unbound 1.48:

Features:
* harden-below-nxdomain config option, default off (because very old software
  may be incompatible). We could enable it by default in the future.
  From draft-vixie-dnsext-resimprove-00.
* typetransparent localzone: does not block other RR types.
* so-sndbuf option for very busy servers, a bit like so-rcvbuf.

Bug Fixes:
* Fix so a changed NS RRset does not get moved name stuck on old server,
  for type NS the TTL is not increased.
* Fix prefetch so it does not get stuck on old server for moved names.
* Fix insecure CNAME sequence marked as secure, reported by Bert Hubert.
* faster lruhash get_mem routine.
* [bugzilla: 346 ] remove ITAR scripts from contrib,
  the service is discontinued, use the root.
* Fix in infra cache that could cause rto larger than TOP_TIMEOUT kept.
* algorithm compromise protection using the algorithms signalled in the DS
  record. Also, trust anchors, DLV, and RFC5011 receive this, and thus,
  if you have multiple algorithms in your trust-anchor-file then it will now
  behave different than before. Also, 5011 rollover for algorithms needs to be
  double-signature until the old algorithm is revoked.
* squelch 'tcp connect: bla' in logfile, (set verbosity 2 to see them)
* fix validation in this case: CNAME to nodata for co-hosted opt-in
  NSEC3 insecure delegation, was bogus, fixed to be insecure.
* Fix our 'BDS' license (typo reported by Xavier Belanger).
* [bugzilla: 338 ] print address when socket creation fails.
* Fix storage of EDNS failures in the infra cache.
* silence 'tcp connect: broken pipe' and 'net down' at low verbosity.
* unbound-anchor compiles with openssl 0.9.7.
* Be lenient and accept imgw.pl malformed packet (like BIND).
* the included ldns tarball is updated (to 1.6.8)
* iana portlist updated.

unbound 1.47:

Features:
* unbound-anchor app, unbound requires libexpat (xml parser library).
  It creates or updates a root.key file. Use it before you start the validator
  (e.g. at system boot time).
* dump_infra and flush_infra commands for unbound-control.

Bug Fixes:
* GOST code enabled by default (RFC 5933).
* Configure detects libev-4.00.
* do not synthesize a CNAME message from cache for qtype DS.
* Use central entropy to seed threads.
* Change the rtt used to probe EDNS-timeout hosts to 1000 msec.
* Fix validation failure for parent and child on same server with an insecure
  childzone and a CNAME from parent to child.
* Change of timeout code. No more lost and backoff in blockage. At 12sec timeout
  (and at least 2x lost before) one probe per IP is allowed only. At 120sec,
  the IP is blocked. After 15min, a 120sec entry has a single retry packet.
* no timeout backoff if meanwhile a query succeeded.
* Configure errors if ldns is not found.
* Windows 7 fix for the installer.
* Fix bug where fallback_tcp causes wrong roundtrip and edns observation to be
  noted in cache. Fix bug where EDNSprobe halted exponential backoff if EDNS
  status unknown.
* interface automatic works for some people with ip6 disabled. Therefore the
  error check is removed, so they can use the option.
* Fix TCP so it uses a random outgoing-interface.
* Fix bug when DLV below a trust-anchor that uses NSEC3 optout where the zone
  has a secure delegation hosted on the same server did not verify as secure
  (it was insecure by mistake).
* Fix alloc_reg_release for longer uptime in out of memory conditions.
* [bugzilla: 329 ] in example.conf show correct ipv4 link-local 169.254/16.
* compliance with draft-ietf-dnsop-default-local-zones-14,
  removed reverse ipv6 orchid prefix from builtin list.
* Algorithm rollover operational reality intrudes, for trust-anchor and
  5011-store, if one key matches it's good enough.
* Fix reported validation error in out of memory condition.
* Abide RFC5155 section 9.2: no AD flag for replies with NSEC3 optout.
* increased mesh-max-activation from 1000 to 3000 for crazy domains like
  _tcp.slb.com with 262 servers.
* [bugzilla: 327 ] Fix for cannot access stub zones until the root is primed.
* openbsd-lint fixes
* [bugzilla: 321 ] Fix resolution of rs.ripe.net artifacts with 0x20.
  Delegpt structures checked for duplicates always.
  No more nameserver lookups generated when depth is full anyway.
* [bugzilla: 322 ] Fix, configure does not respect CFLAGS on Solaris.
  Pass CFLAGS="-xO4 -xtarget=generic" on the configure command line if use
  sun-cc, but some systems need different flags.
* Fix acx_nlnetlabs.m4 configure output for autoconf-2.66 AS_TR_CPP changes,
  uses m4_bpatsubst now.
* make test (or make check) should be more portable and run the unit test and
  testbound scripts. (make longtest has special requirements).
* More pleasant remote control command parsing.
* Fix name of rrset printed that failed validation.
* Return NXDOMAIN after chain of CNAMEs ends at name-not-found.
* Fix validation in case a trust anchor enters into a zone with
  unsupported algorithms.
* iana portlist updated.
* updated ldns tarball.

