Pullup ticket 1816 - requested by adrianp

security update for bind9

Revisions pulled up:
- pkgsrc/net/bind9/Makefile				1.79,1.81-1.82
- pkgsrc/net/bind9/PLIST				1.19
- pkgsrc/net/bind9/distinfo				1.27
- pkgsrc/net/bind9/patches/patch-aa			removed
- pkgsrc/net/bind9/patches/patch-ac			1.6
- pkgsrc/net/bind9/patches/patch-ad			1.6
- pkgsrc/net/bind9/patches/patch-ae			removed
- pkgsrc/net/bind9/patches/patch-af			1.6
- pkgsrc/net/bind9/patches/patch-ah			removed
- pkgsrc/net/bind9/patches/patch-ai			1.7
- pkgsrc/net/bind9/patches/patch-aj			1.4
- pkgsrc/net/bind9/patches/patch-al			1.2
- pkgsrc/net/bind9/patches/patch-am			1.1
- pkgsrc/net/bind9/patches/patch-ao			1.1
- pkgsrc/net/bind9/patches/patch-ap			1.1
- pkgsrc/net/bind9/patches/patch-aq			1.1

   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Thu Aug 17 14:14:18 UTC 2006

   Modified Files:
	pkgsrc/net/bind9: Makefile PLIST distinfo
	pkgsrc/net/bind9/patches: patch-ac patch-ad patch-af patch-ai patch-aj
	    patch-al
   Added Files:
	pkgsrc/net/bind9/patches: patch-am
   Removed Files:
	pkgsrc/net/bind9/patches: patch-aa patch-ae patch-ah

   Log Message:
   Update bind to 9.3.2.

   Changes are huge, so please see http://www.isc.org/sw/bind/bind9.3.php.
---
   Module Name:	pkgsrc
   Committed By:	seb
   Date:		Mon Aug 28 16:00:45 UTC 2006

   Modified Files:
	pkgsrc/net/bind9: Makefile distinfo
   Added Files:
	pkgsrc/net/bind9/patches: patch-an patch-ao

   Log Message:
   Bump PKGREVISION to 1.

   Fix build on NetBSD/sparc64 3.x: sync CPP symbols usage between
   struct addrinfo definition and its usage in getaddrinfo().

   While here define struct addrinfo's pad members the same way as in
   NetBSD's /usr/include/netbsd.h and sync code in
   lib/bind/irs/getaddrinfo.c:getaddrinfo().

   This had been reported to bind9-bugs at isc dot org.
---
   Module Name:	pkgsrc
   Committed By:	rillig
   Date:		Sun Sep  3 22:58:26 UTC 2006

   Modified Files:
	pkgsrc/net/bind9: Makefile

   Log Message:
   Added the relevant variables to BUILD_DEFS.
---
   Module Name:	pkgsrc
   Committed By:	adrianp
   Date:		Tue Sep  5 20:45:32 UTC 2006

   Modified Files:
	pkgsrc/net/bind9: Makefile distinfo
   Added Files:
	pkgsrc/net/bind9/patches: patch-ap patch-aq

   Log Message:
   Fixes for CVE-2006-4095 and CVE-2006-4096 from bind-9.3.2-P1

   * Assertion failure in ISC BIND SIG query processing (CVE-2006-4095)

   - Recursive servers
   Queries for SIG records will trigger an assertion failure if more
   than one RRset is returned. However exposure can be minimized by
   restricting which sources can ask for recursion.

   - Authoritative servers
   If a nameserver is serving a RFC 2535 DNSSEC zone and is queried
   for the SIG records where there are multiple RRsets, then the
   named program will trigger an assertion failure when it tries
   to construct the response.

   * INSIST failure in ISC BIND recursive query handling code (CVE-2006-4096)

   It is possible to trigger an INSIST failure by sending enough
   recursive queries such that the response to the query arrives after
   all the clients waiting for the response have left the recursion
   queue. However exposure can be minimized by restricting which sources
   can ask for recursion.

16 files changed, 386 insertions, 208 deletions

diff --git a/net/bind9/Makefile b/net/bind9/Makefile
index ee538da6006..50b4d73010d 100644
--- a/net/bind9/Makefile
+++ b/net/bind9/Makefile
@@ -1,6 +1,7 @@
-# $NetBSD: Makefile,v 1.78 2006/06/20 13:37:22 abs Exp $
+# $NetBSD: Makefile,v 1.78.2.1 2006/09/07 11:20:43 ghen Exp $
 
 DISTNAME=	bind-${BIND_VERSION}
+PKGREVISION=	2
 CATEGORIES=	net
 MASTER_SITES=	ftp://ftp.isc.org/isc/bind9/${BIND_VERSION}/
 
@@ -8,13 +9,15 @@ MAINTAINER=	pkgsrc-users@NetBSD.org
 HOMEPAGE=	http://www.isc.org/sw/bind/
 COMMENT=	Version 9 of the Berkeley Internet Name Daemon, implementation of DNS
 
-BIND_VERSION=	9.3.1
+BIND_VERSION=	9.3.2
 
 # IPv6 ready, automatically detected
 .include "../../mk/bsd.prefs.mk"
 BUILD_DEFS+=	USE_INET6
 # No need to set USE_INET6, will auto-detect.
 
