Update bind910 to 9.10.4 (BIND 9.10.4).

PKG_OPTIONS change:

    * Remove rrl which is always enabled.
    * Add fetchlimit, geoip, pkcs11, sit and tuning.


Security Fixes

     * Duplicate EDNS COOKIE options in a response could trigger an
       assertion failure. This flaw is disclosed in CVE-2016-2088. [RT
       #41809]
     * The resolver could abort with an assertion failure due to improper
       DNAME handling when parsing fetch reply messages. This flaw is
       disclosed in CVE-2016-1286. [RT #41753]
     * Malformed control messages can trigger assertions in named and
       rndc. This flaw is disclosed in CVE-2016-1285. [RT #41666]
     * Certain errors that could be encountered when printing out or
       logging an OPT record containing a CLIENT-SUBNET option could be
       mishandled, resulting in an assertion failure. This flaw is
       disclosed in CVE-2015-8705. [RT #41397]
     * Specific APL data could trigger an INSIST. This flaw is disclosed
       in CVE-2015-8704. [RT #41396]
     * Incorrect reference counting could result in an INSIST failure if a
       socket error occurred while performing a lookup. This flaw is
       disclosed in CVE-2015-8461. [RT#40945]
     * Insufficient testing when parsing a message allowed records with an
       incorrect class to be be accepted, triggering a REQUIRE failure
       when those records were subsequently cached. This flaw is disclosed
       in CVE-2015-8000. [RT #40987]

New Features

     * The following resource record types have been implemented: AVC,
       CSYNC, NINFO, RKEY, SINK, SMIMEA, TA, TALINK.
     * Added a warning for a common misconfiguration involving forwarded
       RFC 1918 and IPv6 ULA (Universal Local Address) zones.
     * Contributed software from Nominum is included in the source at
       contrib/dnsperf-2.1.0.0-1/. It includes dnsperf for measuring the
       performance of authoritative DNS servers, resperf for testing the
       resolution performance of a caching DNS server, resperf-report for
       generating a resperf report in HTML with gnuplot graphs, and
       queryparse to extract DNS queries from pcap capture files. This
       software is not installed by default with BIND.
     * When loading a signed zone, named will now check whether an RRSIG's
       inception time is in the future, and if so, it will regenerate the
       RRSIG immediately. This helps when a system's clock needs to be
       reset backwards.

Feature Changes

     * Updated the compiled-in addresses for H.ROOT-SERVERS.NET and
       L.ROOT-SERVERS.NET.
     * The default preferred glue is now the address type of the transport
       the query was received over.
     * On machines with 2 or more processors (CPU), the default value for
       the number of UDP listeners has been changed to the number of
       detected processors minus one.
     * Zone transfers now use smaller message sizes to improve message
       compression. This results in reduced network usage.
     * named -V output now also includes operating system details.

Porting Changes

     * The Microsoft Windows install tool BINDInstall.exe which requires a
       non-free version of Visual Studio to be built, now uses two files
       (lists of flags and files) created by the Configure perl script
       with all the needed information which were previously compiled in
       the binary. Read win32utils/build.txt for more details. [RT #38915]

Bug Fixes

     * rndc flushtree now works even if there wasn't a cached node at the
       specified name. [RT #41846]
     * Don't emit records with zero TTL unless the records were received
       with a zero TTL. After being returned to waiting clients, the
       answer will be discarded from the cache. [RT #41687]
     * For Windows platforms, the SIT (Source Identity Token) support was
       restored. (It was mistakenly partially replaced in a previous beta
       with new 9.11 COOKIE support.) [RT #41905]
     * When deleting records from a zone database, interior nodes could be
       left empty but not deleted, damaging search performance afterward.
       [RT #40997] [RT #41941]
     * The server could crash due to a use-after-free if a zone transfer
       timed out. [RT #41297]
     * Authoritative servers that were marked as bogus (e.g. blackholed in
       configuration or with invalid addresses) were being queried anyway.
       [RT #41321]
     * Some of the options for GeoIP ACLs, including "areacode",
       "metrocode", and "timezone", were incorrectly documented as "area",
       "metro" and "tz". Both the long and abbreviated versions are now
       accepted.
     * Zones configured to use map format master files can't be used as
       policy zones because RPZ summary data isn't compiled when such
       zones are mapped into memory. This limitation may be fixed in a
       future release, but in the meantime it has been documented, and
       attempting to use such zones in response-policy statements is now a
       configuration error. [RT #38321]

