net/bind916: update to 9.16.13

9.16.13 (2022-03-17)

New Features

* A new purge-keys option has been added to dnssec-policy. It sets the
  period of time that key files are retained after becoming obsolete
  due to a key rollover; the default is 90 days. This feature can be
  disabled by setting purge-keys to 0. [GL #2408]

Feature Changes

* When serve-stale is enabled and stale data is available, named now
  returns stale answers upon encountering any unexpected error in the
  query resolution process. This may happen, for example, if the
  fetches-per-server or fetches-per-zone limits are reached. In this
  case, named attempts to answer DNS requests with stale data, but
  does not start the stale-refresh-time window. [GL #2434]

Bug Fixes

* Zone journal (.jnl) files created by versions of named prior to
  9.16.12 were no longer compatible; this could cause problems when
  upgrading if journal files were not synchronized first. This has
  been corrected: older journal files can now be read when starting
  up. When an old-style journal file is detected, it is updated to the
  new format immediately after loading.

  Note that journals created by the current version of named are not
  usable by versions prior to 9.16.12. Before downgrading to a prior
  release, users are advised to ensure that all dynamic zones have
  been synchronized using rndc sync -clean.

  A journal file's format can be changed manually by running
  named-journalprint -d (downgrade) or named-journalprint -u
  (upgrade). Note that this must not be done while named is
  running. [GL #2505]

* named crashed when it was allowed to serve stale answers and
  stale-answer-client-timeout was triggered without any (stale) data
  available in the cache to answer the query. [GL #2503]

* If an outgoing packet exceeded max-udp-size, named dropped it
  instead of sending back a proper response. To prevent this problem,
  the IP_DONTFRAG option is no longer set on UDP sockets, which has
  been happening since BIND 9.16.11. [GL #2466]

* NSEC3 records were not immediately created when signing a dynamic
  zone using dnssec-policy with nsec3param. This has been fixed. [GL
  #2498]

* A memory leak occurred when named was reconfigured after adding an
  inline-signed zone with auto-dnssec maintain enabled. This has been
  fixed. [GL #2041]

* An invalid direction field (not one of N, S, E, W) in a LOC record
  resulted in an INSIST failure when a zone file containing such a
  record was loaded. [GL #2499]

7 files changed, 29 insertions, 51 deletions

diff --git a/net/bind916/Makefile b/net/bind916/Makefile
index 1c2bff2b316..cfdeabf3878 100644
--- a/net/bind916/Makefile
+++ b/net/bind916/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.10 2021/02/17 21:36:03 wiz Exp $
+# $NetBSD: Makefile,v 1.11 2021/03/21 04:16:17 taca Exp $
 
 DISTNAME=	bind-${BIND_VERSION}
 PKGNAME=	${DISTNAME:S/-P/pl/}
@@ -15,7 +15,7 @@ CONFLICTS+=	host-[0-9]*
 
 MAKE_JOBS_SAFE=	no
 
-BIND_VERSION=	9.16.12
+BIND_VERSION=	9.16.13
 
 BUILD_DEFS+=	BIND_DIR VARBASE
 
diff --git a/net/bind916/PLIST b/net/bind916/PLIST
index b71911dd93c..6eaca5a1878 100644
--- a/net/bind916/PLIST
+++ b/net/bind916/PLIST
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.3 2020/11/26 13:21:51 taca Exp $
+@comment $NetBSD: PLIST,v 1.4 2021/03/21 04:16:17 taca Exp $
 bin/arpaname
 bin/delv
 bin/dig
@@ -220,6 +220,7 @@ include/isc/taskpool.h
 include/isc/thread.h
 include/isc/time.h
 include/isc/timer.h
+include/isc/tls.h
 include/isc/tm.h
 include/isc/types.h
 include/isc/utf8.h
diff --git a/net/bind916/distinfo b/net/bind916/distinfo
index 41b1a9c6ed1..7756c43d3ac 100644
--- a/net/bind916/distinfo
+++ b/net/bind916/distinfo
@@ -1,9 +1,9 @@
-$NetBSD: distinfo,v 1.10 2021/02/17 21:36:03 wiz Exp $
+$NetBSD: distinfo,v 1.11 2021/03/21 04:16:17 taca Exp $
 
