pkgsrc-Changes archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
CVS commit: pkgsrc/net/bind920
Module Name: pkgsrc
Committed By: he
Date: Sat Oct 10 10:13:09 UTC 2026
Added Files:
pkgsrc/net/bind920: DESCR MESSAGE.rcd Makefile PLIST buildlink3.mk
builtin.mk distinfo options.mk
pkgsrc/net/bind920/files: named9.sh
pkgsrc/net/bind920/files/smf: manifest.xml named.sh
pkgsrc/net/bind920/patches: patch-configure.ac
Log Message:
net/bind920: Add a package for BIND 9.20.x, version 9.20.29.
This is brought over from pkgsrc-wip, despite it still lacks
the blocklist patches.
This is the upstream release note for this latest version:
Notes for BIND 9.20.29
----------------------
Security Fixes
~~~~~~~~~~~~~~
- Prevent excessive CPU use validating crafted DNSSEC responses.
:cve:`2026-19668`
A malicious authoritative server could serve a securely delegated zone
whose DS and DNSKEY records carried many distinct key tags but no valid
match, forcing a validating resolver into excessive key-tag matching
and high CPU use for every query. This work is now bounded by the
per-query validation limit (:any:`max-validations-per-fetch`).
ISC would like to thank Zuyao Xu and Xiang Li of the All-in-One
Security and Privacy Laboratory, Nankai University, for bringing this
vulnerability to our attention. :gl:`#5349`
- Require a TSIG on every message of incoming zone transfers.
:cve:`2026-19033`
Previously, :iscman:`named` accepted TSIG-signed zone transfers in
which some messages were unsigned, and processed those messages
before the next signature could vouch for them. It now requires a
TSIG on every message of an incoming AXFR or IXFR; all modern
nameservers already sign every message, so no change is expected in
practice. :gl:`#6062`
- Prevent a DNSSEC downgrade of secure delegations via unrelated NSEC3
records. :cve:`2026-77119`
A validating resolver could be tricked into treating a secure
delegation as unsigned and accepting forged answers for names beneath
it, if an attacker could inject responses to its queries. Such forged
proofs are now rejected. :gl:`#6234`
- Prevent forged DNSSEC-validated NXDOMAIN responses. :cve:`2026-19941`
A validating resolver could accept a signed NSEC record from an
unrelated zone as proof that a wildcard did not exist. An on-path
attacker or malicious forwarder controlling a signed zone could
therefore forge an authenticated NXDOMAIN response for a name that
should resolve through a wildcard. The wildcard-denial and
name-nonexistence proofs are now required to be signed by the same
zone. :gl:`#6253`
- DNS64 with :any:`break-dnssec` could cause an assertion failure.
:cve:`2026-19666`
When a :any:`dns64` statement is configured with ``break-dnssec yes;``
and its ``exclude`` list matches some but not all of the addresses in
an AAAA RRset, :iscman:`named` removes the excluded addresses from the
answer instead of synthesizing new ones. If the answer being filtered
had been cached together with a proof that the queried name did not
exist �<80><94> which is what a wildcard match produces �<80><94> :iscman:`named`
terminated with an assertion failure.
Only recursive resolvers are affected, and only when
``break-dnssec yes;`` is in use; the answer has to come from the
cache, so a server that is only authoritative cannot reach this.
ISC would like to thank Rintaro Kawasugi for bringing this
vulnerability to our attention. :gl:`#6301`
- Reject oversized negative cache records. :cve:`2026-19667`
A single crafted response from a server could make a resolver cache a
malformed negative entry and then terminate with an assertion failure
when reading it back. Only recursive resolvers are affected, on a
default configuration.
ISC would like to thank Rintaro Kawasugi for bringing this
vulnerability to our attention. :gl:`#6302`
- Prevent resolver crash with cached DNSSEC proofs. :cve:`2026-19662`
Under certain timing conditions, concurrent recursive queries could
cause :iscman:`named` to crash when cached DNSSEC NOQNAME proof data
was replaced while still in use. Cached proof data is now retained
until all queries using it have completed.
ISC would like to thank Samy Medjahed/Ap4sh for bringing this
vulnerability to our attention. :gl:`#6333`
- Discard repeated SOA, CNAME, and DNAME records when parsing DNS
messages. :cve:`2026-75029`
A DNS message could carry the same SOA, CNAME, or DNAME record many
times, and :iscman:`named` kept every copy while parsing it. With name
compression those copies took up far more memory internally than in
the message itself, and every later processing step had to handle all
of them. Only the first copy of such a record is now kept; identical
repeats are discarded. :gl:`#6335`
- Fix an unauthenticated crash on HTTPS using SIG(0). :cve:`2026-77692`
A specifically crafted HTTPS query using SIG(0) as authentication
could crash :iscman:`named` if the client closed the connection before
:iscman:`named` actually verified the signature. This is now fixed.
ISC would like to thank Vitaly Simonovich for bringing this
vulnerability to our attention. :gl:`#6343`
- Cached HTTPS/SVCB aliases could exhaust resolver CPU.
:cve:`2026-81736`
A recursive resolver that had cached a large set of interlinked HTTPS
or SVCB records in alias form could be driven to do an excessive
amount of work assembling a single response, because it followed every
cached alias target when building the additional section. A client
permitted to use recursion, together with an attacker-controlled zone
used to plant the records, could repeat small queries to consume
enough CPU to delay or deny service to other clients. The amount of
additional processing done for one query is now bounded.
ISC would like to thank Henrique Pereira for bringing this
vulnerability to our attention. :gl:`#6347`
- Prevent TKEY queries from terminating :iscman:`named` without global
options. :cve:`2026-76163`
The :iscman:`named` process could terminate unexpectedly when a remote
client sent a TKEY query and the configuration did not include a
global :namedconf:ref:`options` statement. This has been fixed.
ISC would like to thank Owais Lone (thesecguy) for bringing this
vulnerability to our attention. :gl:`#6357`
- Out-of-zone records in a zone database could be served as
authoritative. :cve:`2026-78301`
When a zone database contained records for names outside the zone �<80>
<94>
such as a delegation above the zone apex, left behind by a secondary
that had accepted out-of-zone data from its primary �<80><94> the server could
treat them as authoritative and answer queries for names inside the
zone with that out-of-zone data instead of the zone's own. A server
that was also a resolver could follow such a delegation and cache the
answers of the server it named, affecting names outside the configured
zone. Zone database lookups are now confined to names at or below the
zone's origin.
ISC would like to thank Henrique Pereira for bringing this
vulnerability to our attention. :gl:`#6361`
- Fix crash on wildcard answers carrying both NSEC and NSEC3 proofs.
:cve:`2026-80274`
When a wildcard answer arrived with both NSEC and NSEC3 records at the
name proving that the queried name did not exist, the resolver could
pick different records when caching the answer and when retrieving the
proof, depending on the order in which the authoritative server sent
them. This could terminate :iscman:`named` with an assertion failure,
fail the query with SERVFAIL, or serve a denial record other than the
one that had been verified. The resolver now caches and serves the
same denial record it accepted when the answer was received.
ISC would like to thank hythyt for bringing this vulnerability to our
attention. :gl:`#6369`
- Following HTTPS/SVCB aliases could leak resolver cache memory.
:cve:`2026-81563`
When a recursive server answered a query for an HTTPS or SVCB record
in alias form and the alias target had more than 13 records, the
target records were pinned in the cache permanently instead of being
released once the answer was sent. A remote party who could make the
server follow such aliases to a steady stream of fresh names could
grow the cache beyond the configured :any:`max-cache-size` until the
server was unable to resolve unrelated names. The records are now
released correctly.
ISC would like to thank Samy Medjahed/Ap4sh for bringing this
vulnerability to our attention. :gl:`#6374`
Feature Changes
~~~~~~~~~~~~~~~
- Reject oversized and malformed DNSKEY records up front.
Oversized RSA key material in a DNSKEY record was only rejected after
it had been converted, allocating memory proportional to the record
size. Such records are now rejected before conversion, as are Ed25519
and Ed448 keys with trailing bytes that were previously silently
ignored. :gl:`#4537`
Bug Fixes
~~~~~~~~~
- Prevent a crash when using both :any:`dns64` and ``filter-a``.
An assertion failure was possible when using both :any:`dns64` and the
``filter-a`` plugin simultaneously; this has been fixed.
