Pullup ticket #4872 - requested by taca

net/bind910: security fix

Revisions pulled up:
- net/bind910/Makefile                                          1.13-1.14
- net/bind910/distinfo                                          1.12-1.13
- net/bind910/patches/patch-bin_dig_dighost.c                   1.3
- net/bind910/patches/patch-bin_tests_system_Makefile.in        1.3
- net/bind910/patches/patch-configure                           1.4

---
   Module Name:    pkgsrc
   Committed By:   taca
   Date:           Sun Dec 13 17:35:22 UTC 2015

   Modified Files:
           pkgsrc/net/bind910: Makefile distinfo
           pkgsrc/net/bind910/patches: patch-bin_dig_dighost.c
               patch-bin_tests_system_Makefile.in patch-configure

   Log Message:
   Update bind910 to 9.10.3.

   Security Fixes

        * An incorrect boundary check in the OPENPGPKEY rdatatype could
          trigger an assertion failure. This flaw is disclosed in
          CVE-2015-5986. [RT #40286]
        * A buffer accounting error could trigger an assertion failure when
          parsing certain malformed DNSSEC keys.
          This flaw was discovered by Hanno Böck of the Fuzzing Project, and
          is disclosed in CVE-2015-5722. [RT #40212]
        * A specially crafted query could trigger an assertion failure in
          message.c.
          This flaw was discovered by Jonathan Foote, and is disclosed in
          CVE-2015-5477. [RT #40046]
        * On servers configured to perform DNSSEC validation, an assertion
          failure could be triggered on answers from a specially configured
          server.
          This flaw was discovered by Breno Silveira Soares, and is disclosed
          in CVE-2015-4620. [RT #39795]

   New Features

        * New quotas have been added to limit the queries that are sent by
          recursive resolvers to authoritative servers experiencing
          denial-of-service attacks. When configured, these options can both
          reduce the harm done to authoritative servers and also avoid the
          resource exhaustion that can be experienced by recursives when they
          are being used as a vehicle for such an attack.
          NOTE: These options are not available by default; use configure
          --enable-fetchlimit to include them in the build.
             + fetches-per-server limits the number of simultaneous queries
               that can be sent to any single authoritative server. The
               configured value is a starting point; it is automatically
               adjusted downward if the server is partially or completely
               non-responsive. The algorithm used to adjust the quota can be
               configured via the fetch-quota-params option.
             + fetches-per-zone limits the number of simultaneous queries
               that can be sent for names within a single domain. (Note:
               Unlike "fetches-per-server", this value is not self-tuning.)
          Statistics counters have also been added to track the number of
          queries affected by these quotas.
        * dig +ednsflags can now be used to set yet-to-be-defined EDNS flags
          in DNS requests.
        * dig +[no]ednsnegotiation can now be used enable / disable EDNS
          version negotiation.
        * An --enable-querytrace configure switch is now available to enable
          very verbose query tracelogging. This option can only be set at
          compile time. This option has a negative performance impact and
          should be used only for debugging.

   Feature Changes

        * Large inline-signing changes should be less disruptive. Signature
          generation is now done incrementally; the number of signatures to
          be generated in each quantum is controlled by
          "sig-signing-signatures number;". [RT #37927]
        * The experimental SIT extension now uses the EDNS COOKIE option code
          point (10) and is displayed as "COOKIE: <value>". The existing
          named.conf directives; "request-sit", "sit-secret" and
          "nosit-udp-size", are still valid and will be replaced by
          "send-cookie", "cookie-secret" and "nocookie-udp-size" in BIND
          9.11. The existing dig directive "+sit" is still valid and will be
          replaced with "+cookie" in BIND 9.11.
        * When retrying a query via TCP due to the first answer being
          truncated, dig will now correctly send the COOKIE value returned by
          the server in the prior response. [RT #39047]
        * Retrieving the local port range from net.ipv4.ip_local_port_range
          on Linux is now supported.
        * Active Directory names of the form gc._msdcs.<forest> are now
          accepted as valid hostnames when using the check-names option.
          <forest> is still restricted to letters, digits and hyphens.
        * Names containing rich text are now accepted as valid hostnames in
          PTR records in DNS-SD reverse lookup zones, as specified in RFC
          6763. [RT #37889]

