net/bind916: update to 9.16.28

	--- 9.16.28 released ---

5856.	[bug]		The "starting maxtime timer" message related to outgoing
			zone transfers was incorrectly logged at the ERROR level
			instead of DEBUG(1). [GL #3208]

5852.	[func]		Add new "reuseport" option to enable/disable load
			balancing of sockets. [GL #3249]

5843.	[bug]		When an UPDATE targets a zone that is not configured,
			the requested zone name is now logged in the "not
			authoritative" error message, so that it is easier to
			track down problematic update clients. [GL #3209]

5836.	[bug]		Quote the dns64 prefix in error messages that complain
			about problems with it, to avoid confusion with the
			following dns64 ACLs. [GL #3210]

5834.	[cleanup]	C99 variable-length arrays are difficult to use safely,
			so avoid them except in test code. [GL #3201]

5828.	[bug]		Replace single TCP write timer with per-TCP write
			timers. [GL #3200]

5824.	[bug]		Invalid dnssec-policy definitions were being accepted
			where the defined keys did not cover both KSK and ZSK
			roles for a given algorithm.  This is now checked for
			and the dnssec-policy is rejected if both roles are
			not present for all algorithms in use. [GL #3142]

7 files changed, 42 insertions, 48 deletions

diff --git a/net/bind916/Makefile b/net/bind916/Makefile
index eb6eb888db0..27792dad3f6 100644
--- a/net/bind916/Makefile
+++ b/net/bind916/Makefile
@@ -1,8 +1,7 @@
-# $NetBSD: Makefile,v 1.39 2022/04/18 19:11:48 adam Exp $
+# $NetBSD: Makefile,v 1.40 2022/04/21 14:14:46 taca Exp $
 
 DISTNAME=	bind-${BIND_VERSION}
 PKGNAME=	${DISTNAME:S/-P/pl/}
-PKGREVISION=	2
 CATEGORIES=	net
 MASTER_SITES=	ftp://ftp.isc.org/isc/bind9/${BIND_VERSION}/
 EXTRACT_SUFX=	.tar.xz
@@ -16,7 +15,7 @@ CONFLICTS+=	host-[0-9]*
 
 MAKE_JOBS_SAFE=	no
 
-BIND_VERSION=	9.16.27
+BIND_VERSION=	9.16.28
 
 BUILD_DEFS+=	BIND_DIR VARBASE
 
diff --git a/net/bind916/PLIST b/net/bind916/PLIST
index ce60f379055..79a13849129 100644
--- a/net/bind916/PLIST
+++ b/net/bind916/PLIST
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.5 2021/06/17 09:04:45 otis Exp $
+@comment $NetBSD: PLIST,v 1.6 2022/04/21 14:14:46 taca Exp $
 bin/arpaname
 bin/delv
 bin/dig
@@ -175,7 +175,6 @@ include/isc/md.h
 include/isc/mem.h
 include/isc/meminfo.h
 include/isc/mutex.h
-include/isc/mutexatomic.h
 include/isc/mutexblock.h
 include/isc/net.h
 include/isc/netaddr.h
diff --git a/net/bind916/distinfo b/net/bind916/distinfo
index 4c646e3e0b4..100da3bcabe 100644
--- a/net/bind916/distinfo
+++ b/net/bind916/distinfo
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.34 2022/03/31 12:16:24 jperkin Exp $
+$NetBSD: distinfo,v 1.35 2022/04/21 14:14:46 taca Exp $
 
