Update net/dnsmasq to 2.73.

Fix build on SunOS.

Version 2.73
  Fix crash at startup when an empty suffix is supplied to
  --conf-dir, also trivial memory leak. Thanks to
  Tomas Hozza for spotting this.

  Remove floor of 4096 on advertised EDNS0 packet size when
  DNSSEC in use, the original rationale for this has long gone.
  Thanks to Anders Kaseorg for spotting this.

  Use inotify for checking on updates to /etc/resolv.conf and
  friends under Linux. This fixes race conditions when the files are
  updated rapidly and saves CPU by noy polling. To build
  a binary that runs on old Linux kernels without inotify,
  use make COPTS=-DNO_INOTIFY

  Fix breakage of --domain=<domain>,<subnet>,local - only reverse
  queries were intercepted. THis appears to have been broken
  since 2.69. Thanks to Josh Stone for finding the bug.

  Eliminate IPv6 privacy addresses and deprecated addresses from
  the answers given by --interface-name. Note that reverse queries
  (ie looking for names, given addresses) are not affected.
  Thanks to Michael Gorbach for the suggestion.

  Fix crash in DNSSEC code with long RRs. Thanks to Marco Davids
  for the bug report.

  Add --ignore-address option. Ignore replies to A-record
  queries which include the specified address. No error is
  generated, dnsmasq simply continues to listen for another
  reply. This is useful to defeat blocking strategies which
  rely on quickly supplying a forged answer to a DNS
  request for certain domains, before the correct answer can
  arrive. Thanks to Glen Huang for the patch.

  Revisit the part of DNSSEC validation which determines if an
  unsigned answer is legit, or is in some part of the DNS
  tree which should be signed. Dnsmasq now works from the
  DNS root downward looking for the limit of signed
  delegations, rather than working bottom up. This is
  both more correct, and less likely to trip over broken
  nameservers in the unsigned parts of the DNS tree
  which don't respond well to DNSSEC queries.

  Add --log-queries=extra option, which makes logs easier
  to search automatically.

  Add --min-cache-ttl option. I've resisted this for a long
  time, on the grounds that disbelieving TTLs is never a
  good idea, but I've been persuaded that there are
  sometimes reasons to do it. (Step forward, GFW).
  To avoid misuse, there's a hard limit on the TTL
  floor of one hour. Thansk to RinSatsuki for the patch.

  Cope with multiple interfaces with the same link-local
  address. (IPv6 addresses are scoped, so this is allowed.)
  Thanks to Cory Benfield for help with this.

  Add --dhcp-hostsdir. This allows addition of new host
  configurations to a running dnsmasq instance much more
  cheaply than having dnsmasq re-read all its existing
  configuration each time.

  Don't reply to DHCPv6 SOLICIT messages if we're not
  configured to do stateful DHCPv6. Thanks to Win King Wan
  for the patch.

  Fix broken DNSSEC validation of ECDSA signatures.

  Add --dnssec-timestamp option, which provides an automatic
  way to detect when the system time becomes valid after
  boot on systems without an RTC, whilst allowing DNS
  queries before the clock is valid so that NTP can run.
  Thanks to Kevin Darbyshire-Bryant for developing this idea.

  Add --tftp-no-fail option. Thanks to Stefan Tomanek for
  the patch.

  Fix crash caused by looking up servers.bind, CHAOS text
  record, when more than about five --servers= lines are
  in the dnsmasq config. This causes memory corruption
  which causes a crash later. Thanks to Matt Coddington for
  sterling work chasing this down.

  Fix crash on receipt of certain malformed DNS requests.
  Thanks to Nick Sampanis for spotting the problem.
  Note that this is could allow the dnsmasq process's
  memory to be read by an attacker under certain
  circumstances, so it has a CVE, CVE-2015-3294

  Fix crash in authoritative DNS code, if a .arpa zone
  is declared as authoritative, and then a PTR query which
  is not to be treated as authoritative arrived. Normally,
  directly declaring .arpa zone as authoritative is not
  done, so this crash wouldn't be seen. Instead the
  relevant .arpa zone should be specified as a subnet
  in the auth-zone declaration. Thanks to Johnny S. Lee
  for the bugreport and initial patch.

