diff --git a/dns/bind-tools/pkg-plist-devel b/dns/bind-tools/pkg-plist-devel
index 4c095f749598..f0e490276003 100644
--- a/dns/bind-tools/pkg-plist-devel
+++ b/dns/bind-tools/pkg-plist-devel
@@ -1,65 +1,65 @@
 bin/arpaname
 bin/delv
 bin/dig
 bin/dnssec-cds
 bin/dnssec-dsfromkey
 bin/dnssec-importkey
 bin/dnssec-keyfromlabel
 bin/dnssec-keygen
 bin/dnssec-revoke
 bin/dnssec-settime
 bin/dnssec-signzone
 bin/dnssec-verify
 bin/host
 bin/mdig
 bin/named-rrchecker
 bin/nsec3hash
 bin/nslookup
 bin/nsupdate
 lib/bind-tools/libbind9.so
-lib/bind-tools/libbind9-9.17.15.so
+lib/bind-tools/libbind9-9.17.18.so
 lib/bind-tools/libdns.so
-lib/bind-tools/libdns-9.17.15.so
+lib/bind-tools/libdns-9.17.18.so
 lib/bind-tools/libirs.so
-lib/bind-tools/libirs-9.17.15.so
+lib/bind-tools/libirs-9.17.18.so
 lib/bind-tools/libisc.so
-lib/bind-tools/libisc-9.17.15.so
+lib/bind-tools/libisc-9.17.18.so
 lib/bind-tools/libisccc.so
-lib/bind-tools/libisccc-9.17.15.so
+lib/bind-tools/libisccc-9.17.18.so
 lib/bind-tools/libisccfg.so
-lib/bind-tools/libisccfg-9.17.15.so
+lib/bind-tools/libisccfg-9.17.18.so
 lib/bind-tools/libns.so
-lib/bind-tools/libns-9.17.15.so
+lib/bind-tools/libns-9.17.18.so
 man/man1/arpaname.1.gz
 man/man1/delv.1.gz
 man/man1/dig.1.gz
 man/man1/dnssec-cds.1.gz
 man/man1/dnssec-dsfromkey.1.gz
 man/man1/dnssec-importkey.1.gz
 man/man1/dnssec-keyfromlabel.1.gz
 man/man1/dnssec-keygen.1.gz
 man/man1/dnssec-revoke.1.gz
 man/man1/dnssec-settime.1.gz
 man/man1/dnssec-signzone.1.gz
 man/man1/dnssec-verify.1.gz
 @comment man/man1/dnstap-read.1.gz
 man/man1/host.1.gz
 man/man1/mdig.1.gz
 @comment man/man1/named-checkconf.1.gz
 @comment man/man1/named-checkzone.1.gz
 @comment man/man1/named-compilezone.1.gz
 @comment man/man1/named-journalprint.1.gz
 @comment man/man1/named-nzd2nzf.1.gz
 man/man1/named-rrchecker.1.gz
 man/man1/nsec3hash.1.gz
 man/man1/nslookup.1.gz
 man/man1/nsupdate.1.gz
 @comment man/man5/named.conf.5.gz
 @comment man/man5/rndc.conf.5.gz
 @comment man/man8/ddns-confgen.8.gz
 @comment man/man8/filter-a.8.gz
 @comment man/man8/filter-aaaa.8.gz
 @comment man/man8/named.8.gz
 @comment man/man8/rndc-confgen.8.gz
 @comment man/man8/rndc.8.gz
 @comment man/man8/tsig-keygen.8.gz
diff --git a/dns/bind9-devel/Makefile b/dns/bind9-devel/Makefile
index 45a2b3c5779b..8a6aff840f2c 100644
--- a/dns/bind9-devel/Makefile
+++ b/dns/bind9-devel/Makefile
@@ -1,281 +1,275 @@
 # pkg-help formatted with fmt 59 63
 
 PORTNAME=	bind
 PORTVERSION=	${ISCVERSION:S/-P/P/:S/b/.b/:S/a/.a/:S/rc/.rc/}
 .if defined(BIND_TOOLS_SLAVE)
 # dns/bind-tools here
 PORTREVISION=	0
 .else
 # XXX: correct version
 # dns/bind9xx here
 PORTREVISION=	0
 .endif
 CATEGORIES=	dns net
 # XXX: put the ISC master_site
 #MASTER_SITES=	ISC/bind9/${ISCVERSION}
 MASTER_SITES=	LOCAL/mat/bind
 .if defined(BIND_TOOLS_SLAVE)
 PKGNAMESUFFIX=	-tools
 .else
 # XXX: correct SUFFIX.
 PKGNAMESUFFIX=	9-devel
 .endif
 # XXX: correct DISTNAME.
 #DISTNAME=	${PORTNAME}-${ISCVERSION}
 
 MAINTAINER=	mat@FreeBSD.org
 .if defined(BIND_TOOLS_SLAVE)
 COMMENT=	Command line tools from BIND: delv, dig, host, nslookup...
 .else
 COMMENT=	BIND DNS suite with updated DNSSEC and DNS64
 .endif
 
 # Uncomment when bind9xx comes of age. +3 years if ESV, +1year otherwise, see
 # https://kb.isc.org/docs/aa-00896
 # DEPRECATED=	End of life, please migrate to a newer version of BIND9
 # EXPIRATION_DATE=	XXX-12-31
 
 LICENSE=	MPL20
 LICENSE_FILE=	${WRKSRC}/COPYRIGHT
 
 LIB_DEPENDS=	libuv.so:devel/libuv \
 		libnghttp2.so:www/libnghttp2 \
 		libxml2.so:textproc/libxml2
 
 .if !defined(BIND_TOOLS_SLAVE)
 RUN_DEPENDS=	bind-tools>0:dns/bind-tools
 .endif
 
 # XXX: remove tar:bz2
 USES=		autoreconf compiler:c11 cpe libedit libtool pkgconfig ssl tar:bz2
 # ISC releases things like 9.8.0-P1, which our versioning doesn't like
-ISCVERSION=	9.17.15a0.2021.07.06
+ISCVERSION=	9.17.18a0.2021.09.20
 # XXX: Remove gitlab
 USE_GITLAB=	yes
 GL_SITE=	https://gitlab.isc.org
 GL_ACCOUNT=	isc-projects
 GL_PROJECT=	bind9
-GL_COMMIT=	f663701b1deab34415f86cfef4172ac71e164edc
+GL_COMMIT=	be99fc92b63ef2463cadb2f90162982ed3ed289d
 
 CPE_VENDOR=	isc
 CPE_VERSION=	${ISCVERSION:C/-.*//}
 .if ${ISCVERSION:M*-*}
 CPE_UPDATE=	${ISCVERSION:C/.*-//:tl}
 .endif
 
 GNU_CONFIGURE=	yes
 CONFIGURE_ARGS=	--disable-linux-caps \
 		--localstatedir=/var \
 		--sysconfdir=${ETCDIR} \
 		--with-dlopen=yes \
 		--with-libxml2 \
 		--with-openssl=${OPENSSLBASE} \
 		--enable-dnsrps \
 		--with-readline=libedit
 CONFIGURE_ENV=	READLINE_CFLAGS="-L${LOCALBASE}/lib"
 ETCDIR=		${PREFIX}/etc/namedb
 
 .if defined(BIND_TOOLS_SLAVE)
 EXTRA_PATCHES=		${PATCHDIR}/extrapatch-bind-tools
 CONFIGURE_ARGS+=	--libdir=${PREFIX}/lib/bind-tools
 .else
 USE_RC_SUBR=		named
 # XXX: remove the big warning about it being a development version from pkg-message
 SUB_FILES=		named.conf pkg-message
 EXTRA_PATCHES=		${PATCHDIR}/extrapatch-no-bind-tools
 