4 files changed, 21 insertions, 16 deletions

diff --git a/net/unbound/Makefile b/net/unbound/Makefile
index b5c69de7c50..c94389c3bc3 100644
--- a/net/unbound/Makefile
+++ b/net/unbound/Makefile
@@ -1,7 +1,6 @@
-# $NetBSD: Makefile,v 1.12 2010/11/29 12:41:51 ghen Exp $
+# $NetBSD: Makefile,v 1.13 2011/03/21 15:04:32 pettai Exp $
 
-DISTNAME=	unbound-1.4.6
-PKGREVISION=	1
+DISTNAME=	unbound-1.4.8
 CATEGORIES=	net
 MASTER_SITES=	http://www.unbound.net/downloads/
 
@@ -16,6 +15,7 @@ USE_LIBTOOL=	yes
 USE_TOOLS+=	gmake
 
 CONFIGURE_ARGS+=	--with-ldns=${BUILDLINK_PREFIX.ldns}
+CONFIGURE_ARGS+=	--with-libexpat=${BUILDLINK_PREFIX.expat}
 CONFIGURE_ARGS+=	--with-pidfile=${VARBASE}/run/unbound.pid
 CONFIGURE_ARGS+=	--sysconfdir=${PKG_SYSCONFBASE}
 
@@ -41,6 +41,7 @@ UNBOUND_GROUP?=	unbound
 PKG_GROUPS=	${UNBOUND_GROUP}
 PKG_USERS=	${UNBOUND_USER}:${UNBOUND_GROUP}
 
+.include "../../textproc/expat/buildlink3.mk"
 .include "../../net/ldns/buildlink3.mk"
 .include "../../security/openssl/buildlink3.mk"
 .include "../../mk/bsd.pkg.mk"
diff --git a/net/unbound/PLIST b/net/unbound/PLIST
index e3ac131d279..fc82c985cb2 100644
--- a/net/unbound/PLIST
+++ b/net/unbound/PLIST
@@ -1,13 +1,15 @@
-@comment $NetBSD: PLIST,v 1.3 2009/06/14 18:09:46 joerg Exp $
+@comment $NetBSD: PLIST,v 1.4 2011/03/21 15:04:32 pettai Exp $
 include/unbound.h
 lib/libunbound.la
 man/man1/unbound-host.1
 man/man3/libunbound.3
 man/man5/unbound.conf.5
+man/man8/unbound-anchor.8
 man/man8/unbound-checkconf.8
 man/man8/unbound-control.8
 man/man8/unbound.8
 sbin/unbound
+sbin/unbound-anchor
 sbin/unbound-checkconf
 sbin/unbound-control
 sbin/unbound-control-setup
diff --git a/net/unbound/distinfo b/net/unbound/distinfo
index d54776da78e..6ef340400fd 100644
--- a/net/unbound/distinfo
+++ b/net/unbound/distinfo
@@ -1,6 +1,6 @@
-$NetBSD: distinfo,v 1.10 2010/08/30 18:16:45 pettai Exp $
+$NetBSD: distinfo,v 1.11 2011/03/21 15:04:32 pettai Exp $
 