-BLAKE2s (bind-9.16.27.tar.xz) = 16da007bf1fce196969d93cc54e6849a624afa1d39ee57332ffb6d08c8c67cdd
-SHA512 (bind-9.16.27.tar.xz) = 5c71f228db83aa8cc9e65466d6e5afca4a9f80c693358111a003fe09e1a14522175eb2b6a0f11e2a2cd4fdba01f2ae315de52e394a441b3861ca2a011e02af62
-Size (bind-9.16.27.tar.xz) = 5084340 bytes
+BLAKE2s (bind-9.16.28.tar.xz) = df28906d9e1b2d64cb8ea367a8114e1fb3f9320a997c872b85e4a1150dc5058a
+SHA512 (bind-9.16.28.tar.xz) = 7314c039b6d61b90e7f7c6d4465a26b214de67272116e334b8a3e2551b1d66c028819024ec819676c1cc66e6bf81f17890239bb48e4c40f9d6cea35f025976d3
+Size (bind-9.16.28.tar.xz) = 5084504 bytes
 SHA1 (patch-bin_dig_dighost.c) = b1073911d80ecd519af98b6678968296ff8c0c98
 SHA1 (patch-bin_dig_include_dig_dig.h) = 10166f5bb98b208c7b10d63eb31e8253f704acc8
 SHA1 (patch-bin_named_Makefile.in) = f1367da6a226ba44d0ee13acf00b8abeb5b1b7eb
@@ -20,14 +20,14 @@ SHA1 (patch-configure.ac) = 9a8aa06ca82de5f3a37aac01aef2fc93af575309
 SHA1 (patch-contrib_dlz_config.dlz.in) = 6c53d61aaaf1a952a867e4c4da0194db94f511d7
 SHA1 (patch-lib_dns_byaddr.c) = 647ddaaaf040233e18d1a87d83bc2bd63d2a20e3
 SHA1 (patch-lib_dns_client.c) = 94909ebeaded676cca502d83bf8071ae651e1928
-SHA1 (patch-lib_dns_gssapi__link.c) = acd5f3c975d4edf391e77fd39cfa91810ad17ba2
+SHA1 (patch-lib_dns_gssapi__link.c) = 72296598b0bdd2a57d0f38ecf1775e2898a041c6
 SHA1 (patch-lib_dns_include_dns_client.h) = 5e3c6baebe136b026f30552dbbff632a2b535301
 SHA1 (patch-lib_dns_include_dns_zone.h) = e6dfcd43430538ac2a39b217fcae0d81e4c4d163
 SHA1 (patch-lib_dns_lookup.c) = 6c7463aca16abf6bd578aba1733a3217608a39d3
 SHA1 (patch-lib_dns_pkcs11ecdsa__link.c) = 99f386b056c5a6471f69841c41a2698d36b6b275
 SHA1 (patch-lib_dns_pkcs11eddsa__link.c) = bd887a6c8960da3a8663cdf5e955e045f16dee3f
 SHA1 (patch-lib_dns_rbt.c) = c14eff9a609e4b49aa9db18f395461cd7c8944be
-SHA1 (patch-lib_dns_rbtdb.c) = bb3f829cbed23bce624462766aa6d039a0153afe
+SHA1 (patch-lib_dns_rbtdb.c) = e8d61e1ba613b2a2fdcd3ff077e2e5b6ce2e45b2
 SHA1 (patch-lib_dns_rdata.c) = fb12d214a86d71d62e200e6bc09b7c8b7187b911
 SHA1 (patch-lib_dns_request.c) = 82560e819cba0259883da8d47618ffabead22c55
 SHA1 (patch-lib_dns_sdb.c) = ed447ec7a134e620765b25ee36124a19dfd9fab0
@@ -48,10 +48,10 @@ SHA1 (patch-lib_isc_stats.c) = 8d962fa360740770588fccf1d303d7fe22ae724b
 SHA1 (patch-lib_isc_timer.c) = aea2019bbf3d84cad77af432a2bbdf0da8f2f893
 SHA1 (patch-lib_isc_unix_include_isc_stdatomic.h) = b73b0224be47c1733f6346fce9243e97f54e1865
 SHA1 (patch-lib_isc_unix_net.c) = c654f60a1feefdba9bf980dcfa46ce37f46918aa
-SHA1 (patch-lib_isc_unix_socket.c) = c6d04164dfc2047493b39c174bbdf2c8aa59bc1d
+SHA1 (patch-lib_isc_unix_socket.c) = 7ad11597238d1374abea83957e18505aeafeeaee
 SHA1 (patch-lib_isc_unix_time.c) = fac9e66754e099f53ba8c499f5f179825a0b0fbd
 SHA1 (patch-lib_ns_Makefile.in) = 7375d0cb44c891492594dc7540f78826c141106a
-SHA1 (patch-lib_ns_client.c) = 099ca607278d064081a0cfc92d96f0b31d95a944
+SHA1 (patch-lib_ns_client.c) = e1e2de8983934378f749ae9610b38fb8e4f26592
 SHA1 (patch-lib_ns_include_ns_client.h) = 3ccd630aee77ea638fb3b954b85bad9c74b0c86e
 SHA1 (patch-lib_ns_include_ns_pfilter.h) = cc86752971b4f9f7492283c4ad3ff29bc1bae237
 SHA1 (patch-lib_ns_pfilter.c) = 8f4a3b3a729360a131eb1962c42a9f9f985c7e7b
diff --git a/net/bind916/patches/patch-lib_dns_gssapi__link.c b/net/bind916/patches/patch-lib_dns_gssapi__link.c
index e7c2bb69419..bca218010b3 100644
--- a/net/bind916/patches/patch-lib_dns_gssapi__link.c
+++ b/net/bind916/patches/patch-lib_dns_gssapi__link.c
@@ -1,16 +1,12 @@
-$NetBSD: patch-lib_dns_gssapi__link.c,v 1.1 2020/08/09 15:20:22 taca Exp $
+$NetBSD: patch-lib_dns_gssapi__link.c,v 1.2 2022/04/21 14:14:46 taca Exp $
 
 * Take from NetBSD base.
 