 PORTDOCS=	*
 
 # XXX: Add -devel
 CONFLICTS=	bind911 bind912 bind913 bind914 bind916
 .endif	# BIND_TOOLS_SLAVE
 
 MAKE_JOBS_UNSAFE=	yes
 
 OPTIONS_DEFAULT=	DLZ_FILESYSTEM GSSAPI_NONE IDN JSON LMDB MANPAGES \
 			TCP_FASTOPEN DNSTAP
 OPTIONS_DEFINE=		DNSTAP DOCS FIXED_RRSET GEOIP IDN JSON LARGE_FILE LMDB \
 			MANPAGES OVERRIDECACHE PORTREVISION QUERYTRACE \
 			START_LATE TCP_FASTOPEN
 
-OPTIONS_RADIO=		CRYPTO
-OPTIONS_RADIO_CRYPTO=	NATIVE_PKCS11
-
 OPTIONS_GROUP=		DLZ
 OPTIONS_GROUP_DLZ=	DLZ_BDB DLZ_FILESYSTEM DLZ_LDAP DLZ_MYSQL \
 			DLZ_POSTGRESQL DLZ_STUB
 
 OPTIONS_SINGLE=		GSSAPI
 OPTIONS_SINGLE_GSSAPI=	GSSAPI_BASE GSSAPI_HEIMDAL GSSAPI_MIT GSSAPI_NONE
 
 .if defined(BIND_TOOLS_SLAVE)
 OPTIONS_EXCLUDE=	${OPTIONS_GROUP_DLZ} DNSTAP DOCS GEOIP LMDB \
 			OVERRIDECACHE PORTREVISION QUERYTRACE START_LATE \
 			TCP_FASTOPEN
 .endif	# BIND_TOOLS_SLAVE
 
 OPTIONS_SUB=	yes
 
 CRYPTO_DESC=		Choose which crypto engine to use
 DLZ_BDB_DESC=		DLZ BDB driver
 DLZ_DESC=		Dynamically Loadable Zones
 DLZ_FILESYSTEM_DESC=	DLZ filesystem driver
 DLZ_LDAP_DESC=		DLZ LDAP driver
 DLZ_MYSQL_DESC=		DLZ MySQL driver (no threading)
 DLZ_POSTGRESQL_DESC=	DLZ Postgres driver
 DLZ_STUB_DESC=		DLZ stub driver
 DNSTAP_DESC=		Provides fast passive logging of DNS messages
 FIXED_RRSET_DESC=	Enable fixed rrset ordering
 GSSAPI_BASE_DESC=	Using Heimdal in base
 GSSAPI_HEIMDAL_DESC=	Using security/heimdal
 GSSAPI_MIT_DESC=	Using security/krb5
 GSSAPI_NONE_DESC=	Disable
 LARGE_FILE_DESC=	64-bit file support
 LMDB_DESC=		Use LMDB for zone management
 OVERRIDECACHE_DESC=	Use the override-cache patch
-NATIVE_PKCS11_DESC=	Use PKCS\#11 native API (**READ HELP**)
 PORTREVISION_DESC=	Show PORTREVISION in the version string
 QUERYTRACE_DESC=	Enable the very verbose query tracelogging
 START_LATE_DESC=	Start BIND late in the boot process (see help)
 TCP_FASTOPEN_DESC=	RFC 7413 support
 
 DLZ_BDB_CONFIGURE_ON=	--with-dlz-bdb=yes
 DLZ_BDB_USES=		bdb
 
 DLZ_FILESYSTEM_CONFIGURE_ON=	--with-dlz-filesystem=yes
 
 DLZ_LDAP_CONFIGURE_ON=	--with-dlz-ldap=yes
 DLZ_LDAP_USE=		OPENLDAP=yes
 
 DLZ_MYSQL_CONFIGURE_ON=	--with-dlz-mysql=yes
 DLZ_MYSQL_USES=		mysql
 
 DLZ_POSTGRESQL_CONFIGURE_ON=	--with-dlz-postgres=yes
 DLZ_POSTGRESQL_USES=		pgsql
 
 DLZ_STUB_CONFIGURE_ON=	--with-dlz-stub=yes
 
 DNSTAP_CONFIGURE_ENABLE=	dnstap
 DNSTAP_LIB_DEPENDS=		libfstrm.so:devel/fstrm \
 				libprotobuf-c.so:devel/protobuf-c
 
 FIXED_RRSET_CONFIGURE_ENABLE=	fixed-rrset
 
 GEOIP_CONFIGURE_ENABLE=	geoip
 GEOIP_CONFIGURE_WITH=	maxminddb
 GEOIP_LIB_DEPENDS=	libmaxminddb.so:net/libmaxminddb
 
 GSSAPI_BASE_CONFIGURE_ON=	--with-gssapi="${KRB5CONFIG}" \
 				${GSSAPI_CONFIGURE_ARGS}
 GSSAPI_BASE_USES=		gssapi
 
 GSSAPI_HEIMDAL_CONFIGURE_ON=	--with-gssapi="${KRB5CONFIG}" \
 				${GSSAPI_CONFIGURE_ARGS}
 GSSAPI_HEIMDAL_USES=		gssapi:heimdal
 
 GSSAPI_MIT_CONFIGURE_ON=	--with-gssapi="${KRB5CONFIG}" \
 				${GSSAPI_CONFIGURE_ARGS}
 GSSAPI_MIT_USES=		gssapi:mit
 
 GSSAPI_NONE_CONFIGURE_ON=	--without-gssapi
 
 IDN_CONFIGURE_OFF=	--without-libidn2
 IDN_CONFIGURE_ON=	${ICONV_CONFIGURE_BASE} \
 			--with-libidn2=${LOCALBASE}
 IDN_LIB_DEPENDS=	libidn2.so:dns/libidn2
 IDN_USES=		iconv
 
 JSON_CONFIGURE_WITH=	json-c
 JSON_LIB_DEPENDS=	libjson-c.so:devel/json-c
 JSON_LDFLAGS=		-L${LOCALBASE}/lib -ljson-c
 
 LARGE_FILE_CONFIGURE_ENABLE=	largefile
 
 LMDB_CONFIGURE_WITH=	lmdb=${LOCALBASE}
 LMDB_LIB_DEPENDS=	liblmdb.so:databases/lmdb
 
 MANPAGES_BUILD_DEPENDS=	sphinx-build:textproc/py-sphinx
 
 OVERRIDECACHE_EXTRA_PATCHES=	${FILESDIR}/extrapatch-bind-min-override-ttl
 
-NATIVE_PKCS11_CONFIGURE_ENABLE=	native-pkcs11
-
 QUERYTRACE_CONFIGURE_ENABLE=	querytrace
 
 START_LATE_SUB_LIST=		NAMED_BEFORE="LOGIN" \
 				NAMED_REQUIRE="SERVERS cleanvar"
 START_LATE_SUB_LIST_OFF=	NAMED_BEFORE="SERVERS" \
 				NAMED_REQUIRE="NETWORKING ldconfig syslogd"
 
 TCP_FASTOPEN_CONFIGURE_ENABLE=	tcp-fastopen
 
 .include <bsd.port.options.mk>
 
 .if defined(WITH_DEBUG)
 CONFIGURE_ARGS+=	--enable-developer \
 			--enable-symtable
 USES+=			perl5
 USE_PERL5=		build
 BUILD_DEPENDS+=		cmocka>0:sysutils/cmocka
 .endif
 
 .include <bsd.port.pre.mk>
 
 .if ${SSL_DEFAULT} == base
 SUB_LIST+=	ENGINES=/usr/lib/engines
 .else
 SUB_LIST+=	ENGINES=${LOCALBASE}/lib/engines
 .endif
 
