diff options
author | taca <taca@pkgsrc.org> | 2016-05-02 13:22:06 +0000 |
---|---|---|
committer | taca <taca@pkgsrc.org> | 2016-05-02 13:22:06 +0000 |
commit | effb557ab57d69a9b947c4ad87ffc09826f976c0 (patch) | |
tree | b52de0ea2a0ae7d63ea21ef9f4777cdea12f9755 /net/bind99 | |
parent | 6d03af0f7bf64db1739d570d42bbaf6efd3720ae (diff) | |
download | pkgsrc-effb557ab57d69a9b947c4ad87ffc09826f976c0.tar.gz |
Update bind99 to 9.9.9 (BIND 9.9.9).
All Security Fixes should be fixed by 9.9.8-P4.
Security Fixes
* The resolver could abort with an assertion failure due to improper
DNAME handling when parsing fetch reply messages. This flaw is
disclosed in CVE-2016-1286. [RT #41753]
* Malformed control messages can trigger assertions in named and
rndc. This flaw is disclosed in CVE-2016-1285. [RT #41666]
* Specific APL data could trigger an INSIST. This flaw is disclosed
in CVE-2015-8704. [RT #41396]
* Incorrect reference counting could result in an INSIST failure if a
socket error occurred while performing a lookup. This flaw is
disclosed in CVE-2015-8461. [RT#40945]
* Insufficient testing when parsing a message allowed records with an
incorrect class to be be accepted, triggering a REQUIRE failure
when those records were subsequently cached. This flaw is disclosed
in CVE-2015-8000. [RT #40987]
New Features
* The following resource record types have been implemented: AVC,
CSYNC, NINFO, RKEY, SINK, SMIMEA, TA, TALINK.
* Added a warning for a common misconfiguration involving forwarded
RFC 1918 and IPv6 ULA (Universal Local Address) zones.
* Contributed software from Nominum is included in the source at
contrib/dnsperf-2.1.0.0-1/. It includes dnsperf for measuring the
performance of authoritative DNS servers, resperf for testing the
resolution performance of a caching DNS server, resperf-report for
generating a resperf report in HTML with gnuplot graphs, and
queryparse to extract DNS queries from pcap capture files. This
software is not installed by default with BIND.
* When loading a signed zone, named will now check whether an RRSIG's
inception time is in the future, and if so, it will regenerate the
RRSIG immediately. This helps when a system's clock needs to be
reset backwards.
Feature Changes
* Updated the compiled-in addresses for H.ROOT-SERVERS.NET and
L.ROOT-SERVERS.NET.
* The default preferred glue is now the address type of the transport
the query was received over.
* On machines with 2 or more processors (CPU), the default value for
the number of UDP listeners has been changed to the number of
detected processors minus one.
* Zone transfers now use smaller message sizes to improve message
compression. This results in reduced network usage.
* named -V output now also includes operating system details.
Porting Changes
* The Microsoft Windows install tool BINDInstall.exe which requires a
non-free version of Visual Studio to be built, now uses two files
(lists of flags and files) created by the Configure perl script
with all the needed information which were previously compiled in
the binary. Read win32utils/build.txt for more details. [RT #38915]
Bug Fixes
* rndc flushtree now works even if there wasn't a cached node at the
specified name. [RT #41846]
* Don't emit records with zero TTL unless the records were received
with a zero TTL. After being returned to waiting clients, the
answer will be discarded from the cache. [RT #41687]
* When deleting records from a zone database, interior nodes could be
left empty but not deleted, damaging search performance afterward.
[RT #40997] [RT #41941]
* The server could crash due to a use-after-free if a zone transfer
timed out. [RT #41297]
* Authoritative servers that were marked as bogus (e.g. blackholed in
configuration or with invalid addresses) were being queried anyway.
[RT #41321]
Diffstat (limited to 'net/bind99')
-rw-r--r-- | net/bind99/Makefile | 4 | ||||
-rw-r--r-- | net/bind99/PLIST | 5 | ||||
-rw-r--r-- | net/bind99/distinfo | 12 | ||||
-rw-r--r-- | net/bind99/patches/patch-lib_dns_rbt.c | 16 |
4 files changed, 20 insertions, 17 deletions
