Index: head/dns/bind910/Makefile
===================================================================
--- head/dns/bind910/Makefile	(revision 388210)
+++ head/dns/bind910/Makefile	(revision 388211)
@@ -1,248 +1,254 @@
 # $FreeBSD$
 # pkg-help formatted with fmt 59 63
 
 PORTNAME=	bind
 PORTVERSION=	${ISCVERSION:S/-P/P/}
 .if defined(BIND_TOOLS_SLAVE)
 # dns/bind-tools here
 PORTREVISION=	0
 .else
 # dns/bind910 here
-PORTREVISION=	4
+PORTREVISION=	5
 .endif
 CATEGORIES=	dns net ipv6
 MASTER_SITES=	ISC/bind9/${ISCVERSION}
 PKGNAMESUFFIX?=	910
 DISTNAME=	${PORTNAME}-${ISCVERSION}
 
 MAINTAINER=	mat@FreeBSD.org
 COMMENT?=	BIND DNS suite with updated DNSSEC and DNS64
 
 LICENSE=	ISCL
 
 # ISC releases things like 9.8.0-P1, which our versioning doesn't like
 ISCVERSION=	9.10.2
 
 MAKE_JOBS_UNSAFE=	yes
 
 USES=	cpe
 
 CPE_VENDOR=	isc
 CPE_VERSION=	${ISCVERSION:C/-.*//}
 .if ${ISCVERSION:M*-*}
 CPE_UPDATE=	${ISCVERSION:C/.*-//:tl}
 .endif
 
 LIB_DEPENDS=	libxml2.so:${PORTSDIR}/textproc/libxml2
 
 GNU_CONFIGURE=	yes
 CONFIGURE_ARGS+=	--localstatedir=/var --disable-linux-caps \
 		--disable-symtable \
 		--with-randomdev=/dev/random \
 		--with-libxml2=${LOCALBASE} \
 		--sysconfdir=${ETCDIR}
 ETCDIR=		${PREFIX}/etc/namedb
 
 CONFLICTS+=	bind9*-9.[456789].* bind9*-sdb-9.[456789].*
 
 .if !defined(BIND_TOOLS_SLAVE)
 SUB_FILES=	pkg-message
 .endif
 
 OPTIONS_DEFAULT=	IPV6 SSL THREADS SIGCHASE IDN GSSAPI_NONE
-OPTIONS_DEFINE=		IDN LARGE_FILE PYTHON \
+OPTIONS_DEFINE=		IDN LARGE_FILE PYTHON START_LATE \
 			FIXED_RRSET SIGCHASE IPV6 THREADS FILTER_AAAA
 OPTIONS_RADIO=	CRYPTO GOSTDEF
 OPTIONS_RADIO_CRYPTO=	SSL NATIVE_PKCS11
 OPTIONS_RADIO_GOSTDEF=	GOST GOST_ASN1
 
 .if !defined(BIND_TOOLS_SLAVE)
 OPTIONS_DEFAULT+=	RRL
 OPTIONS_DEFINE+=	LINKS RPZ_NSIP RPZ_NSDNAME RRL DOCS NEWSTATS GEOIP
 OPTIONS_GROUP=		DLZ
 OPTIONS_GROUP_DLZ=	DLZ_POSTGRESQL DLZ_MYSQL DLZ_BDB \
 			DLZ_LDAP DLZ_FILESYSTEM DLZ_STUB
 .endif	# BIND_TOOLS_SLAVE
 OPTIONS_SINGLE=		GSSAPI
 OPTIONS_SINGLE_GSSAPI=	GSSAPI_BASE GSSAPI_HEIMDAL GSSAPI_MIT GSSAPI_NONE
 
 OPTIONS_SUB=	yes
 
 SSL_DESC=		Build with OpenSSL (Required for DNSSEC)
 LARGE_FILE_DESC=	64-bit file support
 FIXED_RRSET_DESC=	Enable fixed rrset ordering
 SIGCHASE_DESC=		dig/host/nslookup will do DNSSEC validation
 FILTER_AAAA_DESC=	Enable filtering of AAAA records
 CRYPTO_DESC=		Choose which crypto engine to use
 NATIVE_PKCS11_DESC=	Use PKCS\#11 native API (**READ HELP**)
 GEOIP_DESC=		Allow geographically based ACL.
 GOSTDEF_DESC=		Enable GOST ciphers, needs SSL (see help on 8 and 9)
 GOST_DESC=		GOST raw keys (new default)
 GOST_ASN1_DESC=		GOST using ASN.1
 PYTHON_DESC=		Build with Python utilities
+START_LATE_DESC=	Start BIND late in the boot process
 
 LINKS_DESC=		Create conf file symlinks in ${PREFIX}
 NEWSTATS_DESC=		Enable alternate xml statistics channel format
 RPZ_NSIP_DESC=		Enable RPZ NSIP trigger rules
 RPZ_NSDNAME_DESC=	Enable RPZ NSDNAME policy records
 RRL_DESC=		Response Rate Limiting
 DLZ_DESC=		Dynamically Loadable Zones
 DLZ_POSTGRESQL_DESC=	DLZ Postgres driver
 DLZ_MYSQL_DESC=		DLZ MySQL driver (no threading)
 DLZ_BDB_DESC=		DLZ BDB driver
 DLZ_LDAP_DESC=		DLZ LDAP driver
 DLZ_FILESYSTEM_DESC=	DLZ filesystem driver
 DLZ_STUB_DESC=		DLZ stub driver
 GSSAPI_BASE_DESC=	Using Heimdal in base
 GSSAPI_HEIMDAL_DESC=	Using security/heimdal
 GSSAPI_MIT_DESC=	Using security/krb5
 GSSAPI_NONE_DESC=	Disable
 
 .if !defined(BIND_TOOLS_SLAVE)
 CONFLICTS+=		bind-tools-9.*
 .endif	# BIND_TOOLS_SLAVE
 
 SSL_CONFIGURE_ON=	--with-openssl=${OPENSSLBASE}
 SSL_USE=		openssl=yes
 SSL_CONFIGURE_OFF=	--disable-openssl-version-check --without-openssl
 
 NEWSTATS_CONFIGURE_ENABLE=	newstats
 
 IDN_USES=		iconv
 IDN_CONFIGURE_ON=	--with-idn=${LOCALBASE} ${ICONV_CONFIGURE_BASE}
 IDN_LIB_DEPENDS=	libidnkit.so:${PORTSDIR}/dns/idnkit
 IDN_CONFIGURE_OFF=	--without-idn
 
 LARGE_FILE_CONFIGURE_ENABLE=	largefile
 
 SIGCHASE_CONFIGURE_ON=	STD_CDEFINES="-DDIG_SIGCHASE=1"
 
 IPV6_CONFIGURE_ENABLE=	ipv6
 
 FILTER_AAAA_CONFIGURE_ENABLE=	filter-aaaa
 
 NATIVE_PKCS11_CONFIGURE_ENABLE=	native-pkcs11
 
 GEOIP_CONFIGURE_WITH=	geoip
 GEOIP_LIB_DEPENDS=	libGeoIP.so:${PORTSDIR}/net/GeoIP
 
 GOST_CONFIGURE_ON=	--with-gost
 GOST_ASN1_CONFIGURE_ON=	--with-gost=asn1
 
 PYTHON_CONFIGURE_WITH=	python
 PYTHON_USES=	python
 
 DLZ_POSTGRESQL_CONFIGURE_ON=	--with-dlz-postgres=yes
 DLZ_POSTGRESQL_USES=		pgsql
 