-SHA1 (bind-9.16.12.tar.xz) = 4e75a4c9ffb905d7eaa389464f0f3418c94cb2e7
-RMD160 (bind-9.16.12.tar.xz) = 7b180be178a847af1f47f06fbfec4bf79326df68
-SHA512 (bind-9.16.12.tar.xz) = 001613bd3c8bfc73d60bf3c053b233233a981132206e1ae5847820c5416ba0d65b0e026817ea3a718c7d3745c28a8de8dd9fb4355344955bead7bc2e1433e074
-Size (bind-9.16.12.tar.xz) = 5017756 bytes
+SHA1 (bind-9.16.13.tar.xz) = 5120b0e7fcc8b7d3e1c9d1414c5c3888640c3b40
+RMD160 (bind-9.16.13.tar.xz) = 95ca9bcf95ecf996d3bfe97a2bad602f35a63b3e
+SHA512 (bind-9.16.13.tar.xz) = 1f3c8f54dd2c9e18cd9b67cfebb645d0a8e8f566add07fc4690cb8820bf81640c33b2b0685cb8be095e0f9ac84b2cf78176aea841a30c27d547b569b8353b07b
+Size (bind-9.16.13.tar.xz) = 5028340 bytes
 SHA1 (patch-bin_dig_dighost.c) = b1073911d80ecd519af98b6678968296ff8c0c98
 SHA1 (patch-bin_dig_include_dig_dig.h) = 10166f5bb98b208c7b10d63eb31e8253f704acc8
 SHA1 (patch-bin_named_Makefile.in) = f1367da6a226ba44d0ee13acf00b8abeb5b1b7eb
@@ -14,7 +14,7 @@ SHA1 (patch-bin_pkcs11_pkcs11-keygen.c) = d953bf48aadcdf7e95975d335167cc50f54ef9
 SHA1 (patch-bin_tools_arpaname.c) = 868da4454d06dc823680cf06a764fa40b8474708
 SHA1 (patch-bin_tools_nsec3hash.c) = 87c3891db62c45cd8ed2b484b17f7bf2e319bef3
 SHA1 (patch-config.guess) = f44c6344a297e7c623dcbf75b308eb35f797a537
-SHA1 (patch-config.h.in) = a9b2c067bada2055b51d88112e4058ccec0d1441
+SHA1 (patch-config.h.in) = fb0396429bd68bb3bf478cb1da67736592208702
 SHA1 (patch-config.sub) = 7389c0f2500f2afe96d43979a2d3e0b9f8dff073
 SHA1 (patch-config.threads.in) = fc5cc7097d87523a34c0e630cb8dd1d081d859e5
 SHA1 (patch-configure.ac) = 3dd8c49eb6bc475c20c88edc20bd8457698ad500
@@ -35,10 +35,9 @@ SHA1 (patch-lib_dns_sdb.c) = ed447ec7a134e620765b25ee36124a19dfd9fab0
 SHA1 (patch-lib_dns_sdlz.c) = 4fc15a577c64501c10c144eab147e54686e80309
 SHA1 (patch-lib_dns_validator.c) = 03dd60d4c38be7248d1e07f2c29ddd543b5f7454
 SHA1 (patch-lib_dns_view.c) = 5b092f0344b92d003f1fe1f28e4cc4c76b2505cf
-SHA1 (patch-lib_dns_zone.c) = 900e84e0de403d601df4c30f22758ab26a2a52b5
+SHA1 (patch-lib_dns_zone.c) = cad37c0fc4a05a2adb6159d4e1453fdbd3f08b41
 SHA1 (patch-lib_isc_backtrace.c) = 1b6bca9b3de7f7298882c6c88274b0baf1dad507
-SHA1 (patch-lib_isc_hp.c) = 4c9646722297460f0e973bd131439b4ede885588
-SHA1 (patch-lib_isc_include_isc_netmgr.h) = cdf6bceae7e0b288d3e7ef7a4545a9cf2411112c
+SHA1 (patch-lib_isc_include_isc_netmgr.h) = 48ac44c6a9b81e6b442deba6c075653d3691464b
 SHA1 (patch-lib_isc_include_isc_socket.h) = dc6376cd9e8391fa96efd805faee1a5d0647a142
 SHA1 (patch-lib_isc_include_isc_types.h) = bc0cdeb762d974b7be6e602b7dc2aac17fa7fe2f
 SHA1 (patch-lib_isc_netmgr_netmgr.c) = 63168c8901646e7b2079e1dc3324087508bb1e62
diff --git a/net/bind916/patches/patch-config.h.in b/net/bind916/patches/patch-config.h.in
index fd6b3a11e67..c891273c123 100644
--- a/net/bind916/patches/patch-config.h.in
+++ b/net/bind916/patches/patch-config.h.in
@@ -1,12 +1,12 @@
-$NetBSD: patch-config.h.in,v 1.3 2020/12/19 16:41:36 taca Exp $
+$NetBSD: patch-config.h.in,v 1.4 2021/03/21 04:16:17 taca Exp $
 
 * Based on NetBSD, add support for blocklist(blacklist).
 