:gl:`#5979`
- Stop passing UDP client addresses to :any:`update-policy` ``external``
helpers.
Dynamic update rules of type ``external`` delegate the authorization
decision to an external helper daemon. The client address field in
the helper request is only meant to carry TCP client addresses, which
cannot easily be spoofed, but UDP client addresses were passed as
well, so the helper could base its decision on an untrustworthy
address. For updates arriving over UDP, the helper request no longer
includes a client address. :gl:`#6061`
- Missing required NSEC3 for delegation not detected.
A missing required NSEC3 record for an insecure delegation in a
non-opt-out range was not being detected. This has been fixed.
:gl:`#6063`
- Tighten EUI48 and EUI64 text parsing.
Malformed EUI48 and EUI64 records could be accepted. This has been
fixed. :gl:`#6082`
- GeoIP ACL state could be stale or wrong after reload.
Previously, :iscman:`named` cached GeoIP information after looking it
up, but the cached information was not invalidated when the GeoIP
database was reloaded, so it could continue to be used. Existing
cached GeoIP information is now invalidated as part of the reloading
process. :gl:`#6083`
- Honor DNSSEC policy key tag ranges.
When a :any:`dnssec-policy` configured a non-default ``tag-range``,
:iscman:`dnssec-keygen` and :iscman:`dnssec-ksr` could accept
generated keys outside that range. Both tools now honor the configured
minimum and maximum key tags. :gl:`#6091`
- Fix a double free in :iscman:`mdig` when EDNS options are specified.
The :iscman:`mdig` utility could terminate with a double free when
EDNS options were specified on the command line. This has been fixed.
:gl:`#6095`
- Fix a crash when an IXFR falls back to AXFR with updates still
pending.
When a secondary zone received an incremental transfer (IXFR) and the
primary then caused :iscman:`named` to fall back to a full transfer
(AXFR) while some of the already-received incremental changes were
still waiting to be applied, :iscman:`named` could later crash when
that transfer finished. The pending changes are now discarded
correctly before the AXFR retry. :gl:`#6114`
- Fix DS requests to parental agents over TLS.
TLS configuration for parental agents was being ignored when sending
DS requests. This has been fixed. :gl:`#6135`
- Fix the :option:`rndc-confgen -q` (quiet) option.
The command-line parsing in :iscman:`rndc-confgen` was broken, so
:option:`rndc-confgen -q` did not work. This has been fixed.
:gl:`#6187`
- Enforce query ACLs for redirect zones and searched DLZs.
Queries answered from redirect zones or searched DLZ databases did not
consistently honor :any:`allow-query` and :any:`allow-query-on`,
potentially exposing restricted DNS data to excluded clients or
through excluded listening addresses. These ACLs are now enforced
before redirect or DLZ data is returned. :gl:`#6251` :gl:`#6252`
- Check ``asnum`` validity in GeoIP ACLs.
The validity of autonomous system (AS) numbers is now checked at
configuration time when parsing GeoIP ACLs that use ``asnum``
elements.
``asnum`` values start with an optional case-insensitive ``AS``
prefix, followed only by decimal digits, with no spaces or other
extraneous characters. The value represented cannot exceed 2^32.
:gl:`#6255`
- Fix a crash on :any:`remote-servers` lists that reference themselves.
Since 9.21.16 and 9.20.17, a :any:`remote-servers`, :any:`primaries`,
``masters``, or :any:`parental-agents` list that referenced itself,
directly or through another list, made :iscman:`named` crash on
startup or reconfiguration. Such references are again skipped and the
remaining entries in the list are used, as in earlier versions.
:gl:`#6287`
- A record from outside a response policy zone could crash
:iscman:`named`.
A response policy zone transferred from a primary can contain a record
whose name lies outside the zone. Such a record could terminate
:iscman:`named` with an assertion failure, both when it arrived and
again at every startup afterwards, because a secondary keeps it in its
own copy of the zone. Records like this are now rejected and logged;
previously one could also silently create a policy entry for an
unrelated name. :gl:`#6304`
- Invalid :any:`key-store` configuration could abort the DNSSEC tools.
An invalid :any:`key-store` block named ``key-directory`` in a
configuration file could abort the DNSSEC tools. This has been fixed.
:gl:`#6313`
- NSEC signature set could bypass the secure-delegation check.
When proving that a delegation was insecure, the validator bounded an
NSEC record's authority by the signer of whichever RRSIG happened to
come first in the record's signature set, rather than the signature
that actually verified. A grandparent NSEC padded with an extra,
unverifiable signature could therefore pass the check that kept such
proofs from reaching below a signed child zone. The validator now
requires every signature on the NSEC to name the same signer and
refuses proofs whose signature set is malformed or larger than
:any:`max-validations-per-fetch` allows. :gl:`#6321`
- Fix a possible :iscman:`nsupdate` issue when using GSS-TSIG.
The :iscman:`nsupdate` process could terminate unexpectedly when using
the GSS-TSIG mode executed with the :option:`nsupdate -g` option. This
has been fixed. :gl:`#6325`
- Fix a crash with a single-element ``geoip`` sortlist.
If :iscman:`named` was configured with a single-element
:any:`sortlist` containing a ``geoip`` ACL element, any matching query
triggered an assertion failure. This has been fixed. :gl:`#6342`
- Prevent out-of-bailiwick CNAMEs from evicting cached records.
A recursive resolver could remove valid cached records when a DNS
response contained an out-of-bailiwick CNAME with the same owner name.
Out-of-bailiwick data is now discarded before it can modify the cache.
:gl:`#6345`
- Restore periodic cleanup of stale resolver address data.
Stale resolver address data could remain cached until memory pressure
or an explicit flush. The cleanup interval has been corrected, so
stale entries are removed periodically again. :gl:`#6346`
- Fix :iscman:`named-checkconf`/:iscman:`named` crash with malformed
key name.
When a primary/remote-server key name was malformed,
:iscman:`named-checkconf` and :iscman:`named` were both crashing
(after warning about the invalid key name). This is now fixed.
:gl:`#6362`
- Prevent resolver crashes while processing DNS over TCP.
Recursive resolvers could terminate with an assertion failure while
processing DNS responses over TCP under sustained traffic. The failure
was observed on resolvers configured globally with ``forward only;``,
but the same transport path is also used by iterative resolution.
This has been fixed. :gl:`!12537`
Notes for BIND 9.20.28
----------------------
.. note::
The BIND 9.20.28 release was withdrawn after the discovery of a
regression in it during pre-release testing.
To generate a diff of this commit:
cvs rdiff -u -r0 -r1.1 pkgsrc/net/bind920/DESCR \
pkgsrc/net/bind920/MESSAGE.rcd pkgsrc/net/bind920/Makefile \
pkgsrc/net/bind920/PLIST pkgsrc/net/bind920/buildlink3.mk \
pkgsrc/net/bind920/builtin.mk pkgsrc/net/bind920/distinfo \
pkgsrc/net/bind920/options.mk
cvs rdiff -u -r0 -r1.1 pkgsrc/net/bind920/files/named9.sh
cvs rdiff -u -r0 -r1.1 pkgsrc/net/bind920/files/smf/manifest.xml \
pkgsrc/net/bind920/files/smf/named.sh
cvs rdiff -u -r0 -r1.1 pkgsrc/net/bind920/patches/patch-configure.ac
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Added files:
Index: pkgsrc/net/bind920/DESCR
diff -u /dev/null pkgsrc/net/bind920/DESCR:1.1
--- /dev/null Sat Oct 10 10:13:09 2026
+++ pkgsrc/net/bind920/DESCR Sat Oct 10 10:13:08 2026
@@ -0,0 +1,6 @@
+BIND, the Berkeley Internet Name Daemon.
+
+Release notes are available via https://bind9.readthedocs.io/en/
+
+This package contains the BIND 9.20 release. Upstream labels it
+as supported.
Index: pkgsrc/net/bind920/MESSAGE.rcd
diff -u /dev/null pkgsrc/net/bind920/MESSAGE.rcd:1.1
--- /dev/null Sat Oct 10 10:13:09 2026
+++ pkgsrc/net/bind920/MESSAGE.rcd Sat Oct 10 10:13:08 2026
@@ -0,0 +1,19 @@
+===========================================================================
+$NetBSD: MESSAGE.rcd,v 1.1 2026/10/10 10:13:08 he Exp $
+
+Please consider running BIND under the pseudo user account "${BIND_USER}"
+in a chroot environment for security reasons.