 FIXED_RRSET_CONFIGURE_ENABLE=	fixed-rrset
 
 RPZ_NSIP_CONFIGURE_ENABLE=	rpz-nsip
 
 RPZ_NSDNAME_CONFIGURE_ENABLE=	rpz-nsdname
 
 RRL_CONFIGURE_ENABLE=	rrl
 
 DLZ_MYSQL_CONFIGURE_ON=	--with-dlz-mysql=yes
 DLZ_MYSQL_USE=		mysql=yes
 
 DLZ_BDB_CONFIGURE_ON=	--with-dlz-bdb=yes
 DLZ_BDB_USE=		bdb=yes
 
 DLZ_LDAP_CONFIGURE_ON=	--with-dlz-ldap=yes
 DLZ_LDAP_USE=		openldap=yes
 
 DLZ_FILESYSTEM_CONFIGURE_ON=	--with-dlz-filesystem=yes
 
 DLZ_STUB_CONFIGURE_ON=	--with-dlz-stub=yes
+
+START_LATE_SUB_LIST=	NAMED_REQUIRE="SERVERS cleanvar" \
+			NAMED_BEFORE="LOGIN"
+START_LATE_SUB_LIST_OFF=NAMED_REQUIRE="NETWORKING ldconfig syslogd" \
+			NAMED_BEFORE="SERVERS"
 
 GSSAPI_BASE_USES=	gssapi
 GSSAPI_BASE_CONFIGURE_ON= \
 	--with-gssapi=${GSSAPIBASEDIR} ${GSSAPI_CONFIGURE_ARGS}
 GSSAPI_HEIMDAL_USES=	gssapi:heimdal
 GSSAPI_HEIMDAL_CONFIGURE_ON= \
 	--with-gssapi=${GSSAPIBASEDIR} ${GSSAPI_CONFIGURE_ARGS}
 GSSAPI_MIT_USES=	gssapi:mit
 GSSAPI_MIT_CONFIGURE_ON= \
 	--with-gssapi=${GSSAPIBASEDIR} ${GSSAPI_CONFIGURE_ARGS}
 GSSAPI_NONE_CONFIGURE_ON=	--without-gssapi
 
 .include <bsd.port.options.mk>
 
 .if !${PORT_OPTIONS:MGOST} && !${PORT_OPTIONS:MGOST_ASN1}
 CONFIGURE_ARGS+=	--without-gost
 .endif
 
 .if !${PORT_OPTIONS:MLINKS}
 PKGINSTALL=${NONEXISTENT}
 .endif
 
 .if ${PORT_OPTIONS:MTHREADS} && !${PORT_OPTIONS:MDLZ_MYSQL}
 CONFIGURE_ARGS+=	--enable-threads
 .else
 CONFIGURE_ARGS+=	--disable-threads
 .endif
 
 .if ${OPSYS} == DragonFly || (${OPSYS} == FreeBSD && ${OSVERSION} >= 1000100)
 PKGINSTALL=	${NONEXISTENT}
 PLIST_SUB+=	NOBASE="" BASE="@comment "
 SUB_LIST+=	NOBASE="" BASE="@comment "
 .if !defined(BIND_TOOLS_SLAVE)
 USE_RC_SUBR+=	named
 SUB_FILES+=	named.conf
 .endif # !defined(BIND_TOOLS_SLAVE)
 .if ${PORT_OPTIONS:MGOST} || ${PORT_OPTIONS:MGOST_ASN1}
 WITH_OPENSSL_PORT=yes
 .endif
 .else
 PLIST_SUB+=	NOBASE="@comment " BASE=""
 SUB_LIST+=	NOBASE="@comment " BASE=""
 .if ${PORT_OPTIONS:MSSL}
 WITH_OPENSSL_PORT=	yes
 .endif
 .endif
 
 PKGDEINSTALL=	${PKGINSTALL}
 
 
 PORTDOCS=	*
 
 .if !defined(BIND_TOOLS_SLAVE)
 post-patch:
 .for FILE in check/named-checkconf.8 named/named.8 nsupdate/nsupdate.1 \
 	rndc/rndc.8
 	@${REINPLACE_CMD} -e 's#/etc/named.conf#${ETCDIR}/named.conf#g' \
 		-e 's#/etc/rndc.conf#${ETCDIR}/rndc.conf#g' \
 		-e "s#/var\/run\/named\/named.pid#/var/run/named/pid#" \
 		${WRKSRC}/bin/${FILE}
 .endfor
 
 post-install:
 .if ${PORT_OPTIONS:MDOCS}
 	${MKDIR} ${STAGEDIR}${DOCSDIR}/arm
 	${INSTALL_DATA} ${WRKSRC}/doc/arm/*.html ${STAGEDIR}${DOCSDIR}/arm
 	${INSTALL_DATA} ${WRKSRC}/doc/arm/Bv9ARM.pdf ${STAGEDIR}${DOCSDIR}
 	${INSTALL_DATA} ${WRKSRC}/CHANGES ${WRKSRC}/COPYRIGHT ${WRKSRC}/FAQ \
 		${WRKSRC}/HISTORY ${WRKSRC}/README ${STAGEDIR}${DOCSDIR}
 .endif
 
 .if ${OPSYS} == DragonFly || (${OPSYS} == FreeBSD && ${OSVERSION} >= 1000100)
 	${MKDIR} ${STAGEDIR}${PREFIX}/etc/mtree
 	${MKDIR} ${STAGEDIR}${ETCDIR}
 .for i in dynamic master slave working
 	@${MKDIR} ${STAGEDIR}${ETCDIR}/$i
 .endfor
 	${INSTALL_DATA} ${WRKDIR}/named.conf ${STAGEDIR}${ETCDIR}/named.conf.sample
 	${INSTALL_DATA} ${FILESDIR}/named.root ${STAGEDIR}${ETCDIR}
 	${INSTALL_DATA} ${FILESDIR}/empty.db ${STAGEDIR}${ETCDIR}/master
 	${INSTALL_DATA} ${FILESDIR}/localhost-forward.db ${STAGEDIR}${ETCDIR}/master
 	${INSTALL_DATA} ${FILESDIR}/localhost-reverse.db ${STAGEDIR}${ETCDIR}/master
 	${INSTALL_DATA} ${FILESDIR}/BIND.chroot.dist ${STAGEDIR}${PREFIX}/etc/mtree
 	${INSTALL_DATA} ${FILESDIR}/BIND.chroot.local.dist ${STAGEDIR}${PREFIX}/etc/mtree
 .endif
 	${INSTALL_DATA} ${WRKSRC}/bin/rndc/rndc.conf \
 		${STAGEDIR}${ETCDIR}/rndc.conf.sample
 
 .endif	# BIND_TOOLS_SLAVE
 
 .include <bsd.port.mk>
Index: head/dns/bind910/files/named.in
===================================================================
--- head/dns/bind910/files/named.in	(revision 388210)
+++ head/dns/bind910/files/named.in	(revision 388211)
@@ -1,401 +1,401 @@
 #!/bin/sh
 #
 # $FreeBSD$
 #
 
 # PROVIDE: named
-# REQUIRE: FILESYSTEMS defaultroute ldconfig
-# BEFORE: NETWORKING
+# REQUIRE: %%NAMED_REQUIRE%%
+# BEFORE: %%NAMED_BEFORE%%
 # KEYWORD: shutdown
 
 #
 # Add the following lines to /etc/rc.conf to enable BIND:
 # named_enable (bool):		    Run named, the DNS server (or NO).
 # named_program (str):		    Path to named, if you want a different one.
 # named_conf (str):		    Path to the configuration file
 # named_flags (str):		    Use this for flags OTHER than -u and -c
 # named_uid (str):		    User to run named as
 # named_chrootdir (str):	    Chroot directory (or "" not to auto-chroot it)
 #				    Historically, was /var/named
 # named_chroot_autoupdate (bool):   Automatically install/update chrooted
 # 				    components of named.
 # named_symlink_enable (bool):	    Symlink the chrooted pid file
 # named_wait (bool):		    Wait for working name service before exiting
 # named_wait_host (str):	    Hostname to check if named_wait is enabled
 # named_auto_forward (str):	    Set up forwarders from /etc/resolv.conf
 # named_auto_forward_only (str):    Do "forward only" instead of "forward first"
 %%NATIVE_PKCS11%%# named_pkcs11_engine (str):	    Path to the PKCS#11 library to use.
 #
 