diff --git a/net/bind99/Makefile b/net/bind99/Makefile index 070da5b4704..7512d9a1af9 100644 --- a/net/bind99/Makefile +++ b/net/bind99/Makefile @@ -1,4 +1,4 @@ -# $NetBSD: Makefile,v 1.54 2016/03/10 00:50:34 taca Exp $ +# $NetBSD: Makefile,v 1.55 2016/05/02 13:22:06 taca Exp $ DISTNAME= bind-${BIND_VERSION} PKGNAME= ${DISTNAME:S/-P/pl/} @@ -14,7 +14,7 @@ CONFLICTS+= host-[0-9]* MAKE_JOBS_SAFE= no -BIND_VERSION= 9.9.8-P4 +BIND_VERSION= 9.9.9 .include "../../mk/bsd.prefs.mk" diff --git a/net/bind99/PLIST b/net/bind99/PLIST index a1c48d8fa47..3d566122ef8 100644 --- a/net/bind99/PLIST +++ b/net/bind99/PLIST @@ -1,4 +1,4 @@ -@comment $NetBSD: PLIST,v 1.10 2015/02/26 10:14:10 taca Exp $ +@comment $NetBSD: PLIST,v 1.11 2016/05/02 13:22:06 taca Exp $ bin/bind9-config bin/dig bin/host @@ -396,6 +396,7 @@ share/doc/bind9/arm/man.dig.html share/doc/bind9/arm/man.dnssec-checkds.html share/doc/bind9/arm/man.dnssec-coverage.html share/doc/bind9/arm/man.dnssec-dsfromkey.html +share/doc/bind9/arm/man.dnssec-importkey.html share/doc/bind9/arm/man.dnssec-keyfromlabel.html share/doc/bind9/arm/man.dnssec-keygen.html share/doc/bind9/arm/man.dnssec-revoke.html @@ -405,9 +406,11 @@ share/doc/bind9/arm/man.dnssec-verify.html share/doc/bind9/arm/man.genrandom.html share/doc/bind9/arm/man.host.html share/doc/bind9/arm/man.isc-hmac-fixup.html +share/doc/bind9/arm/man.lwresd.html share/doc/bind9/arm/man.named-checkconf.html share/doc/bind9/arm/man.named-checkzone.html share/doc/bind9/arm/man.named-journalprint.html +share/doc/bind9/arm/man.named.conf.html share/doc/bind9/arm/man.named.html share/doc/bind9/arm/man.nsec3hash.html share/doc/bind9/arm/man.nsupdate.html diff --git a/net/bind99/distinfo b/net/bind99/distinfo index fa514810e9f..96e3c7ab575 100644 --- a/net/bind99/distinfo +++ b/net/bind99/distinfo @@ -1,14 +1,14 @@ -$NetBSD: distinfo,v 1.37 2016/03/10 00:50:34 taca Exp $ +$NetBSD: distinfo,v 1.38 2016/05/02 13:22:06 taca Exp $ -SHA1 (bind-9.9.8-P4.tar.gz) = c4dae4dd9aefd6fc0f8644d6d8559d450e7e8224 -RMD160 (bind-9.9.8-P4.tar.gz) = 989ac8bd9e9775b6f59a2b18b1f44265216c7d38 -SHA512 (bind-9.9.8-P4.tar.gz) = 72d709d824a5e121965f3520126c3155f1049b2b30560c1c5e66d78227873d426438af876f1b68061d49e5599cfefbfcfd8b1dc2e1490a2e20c6519e7d6c72cb -Size (bind-9.9.8-P4.tar.gz) = 7999697 bytes +SHA1 (bind-9.9.9.tar.gz) = 6383901b64e6c56ede5839c37664b715a901622c +RMD160 (bind-9.9.9.tar.gz) = 822c4ddf6b7898dc368fef16e846cdcc13f86e84 +SHA512 (bind-9.9.9.tar.gz) = 3761358211a04f7a51075ad832c5f5f130601df115ffdcedda3c2d50a6e76b5bc2ce5a29e54bfe5bb08d585090a76f80068c4e816108aac3c6db9c1b65bd54e0 +Size (bind-9.9.9.tar.gz) = 8781170 bytes SHA1 (patch-bin_dig_dighost.c) = a4bc9558c5dbedcc6bb0f87ea309358ca098d42a SHA1 (patch-bin_tests_system_Makefile.in) = 19d90050acfbe3da838dbd4c1436b5581039b71f SHA1 (patch-config.threads.in) = 227b83efe9cb3e301aaac9b97cf42f1fb8ad06b2 SHA1 (patch-configure) = 1e86fab1a82f237dfc7f1a3c09e4ef6095bf973e SHA1 (patch-contrib_dlz_config.dlz.in) = f18bec63fbfce7cb2cd72929058ce3770fce458f -SHA1 (patch-lib_dns_rbt.c) = df4b029369d9fa3b250d8505b5f7590e2cd86654 +SHA1 (patch-lib_dns_rbt.c) = 267ecae3de33297b18faff46c9855c1ce64b4856 SHA1 (patch-lib_lwres_getaddrinfo.c) = cda91b6d1afa02de2c59d51490090ef4ab7f1a41 SHA1 (patch-lib_lwres_getnameinfo.c) = 7ded70795a9001cce5c8094ef3f70ac787a6d43d diff --git a/net/bind99/patches/patch-lib_dns_rbt.c b/net/bind99/patches/patch-lib_dns_rbt.c index f5309ca236a..41017dbecf5 100644 --- a/net/bind99/patches/patch-lib_dns_rbt.c +++ b/net/bind99/patches/patch-lib_dns_rbt.c @@ -1,17 +1,17 @@ -$NetBSD: patch-lib_dns_rbt.c,v 1.1.1.1 2012/03/07 14:25:00 taca Exp $ +$NetBSD: patch-lib_dns_rbt.c,v 1.2 2016/05/02 13:22:06 taca Exp $ * Disable inline on powerpc. ---- lib/dns/rbt.c.orig 2011-08-25 05:56:50.000000000 +0000 +--- lib/dns/rbt.c.orig 2016-04-20 20:11:30.000000000 +0000 +++ lib/dns/rbt.c -@@ -177,6 +177,10 @@ Name(dns_rbtnode_t *node) { - static void dns_rbt_printnodename(dns_rbtnode_t *node); - #endif +@@ -179,6 +179,10 @@ Name(dns_rbtnode_t *node) { + } + #endif /* DEBUG */ +#if !defined(inline) && defined(__powerpc__) +#define inline /**/ +#endif + - static inline dns_rbtnode_t * - find_up(dns_rbtnode_t *node) { - dns_rbtnode_t *root; + #ifdef DNS_RBT_USEHASH + + /* |