  Fix authoritative DNS code to correctly reply to NS
  and SOA queries for .arpa zones for which we are
  declared authoritative by means of a subnet in auth-zone.
  Previously we provided correct answers to PTR queries
  in such zones (including NS and SOA) but not direct
  NS and SOA queries. Thanks to Johnny S. Lee for
  pointing out the problem.

  Fix logging of DHCPREPLY which should be suppressed
  by quiet-dhcp6. Thanks to J. Pablo Abonia for
  spotting the problem.

  Try and handle net connections with broken fragmentation
  that lose large UDP packets. If a server times out,
  reduce the maximum UDP packet size field in the EDNS0
  header to 1280 bytes. If it then answers, make that
  change permanent.

  Check IPv4-mapped IPv6 addresses when --stop-rebind
  is active. Thanks to Jordan Milne for spotting this.

  Allow DHCPv4 options T1 and T2 to be set using --dhcp-option.
  Thanks to Kevin Benton for patches and work on this.

  Fix code for DHCPCONFIRM DHCPv6 messages to confirm addresses
  in the correct subnet, even of not in dynamic address
  allocation range. Thanks to Steve Hirsch for spotting
  the problem.

  Add AddDhcpLease and DeleteDhcpLease DBus methods. Thanks
  to Nicolas Cavallari for the patch.

  Allow configuration of router advertisements without the
  "on-link" bit set. Thanks to Neil Jerram for the patch.

  Extend --bridge-interface to DHCPv6 and router
  advertisements. Thanks to Neil Jerram for the patch.

4 files changed, 27 insertions, 59 deletions

diff --git a/net/dnsmasq/Makefile b/net/dnsmasq/Makefile
index ab06c40ed4d..27a9cdad9fb 100644
--- a/net/dnsmasq/Makefile
+++ b/net/dnsmasq/Makefile
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.29 2015/05/06 06:08:48 mef Exp $
+# $NetBSD: Makefile,v 1.30 2015/07/14 09:57:13 fhajny Exp $
 
-DISTNAME=		dnsmasq-2.72
+DISTNAME=		dnsmasq-2.73
 CATEGORIES=		net
 MASTER_SITES=		http://www.thekelleys.org.uk/dnsmasq/
 
@@ -46,6 +46,10 @@ PLIST.dbus=	yes
 CFLAGS+=	-DNO_IPV6
 .endif
 
+.if ${OPSYS} == "SunOS"
+CFLAGS+=	-DNO_IPSET
+.endif
+
 # Override the defaults
 AUTO_MKDIRS=yes
 CFLAGS+=		-DCONFFILE='"${PKG_SYSCONFDIR}/dnsmasq.conf"'
diff --git a/net/dnsmasq/distinfo b/net/dnsmasq/distinfo
index 51f7492c1d6..cb81f51e5ee 100644
--- a/net/dnsmasq/distinfo
+++ b/net/dnsmasq/distinfo
@@ -1,8 +1,7 @@
-$NetBSD: distinfo,v 1.27 2015/05/06 06:08:48 mef Exp $
+$NetBSD: distinfo,v 1.28 2015/07/14 09:57:13 fhajny Exp $
 
-SHA1 (dnsmasq-2.72.tar.gz) = c2dc54b142ec5676d6e22951bc5b61863b0503fe
-RMD160 (dnsmasq-2.72.tar.gz) = bac635ea7c93e2864fb369d3e346a65222e70ce2
-Size (dnsmasq-2.72.tar.gz) = 654739 bytes
+SHA1 (dnsmasq-2.73.tar.gz) = 2bea70fed6b43d69d58ee0f473e3b0c2f4cd2feb
+RMD160 (dnsmasq-2.73.tar.gz) = c7d49a608ba73bd6f075878f8bf24e1677b6aebb
+Size (dnsmasq-2.73.tar.gz) = 681245 bytes
 SHA1 (patch-dnsmasq.conf.example) = 2974c722a26400915037259c79899e8a3e95bf8f
-SHA1 (patch-src_bpf.c) = 82b1fcbb20122684193fe0718bff93ab20af0463
-SHA1 (patch-src_rfc1035.c) = 08cd37ee864931cf664a2e008ce475898a2757df
+SHA1 (patch-src_bpf.c) = 51e1341d940304a5246ee87d5e3b07faf7d70cf1
diff --git a/net/dnsmasq/patches/patch-src_bpf.c b/net/dnsmasq/patches/patch-src_bpf.c
index 9622cead880..a594cf7f7f4 100644
--- a/net/dnsmasq/patches/patch-src_bpf.c
+++ b/net/dnsmasq/patches/patch-src_bpf.c
@@ -1,15 +1,26 @@
-$NetBSD: patch-src_bpf.c,v 1.5 2015/05/06 06:08:48 mef Exp $
+$NetBSD: patch-src_bpf.c,v 1.6 2015/07/14 09:57:13 fhajny Exp $
 