 . /etc/rc.subr
 
 name=named
 desc="named BIND startup script"
 rcvar=named_enable
 
 load_rc_config ${name}
 
 extra_commands=reload
 
 start_precmd=named_prestart
 start_postcmd=named_poststart
 reload_cmd=named_reload
 stop_cmd=named_stop
 stop_postcmd=named_poststop
 
 named_enable=${named_enable:-"NO"}
 named_program=${named_program:-"%%PREFIX%%/sbin/named"}
 named_conf=${named_conf:-"%%ETCDIR%%/named.conf"}
 named_flags=${named_flags:-""}
 named_uid=${named_uid:-"bind"}
 named_chrootdir=${named_chrootdir:-""}
 named_chroot_autoupdate=${named_chroot_autoupdate:-"YES"}
 named_symlink_enable=${named_symlink_enable:-"YES"}
 named_wait=${named_wait:-"NO"}
 named_wait_host=${named_wait_host:-"localhost"}
 named_auto_forward=${named_auto_forward:-"NO"}
 named_auto_forward_only=${named_auto_forward_only:-"NO"}
 %%NATIVE_PKCS11%%named_pkcs11_engine=${named_pkcs11_engine:-""}
 
 # Not configuration variables but having them here keeps rclint happy
 required_dirs="${named_chrootdir}"
 _named_confdirroot="${named_conf%/*}"
 _named_confdir="${named_chrootdir}${_named_confdirroot}"
 _named_program_root="${named_program%/sbin/named}"
 _openssl_engines="%%LOCALBASE%%/lib/engines"
 
 # Needed if named.conf and rndc.conf are moved or if rndc.conf is used
 rndc_conf=${rndc_conf:-"$_named_confdir/rndc.conf"}
 rndc_key=${rndc_key:-"$_named_confdir/rndc.key"}
 
 # If running in a chroot cage, ensure that the appropriate files
 # exist inside the cage, as well as helper symlinks into the cage
 # from outside.
 #
 # As this is called after the is_running and required_dir checks
 # are made in run_rc_command(), we can safely assume ${named_chrootdir}
 # exists and named isn't running at this point (unless forcestart
 # is used).
 #
 chroot_autoupdate()
 {
 	local file
 
 	# If it's the first time around, fiddle with things and move the
 	# current configuration to the chroot.
 	if [ -d ${_named_confdirroot} -a ! -d ${_named_confdir} ]; then
 		warn "named chroot: Moving current configuration in the chroot!"
 		install -d ${_named_confdir%/*}
 		mv ${_named_confdirroot} ${_named_confdir}
 	fi
 
 	# Create (or update) the chroot directory structure
 	#
 	if [ -r %%PREFIX%%/etc/mtree/BIND.chroot.dist ]; then
 		mtree -deU -f %%PREFIX%%/etc/mtree/BIND.chroot.dist \
 		    -p ${named_chrootdir}
 	else
 		warn "%%PREFIX%%/etc/mtree/BIND.chroot.dist missing,"
 		warn "${named_chrootdir} directory structure not updated"
 	fi
 	if [ -r %%PREFIX%%/etc/mtree/BIND.chroot.local.dist ]; then
 		mkdir -p ${named_chrootdir}%%PREFIX%%
 		mtree -deU -f %%PREFIX%%/etc/mtree/BIND.chroot.local.dist \
 		    -p ${named_chrootdir}%%PREFIX%%
 	else
 		warn "%%PREFIX%%/etc/mtree/BIND.chroot.local.dist missing,"
 		warn "${named_chrootdir}%%PREFIX%% directory structure not updated"
 	fi
 
 	# Create (or update) the configuration directory symlink
 	#
 	if [ ! -L "${_named_confdirroot}" ]; then
 		if [ -d "${_named_confdirroot}" ]; then
 			warn "named chroot: ${_named_confdirroot} is a directory!"
 		elif [ -e "${_named_confdirroot}" ]; then
 			warn "named chroot: ${_named_confdirroot} exists!"
 		else
 			ln -s ${_named_confdir} ${_named_confdirroot}
 		fi
 	else
 		# Make sure it points to the right place.
 		ln -shf ${_named_confdir} ${_named_confdirroot}
 	fi
 
 	# Mount a devfs in the chroot directory if needed
 	#
 	if [ `${SYSCTL_N} security.jail.jailed` -eq 0 ]; then
 		umount ${named_chrootdir}/dev 2>/dev/null
 		devfs_domount ${named_chrootdir}/dev devfsrules_hide_all
 		devfs -m ${named_chrootdir}/dev rule apply path null unhide
 		devfs -m ${named_chrootdir}/dev rule apply path random unhide
 	else
 		if [ -c ${named_chrootdir}/dev/null -a \
 		    -c ${named_chrootdir}/dev/random ]; then
 			info "named chroot: using pre-mounted devfs."
 		else
 			err 1 "named chroot: devfs cannot be mounted from " \
 				"within a jail. Thus a chrooted named cannot " \
 				"be run from within a jail.  Either mount the " \
 				"devfs with null and random from the host, or " \
 				"run named without chrooting it, set " \
 				"named_chrootdir=\"\" in /etc/rc.conf."
 		fi
 	fi
 
 	# If OpenSSL from ports, then the engines should be present in the
 	# chroot, named loads them after chrooting.
 	if [ -d ${_openssl_engines} ]; then
 		# FIXME when 8.4 is gone see if
 		# security.jail.param.allow.mount.nullfs can be used.
 		if [ `${SYSCTL_N} security.jail.jailed` -eq 0 -o `${SYSCTL_N} security.jail.mount_allowed` -eq 1 ]; then
 			mkdir -p ${named_chrootdir}${_openssl_engines}
 			mount -t nullfs ${_openssl_engines} ${named_chrootdir}${_openssl_engines}
 		else
 			warn "named chroot: cannot nullfs mount OpenSSL" \
 				"engines into the chroot, will copy the shared" \
 				"libraries instead."
 			mkdir -p ${named_chrootdir}${_openssl_engines}
 			cp -f ${_openssl_engines}/*.so ${named_chrootdir}${_openssl_engines}
 		fi
 	fi
 
 	# Copy and/or update key files to the chroot /etc
 	#
 	for file in localtime protocols services; do
 		if [ -r /etc/${file} ] && \
 			! cmp -s /etc/${file} "${named_chrootdir}/etc/${file}"; then
 			cp -p /etc/${file} "${named_chrootdir}/etc/${file}"
 		fi
 	done
 }
 
