summaryrefslogtreecommitdiff
path: root/net/bind99
AgeCommit message (Collapse)AuthorFilesLines
2014-05-29Bump for perl-5.20.0.wiz1-2/+2
Do it for all packages that * mention perl, or * have a directory name starting with p5-*, or * depend on a package starting with p5- like last time, for 5.18, where this didn't lead to complaints. Let me know if you have any this time.
2014-03-11Import initial SMF support for individual packages.jperkin3-1/+260
2014-03-11Remove example rc.d scripts from PLISTs.jperkin1-3/+1
These are now handled dynamically if INIT_SYSTEM is set to "rc.d", or ignored otherwise.
2014-02-12Recursive PKGREVISION bump for OpenSSL API version bump.tron1-1/+2
2014-02-02Update bind99 to 9.9.5 (BIND 9.9.5).taca6-33/+39
Security fixes were already covered by 9.9.4pl2. Some bug fixes and clean up, please refer CHANGES file in detail.
2014-01-13Update bind99 to 9.9.4pl2 (BIND 9.9.4-P2), securify fix for CVE-2014-0591.taca4-26/+10
pkgsrc change: remove patches/patch-configure.in. --- 9.9.4-P2 released --- 3693. [security] memcpy was incorrectly called with overlapping ranges resulting in malformed names being generated on some platforms. This could cause INSIST failures when serving NSEC3 signed zones. [RT #35120] 3658. [port] linux: Address platform specific compilation issue when libcap-devel is installed. [RT #34838]
2013-11-07Update bind99 to 9.9.4pl1 (BIND 9.9.4-P1).taca2-6/+6
Security Fixes Treat an all zero netmask as invalid when generating the localnets acl. A Winsock library call on some Windows systems can return an incorrect value for an interface's netmask, potentially causing unexpected matches to BIND's built-in "localnets" Access Control List. (CVE-2013-6230) [RT #34687]
2013-09-21Update bind99 to 9.9.4 (BIND 9.9.4).taca12-61/+61
(CVE-2013-4854 and CVE-2013-3919 were already fixed in pkgsrc). Security Fixes Previously an error in bounds checking on the private type 'keydata' could be used to deny service through a deliberately triggerable REQUIRE failure (CVE-2013-4854). [RT #34238] Prevents exploitation of a runtime_check which can crash named when satisfying a recursive query for particular malformed zones. (CVE-2013-3919) [RT #33690] New Features Added Response Rate Limiting (RRL) functionality to reduce the effectiveness of DNS as an amplifier for reflected denial-of-service attacks by rate-limiting substantially-identical responses. [RT #28130] Feature Changes rndc status now also shows the build-id. [RT #20422] Improved OPT pseudo-record processing to make it easier to support new EDNS options. [RT #34414] "configure" now finishes by printing a summary of optional BIND features and whether they are active or inactive. ("configure --enable-full-report" increases the verbosity of the summary.) [RT #31777] Addressed compatibility issues with newer versions of Microsoft Visual Studio. [RT #33916] Improved the 'rndc' man page. [RT #33506] 'named -g' now no longer works with an invalid logging configuration. [RT #33473] The default (and minimum) value for tcp-listen-queue is now 10 instead of 3. This is a subtle control setting (not applicable to all OS environments). When there is a high rate of inbound TCP connections, it controls how many connections can be queued before they are accepted by named. Once this limit is exceeded, new TCP connections will be rejected. Note however that a value of 10 does not imply a strict limit of 10 queued TCP connections - the impact of changing this configuration setting will be OS-dependent. Larger values for tcp-listen queue will permit more pending tcp connections, which may be needed where there is a high