   Bug Fixes

        * Asynchronous zone loads were not handled correctly when the zone
          load was already in progress; this could trigger a crash in zt.c.
          [RT #37573]
        * A race during shutdown or reconfiguration could cause an assertion
          failure in mem.c. [RT #38979]
        * Some answer formatting options didn't work correctly with dig
          +short. [RT #39291]
        * Malformed records of some types, including NSAP and UNSPEC, could
          trigger assertion failures when loading text zone files. [RT
          #40274] [RT #40285]
        * Fixed a possible crash in ratelimiter.c caused by NOTIFY messages
          being removed from the wrong rate limiter queue. [RT #40350]
        * The default rrset-order of random was inconsistently applied. [RT
          #40456]
        * BADVERS responses from broken authoritative name servers were not
          handled correctly. [RT #40427]
        * Several bugs have been fixed in the RPZ implementation:
             + Policy zones that did not specifically require recursion could
               be treated as if they did; consequently, setting
               qname-wait-recurse no; was sometimes ineffective. This has
               been corrected. In most configurations, behavioral changes due
               to this fix will not be noticeable. [RT #39229]
             + The server could crash if policy zones were updated (e.g. via
               rndc reload or an incoming zone transfer) while RPZ processing
               was still ongoing for an active query. [RT #39415]
             + On servers with one or more policy zones configured as slaves,
               if a policy zone updated during regular operation (rather than
               at startup) using a full zone reload, such as via AXFR, a bug
               could allow the RPZ summary data to fall out of sync,
               potentially leading to an assertion failure in rpz.c when
               further incremental updates were made to the zone, such as via
               IXFR. [RT #39567]
             + The server could match a shorter prefix than what was
               available in CLIENT-IP policy triggers, and so, an unexpected
               action could be taken. This has been corrected. [RT #39481]
             + The server could crash if a reload of an RPZ zone was
               initiated while another reload of the same zone was already in
               progress. [RT #39649]
             + Query names could match against the wrong policy zone if
               wildcard records were present. [RT #40357]

---
   Module Name:    pkgsrc
   Committed By:   taca
   Date:           Wed Dec 16 00:31:22 UTC 2015

   Modified Files:
           pkgsrc/net/bind910: Makefile distinfo

   Log Message:
   Update bind910 package to 9.10.3pl2 (BIND 9.10.3-P2), security release.

           --- 9.10.3-P2 released ---

   4270.   [security]      Update allowed OpenSSL versions as named is
                           potentially vulnerable to CVE-2015-3193.

   4261.   [maint]         H.ROOT-SERVERS.NET is 198.97.190.53 and 2001:500:1::53.
                           [RT #40556]

   4260.   [security]      Insufficient testing when parsing a message allowed
                           records with an incorrect class to be be accepted,
                           triggering a REQUIRE failure when those records
                           were subsequently cached. (CVE-2015-8000) [RT #40987]

   4253.   [security]      Address fetch context reference count handling error
                           on socket error. (CVE-2015-8461) [RT#40945]

           --- 9.10.3-P1 (withdrawn) ---

5 files changed, 35 insertions, 52 deletions

diff --git a/net/bind910/Makefile b/net/bind910/Makefile
index 759c9be1992..6b3dff8679b 100644
--- a/net/bind910/Makefile
+++ b/net/bind910/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.12 2015/09/03 00:33:31 taca Exp $
+# $NetBSD: Makefile,v 1.12.2.1 2015/12/18 19:46:02 bsiegert Exp $
 