 # Make symlinks to the correct pid file
 #
 make_symlinks()
 {
 	checkyesno named_symlink_enable &&
 	    ln -fs "${named_chrootdir}${pidfile}" ${pidfile}
 }
 
 named_poststart()
 {
 	make_symlinks
 
 	if checkyesno named_wait; then
 		until ${_named_program_root}/bin/host ${named_wait_host} >/dev/null 2>&1; do
 			echo "	Waiting for nameserver to resolve ${named_wait_host}"
 			sleep 1
 		done
 	fi
 }
 
 named_reload()
 {
 	# This is a one line function, but ${named_program} is not defined early
 	# enough to be there when the reload_cmd variable is defined up there.
 	${_named_program_root}/sbin/rndc ${rndc_flags} reload
 }
 
 find_pidfile()
 {
 	if get_pidfile_from_conf pid-file ${named_conf}; then
 		pidfile="${_pidfile_from_conf}"
 	else
 		pidfile="/var/run/named/pid"
 	fi
 }
 
 named_stop()
 {
 	find_pidfile
 
 	# This duplicates an undesirably large amount of code from the stop
 	# routine in rc.subr in order to use rndc to shut down the process,
 	# and to give it a second chance in case rndc fails.
 	rc_pid=$(check_pidfile ${pidfile} ${command})
 	if [ -z "${rc_pid}" ]; then
 		[ -n "${rc_fast}" ] && return 0
 		_run_rc_notrunning
 		return 1
 	fi
 	echo 'Stopping named.'
 	if ${_named_program_root}/sbin/rndc ${rndc_flags} stop 2>/dev/null; then
 		wait_for_pids ${rc_pid}
 	else
 		echo -n 'rndc failed, trying kill: '
 		kill -TERM ${rc_pid}
 		wait_for_pids ${rc_pid}
 	fi
 }
 
 named_poststop()
 {
 	if [ -n "${named_chrootdir}" -a -c ${named_chrootdir}/dev/null ]; then
 		# unmount OpenSSL engines, if they were not mounted but only
 		# copied, do nothing.
 		if [ `${SYSCTL_N} security.jail.jailed` -eq 0 -o `${SYSCTL_N} security.jail.mount_allowed` -eq 1 ]; then
 			umount ${named_chrootdir}${_openssl_engines}
 		fi
 		# unmount /dev
 		if [ `${SYSCTL_N} security.jail.jailed` -eq 0 ]; then
 			umount ${named_chrootdir}/dev 2>/dev/null || true
 		else
 			warn "named chroot:" \
 			    "cannot unmount devfs from inside jail!"
 		fi
 	fi
 }
 
 create_file()
 {
 	if [ -e "$1" ]; then
 		unlink $1
 	fi
 	install -o root -g wheel -m 0644 /dev/null $1
 }
 
 named_prestart()
 {
 	find_pidfile
 
 	if [ -n "${named_pidfile}" ]; then
 		warn 'named_pidfile: now determined from the conf file'
 	fi
 
 	piddir=`/usr/bin/dirname ${pidfile}`
 	if [ ! -d ${piddir} ]; then
 		install -d -o ${named_uid} -g ${named_uid} ${piddir}
 	fi
 
 	command_args="-u ${named_uid:=root} -c ${named_conf} ${command_args}"
 
 	if [ -z "${rndc_flags}" ]; then
 		if [ -s ${rndc_conf} ] ; then
 			rndc_flags="-c ${rndc_conf}"
 		elif [ -s ${rndc_key} ] ; then
 			rndc_flags="-k ${rndc_key}"
 		else
 			rndc_flags=""
 		fi
 	fi
 
 %%NATIVE_PKCS11%%	if [ -z "${named_pkcs11_engine}"]; then
 %%NATIVE_PKCS11%%		err 3 "named_pkcs11_engine has to be set to the PKCS#11 engine's library you want to use"
 %%NATIVE_PKCS11%%	elif [ ! -f ${named_pkcs11_engine} ]; then
 %%NATIVE_PKCS11%%		err 3 "named_pkcs11_engine the PKCS#11 engine's library you want to use doesn't exist"
 %%NATIVE_PKCS11%%	else
 %%NATIVE_PKCS11%%		mkdir -p ${named_chrootdir}${named_pkcs11_engine%/*}
 %%NATIVE_PKCS11%%		cp -p ${named_pkcs11_engine} ${named_chrootdir}${named_pkcs11_engine}
 %%NATIVE_PKCS11%%		command_args="-E ${named_pkcs11_engine} ${command_args}"
 %%NATIVE_PKCS11%%	fi
 
 	local line nsip firstns
 
 	# Is the user using a sandbox?
 	#
 	if [ -n "${named_chrootdir}" ]; then
 		rc_flags="${rc_flags} -t ${named_chrootdir}"
 		checkyesno named_chroot_autoupdate && chroot_autoupdate
 	else
 		named_symlink_enable=NO
 	fi
 
 	# Create an rndc.key file for the user if none exists
 	#
 	confgen_command="${_named_program_root}/sbin/rndc-confgen -a -b256 -u ${named_uid} \
 	    -c ${_named_confdir}/rndc.key"
 	if [ -s "${_named_confdir}/rndc.conf" ]; then
 		unset confgen_command
 	fi
 	if [ -s "${_named_confdir}/rndc.key" ]; then
 		case `stat -f%Su ${_named_confdir}/rndc.key` in
 		root|${named_uid}) ;;
 		*) ${confgen_command} ;;
 		esac
 	else
 		${confgen_command}
 	fi
 
 	local checkconf
 
 	checkconf="${_named_program_root}/sbin/named-checkconf"
 	if ! checkyesno named_chroot_autoupdate && [ -n "${named_chrootdir}" ]; then
 		checkconf="${checkconf} -t ${named_chrootdir}"
 	fi
 
 	# Create a forwarder configuration based on /etc/resolv.conf
 	if checkyesno named_auto_forward; then
 		if [ ! -s /etc/resolv.conf ]; then
 			warn "named_auto_forward enabled, but no /etc/resolv.conf"
 
 			# Empty the file in case it is included in named.conf
 			[ -s "${_named_confdir}/auto_forward.conf" ] &&
 			    create_file ${_named_confdir}/auto_forward.conf
 
 			${checkconf} ${named_conf} ||
 			    err 3 'named-checkconf for ${named_conf} failed'
 			return
 		fi
 
 		create_file /var/run/naf-resolv.conf
 		create_file /var/run/auto_forward.conf
 
 		echo '	forwarders {' > /var/run/auto_forward.conf
 
 		while read line; do
 			case "${line}" in
 			'nameserver '*|'nameserver	'*)
 				nsip=${line##nameserver[         ]}
 
 				if [ -z "${firstns}" ]; then
 					if [ ! "${nsip}" = '127.0.0.1' ]; then
 						echo 'nameserver 127.0.0.1'
 						echo "		${nsip};" >> /var/run/auto_forward.conf
 					fi
 
 					firstns=1
 				else
 					[ "${nsip}" = '127.0.0.1' ] && continue
 					echo "		${nsip};" >> /var/run/auto_forward.conf
 				fi
 				;;
 			esac
 
 			echo ${line}
 		done < /etc/resolv.conf > /var/run/naf-resolv.conf
 
 		echo '	};' >> /var/run/auto_forward.conf
 		echo '' >> /var/run/auto_forward.conf
 		if checkyesno named_auto_forward_only; then
 			echo "	forward only;" >> /var/run/auto_forward.conf
 		else
 			echo "	forward first;" >> /var/run/auto_forward.conf
 		fi
 
 		if cmp -s /etc/resolv.conf /var/run/naf-resolv.conf; then
 			unlink /var/run/naf-resolv.conf
 		else
 			[ -e /etc/resolv.conf ] && unlink /etc/resolv.conf
 			mv /var/run/naf-resolv.conf /etc/resolv.conf
 		fi
 
 		if cmp -s ${_named_confdir}/auto_forward.conf \
 		    /var/run/auto_forward.conf; then
 			unlink /var/run/auto_forward.conf
 		else
 			[ -e "${_named_confdir}/auto_forward.conf" ] &&
 			    unlink ${_named_confdir}/auto_forward.conf
 			mv /var/run/auto_forward.conf \
 			    ${_named_confdir}/auto_forward.conf
 		fi
 	else
 		# Empty the file in case it is included in named.conf
 		[ -s "${_named_confdir}/auto_forward.conf" ] &&
 		    create_file ${_named_confdir}/auto_forward.conf
 	fi
 
 	${checkconf} ${named_conf} || err 3 "named-checkconf for ${named_conf} failed"
 }
 
 run_rc_command "$1"
Index: head/dns/bind910/pkg-help
===================================================================
--- head/dns/bind910/pkg-help	(revision 388210)
+++ head/dns/bind910/pkg-help	(revision 388211)
@@ -1,24 +1,30 @@
                        NATIVE_PKCS11
 When using the NATIVE_PKCS11 option, BIND will use the PKCS#11
 engine specified by the named_pkcss11_engine variable in
 /etc/rc.conf for *all* crypto operations.
 