+BUILD_DEFS+=	BIND_USER BIND_GROUP BIND_DIR VARBASE
+
 USE_LIBTOOL=		yes
 
 GNU_CONFIGURE=	yes
diff --git a/net/bind9/PLIST b/net/bind9/PLIST
index f1440589cc9..c3658a0a0a4 100644
--- a/net/bind9/PLIST
+++ b/net/bind9/PLIST
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.18 2006/06/20 13:37:22 abs Exp $
+@comment $NetBSD: PLIST,v 1.18.2.1 2006/09/07 11:20:43 ghen Exp $
 bin/dig
 bin/host
 bin/isc-config.sh
@@ -92,6 +92,7 @@ include/isc/eventclass.h
 include/isc/file.h
 include/isc/formatcheck.h
 include/isc/fsaccess.h
+include/isc/hash.h
 include/isc/heap.h
 include/isc/hex.h
 include/isc/hmacmd5.h
diff --git a/net/bind9/distinfo b/net/bind9/distinfo
index 0ddd9ea4795..8b8d66f7c72 100644
--- a/net/bind9/distinfo
+++ b/net/bind9/distinfo
@@ -1,16 +1,18 @@
-$NetBSD: distinfo,v 1.26 2006/03/22 16:40:08 joerg Exp $
+$NetBSD: distinfo,v 1.26.4.1 2006/09/07 11:20:43 ghen Exp $
 
-SHA1 (bind-9.3.1.tar.gz) = 99df8014e3b500c4d3a6652ec7b1c3cf7bba6f64
-RMD160 (bind-9.3.1.tar.gz) = 845778c95d7a9a2c46330cac91001ae9a12151e3
-Size (bind-9.3.1.tar.gz) = 4673603 bytes
-SHA1 (patch-aa) = 959fe6c66d54fa93a0191065a5d54007065ca707
+SHA1 (bind-9.3.2.tar.gz) = 13efeaf496ed110980088fb5cbe22460f04a0fac
+RMD160 (bind-9.3.2.tar.gz) = c825b6308eb374e9bcf9b6ccc48f65d8753c0a6d
+Size (bind-9.3.2.tar.gz) = 5302112 bytes
 SHA1 (patch-ab) = dd12c457791a75a8b43d9dfd0c0b236dcdbe31a5
-SHA1 (patch-ac) = 57f0fee92a6c84bf422c6b872eb327b755450557
-SHA1 (patch-ad) = d4a007e641464f3383542b81db4992313e930428
-SHA1 (patch-ae) = 8b562bbbf19eafffbd71ace77f9b26e89d05e272
-SHA1 (patch-af) = 1f9058f0c6893a800d1af52b1daf35b45385a78e
+SHA1 (patch-ac) = 4df1ece91d59b2b36fc7a4316604f1c112cf70ba
+SHA1 (patch-ad) = 0e28ae0bb42e633f1ff1111478c97ced5c222186
+SHA1 (patch-af) = 61725e32bd2d3eb56bfc162ddfb172624e1cfc8e
 SHA1 (patch-ag) = 9d61e0f527a76977bf8457355997d201fa37dd4e
-SHA1 (patch-ah) = b6f6149d5730201c191fa35ba17e14ffc9195f67
-SHA1 (patch-ai) = 7ea8771f7dc1a6752838d7d458cf14c30118a8e4
-SHA1 (patch-aj) = 7422829ca0dc3d411f00628189f059e47350b524
-SHA1 (patch-al) = 606600d8bdb817688a5f3336a39b7348bca2c230
+SHA1 (patch-ai) = fbe3b15b2d49e6767c8cfe9d985924c2ad797b9f
+SHA1 (patch-aj) = c3bbf84a8a735298552f918ac38331e06a1b68a1
+SHA1 (patch-al) = eb6a52d3f865639447ec6f9019c0ea1d2122b772
+SHA1 (patch-am) = bb267f13dbd30d492f4dfcf9c278b941efa97bed
+SHA1 (patch-an) = b3e5cd93890aa9a9cec7c14abf1b62ddbf854b14
+SHA1 (patch-ao) = 8a3f8f1b5871af263fc99bc8e552b3ab615bc815
+SHA1 (patch-ap) = 817c39121f1b62f8033822a42d7d9f8a5b5372ea
+SHA1 (patch-aq) = 20cde9869c69dff2aca4784ec9b8b032639776fe
diff --git a/net/bind9/patches/patch-ac b/net/bind9/patches/patch-ac
index 005d46c74af..2b758c01bf9 100644
--- a/net/bind9/patches/patch-ac
+++ b/net/bind9/patches/patch-ac
@@ -1,10 +1,10 @@
-$NetBSD: patch-ac,v 1.5 2004/10/03 09:20:41 tron Exp $
+$NetBSD: patch-ac,v 1.5.14.1 2006/09/07 11:20:43 ghen Exp $
 
---- lib/lwres/getaddrinfo.c-	2004-05-16 05:03:22.000000000 +0900
-+++ lib/lwres/getaddrinfo.c	2004-05-16 05:04:33.000000000 +0900
+--- lib/lwres/getaddrinfo.c.orig	2005-06-10 08:54:33.000000000 +0900
++++ lib/lwres/getaddrinfo.c
 @@ -30,6 +30,10 @@
- #include <lwres/net.h>
  #include <lwres/netdb.h>
+ #include <lwres/stdlib.h>
  
 +#ifdef __KAME__
 +#include <net/if.h>
@@ -13,7 +13,7 @@ $NetBSD: patch-ac,v 1.5 2004/10/03 09:20:41 tron Exp $
  #define SA(addr)	((struct sockaddr *)(addr))
  #define SIN(addr)	((struct sockaddr_in *)(addr))
  #define SIN6(addr)	((struct sockaddr_in6 *)(addr))
-@@ -252,14 +256,22 @@
+@@ -252,14 +256,22 @@ lwres_getaddrinfo(const char *hostname, 
  			p = strchr(ntmp, '%');
  			ep = NULL;
  
diff --git a/net/bind9/patches/patch-ad b/net/bind9/patches/patch-ad
index 20f11f1be1e..de16013c911 100644
--- a/net/bind9/patches/patch-ad
+++ b/net/bind9/patches/patch-ad
@@ -1,8 +1,8 @@
-$NetBSD: patch-ad,v 1.5 2006/03/22 16:40:08 joerg Exp $
+$NetBSD: patch-ad,v 1.5.4.1 2006/09/07 11:20:43 ghen Exp $
 
