CVS commit: pkgsrc/net/bind918

["Havard Eidnes" <he%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   he
Date:           Fri Jun 19 17:30:24 UTC 2026

Modified Files:
        pkgsrc/net/bind918: Makefile distinfo

Log Message:
net/bind: update to version 9.18.50.

Pkgsrc changes:
 * None (just version + checksums)

Upstream changes:

Notes for BIND 9.18.50
----------------------

Removed Features
~~~~~~~~~~~~~~~~

- Remove ineffective TCP fallback after repeated UDP timeouts.

  When an authoritative server failed to respond to two consecutive UDP
  queries, :iscman:`named` marked the next retry as TCP but still sent
  it over UDP, producing misleading dnstap records. The ineffective
  retry path has been removed; a corrected TCP fallback will be restored
  in future BIND 9 versions. :gl:`#5529`

Feature Changes
~~~~~~~~~~~~~~~

- Fall back to TCP on receipt of a UDP response with a mismatched query ID.

  BIND used to wait silently for the correct DNS message ID on a UDP
  fetch, even after receiving a response from the expected server with
  the wrong ID, leaving room for off-path spoofing attempts to keep
  guessing within that window.  The resolver now retries the fetch over
  TCP on the first such response, and a new ``MismatchTCP`` statistics
  counter tracks how often the fallback fires. :gl:`#5449`

Bug Fixes
~~~~~~~~~

- Fix DNS64 owner case after DNAME restart.

  When BIND 9 was configured to use DNS64 and encountered a DNAME
  redirect, it could end up using freed memory for the DNS response
  owner name. This caused the response to contain corrupted data. This
  fix ensures the correct owner name is used when constructing the
  synthesized response after a DNAME redirect. :gl:`#5934`

- Clear REDIRECT flag when it isn't needed.

  When :any:`nxdomain-redirect` is in use, and a recursive query is used
  to get the redirected answer, a flag is set to distinguish it from a
  normal recursive response. Previously, that flag was left set
  afterward, which could trigger an assertion if a normal recursive
  query was sent later on behalf of the same client: for example,
  because the :any:`filter-aaaa` plugin was in use.  This has been
  fixed. :gl:`#5936`


To generate a diff of this commit:
cvs rdiff -u -r1.68 -r1.69 pkgsrc/net/bind918/Makefile
cvs rdiff -u -r1.40 -r1.41 pkgsrc/net/bind918/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/net/bind918/Makefile
diff -u pkgsrc/net/bind918/Makefile:1.68 pkgsrc/net/bind918/Makefile:1.69
--- pkgsrc/net/bind918/Makefile:1.68    Wed May 20 13:07:16 2026
+++ pkgsrc/net/bind918/Makefile Fri Jun 19 17:30:24 2026
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.68 2026/05/20 13:07:16 taca Exp $
+# $NetBSD: Makefile,v 1.69 2026/06/19 17:30:24 he Exp $
 
 DISTNAME=      bind-${BIND_VERSION}
 PKGNAME=       ${DISTNAME:S/-P/pl/}
@@ -15,7 +15,7 @@ CONFLICTS+=   host-[0-9]*
 
 MAKE_JOBS_SAFE=        no
 
-BIND_VERSION=  9.18.49
+BIND_VERSION=  9.18.50
 
 BUILD_DEFS+=   BIND_DIR VARBASE
 

Index: pkgsrc/net/bind918/distinfo
diff -u pkgsrc/net/bind918/distinfo:1.40 pkgsrc/net/bind918/distinfo:1.41
--- pkgsrc/net/bind918/distinfo:1.40    Wed May 20 13:07:16 2026
+++ pkgsrc/net/bind918/distinfo Fri Jun 19 17:30:24 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.40 2026/05/20 13:07:16 taca Exp $
+$NetBSD: distinfo,v 1.41 2026/06/19 17:30:24 he Exp $
 
-BLAKE2s (bind-9.18.49.tar.xz) = 9427430160992a3d37f561326f2e7ce3894ae8e60ad45c039b68ba5f24e5b4d6
-SHA512 (bind-9.18.49.tar.xz) = e5259db8b9fdb3940d4e1d95978514692777a3675fc85a83db30e049d80d8150d10e672d51eeb885a94c6bbd4573ff8fe49248117c24ff155197a24a26b09544
-Size (bind-9.18.49.tar.xz) = 5476288 bytes
+BLAKE2s (bind-9.18.50.tar.xz) = fc87902728b75030e168bff93655708223b2b6241c312b65016eea880e3a23fb
+SHA512 (bind-9.18.50.tar.xz) = 5ae70c95f19868f41fd609bf34a908c38769401ee5b89e4782b94081032a579c00ba9010b2feb2789a95cfd12289cfe250e6488b3b47ff666bfa8cd7edf74d43
+Size (bind-9.18.50.tar.xz) = 5479148 bytes
 SHA1 (patch-bin_named_main.c) = 4e4a763c478f1fcecb7e65968cf6ca20dacf01f1
 SHA1 (patch-bin_named_os.c) = 5ecb0883076575d8ac5fcad68f9daad6c9be0d0b
 SHA1 (patch-bin_named_server.c) = 52190897c4c4b141d98ca5bca7cc3eb4c83ac584