+
+To achieve this, set the variable "named_chrootdir" in /etc/rc.conf to
+the directory with the chroot environment e.g. "${BIND_DIR}".
+
+Note: named(8) requires writable directories under "/etc/namedb" which
+specified by "directory" in "options" statement:
+
+ cache
+ keys
+ nta
+
+Make sure these directories exists with writable by "${BIND_USER}" user.
+
+===========================================================================
Index: pkgsrc/net/bind920/Makefile
diff -u /dev/null pkgsrc/net/bind920/Makefile:1.1
--- /dev/null Sat Oct 10 10:13:09 2026
+++ pkgsrc/net/bind920/Makefile Sat Oct 10 10:13:08 2026
@@ -0,0 +1,109 @@
+# $NetBSD: Makefile,v 1.1 2026/10/10 10:13:08 he Exp $
+
+DISTNAME= bind-${BIND_VERSION}
+PKGNAME= ${DISTNAME:S/-P/pl/}
+CATEGORIES= net
+MASTER_SITES= https://downloads.isc.org/isc/bind9/${BIND_VERSION}/
+EXTRACT_SUFX= .tar.xz
+
+MAINTAINER= pkgsrc-users%NetBSD.org@localhost
+HOMEPAGE= https://www.isc.org/bind/
+COMMENT= Berkeley Internet Name Daemon implementation of DNS, version 9.20
+LICENSE= mpl-2.0
+
+CONFLICTS+= host-[0-9]*
+
+MAKE_JOBS_SAFE= no
+
+BIND_VERSION= 9.20.29
+
+BUILD_DEFS+= BIND_DIR VARBASE
+
+.include "options.mk"
+
+USE_TOOLS+= aclocal autoconf automake pax perl pkg-config
+USE_LIBTOOL= yes
+# Requires support for C11 atomics.
+USE_CC_FEATURES+= c11
+GNU_CONFIGURE= yes
+CHECK_FILES_SKIP= bin/tests/system/system-test-driver.sh
+MAKE_ENV+= WRKDIR=${WRKDIR} PREFIX=${PREFIX}
+
+.if ${OPSYS} == "Linux" && !exists(/usr/include/sys/capability.h)
+CONFIGURE_ARGS+= --disable-linux-caps
+.endif
+
+# Compile with debug info
+CFLAGS+= -g
+# Sadly, broken in -current, ref. PR#59189
+#CFLAGS+= -g -fsanitize=thread
+#LDFLAGS+= -g -fsanitize=thread
+
+CONFIGURE_ARGS+= --sysconfdir=${PKG_SYSCONFDIR}
+CONFIGURE_ARGS+= --localstatedir=${VARBASE}
+CONFIGURE_ARGS+= --with-openssl=${SSLBASE:Q}
+CONFIGURE_ARGS.NetBSD+= --disable-tracing
+CONFIGURE_ARGS.DragonFly+= --disable-kqueue
+CONFIGURE_ARGS.SunOS+= --disable-epoll
+CONFIGURE_ENV+= ac_cv_path_SPHINX_BUILD=""
+
+# Remove WRKDIR reference by modifying pkg-config related path.
+SUBST_CLASSES+= pkgconf
+SUBST_STAGE.pkgconf= pre-configure
+SUBST_FILES.pkgconf= configure.ac
+SUBST_MESSAGE.pkgconf= Fixing pkg-config path.
+SUBST_VARS.pkgconf+= BUILDLINK_DIR PREFIX TOOLS_DIR
+
+BUILDLINK_TRANSFORM.SunOS+= rm:-zrelax=transtls
+
+PKG_GROUPS_VARS+= BIND_GROUP
+PKG_USERS_VARS= BIND_USER
+
+PKG_GROUPS= ${BIND_GROUP}
+PKG_USERS= ${BIND_USER}:${BIND_GROUP}
+
+PKG_GECOS.${BIND_USER}= Named pseudo-user
+PKG_HOME.${BIND_USER}= ${BIND_DIR}
+
+DOCS= OPTIONS.md README.md
+
+FILES_SUBST+= BIND_GROUP=${BIND_GROUP} \
+ BIND_USER=${BIND_USER} PAX=${PAX:Q} \
+ SSLBASE=${SSLBASE}
+MESSAGE_SUBST+= BIND_DIR=${BIND_DIR} BIND_USER=${BIND_USER}
+
+DOCDIR= share/doc/bind9
+
+RCD_SCRIPTS= named9
+SMF_METHODS= named
+
+EGDIR= share/examples/bind9/
+INSTALL_MAKE_FLAGS+= sysconfdir=${PREFIX}/share/examples/bind9
+CONF_FILES+= ${EGDIR}/bind.keys \
+ ${PKG_SYSCONFDIR}/bind.keys
+
+INSTALLATION_DIRS+= ${DOCDIR} ${EGDIR}
+
+pre-configure:
+ cd ${WRKSRC} && \
+ rm -rf autom4te*.cache && \
+ aclocal && \
+ automake --include-deps --add-missing --copy && \
+ autoconf -f
+
+post-install:
+.for f in ${DOCS}
+ ${INSTALL_DATA} ${WRKSRC}/${f} ${DESTDIR}${PREFIX}/${DOCDIR}
+.endfor
+ ${INSTALL_DATA} \
+ ${WRKSRC}/doc/changelog/changelog-${BIND_VERSION}.rst \
+ ${DESTDIR}${PREFIX}/${DOCDIR}/CHANGES
+ ${INSTALL_DATA} ${WRKSRC}/bind.keys ${DESTDIR}${PREFIX}/${EGDIR}
+
+.include "../../mk/atomic64.mk"
+.include "../../devel/userspace-rcu/buildlink3.mk"
+.include "../../www/nghttp2/buildlink3.mk"
+.include "../../security/openssl/buildlink3.mk"
+.include "../../devel/libuv/buildlink3.mk"
+.include "../../devel/zlib/buildlink3.mk"
+.include "../../mk/bsd.pkg.mk"
Index: pkgsrc/net/bind920/PLIST
diff -u /dev/null pkgsrc/net/bind920/PLIST:1.1
--- /dev/null Sat Oct 10 10:13:09 2026
+++ pkgsrc/net/bind920/PLIST Sat Oct 10 10:13:08 2026
@@ -0,0 +1,305 @@
+@comment $NetBSD: PLIST,v 1.1 2026/10/10 10:13:08 he Exp $
+bin/arpaname
+bin/delv
+bin/dig
+bin/dnssec-cds
+bin/dnssec-dsfromkey
+bin/dnssec-importkey
+bin/dnssec-keyfromlabel
+bin/dnssec-keygen
+bin/dnssec-ksr
+bin/dnssec-revoke
+bin/dnssec-settime
+bin/dnssec-signzone
+bin/dnssec-verify
+${PLIST.dnstap}bin/dnstap-read
+bin/host
+bin/mdig
+bin/named-checkconf
+bin/named-checkzone
+bin/named-compilezone
+bin/named-journalprint
+${PLIST.lmdb}bin/named-nzd2nzf
+bin/named-rrchecker
+bin/nsec3hash
+bin/nslookup
+bin/nsupdate
+include/dns/acl.h
+include/dns/adb.h
+include/dns/badcache.h
+include/dns/bit.h
+include/dns/byaddr.h
+include/dns/cache.h
+include/dns/callbacks.h
+include/dns/catz.h
+include/dns/cert.h
+include/dns/client.h
+include/dns/clientinfo.h
+include/dns/compress.h
+include/dns/db.h
+include/dns/dbiterator.h
+include/dns/diff.h
+include/dns/dispatch.h
+include/dns/dlz.h
+include/dns/dlz_dlopen.h
+include/dns/dns64.h
+include/dns/dnsrps.h
+include/dns/dnssec.h
+include/dns/dnstap.h
+include/dns/ds.h
+include/dns/dsdigest.h
+include/dns/dsync.h
+include/dns/dyndb.h
+include/dns/ecs.h
+include/dns/ede.h
+include/dns/edns.h
+include/dns/enumclass.h
+include/dns/enumtype.h
+include/dns/fixedname.h
+include/dns/forward.h
+include/dns/geoip.h
+include/dns/ipkeylist.h
+include/dns/iptable.h
+include/dns/journal.h
+include/dns/kasp.h
+include/dns/keydata.h
+include/dns/keyflags.h
+include/dns/keymgr.h
+include/dns/keystore.h
+include/dns/keytable.h
+include/dns/keyvalues.h
+include/dns/librpz.h
+include/dns/log.h
+include/dns/master.h
+include/dns/masterdump.h
+include/dns/message.h
+include/dns/name.h
+include/dns/nametree.h
+include/dns/ncache.h
+include/dns/nsec.h
+include/dns/nsec3.h
+include/dns/nta.h
+include/dns/opcode.h
+include/dns/order.h
+include/dns/peer.h
+include/dns/private.h
+include/dns/qp.h
+include/dns/rbt.h
+include/dns/rcode.h
+include/dns/rdata.h
+include/dns/rdataclass.h