---- configure-	2004-05-16 05:05:10.000000000 +0900
-+++ configure	2004-05-16 05:08:20.000000000 +0900
-@@ -5480,6 +5480,8 @@ case $host in
+--- configure.orig	2005-10-21 08:57:38.000000000 +0900
++++ configure
+@@ -5546,6 +5546,8 @@ case $host in
  	use_threads=false ;;
  *-freebsd*)
  	use_threads=false ;;
@@ -11,7 +11,16 @@ $NetBSD: patch-ad,v 1.5 2006/03/22 16:40:08 joerg Exp $
  *-bsdi234*)
  	# Thread signals do not work reliably on some versions of BSD/OS.
  	use_threads=false ;;
-@@ -5579,14 +5581,22 @@ echo "$as_me: error: \"could not find th
+@@ -5634,7 +5636,7 @@ echo "$as_me: WARNING: linking with PTL2
+ echo "${ECHO_T}native" >&6
+ 				LIBS="-lpthread $LIBS"
+ 			else
+-				if test ! -d $LOCALBASE/pthreads
++				if test ! -d $LOCALBASE/pthreads -a ! -f /usr/include/pthread.h
+ 				then
+ 					echo "$as_me:$LINENO: result: none" >&5
+ echo "${ECHO_T}none" >&6
+@@ -5645,14 +5647,23 @@ echo "$as_me: error: \"could not find th
  
  				if $use_threads
  				then
@@ -23,15 +32,16 @@ $NetBSD: patch-ad,v 1.5 2006/03/22 16:40:08 joerg Exp $
 -					LIBS="$lib1 $lib2 $LIBS"
 -					CPPFLAGS="$CPPFLAGS -I$pkg/include"
 -					STD_CINCLUDES="$STD_CINCLUDES -I$pkg/include"
-+					if test -f /usr/include/pthreads.h
++					if test -f /usr/include/pthread.h
 +					then
-+						echo "$as_me:$LINENO: result: native pthreads" >&5
++						{ echo "$as_me:$LINENO: result: native pthreads" >&5
++echo "${ECHO_T}native pthreads" >&6; }
 +						LIBS="-lpthread $LIBS"
-+						CPPFLAGS="$CPPFLAGS -I/usr/include"
-+						STD_CINCLUDES="$STD_CINCLUDES -I/usr/include"
++						CPPFLAGS="$CPPFLAGS -I/usr/inclue"
++						STD_CINDLUES="$STD_CINDLUES -I/usr/include"
 +					else
-+						echo "$as_me:$LINENO: result: mit-pthreads/unproven-pthreads" >&5
-+	echo "${ECHO_T}mit-pthreads/unproven-pthreads" >&6
++						{ echo "$as_me:$LINENO: result: mit-pthreads/unproven-pthreads" >&5
++echo "${ECHO_T}mit-pthreads/unproven-pthreads" >&6; }
 +						pkg="$LOCALBASE/pthreads"
 +						lib1="-L$pkg/lib -Wl,-R$pkg/lib"
 +						lib2="-lpthread -lm -lgcc -lpthread"
@@ -42,14 +52,3 @@ $NetBSD: patch-ad,v 1.5 2006/03/22 16:40:08 joerg Exp $
  				fi
  			fi
  		fi
-@@ -6727,6 +6737,10 @@ fi
- 			CCOPT="$CCOPT -pthread"
- 			STD_CDEFINES="$STD_CDEFINES -D_THREAD_SAFE"
- 			;;
-+		*-dragonfly*)
-+			CC="$CC -pthread"
-+			CCOPT="$CCOPT -pthread"
-+			;;
- 		*-openbsd*)
- 			CC="$CC -pthread"
- 			CCOPT="$CCOPT -pthread"
diff --git a/net/bind9/patches/patch-ae b/net/bind9/patches/patch-ae
deleted file mode 100644
index 80ef22cc536..00000000000
--- a/net/bind9/patches/patch-ae
+++ /dev/null
@@ -1,72 +0,0 @@
-$NetBSD: patch-ae,v 1.5 2006/03/22 16:40:08 joerg Exp $
-
---- lib/bind/configure.orig	2004-02-24 11:32:40.000000000 +0900
-+++ lib/bind/configure	2004-05-16 05:09:21.000000000 +0900
-@@ -4497,7 +4497,8 @@
- echo "$as_me: WARNING: linking with PTL2 is highly experimental and not expected to work" >&2;}
- 			CC=ptlgcc
- 		else
--			if test ! -d $LOCALBASE/pthreads
-+			if test ! -d $LOCALBASE/pthreads \
-+				-a ! -f /usr/include/pthread.h
- 			then
- 				echo "$as_me:$LINENO: result: none" >&5
- echo "${ECHO_T}none" >&6
-@@ -4506,14 +4507,23 @@
- 
- 			if $use_threads
- 			then
--				echo "$as_me:$LINENO: result: mit-pthreads/unproven-pthreads" >&5
-+				if test -f /usr/include/pthread.h
-+				then
-+					echo "$as_me:$LINENO: result: native pthreads" >&5
-+echo "${ECHO_T}native pthreads" >&6
-+					LIBS="-lpthread $LIBS"
-+					CPPFLAGS="$CPPFLAGS -I/usr/include"
-+					STD_CINCLUDES="$STD_CINCLUDES -I/usr/include"
-+				else
-+					echo "$as_me:$LINENO: result: mit-pthreads/unproven-pthreads" >&5
- echo "${ECHO_T}mit-pthreads/unproven-pthreads" >&6
--				pkg="$LOCALBASE/pthreads"
--				lib1="-L$pkg/lib -Wl,-R$pkg/lib"
--				lib2="-lpthread -lm -lgcc -lpthread"
--				LIBS="$lib1 $lib2 $LIBS"
--				CPPFLAGS="$CPPFLAGS -I$pkg/include"
--				STD_CINCLUDES="$STD_CINCLUDES -I$pkg/include"
-+					pkg="$LOCALBASE/pthreads"
-+					lib1="-L$pkg/lib -Wl,-R$pkg/lib"
-+					lib2="-lpthread -lm -lgcc -lpthread"
-+					LIBS="$lib1 $lib2 $LIBS"
-+					CPPFLAGS="$CPPFLAGS -I$pkg/include"
-+					STD_CINCLUDES="$STD_CINCLUDES -I$pkg/include"
-+				fi
- 			fi
- 		fi
- 		;;
-@@ -5577,6 +5577,10 @@ fi
- 			CCOPT="$CCOPT -pthread"
- 			STD_CDEFINES="$STD_CDEFINES -D_THREAD_SAFE"
- 			;;
-+		*-dragonfly*)
-+			CC="$CC -pthread"
-+			CCOPT="$CCOPT -pthread"
-+			;;
- 		*-openbsd*)
- 			CC="$CC -pthread"
- 			CCOPT="$CCOPT -pthread"
-@@ -22995,6 +22999,7 @@ case "$host" in
- 	*-bsdi2345*)	have_minimum_ifreq=yes;;
- 	*-darwin*)	have_minimum_ifreq=yes;;
- 	*-freebsd*)	have_minimum_ifreq=yes;;
-+	*-drgonfly*)	have_minimum_ifreq=yes;;
- 	*-lynxos*)	have_minimum_ifreq=yes;;
- 	*-netbsd*)	have_minimum_ifreq=yes;;
- 	*-next*)	have_minimum_ifreq=yes;;
-@@ -23028,6 +23033,7 @@ case "$host" in
- 	*-darwin*)	PORT_DIR="port/darwin";;
- 	*-osf*)		PORT_DIR="port/decunix";;
- 	*-freebsd*)	PORT_DIR="port/freebsd";;
-+	*-dragonfly*)	PORT_DIR="port/freebsd";;
- 	*-hpux9*)	PORT_DIR="port/hpux9";;
- 	*-hpux10*)	PORT_DIR="port/hpux10";;
- 	*-hpux11*)	PORT_DIR="port/hpux";;
diff --git a/net/bind9/patches/patch-af b/net/bind9/patches/patch-af
index d2f645435f5..8024164610f 100644
--- a/net/bind9/patches/patch-af
+++ b/net/bind9/patches/patch-af
@@ -1,43 +1,45 @@
-$NetBSD: patch-af,v 1.5 2004/10/03 09:20:41 tron Exp $
+$NetBSD: patch-af,v 1.5.14.1 2006/09/07 11:20:43 ghen Exp $
 