 This is primarily intended to be used in an authoritative
 case.
 
 If BIND is also operating as a validating resolver,
 NATIVE_PKCS11 should not be used, because the HSM will be
 used for all crypto, including DNSSEC validations, and the
 HSM is likely to be slower than the CPU for this purpose.
 Additionally, the HSM might not support all of the PKCS#11
 API functions needed for signature verification.
 
 
                             GOST
 If using a chrooted instance of BIND on FreeBSD 8.x and 9.x,
 the OpenSSL engines MUST be accessible from within the chroot.
 If BIND is chrooted in /var/named, this can be achieved by
 either copying content of /usr/local/lib/engines into
 /var/named/usr/local/lib/engines, or by creating that directory
 and adding this line to /etc/fstab:
 /usr/local/lib/engines  /var/named/usr/local/lib/engines nullfs ro 0 0
+
+
+                         START_LATE
+Most of the time, BIND needs to start early in the boot
+process.  Enable this if BIND starts too early for you and
+you need it to start later.
Index: head/dns/bind99/Makefile
===================================================================
--- head/dns/bind99/Makefile	(revision 388210)
+++ head/dns/bind99/Makefile	(revision 388211)
@@ -1,220 +1,226 @@
 # $FreeBSD$
 # pkg-help formatted with fmt 59 63
 
 PORTNAME=	bind
 PORTVERSION=	${ISCVERSION:S/-P/P/}
-PORTREVISION=	3
+PORTREVISION=	4
 CATEGORIES=	dns net ipv6
 MASTER_SITES=	ISC/bind9/${ISCVERSION}
 PKGNAMESUFFIX=	99
 DISTNAME=	${PORTNAME}-${ISCVERSION}
 
 MAINTAINER=	mat@FreeBSD.org
 COMMENT=	BIND DNS suite with updated DNSSEC and DNS64
 
 LICENSE=	ISCL
 
 # ISC releases things like 9.8.0-P1, which our versioning doesn't like
 ISCVERSION=	9.9.7
 
 MAKE_JOBS_UNSAFE=	yes
 
 USES=	cpe
 
 CPE_VENDOR=	isc
 CPE_VERSION=	${ISCVERSION:C/-.*//}
 .if ${ISCVERSION:M*-*}
 CPE_UPDATE=	${ISCVERSION:C/.*-//:tl}
 .endif
 
 LIB_DEPENDS=	libxml2.so:${PORTSDIR}/textproc/libxml2
 
 GNU_CONFIGURE=	yes
 CONFIGURE_ARGS=	--localstatedir=/var --disable-linux-caps \
 		--disable-symtable \
 		--with-randomdev=/dev/random \
 		--with-libxml2=${LOCALBASE} \
 		--sysconfdir=${ETCDIR}
 ETCDIR=		${PREFIX}/etc/namedb
 
 CONFLICTS=	bind9*-9.[45678].* bind9*-sdb-9.[45678].* bind-tools-9.*
 
 SUB_FILES=	pkg-message
 
 OPTIONS_DEFAULT=	IPV6 SSL THREADS SIGCHASE IDN GSSAPI_NONE RRL
 OPTIONS_DEFINE=		SSL IDN REPLACE_BASE LARGE_FILE FIXED_RRSET SIGCHASE \
-			IPV6 THREADS FILTER_AAAA GOST PYTHON \
+			IPV6 THREADS FILTER_AAAA GOST PYTHON START_LATE \
 			LINKS RPZ_NSIP RPZ_NSDNAME RRL DOCS RPZ_PATCH NEWSTATS
 OPTIONS_GROUP=		DLZ
 OPTIONS_GROUP_DLZ=	DLZ_POSTGRESQL DLZ_MYSQL DLZ_BDB \
 			DLZ_LDAP DLZ_FILESYSTEM DLZ_STUB
 OPTIONS_SINGLE=		GSSAPI
 OPTIONS_SINGLE_GSSAPI=	GSSAPI_BASE GSSAPI_HEIMDAL GSSAPI_MIT GSSAPI_NONE
 
 OPTIONS_SUB=	yes
 
 SSL_DESC=		Build with OpenSSL (Required for DNSSEC)
 REPLACE_BASE_DESC=	EOL, no longer supported
 LARGE_FILE_DESC=	64-bit file support
 FIXED_RRSET_DESC=	Enable fixed rrset ordering
 SIGCHASE_DESC=		dig/host/nslookup will do DNSSEC validation
 FILTER_AAAA_DESC=	Enable filtering of AAAA records
 GOST_DESC=		Enable GOST ciphers, needs SSL (see help on 8 and 9)
 PYTHON_DESC=		Build with Python utilities
+START_LATE_DESC=	Start BIND late in the boot process
 
 LINKS_DESC=		Create conf file symlinks in ${PREFIX}
 NEWSTATS_DESC=		Enable alternate xml statistics channel format
 RPZ_NSIP_DESC=		Enable RPZ NSIP trigger rules
 RPZ_NSDNAME_DESC=	Enable RPZ NSDNAME policy records
 RPZ_PATCH_DESC=		RPZ improvements
 RRL_DESC=		Response Rate Limiting
 DLZ_DESC=		Dynamically Loadable Zones
 DLZ_POSTGRESQL_DESC=	DLZ Postgres driver
 DLZ_MYSQL_DESC=		DLZ MySQL driver (no threading)
 DLZ_BDB_DESC=		DLZ BDB driver
 DLZ_LDAP_DESC=		DLZ LDAP driver
 DLZ_FILESYSTEM_DESC=	DLZ filesystem driver
 DLZ_STUB_DESC=		DLZ stub driver
 GSSAPI_BASE_DESC=	${GSSAPI_DESC} (Heimdal in base)
 GSSAPI_HEIMDAL_DESC=	${GSSAPI_DESC} (security/heimdal)
 GSSAPI_MIT_DESC=	${GSSAPI_DESC} (security/krb5)
 GSSAPI_NONE_DESC=	No ${GSSAPI_DESC}
 
 SSL_CONFIGURE_ON=	--with-openssl=${OPENSSLBASE}
 SSL_USE=		openssl=yes
 SSL_CONFIGURE_OFF=	--disable-openssl-version-check --without-openssl
 
 NEWSTATS_CONFIGURE_ENABLE=	newstats
 
 IDN_USES=		iconv
 IDN_CONFIGURE_ON=	--with-idn=${LOCALBASE} ${ICONV_CONFIGURE_BASE}
 IDN_LIB_DEPENDS=	libidnkit.so:${PORTSDIR}/dns/idnkit
 IDN_CONFIGURE_OFF=	--without-idn
 
 LARGE_FILE_CONFIGURE_ENABLE=	largefile
 
 SIGCHASE_CONFIGURE_ON=	STD_CDEFINES="-DDIG_SIGCHASE=1"
 
 IPV6_CONFIGURE_ENABLE=	ipv6
 
 FILTER_AAAA_CONFIGURE_ENABLE=	filter-aaaa
 
 GOST_CONFIGURE_WITH=	gost
 
 PYTHON_CONFIGURE_WITH=	python
 PYTHON_USES=	python
 
 DLZ_POSTGRESQL_CONFIGURE_ON=	--with-dlz-postgres=yes
 DLZ_POSTGRESQL_USES=		pgsql
 