---- lib/dns/gssapi_link.c.orig	2020-05-06 09:59:35.000000000 +0000
+--- lib/dns/gssapi_link.c.orig	2022-04-11 15:28:12.000000000 +0000
 +++ lib/dns/gssapi_link.c
-@@ -179,9 +179,12 @@ gssapi_verify(dst_context_t *dctx, const
- 	gss_buffer_desc gmessage, gsig;
- 	OM_uint32 minor, gret;
+@@ -128,6 +128,9 @@ gssapi_sign(dst_context_t *dctx, isc_buf
  	gss_ctx_id_t gssctx = dctx->key->keydata.gssctx;
--	unsigned char buf[sig->length];
-+	unsigned char buf[4096];
- 	char err[1024];
+ 	char buf[1024];
  
 +	if (sizeof(buf) < sig->length)
 +		abort();
diff --git a/net/bind916/patches/patch-lib_dns_rbtdb.c b/net/bind916/patches/patch-lib_dns_rbtdb.c
index a77195ce397..80cf20fbf8c 100644
--- a/net/bind916/patches/patch-lib_dns_rbtdb.c
+++ b/net/bind916/patches/patch-lib_dns_rbtdb.c
@@ -1,10 +1,10 @@
-$NetBSD: patch-lib_dns_rbtdb.c,v 1.1 2020/08/09 15:20:22 taca Exp $
+$NetBSD: patch-lib_dns_rbtdb.c,v 1.2 2022/04/21 14:14:46 taca Exp $
 
 * Take from NetBSD base.
 
---- lib/dns/rbtdb.c.orig	2020-05-06 09:59:35.000000000 +0000
+--- lib/dns/rbtdb.c.orig	2022-04-11 15:28:12.000000000 +0000
 +++ lib/dns/rbtdb.c
-@@ -2218,7 +2218,7 @@ prune_tree(isc_task_t *task, isc_event_t
+@@ -2277,7 +2277,7 @@ prune_tree(isc_task_t *task, isc_event_t
  	NODE_UNLOCK(&rbtdb->node_locks[locknum].lock, isc_rwlocktype_write);
  	RWUNLOCK(&rbtdb->tree_lock, isc_rwlocktype_write);
  
@@ -12,4 +12,4 @@ $NetBSD: patch-lib_dns_rbtdb.c,v 1.1 2020/08/09 15:20:22 taca Exp $
 +	detach((dns_db_t **)(void *)&rbtdb);
  }
  
- static inline void
+ static void
diff --git a/net/bind916/patches/patch-lib_isc_unix_socket.c b/net/bind916/patches/patch-lib_isc_unix_socket.c
index 3613a7cd337..05a503b6ba2 100644
--- a/net/bind916/patches/patch-lib_isc_unix_socket.c
+++ b/net/bind916/patches/patch-lib_isc_unix_socket.c
@@ -1,10 +1,10 @@
-$NetBSD: patch-lib_isc_unix_socket.c,v 1.7 2022/02/17 15:37:26 gutteridge Exp $
+$NetBSD: patch-lib_isc_unix_socket.c,v 1.8 2022/04/21 14:14:46 taca Exp $
 
 * Apply fixes from NetBSD base system.
 * Fix build on SunOS. In this special case, _XOPEN_SOURCE has to be only
   defined on SunOS.
 