 DISTNAME=	bind-${BIND_VERSION}
 PKGNAME=	${DISTNAME:S/-P/pl/}
@@ -14,7 +14,7 @@ CONFLICTS+=	host-[0-9]*
 
 MAKE_JOBS_SAFE=	no
 
-BIND_VERSION=	9.10.2-P4
+BIND_VERSION=	9.10.3-P2
 
 .include "../../mk/bsd.prefs.mk"
 
diff --git a/net/bind910/distinfo b/net/bind910/distinfo
index adb0de4c638..1ecc85f081d 100644
--- a/net/bind910/distinfo
+++ b/net/bind910/distinfo
@@ -1,12 +1,13 @@
-$NetBSD: distinfo,v 1.10 2015/09/03 00:33:31 taca Exp $
+$NetBSD: distinfo,v 1.10.2.1 2015/12/18 19:46:02 bsiegert Exp $
 
-SHA1 (bind-9.10.2-P4.tar.gz) = 55b8803c566aa0c9a9e4dbabbad06fb4536a8d5b
-RMD160 (bind-9.10.2-P4.tar.gz) = 8b2e0501899a5d654d8a234a7bd939cf06c43948
-Size (bind-9.10.2-P4.tar.gz) = 8471531 bytes
-SHA1 (patch-bin_dig_dighost.c) = 582fa4c7288e70bcc6ac906e8429cf38e0ad5152
-SHA1 (patch-bin_tests_system_Makefile.in) = 8bb6130981a6ff2ac736cf53a061115782bb65a2
+SHA1 (bind-9.10.3-P2.tar.gz) = c23663a9b464cff6f2279e80513ef97f9fe5803b
+RMD160 (bind-9.10.3-P2.tar.gz) = 34e3f033fb177dd37868176fb2729f52da8311a9
+SHA512 (bind-9.10.3-P2.tar.gz) = 21905cdff464f9ff275b87744433970d4a80faa6d9245c66c092421a45e89e438bd78f3bfe0d795964312f072c936e44eb6867b72decbba86821619180ced210
+Size (bind-9.10.3-P2.tar.gz) = 8523719 bytes
+SHA1 (patch-bin_dig_dighost.c) = 983e23a30d519982cbe88ed2277fcffc9cad616e
+SHA1 (patch-bin_tests_system_Makefile.in) = aeb2de1b6c6cfdbae7ffbf38aeebf52e94af9e2f
 SHA1 (patch-config.threads.in) = 227b83efe9cb3e301aaac9b97cf42f1fb8ad06b2
-SHA1 (patch-configure) = 3ea12f60b26064679e086ef5e637420b95d165be
+SHA1 (patch-configure) = 754a510493ae8fae669a9ff79940ccb04bc1e57e
 SHA1 (patch-contrib_dlz_config.dlz.in) = f18bec63fbfce7cb2cd72929058ce3770fce458f
 SHA1 (patch-lib_dns_rbt.c) = 510dfc72bc7764e548a46e9c48b58b2543490d7a
 SHA1 (patch-lib_lwres_getaddrinfo.c) = 69e9c8049fedcb93bd219c6053163f21ce3b2535
diff --git a/net/bind910/patches/patch-bin_dig_dighost.c b/net/bind910/patches/patch-bin_dig_dighost.c
index d984b3b7ecd..38d90825478 100644
--- a/net/bind910/patches/patch-bin_dig_dighost.c
+++ b/net/bind910/patches/patch-bin_dig_dighost.c
@@ -1,11 +1,11 @@
-$NetBSD: patch-bin_dig_dighost.c,v 1.2 2015/02/26 10:15:02 taca Exp $
+$NetBSD: patch-bin_dig_dighost.c,v 1.2.6.1 2015/12/18 19:46:02 bsiegert Exp $
 
 * Avoid to use true as variable name.
 