rate of TCP-based traffic (for example in a dynamic environment where there are frequent zone updates and transfers). For most production servers the new default value of 10 should be adequate. [RT #33029] Added support for OpenSSL versions 0.9.8y, 1.0.0k, and 1.0.1e with PKCS#11. [RT #33463] Added logging messages on slave servers when they forward DDNS updates to a master. [RT #33240] Changed the logging category for RRL events from 'queries' to 'query-errors'. [RT #33540] Bug Fixes Fixed the "allow-query-on" option to correctly check the destination address. [RT #34590] Fix forwarding for forward only "zones" beneath automatic empty zones. [RT #34583] Fix DNSSEC auto maintenance so signatures can be removed from a zone with only KSK keys for an algorithm. [RT #34439] Fix DNSSEC auto maintenance so signatures from newly inactive keys are removed (when publishing a new key while deactivating another key at the same time). [RT #32178] Remove bogus warning log message about missing signatures when receiving a query for a SIG record. [RT #34600] Fix Response Policy Zones on slave servers so new RPZ changes take effect. [RT #34450] Fix the "zone-statistics" option to work with the default traditional statistics (not new "--enable-newstats" feature). [RT #34466] named could crash when deleting inline-signing zones with "rndc delzone". [RT #34066] Improved resistance to a theoretical authentication attack based on differential timing. [RT #33939] named was failing to answer queries during "rndc reload" [RT #34098] win32: Some executables had been omitted from the installer. [RT #34116] fixed a broken 'Invalid keyfile' error message in dnssec-keygen. [RT #34045] The build of BIND now installs isc/stat.h so that it's available to /isc/file.h when building other applications that reference these header files - for example dnsperf (see Debian bug ticket #692467). [RT #33056] Better handle failures building XML for stats channel responses. [RT #33706] Fixed a memory leak in GSS-API processing. [RT #33574] Fixed an acache-related race condition that could cause a crash. [RT #33602] rndc now properly fails when given an invalid '-c' argument. [RT #33571] Fixed an issue with the handling of zero TTL records that could cause improper SERVFAILs. [RT #33411] Fixed a crash-on-shutdown race condition with DNSSEC validation. [RT #33573] Corrected the way that "rndc addzone" and "rndc delzone" handle non-standard characters in zone names. [RT #33419] Adjusted RRL behavior for recursive queries to defer rate-limiting until after recursion is complete. Also uses correct rcode for slipped NXDOMAIN responses. [RT #33604] Previously, BIND could erroneously report a missing file specification when using inline slave zones. [RT #33662]
2013-08-07rl-9.9.3-P2.patch has been updated. From http://ss.vix.su/~vjs/rrlrpz.htmljklos1-3/+3
2013-08-01sync rrl patch version with using base BIND_VERSION.obache2-6/+6
PR pkg/48102.
2013-07-27Update bind99 to 9.9.3pl2 (BIND 9.9.3-P2).taca2-9/+6
--- 9.9.3-P2 released --- 3621. [security] Incorrect bounds checking on private type 'keydata' can lead to a remotely triggerable REQUIRE failure (CVE-2013-4854). [RT #34238]
2013-07-15* .include "../../devel/readline/buildlink3.mk" with USE_GNU_READLINE=yesryoon1-2/+2
are replaced with .include "../../devel/readline/buildlink3.mk", and USE_GNU_READLINE are removed, * .include "../../devel/readline/buildlink3.mk" without USE_GNU_READLINE are replaced with .include "../../mk/readline.buildlink3.mk".
2013-07-12Bump PKGREVISION of all packages which create users, to pick up change ofjperkin1-1/+2
sysutils/user_* packages.