5 files changed, 51 insertions, 25 deletions

diff --git a/net/bind910/Makefile b/net/bind910/Makefile
index 9dd054f015f..eb997f87b38 100644
--- a/net/bind910/Makefile
+++ b/net/bind910/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.18 2016/03/10 00:48:41 taca Exp $
+# $NetBSD: Makefile,v 1.19 2016/05/02 13:27:57 taca Exp $
 
 DISTNAME=	bind-${BIND_VERSION}
 PKGNAME=	${DISTNAME:S/-P/pl/}
@@ -14,7 +14,7 @@ CONFLICTS+=	host-[0-9]*
 
 MAKE_JOBS_SAFE=	no
 
-BIND_VERSION=	9.10.3-P4
+BIND_VERSION=	9.10.4
 
 .include "../../mk/bsd.prefs.mk"
 
@@ -58,12 +58,6 @@ FILES_SUBST+=		BIND_GROUP=${BIND_GROUP} \
 MESSAGE_SUBST+=		BIND_DIR=${BIND_DIR} BIND_USER=${BIND_USER}
 DOCDIR=			${DESTDIR}${PREFIX}/share/doc/bind9
 
-# include/isc/ipv6.h is installed on non-ipv6 platforms
-PLIST_VARS+=	inet6
-.if !empty(MISSING_FEATURES:Minet6)
-PLIST.inet6=	yes
-.endif
-
 RCD_SCRIPTS=		lwresd named9
 SMF_METHODS=		named
 
diff --git a/net/bind910/PLIST b/net/bind910/PLIST
index 8290b56ed8d..a315ab8f78d 100644
--- a/net/bind910/PLIST
+++ b/net/bind910/PLIST
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.4 2015/02/26 10:15:02 taca Exp $
+@comment $NetBSD: PLIST,v 1.5 2016/05/02 13:27:57 taca Exp $
 bin/bind9-config
 bin/delv
 bin/dig
@@ -372,6 +372,10 @@ man/man8/named-compilezone.8
 man/man8/named-journalprint.8
 man/man8/named.8
 man/man8/nsec3hash.8
+${PLIST.pkcs11}man/man8/pkcs11-destroy.8
+${PLIST.pkcs11}man/man8/pkcs11-keygen.8
+${PLIST.pkcs11}man/man8/pkcs11-list.8
+${PLIST.pkcs11}man/man8/pkcs11-tokens.8
 man/man8/rndc-confgen.8
 man/man8/rndc.8
 man/man8/tsig-keygen.8
@@ -395,6 +399,10 @@ sbin/named-compilezone
 sbin/named-journalprint
 sbin/named-rrchecker
 sbin/nsec3hash
+${PLIST.pkcs11}sbin/pkcs11-destroy
+${PLIST.pkcs11}sbin/pkcs11-keygen
+${PLIST.pkcs11}sbin/pkcs11-list
+${PLIST.pkcs11}sbin/pkcs11-tokens
 sbin/rndc
 sbin/rndc-confgen
 sbin/tsig-keygen
@@ -432,10 +440,12 @@ share/doc/bind9/arm/man.dnssec-verify.html
 share/doc/bind9/arm/man.genrandom.html
 share/doc/bind9/arm/man.host.html
 share/doc/bind9/arm/man.isc-hmac-fixup.html
+share/doc/bind9/arm/man.lwresd.html
 share/doc/bind9/arm/man.named-checkconf.html
 share/doc/bind9/arm/man.named-checkzone.html
 share/doc/bind9/arm/man.named-journalprint.html
 share/doc/bind9/arm/man.named-rrchecker.html
+share/doc/bind9/arm/man.named.conf.html
 share/doc/bind9/arm/man.named.html
 share/doc/bind9/arm/man.nsec3hash.html
 share/doc/bind9/arm/man.nsupdate.html
diff --git a/net/bind910/distinfo b/net/bind910/distinfo
index 1c32d4551f5..94899a63f18 100644
--- a/net/bind910/distinfo
+++ b/net/bind910/distinfo
@@ -1,14 +1,14 @@
-$NetBSD: distinfo,v 1.15 2016/03/10 00:48:41 taca Exp $
+$NetBSD: distinfo,v 1.16 2016/05/02 13:27:57 taca Exp $
 