---- bin/dig/dighost.c.orig	2015-02-18 01:55:55.000000000 +0000
+--- bin/dig/dighost.c.orig	2015-09-09 02:23:40.000000000 +0000
 +++ bin/dig/dighost.c
-@@ -4678,7 +4678,7 @@ prepare_lookup(dns_name_t *name)
- 		isc_result_t result;
+@@ -4821,7 +4821,7 @@ prepare_lookup(dns_name_t *name)
+ 		isc_buffer_t *b = NULL;
  		isc_region_t r;
  		dns_rdataset_t *rdataset = NULL;
 -		isc_boolean_t true = ISC_TRUE;
@@ -13,7 +13,7 @@ $NetBSD: patch-bin_dig_dighost.c,v 1.2 2015/02/26 10:15:02 taca Exp $
  #endif
  
  		memset(namestr, 0, DNS_NAME_FORMATSIZE);
-@@ -4692,7 +4692,7 @@ prepare_lookup(dns_name_t *name)
+@@ -4835,7 +4835,7 @@ prepare_lookup(dns_name_t *name)
  
  		result = advanced_rrsearch(&rdataset, &ns.name,
  					   dns_rdatatype_aaaa,
@@ -22,7 +22,7 @@ $NetBSD: patch-bin_dig_dighost.c,v 1.2 2015/02/26 10:15:02 taca Exp $
  		if (result == ISC_R_SUCCESS) {
  			for (result = dns_rdataset_first(rdataset);
  			     result == ISC_R_SUCCESS;
-@@ -4721,7 +4721,7 @@ prepare_lookup(dns_name_t *name)
+@@ -4864,7 +4864,7 @@ prepare_lookup(dns_name_t *name)
  
  		rdataset = NULL;
  		result = advanced_rrsearch(&rdataset, &ns.name, dns_rdatatype_a,
@@ -31,7 +31,7 @@ $NetBSD: patch-bin_dig_dighost.c,v 1.2 2015/02/26 10:15:02 taca Exp $
  		if (result == ISC_R_SUCCESS) {
  			for (result = dns_rdataset_first(rdataset);
  			     result == ISC_R_SUCCESS;
-@@ -4840,11 +4840,11 @@ isc_result_t
+@@ -4983,11 +4983,11 @@ isc_result_t
  initialization(dns_name_t *name)
  {
  	isc_result_t   result;
@@ -45,7 +45,7 @@ $NetBSD: patch-bin_dig_dighost.c,v 1.2 2015/02/26 10:15:02 taca Exp $
  	if (result != ISC_R_SUCCESS) {
  		printf("\n;; NS RRset is missing to continue validation:"
  		       " FAILED\n\n");
-@@ -5202,7 +5202,7 @@ sigchase_td(dns_message_t *msg)
+@@ -5342,7 +5342,7 @@ sigchase_td(dns_message_t *msg)
  	isc_result_t result;
  	dns_name_t *name = NULL;
  	isc_boolean_t have_answer = ISC_FALSE;
@@ -54,7 +54,7 @@ $NetBSD: patch-bin_dig_dighost.c,v 1.2 2015/02/26 10:15:02 taca Exp $
  