2013-06-06Update bind99 to 9.9.3pl1 (BIND 9.9.3-P1).taca9-177/+23
Please refer CHANGES file for complete changes and here is quote from release announce. Introduction BIND 9.9.3-P1 is the latest production release of BIND 9.9-ESV. Security Fixes Prevents exploitation of a runtime_check which can crash named when satisfying a recursive query for particular malformed zones. (CVE-2013-3919) [RT #33690] Now supports NAPTR regular expression validation on all platforms, and avoids memory exhaustion compiling pathological regular expressions. (CVE-2013-2266) [RT #32688] Prevents named from aborting with a require assertion failure on servers with DNS64 enabled. These crashes might occur as a result of specific queries that are received. (CVE-2012-5688) [RT #30792 / #30996] Prevents an assertion failure in named when RPZ and DNS64 are used together. (CVE-2012-5689) [RT #32141] New Features Adds a new configuration option, "check-spf"; valid values are "warn" (default) and "ignore". When set to "warn", checks SPF and TXT records in spf format, warning if either resource record type occurs without a corresponding record of the other resource record type. [RT #33355] Adds the command-line tool "dnssec-coverage" that checks to make sure that there is no scheduled lapse in key coverage. Requires python. [RT #28098] Adds support for the EUI48 and EUI64 RR types. [RT #33082] Adds support for the RFC 6742 ILNP record types (NID, LP, L32, and L64). [RT #31836]
2013-05-31Bump all packages for perl-5.18, thatwiz1-1/+2
a) refer 'perl' in their Makefile, or b) have a directory name of p5-*, or c) have any dependency on any p5-* package Like last time, where this caused no complaints.
2013-04-08New rrl patch, new checksumpettai1-4/+4
2013-04-06Fixes:rodent1-2/+2
COMMENT should not be longer than 70 characters. COMMENT should not begin with 'A'. COMMENT should not begin with 'An'. COMMENT should not begin with 'a'. COMMENT should not end with a period. COMMENT should start with a capital letter. pkglint warnings. Some files also got minor formatting, spelling, and style corrections.
2013-03-27Also update the corresponding RRL patch + distinfo filepettai2-6/+6
2013-03-26Update bind99 to 9.9.2pl2 (BIND 9.9.2-P2).taca3-16/+15
--- 9.9.2-P2 released --- 3516. [security] Removed the check for regex.h in configure in order to disable regex syntax checking, as it exposes BIND to a critical flaw in libregex on some platforms. [RT #32688]
2013-03-02Bump PKGREVISION for mysql default change to 55.wiz1-2/+2
2013-02-09Updated rrl patch version + sourcepettai2-7/+7
2013-02-06PKGREVISION bumps for the security/openssl 1.0.1d update.jperkin1-2/+2
2012-12-16recursive bump from cyrus-sasl libsasl2 shlib major bump.obache1-1/+2
2012-12-05Update bind99 to 9.9.2pl1nb2 (BIND 9.9.2-P1) which solves CVE-2012-5688.taca2-7/+6
--- 9.9.2-P1 released --- 3407. [security] Named could die on specific queries with dns64 enabled. [Addressed in change #3388 for BIND 9.8.5 and 9.9.3.]
2012-11-11Remove the PATCH* lines from the Makefilepettai1-4/+1
2012-11-10Added RRL (Response Rate Limiting) build optionpettai3-4/+16
2012-11-08Explicitly disable Python support. This fixes build problems e.g. if thetron1-1/+2
"pkg_alternatives" package is installed and a binary called "python" is available.
2012-10-23Drop superfluous PKG_DESTDIR_SUPPORT, "user-destdir" is default these days.asau1-3/+1
2012-10-21Add CONFLICTS between net/bind and net/host.cheusov1-2/+3
net/bind9*: remove "bind<x.y.z" entries from CONFLICTS. It is useless because package's PKGBASE is "bind".