-SHA1 (bind-9.10.3-P4.tar.gz) = c3f87804b2b950a0be8122c41ebbc253d0624786
-RMD160 (bind-9.10.3-P4.tar.gz) = 75af2755febcd4b5a6f1b15c14d76ed4b1b11ba8
-SHA512 (bind-9.10.3-P4.tar.gz) = 9c7b710054cd1230e7e470541a13850def56b2247c404a1800e0d0dad6aba20b3c3c09b1a17cd6017435525e84fa2f7cde40ae13feeeb7747efb26c66961aadd
-Size (bind-9.10.3-P4.tar.gz) = 8529535 bytes
+SHA1 (bind-9.10.4.tar.gz) = 8c1da5ee9232507b2d58520cf941bce805f2b61e
+RMD160 (bind-9.10.4.tar.gz) = 038a854b2caee09354e2cc656bacf56eccaae125
+SHA512 (bind-9.10.4.tar.gz) = 43710d1cf62756c74b60f177a4220e64f9faad7ec689ee04aa2898413e325a76d192293b8f37a2b6dbd6208bcc815def079a02d5037630dc098ad050a5e78df1
+Size (bind-9.10.4.tar.gz) = 9318151 bytes
 SHA1 (patch-bin_dig_dighost.c) = 983e23a30d519982cbe88ed2277fcffc9cad616e
 SHA1 (patch-bin_tests_system_Makefile.in) = aeb2de1b6c6cfdbae7ffbf38aeebf52e94af9e2f
 SHA1 (patch-config.threads.in) = 227b83efe9cb3e301aaac9b97cf42f1fb8ad06b2
 SHA1 (patch-configure) = 754a510493ae8fae669a9ff79940ccb04bc1e57e
 SHA1 (patch-contrib_dlz_config.dlz.in) = f18bec63fbfce7cb2cd72929058ce3770fce458f
-SHA1 (patch-lib_dns_rbt.c) = 510dfc72bc7764e548a46e9c48b58b2543490d7a
+SHA1 (patch-lib_dns_rbt.c) = d26514fb43ef5053594c8a8597c57539e8d2cf12
 SHA1 (patch-lib_lwres_getaddrinfo.c) = 69e9c8049fedcb93bd219c6053163f21ce3b2535
 SHA1 (patch-lib_lwres_getnameinfo.c) = 418ad349cf52925c9e8051b5c71d9d51ea8d2fb1
diff --git a/net/bind910/options.mk b/net/bind910/options.mk
index 98ab544ee4b..4fe8ea1af69 100644
--- a/net/bind910/options.mk
+++ b/net/bind910/options.mk
@@ -1,12 +1,14 @@
-# $NetBSD: options.mk,v 1.2 2015/02/13 13:50:32 fhajny Exp $
+# $NetBSD: options.mk,v 1.3 2016/05/02 13:27:57 taca Exp $
 