 # XXX: Remove first REINPLACE_CMD
 post-patch:
 	@${REINPLACE_CMD} -e '/^m4_define(\[bind_SRCID/s/\[m4.*\]/${GL_COMMIT}/' \
 		${WRKSRC}/configure.ac
 .for FILE in check/named-checkconf.rst named/named.rst nsupdate/nsupdate.rst \
 	rndc/rndc.rst
 	@${REINPLACE_CMD} -e 's#/etc/named.conf#${ETCDIR}/named.conf#g' \
 		-e 's#/etc/rndc.conf#${ETCDIR}/rndc.conf#g' \
 		-e "s#/var\/run\/named\/named.pid#/var/run/named/pid#" \
 		${WRKSRC}/bin/${FILE}
 .endfor
 
 .if !defined(BIND_TOOLS_SLAVE)
 .  if ${PORTREVISION:N0}
 post-patch-PORTREVISION-on:
 	@${REINPLACE_CMD} '/^m4_define.*bind_VERSION_EXTRA/s#)#_${PORTREVISION})#' \
 		${WRKSRC}/configure.ac
 .  endif
 
 post-install:
 	${MKDIR} ${STAGEDIR}${PREFIX}/etc/mtree
 	${MKDIR} ${STAGEDIR}${ETCDIR}
 .  for i in dynamic primary secondary working
 	@${MKDIR} ${STAGEDIR}${ETCDIR}/$i
 .  endfor
 	${INSTALL_DATA} ${WRKDIR}/named.conf ${STAGEDIR}${ETCDIR}/named.conf.sample
 	${INSTALL_DATA} ${FILESDIR}/named.root ${STAGEDIR}${ETCDIR}
 	${INSTALL_DATA} ${FILESDIR}/empty.db ${STAGEDIR}${ETCDIR}/primary
 	${INSTALL_DATA} ${FILESDIR}/localhost-forward.db ${STAGEDIR}${ETCDIR}/primary
 	${INSTALL_DATA} ${FILESDIR}/localhost-reverse.db ${STAGEDIR}${ETCDIR}/primary
 	${INSTALL_DATA} ${FILESDIR}/BIND.chroot.dist ${STAGEDIR}${PREFIX}/etc/mtree/BIND.chroot.dist.sample
 	${INSTALL_DATA} ${FILESDIR}/BIND.chroot.local.dist ${STAGEDIR}${PREFIX}/etc/mtree/BIND.chroot.local.dist.sample
 	${INSTALL_DATA} ${WRKSRC}/bin/rndc/rndc.conf \
 		${STAGEDIR}${ETCDIR}/rndc.conf.sample
 # FIXME: this is strange.
 	@${RM} -rf ${STAGEDIR}/wrkdirs
 
 post-install-DOCS-on:
 	${MKDIR} ${STAGEDIR}${DOCSDIR}
 	${INSTALL_DATA} ${WRKSRC}/CHANGES* \
 		${WRKSRC}/README.md ${STAGEDIR}${DOCSDIR}
 .else
 
 do-install:
 	for dir in bin lib doc/man; do \
 		(cd ${INSTALL_WRKSRC}/$$dir && ${SETENV} ${MAKE_ENV} ${FAKEROOT} ${MAKE_CMD} ${MAKE_FLAGS} ${MAKEFILE} ${MAKE_ARGS} ${INSTALL_TARGET}) ; \
 	done
 	@${RM} -r ${STAGEDIR}${PREFIX}/include
 
 .endif	# BIND_TOOLS_SLAVE
 
 .include <bsd.port.post.mk>
diff --git a/dns/bind9-devel/distinfo b/dns/bind9-devel/distinfo
index 0d95430036d5..ca046ef53dd2 100644
--- a/dns/bind9-devel/distinfo
+++ b/dns/bind9-devel/distinfo
@@ -1,3 +1,3 @@
-TIMESTAMP = 1625573711
-SHA256 (isc-projects-bind9-f663701b1deab34415f86cfef4172ac71e164edc_GL0.tar.gz) = 6e07498a88a5c1525570e777501d96cbad3e9bf7d997fdb4a4da25183bec5663
-SIZE (isc-projects-bind9-f663701b1deab34415f86cfef4172ac71e164edc_GL0.tar.gz) = 6222198
+TIMESTAMP = 1632153636
+SHA256 (isc-projects-bind9-be99fc92b63ef2463cadb2f90162982ed3ed289d_GL0.tar.gz) = 5bdcd0999fb97f70c8622b90270665cccba9467d943984ce06845545ef5c605f
+SIZE (isc-projects-bind9-be99fc92b63ef2463cadb2f90162982ed3ed289d_GL0.tar.gz) = 6192681
diff --git a/dns/bind9-devel/files/extrapatch-bind-min-override-ttl b/dns/bind9-devel/files/extrapatch-bind-min-override-ttl
index 0814e1d03ccd..0277ad45fc8d 100644
--- a/dns/bind9-devel/files/extrapatch-bind-min-override-ttl
+++ b/dns/bind9-devel/files/extrapatch-bind-min-override-ttl
@@ -1,61 +1,61 @@
 Add the override-cache-ttl feature.
 
---- bin/named/config.c.orig	2021-07-06 05:53:30 UTC
+--- bin/named/config.c.orig	2021-09-17 07:10:48 UTC
 +++ bin/named/config.c
-@@ -179,6 +179,7 @@ options {\n\
+@@ -182,6 +182,7 @@ options {\n\
  	notify-source *;\n\
  	notify-source-v6 *;\n\
  	nsec3-test-zone no;\n\
 +	override-cache-ttl 0; /* do not override */\n\
  	parental-source *;\n\
  	parental-source-v6 *;\n\
  	provide-ixfr true;\n\
---- bin/named/server.c.orig	2021-07-06 05:53:30 UTC
+--- bin/named/server.c.orig	2021-09-17 07:10:48 UTC
 +++ bin/named/server.c
-@@ -4497,6 +4497,11 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewl
+@@ -4498,6 +4498,11 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewl
  	}
  
  	obj = NULL;
 +	result = named_config_get(maps, "override-cache-ttl", &obj);
 +	INSIST(result == ISC_R_SUCCESS);
 +	view->overridecachettl = cfg_obj_asduration(obj);
 +
 +	obj = NULL;
  	result = named_config_get(maps, "max-cache-ttl", &obj);
  	INSIST(result == ISC_R_SUCCESS);
  	view->maxcachettl = cfg_obj_asduration(obj);
---- lib/dns/include/dns/view.h.orig	2021-07-06 05:53:30 UTC
+--- lib/dns/include/dns/view.h.orig	2021-09-17 07:10:48 UTC
 +++ lib/dns/include/dns/view.h
 @@ -154,6 +154,7 @@ struct dns_view {
  	bool		      requestnsid;
  	bool		      sendcookie;
  	dns_ttl_t	      maxcachettl;
 +	dns_ttl_t	      overridecachettl;
  	dns_ttl_t	      maxncachettl;
  	dns_ttl_t	      mincachettl;
  	dns_ttl_t	      minncachettl;
---- lib/dns/resolver.c.orig	2021-07-06 05:53:30 UTC
+--- lib/dns/resolver.c.orig	2021-09-17 07:10:48 UTC
 +++ lib/dns/resolver.c
-@@ -6386,6 +6386,12 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, dns_mes
+@@ -6382,6 +6382,12 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, dns_mes
  		}
  