2012-10-10Update bind99 to 9.9.2 (BIND 9.9.2).taca6-24/+46
Here are change changes from release note. Note security fixes except CVE-2012-5166 should be already fixed in previous version of bind99 package. Please refer https://kb.isc.org/article/AA-00798 for list of full bug fixes. Security Fixes * A deliberately constructed combination of records could cause named to hang while populating the additional section of a response. [CVE-2012-5166] [RT #31090] * Prevents a named assert (crash) when queried for a record whose RDATA exceeds 65535 bytes. [CVE-2012-4244] [RT #30416] * Prevents a named assert (crash) when validating caused by using "Bad cache" data before it has been initialized. [CVE-2012-3817] [RT #30025] * A condition has been corrected where improper handling of zero-length RDATA could cause undesirable behavior, including termination of the named process. [CVE-2012-1667] [RT #29644] * ISC_QUEUE handling for recursive clients was updated to address a race condition that could cause a memory leak. This rarely occurred with UDP clients, but could be a significant problem for a server handling a steady rate of TCP queries. [CVE-2012-3868] [RT #29539 & #30233] New Features * Elliptic Curve Digital Signature Algorithm keys and signatures in DNSSEC are now supported per RFC 6605. [RT #21918] * Introduces a new tool "dnssec-checkds" command that checks a zone to determine which DS records should be published in the parent zone, or which DLV records should be published in a DLV zone, and queries the DNS to ensure that it exists. (Note: This tool depends on python; it will not be built or installed on systems that do not have a python interpreter.) [RT #28099] * Introduces a new tool "dnssec-verify" that validates a signed zone, checking for the correctness of signatures and NSEC/NSEC3 chains. [RT #23673] * Adds configuration option "max-rsa-exponent-size <value>;" that can be used to specify the maximum rsa exponent size that will be accepted when validating [RT #29228] Feature Changes * Improves OpenSSL error logging [RT #29932] * nslookup now returns a nonzero exit code when it is unable to get an answer. [RT #29492]
2012-10-03Bump all packages that use perl, or depend on a p5-* package, orwiz1-1/+2
are called p5-*. I hope that's all of them.
2012-09-13Update bind99 to 9.9.1pl3 (BIND 9.9.1-P3).taca2-6/+6
--- 9.9.1-P3 released --- 3364. [security] Named could die on specially crafted record. [RT #30416]
2012-08-26Make it clearer which package contains exactly which bind version.wiz2-2/+4
Patch from Bug Hunting.
2012-07-24patch version fixing CVE-2012-3817 and CVE-2012-3868:spz2-7/+6
--- 9.9.1-P2 released --- 3349. [bug] Change #3345 was incomplete. [RT #30233] 3346. [security] Bad-cache data could be used before it was initialized, causing an assert. [RT #30025] 3345. [bug] Addressed race condition when removing the last item or inserting the first item in an ISC_QUEUE. [RT #29539] 3342. [bug] Change #3314 broke saving of stub zones to disk resulting in excessive cpu usage in some cases. [RT #29952]
2012-07-10Add and enable readline option.sbd7-10/+164
To make this work properly rework the readline detection to not use LIBS but instead use the new @LIBREADLINE@ AC_SUBST (This stops _everything_ being linked to libreadline!). Bump PKGREVISION.
2012-07-10Add patch to "Link proper postgresql library" in autoconf source.sbd1-0/+15
2012-07-10Only set PTHREAD_AUTO_VARS if the threads options is enabled.sbd2-4/+4
Also move PTHREAD_OPTS to just above where pthread.buildlink3.mk is included.
2012-06-14Recursive PKGREVISION bump for libxml2 buildlink addition.sbd1-1/+2
2012-06-04Update bind99 to 9.9.1pl1 (BIND 9.9.1-P1).taca2-6/+6
Security release for CVE-2012-1667. --- 9.9.1-P1 released --- 3331. [security] dns_rdataslab_fromrdataset could produce bad rdataslabs. [RT #29644]
2012-05-22Update biind99 package to 9.9.1.taca5-45/+12
