CVS commit: pkgsrc/net/nsd

["Havard Eidnes" <he%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   he
Date:           Tue Jul  7 16:06:41 UTC 2026

Modified Files:
        pkgsrc/net/nsd: Makefile distinfo

Log Message:
Update nsd to version 4.15.0.

Pkgsrc changes:
 * Version & checksum changes.

Upstream changes:

4.15.0
================
FEATURES:
        - Merge #483 from ruuda: Improve Prometheus metrics: Move zonestats from
          metric name to label
BUG FIXES:
        - Fix #478: Feature request: reduce syslog noise from frequent
          read-only control commands (e.g. stats_noreset). It logs the
          verbosity command always, and others at 2 and higher.
        - Fix XDP cleanup code being executed even if xdp is not configured
        - Merge #481 from jaredmauch: Fix pedantic/CodeQL warning in sources
        - Merge #484 from orlitzky: OpenRC: fix network deps and support both
          supervisors
        - Fix PROXYv2 header read and consume, it checks the header size.
          Thanks to Qifan Zhang, Palo Alto Networks for the report.
        - Fix notify relay ipc to check for large size.
          This stops desync of the internal notify pipe.
          Thanks to Qifan Zhang, Palo Alto Networks for the report.
        - Fix print of malformed HIP records.
          Thanks to Qifan Zhang, Palo Alto Networks, for the report, and
          Haruki Oyama (Waseda University) for also reporting this issue.
        - Fix to not fail on NSEC3 records with a bad owner name.
          Thanks to Qifan Zhang, Palo Alto Networks, for the report.
        - Fix print of NXT RR without bitmap
          Thanks to Qifan Zhang, Palo Alto Networks, for the report.
        - Fix overflow for NSEC3 zones with 255-octet name
          Thanks to Haruki Oyama (Waseda University) for the report, and
          Qifan Zhang, Palo Alto Networks, for also reporting this issue.
        - Fix to update github ci actions/checkout to v7.
        - Fix notify and zone transfer processing for malformed SOA records,
          with a short rdata content. It stops an assertion failure. Thanks to
          Tristan Madani (@TristanInSec) from Talence Security for the report.
        - Fix that wrong buffer position in IXFR for the first SOA causes the
          storage to retrieve wrong information. Later data would overwrite it
          so it did not cause observable trouble. Thanks to Tristan Madani
          (@TristanInSec) from Talence Security for the report.
        - More robust removing of RRs from an IXFR processing.
          Thanks zhangph for reporting this issue
        - Fix unit test for stopmany for process role logs.
        - Fix nsd-control assoc_tsig, if that interrupts a zone transfer in
          progress, to not crash. It restarts the transfer from the primary.
          Thanks to Qifan Zhang, Palo Alto Networks, for the report.
        - Fix nsd-control del_tsig, if that interrupts a zone transfer in
          progress, to not crash. It does not delete the key, if in use.
          Thanks to Qifan Zhang, Palo Alto Networks, for the report.
        - Fix catalog producer zone with long name, so that it does not crash
          on that. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
        - Fix catalog consumer zone with long name for member unique label that
          is long, so that it does not crash on that.
          Thanks to Qifan Zhang, Palo Alto Networks, for the report.
        - Fix that non-IN-class records cause a zone transfer to be rejected.
          Also such records are not added from a transfer. This stops an
          assertion failure.
          Thanks to Qifan Zhang, Palo Alto Networks, for the report.
        - Fix to disallow a SOA record in the middle of an AXFR. This stops an
          assertion failure.
          Thanks to Qifan Zhang, Palo Alto Networks, for the report.
        - Fix to set zone is_secure to false when IXFR removes RRSIG DNSKEY.
          This stops an assertion failure. Also fix soa and ns rrset change in
          IXFR when packed rrsets are disabled.
          Thanks to Qifan Zhang, Palo Alto Networks, for the report.
        - Fix to handle NSEC3 zones without space for hashes. Zones with a apex
          domain name length >= 223 bytes, that have a NSEC3PARAM must not be
          prehashed, since the hashed owner name would not fit.
          Thanks Qifan Zhang, Palo Alto Networks, for the report
        - Fix to add hardening to zone_ixfr_remove_oldest, for IXFR processing.
          Thanks to Qifan Zhang, Palo Alto Networks, for the report.
        - Fix for xfrd crash with too short response to a UDP SOA query
          Only for release builds and only when configured for XFR over UDP
          Thanks to Qifan Zhang, Palo Alto Networks, for the report.
        - Fix that out-of-zone records are skipped from zone transfers.
          Otherwise such records could stick around after zone deletion and
          cause failures for DS queries.
          Thanks to Qifan Zhang, Palo Alto Networks, for the report.


To generate a diff of this commit:
cvs rdiff -u -r1.137 -r1.138 pkgsrc/net/nsd/Makefile
cvs rdiff -u -r1.94 -r1.95 pkgsrc/net/nsd/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/net/nsd/Makefile
diff -u pkgsrc/net/nsd/Makefile:1.137 pkgsrc/net/nsd/Makefile:1.138
--- pkgsrc/net/nsd/Makefile:1.137       Thu Jun 25 11:21:53 2026
+++ pkgsrc/net/nsd/Makefile     Tue Jul  7 16:06:41 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.137 2026/06/25 11:21:53 he Exp $
+# $NetBSD: Makefile,v 1.138 2026/07/07 16:06:41 he Exp $
 
-DISTNAME=      nsd-4.14.3
+DISTNAME=      nsd-4.15.0
 CATEGORIES=    net
 MASTER_SITES=  http://www.nlnetlabs.nl/downloads/nsd/
 

Index: pkgsrc/net/nsd/distinfo
diff -u pkgsrc/net/nsd/distinfo:1.94 pkgsrc/net/nsd/distinfo:1.95
--- pkgsrc/net/nsd/distinfo:1.94        Thu Jun 25 11:21:53 2026
+++ pkgsrc/net/nsd/distinfo     Tue Jul  7 16:06:41 2026
@@ -1,6 +1,6 @@
-$NetBSD: distinfo,v 1.94 2026/06/25 11:21:53 he Exp $
+$NetBSD: distinfo,v 1.95 2026/07/07 16:06:41 he Exp $
 
-BLAKE2s (nsd-4.14.3.tar.gz) = 0b01e633a3c8d2eef875d683875375ca417160b9c78d0d096f33f601965db474
-SHA512 (nsd-4.14.3.tar.gz) = 7acabc0e54eb24ca85578f406009f20721da0137f310eb78b3e3c88f66a4369edc2d15c513aa4c11939e4d8caf0cfb29ea6801ee085f34d1845afbbc14a35cc0
-Size (nsd-4.14.3.tar.gz) = 1617135 bytes
+BLAKE2s (nsd-4.15.0.tar.gz) = 984759f66e1493a6183cf238ed77b9e439c40311ae9d871c39f049e29b987f55
+SHA512 (nsd-4.15.0.tar.gz) = 8bf1ab1dcaf707ace0066aaebbbaf67c4a81b19c36d3534884de7a3b533e54ecc48334a272f039408b91a7ad80ce2e928d94f84b93ce802688581e55dec1ff44
+Size (nsd-4.15.0.tar.gz) = 1623254 bytes
 SHA1 (patch-Makefile.in) = 93f77704ee6730aef41955511807ce2f4b6cfc90