Pullup ticket #6835 - requested by taca
net/bind918: security fix

Revisions pulled up:
- net/bind918/Makefile                                          1.25-1.27
- net/bind918/buildlink3.mk                                    1.2
- net/bind918/distinfo                                          1.14-1.15
- net/bind918/patches/patch-lib_dns_rbtdb.c                    1.2
- net/bind918/patches/patch-lib_isc_netmgr_netmgr.c            1.2

---
  Module Name: pkgsrc
  Committed By: taca
  Date: Fri Jan  5 01:52:20 UTC 2024

  Modified Files:
  pkgsrc/net/bind918: Makefile distinfo

  Log Message:
  net/bind918: update to 9.18.21

  9.18.21 (2023-12-20)

  6297. [bug] Improve LRU cleaning behaviour. [GL #4448]

  6296. [func] The "resolver-nonbackoff-tries" and
  "resolver-retry-interval" options are deprecated;
  a warning will be logged if they are used. [GL #4405]

  6294. [bug] BIND might sometimes crash after startup or
  re-configuration when one 'tls' entry is used multiple
  times to connect to remote servers due to initialisation
  attempts from contexts of multiple threads. That has
  been fixed. [GL #4464]

  6290. [bug] Dig +yaml will now report "no servers could be reached"
  also for UDP setup failure when no other servers or
  tries are left. [GL #1229]

  6287. [bug] Recognize escapes when reading the public key from file.
  [GL !8502]

  6286. [bug] Dig +yaml will now report "no servers could be reached"
  on TCP connection failure as well as for UDP timeouts.
  [GL #4396]

  6282. [func] Deprecate AES-based DNS cookies. [GL #4421]

---
  Module Name: pkgsrc
  Committed By: adam
  Date: Tue Jan 30 18:29:21 UTC 2024

  Modified Files:
  pkgsrc/audio/libilbc: Makefile
  pkgsrc/audio/termusic: Makefile
  pkgsrc/biology/plinkseq: Makefile
  pkgsrc/chat/ekg: Makefile
  pkgsrc/chat/libgadu: Makefile buildlink3.mk
  pkgsrc/databases/postgresql-postgis2: Makefile
  pkgsrc/devel/abseil: buildlink3.mk
  pkgsrc/devel/compizconfig-backend-gconf: Makefile buildlink3.mk
  pkgsrc/devel/cre2: Makefile
  pkgsrc/devel/libcompizconfig: Makefile buildlink3.mk
  pkgsrc/devel/protobuf: Makefile buildlink3.mk
  pkgsrc/devel/protobuf-c: Makefile buildlink3.mk
  pkgsrc/devel/py-compizconfig: Makefile buildlink3.mk
  pkgsrc/devel/re2: Makefile buildlink3.mk
  pkgsrc/graphics/opencv: Makefile buildlink3.mk
  pkgsrc/graphics/opencv-contrib-face: Makefile buildlink3.mk
  pkgsrc/graphics/py-Willow: Makefile
  pkgsrc/inputmethod/fcitx5-mozc: Makefile
  pkgsrc/misc/libreoffice: Makefile
  pkgsrc/net/bind916: Makefile
  pkgsrc/net/bind918: Makefile
  pkgsrc/net/dnsdist: Makefile
  pkgsrc/net/frr: Makefile
  pkgsrc/net/grpc: Makefile buildlink3.mk
  pkgsrc/net/mosh: Makefile
  pkgsrc/net/py-grpcio: Makefile
  pkgsrc/net/py-grpcio-tools: Makefile
  pkgsrc/net/qt6-qtgrpc: Makefile buildlink3.mk
  pkgsrc/net/ratman: Makefile
  pkgsrc/net/unbound: Makefile
  pkgsrc/sysutils/collectd-grpc: Makefile
  pkgsrc/sysutils/collectd-pinba: Makefile
  pkgsrc/sysutils/collectd-riemann: Makefile
  pkgsrc/sysutils/collectd-write_prometheus: Makefile
  pkgsrc/sysutils/riemann-client: Makefile
  pkgsrc/wm/ccsm: Makefile

  Log Message:
  revbump for devel/abseil

---
  Module Name: pkgsrc
  Committed By: taca
  Date: Fri Jan  5 01:53:35 UTC 2024

  Modified Files:
  pkgsrc/net/bind918: buildlink3.mk

  Log Message:
  net/bind918: fix BUILDLINK_ABI_DEPENDS

  We have 9.8.21 but not yet 9.18.30nb1.

---
  Module Name: pkgsrc
  Committed By: taca
  Date: Tue Feb 13 13:50:39 UTC 2024

  Modified Files:
  pkgsrc/net/bind918: Makefile distinfo
  pkgsrc/net/bind918/patches: patch-lib_dns_rbtdb.c
      patch-lib_isc_netmgr_netmgr.c

  Log Message:
  net/bind918: update to 9.18.24

  9.18.24 (2024-02-13)

  --- 9.18.24 released ---

  6343. [bug] Fix case insensitive setting for isc_ht hashtable.
  [GL #4568]

  --- 9.18.23 released ---

  6322. [security] Specific DNS answers could cause a denial-of-service
  condition due to DNS validation taking a long time.
  (CVE-2023-50387) [GL #4424]

  6321. [security] Change 6315 inadvertently introduced regressions that
  could cause named to crash. [GL #4234]

  6320. [bug] Under some circumstances, the DoT code in client
  mode could process more than one message at a time when
  that was not expected. That has been fixed. [GL #4487]

  --- 9.18.22 released ---

  6319. [func] Limit isc_task_send() overhead for RBTDB tree pruning.
  [GL #4383]

  6317. [security] Restore DNS64 state when handling a serve-stale timeout.
  (CVE-2023-5679) [GL #4334]

  6316. [security] Specific queries could trigger an assertion check with
  nxdomain-redirect enabled. (CVE-2023-5517) [GL #4281]

  6315. [security] Speed up parsing of DNS messages with many different
  names. (CVE-2023-4408) [GL #4234]

  6314. [bug] Address race conditions in dns_tsigkey_find().
  [GL #4182]

  6312. [bug] Conversion from NSEC3 signed to NSEC signed could
  temporarily put the zone into a state where it was
  treated as unsigned until the NSEC chain was built.
  Additionally conversion from one set of NSEC3 parameters
  to another could also temporarily put the zone into a
  state where it was treated as unsigned until the new
  NSEC3 chain was built. [GL #1794] [GL #4495]

  6310. [bug] Memory leak in zone.c:sign_zone. When named signed a
  zone it could leak dst_keys due to a misplaced
  'continue'. [GL #4488]

  6306. [func] Log more details about the cause of "not exact" errors.
  [GL #4500]

  6304. [bug] The wrong time was being used to determine what RRSIGs
  where to be generated when dnssec-policy was in use.
  [GL #4494]

  6302. [func] The "trust-anchor-telemetry" statement is no longer
  marked as experimental. This silences a relevant log
  message that was emitted even when the feature was
  explicitly disabled. [GL #4497]

  6300. [bug] Fix statistics export to use full 64 bit signed numbers
  instead of truncating values to unsigned 32 bits.
  [GL #4467]

  6299. [port] NetBSD has added 'hmac' to libc which collides with our
  use of 'hmac'. [GL #4478]

(bsiegert)