 FIXED_RRSET_CONFIGURE_ENABLE=	fixed-rrset
 
 RPZ_NSIP_CONFIGURE_ENABLE=	rpz-nsip
 
 RPZ_NSDNAME_CONFIGURE_ENABLE=	rpz-nsdname
 
 RPZ_PATCH_PATCHFILES=	${ISCVERSION}-rpz2+rl.14038.05.patch.xz:vix
 RPZ_PATCH_PATCH_SITES=	http://ss.vix.su/~vjs/:vix LOCAL/mat/bind:vix
 
 RRL_CONFIGURE_ENABLE=	rrl
 
 DLZ_MYSQL_CONFIGURE_ON=	--with-dlz-mysql=yes
 DLZ_MYSQL_USE=		mysql=yes
 
 DLZ_BDB_CONFIGURE_ON=	--with-dlz-bdb=yes
 DLZ_BDB_USE=		bdb=yes
 
 DLZ_LDAP_CONFIGURE_ON=	--with-dlz-ldap=yes
 DLZ_LDAP_USE=		openldap=yes
 
 DLZ_FILESYSTEM_CONFIGURE_ON=	--with-dlz-filesystem=yes
 
 DLZ_STUB_CONFIGURE_ON=	--with-dlz-stub=yes
+
+START_LATE_SUB_LIST=	NAMED_REQUIRE="SERVERS cleanvar" \
+			NAMED_BEFORE="LOGIN"
+START_LATE_SUB_LIST_OFF=NAMED_REQUIRE="NETWORKING ldconfig syslogd" \
+			NAMED_BEFORE="SERVERS"
 
 GSSAPI_BASE_USES=	gssapi
 GSSAPI_BASE_CONFIGURE_ON= \
 	--with-gssapi=${GSSAPIBASEDIR} ${GSSAPI_CONFIGURE_ARGS}
 GSSAPI_HEIMDAL_USES=	gssapi:heimdal
 GSSAPI_HEIMDAL_CONFIGURE_ON= \
 	--with-gssapi=${GSSAPIBASEDIR} ${GSSAPI_CONFIGURE_ARGS}
 GSSAPI_MIT_USES=	gssapi:mit
 GSSAPI_MIT_CONFIGURE_ON= \
 	--with-gssapi=${GSSAPIBASEDIR} ${GSSAPI_CONFIGURE_ARGS}
 GSSAPI_NONE_CONFIGURE_ON=	--without-gssapi
 
 .include <bsd.port.options.mk>
 
 .if !${PORT_OPTIONS:MLINKS}
 PKGINSTALL=${NONEXISTENT}
 .endif
 
 .if ${PORT_OPTIONS:MTHREADS} && !${PORT_OPTIONS:MDLZ_MYSQL}
 CONFIGURE_ARGS+=	--enable-threads
 .else
 CONFIGURE_ARGS+=	--disable-threads
 .endif
 
 .if ${PORT_OPTIONS:MREPLACE_BASE}
 IGNORE=		REPLACE_BASE is no longer supported
 .endif # REPLACE_BASE
 
 .if ${OPSYS} == DragonFly || (${OPSYS} == FreeBSD && ${OSVERSION} >= 1000100)
 PKGINSTALL=	${NONEXISTENT}
 PLIST_SUB+=	NOBASE="" BASE="@comment "
 SUB_LIST+=	NOBASE="" BASE="@comment "
 USE_RC_SUBR+=	named
 SUB_FILES+=	named.conf
 .if ${PORT_OPTIONS:MGOST}
 WITH_OPENSSL_PORT=yes
 .endif
 .else
 PLIST_SUB+=	NOBASE="@comment " BASE=""
 SUB_LIST+=	NOBASE="@comment " BASE=""
 .if ${PORT_OPTIONS:MSSL}
 WITH_OPENSSL_PORT=	yes
 .endif
 .endif
 
 PKGDEINSTALL=	${PKGINSTALL}
 
 PORTDOCS=	*
 
 post-patch:
 .for FILE in check/named-checkconf.8 named/named.8 nsupdate/nsupdate.1 \
 	rndc/rndc.8
 	@${REINPLACE_CMD} -e 's#/etc/named.conf#${ETCDIR}/named.conf#g' \
 		-e 's#/etc/rndc.conf#${ETCDIR}/rndc.conf#g' \
 		-e "s#/var\/run\/named\/named.pid#/var/run/named/pid#" \
 		${WRKSRC}/bin/${FILE}
 .endfor
 
 post-configure:
 	@${REINPLACE_CMD} -e '/^SO_LDFLAGS/s/-Wl,-rpath,/-rpath /' ${WRKSRC}/bin/tests/system/dlzexternal/Makefile
 
 post-install:
 .if ${PORT_OPTIONS:MDOCS}
 	${MKDIR} ${STAGEDIR}${DOCSDIR}/arm
 	${INSTALL_DATA} ${WRKSRC}/doc/arm/*.html ${STAGEDIR}${DOCSDIR}/arm
 	${INSTALL_DATA} ${WRKSRC}/doc/arm/Bv9ARM.pdf ${STAGEDIR}${DOCSDIR}
 	${INSTALL_DATA} ${WRKSRC}/CHANGES ${WRKSRC}/COPYRIGHT ${WRKSRC}/FAQ \
 		${WRKSRC}/HISTORY ${WRKSRC}/README ${STAGEDIR}${DOCSDIR}
 .endif
 
 .if ${OPSYS} == DragonFly || (${OPSYS} == FreeBSD && ${OSVERSION} >= 1000100)
 	${MKDIR} ${STAGEDIR}${PREFIX}/etc/mtree
 	${MKDIR} ${STAGEDIR}${ETCDIR}
 .for i in dynamic master slave working
 	@${MKDIR} ${STAGEDIR}${ETCDIR}/$i
 .endfor
 	${INSTALL_DATA} ${WRKDIR}/named.conf ${STAGEDIR}${ETCDIR}/named.conf.sample
 	${INSTALL_DATA} ${FILESDIR}/named.root ${STAGEDIR}${ETCDIR}
 	${INSTALL_DATA} ${FILESDIR}/empty.db ${STAGEDIR}${ETCDIR}/master
 	${INSTALL_DATA} ${FILESDIR}/localhost-forward.db ${STAGEDIR}${ETCDIR}/master
 	${INSTALL_DATA} ${FILESDIR}/localhost-reverse.db ${STAGEDIR}${ETCDIR}/master
 	${INSTALL_DATA} ${FILESDIR}/BIND.chroot.dist ${STAGEDIR}${PREFIX}/etc/mtree
 	${INSTALL_DATA} ${FILESDIR}/BIND.chroot.local.dist ${STAGEDIR}${PREFIX}/etc/mtree
 .endif
 	${INSTALL_DATA} ${WRKSRC}/bin/rndc/rndc.conf \
 		${STAGEDIR}${ETCDIR}/rndc.conf.sample
 
 .include <bsd.port.mk>
Index: head/dns/bind99/files/named.in
===================================================================
--- head/dns/bind99/files/named.in	(revision 388210)
+++ head/dns/bind99/files/named.in	(revision 388211)
@@ -1,389 +1,389 @@
 #!/bin/sh
 #
 # $FreeBSD$
 #
 
 # PROVIDE: named
-# REQUIRE: FILESYSTEMS defaultroute ldconfig
-# BEFORE: NETWORKING
+# REQUIRE: %%NAMED_REQUIRE%%
+# BEFORE: %%NAMED_BEFORE%%
 # KEYWORD: shutdown
 