---- lib/isc/unix/socket.c.orig	2022-01-12 13:50:10.000000000 +0000
+--- lib/isc/unix/socket.c.orig	2022-04-11 15:28:12.000000000 +0000
 +++ lib/isc/unix/socket.c
 @@ -13,6 +13,15 @@
  
@@ -48,14 +48,14 @@ $NetBSD: patch-lib_isc_unix_socket.c,v 1.7 2022/02/17 15:37:26 gutteridge Exp $
  
  #define SELECT_POKE_SHUTDOWN (-1)
  #define SELECT_POKE_NOTHING  (-2)
-@@ -1574,6 +1595,7 @@ doio_recv(isc_socket_t *sock, isc_socket
+@@ -1575,6 +1596,7 @@ doio_recv(isc_socket_t *sock, isc_socket
  	case isc_sockettype_udp:
  	case isc_sockettype_raw:
  		break;
 +	case isc_sockettype_fdwatch:
  	default:
- 		INSIST(0);
- 		ISC_UNREACHABLE();
+ 		UNREACHABLE();
+ 	}
 @@ -1782,9 +1804,26 @@ socketclose(isc__socketthread_t *thread,
  	 */
  	LOCK(&thread->fdlock[lockid]);
@@ -98,7 +98,7 @@ $NetBSD: patch-lib_isc_unix_socket.c,v 1.7 2022/02/17 15:37:26 gutteridge Exp $
  		}
  	} else {
  		sock->fd = dup(dup_socket->fd);
-@@ -2440,6 +2486,7 @@ socket_create(isc_socketmgr_t *manager,
+@@ -2440,6 +2486,7 @@ socket_create(isc_socketmgr_t *manager, 
  
  	REQUIRE(VALID_MANAGER(manager));
  	REQUIRE(socketp != NULL && *socketp == NULL);
@@ -106,7 +106,7 @@ $NetBSD: patch-lib_isc_unix_socket.c,v 1.7 2022/02/17 15:37:26 gutteridge Exp $
  
  	result = allocate_socket(manager, type, &sock);
  	if (result != ISC_R_SUCCESS) {
-@@ -2554,6 +2601,7 @@ isc_socket_open(isc_socket_t *sock) {
+@@ -2553,6 +2600,7 @@ isc_socket_open(isc_socket_t *sock) {
  	REQUIRE(isc_refcount_current(&sock->references) >= 1);
  	REQUIRE(sock->fd == -1);
  	REQUIRE(sock->threadid == -1);
@@ -114,7 +114,7 @@ $NetBSD: patch-lib_isc_unix_socket.c,v 1.7 2022/02/17 15:37:26 gutteridge Exp $
  
  	result = opensocket(sock->manager, sock, NULL);
  
-@@ -2632,6 +2680,7 @@ isc_socket_close(isc_socket_t *sock) {
+@@ -2631,6 +2679,7 @@ isc_socket_close(isc_socket_t *sock) {
  
  	LOCK(&sock->lock);
  
@@ -122,7 +122,7 @@ $NetBSD: patch-lib_isc_unix_socket.c,v 1.7 2022/02/17 15:37:26 gutteridge Exp $
  	REQUIRE(sock->fd >= 0 && sock->fd < (int)sock->manager->maxsocks);
  
  	INSIST(!sock->connecting);
-@@ -2662,6 +2711,24 @@ isc_socket_close(isc_socket_t *sock) {
+@@ -2661,6 +2710,24 @@ isc_socket_close(isc_socket_t *sock) {
  	return (ISC_R_SUCCESS);
  }
  
@@ -147,7 +147,7 @@ $NetBSD: patch-lib_isc_unix_socket.c,v 1.7 2022/02/17 15:37:26 gutteridge Exp $
  /*
   * Dequeue an item off the given socket's read queue, set the result code
   * in the done event to the one provided, and send it to the task it was
-@@ -3102,6 +3169,58 @@ finish:
+@@ -3101,6 +3168,58 @@ finish:
  	}
  }
  
@@ -206,7 +206,7 @@ $NetBSD: patch-lib_isc_unix_socket.c,v 1.7 2022/02/17 15:37:26 gutteridge Exp $
  /*
   * Process read/writes on each fd here.  Avoid locking
   * and unlocking twice if both reads and writes are possible.
-@@ -3149,7 +3268,7 @@ process_fd(isc__socketthread_t *thread,
+@@ -3148,7 +3267,7 @@ process_fd(isc__socketthread_t *thread, 
  		if (sock->connecting) {
  			internal_connect(sock);
  		} else {
@@ -215,7 +215,7 @@ $NetBSD: patch-lib_isc_unix_socket.c,v 1.7 2022/02/17 15:37:26 gutteridge Exp $
  		}
  	}
  