  		/*
 +		 * Enforce the configure cache TTL override.
 +		 */
 +                if (res->view->overridecachettl)
 +                        rdataset->ttl = res->view->overridecachettl;
 +
 +		/*
  		 * Enforce the configure maximum cache TTL.
  		 */
  		if (rdataset->ttl > res->view->maxcachettl) {
---- lib/isccfg/namedconf.c.orig	2021-07-06 05:53:30 UTC
+--- lib/isccfg/namedconf.c.orig	2021-09-17 07:10:48 UTC
 +++ lib/isccfg/namedconf.c
-@@ -2029,6 +2029,7 @@ static cfg_clausedef_t view_clauses[] = {
+@@ -2050,6 +2050,7 @@ static cfg_clausedef_t view_clauses[] = {
  #endif /* ifdef HAVE_LMDB */
  	{ "max-acache-size", NULL, CFG_CLAUSEFLAG_ANCIENT },
  	{ "max-cache-size", &cfg_type_sizeorpercent, 0 },
 +	{ "override-cache-ttl", &cfg_type_duration, 0 },
  	{ "max-cache-ttl", &cfg_type_duration, 0 },
  	{ "max-clients-per-query", &cfg_type_uint32, 0 },
  	{ "max-ncache-ttl", &cfg_type_duration, 0 },
diff --git a/dns/bind9-devel/files/extrapatch-bind-tools b/dns/bind9-devel/files/extrapatch-bind-tools
index e13e588e5aa4..ed20ba2432ba 100644
--- a/dns/bind9-devel/files/extrapatch-bind-tools
+++ b/dns/bind9-devel/files/extrapatch-bind-tools
@@ -1,31 +1,30 @@
 Only select the "tools" part of bind for building.
 
---- Makefile.am.orig	2020-07-20 08:13:37 UTC
+--- Makefile.am.orig	2021-09-17 07:10:48 UTC
 +++ Makefile.am
 @@ -8,8 +8,6 @@ CLEANFILES = bind.keys.h
  bind.keys.h: bind.keys Makefile
  	${PERL} ${top_srcdir}/util/bindkeys.pl ${top_srcdir}/bind.keys > $@
  
 -dist_sysconf_DATA = bind.keys
 -
  .PHONY: doc
  
  EXTRA_DIST = 			\
---- bin/Makefile.am.orig	2020-07-20 08:13:37 UTC
+--- bin/Makefile.am.orig	2021-09-17 07:10:48 UTC
 +++ bin/Makefile.am
-@@ -1,4 +1,4 @@
+@@ -1 +1 @@
 -SUBDIRS = named rndc dig delv dnssec tools nsupdate check confgen tests plugins
 +SUBDIRS = dig delv dnssec tools nsupdate
- 
- if HAVE_PKCS11
- SUBDIRS += pkcs11
---- bin/tools/Makefile.am.orig	2020-07-20 08:13:37 UTC
+-SUBDIRS = named rndc dig delv dnssec tools nsupdate check confgen tests plugins
++SUBDIRS = dig delv dnssec tools nsupdate
+--- bin/tools/Makefile.am.orig	2021-09-17 07:10:48 UTC
 +++ bin/tools/Makefile.am
-@@ -11,7 +11,6 @@ LDADD =				\
+@@ -11,7 +11,6 @@ LDADD +=			\
  bin_PROGRAMS =			\
  	arpaname		\
  	mdig			\
 -	named-journalprint	\
  	named-rrchecker		\
  	nsec3hash
  
diff --git a/dns/bind9-devel/files/extrapatch-no-bind-tools b/dns/bind9-devel/files/extrapatch-no-bind-tools
index 0183e6a803ab..d53088bec0f4 100644
--- a/dns/bind9-devel/files/extrapatch-no-bind-tools
+++ b/dns/bind9-devel/files/extrapatch-no-bind-tools
@@ -1,25 +1,22 @@
 Exclude the "tools" from building and installing.
 
---- bin/Makefile.am.orig	2021-01-04 06:21:13 UTC
+--- bin/Makefile.am.orig	2021-09-17 07:10:48 UTC
 +++ bin/Makefile.am
-@@ -1,4 +1,4 @@
+@@ -1 +1 @@
 -SUBDIRS = named rndc dig delv dnssec tools nsupdate check confgen tests plugins
 +SUBDIRS = named rndc tools check confgen tests plugins
- 
- if HAVE_PKCS11
- SUBDIRS += pkcs11
---- bin/tools/Makefile.am.orig	2021-01-04 06:21:13 UTC
+--- bin/tools/Makefile.am.orig	2021-09-17 07:10:48 UTC
 +++ bin/tools/Makefile.am
-@@ -9,11 +9,7 @@ LDADD =				\
+@@ -9,11 +9,7 @@ LDADD +=			\
  	$(LIBISC_LIBS)
  
  bin_PROGRAMS =			\
 -	arpaname		\
 -	mdig			\
 -	named-journalprint	\
 -	named-rrchecker		\
 -	nsec3hash
 +	named-journalprint
  
  arpaname_LDADD =		\
  	$(LIBISC_LIBS)
diff --git a/dns/bind9-devel/files/named.in b/dns/bind9-devel/files/named.in
index f1f0fb3e2d03..0d19435000cc 100644
--- a/dns/bind9-devel/files/named.in
+++ b/dns/bind9-devel/files/named.in
@@ -1,464 +1,452 @@
 #!/bin/sh
 
 # PROVIDE: named
 # REQUIRE: %%NAMED_REQUIRE%%
 # BEFORE: %%NAMED_BEFORE%%
 # KEYWORD: shutdown
 
 #
 # Add the following lines to /etc/rc.conf to enable BIND:
 # named_enable (bool):		    Run named, the DNS server (or NO).
 # named_program (str):		    Path to named, if you want a different one.
 # named_conf (str):		    Path to the configuration file
 # named_flags (str):		    Use this for flags OTHER than -u and -c
 # named_uid (str):		    User to run named as
 # named_chrootdir (str):	    Chroot directory (or "" not to auto-chroot it)
 #				    Historically, was /var/named
 # named_chroot_autoupdate (bool):   Automatically install/update chrooted
 # 				    components of named.
 # named_symlink_enable (bool):	    Symlink the chrooted pid file
 # named_wait (bool):		    Wait for working name service before exiting
 # named_wait_host (str):	    Hostname to check if named_wait is enabled
 # named_auto_forward (str):	    Set up forwarders from /etc/resolv.conf
 # named_auto_forward_only (str):    Do "forward only" instead of "forward first"
-%%NATIVE_PKCS11%%# named_pkcs11_engine (str):	    Path to the PKCS#11 library to use.
 #
 
 . /etc/rc.subr
 
 name=named
 desc="named BIND startup script"
 rcvar=named_enable
 
 load_rc_config ${name}
 
 extra_commands=reload
 
 start_precmd=named_prestart
 start_postcmd=named_poststart
 reload_cmd=named_reload
 stop_cmd=named_stop
 stop_postcmd=named_poststop
 
 named_enable=${named_enable:-"NO"}
 named_program=${named_program:-"%%PREFIX%%/sbin/named"}
 named_conf=${named_conf:-"%%ETCDIR%%/named.conf"}
 named_flags=${named_flags:-""}
 named_uid=${named_uid:-"bind"}
 named_chrootdir=${named_chrootdir:-""}
 named_chroot_autoupdate=${named_chroot_autoupdate:-"YES"}
 named_symlink_enable=${named_symlink_enable:-"YES"}
 named_wait=${named_wait:-"NO"}
 named_wait_host=${named_wait_host:-"localhost"}
 named_auto_forward=${named_auto_forward:-"NO"}
 named_auto_forward_only=${named_auto_forward_only:-"NO"}
-%%NATIVE_PKCS11%%named_pkcs11_engine=${named_pkcs11_engine:-""}
 
 # Not configuration variables but having them here keeps rclint happy
 required_dirs="${named_chrootdir}"
 _named_confdirroot="${named_conf%/*}"
 _named_confdir="${named_chrootdir}${_named_confdirroot}"
 _named_program_root="${named_program%/sbin/named}"
 _openssl_engines="%%ENGINES%%"
 