 #
 # Add the following lines to /etc/rc.conf to enable BIND:
 # named_enable (bool):		    Run named, the DNS server (or NO).
 # named_program (str):		    Path to named, if you want a different one.
 # named_conf (str):		    Path to the configuration file
 # named_flags (str):		    Use this for flags OTHER than -u and -c
 # named_uid (str):		    User to run named as
 # named_chrootdir (str):	    Chroot directory (or "" not to auto-chroot it)
 #				    Historically, was /var/named
 # named_chroot_autoupdate (bool):   Automatically install/update chrooted
 # 				    components of named.
 # named_symlink_enable (bool):	    Symlink the chrooted pid file
 # named_wait (bool):		    Wait for working name service before exiting
 # named_wait_host (str):	    Hostname to check if named_wait is enabled
 # named_auto_forward (str):	    Set up forwarders from /etc/resolv.conf
 # named_auto_forward_only (str):    Do "forward only" instead of "forward first"
 #
 
 . /etc/rc.subr
 
 name=named
 desc="named BIND startup script"
 rcvar=named_enable
 
 load_rc_config ${name}
 
 extra_commands=reload
 
 start_precmd=named_prestart
 start_postcmd=named_poststart
 reload_cmd=named_reload
 stop_cmd=named_stop
 stop_postcmd=named_poststop
 
 named_enable=${named_enable:-"NO"}
 named_program=${named_program:-"%%PREFIX%%/sbin/named"}
 named_conf=${named_conf:-"%%ETCDIR%%/named.conf"}
 named_flags=${named_flags:-""}
 named_uid=${named_uid:-"bind"}
 named_chrootdir=${named_chrootdir:-""}
 named_chroot_autoupdate=${named_chroot_autoupdate:-"YES"}
 named_symlink_enable=${named_symlink_enable:-"YES"}
 named_wait=${named_wait:-"NO"}
 named_wait_host=${named_wait_host:-"localhost"}
 named_auto_forward=${named_auto_forward:-"NO"}
 named_auto_forward_only=${named_auto_forward_only:-"NO"}
 
 # Not configuration variables but having them here keeps rclint happy
 required_dirs="${named_chrootdir}"
 _named_confdirroot="${named_conf%/*}"
 _named_confdir="${named_chrootdir}${_named_confdirroot}"
 _named_program_root="${named_program%/sbin/named}"
 _openssl_engines="%%LOCALBASE%%/lib/engines"
 
 # Needed if named.conf and rndc.conf are moved or if rndc.conf is used
 rndc_conf=${rndc_conf:-"$_named_confdir/rndc.conf"}
 rndc_key=${rndc_key:-"$_named_confdir/rndc.key"}
 
 # If running in a chroot cage, ensure that the appropriate files
 # exist inside the cage, as well as helper symlinks into the cage
 # from outside.
 #
 # As this is called after the is_running and required_dir checks
 # are made in run_rc_command(), we can safely assume ${named_chrootdir}
 # exists and named isn't running at this point (unless forcestart
 # is used).
 #
 chroot_autoupdate()
 {
 	local file
 
 	# If it's the first time around, fiddle with things and move the
 	# current configuration to the chroot.
 	if [ -d ${_named_confdirroot} -a ! -d ${_named_confdir} ]; then
 		warn "named chroot: Moving current configuration in the chroot!"
 		install -d ${_named_confdir%/*}
 		mv ${_named_confdirroot} ${_named_confdir}
 	fi
 
 	# Create (or update) the chroot directory structure
 	#
 	if [ -r %%PREFIX%%/etc/mtree/BIND.chroot.dist ]; then
 		mtree -deU -f %%PREFIX%%/etc/mtree/BIND.chroot.dist \
 		    -p ${named_chrootdir}
 	else
 		warn "%%PREFIX%%/etc/mtree/BIND.chroot.dist missing,"
 		warn "${named_chrootdir} directory structure not updated"
 	fi
 	if [ -r %%PREFIX%%/etc/mtree/BIND.chroot.local.dist ]; then
 		mkdir -p ${named_chrootdir}%%PREFIX%%
 		mtree -deU -f %%PREFIX%%/etc/mtree/BIND.chroot.local.dist \
 		    -p ${named_chrootdir}%%PREFIX%%
 	else
 		warn "%%PREFIX%%/etc/mtree/BIND.chroot.local.dist missing,"
 		warn "${named_chrootdir}%%PREFIX%% directory structure not updated"
 	fi
 
 	# Create (or update) the configuration directory symlink
 	#
 	if [ ! -L "${_named_confdirroot}" ]; then
 		if [ -d "${_named_confdirroot}" ]; then
 			warn "named chroot: ${_named_confdirroot} is a directory!"
 		elif [ -e "${_named_confdirroot}" ]; then
 			warn "named chroot: ${_named_confdirroot} exists!"
 		else
 			ln -s ${_named_confdir} ${_named_confdirroot}
 		fi
 	else
 		# Make sure it points to the right place.
 		ln -shf ${_named_confdir} ${_named_confdirroot}
 	fi
 
 	# Mount a devfs in the chroot directory if needed
 	#
 	if [ `${SYSCTL_N} security.jail.jailed` -eq 0 ]; then
 		umount ${named_chrootdir}/dev 2>/dev/null
 		devfs_domount ${named_chrootdir}/dev devfsrules_hide_all
 		devfs -m ${named_chrootdir}/dev rule apply path null unhide
 		devfs -m ${named_chrootdir}/dev rule apply path random unhide
 	else
 		if [ -c ${named_chrootdir}/dev/null -a \
 		    -c ${named_chrootdir}/dev/random ]; then
 			info "named chroot: using pre-mounted devfs."
 		else
 			err 1 "named chroot: devfs cannot be mounted from " \
 				"within a jail. Thus a chrooted named cannot " \
 				"be run from within a jail.  Either mount the " \
 				"devfs with null and random from the host, or " \
 				"run named without chrooting it, set " \
 				"named_chrootdir=\"\" in /etc/rc.conf."
 		fi
 	fi
 
 	# If OpenSSL from ports, then the engines should be present in the
 	# chroot, named loads them after chrooting.
 	if [ -d ${_openssl_engines} ]; then
 		# FIXME when 8.4 is gone see if
 		# security.jail.param.allow.mount.nullfs can be used.
 		if [ `${SYSCTL_N} security.jail.jailed` -eq 0 -o `${SYSCTL_N} security.jail.mount_allowed` -eq 1 ]; then
 			mkdir -p ${named_chrootdir}${_openssl_engines}
 			mount -t nullfs ${_openssl_engines} ${named_chrootdir}${_openssl_engines}
 		else
 			warn "named chroot: cannot nullfs mount OpenSSL" \
 				"engines into the chroot, will copy the shared" \
 				"libraries instead."
 			mkdir -p ${named_chrootdir}${_openssl_engines}
 			cp -f ${_openssl_engines}/*.so ${named_chrootdir}${_openssl_engines}
 		fi
 	fi
 
 	# Copy and/or update key files to the chroot /etc
 	#
 	for file in localtime protocols services; do
 		if [ -r /etc/${file} ] && \
 			! cmp -s /etc/${file} "${named_chrootdir}/etc/${file}"; then
 			cp -p /etc/${file} "${named_chrootdir}/etc/${file}"
 		fi
 	done
 }
 