-@@ -3157,7 +3276,7 @@ process_fd(isc__socketthread_t *thread,
+@@ -3156,7 +3275,7 @@ process_fd(isc__socketthread_t *thread, 
  		if (sock->listener) {
  			internal_accept(sock); /* unlocks sock */
  		} else {
@@ -224,7 +224,7 @@ $NetBSD: patch-lib_isc_unix_socket.c,v 1.7 2022/02/17 15:37:26 gutteridge Exp $
  			UNLOCK(&sock->lock);
  		}
  	} else {
-@@ -3798,7 +3917,7 @@ isc_socketmgr_create2(isc_mem_t *mctx, i
+@@ -3797,7 +3916,7 @@ isc_socketmgr_create2(isc_mem_t *mctx, i
  		isc_thread_create(netthread, &manager->threads[i],
  				  &manager->threads[i].thread);
  		char tname[1024];
@@ -233,7 +233,7 @@ $NetBSD: patch-lib_isc_unix_socket.c,v 1.7 2022/02/17 15:37:26 gutteridge Exp $
  		isc_thread_setname(manager->threads[i].thread, tname);
  	}
  
-@@ -5219,7 +5338,7 @@ static isc_once_t hasreuseport_once = IS
+@@ -5218,7 +5337,7 @@ static isc_once_t hasreuseport_once = IS
  static bool hasreuseport = false;
  
  static void
@@ -242,7 +242,7 @@ $NetBSD: patch-lib_isc_unix_socket.c,v 1.7 2022/02/17 15:37:26 gutteridge Exp $
  /*
   * SO_REUSEPORT works very differently on *BSD and on Linux (because why not).
   * We only want to use it on Linux, if it's available. On BSD we want to dup()
-@@ -5273,6 +5392,8 @@ _socktype(isc_sockettype_t type) {
+@@ -5272,6 +5391,8 @@ _socktype(isc_sockettype_t type) {
  		return ("tcp");
  	case isc_sockettype_unix:
  		return ("unix");
@@ -251,7 +251,7 @@ $NetBSD: patch-lib_isc_unix_socket.c,v 1.7 2022/02/17 15:37:26 gutteridge Exp $
  	default:
  		return ("not-initialized");
  	}
-@@ -5503,3 +5624,113 @@ error:
+@@ -5502,3 +5623,113 @@ error:
  	return (result);
  }
  #endif /* HAVE_JSON_C */
diff --git a/net/bind916/patches/patch-lib_ns_client.c b/net/bind916/patches/patch-lib_ns_client.c
index 27b92ab9c98..2162c428dcb 100644
--- a/net/bind916/patches/patch-lib_ns_client.c
+++ b/net/bind916/patches/patch-lib_ns_client.c
@@ -1,10 +1,10 @@
-$NetBSD: patch-lib_ns_client.c,v 1.5 2021/10/24 06:40:28 taca Exp $
+$NetBSD: patch-lib_ns_client.c,v 1.6 2022/04/21 14:14:46 taca Exp $
 
 Use 32-bit atomic integers for !_LP64 platforms.
 
---- lib/ns/client.c.orig	2021-09-07 09:37:05.000000000 +0000
+--- lib/ns/client.c.orig	2022-04-11 15:28:12.000000000 +0000
 +++ lib/ns/client.c
-@@ -87,8 +87,8 @@
+@@ -89,8 +89,8 @@
  	isc_log_write(ns_lctx, NS_LOGCATEGORY_CLIENT, NS_LOGMODULE_CLIENT, \
  		      ISC_LOG_DEBUG(3), "clientmgr @%p: %s", manager, (m))
  #else /* ifdef NS_CLIENT_TRACE */
@@ -15,12 +15,12 @@ Use 32-bit atomic integers for !_LP64 platforms.
  #endif /* ifdef NS_CLIENT_TRACE */
  
  #define TCP_CLIENT(c) (((c)->attributes & NS_CLIENTATTR_TCP) != 0)
-@@ -126,7 +126,7 @@
+@@ -128,7 +128,7 @@
   * Number of tasks to be used by clients - those are used only when recursing
   */
  
 -#if defined(_WIN32) && !defined(_WIN64)
-+#if (defined(_WIN32) && !defined(_WIN64)) || !defined(_LP64)
- LIBNS_EXTERNAL_DATA atomic_uint_fast32_t ns_client_requests =
- 	ATOMIC_VAR_INIT(0);
++#if defined(_WIN32) && !defined(_WIN64) || !defined(_LP64)
+ LIBNS_EXTERNAL_DATA atomic_uint_fast32_t ns_client_requests = 0;
  #else  /* if defined(_WIN32) && !defined(_WIN64) */
+ LIBNS_EXTERNAL_DATA atomic_uint_fast64_t ns_client_requests = 0;