---- lib/bind/configure.in.orig	2004-03-15 10:02:44.000000000 +0900
-+++ lib/bind/configure.in	2004-05-16 05:09:55.000000000 +0900
-@@ -367,7 +367,8 @@
- [linking with PTL2 is highly experimental and not expected to work])
- 			CC=ptlgcc
- 		else
--			if test ! -d $LOCALBASE/pthreads
-+			if test ! -d $LOCALBASE/pthreads \
-+				-a ! -f /usr/include/pthread.h
- 			then
- 				AC_MSG_RESULT(none)
- 				use_threads=false
-@@ -375,13 +376,21 @@
- 
- 			if $use_threads
- 			then
--				AC_MSG_RESULT(mit-pthreads/unproven-pthreads)
--				pkg="$LOCALBASE/pthreads"
--				lib1="-L$pkg/lib -Wl,-R$pkg/lib"
--				lib2="-lpthread -lm -lgcc -lpthread"
--				LIBS="$lib1 $lib2 $LIBS"
--				CPPFLAGS="$CPPFLAGS -I$pkg/include"
--				STD_CINCLUDES="$STD_CINCLUDES -I$pkg/include"
-+				if test -f /usr/include/pthread.h
-+				then
-+					AC_MSG_RESULT(native pthreads)
-+					LIBS="-lpthread $LIBS"
-+					CPPFLAGS="$CPPFLAGS -I/usr/include"
-+					STD_CINCLUDES="$STD_CINCLUDES -I/usr/include"
-+				else
-+					AC_MSG_RESULT(mit-pthreads/unproven-pthreads)
-+					pkg="$LOCALBASE/pthreads"
-+					lib1="-L$pkg/lib -Wl,-R$pkg/lib"
-+					lib2="-lpthread -lm -lgcc -lpthread"
-+					LIBS="$lib1 $lib2 $LIBS"
-+					CPPFLAGS="$CPPFLAGS -I$pkg/include"
-+					STD_CINCLUDES="$STD_CINCLUDES -I$pkg/include"
-+				fi
- 			fi
- 		fi
+--- lib/bind/configure.in.orig	2005-10-14 10:38:46.000000000 +0900
++++ lib/bind/configure.in
+@@ -82,12 +82,7 @@ AC_SUBST(PERL)
+ #
+ case "$includedir" in
+ 	'${prefix}/include')
+-		includedir='${prefix}/bind/include'
+-		;;
+-esac
+-case "$libdir" in
+-	'${prefix}/lib')
+-		libdir='${prefix}/bind/lib'
++		includedir='${prefix}/include/bind'
  		;;
+ esac
+ 
+@@ -395,6 +390,10 @@ then
+ 			CCOPT="$CCOPT -pthread"
+ 			STD_CDEFINES="$STD_CDEFINES -D_THREAD_SAFE"
+ 			;;
++		*-dragonfly*)
++			CC="$CC -pthread"
++			CCOPT="$CCOPT -pthread"
++			;;
+ 		*-openbsd*)
+ 			CC="$CC -pthread"
+ 			CCOPT="$CCOPT -pthread"
+@@ -985,6 +984,7 @@ case "$host" in
+ 	*-bsdi[2345]*)	have_minimum_ifreq=yes;;
+ 	*-darwin*)	have_minimum_ifreq=yes;;
+ 	*-freebsd*)	have_minimum_ifreq=yes;;
++	*-drgonfly*)	have_minimum_ifreq=yes;;
+ 	*-lynxos*)	have_minimum_ifreq=yes;;
+ 	*-netbsd*)	have_minimum_ifreq=yes;;
+ 	*-next*)	have_minimum_ifreq=yes;;
+@@ -1024,6 +1024,7 @@ case "$host" in
+ 	*-darwin*)	PORT_DIR="port/darwin";;
+ 	*-osf*)		PORT_DIR="port/decunix";;
+ 	*-freebsd*)	PORT_DIR="port/freebsd";;
++	*-dragonfly*)	PORT_DIR="port/freebsd";;
+ 	*-hpux9*)	PORT_DIR="port/hpux9";;
+ 	*-hpux10*)	PORT_DIR="port/hpux10";;
+ 	*-hpux11*)	PORT_DIR="port/hpux";;
diff --git a/net/bind9/patches/patch-ah b/net/bind9/patches/patch-ah
deleted file mode 100644
index 4c52064a0c4..00000000000
--- a/net/bind9/patches/patch-ah
+++ /dev/null
@@ -1,27 +0,0 @@
-$NetBSD: patch-ah,v 1.6 2005/03/15 15:50:04 tron Exp $
-
---- lib/bind/configure.in.orig	Tue Apr  6 15:49:26 2004
-+++ lib/bind/configure.in	Tue Apr  6 15:50:11 2004
-@@ -81,16 +81,16 @@
- # isc/list.h and others clash with the rest of BIND 9
- #
- case "$includedir" in
- 	'${prefix}/include')
--		includedir='${prefix}/bind/include'
--		;;
--esac
--case "$libdir" in
--	'${prefix}/lib')
--		libdir='${prefix}/bind/lib'
-+		includedir='${prefix}/include/bind'
- 		;;
- esac
-+#case "$libdir" in
-+#	'${prefix}/lib')
-+#		libdir='${prefix}/bind/lib'
-+#		;;
-+#esac
- 
- #
- # Make sure INSTALL uses an absolute path, else it will be wrong in all
- # Makefiles, since they use make/rules.in and INSTALL will be adjusted by
diff --git a/net/bind9/patches/patch-ai b/net/bind9/patches/patch-ai
index 9e62738f97c..9fdad059575 100644
--- a/net/bind9/patches/patch-ai
+++ b/net/bind9/patches/patch-ai
@@ -1,9 +1,8 @@
-$NetBSD: patch-ai,v 1.6 2005/03/15 15:50:04 tron Exp $
+$NetBSD: patch-ai,v 1.6.12.1 2006/09/07 11:20:43 ghen Exp $
 