 # Needed if named.conf and rndc.conf are moved or if rndc.conf is used
 rndc_conf=${rndc_conf:-"$_named_confdir/rndc.conf"}
 rndc_key=${rndc_key:-"$_named_confdir/rndc.key"}
 
 # If running in a chroot cage, ensure that the appropriate files
 # exist inside the cage, as well as helper symlinks into the cage
 # from outside.
 #
 # As this is called after the is_running and required_dir checks
 # are made in run_rc_command(), we can safely assume ${named_chrootdir}
 # exists and named isn't running at this point (unless forcestart
 # is used).
 #
 chroot_autoupdate()
 {
 	local file
 
 	# If it's the first time around, fiddle with things and move the
 	# current configuration to the chroot.
 	if [ -d ${_named_confdirroot} -a ! -d ${_named_confdir} ]; then
 		warn "named chroot: Moving current configuration in the chroot!"
 		install -d ${_named_confdir%/*}
 		mv ${_named_confdirroot} ${_named_confdir}
 	fi
 
 	# Create (or update) the chroot directory structure
 	#
 	if [ -r %%PREFIX%%/etc/mtree/BIND.chroot.dist ]; then
 		mtree -deU -f %%PREFIX%%/etc/mtree/BIND.chroot.dist \
 		    -p ${named_chrootdir}
 	else
 		warn "%%PREFIX%%/etc/mtree/BIND.chroot.dist missing,"
 		warn "${named_chrootdir} directory structure not updated"
 	fi
 	if [ -r %%PREFIX%%/etc/mtree/BIND.chroot.local.dist ]; then
 		mkdir -p ${named_chrootdir}%%PREFIX%%
 		mtree -deU -f %%PREFIX%%/etc/mtree/BIND.chroot.local.dist \
 		    -p ${named_chrootdir}%%PREFIX%%
 	else
 		warn "%%PREFIX%%/etc/mtree/BIND.chroot.local.dist missing,"
 		warn "${named_chrootdir}%%PREFIX%% directory structure not updated"
 	fi
 
 	# Create (or update) the configuration directory symlink
 	#
 	if [ ! -L "${_named_confdirroot}" ]; then
 		if [ -d "${_named_confdirroot}" ]; then
 			warn "named chroot: ${_named_confdirroot} is a directory!"
 		elif [ -e "${_named_confdirroot}" ]; then
 			warn "named chroot: ${_named_confdirroot} exists!"
 		else
 			ln -s ${_named_confdir} ${_named_confdirroot}
 		fi
 	else
 		# Make sure it points to the right place.
 		ln -shf ${_named_confdir} ${_named_confdirroot}
 	fi
 
 	# Mount a devfs in the chroot directory if needed
 	#
 	if [ `${SYSCTL_N} security.jail.jailed` -eq 0 ]; then
 		umount ${named_chrootdir}/dev 2>/dev/null
 		devfs_domount ${named_chrootdir}/dev devfsrules_hide_all
 		devfs -m ${named_chrootdir}/dev rule apply path null unhide
 		devfs -m ${named_chrootdir}/dev rule apply path random unhide
 	else
 		if [ -c ${named_chrootdir}/dev/null -a \
 		    -c ${named_chrootdir}/dev/random ]; then
 			info "named chroot: using pre-mounted devfs."
 		else
 			err 1 "named chroot: devfs cannot be mounted from " \
 				"within a jail. Thus a chrooted named cannot " \
 				"be run from within a jail.  Either mount the " \
 				"devfs with null and random from the host, or " \
 				"run named without chrooting it, set " \
 				"named_chrootdir=\"\" in /etc/rc.conf."
 		fi
 	fi
 
 	# The OpenSSL engines and BIND9 plugins should be present in the
 	# chroot, named loads them after chrooting.
 	null_mount_or_copy ${_openssl_engines}
 	null_mount_or_copy %%PREFIX%%/lib/named
 
 	# Copy and/or update key files to the chroot /etc
 	#
 	for file in localtime protocols services; do
 		if [ -r /etc/${file} ] && \
 			! cmp -s /etc/${file} "${named_chrootdir}/etc/${file}"; then
 			cp -p /etc/${file} "${named_chrootdir}/etc/${file}"
 		fi
 	done
 }
 
 # Make symlinks to the correct pid file
 #
 make_symlinks()
 {
 	checkyesno named_symlink_enable &&
 	    ln -fs "${named_chrootdir}${pidfile}" ${pidfile} &&
 	    ln -fs "${named_chrootdir}${sessionkeyfile}" ${sessionkeyfile}
 }
 
 named_poststart()
 {
 	make_symlinks
 
 	if checkyesno named_wait; then
 		until ${_named_program_root}/bin/host ${named_wait_host} >/dev/null 2>&1; do
 			echo "	Waiting for nameserver to resolve ${named_wait_host}"
 			sleep 1
 		done
 	fi
 }
 
 named_reload()
 {
 	# This is a one line function, but ${named_program} is not defined early
 	# enough to be there when the reload_cmd variable is defined up there.
 	rndc reload
 }
 
 find_pidfile()
 {
 	if get_pidfile_from_conf pid-file ${named_conf}; then
 		pidfile="${_pidfile_from_conf}"
 	else
 		pidfile="/var/run/named/pid"
 	fi
 }
 
 find_sessionkeyfile()
 {
 	if get_pidfile_from_conf session-keyfile ${named_conf}; then
 		sessionkeyfile="${_pidfile_from_conf}"
 	else
 		sessionkeyfile="/var/run/named/session.key"
 	fi
 }
 
 named_stop()
 {
 	find_pidfile
 
 	# This duplicates an undesirably large amount of code from the stop
 	# routine in rc.subr in order to use rndc to shut down the process,
 	# and to give it a second chance in case rndc fails.
 	rc_pid=$(check_pidfile ${pidfile} ${command})
 	if [ -z "${rc_pid}" ]; then
 		[ -n "${rc_fast}" ] && return 0
 		_run_rc_notrunning
 		return 1
 	fi
 	echo 'Stopping named.'
 	if rndc stop; then
 		wait_for_pids ${rc_pid}
 	else
 		echo -n 'rndc failed, trying kill: '
 		kill -TERM ${rc_pid}
 		wait_for_pids ${rc_pid}
 	fi
 }
 
 named_poststop()
 {
 	if [ -n "${named_chrootdir}" ]; then
 		null_umount %%PREFIX%%/lib/named
 		null_umount ${_openssl_engines}
 		if [ -c ${named_chrootdir}/dev/null ]; then
 			# unmount /dev
 			if [ `${SYSCTL_N} security.jail.jailed` -eq 0 ]; then
 				umount ${named_chrootdir}/dev 2>/dev/null || true
 			else
 				warn "named chroot:" \
 					"cannot unmount devfs from inside jail!"
 			fi
 		fi
 	fi
 }
 
 can_mount()
 {
 	local kld
 	kld=$1
 	if ! load_kld $kld; then
 		return 1
 	fi
 	if [ `${SYSCTL_N} security.jail.jailed` -eq 0 ] ||
 		[ `${SYSCTL_N} security.jail.mount_allowed` -eq 1 ] ||
 		[ `${SYSCTL_N} security.jail.mount_${kld}_allowed` -eq 1 ] ; then
 		return 0
 	fi
 	return 1
 }
 
 null_mount_or_copy()
 {
 	local dir
 	dir=$1
 
 	if [ -d ${dir} ]; then
 		mkdir -p ${named_chrootdir}${dir}
 		if can_mount nullfs ; then
 			mount -t nullfs ${dir} ${named_chrootdir}${dir}
 		else
 			warn "named chroot: cannot nullfs mount OpenSSL" \
 				"engines into the chroot, will copy the shared" \
 				"libraries instead."
 			cp -f ${dir}/*.so ${named_chrootdir}${dir}
 		fi
 	fi
 }
 
 null_umount()
 {
 	local dir
 	dir=$1
 
 	if [ -d ${dir} ]; then
 		if can_mount nullfs; then
 			umount ${named_chrootdir}${dir}
 		fi
 	fi
 }
 
 create_file()
 {
 	if [ -e "$1" ]; then
 		unlink $1
 	fi
 	install -o root -g wheel -m 0644 /dev/null $1
 }
 
 rndc()
 {
 	if [ -z "${rndc_flags}" ]; then
 		if [ -s "${rndc_conf}" ] ; then
 			rndc_flags="-c ${rndc_conf}"
 		elif [ -s "${rndc_key}" ] ; then
 			rndc_flags="-k ${rndc_key}"
 		else
 			rndc_flags=""
 		fi
 	fi
 