+include/dns/rdatalist.h
+include/dns/rdataset.h
+include/dns/rdatasetiter.h
+include/dns/rdataslab.h
+include/dns/rdatastruct.h
+include/dns/rdatatype.h
+include/dns/remote.h
+include/dns/request.h
+include/dns/resolver.h
+include/dns/result.h
+include/dns/rootns.h
+include/dns/rpz.h
+include/dns/rriterator.h
+include/dns/rrl.h
+include/dns/sdlz.h
+include/dns/secalg.h
+include/dns/secproto.h
+include/dns/skr.h
+include/dns/soa.h
+include/dns/ssu.h
+include/dns/stats.h
+include/dns/time.h
+include/dns/tkey.h
+include/dns/trace.h
+include/dns/transport.h
+include/dns/tsig.h
+include/dns/ttl.h
+include/dns/types.h
+include/dns/update.h
+include/dns/validator.h
+include/dns/view.h
+include/dns/xfrin.h
+include/dns/zone.h
+include/dns/zonekey.h
+include/dns/zoneverify.h
+include/dns/zt.h
+include/dst/dst.h
+include/dst/gssapi.h
+include/irs/resconf.h
+include/isc/ascii.h
+include/isc/assertions.h
+include/isc/async.h
+include/isc/atomic.h
+include/isc/attributes.h
+include/isc/backtrace.h
+include/isc/barrier.h
+include/isc/base32.h
+include/isc/base64.h
+include/isc/buffer.h
+include/isc/commandline.h
+include/isc/condition.h
+include/isc/counter.h
+include/isc/crc64.h
+include/isc/dir.h
+include/isc/dnsstream.h
+include/isc/endian.h
+include/isc/errno.h
+include/isc/error.h
+include/isc/file.h
+include/isc/fips.h
+include/isc/formatcheck.h
+include/isc/fuzz.h
+include/isc/getaddresses.h
+include/isc/hash.h
+include/isc/hashmap.h
+include/isc/heap.h
+include/isc/hex.h
+include/isc/histo.h
+include/isc/hmac.h
+include/isc/ht.h
+include/isc/httpd.h
+include/isc/interfaceiter.h
+include/isc/iterated_hash.h
+include/isc/job.h
+include/isc/lang.h
+include/isc/lex.h
+include/isc/list.h
+include/isc/log.h
+include/isc/loop.h
+include/isc/magic.h
+include/isc/managers.h
+include/isc/md.h
+include/isc/mem.h
+include/isc/meminfo.h
+include/isc/mutex.h
+include/isc/mutexblock.h
+include/isc/net.h
+include/isc/netaddr.h
+include/isc/netmgr.h
+include/isc/netscope.h
+include/isc/nonce.h
+include/isc/once.h
+include/isc/os.h
+include/isc/overflow.h
+include/isc/parseint.h
+include/isc/pause.h
+include/isc/portset.h
+include/isc/proxy2.h
+include/isc/queue.h
+include/isc/quota.h
+include/isc/radix.h
+include/isc/random.h
+include/isc/ratelimiter.h
+include/isc/refcount.h
+include/isc/regex.h
+include/isc/region.h
+include/isc/result.h
+include/isc/rwlock.h
+include/isc/safe.h
+include/isc/serial.h
+include/isc/signal.h
+include/isc/siphash.h
+include/isc/sockaddr.h
+include/isc/spinlock.h
+include/isc/stats.h
+include/isc/stdio.h
+include/isc/stdtime.h
+include/isc/strerr.h
+include/isc/string.h
+include/isc/symtab.h
+include/isc/syslog.h
+include/isc/thread.h
+include/isc/tid.h
+include/isc/time.h
+include/isc/timer.h
+include/isc/tls.h
+include/isc/tm.h
+include/isc/types.h
+include/isc/urcu.h
+include/isc/url.h
+include/isc/utf8.h
+include/isc/util.h
+include/isc/uv.h
+include/isc/work.h
+include/isc/xml.h
+include/isccc/alist.h
+include/isccc/base64.h
+include/isccc/cc.h
+include/isccc/ccmsg.h
+include/isccc/sexpr.h
+include/isccc/symtab.h
+include/isccc/symtype.h
+include/isccc/types.h
+include/isccc/util.h
+include/isccfg/aclconf.h
+include/isccfg/cfg.h
+include/isccfg/check.h
+include/isccfg/duration.h
+include/isccfg/grammar.h
+include/isccfg/kaspconf.h
+include/isccfg/log.h
+include/isccfg/namedconf.h
+include/ns/client.h
+include/ns/hooks.h
+include/ns/interfacemgr.h
+include/ns/listenlist.h
+include/ns/log.h
+include/ns/notify.h
+include/ns/query.h
+include/ns/server.h
+include/ns/sortlist.h
+include/ns/stats.h
+include/ns/types.h
+include/ns/update.h
+include/ns/xfrout.h
+lib/bind/filter-a.la
+lib/bind/filter-aaaa.la
+lib/libdns.la
+lib/libisc.la
+lib/libisccc.la
+lib/libisccfg.la
+lib/libns.la
+man/man1/arpaname.1
+man/man1/delv.1
+man/man1/dig.1
+man/man1/dnssec-cds.1
+man/man1/dnssec-dsfromkey.1
+man/man1/dnssec-importkey.1
+man/man1/dnssec-keyfromlabel.1
+man/man1/dnssec-keygen.1
+man/man1/dnssec-ksr.1
+man/man1/dnssec-revoke.1
+man/man1/dnssec-settime.1
+man/man1/dnssec-signzone.1
+man/man1/dnssec-verify.1
+${PLIST.dnstap}man/man1/dnstap-read.1
+man/man1/host.1
+man/man1/mdig.1
+man/man1/named-checkconf.1
+man/man1/named-checkzone.1
+man/man1/named-compilezone.1
+man/man1/named-journalprint.1
+${PLIST.lmdb}man/man1/named-nzd2nzf.1
+man/man1/named-rrchecker.1
+man/man1/nsec3hash.1
+man/man1/nslookup.1
+man/man1/nsupdate.1
+man/man5/named.conf.5
+man/man5/rndc.conf.5
+man/man8/ddns-confgen.8
+man/man8/filter-a.8
+man/man8/filter-aaaa.8
+man/man8/named.8
+man/man8/rndc-confgen.8
+man/man8/rndc.8
+man/man8/tsig-keygen.8
+sbin/ddns-confgen
+sbin/named
+sbin/rndc
+sbin/rndc-confgen
+sbin/tsig-keygen
+share/doc/bind9/CHANGES
+share/doc/bind9/OPTIONS.md
+share/doc/bind9/README.md
+share/examples/bind9/bind.keys
Index: pkgsrc/net/bind920/buildlink3.mk
diff -u /dev/null pkgsrc/net/bind920/buildlink3.mk:1.1
--- /dev/null Sat Oct 10 10:13:09 2026
+++ pkgsrc/net/bind920/buildlink3.mk Sat Oct 10 10:13:08 2026
@@ -0,0 +1,13 @@
+# $NetBSD: buildlink3.mk,v 1.1 2026/10/10 10:13:08 he Exp $
+
+BUILDLINK_TREE+= bind
+
+.if !defined(BIND_BUILDLINK3_MK)
+BIND_BUILDLINK3_MK:=
+
+BUILDLINK_API_DEPENDS.bind+= bind>=9.20.0
+BUILDLINK_ABI_DEPENDS.bind+= bind>=9.20.0
+BUILDLINK_PKGSRCDIR.bind?= ../../wip/bind920
+.endif # BIND_BUILDLINK3_MK
+
+BUILDLINK_TREE+= -bind
Index: pkgsrc/net/bind920/builtin.mk
diff -u /dev/null pkgsrc/net/bind920/builtin.mk:1.1
--- /dev/null Sat Oct 10 10:13:09 2026
+++ pkgsrc/net/bind920/builtin.mk Sat Oct 10 10:13:08 2026
@@ -0,0 +1,96 @@
+# $NetBSD: builtin.mk,v 1.1 2026/10/10 10:13:08 he Exp $
+
+BUILTIN_PKG:= bind
+
+BUILTIN_FIND_FILES_VAR:= EXE_NAMED
+BUILTIN_FIND_FILES.EXE_NAMED= /usr/sbin/named
+BUILTIN_FIND_LIBS:= bind
+
+.include "../../mk/buildlink3/bsd.builtin.mk"
+
+###
+### Figure out the version of BIND if an ISC BIND named exists on the
+### system.