 PKG_OPTIONS_VAR=	PKG_OPTIONS.bind910
 PKG_SUPPORTED_OPTIONS=	bind-dig-sigchase bind-xml-statistics-server
 PKG_SUPPORTED_OPTIONS+=	bind-json-statistics-server
 PKG_SUPPORTED_OPTIONS+=	inet6 threads readline mysql pgsql ldap dlz-filesystem
-PKG_SUPPORTED_OPTIONS+=	rrl
+PKG_SUPPORTED_OPTIONS+=	fetchlimit geoip pkcs11 sit tuning
 PKG_SUGGESTED_OPTIONS+=	readline
 
+PLIST_VARS+=	inet6 pkcs11
+
 PTHREAD_OPTS+=		native
 .include "../../mk/pthread.buildlink3.mk"
 
@@ -22,6 +24,8 @@ PKG_SUGGESTED_OPTIONS+=	threads
 
 .if empty(MISSING_FEATURES:Minet6)
 PKG_SUGGESTED_OPTIONS+=	inet6
+.else
+PLIST.inet6=	yes
 .endif
 
 .include "../../mk/bsd.options.mk"
@@ -55,8 +59,26 @@ CONFIGURE_ARGS+=	--with-dlz-ldap=${BUILDLINK_PREFIX.openldap-client}
 CONFIGURE_ARGS+=	--with-dlz-filesystem
 .endif
 
-.if !empty(PKG_OPTIONS:Mrrl)
-CONFIGURE_ARGS+=	--enable-rrl
+.if !empty(PKG_OPTIONS:Mfetchlimit)
+CONFIGURE_ARGS+=	--enable-fetchlimit
+.endif
+
+.if !empty(PKG_OPTIONS:Mgeoip)
+CONFIGURE_ARGS+=	--with-geoip=${PREFIX}
+.include "../../net/GeoIP/buildlink3.mk"
+.endif
+
+.if !empty(PKG_OPTIONS:Mpkcs11)
+CONFIGURE_ARGS+=	--with-pkcs11=yes
+PLIST.pkcs11=		yes
+.endif
+
+.if !empty(PKG_OPTIONS:Msit)
+CONFIGURE_ARGS+=	--enable-sit
+.endif
+
+.if !empty(PKG_OPTIONS:Mtuning)
+CONFIGURE_ARGS+=	--with-tuning=large
 .endif
 
 ###
diff --git a/net/bind910/patches/patch-lib_dns_rbt.c b/net/bind910/patches/patch-lib_dns_rbt.c
index 89e16f4d996..ffe02fbf825 100644
--- a/net/bind910/patches/patch-lib_dns_rbt.c
+++ b/net/bind910/patches/patch-lib_dns_rbt.c
@@ -1,10 +1,10 @@
-$NetBSD: patch-lib_dns_rbt.c,v 1.2 2014/10/14 16:23:19 taca Exp $
+$NetBSD: patch-lib_dns_rbt.c,v 1.3 2016/05/02 13:27:57 taca Exp $
 
 * Disable inline on powerpc.
 
---- lib/dns/rbt.c.orig	2014-09-16 19:27:15.000000000 +0000
+--- lib/dns/rbt.c.orig	2016-04-20 20:11:20.000000000 +0000
 +++ lib/dns/rbt.c
-@@ -345,6 +345,10 @@ hexdump(const char *desc, unsigned char 
+@@ -348,6 +348,10 @@ hexdump(const char *desc, unsigned char 
  }
  #endif /* DEBUG */
  
@@ -12,6 +12,6 @@ $NetBSD: patch-lib_dns_rbt.c,v 1.2 2014/10/14 16:23:19 taca Exp $
 +#define        inline  /**/
 +#endif
 +
- /* The passed node must not be NULL. */
- static inline dns_rbtnode_t *
- get_subtree_root(dns_rbtnode_t *node) {
+ #ifdef DNS_RBT_USEHASH
+ 
+ /*