 	${_named_program_root}/sbin/rndc ${rndc_flags} "$@"
 }
 
 named_prestart()
 {
 	find_pidfile
 	find_sessionkeyfile
 
 	if [ -n "${named_pidfile}" ]; then
 		warn 'named_pidfile: now determined from the conf file'
 	fi
 
 	if [ -n "${named_sessionkeyfile}" ]; then
 		warn 'named_sessionkeyfile: now determined from the conf file'
 	fi
 
 	piddir=`/usr/bin/dirname ${pidfile}`
 	if [ ! -d ${piddir} ]; then
 		install -d -o ${named_uid} -g ${named_uid} ${piddir}
 	fi
 
 	sessionkeydir=`/usr/bin/dirname ${sessionkeyfile}`
 	if [ ! -d ${sessionkeydir} ]; then
 		install -d -o ${named_uid} -g ${named_uid} ${sessionkeydir}
 	fi
 
 	command_args="-u ${named_uid:=root} -c ${named_conf} ${command_args}"
 
-%%NATIVE_PKCS11%%	if [ -z "${named_pkcs11_engine}"]; then
-%%NATIVE_PKCS11%%		err 3 "named_pkcs11_engine has to be set to the PKCS#11 engine's library you want to use"
-%%NATIVE_PKCS11%%	elif [ ! -f ${named_pkcs11_engine} ]; then
-%%NATIVE_PKCS11%%		err 3 "named_pkcs11_engine the PKCS#11 engine's library you want to use doesn't exist"
-%%NATIVE_PKCS11%%	else
-%%NATIVE_PKCS11%%		mkdir -p ${named_chrootdir}${named_pkcs11_engine%/*}
-%%NATIVE_PKCS11%%		cp -p ${named_pkcs11_engine} ${named_chrootdir}${named_pkcs11_engine}
-%%NATIVE_PKCS11%%		command_args="-E ${named_pkcs11_engine} ${command_args}"
-%%NATIVE_PKCS11%%	fi
-
 	local line nsip firstns
 
 	# Is the user using a sandbox?
 	#
 	if [ -n "${named_chrootdir}" ]; then
 		rc_flags="${rc_flags} -t ${named_chrootdir}"
 		checkyesno named_chroot_autoupdate && chroot_autoupdate
 
 		case "${altlog_proglist}" in
 		  *named*)
 		    ;;
 		  *)
 		    warn 'Using chroot without setting altlog_proglist, logging may not'
 		    warn 'work correctly.  Run sysrc altlog_proglist+=named'
 		    ;;
 		esac
 	else
 		named_symlink_enable=NO
 	fi
 
 	# Create an rndc.key file for the user if none exists
 	#
 	confgen_command="${_named_program_root}/sbin/rndc-confgen -a -b256 -u ${named_uid} \
 	    -c ${_named_confdir}/rndc.key"
 	if [ -s "${_named_confdir}/rndc.conf" ]; then
 		unset confgen_command
 	fi
 	if [ -s "${_named_confdir}/rndc.key" ]; then
 		case `stat -f%Su ${_named_confdir}/rndc.key` in
 		root|${named_uid}) ;;
 		*) ${confgen_command} ;;
 		esac
 	else
 		${confgen_command}
 	fi
 
 	local checkconf
 
 	checkconf="${_named_program_root}/bin/named-checkconf"
 	if ! checkyesno named_chroot_autoupdate && [ -n "${named_chrootdir}" ]; then
 		checkconf="${checkconf} -t ${named_chrootdir}"
 	fi
 
 	# Create a forwarder configuration based on /etc/resolv.conf
 	if checkyesno named_auto_forward; then
 		if [ ! -s /etc/resolv.conf ]; then
 			warn "named_auto_forward enabled, but no /etc/resolv.conf"
 
 			# Empty the file in case it is included in named.conf
 			[ -s "${_named_confdir}/auto_forward.conf" ] &&
 			    create_file ${_named_confdir}/auto_forward.conf
 
 			${checkconf} ${named_conf} ||
 			    err 3 'named-checkconf for ${named_conf} failed'
 			return
 		fi
 
 		create_file /var/run/naf-resolv.conf
 		create_file /var/run/auto_forward.conf
 
 		echo '	forwarders {' > /var/run/auto_forward.conf
 
 		while read line; do
 			case "${line}" in
 			'nameserver '*|'nameserver	'*)
 				nsip=${line##nameserver[         ]}
 
 				if [ -z "${firstns}" ]; then
 					if [ ! "${nsip}" = '127.0.0.1' ]; then
 						echo 'nameserver 127.0.0.1'
 						echo "		${nsip};" >> /var/run/auto_forward.conf
 					fi
 
 					firstns=1
 				else
 					[ "${nsip}" = '127.0.0.1' ] && continue
 					echo "		${nsip};" >> /var/run/auto_forward.conf
 				fi
 				;;
 			esac
 
 			echo ${line}
 		done < /etc/resolv.conf > /var/run/naf-resolv.conf
 
 		echo '	};' >> /var/run/auto_forward.conf
 		echo '' >> /var/run/auto_forward.conf
 		if checkyesno named_auto_forward_only; then
 			echo "	forward only;" >> /var/run/auto_forward.conf
 		else
 			echo "	forward first;" >> /var/run/auto_forward.conf
 		fi
 
 		if cmp -s /etc/resolv.conf /var/run/naf-resolv.conf; then
 			unlink /var/run/naf-resolv.conf
 		else
 			[ -e /etc/resolv.conf ] && unlink /etc/resolv.conf
 			mv /var/run/naf-resolv.conf /etc/resolv.conf
 		fi
 
 		if cmp -s ${_named_confdir}/auto_forward.conf \
 		    /var/run/auto_forward.conf; then
 			unlink /var/run/auto_forward.conf
 		else
 			[ -e "${_named_confdir}/auto_forward.conf" ] &&
 			    unlink ${_named_confdir}/auto_forward.conf
 			mv /var/run/auto_forward.conf \
 			    ${_named_confdir}/auto_forward.conf
 		fi
 	else
 		# Empty the file in case it is included in named.conf
 		[ -s "${_named_confdir}/auto_forward.conf" ] &&
 		    create_file ${_named_confdir}/auto_forward.conf
 	fi
 
 	${checkconf} ${named_conf} || err 3 "named-checkconf for ${named_conf} failed"
 }
 
 run_rc_command "$1"
diff --git a/dns/bind9-devel/files/patch-bin_named_include_named_globals.h b/dns/bind9-devel/files/patch-bin_named_include_named_globals.h
index 173ad8b5d006..6b9d61afe30c 100644
--- a/dns/bind9-devel/files/patch-bin_named_include_named_globals.h
+++ b/dns/bind9-devel/files/patch-bin_named_include_named_globals.h
@@ -1,13 +1,13 @@
 We reference the pid file as being run/named/pid everywere else.
 