+###
+### XXX This doesn't work for cross-compilation because we can't
+### execute the target system's program. Can the version be discovered
+### any other way?
+###
+.if ${USE_CROSS_COMPILE:tl} != "yes" && \
+ !defined(BUILTIN_VERSION.bind) && \
+ empty(EXE_NAMED:M__nonexistent__) && \
+ empty(EXE_NAMED:M${LOCALBASE}/*)
+BUILTIN_VERSION.bind!= \
+ ${EXE_NAMED} -v 2>/dev/null | ${HEAD} -1 | \
+ ${AWK} 'BEGIN { v = "4.9.11"; } \
+ /^BIND / { v = $$2; sub("-.*", "", v); } \
+ /^named / { v = $$2; sub("-.*", "", v); } \
+ END { print v; }'
+.endif
+MAKEVARS+= BUILTIN_VERSION.bind
+
+###
+### Determine if there is a built-in implementation of the package and
+### set IS_BUILTIN.<pkg> appropriately ("yes" or "no").
+###
+.if !defined(IS_BUILTIN.bind)
+IS_BUILTIN.bind= no
+. if defined(BUILTIN_VERSION.bind)
+IS_BUILTIN.bind= yes
+. endif
+.endif
+MAKEVARS+= IS_BUILTIN.bind
+
+###
+### If there is a built-in implementation, then set BUILTIN_PKG.<pkg> to
+### a package name to represent the built-in package.
+###
+.if !defined(BUILTIN_PKG.bind) && \
+ ${IS_BUILTIN.bind:tl} == yes && \
+ defined(BUILTIN_VERSION.bind)
+BUILTIN_PKG.bind= bind-${BUILTIN_VERSION.bind}
+.endif
+MAKEVARS+= BUILTIN_PKG.bind
+
+###
+### Determine whether we should use the built-in implementation if it
+### exists, and set USE_BUILTIN.<pkg> appropriate ("yes" or "no").
+###
+.if !defined(USE_BUILTIN.bind)
+. if ${PREFER.bind} == "pkgsrc"
+USE_BUILTIN.bind= no
+. else
+USE_BUILTIN.bind= ${IS_BUILTIN.bind}
+. if defined(BUILTIN_PKG.bind) && \
+ ${IS_BUILTIN.bind:tl} == yes
+USE_BUILTIN.bind= yes
+. for dep in ${BUILDLINK_API_DEPENDS.bind}
+. if ${USE_BUILTIN.bind:tl} == yes
+USE_BUILTIN.bind!= \
+ if ${PKG_ADMIN} pmatch ${dep:Q} ${BUILTIN_PKG.bind:Q}; then \
+ ${ECHO} yes; \
+ else \
+ ${ECHO} no; \
+ fi
+. endif
+. endfor
+. endif
+. endif # PREFER.bind
+.endif
+MAKEVARS+= USE_BUILTIN.bind
+
+###
+### The section below only applies if we are not including this file
+### solely to determine whether a built-in implementation exists.
+###
+CHECK_BUILTIN.bind?= no
+.if ${CHECK_BUILTIN.bind:tl} == no
+. if ${USE_BUILTIN.bind:tl} == yes
+. if ${BUILTIN_LIB_FOUND.bind:U:tl} == yes
+BUILDLINK_LDADD.bind?= -lbind
+. endif
+. elif ${USE_BUILTIN.bind:tl} == no
+BUILDLINK_LDADD.bind?= -lbind
+. endif
+
+.endif # CHECK_BUILTIN.bind
Index: pkgsrc/net/bind920/distinfo
diff -u /dev/null pkgsrc/net/bind920/distinfo:1.1
--- /dev/null Sat Oct 10 10:13:09 2026
+++ pkgsrc/net/bind920/distinfo Sat Oct 10 10:13:08 2026
@@ -0,0 +1,6 @@
+$NetBSD: distinfo,v 1.1 2026/10/10 10:13:08 he Exp $
+
+BLAKE2s (bind-9.20.29.tar.xz) = 56c60f788031e8d217d2d46c620dd7ba40fd0c7d376b39786e7f9e4b4958fe21
+SHA512 (bind-9.20.29.tar.xz) = afedc73a1376d662eec86b7f0e5795a3b0302e7184af83f90d06e3b5054efb54f5d7ab73f777e0d1b84b25aa27f299de688c508e28f0a22e67ba5eb07aa46077
+Size (bind-9.20.29.tar.xz) = 5966372 bytes
+SHA1 (patch-configure.ac) = d3b9bb82c8e164135b93a76d5c53ad40521226e2
Index: pkgsrc/net/bind920/options.mk
diff -u /dev/null pkgsrc/net/bind920/options.mk:1.1
--- /dev/null Sat Oct 10 10:13:09 2026
+++ pkgsrc/net/bind920/options.mk Sat Oct 10 10:13:08 2026
@@ -0,0 +1,156 @@
+# $NetBSD: options.mk,v 1.1 2026/10/10 10:13:08 he Exp $
+
+PKG_OPTIONS_VAR= PKG_OPTIONS.bind
+PKG_SUPPORTED_OPTIONS= bind-dig-sigchase bind-xml-statistics-server
+PKG_SUPPORTED_OPTIONS+= bind-json-statistics-server blacklist blocklist
+PKG_SUPPORTED_OPTIONS+= threads readline lmdb mysql pgsql ldap dlz-filesystem
+PKG_SUPPORTED_OPTIONS+= geoip gssapi tuning dnstap
+PKG_SUGGESTED_OPTIONS+= readline
+
+PLIST_VARS+= dnstap lmdb
+
+PTHREAD_OPTS+= native
+.include "../../mk/pthread.buildlink3.mk"
+
+.if defined(PTHREAD_TYPE) && (${PTHREAD_TYPE} == "none") || \
+ ${MACHINE_PLATFORM:MNetBSD-*-vax} || \
+ ${MACHINE_PLATFORM:MNetBSD-*-sparc} || \
+ ${MACHINE_PLATFORM:MNetBSD-*-sparc64} || \
+ ${MACHINE_PLATFORM:MNetBSD-*-m68k}
+# don't touch PKG_SUGGESTED_OPTIONS
+.else
+PKG_SUGGESTED_OPTIONS+= threads
+.endif
+
+.if ${OPSYS} == "NetBSD"
+. if !empty(PKG_OPTIONS:Mblacklist)
+. if exists(/usr/include/blacklist.h)
+PKG_SUGGESTED_OPTIONS+= blacklist
+. elif !empty(PKG_OPTIONS:Mblocklist) && exists(/usr/include/blocklist.h)
+PKG_SUGGESTED_OPTIONS+= blocklist
+. endif
+. endif
+.endif
+
+.include "../../mk/bsd.options.mk"
+
+###
+### The mysql pgsql ldap dlz-filesystem options are all for BIND
+### DLZ (Dynamically Loadable Zones) functionality
+###
+### NOTE: bdb is excluded on purpose as pkgsrc does not contain
+### a bdb v4.1 or 4.2 package which is what BIND needs.