-SHA1 (unbound-1.4.6.tar.gz) = b0d7c58f173c5c80cc81345f6766555f96bde20d
-RMD160 (unbound-1.4.6.tar.gz) = d5d8cd19096aa8c0624ecfb8f57ce0276ab5c1d4
-Size (unbound-1.4.6.tar.gz) = 4384085 bytes
-SHA1 (patch-ac) = f2294c6216b4f1ee1c1fe07a9949aea2bb8dc485
+SHA1 (unbound-1.4.8.tar.gz) = 557a9c10de9a83f88cd7c66d44488f1cb65de4fa
+RMD160 (unbound-1.4.8.tar.gz) = 08082658e4b7f0e82e7e3feae1acea42e1956fb4
+Size (unbound-1.4.8.tar.gz) = 4474063 bytes
+SHA1 (patch-ac) = 2ad1a444a425e8583c1212faa4479f0d65061bff
diff --git a/net/unbound/patches/patch-ac b/net/unbound/patches/patch-ac
index bd11b14c31d..b62ac30a0f0 100644
--- a/net/unbound/patches/patch-ac
+++ b/net/unbound/patches/patch-ac
@@ -1,8 +1,10 @@
-$NetBSD: patch-ac,v 1.6 2010/07/26 19:09:19 pettai Exp $
+$NetBSD: patch-ac,v 1.7 2011/03/21 15:04:32 pettai Exp $
 
---- Makefile.in.orig	2010-06-02 08:59:11.000000000 +0000
+$NetBSD: patch-ac,v 1.7 2011/03/21 15:04:32 pettai Exp $
+
+--- Makefile.in.orig	2011-01-12 09:17:59.000000000 +0000
 +++ Makefile.in
-@@ -101,12 +101,11 @@ UNITTEST_SRC=$(patsubst $(srcdir)/%,%, \
+@@ -102,12 +102,11 @@ UNITTEST_SRC=$(patsubst $(srcdir)/%,%, \
  	testcode/readhex.c testcode/ldns-testpkts.c smallapp/worker_cb.c \
  	$(COMMON_SRC)
  UNITTEST_OBJ=$(addprefix $(BUILD),$(UNITTEST_SRC:.c=.lo)) $(COMPAT_OBJ)
@@ -18,9 +20,9 @@ $NetBSD: patch-ac,v 1.6 2010/07/26 19:09:19 pettai Exp $
  CONTROL_OBJ=$(addprefix $(BUILD),$(CONTROL_SRC:.c=.lo)) $(COMPAT_OBJ)
  HOST_SRC=smallapp/unbound-host.c
  HOST_OBJ=$(addprefix $(BUILD),$(HOST_SRC:.c=.lo)) $(filter-out $(BUILD)compat/ctime_r.lo, $(COMPAT_OBJ))
-@@ -213,21 +212,21 @@ libunbound.la:	$(LIBUNBOUND_OBJ) $(ldnsl
- 	$(INFO) Link $@
- 	$Q$(LINK_LIB) -export-symbols $(srcdir)/libunbound/ubsyms.def -o $@ $(sort $(LIBUNBOUND_OBJ)) -rpath $(libdir) $(LIBS)
+@@ -243,21 +242,21 @@ else
+ 	$Q$(LINK_LIB) -export-symbols $(BUILD)clubsyms.def -o $@ $(sort $(LIBUNBOUND_OBJ)) -rpath $(libdir) $(LIBS)
+ endif
  
 -unbound$(EXEEXT):	$(DAEMON_OBJ) $(ldnslib)
 +unbound$(EXEEXT):	$(DAEMON_OBJ) $(ldnslib) libunbound.la
@@ -45,5 +47,5 @@ $NetBSD: patch-ac,v 1.6 2010/07/26 19:09:19 pettai Exp $
 -	$Q$(LINK) -o $@ $(sort $(HOST_OBJ)) -L. -L.libs -lunbound $(LIBS)
 +	$Q$(LINK) -o $@ $(sort $(HOST_OBJ)) libunbound.la $(LIBS)
  
- unbound-service-install$(EXEEXT):	$(SVCINST_OBJ)
+ unbound-anchor$(EXEEXT):	$(UBANCHOR_OBJ) libunbound.la $(ldnslib)
  	$(INFO) Link $@