---- bin/named/include/named/globals.h.orig	2021-02-08 02:55:31 UTC
+--- bin/named/include/named/globals.h.orig	2021-09-17 07:10:48 UTC
 +++ bin/named/include/named/globals.h
-@@ -130,7 +130,7 @@ EXTERN bool named_g_forcelock		   INIT(false);
+@@ -133,7 +133,7 @@ EXTERN bool named_g_forcelock		   INIT(false);
  
  #if NAMED_RUN_PID_DIR
  EXTERN const char *named_g_defaultpidfile INIT(NAMED_LOCALSTATEDIR "/run/named/"
 -								   "named.pid");
 +								   "pid");
  #else  /* if NAMED_RUN_PID_DIR */
  EXTERN const char *named_g_defaultpidfile INIT(NAMED_LOCALSTATEDIR "/run/"
  								   "named.pid");
diff --git a/dns/bind9-devel/files/patch-configure.ac b/dns/bind9-devel/files/patch-configure.ac
index 417f725db3f2..ed71cb259b09 100644
--- a/dns/bind9-devel/files/patch-configure.ac
+++ b/dns/bind9-devel/files/patch-configure.ac
@@ -1,13 +1,13 @@
 automake has warnings, it is ok here.
 
---- configure.ac.orig	2021-04-26 07:17:12 UTC
+--- configure.ac.orig	2021-09-17 07:10:48 UTC
 +++ configure.ac
-@@ -63,7 +63,7 @@ AC_CANONICAL_HOST
+@@ -46,7 +46,7 @@ AC_CANONICAL_HOST
  AC_CANONICAL_TARGET
  
  AC_CONFIG_SRCDIR([bin/named/main.c])
 -AM_INIT_AUTOMAKE([1.9 tar-pax foreign subdir-objects dist-xz no-dist-gzip -Wall -Werror])
 +AM_INIT_AUTOMAKE([1.9 tar-pax foreign subdir-objects dist-xz no-dist-gzip -Wall])
  AM_SILENT_RULES([yes])
  AM_EXTRA_RECURSIVE_TARGETS([test unit doc])
  
diff --git a/dns/bind9-devel/pkg-help b/dns/bind9-devel/pkg-help
index aa85330b21d7..55cdb63c117c 100644
--- a/dns/bind9-devel/pkg-help
+++ b/dns/bind9-devel/pkg-help
@@ -1,30 +1,14 @@
-                       NATIVE_PKCS11
-When using the NATIVE_PKCS11 option, BIND will use the PKCS#11
-engine specified by the named_pkcss11_engine variable in
-/etc/rc.conf for *all* crypto operations.
-
-This is primarily intended to be used in an authoritative
-case.
-
-If BIND is also operating as a validating resolver,
-NATIVE_PKCS11 should not be used, because the HSM will be
-used for all crypto, including DNSSEC validations, and the
-HSM is likely to be slower than the CPU for this purpose.
-Additionally, the HSM might not support all of the PKCS#11
-API functions needed for signature verification.
-
-
                             GOST
 If using a chrooted instance of BIND on FreeBSD 8.x and 9.x,
 the OpenSSL engines MUST be accessible from within the chroot.
 If BIND is chrooted in /var/named, this can be achieved by
 either copying content of /usr/local/lib/engines into
 /var/named/usr/local/lib/engines, or by creating that directory
 and adding this line to /etc/fstab:
 /usr/local/lib/engines  /var/named/usr/local/lib/engines nullfs ro 0 0
 