---- lib/bind/configure.orig	Tue Apr  6 16:25:51 2004
-+++ lib/bind/configure	Tue Apr  6 16:26:15 2004
-@@ -1822,16 +1822,16 @@
- # isc/list.h and others clash with the rest of BIND 9
+--- lib/bind/configure.orig	2005-10-14 10:44:50.000000000 +0900
++++ lib/bind/configure
+@@ -1960,12 +1960,7 @@ done
  #
  case "$includedir" in
  	'${prefix}/include')
@@ -16,12 +15,81 @@ $NetBSD: patch-ai,v 1.6 2005/03/15 15:50:04 tron Exp $
 +		includedir='${prefix}/include/bind'
  		;;
  esac
-+#case "$libdir" in
-+#	'${prefix}/lib')
-+#		libdir='${prefix}/bind/lib'
-+#		;;
-+#esac
  
- #
- # Make sure INSTALL uses an absolute path, else it will be wrong in all
- # Makefiles, since they use make/rules.in and INSTALL will be adjusted by
+@@ -4547,6 +4542,8 @@ case $host in
+ 	use_threads=false ;;
+ *-freebsd*)
+ 	use_threads=false ;;
++*-dragonfly*)
++	use_threads=false ;;
+ *-bsdi234*)
+ 	# Thread signals do not work reliably on some versions of BSD/OS.
+ 	use_threads=false ;;
+@@ -4635,7 +4632,7 @@ echo "$as_me: WARNING: linking with PTL2
+ echo "${ECHO_T}native" >&6
+ 				LIBS="-lpthread $LIBS"
+ 			else
+-				if test ! -d $LOCALBASE/pthreads
++				if test ! -d $LOCALBASE/pthreads -a ! -f /usr/include/pthread.h
+ 				then
+ 					echo "$as_me:$LINENO: result: none" >&5
+ echo "${ECHO_T}none" >&6
+@@ -4646,14 +4643,23 @@ echo "$as_me: error: \"could not find th
+ 
+ 				if $use_threads
+ 				then
+-					echo "$as_me:$LINENO: result: mit-pthreads/unproven-pthreads" >&5
+-echo "${ECHO_T}mit-pthreads/unproven-pthreads" >&6
+-					pkg="$LOCALBASE/pthreads"
+-					lib1="-L$pkg/lib -Wl,-R$pkg/lib"
+-					lib2="-lpthread -lm -lgcc -lpthread"
+-					LIBS="$lib1 $lib2 $LIBS"
+-					CPPFLAGS="$CPPFLAGS -I$pkg/include"
+-					STD_CINCLUDES="$STD_CINCLUDES -I$pkg/include"
++					if test -f /usr/include/pthread.h
++					then
++						{ echo "$as_me:$LINENO: result: native pthreads" >&5
++echo "${ECHO_T}native pthreads" >&6; }
++						LIBS="-lpthread $LIBS"
++						CPPFLAGS="$CPPFLAGS -I/usr/inclue"
++						STD_CINDLUES="$STD_CINDLUES -I/usr/include"
++					else
++						{ echo "$as_me:$LINENO: result: mit-pthreads/unproven-pthreads" >&5
++echo "${ECHO_T}mit-pthreads/unproven-pthreads" >&6; }
++						pkg="$LOCALBASE/pthreads"
++						lib1="-L$pkg/lib -Wl,-R$pkg/lib"
++						lib2="-lpthread -lm -lgcc -lpthread"
++						LIBS="$lib1 $lib2 $LIBS"
++						CPPFLAGS="$CPPFLAGS -I$pkg/include"
++						STD_CINCLUDES="$STD_CINCLUDES -I$pkg/include"
++					fi
+ 				fi
+ 			fi
+ 		fi
+@@ -5714,6 +5720,10 @@ fi
+ 			CCOPT="$CCOPT -pthread"
+ 			STD_CDEFINES="$STD_CDEFINES -D_THREAD_SAFE"
+ 			;;
++		*-dragonfly*)
++			CC="$CC -pthread"
++			CCOPT="$CCOPT -pthread"
++			;;
+ 		*-openbsd*)
+ 			CC="$CC -pthread"
+ 			CCOPT="$CCOPT -pthread"
+@@ -23291,6 +23301,7 @@ case "$host" in
+ 	*-bsdi2345*)	have_minimum_ifreq=yes;;
+ 	*-darwin*)	have_minimum_ifreq=yes;;
+ 	*-freebsd*)	have_minimum_ifreq=yes;;