---- config.h.in.orig	2020-12-07 08:16:53.000000000 +0000
+--- config.h.in.orig	2021-03-11 13:20:59.000000000 +0000
 +++ config.h.in
-@@ -45,6 +45,12 @@
- /* define if the ARM yield instruction is available */
- #undef HAVE_ARM_YIELD
+@@ -51,6 +51,12 @@
+ /* Define to 1 if you have the `BIO_write_ex' function. */
+ #undef HAVE_BIO_WRITE_EX
  
 +/* Define to 1 if blacklist is supported. */
 +#undef HAVE_BLACKLIST_H
diff --git a/net/bind916/patches/patch-lib_dns_zone.c b/net/bind916/patches/patch-lib_dns_zone.c
index 46f747cdb22..557cd8f9464 100644
--- a/net/bind916/patches/patch-lib_dns_zone.c
+++ b/net/bind916/patches/patch-lib_dns_zone.c
@@ -1,8 +1,8 @@
-$NetBSD: patch-lib_dns_zone.c,v 1.1 2020/08/09 15:20:22 taca Exp $
+$NetBSD: patch-lib_dns_zone.c,v 1.2 2021/03/21 04:16:17 taca Exp $
 
 * Take from NetBSD base.
 
---- lib/dns/zone.c.orig	2020-06-10 21:01:43.000000000 +0000
+--- lib/dns/zone.c.orig	2021-03-11 13:20:59.000000000 +0000
 +++ lib/dns/zone.c
 @@ -224,8 +224,13 @@ struct dns_zone {
  	int32_t journalsize;
@@ -30,13 +30,3 @@ $NetBSD: patch-lib_dns_zone.c,v 1.1 2020/08/09 15:20:22 taca Exp $
  
  	/*%
  	 * True if added by "rndc addzone"
-@@ -499,7 +508,9 @@ typedef enum {
- 						      * notify due to the zone
- 						      * just being loaded for
- 						      * the first time.  */
-+#ifndef __NetBSD__
- 	DNS_ZONEFLG___MAX = UINT64_MAX, /* trick to make the ENUM 64-bit wide */
-+#endif
- } dns_zoneflg_t;
- 
- #define DNS_ZONE_OPTION(z, o)	 ((atomic_load_relaxed(&(z)->options) & (o)) != 0)
diff --git a/net/bind916/patches/patch-lib_isc_hp.c b/net/bind916/patches/patch-lib_isc_hp.c
deleted file mode 100644
index cee41af4916..00000000000
--- a/net/bind916/patches/patch-lib_isc_hp.c
+++ /dev/null
@@ -1,15 +0,0 @@
-$NetBSD: patch-lib_isc_hp.c,v 1.1 2020/08/09 15:20:22 taca Exp $
-
-* Take from NetBSD base.
-
---- lib/isc/hp.c.orig	2020-05-06 09:59:35.000000000 +0000
-+++ lib/isc/hp.c
-@@ -82,7 +82,7 @@ struct isc_hp {
- };
- 
- static inline int
--tid() {
-+tid(void) {
- 	if (tid_v == TID_UNKNOWN) {
- 		tid_v = atomic_fetch_add(&tid_v_base, 1);
- 		REQUIRE(tid_v < isc__hp_max_threads);
diff --git a/net/bind916/patches/patch-lib_isc_include_isc_netmgr.h b/net/bind916/patches/patch-lib_isc_include_isc_netmgr.h
index 6ccfcfbdce0..17095c3ac6a 100644
--- a/net/bind916/patches/patch-lib_isc_include_isc_netmgr.h
+++ b/net/bind916/patches/patch-lib_isc_include_isc_netmgr.h
@@ -1,13 +1,16 @@
-$NetBSD: patch-lib_isc_include_isc_netmgr.h,v 1.2 2021/01/29 16:17:15 otis Exp $
+$NetBSD: patch-lib_isc_include_isc_netmgr.h,v 1.3 2021/03/21 04:16:17 taca Exp $
 
 Declare missing prototype.
 
---- lib/isc/include/isc/netmgr.h.orig	2021-01-11 13:23:31.000000000 +0000
+--- lib/isc/include/isc/netmgr.h.orig	2021-03-11 13:20:59.000000000 +0000
 +++ lib/isc/include/isc/netmgr.h
-@@ -510,3 +510,6 @@ isc_nm_tlsdnsconnect(isc_nm_t *mgr, isc_
- isc_result_t
- isc_nm_tls_create_server_ctx(const char *keyfile, const char *certfile,
- 			     isc_ssl_ctx_t **ctxp);
-+
+@@ -146,6 +146,9 @@ isc_nmhandle_getdata(isc_nmhandle_t *han
+ void *
+ isc_nmhandle_getextra(isc_nmhandle_t *handle);
+ 
 +int
 +isc_nmhandle_getfd(isc_nmhandle_t *handle);
++
+ bool
+ isc_nmhandle_is_stream(isc_nmhandle_t *handle);
+