pkgsrc change: add an comment to patches/patch-bin_tests_system_Makefile.in. Changes from release announce: Security Fixes * Windows binary packages distributed by ISC are now built and linked against OpenSSL 1.0.0i New Features * None Feature Changes * BIND now recognizes the TLSA resource record type, created to support IETF DANE (DNS-based Authentication of Named Entities) [RT #28989] * A note will be added to the README in future releases to explain that the improved scalability provided by using multiple threads to listen for and process queries (change 3137, RT #22992) does not provide any performance benefit when running BIND on versions of the linux kernel that do not include the 'lockless UDP transmit path' changes that were incorporated in 2.6.39. (Some linux distributors may have provided this functionality under their own version numbering systems). Bug Fixes * The locking strategy around the handling of iterative queries has been tuned to reduce unnecessary contention in a multi-threaded environment. (Note that this may not provide a measurable improvement over previous versions of BIND, but it corrects the performance impact of change 3309 / RT #27995) [RT #29239] * Addresses a race condition that can cause named to to crash when the masters list for a zone is updated via rndc reload/reconfig [RT #26732] * named-checkconf now correctly validates dns64 clients acl definitions. [RT #27631] * Fixes a race condition in zone.c that can cause named to crash during the processing of rndc delzone [RT #29028] * Prevents a named segfault from resolver.c due to procedure fctx_finddone() not being thread-safe. [RT #27995] * Improves DNS64 reverse zone performance. [RT #28563] * Adds wire format lookup method to sdb. [RT #28563] * Uses hmctx, not mctx when freeing rbtdb->heaps to avoid triggering an assertion when flushing cache data. [RT #28571] * Prevents intermittent named crashes following an rndc reload [RT #28606] * Resolves inconsistencies in locating DNSSEC keys where zone names contain characters that require special mappings [RT #28600] * A new flag -R has been added to queryperf for running tests using non-recursive queries. It also now builds correctly on MacOS version 10.7 (darwin) [RT #28565] * Named no longer crashes if gssapi is enabled in named.conf but was not compiled into the binary [RT #28338] * SDB now handles unexpected errors from back-end database drivers gracefully instead of exiting on an assert. [RT #28534] * Prevents named crashes as a result of dereferencing a NULL pointer in zmgr_start_xfrin_ifquota if the zone was being removed while there were zone transfers still pending [RT #28419] * Corrects a parser bug that could cause named to crash while reading a malformed zone file. [RT #28467] * Ensures that when a client recurses its status fields are consistently set so that named doesn't fail on an INSIST in client.c:exit_check. [RT #28346] * Fixed a problem preventing proper use of 64 bit time values in libbind. [RT # 26542] * isccc/cc.c:table_fromwire could fail to free an allocated object on error, leading to a possible memory leak condition. [RT #28265] * Fixed a build error on systems without ENOTSUP. [RT #28200] * The header file isc/hmacsha.h is now installed when building BIND. [RT #28169] * AAAA responses will no longer be returned in the additional section when filter-aaaa-on-v4 is in use. (Prior to this change, they would be returned for some query types). [RT #27292]
2012-05-20PR#45780 net/bind99: Fix chroot operationmarino2-3/+11
DNSSEC related, bind99 needs same fix as bind98
2012-05-01Add fix to a race condition in the resolver code that can cause a recursivetaca3-2/+38
nameserver: <https://kb.isc.org/article/AA-00664>. Bump PKGREVISION.
2012-03-23net/bind99: Fix undefined reference to `main'marino2-1/+15
DragonFly build was broken during the linking of driver.so ---- libtool: link: cc -o driver.so .libs/driver.o -L/wrkobjdir/net/bind99/work/.buildlink/lib /usr/lib/crt1.o: In function `_start': crt1.c:(.text+0x149): undefined reference to `main' *** Error code 1 ---- This has been seen on other platforms: Fedora: http://lists.fedoraproject.org/pipermail/scm-commits/2011-November/683368.html Gentoo: https://bugs.gentoo.org/show_bug.cgi?id=406399 Not building dlzexternal is the solution the worked in the above reports. It works for DragonFly as well, and the PLIST is not affected.
2012-03-07Importing BIND 9.9.0 as pkgsrc/net/bind99.taca23-0/+1146
Introduction BIND 9.9.0 is the first production release of BIND 9.9. This document summarizes changes from BIND 9.8 to BIND 9.9. Please see the CHANGES file in the source code release for a complete list of all changes. New Features * The new "inline-signing" option * NXDOMAIN redirection * "rndc flushtree <name>" command * "rndc sync" command * The new "rndc signing" command * "auto-dnssec" zones * Improves the startup time And more.
generated by cgit v1.2.3 (git 2.39.1) at 2025-04-18 02:50:10 +0000