++	*-drgonfly*)	have_minimum_ifreq=yes;;
+ 	*-lynxos*)	have_minimum_ifreq=yes;;
+ 	*-netbsd*)	have_minimum_ifreq=yes;;
+ 	*-next*)	have_minimum_ifreq=yes;;
+@@ -23330,6 +23341,7 @@ case "$host" in
+ 	*-darwin*)	PORT_DIR="port/darwin";;
+ 	*-osf*)		PORT_DIR="port/decunix";;
+ 	*-freebsd*)	PORT_DIR="port/freebsd";;
++	*-dragonfly*)	PORT_DIR="port/freebsd";;
+ 	*-hpux9*)	PORT_DIR="port/hpux9";;
+ 	*-hpux10*)	PORT_DIR="port/hpux10";;
+ 	*-hpux11*)	PORT_DIR="port/hpux";;
diff --git a/net/bind9/patches/patch-aj b/net/bind9/patches/patch-aj
index 420f304ffc7..18e50351b3c 100644
--- a/net/bind9/patches/patch-aj
+++ b/net/bind9/patches/patch-aj
@@ -1,8 +1,8 @@
-$NetBSD: patch-aj,v 1.3 2004/10/03 09:20:41 tron Exp $
+$NetBSD: patch-aj,v 1.3.14.1 2006/09/07 11:20:43 ghen Exp $
 
 --- lib/Makefile.in.orig	2004-03-08 18:04:25.000000000 +0900
-+++ lib/Makefile.in	2004-05-16 05:11:57.000000000 +0900
-@@ -23,7 +23,7 @@
++++ lib/Makefile.in
+@@ -23,7 +23,7 @@ top_srcdir =	@top_srcdir@
  # Attempt to disable parallel processing.
  .NOTPARALLEL:
  .NO_PARALLEL:
diff --git a/net/bind9/patches/patch-al b/net/bind9/patches/patch-al
index b2b2ce15d8b..92388682173 100644
--- a/net/bind9/patches/patch-al
+++ b/net/bind9/patches/patch-al
@@ -1,8 +1,8 @@
-$NetBSD: patch-al,v 1.1 2004/10/03 09:20:41 tron Exp $
+$NetBSD: patch-al,v 1.1.14.1 2006/09/07 11:20:43 ghen Exp $
 
---- lib/bind/port_after.h.in.orig	2003-06-27 05:51:35.000000000 +0200
-+++ lib/bind/port_after.h.in	2004-05-18 08:15:19.000000000 +0200
-@@ -361,7 +361,7 @@
+--- lib/bind/port_after.h.in.orig	2005-10-11 09:48:14.000000000 +0900
++++ lib/bind/port_after.h.in
+@@ -376,7 +376,7 @@ int setpassent(int stayopen);
  #define gettimeofday isc__gettimeofday
  #ifdef NEED_GETTIMEOFDAY
  int isc__gettimeofday(struct timeval *tvp, struct _TIMEZONE *tzp);
diff --git a/net/bind9/patches/patch-aa b/net/bind9/patches/patch-am
index f1f145e3abd..bdcb560ec2d 100644
--- a/net/bind9/patches/patch-aa
+++ b/net/bind9/patches/patch-am
@@ -1,8 +1,17 @@
-$NetBSD: patch-aa,v 1.8 2004/10/03 09:20:41 tron Exp $
+$NetBSD: patch-am,v 1.1.2.2 2006/09/07 11:20:44 ghen Exp $
 
---- configure.in-	2004-05-16 04:58:44.000000000 +0900
-+++ configure.in	2004-05-16 05:00:43.000000000 +0900
-@@ -684,7 +684,7 @@
+--- config.threads.in.orig	2005-03-16 07:59:16.000000000 +0900
++++ config.threads.in
+@@ -48,6 +48,8 @@ case $host in
+ 	use_threads=false ;;
+ *-freebsd*)
+ 	use_threads=false ;;
++*-dragonfly*)
++	use_threads=false ;;
+ *-bsdi[234]*)
+ 	# Thread signals do not work reliably on some versions of BSD/OS.
+ 	use_threads=false ;;
+@@ -121,7 +123,7 @@ then
  				AC_MSG_RESULT(native)
  				LIBS="-lpthread $LIBS"
  			else
@@ -11,7 +20,7 @@ $NetBSD: patch-aa,v 1.8 2004/10/03 09:20:41 tron Exp $
  				then
  					AC_MSG_RESULT(none)
  					AC_MSG_ERROR("could not find thread libraries")
-@@ -692,13 +692,20 @@
+@@ -129,13 +131,21 @@ then
  