 
                          START_LATE
 Most of the time, BIND needs to start early in the boot
 process.  Enable this if BIND starts too early for you and
 you need it to start later.
diff --git a/dns/bind9-devel/pkg-plist b/dns/bind9-devel/pkg-plist
index 691e7e9f1cac..f5e38c9ba9b6 100644
--- a/dns/bind9-devel/pkg-plist
+++ b/dns/bind9-devel/pkg-plist
@@ -1,325 +1,310 @@
 %%DNSTAP%%bin/dnstap-read
 bin/named-checkconf
 bin/named-checkzone
 bin/named-compilezone
 bin/named-journalprint
 %%LMDB%%bin/named-nzd2nzf
-%%NATIVE_PKCS11%%bin/pkcs11-destroy
-%%NATIVE_PKCS11%%bin/pkcs11-keygen
-%%NATIVE_PKCS11%%bin/pkcs11-list
-%%NATIVE_PKCS11%%bin/pkcs11-tokens
 @sample etc/mtree/BIND.chroot.dist.sample
 @sample etc/mtree/BIND.chroot.local.dist.sample
 %%ETCDIR%%/bind.keys
 %%ETCDIR%%/primary/empty.db
 %%ETCDIR%%/primary/localhost-forward.db
 %%ETCDIR%%/primary/localhost-reverse.db
 @sample %%ETCDIR%%/named.conf.sample
 %%ETCDIR%%/named.root
 %%ETCDIR%%/rndc.conf.sample
 include/bind9/check.h
 include/bind9/getaddresses.h
 include/dns/acl.h
 include/dns/adb.h
 include/dns/badcache.h
 include/dns/bit.h
 include/dns/byaddr.h
 include/dns/cache.h
 include/dns/callbacks.h
 include/dns/catz.h
 include/dns/cert.h
 include/dns/client.h
 include/dns/clientinfo.h
 include/dns/compress.h
 include/dns/db.h
 include/dns/dbiterator.h
 include/dns/diff.h
 include/dns/dispatch.h
 include/dns/dlz.h
 include/dns/dlz_dlopen.h
 include/dns/dns64.h
 include/dns/dnsrps.h
 include/dns/dnssec.h
 include/dns/dnstap.h
 include/dns/ds.h
 include/dns/dsdigest.h
 include/dns/dyndb.h
 include/dns/ecs.h
 include/dns/edns.h
 include/dns/enumclass.h
 include/dns/enumtype.h
 include/dns/events.h
 include/dns/fixedname.h
 include/dns/forward.h
 include/dns/geoip.h
 include/dns/ipkeylist.h
 include/dns/iptable.h
 include/dns/journal.h
 include/dns/kasp.h
 include/dns/keydata.h
 include/dns/keyflags.h
 include/dns/keymgr.h
 include/dns/keytable.h
 include/dns/keyvalues.h
 include/dns/lib.h
 include/dns/librpz.h
 include/dns/log.h
 include/dns/lookup.h
 include/dns/master.h
 include/dns/masterdump.h
 include/dns/message.h
 include/dns/name.h
 include/dns/ncache.h
 include/dns/nsec.h
 include/dns/nsec3.h
 include/dns/nta.h
 include/dns/opcode.h
 include/dns/order.h
 include/dns/peer.h
 include/dns/private.h
 include/dns/rbt.h
 include/dns/rcode.h
 include/dns/rdata.h
 include/dns/rdataclass.h
 include/dns/rdatalist.h
 include/dns/rdataset.h
 include/dns/rdatasetiter.h
 include/dns/rdataslab.h
 include/dns/rdatastruct.h
 include/dns/rdatatype.h
 include/dns/request.h
 include/dns/resolver.h
 include/dns/result.h
 include/dns/rootns.h
 include/dns/rpz.h
 include/dns/rriterator.h
 include/dns/rrl.h
 include/dns/sdb.h
 include/dns/sdlz.h
 include/dns/secalg.h
 include/dns/secproto.h
 include/dns/soa.h
 include/dns/ssu.h
 include/dns/stats.h
 include/dns/tcpmsg.h
 include/dns/time.h
 include/dns/timer.h
 include/dns/tkey.h
 include/dns/transport.h
 include/dns/tsec.h
 include/dns/tsig.h
 include/dns/ttl.h
 include/dns/types.h
 include/dns/update.h
 include/dns/validator.h
 include/dns/view.h
 include/dns/xfrin.h
 include/dns/zone.h
 include/dns/zonekey.h
 include/dns/zoneverify.h
 include/dns/zt.h
 include/dst/dst.h
 include/dst/gssapi.h
 include/dst/result.h
 include/irs/resconf.h
 include/isc/aes.h
 include/isc/align.h
 include/isc/app.h
 include/isc/assertions.h
 include/isc/astack.h
 include/isc/atomic.h
 include/isc/attributes.h
 include/isc/backtrace.h
 include/isc/barrier.h
 include/isc/base32.h
 include/isc/base64.h
 include/isc/bind9.h
 include/isc/buffer.h
 include/isc/cmocka.h
 include/isc/commandline.h
 include/isc/condition.h
 include/isc/counter.h
 include/isc/crc64.h
 include/isc/deprecated.h
 include/isc/dir.h
 include/isc/endian.h
 include/isc/errno.h
 include/isc/error.h
 include/isc/event.h
 include/isc/eventclass.h
 include/isc/file.h
 include/isc/formatcheck.h
 include/isc/fsaccess.h
 include/isc/fuzz.h
 include/isc/glob.h
 include/isc/hash.h
 include/isc/heap.h
 include/isc/hex.h
 include/isc/hmac.h
 include/isc/hp.h
 include/isc/ht.h
 include/isc/httpd.h
 include/isc/interfaceiter.h
 include/isc/iterated_hash.h
 include/isc/lang.h
 include/isc/lex.h
-include/isc/lib.h
 include/isc/likely.h
 include/isc/list.h
 include/isc/log.h
 include/isc/magic.h
 include/isc/managers.h
 include/isc/md.h
 include/isc/mem.h
 include/isc/meminfo.h
 include/isc/mutex.h
 include/isc/mutexblock.h
 include/isc/net.h
 include/isc/netaddr.h
 include/isc/netdb.h
 include/isc/netmgr.h
 include/isc/netscope.h
 include/isc/nonce.h
 include/isc/offset.h
 include/isc/once.h
 include/isc/os.h
 include/isc/parseint.h
 include/isc/pool.h
 include/isc/portset.h
 include/isc/print.h
 include/isc/queue.h
 include/isc/quota.h
 include/isc/radix.h
 include/isc/random.h
 include/isc/ratelimiter.h
 include/isc/refcount.h
 include/isc/regex.h
 include/isc/region.h
 include/isc/resource.h
 include/isc/result.h
 include/isc/resultclass.h
 include/isc/rwlock.h
 include/isc/safe.h
 include/isc/serial.h
 include/isc/siphash.h
 include/isc/sockaddr.h
 include/isc/socket.h
 include/isc/stat.h
 include/isc/stats.h
 include/isc/stdatomic.h
 include/isc/stdio.h
 include/isc/stdtime.h
 include/isc/strerr.h
 include/isc/string.h
 include/isc/symtab.h
 include/isc/syslog.h
 include/isc/task.h
 include/isc/taskpool.h
 include/isc/thread.h
 include/isc/time.h
 include/isc/timer.h
 include/isc/tls.h
 include/isc/tm.h
 include/isc/types.h
 include/isc/url.h
 include/isc/utf8.h
 include/isc/util.h
 include/isccc/alist.h
 include/isccc/base64.h
 include/isccc/cc.h
 include/isccc/ccmsg.h
 include/isccc/events.h
 include/isccc/result.h
 include/isccc/sexpr.h
 include/isccc/symtab.h
 include/isccc/symtype.h
 include/isccc/types.h
 include/isccc/util.h
 include/isccfg/aclconf.h
 include/isccfg/cfg.h
 include/isccfg/grammar.h
 include/isccfg/kaspconf.h
 include/isccfg/log.h
 include/isccfg/namedconf.h
 include/ns/client.h
 include/ns/events.h
 include/ns/hooks.h
 include/ns/interfacemgr.h
 include/ns/lib.h
 include/ns/listenlist.h
 include/ns/log.h
 include/ns/notify.h
 include/ns/query.h
 include/ns/server.h
 include/ns/sortlist.h
 include/ns/stats.h
 include/ns/types.h
 include/ns/update.h
 include/ns/xfrout.h
-include/pk11/constants.h
-include/pk11/internal.h
-include/pk11/pk11.h
-include/pk11/result.h
-include/pk11/site.h
-include/pkcs11/pkcs11.h
 lib/bind/filter-a.so
 lib/bind/filter-aaaa.so
 lib/libbind9.so
-lib/libbind9-9.17.15.so
+lib/libbind9-9.17.18.so
 lib/libdns.so
-lib/libdns-9.17.15.so
+lib/libdns-9.17.18.so
 lib/libirs.so
-lib/libirs-9.17.15.so
+lib/libirs-9.17.18.so
 lib/libisc.so
-lib/libisc-9.17.15.so
+lib/libisc-9.17.18.so
 lib/libisccc.so
-lib/libisccc-9.17.15.so
+lib/libisccc-9.17.18.so
 lib/libisccfg.so
-lib/libisccfg-9.17.15.so
+lib/libisccfg-9.17.18.so
 lib/libns.so
-lib/libns-9.17.15.so
+lib/libns-9.17.18.so
 @comment man/man1/arpaname.1.gz
 @comment man/man1/delv.1.gz
 @comment man/man1/dig.1.gz
 @comment man/man1/dnssec-cds.1.gz
 @comment man/man1/dnssec-dsfromkey.1.gz
 @comment man/man1/dnssec-importkey.1.gz
 @comment man/man1/dnssec-keyfromlabel.1.gz
 @comment man/man1/dnssec-keygen.1.gz
 @comment man/man1/dnssec-revoke.1.gz
 @comment man/man1/dnssec-settime.1.gz
 @comment man/man1/dnssec-signzone.1.gz
 @comment man/man1/dnssec-verify.1.gz
 %%MANPAGES%%%%DNSTAP%%man/man1/dnstap-read.1.gz
 @comment man/man1/host.1.gz
 @comment man/man1/mdig.1.gz
 %%MANPAGES%%man/man1/named-checkconf.1.gz
 %%MANPAGES%%man/man1/named-checkzone.1.gz
 %%MANPAGES%%man/man1/named-compilezone.1.gz
 %%MANPAGES%%man/man1/named-journalprint.1.gz
 %%MANPAGES%%%%LMDB%%man/man1/named-nzd2nzf.1.gz
 @comment man/man1/named-rrchecker.1.gz
 @comment man/man1/nsec3hash.1.gz
 @comment man/man1/nslookup.1.gz
 @comment man/man1/nsupdate.1.gz
-%%MANPAGES%%%%NATIVE_PKCS11%%man/man1/pkcs11-destroy.1.gz
-%%MANPAGES%%%%NATIVE_PKCS11%%man/man1/pkcs11-keygen.1.gz
-%%MANPAGES%%%%NATIVE_PKCS11%%man/man1/pkcs11-list.1.gz
-%%MANPAGES%%%%NATIVE_PKCS11%%man/man1/pkcs11-tokens.1.gz
 %%MANPAGES%%man/man5/named.conf.5.gz
 %%MANPAGES%%man/man5/rndc.conf.5.gz
 %%MANPAGES%%man/man8/ddns-confgen.8.gz
 %%MANPAGES%%man/man8/filter-a.8.gz
 %%MANPAGES%%man/man8/filter-aaaa.8.gz
 %%MANPAGES%%man/man8/named.8.gz
 %%MANPAGES%%man/man8/rndc-confgen.8.gz
 %%MANPAGES%%man/man8/rndc.8.gz
 %%MANPAGES%%man/man8/tsig-keygen.8.gz
 sbin/ddns-confgen
 sbin/named
 sbin/rndc
 sbin/rndc-confgen
 sbin/tsig-keygen
 @dir(bind,bind,) %%ETCDIR%%/dynamic
 @dir(bind,bind,) %%ETCDIR%%/secondary
 @dir(bind,bind,) %%ETCDIR%%/working