+### The majority of these are compile tested only
+###
+
+.if !empty(PKG_OPTIONS:Mlmdb)
+.include "../../databases/lmdb/buildlink3.mk"
+CONFIGURE_ARGS+= --with-lmdb=${PREFIX}
+PLIST.lmdb= yes
+.else
+CONFIGURE_ARGS+= --with-lmdb=no
+.endif
+
+.if !empty(PKG_OPTIONS:Mmysql)
+.include "../../mk/mysql.buildlink3.mk"
+CONFIGURE_ARGS+= --with-dlz-mysql=${BUILDLINK_PREFIX.mysql-client}
+.endif
+
+.if !empty(PKG_OPTIONS:Mpgsql)
+.include "../../mk/pgsql.buildlink3.mk"
+CONFIGURE_ARGS+= --with-dlz-postgres=${BUILDLINK_PREFIX.${PGSQL_TYPE}}
+CONFIGURE_ENV+= ac_cv_path_PG_CONFIG=${PREFIX}/bin/pg_config
+.endif
+
+.if !empty(PKG_OPTIONS:Mldap)
+.include "../../databases/openldap-client/buildlink3.mk"
+CONFIGURE_ARGS+= --with-dlz-ldap=${BUILDLINK_PREFIX.openldap-client}
+.endif
+
+.if !empty(PKG_OPTIONS:Mdlz-filesystem)
+CONFIGURE_ARGS+= --with-dlz-filesystem
+.endif
+
+.if !empty(PKG_OPTIONS:Mblacklist)
+CONFIGURE_ARGS+= --with-blacklist=yes
+.else
+CONFIGURE_ARGS+= --with-blacklist=no
+.endif
+
+.if !empty(PKG_OPTIONS:Mblocklist)
+CONFIGURE_ARGS+= --with-blocklist=yes
+.else
+CONFIGURE_ARGS+= --with-blocklist=no
+.endif
+
+.if !empty(PKG_OPTIONS:Mgeoip)
+CONFIGURE_ARGS+= --with-geoip=${PREFIX}
+LDFLAGS+= -lGeoIP
+.include "../../net/GeoIP/buildlink3.mk"
+.endif
+
+.if !empty(PKG_OPTIONS:Mgssapi)
+.include "../../mk/krb5.buildlink3.mk"
+CONFIGURE_ARGS+= --with-gssapi=${KRB5_CONFIG}
+.else
+CONFIGURE_ARGS+= --without-gssapi
+.endif
+
+.if !empty(PKG_OPTIONS:Mtuning)
+CONFIGURE_ARGS+= --with-tuning=large
+.endif
+
+.if !empty(PKG_OPTIONS:Mdnstap)
+CONFIGURE_ARGS+= --enable-dnstap
+PLIST.dnstap= yes
+.include "../../net/fstrm/buildlink3.mk"
+.include "../../devel/protobuf/buildlink3.mk"
+.include "../../devel/protobuf-c/buildlink3.mk"
+.endif
+
+###
+### The statistics server in bind99 and later needs libxml2
+###
+.if !empty(PKG_OPTIONS:Mbind-xml-statistics-server)
+.include "../../textproc/libxml2/buildlink3.mk"
+CONFIGURE_ARGS+= --with-libxml2
+LDFLAGS+= -lxml2
+.else
+CONFIGURE_ARGS+= --without-libxml2
+.endif
+
+###
+### The statistics server in bind911 and later supports json
+###
+.if !empty(PKG_OPTIONS:Mbind-json-statistics-server)
+.include "../../textproc/json-c/buildlink3.mk"
+CONFIGURE_ARGS+= --with-json-c=yes
+.else
+CONFIGURE_ARGS+= --with-json-c=no
+.endif
+
+###
+### pthreads support (also see magic above)
+###
+.if !empty(PKG_OPTIONS:Mthreads)
+PTHREAD_AUTO_VARS= yes
+.endif
+
+###
+### readline support in dig(1) and nsupdate(1).
+###
+.if !empty(PKG_OPTIONS:Mreadline)
+.include "../../devel/readline/buildlink3.mk"
+CONFIGURE_ARGS+= --with-readline
+.else
+CONFIGURE_ARGS+= --without-readline
+.endif
+
+###
+### dig(1) option +sigchase for DNSSEC signature chasing
+###
+.if !empty(PKG_OPTIONS:Mbind-dig-sigchase)
+# If anything else needs to add entries to STD_CDEFINES, this will need
+# to be changed so that the two can cooperate.
+CONFIGURE_ENV+= STD_CDEFINES=-DDIG_SIGCHASE=1
+.endif
Index: pkgsrc/net/bind920/files/named9.sh
diff -u /dev/null pkgsrc/net/bind920/files/named9.sh:1.1
--- /dev/null Sat Oct 10 10:13:09 2026
+++ pkgsrc/net/bind920/files/named9.sh Sat Oct 10 10:13:09 2026
@@ -0,0 +1,74 @@
+#!@RCD_SCRIPTS_SHELL@
+#
+# $NetBSD: named9.sh,v 1.1 2026/10/10 10:13:09 he Exp $
+#
+
+# PROVIDE: named
+# REQUIRE: NETWORKING mountcritremote syslogd
+# BEFORE: DAEMON
+# KEYWORD: chrootdir
+
+. /etc/rc.subr
+
+name="named"
+rcvar="${name}9"
+command="@PREFIX@/sbin/${name}"
+pidfile="@VARBASE@/run/named/${name}.pid"
+start_precmd="named_precmd"
+extra_commands="reload"
+required_dirs="$named_chrootdir" # if it is set, it must exist
+
+named_precmd()
+{
+ # Die if $named is also set (i.e. the system's named is not disabled
+ if checkyesno named ; then
+ warn \
+ "disable 'named' when setting 'named9'!"
+ return 1
+ fi
+
+ if [ ! -d @VARBASE@/run/named ]; then
+ @MKDIR@ @VARBASE@/run/named
+ fi
+
+ if [ -z "$named_chrootdir" ]; then
+ return 0;
+ fi
+
+ for i in crypto null random urandom
+ do
+ if [ ! -c "${named_chrootdir}/dev/$i" ]; then
+ @RM@ -f "${named_chrootdir}/dev/$i"
+ (cd /dev &&
+ @PAX@ -rw -pe "$i" "${named_chrootdir}/dev")
+ fi
+ done
+
+ if [ -f /etc/localtime ]; then
+ @CMP@ -s /etc/localtime "${named_chrootdir}/etc/localtime" || \
+ @CP@ -p /etc/localtime "${named_chrootdir}/etc/localtime"
+ fi
+
+ if [ -f @SSLBASE@/lib/engines/libgost.so ]; then
+ if [ ! -d ${named_chrootdir}@SSLBASE@/lib/engines ]; then
+ @MKDIR@ ${named_chrootdir}@SSLBASE@/lib/engines
+ fi
+ @CMP@ -s @SSLBASE@/lib/engines/libgost.so "${named_chrootdir}@SSLBASE@/lib/engines/libgost.so" || \
+ @CP@ -p @SSLBASE@/lib/engines/libgost.so "${named_chrootdir}@SSLBASE@/lib/engines/libgost.so"
+ fi
+
+ if [ ! -d ${named_chrootdir}@VARBASE@/run/named ]; then
+ @MKDIR@ ${named_chrootdir}@VARBASE@/run/named
+ @CHOWN@ @BIND_USER@ ${named_chrootdir}@VARBASE@/run/named
+ fi
+
+ @RM@ -f ${pidfile}
+ @LN@ -s "${named_chrootdir}${pidfile}" ${pidfile}
+
+ # Change run_rc_commands()'s internal copy of $named_flags
+ #
+ rc_flags="-u @BIND_USER@ -t ${named_chrootdir} $rc_flags"
+}
+
+load_rc_config "$rcvar"
+run_rc_command "$1"
Index: pkgsrc/net/bind920/files/smf/manifest.xml
diff -u /dev/null pkgsrc/net/bind920/files/smf/manifest.xml:1.1
--- /dev/null Sat Oct 10 10:13:09 2026
+++ pkgsrc/net/bind920/files/smf/manifest.xml Sat Oct 10 10:13:09 2026
@@ -0,0 +1,138 @@
+<?xml version="1.0"?>
+<!--
+CDDL HEADER START
+
+The contents of this file are subject to the terms of the
+Common Development and Distribution License (the "License").
+You may not use this file except in compliance with the License.
+
+You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+or http://www.opensolaris.org/os/licensing.
+See the License for the specific language governing permissions
+and limitations under the License.