  				if $use_threads
  				then
@@ -23,6 +32,7 @@ $NetBSD: patch-aa,v 1.8 2004/10/03 09:20:41 tron Exp $
 -					CPPFLAGS="$CPPFLAGS -I$pkg/include"
 -					STD_CINCLUDES="$STD_CINCLUDES -I$pkg/include"
 +					if test -f /usr/include/pthread.h
++					then
 +						AC_MSG_RESULT(native pthreads)
 +						LIBS="-lpthread $LIBS"
 +						CPPFLAGS="$CPPFLAGS -I/usr/inclue"
diff --git a/net/bind9/patches/patch-an b/net/bind9/patches/patch-an
new file mode 100644
index 00000000000..94b554a5b2d
--- /dev/null
+++ b/net/bind9/patches/patch-an
@@ -0,0 +1,22 @@
+$NetBSD: patch-an,v 1.1.2.2 2006/09/07 11:20:44 ghen Exp $
+
+--- lib/bind/include/netdb.h.orig	2004-11-30 01:15:42.000000000 +0000
++++ lib/bind/include/netdb.h
+@@ -179,9 +179,17 @@ struct	addrinfo {
+ 	int		_ai_pad;
+ #endif
+ 	socklen_t	ai_addrlen;
++#elif defined(__NetBSD__)
++#if defined(__sparc__) && defined(_LP64)
++	int		_ai_pad;
++#endif
++	socklen_t	ai_addrlen;
+ #else
+ 	size_t		ai_addrlen;	/* length of ai_addr */
+ #endif
++#if defined(__NetBSD__) && (defined(__alpha__) || (defined(__i386__) && defined(_LP64)))
++	int		_ai_pad;
++#endif
+ #ifdef __linux
+ 	struct sockaddr	*ai_addr; 	/* binary address */
+ 	char		*ai_canonname;	/* canonical name for hostname */
diff --git a/net/bind9/patches/patch-ao b/net/bind9/patches/patch-ao
new file mode 100644
index 00000000000..92c61515303
--- /dev/null
+++ b/net/bind9/patches/patch-ao
@@ -0,0 +1,22 @@
+$NetBSD: patch-ao,v 1.1.2.2 2006/09/07 11:20:44 ghen Exp $
+
+--- lib/bind/irs/getaddrinfo.c.orig	2005-07-28 07:43:19.000000000 +0000
++++ lib/bind/irs/getaddrinfo.c
+@@ -332,7 +332,7 @@ getaddrinfo(hostname, servname, hints, r
+ 	pai->ai_family = PF_UNSPEC;
+ 	pai->ai_socktype = ANY;
+ 	pai->ai_protocol = ANY;
+-#ifdef __sparcv9
++#if (defined(sun) && defined(_SOCKLEN_T) && defined(__sparc9)) || (defined(__NetBSD__) && (((defined(__sparc__) || defined(__i386__)) && defined(_LP64)) || defined(__alpha__)))
+ 	/*
+ 	 * clear _ai_pad to preserve binary
+ 	 * compatibility with previously compiled 64-bit
+@@ -365,7 +365,7 @@ getaddrinfo(hostname, servname, hints, r
+ 		}
+ 		memcpy(pai, hints, sizeof(*pai));
+ 
+-#ifdef __sparcv9
++#if (defined(sun) && defined(_SOCKLEN_T) && defined(__sparc9)) || (defined(__NetBSD__) && (((defined(__sparc__) || defined(__i386__)) && defined(_LP64)) || defined(__alpha__)))
+ 		/*
+ 		 * We need to clear _ai_pad to preserve binary
+ 		 * compatibility.  See prior comment.
diff --git a/net/bind9/patches/patch-ap b/net/bind9/patches/patch-ap
new file mode 100644
index 00000000000..6cf6b3f6b18
--- /dev/null
+++ b/net/bind9/patches/patch-ap
@@ -0,0 +1,22 @@
+$NetBSD: patch-ap,v 1.1.2.2 2006/09/07 11:20:44 ghen Exp $
+
+--- bin/named/query.c.orig	2005-08-11 06:25:20.000000000 +0100
++++ bin/named/query.c
+@@ -2393,7 +2393,7 @@ query_find(ns_client_t *client, dns_fetc
+ 		is_zone = ISC_FALSE;
+ 
+ 		qtype = event->qtype;
+-		if (qtype == dns_rdatatype_rrsig)
++		if (qtype == dns_rdatatype_rrsig || qtype == dns_rdatatype_sig)
+ 			type = dns_rdatatype_any;
+ 		else
+ 			type = qtype;
+@@ -2434,7 +2434,7 @@ query_find(ns_client_t *client, dns_fetc
+ 	/*
+ 	 * If it's a SIG query, we'll iterate the node.
+ 	 */
+-	if (qtype == dns_rdatatype_rrsig)
++	if (qtype == dns_rdatatype_rrsig || qtype == dns_rdatatype_sig)
+ 		type = dns_rdatatype_any;
+ 	else
+ 		type = qtype;
diff --git a/net/bind9/patches/patch-aq b/net/bind9/patches/patch-aq
new file mode 100644
index 00000000000..88674501ffc
--- /dev/null
+++ b/net/bind9/patches/patch-aq
@@ -0,0 +1,126 @@
+$NetBSD: patch-aq,v 1.1.2.2 2006/09/07 11:20:44 ghen Exp $
+
+--- lib/dns/resolver.c.orig	2005-10-14 02:38:48.000000000 +0100
++++ lib/dns/resolver.c
+@@ -762,7 +762,8 @@ fctx_sendevents(fetchctx_t *fctx, isc_re
+ 		INSIST(result != ISC_R_SUCCESS ||
+ 		       dns_rdataset_isassociated(event->rdataset) ||
+ 		       fctx->type == dns_rdatatype_any ||
+-		       fctx->type == dns_rdatatype_rrsig);
++		       fctx->type == dns_rdatatype_rrsig ||
++		       fctx->type == dns_rdatatype_sig);
+ 