 Add inet6 include for OS X
+Fix build on SunOS
 
---- src/bpf.c.orig	2014-09-24 06:16:15.000000000 +0900
-+++ src/bpf.c	2015-05-06 15:01:56.000000000 +0900
-@@ -29,7 +29,7 @@
+--- src/bpf.c.orig	2015-06-12 20:39:11.000000000 +0000
++++ src/bpf.c
+@@ -20,7 +20,9 @@
+ #include <ifaddrs.h>
+ 
+ #include <sys/param.h>
++#if defined(HAVE_BSD_NETWORK)
+ #include <sys/sysctl.h>
++#endif
+ #include <net/if.h>
+ #include <net/route.h>
+ #include <net/if_dl.h>
+@@ -29,7 +31,7 @@
  #  include <net/if_var.h> 
  #endif
  #include <netinet/in_var.h>
 -#ifdef HAVE_IPV6
-+#if defined(HAVE_IPV6) || defined(__APPLE__)
++#if (defined(HAVE_IPV6) && !defined(HAVE_SOLARIS_NETWORK)) || defined(__APPLE__)
  #  include <netinet6/in6_var.h>
  #endif
  
diff --git a/net/dnsmasq/patches/patch-src_rfc1035.c b/net/dnsmasq/patches/patch-src_rfc1035.c
deleted file mode 100644
index ab9be83cf51..00000000000
--- a/net/dnsmasq/patches/patch-src_rfc1035.c
+++ /dev/null
@@ -1,46 +0,0 @@
-$NetBSD: patch-src_rfc1035.c,v 1.2 2015/05/06 06:08:48 mef Exp $
-
-From ad4a8ff7d9097008d7623df8543df435bfddeac8 Mon Sep 17 00:00:00 2001
-From: Simon Kelley <simon@thekelleys.org.uk>
-Date: Thu, 9 Apr 2015 21:48:00 +0100
-Subject: [PATCH] Fix crash on receipt of certain malformed DNS requests.
-
----
- CHANGELOG     |    3 +++
- src/rfc1035.c |    9 ++++++---
- 2 files changed, 9 insertions(+), 3 deletions(-)
-
-diff --git a/src/rfc1035.c b/src/rfc1035.c
-index 7a07b0c..a995ab5 100644
---- src/rfc1035.c
-+++ src/rfc1035.c
-@@ -1198,7 +1198,10 @@ unsigned int extract_request(struct dns_header *header, size_t qlen, char *name,
- size_t setup_reply(struct dns_header *header, size_t qlen,
- 		struct all_addr *addrp, unsigned int flags, unsigned long ttl)
- {
--  unsigned char *p = skip_questions(header, qlen);
-+  unsigned char *p;
-+
-+  if (!(p = skip_questions(header, qlen)))
-+    return 0;
-   
-   /* clear authoritative and truncated flags, set QR flag */
-   header->hb3 = (header->hb3 & ~(HB3_AA | HB3_TC)) | HB3_QR;
-@@ -1214,7 +1217,7 @@ size_t setup_reply(struct dns_header *header, size_t qlen,
-     SET_RCODE(header, NOERROR); /* empty domain */
-   else if (flags == F_NXDOMAIN)
-     SET_RCODE(header, NXDOMAIN);
--  else if (p && flags == F_IPV4)
-+  else if (flags == F_IPV4)
-     { /* we know the address */
-       SET_RCODE(header, NOERROR);
-       header->ancount = htons(1);
-@@ -1222,7 +1225,7 @@ size_t setup_reply(struct dns_header *header, size_t qlen,
-       add_resource_record(header, NULL, NULL, sizeof(struct dns_header), &p, ttl, NULL, T_A, C_IN, "4", addrp);
-     }
- #ifdef HAVE_IPV6
--  else if (p && flags == F_IPV6)
-+  else if (flags == F_IPV6)
-     {
-       SET_RCODE(header, NOERROR);
-       header->ancount = htons(1);