+
+When distributing Covered Code, include this CDDL HEADER in each
+file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+If applicable, add the following below this CDDL HEADER, with the
+fields enclosed by brackets "[]" replaced with your own identifying
+information: Portions Copyright [yyyy] [name of copyright owner]
+
+CDDL HEADER END
+-->
+<!DOCTYPE service_bundle SYSTEM "/usr/share/lib/xml/dtd/service_bundle.dtd.1">
+<!--
+ Copyright 2007 Sun Microsystems, Inc. All rights reserved.
+ Use is subject to license terms.
+
+ ident "@(#)server.xml 1.8 07/06/19 SMI"
+-->
+<!-- Portions Copyright 2007 Vedran Bender -->
+<service_bundle type='manifest' name='export'>
+ <service name='@SMF_PREFIX@/@SMF_NAME@' type='service' version='1'>
+ <dependency name='filesystem_minimal' grouping='require_all' restart_on='none' type='service'>
+ <service_fmri value='svc:/system/filesystem/local' />
+ </dependency>
+ <dependency name='loopback' grouping='require_any' restart_on='error' type='service'>
+ <service_fmri value='svc:/network/loopback' />
+ </dependency>
+ <dependency name='network' grouping='optional_all' restart_on='error' type='service'>
+ <service_fmri value='svc:/milestone/network' />
+ </dependency>
+ <dependency name='config-files' grouping='require_any' restart_on='refresh' type='path'>
+ <service_fmri value='file://localhost@PKG_SYSCONFDIR@/named.conf' />
+ </dependency>
+ <!--
+ In order to run multiple named(1M) processes with their own
+ configuration file or properties each must have a unique
+ instance.
+ -->
+ <instance name='default' enabled='false'>
+ <exec_method type='method' name='start' exec='@PREFIX@/@SMF_METHOD_FILE.named@ %m %i' timeout_seconds='60'>
+ <method_context>
+ <method_credential user='root' group='root' />
+ </method_context>
+ </exec_method>
+ <exec_method type='method' name='stop' exec='@PREFIX@/@SMF_METHOD_FILE.named@ %m %i %{restarter/contract}' timeout_seconds='60'>
+ <method_context>
+ <method_credential user='root' group='root' />
+ </method_context>
+
+ </exec_method>
+ <!--
+ SIGHUP causes named to reread its configuration file, but not any
+ of the properties below.
+ -->
+ <exec_method type='method' name='refresh' exec=':kill -HUP' timeout_seconds='60'>
+ <method_context />
+ </exec_method>
+ <property_group name='general' type='framework'>
+ <!-- manage DNS server state -->
+ <propval name='action_authorization' type='astring' value='solaris.smf.manage.bind' />
+ <propval name='value_authorization' type='astring' value='solaris.smf.manage.bind' />
+ </property_group>
+ <!-- Default property settings for named(1M) instance. -->
+ <property_group name='options' type='application'>
+ <!--
+ server: specifies an alternative server command. If
+ not specified the default /usr/sbin/named is used.
+ -->
+ <propval name='server' type='astring' value='' />
+ <!--
+ configuration_file: specifies an alternative
+ configuration file to be used. The property is similar
+ to named(1M) command line option '-c'
+ -->
+ <propval name='configuration_file' type='astring' value='' />
+ <!--
+ ip_interfaces: specifies which IP transport BIND will
+ transmit on. Possible values are 'IPv4' or 'IPv6'. Any
+ other setting assumes 'all', the default.
+ Equivalent command line option '-4' or '-6'.
+ -->
+ <propval name='ip_interfaces' type='astring' value='all' />
+ <!--
+ listen_on_port: Specifies the default UDP and TCP port
+ which will be used to listen for DNS requests.
+ Equivalent command line option '-p <integer>'.
+ -->
+ <propval name='listen_on_port' type='integer' value='0' />
+ <!--
+ debug_level: Specifies the default debug level. The
+ default is 0; no debugging. The Higher the number the
+ more verbose debug information becomes.
+ Equivalent command line option '-d <integer>'.
+ -->
+ <propval name='debug_level' type='integer' value='0' />
+ <!--
+ threads: Specifies the number of cpu worker threads to
+ create. The default of 0 causes named to try and
+ determine the number of CPUs present and create one
+ thread per CPU.
+ Equivalent command line option '-n <integer>'.
+ -->
+ <propval name='threads' type='integer' value='0' />
+ <!--
+ chroot_dir: Change the root directory using chroot(2)
+ to directory after processing the command line
+ arguments, but before reading the configuration file.
+ Equivalent command line option '-t <pathname>'.
+ -->
+ <propval name='chroot_dir' type='astring' value='' />
+ <!--
+ user: Change the user id after processing command line
+ arguments, but before reading the configuration file.
+ Equivalent command line option '-u <user>'.
+ -->
+ <propval name='user' type='astring' value='named' />
+ </property_group>
+ </instance>
+ <template>
+ <common_name>
+ <loctext xml:lang='C'>BIND DNS server</loctext>
+ </common_name>
+ <documentation>
+ <manpage title='named' section='1M' manpath='@PREFIX@/@PKGMANDIR@' />
+ </documentation>
+ </template>
+ </service>
+</service_bundle>
Index: pkgsrc/net/bind920/files/smf/named.sh
diff -u /dev/null pkgsrc/net/bind920/files/smf/named.sh:1.1
--- /dev/null Sat Oct 10 10:13:09 2026
+++ pkgsrc/net/bind920/files/smf/named.sh Sat Oct 10 10:13:09 2026
@@ -0,0 +1,262 @@
+#!@SMF_METHOD_SHELL@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+# Copyright 2007 Sun Microsystems, Inc. All rights reserved.
+# Use is subject to license terms.
+#
+#pragma ident "@(#)dns-server.sh 1.1 07/03/26 SMI"
+
+# smf_method(5) start/stop script required for server DNS
+
+. /lib/svc/share/smf_include.sh
+
+mount_chroot ()
+{
+ c=$1
+ shift
+ for f in $*; do
+ if [ -z "${f}" -o ! -f "${f}" -o \
+ -z "${c}" -o ! -d "${c}" ]; then
+ exit ${SMF_EXIT_ERR_CONFIG}
+ fi
+
+ umount ${c}/${f} >/dev/null 2>&1
+ mkdir -p `dirname ${c}/${f}`
+ touch ${c}/${f}
+ mount -Flofs ${f} ${c}/${f}
+ done
+}
+
+umount_chroot ()
+{
+ c=$1
+ shift
+ for f in $*; do
+ umount ${c}/${f} >/dev/null 2>&1
+ done
+}
+
+get_config ()
+{
+ configuration_file=@PKG_SYSCONFDIR@/named.conf
+ rndc_config_file=@PKG_SYSCONFDIR@/rndc.conf
+ rndc_key_file=@PKG_SYSCONFDIR@/rndc.key
+ rndc_cmd_opts="-a"
+ libraries="/usr/pkg/lib/engines/libgost.so"
+ cmdopts=""
+ checkopts=""
+ properties="debug_level ip_interfaces listen_on_port
+ threads chroot_dir configuration_file server user"
+
+ for prop in $properties
+ do
+ value=`/usr/bin/svcprop -p options/${prop} ${SMF_FMRI}`
+ if [ -z "${value}" -o "${value}" = '""' ]; then
+ continue;
+ fi
+
+ case $prop in
+ 'debug_level')
+ if [ ${value} -gt 0 ]; then
+ cmdopts="${cmdopts} -d ${value}"
+ fi
+ ;;
+ 'ip_interfaces')
+ case ${value} in
+ 'IPv4')
+ cmdopts="${cmdopts} -4";;
+ 'IPv6')
+ cmdopts="${cmdopts} -6";;
+ 'all')
+ : # Default is all, therefore ignore.