+ 		isc_task_sendanddetach(&task, ISC_EVENT_PTR(&event));
+ 	}
+@@ -3188,7 +3189,8 @@ validated(isc_task_t *task, isc_event_t 
+ 	if (hevent != NULL) {
+ 		if (!negative && !chaining &&
+ 		    (fctx->type == dns_rdatatype_any ||
+-		     fctx->type == dns_rdatatype_rrsig)) {
++		     fctx->type == dns_rdatatype_rrsig ||
++		     fctx->type == dns_rdatatype_sig)) {
+ 			/*
+ 			 * Don't bind rdatasets; the caller
+ 			 * will iterate the node.
+@@ -3306,7 +3308,8 @@ validated(isc_task_t *task, isc_event_t 
+ 	if (!ISC_LIST_EMPTY(fctx->validators)) {
+ 		INSIST(!negative);
+ 		INSIST(fctx->type == dns_rdatatype_any ||
+-		       fctx->type == dns_rdatatype_rrsig);
++		       fctx->type == dns_rdatatype_rrsig ||
++		       fctx->type == dns_rdatatype_sig);
+ 		/*
+ 		 * Don't send a response yet - we have
+ 		 * more rdatasets that still need to
+@@ -3455,14 +3458,15 @@ cache_name(fetchctx_t *fctx, dns_name_t 
+ 				return (result);
+ 			anodep = &event->node;
+ 			/*
+-			 * If this is an ANY or SIG query, we're not going
+-			 * to return any rdatasets, unless we encountered
++			 * If this is an ANY, SIG or RRSIG query, we're not
++			 * going to return any rdatasets, unless we encountered
+ 			 * a CNAME or DNAME as "the answer".  In this case,
+ 			 * we're going to return DNS_R_CNAME or DNS_R_DNAME
+ 			 * and we must set up the rdatasets.
+ 			 */
+ 			if ((fctx->type != dns_rdatatype_any &&
+-			    fctx->type != dns_rdatatype_rrsig) ||
++			     fctx->type != dns_rdatatype_rrsig &&
++			     fctx->type != dns_rdatatype_sig) ||
+ 			    (name->attributes & DNS_NAMEATTR_CHAINING) != 0) {
+ 				ardataset = event->rdataset;
+ 				asigrdataset = event->sigrdataset;
+@@ -3521,7 +3525,7 @@ cache_name(fetchctx_t *fctx, dns_name_t 
+ 		 */
+ 		if (secure_domain && rdataset->trust != dns_trust_glue) {
+ 			/*
+-			 * SIGs are validated as part of validating the
++			 * RRSIGs are validated as part of validating the
+ 			 * type they cover.
+ 			 */
+ 			if (rdataset->type == dns_rdatatype_rrsig)
+@@ -3591,7 +3595,8 @@ cache_name(fetchctx_t *fctx, dns_name_t 
+ 
+ 			if (ANSWER(rdataset) && need_validation) {
+ 				if (fctx->type != dns_rdatatype_any &&
+-				    fctx->type != dns_rdatatype_rrsig) {
++				    fctx->type != dns_rdatatype_rrsig &&
++				    fctx->type != dns_rdatatype_sig) {
+ 					/*
+ 					 * This is The Answer.  We will
+ 					 * validate it, but first we cache
+@@ -3763,23 +3768,28 @@ ncache_adderesult(dns_message_t *message
+ 		  isc_result_t *eresultp)
+ {
+ 	isc_result_t result;
++	dns_rdataset_t rdataset;
++
++	if (ardataset == NULL) {
++		dns_rdataset_init(&rdataset);
++		ardataset = &rdataset;
++	}
+ 	result = dns_ncache_add(message, cache, node, covers, now,
+ 				maxttl, ardataset);
+-	if (result == DNS_R_UNCHANGED) {
++	if (result == DNS_R_UNCHANGED || result == ISC_R_SUCCESS) {
+ 		/*
+-		 * The data in the cache are better than the negative cache
+-		 * entry we're trying to add.
++		 * If the cache now contains a negative entry and we
++		 * care about whether it is DNS_R_NCACHENXDOMAIN or
++		 * DNS_R_NCACHENXRRSET then extract it.
+ 		 */
+-		if (ardataset != NULL && ardataset->type == 0) {
++		if (ardataset->type == 0) {
+ 			/*
+-			 * The cache data is also a negative cache
+-			 * entry.
++			 * The cache data is a negative cache entry.
+ 			 */
+ 			if (NXDOMAIN(ardataset))
+ 				*eresultp = DNS_R_NCACHENXDOMAIN;
+ 			else
+ 				*eresultp = DNS_R_NCACHENXRRSET;
+-			result = ISC_R_SUCCESS;
+ 		} else {
+ 			/*
+ 			 * Either we don't care about the nature of the
+@@ -3791,14 +3801,11 @@ ncache_adderesult(dns_message_t *message
+ 			 * XXXRTH  There's a CNAME/DNAME problem here.
+ 			 */
+ 			*eresultp = ISC_R_SUCCESS;
+-			result = ISC_R_SUCCESS;
+ 		}
+-	} else if (result == ISC_R_SUCCESS) {
+-		if (NXDOMAIN(ardataset))
+-			*eresultp = DNS_R_NCACHENXDOMAIN;
+-		else
+-			*eresultp = DNS_R_NCACHENXRRSET;
++		result = ISC_R_SUCCESS;
+ 	}
++	if (ardataset == &rdataset && dns_rdataset_isassociated(ardataset))
++		dns_rdataset_disassociate(ardataset);
+ 
+ 	return (result);
+ }