  	if (msg->rcode != dns_rcode_noerror &&
  	    msg->rcode != dns_rcode_nxdomain) {
-@@ -5225,7 +5225,7 @@ sigchase_td(dns_message_t *msg)
+@@ -5365,7 +5365,7 @@ sigchase_td(dns_message_t *msg)
  			initialization(name);
  			return;
  		}
@@ -63,7 +63,7 @@ $NetBSD: patch-bin_dig_dighost.c,v 1.2 2015/02/26 10:15:02 taca Exp $
  	} else {
  		if (!current_lookup->trace_root_sigchase) {
  			result = dns_message_firstname(msg,
-@@ -5346,7 +5346,7 @@ sigchase_td(dns_message_t *msg)
+@@ -5484,7 +5484,7 @@ sigchase_td(dns_message_t *msg)
  						   dns_rdatatype_rrsig,
  						   current_lookup
  						   ->rdtype_sigchase,
@@ -72,7 +72,7 @@ $NetBSD: patch-bin_dig_dighost.c,v 1.2 2015/02/26 10:15:02 taca Exp $
  			if (result == ISC_R_FAILURE) {
  				printf("\n;; RRset is missing to continue"
  				       " validation SHOULD NOT APPEND:"
-@@ -5359,7 +5359,7 @@ sigchase_td(dns_message_t *msg)
+@@ -5497,7 +5497,7 @@ sigchase_td(dns_message_t *msg)
  						   &chase_authority_name,
  						   dns_rdatatype_rrsig,
  						   dns_rdatatype_any,
@@ -81,7 +81,7 @@ $NetBSD: patch-bin_dig_dighost.c,v 1.2 2015/02/26 10:15:02 taca Exp $
  			if (result == ISC_R_FAILURE) {
  				printf("\n;; RRSIG is missing  to continue"
  				       " validation SHOULD NOT APPEND:"
-@@ -5435,7 +5435,7 @@ sigchase_td(dns_message_t *msg)
+@@ -5573,7 +5573,7 @@ sigchase_td(dns_message_t *msg)
  					   &chase_authority_name,
  					   dns_rdatatype_rrsig,
  					   dns_rdatatype_ds,
@@ -90,7 +90,7 @@ $NetBSD: patch-bin_dig_dighost.c,v 1.2 2015/02/26 10:15:02 taca Exp $
  		if (result != ISC_R_SUCCESS) {
  			printf("\n;; DSset is missing to continue validation:"
  			       " FAILED\n\n");
-@@ -5523,7 +5523,7 @@ sigchase_td(dns_message_t *msg)
+@@ -5660,7 +5660,7 @@ sigchase_td(dns_message_t *msg)
  		result = advanced_rrsearch(&chase_rdataset, &chase_name,
  					   current_lookup->rdtype_sigchase,
  					   dns_rdatatype_any ,
@@ -99,7 +99,7 @@ $NetBSD: patch-bin_dig_dighost.c,v 1.2 2015/02/26 10:15:02 taca Exp $
  	if (result == ISC_R_FAILURE) {
  		printf("\n;; RRsig of RRset is missing to continue validation"
  		       " SHOULD NOT APPEND: FAILED\n\n");
-@@ -5566,7 +5566,7 @@ getneededrr(dns_message_t *msg)
+@@ -5703,7 +5703,7 @@ getneededrr(dns_message_t *msg)
  	dns_name_t *name = NULL;
  	dns_rdata_t sigrdata = DNS_RDATA_INIT;
  	dns_rdata_sig_t siginfo;
@@ -108,7 +108,7 @@ $NetBSD: patch-bin_dig_dighost.c,v 1.2 2015/02/26 10:15:02 taca Exp $
  
  	if ((result = dns_message_firstname(msg, DNS_SECTION_ANSWER))
  	    != ISC_R_SUCCESS) {
-@@ -5582,7 +5582,7 @@ getneededrr(dns_message_t *msg)
+@@ -5719,7 +5719,7 @@ getneededrr(dns_message_t *msg)
  	if (chase_rdataset == NULL) {
  		result = advanced_rrsearch(&chase_rdataset, name,
  					   dns_rdatatype_any,
@@ -117,7 +117,7 @@ $NetBSD: patch-bin_dig_dighost.c,v 1.2 2015/02/26 10:15:02 taca Exp $
  		if (result != ISC_R_SUCCESS) {
  			printf("\n;; No Answers: Validation FAILED\n\n");
  			return (ISC_R_NOTFOUND);
-@@ -5701,7 +5701,7 @@ getneededrr(dns_message_t *msg)
+@@ -5838,7 +5838,7 @@ getneededrr(dns_message_t *msg)
  		result = advanced_rrsearch(&chase_sigdsrdataset,
  					   &chase_signame,
  					   dns_rdatatype_rrsig,
diff --git a/net/bind910/patches/patch-bin_tests_system_Makefile.in b/net/bind910/patches/patch-bin_tests_system_Makefile.in
index 6d012e308db..42865648571 100644
--- a/net/bind910/patches/patch-bin_tests_system_Makefile.in
+++ b/net/bind910/patches/patch-bin_tests_system_Makefile.in
@@ -1,15 +1,15 @@
-$NetBSD: patch-bin_tests_system_Makefile.in,v 1.2 2014/10/14 16:23:19 taca Exp $
+$NetBSD: patch-bin_tests_system_Makefile.in,v 1.2.8.1 2015/12/18 19:46:02 bsiegert Exp $
 
 Build fix for DragonFly while linking of driver.so.
 