+ ;;
+ *)
+ echo "$I: Unrecognised value in service instance property" >&2
+ echo "$I: options/${prop} : ${value}" >&2
+ ;;
+ esac
+ ;;
+ 'listen_on_port')
+ if [ ${value} -gt 0 ]; then
+ cmdopts="${cmdopts} -p ${value}"
+ fi
+ ;;
+ 'threads')
+ if [ ${value} -gt 0 ]; then
+ cmdopts="${cmdopts} -n ${value}"
+ fi
+ ;;
+ 'chroot_dir')
+ cmdopts="${cmdopts} -t ${value}"
+ checkopts="${checkopts} -t ${value}"
+ chroot_dir=${value};
+ ;;
+ 'configuration_file')
+ cmdopts="${cmdopts} -c ${value}"
+ checkopts="${checkopts} ${value}"
+ configuration_file=${value};
+ ;;
+ 'server')
+ set -- `echo ${value} | /usr/bin/sed -e 's/\\\\//g'`
+ server=$@
+ ;;
+ 'user')
+ cmdopts="${cmdopts} -u ${value}"
+ cmduser=${value};
+ ;;
+ esac
+ done
+
+ configuration_dir=$(sed -n -e 's,^[[:space:]]*directory.*"\(.*\)";,\1,p' \
+ ${configuration_file})
+ [ "${configuration_dir}" == "" ] && configuration_dir=@PKG_SYSCONFDIR@/namedb
+
+ configuration_files=$(sed -n -e \
+ "s,^[[:space:]]*file.*\"\(.*\)\";,${configuration_dir}/\1,p" \
+ ${configuration_file} | sort -u)
+ configuration_files="${configuration_files} ${configuration_file}"
+}
+
+result=${SMF_EXIT_OK}
+
+# Read command line arguments
+method="$1" # %m
+instance="$2" # %i
+contract="$3" # %{restarter/contract}
+
+# Set defaults; SMF_FMRI should have been set, but just in case.
+if [ -z "$SMF_FMRI" ]; then
+ SMF_FMRI="svc:/@SMF_PREFIX@/@SMF_NAME@:${instance}"
+fi
+server="@PREFIX@/sbin/named"
+checkconf="@PREFIX@/bin/named-checkconf"
+I=`/usr/bin/basename $0`
+
+case "$method" in
+'start')
+ get_config
+
+ # If chroot option is set, note zones(5) are preferred, then
+ # configuration file lives under chroot directory.
+ if [ "${chroot_dir}" != "" ]; then
+ if [ "${chroot_dir}" = "/" ]; then
+ msg="$I: chroot_dir must not be /"
+ echo ${msg} >&2
+ /usr/bin/logger -p daemon.error ${msg}
+ # dns-server should be placed in maintenance state.
+ exit ${SMF_EXIT_ERR_CONFIG}
+ fi
+
+ server="env LD_NOLAZYLOAD=1 ${server}"
+ checkconf="env LD_NOLAZYLOAD=1 ${checkconf}"
+
+ mkdir -p ${chroot_dir}
+
+ if [ "${SMF_ZONENAME}" = "global" ]; then
+ for dev in crypto log null poll random urandom; do
+ rm -f ${chroot_dir}/dev/${dev}
+ pax -rw -H -pe /dev/${dev} ${chroot_dir}
+ done
+ fi
+
+ missing=""
+ for dev in crypto null poll random urandom; do
+ if [ ! -e "${chroot_dir}/dev/${dev}" ]; then
+ missing="${missing} ${dev}"
+ fi
+ done
+
+ if [ ! -z "${missing}" ]; then
+ msg="$I: missing device nodes in ${chroot_dir}: ${missing}"
+ echo ${msg} >&2
+ /usr/bin/logger -p daemon.err ${msg}
+ # dns-server should be placed in maintenance state.
+ exit ${SMF_EXIT_ERR_CONFIG}
+ fi
+
+ mount_chroot ${chroot_dir} ${configuration_files} ${libraries}
+
+ mkdir -p ${chroot_dir}/var/run/named
+ chown ${cmduser}:${cmduser} ${chroot_dir}/var/run/named
+
+ configuration_file=${chroot_dir}${configuration_file}
+ rndc_config_file=${chroot_dir}${rndc_config_file}
+ rndc_key_file=${chroot_dir}${rndc_key_file}
+ rndc_cmd_opts="${rndc_cmd_opts} -t ${chroot_dir}"
+ else
+ mkdir -p -m 0770 @VARBASE@/run/named
+ chown ${cmduser}:${cmduser} @VARBASE@/run/named
+ fi
+
+ # Check if the rndc config file exists.
+ if [ ! -f ${rndc_config_file} ]; then
+ # If not, check if the default rndc key file exists.
+ if [ ! -f ${rndc_key_file} ]; then
+ echo "$I: Creating default rndc key file: ${rndc_key_file}." >&2
+ @PREFIX@/sbin/rndc-confgen ${rndc_cmd_opts}
+ if [ $? -ne 0 ]; then
+ echo "$I : Warning: rndc configuration failed! Use of 'rndc' to" \
+ "control 'named' may fail and 'named' may report further error" \
+ "messages to the system log. This is not fatal. For more" \
+ "information see rndc(1M) and rndc-confgen(1M)." >&2
+ fi
+ fi
+ fi
+
+ if [ ${result} = ${SMF_EXIT_OK} ]; then
+ ${checkconf} -z ${checkopts}
+ result=$?
+ if [ $result -ne 0 ]; then
+ msg="$I: named-checkconf failed to verify configuration"
+ echo ${msg} >&2
+ /usr/bin/logger -p daemon.error ${msg}
+ if [ "${chroot_dir}" != "" -a "${chroot_dir}" != "/" ]; then
+ umount_chroot ${chroot_dir} ${configuration_files} ${libraries}
+ fi
+ # dns-server should be placed in maintenance state.
+ exit ${SMF_EXIT_ERR_CONFIG}
+ fi
+ fi
+
+ if [ ${result} = ${SMF_EXIT_OK} ]; then
+ echo "$I: Executing: ${server} ${cmdopts}"
+ # Execute named(1M) with relevant command line options.
+ ${server} ${cmdopts}
+ result=$?
+ fi
+ ;;
+'stop')
+ get_config
+
+ smf_kill_contract ${contract} TERM 1
+ [ $? -ne 0 ] && exit 1
+
+ if [ "${chroot_dir}" != "" -a "${chroot_dir}" != "/" ]; then
+ umount_chroot ${chroot_dir} ${configuration_files} ${libraries}
+ fi
+
+ ;;
+*)
+ echo "Usage: $I [stop|start] <instance>" >&2
+ exit 1
+ ;;
+esac
+exit ${result}
Index: pkgsrc/net/bind920/patches/patch-configure.ac
diff -u /dev/null pkgsrc/net/bind920/patches/patch-configure.ac:1.1
--- /dev/null Sat Oct 10 10:13:09 2026
+++ pkgsrc/net/bind920/patches/patch-configure.ac Sat Oct 10 10:13:09 2026
@@ -0,0 +1,31 @@
+$NetBSD: patch-configure.ac,v 1.1 2026/10/10 10:13:09 he Exp $
+
+support removal of WRKDIR references from config.h
+Also test a more specific -lexecinfo function, to allow
+configuration with CFLAGS+=-fsanitize=thread, because
+backtrace_symbols() is in /usr/lib/libtsan.so, so the
+"do we need -lexecinfo?" is otherwise mis-detected as "not needed".
+
+--- configure.ac.orig 2024-07-08 13:09:17.034283885 +0000
++++ configure.ac
+@@ -36,7 +36,10 @@ AC_DEFINE([PACKAGE_DESCRIPTION], [m4_ifn
+ AC_DEFINE([PACKAGE_SRCID], ["][bind_SRCID]["], [A short hash from git])
+
+ bind_CONFIGARGS="${ac_configure_args:-default}"
+-AC_DEFINE_UNQUOTED([PACKAGE_CONFIGARGS], ["$bind_CONFIGARGS"], [Either 'defaults' or used ./configure options])
++faked_CONFIGARGS=$(echo ${bind_CONFIGARGS} | \
++ sed -e 's|@TOOLS_DIR@|@PREFIX@|g' -e 's|@BUILDLINK_DIR@|@PREFIX@|g')
++AC_DEFINE_UNQUOTED([PACKAGE_CONFIGARGS], ["$faked_CONFIGARGS"], [Either 'defaul
++ts' or used ./configure options])
+
+ AC_DEFINE([PACKAGE_BUILDER], ["make"], [make or Visual Studio])
+
+@@ -975,7 +978,7 @@ AC_SUBST([LIBSYSTEMD_LIBS])
+ # Check if the system supports glibc-compatible backtrace() function.
+ #
+ AC_CHECK_HEADERS([execinfo.h],
+- [AC_SEARCH_LIBS([backtrace_symbols], [execinfo],
++ [AC_SEARCH_LIBS([backtrace_symbols_fd], [execinfo],
+ [AC_CHECK_FUNCS([backtrace_symbols])])])
+
+ #
Home |
Main Index |
Thread Index |
Old Index