 # Make symlinks to the correct pid file
 #
 make_symlinks()
 {
 	checkyesno named_symlink_enable &&
 	    ln -fs "${named_chrootdir}${pidfile}" ${pidfile}
 }
 
 named_poststart()
 {
 	make_symlinks
 
 	if checkyesno named_wait; then
 		until ${_named_program_root}/bin/host ${named_wait_host} >/dev/null 2>&1; do
 			echo "	Waiting for nameserver to resolve ${named_wait_host}"
 			sleep 1
 		done
 	fi
 }
 
 named_reload()
 {
 	# This is a one line function, but ${named_program} is not defined early
 	# enough to be there when the reload_cmd variable is defined up there.
 	${_named_program_root}/sbin/rndc ${rndc_flags} reload
 }
 
 find_pidfile()
 {
 	if get_pidfile_from_conf pid-file ${named_conf}; then
 		pidfile="${_pidfile_from_conf}"
 	else
 		pidfile="/var/run/named/pid"
 	fi
 }
 
 named_stop()
 {
 	find_pidfile
 
 	# This duplicates an undesirably large amount of code from the stop
 	# routine in rc.subr in order to use rndc to shut down the process,
 	# and to give it a second chance in case rndc fails.
 	rc_pid=$(check_pidfile ${pidfile} ${command})
 	if [ -z "${rc_pid}" ]; then
 		[ -n "${rc_fast}" ] && return 0
 		_run_rc_notrunning
 		return 1
 	fi
 	echo 'Stopping named.'
 	if ${_named_program_root}/sbin/rndc ${rndc_flags} stop 2>/dev/null; then
 		wait_for_pids ${rc_pid}
 	else
 		echo -n 'rndc failed, trying kill: '
 		kill -TERM ${rc_pid}
 		wait_for_pids ${rc_pid}
 	fi
 }
 
 named_poststop()
 {
 	if [ -n "${named_chrootdir}" -a -c ${named_chrootdir}/dev/null ]; then
 		# unmount OpenSSL engines, if they were not mounted but only
 		# copied, do nothing.
 		if [ `${SYSCTL_N} security.jail.jailed` -eq 0 -o `${SYSCTL_N} security.jail.mount_allowed` -eq 1 ]; then
 			umount ${named_chrootdir}${_openssl_engines}
 		fi
 		# unmount /dev
 		if [ `${SYSCTL_N} security.jail.jailed` -eq 0 ]; then
 			umount ${named_chrootdir}/dev 2>/dev/null || true
 		else
 			warn "named chroot:" \
 			    "cannot unmount devfs from inside jail!"
 		fi
 	fi
 }
 
 create_file()
 {
 	if [ -e "$1" ]; then
 		unlink $1
 	fi
 	install -o root -g wheel -m 0644 /dev/null $1
 }
 
 named_prestart()
 {
 	find_pidfile
 
 	if [ -n "${named_pidfile}" ]; then
 		warn 'named_pidfile: now determined from the conf file'
 	fi
 
 	piddir=`/usr/bin/dirname ${pidfile}`
 	if [ ! -d ${piddir} ]; then
 		install -d -o ${named_uid} -g ${named_uid} ${piddir}
 	fi
 
 	command_args="-u ${named_uid:=root} -c ${named_conf} ${command_args}"
 
 	if [ -z "${rndc_flags}" ]; then
 		if [ -s ${rndc_conf} ] ; then
 			rndc_flags="-c ${rndc_conf}"
 		elif [ -s ${rndc_key} ] ; then
 			rndc_flags="-k ${rndc_key}"
 		else
 			rndc_flags=""
 		fi
 	fi
 
 	local line nsip firstns
 
 	# Is the user using a sandbox?
 	#
 	if [ -n "${named_chrootdir}" ]; then
 		rc_flags="${rc_flags} -t ${named_chrootdir}"
 		checkyesno named_chroot_autoupdate && chroot_autoupdate
 	else
 		named_symlink_enable=NO
 	fi
 
 	# Create an rndc.key file for the user if none exists
 	#
 	confgen_command="${_named_program_root}/sbin/rndc-confgen -a -b256 -u ${named_uid} \
 	    -c ${_named_confdir}/rndc.key"
 	if [ -s "${_named_confdir}/rndc.conf" ]; then
 		unset confgen_command
 	fi
 	if [ -s "${_named_confdir}/rndc.key" ]; then
 		case `stat -f%Su ${_named_confdir}/rndc.key` in
 		root|${named_uid}) ;;
 		*) ${confgen_command} ;;
 		esac
 	else
 		${confgen_command}
 	fi
 
 	local checkconf
 
 	checkconf="${_named_program_root}/sbin/named-checkconf"
 	if ! checkyesno named_chroot_autoupdate && [ -n "${named_chrootdir}" ]; then
 		checkconf="${checkconf} -t ${named_chrootdir}"
 	fi
 
 	# Create a forwarder configuration based on /etc/resolv.conf
 	if checkyesno named_auto_forward; then
 		if [ ! -s /etc/resolv.conf ]; then
 			warn "named_auto_forward enabled, but no /etc/resolv.conf"
 
 			# Empty the file in case it is included in named.conf
 			[ -s "${_named_confdir}/auto_forward.conf" ] &&
 			    create_file ${_named_confdir}/auto_forward.conf
 
 			${checkconf} ${named_conf} ||
 			    err 3 'named-checkconf for ${named_conf} failed'
 			return
 		fi
 
 		create_file /var/run/naf-resolv.conf
 		create_file /var/run/auto_forward.conf
 
 		echo '	forwarders {' > /var/run/auto_forward.conf
 
 		while read line; do
 			case "${line}" in
 			'nameserver '*|'nameserver	'*)
 				nsip=${line##nameserver[         ]}
 
 				if [ -z "${firstns}" ]; then
 					if [ ! "${nsip}" = '127.0.0.1' ]; then
 						echo 'nameserver 127.0.0.1'
 						echo "		${nsip};" >> /var/run/auto_forward.conf
 					fi
 
 					firstns=1
 				else
 					[ "${nsip}" = '127.0.0.1' ] && continue
 					echo "		${nsip};" >> /var/run/auto_forward.conf
 				fi
 				;;
 			esac
 
 			echo ${line}
 		done < /etc/resolv.conf > /var/run/naf-resolv.conf
 
 		echo '	};' >> /var/run/auto_forward.conf
 		echo '' >> /var/run/auto_forward.conf
 		if checkyesno named_auto_forward_only; then
 			echo "	forward only;" >> /var/run/auto_forward.conf
 		else
 			echo "	forward first;" >> /var/run/auto_forward.conf
 		fi
 
 		if cmp -s /etc/resolv.conf /var/run/naf-resolv.conf; then
 			unlink /var/run/naf-resolv.conf
 		else
 			[ -e /etc/resolv.conf ] && unlink /etc/resolv.conf
 			mv /var/run/naf-resolv.conf /etc/resolv.conf
 		fi
 
 		if cmp -s ${_named_confdir}/auto_forward.conf \
 		    /var/run/auto_forward.conf; then
 			unlink /var/run/auto_forward.conf
 		else
 			[ -e "${_named_confdir}/auto_forward.conf" ] &&
 			    unlink ${_named_confdir}/auto_forward.conf
 			mv /var/run/auto_forward.conf \
 			    ${_named_confdir}/auto_forward.conf
 		fi
 	else
 		# Empty the file in case it is included in named.conf
 		[ -s "${_named_confdir}/auto_forward.conf" ] &&
 		    create_file ${_named_confdir}/auto_forward.conf
 	fi
 
 	${checkconf} ${named_conf} || err 3 "named-checkconf for ${named_conf} failed"
 }
 
 run_rc_command "$1"
Index: head/dns/bind99/pkg-help
===================================================================
--- head/dns/bind99/pkg-help	(revision 388210)
+++ head/dns/bind99/pkg-help	(revision 388211)
@@ -1,8 +1,14 @@
                             GOST
 If using a chrooted instance of BIND on FreeBSD 8.x and 9.x,
 the OpenSSL engines MUST be accessible from within the chroot.
 If BIND is chrooted in /var/named, this can be achieved by
 either copying content of /usr/local/lib/engines into
 /var/named/usr/local/lib/engines, or by creating that directory
 and adding this line to /etc/fstab:
 /usr/local/lib/engines  /var/named/usr/local/lib/engines nullfs ro 0 0
+
+
+                         START_LATE
+Most of the time, BIND needs to start early in the boot
+process.  Enable this if BIND starts too early for you and
+you need it to start later.