---- bin/tests/system/Makefile.in.orig	2014-09-16 19:27:15.000000000 +0000
+--- bin/tests/system/Makefile.in.orig	2015-09-09 02:23:40.000000000 +0000
 +++ bin/tests/system/Makefile.in
-@@ -21,7 +21,7 @@ top_srcdir =	@top_srcdir@
+@@ -19,7 +19,7 @@ top_srcdir =	@top_srcdir@
  
  @BIND9_MAKE_INCLUDES@
  
--SUBDIRS =	builtin dlzexternal filter-aaaa geoip lwresd rpz rsabigexponent tkey tsiggss
-+SUBDIRS =	builtin filter-aaaa geoip lwresd rpz rsabigexponent tkey tsiggss
+-SUBDIRS =	builtin dlzexternal fetchlimit filter-aaaa geoip lwresd rpz rsabigexponent statistics tkey tsiggss
++SUBDIRS =	builtin fetchlimit filter-aaaa geoip lwresd rpz rsabigexponent statistics tkey tsiggss
  TARGETS =
  
  @BIND9_MAKE_RULES@
diff --git a/net/bind910/patches/patch-configure b/net/bind910/patches/patch-configure
index ebdc9d6486c..85030f3b167 100644
--- a/net/bind910/patches/patch-configure
+++ b/net/bind910/patches/patch-configure
@@ -1,30 +1,12 @@
-$NetBSD: patch-configure,v 1.3 2015/02/26 10:15:02 taca Exp $
+$NetBSD: patch-configure,v 1.3.6.1 2015/12/18 19:46:02 bsiegert Exp $
 
 * Add DragonFly support.
 * Link proper postgresql library.
 * Avoid using "==" for argument of test(1).
 
---- configure.orig	2015-02-18 01:55:55.000000000 +0000
+--- configure.orig	2015-09-09 02:23:40.000000000 +0000
 +++ configure
-@@ -11840,7 +11840,7 @@ fi
-   test -n "$PYTHON" && break
- done
- 
--				if test "X$PYTHON" == "X"; then
-+				if test "X$PYTHON" = "X"; then
- 					continue;
- 				fi
- 				{ $as_echo "$as_me:${as_lineno-$LINENO}: checking python module 'argparse'" >&5
-@@ -11855,7 +11855,7 @@ $as_echo "not found" >&6; }
- 				unset ac_cv_path_PYTHON
- 				unset PYTHON
- 			done
--			if test "X$PYTHON" == "X"
-+			if test "X$PYTHON" = "X"
- 			then
- 				{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for python support" >&5
- $as_echo_n "checking for python support... " >&6; }
-@@ -14379,6 +14379,8 @@ case $host in
+@@ -14388,6 +14388,8 @@ case $host in
  	use_threads=false ;;
  *-freebsd*)
  	use_threads=true ;;
@@ -33,7 +15,7 @@ $NetBSD: patch-configure,v 1.3 2015/02/26 10:15:02 taca Exp $
  *-bsdi[234]*)
  	# Thread signals do not work reliably on some versions of BSD/OS.
  	use_threads=false ;;
-@@ -21029,7 +21031,7 @@ $as_echo "no" >&6; }
+@@ -21276,7 +21278,7 @@ $as_echo "no" >&6; }
  	fi
  	if test -n "-L$use_dlz_postgres_lib -lpq"
  	then