--- Makefile	2018-01-12 13:58:51.000000000 +0100
+++ Makefile	2018-01-16 16:09:26.718066000 +0100
@@ -8,7 +8,7 @@
 PORTREVISION=	2
 .else
 # dns/bind911 here
-PORTREVISION=	7
+PORTREVISION=	8
 .endif
 CATEGORIES=	dns net ipv6
 MASTER_SITES=	ISC/bind9/${ISCVERSION}
@@ -68,7 +68,7 @@
 PORTDOCS=	*
 
 OPTIONS_DEFAULT=	SSL THREADS SIGCHASE IDN GSSAPI_NONE JSON PYTHON
-OPTIONS_DEFINE=		IDN LARGE_FILE PYTHON JSON \
+OPTIONS_DEFINE=		IDN LARGE_FILE PYTHON JSON TCP_FASTOPEN \
 			FIXED_RRSET SIGCHASE IPV6 THREADS FILTER_AAAA
 
 OPTIONS_RADIO=	CRYPTO GOSTDEF
@@ -120,6 +120,7 @@
 SIGCHASE_DESC=		dig/host/nslookup will do DNSSEC validation
 SSL_DESC=		Build with OpenSSL (Required for DNSSEC)
 START_LATE_DESC=	Start BIND late in the boot process (see help)
+TCP_FASTOPEN_DESC=	Enable experimental support for RFC7413
 TUNING_LARGE_DESC=	Tune named for large systems (**READ HELP**)
 
 DLZ_BDB_CONFIGURE_ON=	--with-dlz-bdb=yes
@@ -213,6 +214,8 @@
 
 THREADS_CONFIGURE_ENABLE=	threads
 
+TCP_FASTOPEN_EXTRA_PATCHES_OFF=	${FILESDIR}/extrapatch-disable-rfc7413
+
 TUNING_LARGE_IMPLIES=	THREADS
 TUNING_LARGE_CONFIGURE_ON=	--with-tuning=large
 TUNING_LARGE_CONFIGURE_OFF=	--with-tuning=default
--- files/extrapatch-disable-rfc7413	1970-01-01 01:00:00.000000000 +0100
+++ files/extrapatch-disable-rfc7413	2018-01-16 16:15:57.060283000 +0100
@@ -0,0 +1,27 @@
+--- lib/isc/unix/socket.c.orig	2017-07-24 07:36:50.000000000 +0200
++++ lib/isc/unix/socket.c
+@@ -5681,24 +5681,6 @@
+ 		return (ISC_R_UNEXPECTED);
+ 	}
+ 
+-#if defined(ISC_PLATFORM_HAVETFO) && defined(TCP_FASTOPEN)
+-#ifdef __APPLE__
+-	backlog = 1;
+-#else
+-	backlog = backlog / 2;
+-	if (backlog == 0)
+-		backlog = 1;
+-#endif
+-	if (setsockopt(sock->fd, IPPROTO_TCP, TCP_FASTOPEN,
+-		       (void *)&backlog, sizeof(backlog)) < 0) {
+-		isc__strerror(errno, strbuf, sizeof(strbuf));
+-		UNEXPECTED_ERROR(__FILE__, __LINE__,
+-				 "setsockopt(%d, TCP_FASTOPEN) failed with %s",
+-				 sock->fd, strbuf);
+-		/* TCP_FASTOPEN is experimental so ignore failures */
+-	}
+-#endif
+-
+ 	sock->listener = 1;
+ 
+ 	UNLOCK(&sock->lock);