aboutsummaryrefslogtreecommitdiffstats
path: root/dns/bind99
Commit message (Collapse)AuthorAgeFilesLines
* Add an option for filter-aaaaErwin Lansing2013-09-231-1/+6
| | | | Submitted by: Matej Gregr <matej.gregr@gmail.com>
* Add NO_STAGE all over the place in preparation for the staging support (cat: ↵Baptiste Daroussin2013-09-211-0/+1
| | | | dns)
* Update to 9.9.4Erwin Lansing2013-09-203-11/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Note that the Rate Limiting option has been renamed. Security Fixes Previously an error in bounds checking on the private type 'keydata' could be used to deny service through a deliberately triggerable REQUIRE failure (CVE-2013-4854). [RT #34238] Prevents exploitation of a runtime_check which can crash named when satisfying a recursive query for particular malformed zones. (CVE-2013-3919) [RT #33690] New Features Added Response Rate Limiting (RRL) functionality to reduce the effectiveness of DNS as an amplifier for reflected denial-of-service attacks by rate-limiting substantially-identical responses. [RT #28130] Feature Changes rndc status now also shows the build-id. [RT #20422] Improved OPT pseudo-record processing to make it easier to support new EDNS options. [RT #34414] "configure" now finishes by printing a summary of optional BIND features and whether they are active or inactive. ("configure --enable-full-report" increases the verbosity of the summary.) [RT #31777] Addressed compatibility issues with newer versions of Microsoft Visual Studio. [RT #33916] Improved the 'rndc' man page. [RT #33506] 'named -g' now no longer works with an invalid logging configuration. [RT #33473] The default (and minimum) value for tcp-listen-queue is now 10 instead of 3. This is a subtle control setting (not applicable to all OS environments). When there is a high rate of inbound TCP connections, it controls how many connections can be queued before they are accepted by named. Once this limit is exceeded, new TCP connections will be rejected. Note however that a value of 10 does not imply a strict limit of 10 queued TCP connections - the impact of changing this configuration setting will be OS-dependent. Larger values for tcp-listen queue will permit more pending tcp connections, which may be needed where there is a high rate of TCP-based traffic (for example in a dynamic environment where there are frequent zone updates and transfers). For most production servers the new default value of 10 should be adequate. [RT #33029] Added support for OpenSSL versions 0.9.8y, 1.0.0k, and 1.0.1e with PKCS#11. [RT #33463] Added logging messages on slave servers when they forward DDNS updates to a master. [RT #33240] Changed the logging category for RRL events from 'queries' to 'query-errors'. [RT #33540]
* Make GSSAPI support optionalErwin Lansing2013-09-171-1/+7
| | | | | PR: 182122 Submitted by: Uwe Doering <gemini@geminix.org>
* . introduce ICONV_CONFIGURE_BASE variable at Mk/Uses/iconv.mk. It's value isBoris Samorodov2013-09-061-1/+2
| | | | | | | | "--with-libiconv=${LOCALBASE}" at systems pre OSVERSION 100043 and "" (null) otherwise; . convert all ports which has CONFIGURE_ARGS=--with-libiconv=${LOCALBASE}. Approved by: portmgr (bapt, implicit)
* Update the RPZ+RL patches for both versions.Ollivier Robert2013-07-282-3/+3
| | | | Approved by: erwin
* Put back the two patches for RPZ-RL that were removed during the previousOllivier Robert2013-07-271-0/+2
| | | | update.
* Security update to fix CVE-2013-4854 as reported atOllivier Robert2013-07-272-6/+4
| | | | | | | | | | | https://kb.isc.org/article/AA-01015/0 9.9.3-p1 -> 9.9.3-P2 9.8.5-p1 -> 9.8.5-P2 9.6.x is not affected, neither is 10.x. Security: CVE-2013-4854 Remote DOS
* Update to 9.9.3-P1Erwin Lansing2013-06-052-7/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Security Fixes Prevents exploitation of a runtime_check which can crash named when satisfying a recursive query for particular malformed zones. (CVE-2013-3919) [RT #33690] Now supports NAPTR regular expression validation on all platforms, and avoids memory exhaustion compiling pathological regular expressions. (CVE-2013-2266) [RT #32688] Prevents named from aborting with a require assertion failure on servers with DNS64 enabled. These crashes might occur as a result of specific queries that are received. (CVE-2012-5688) [RT #30792 / #30996] Prevents an assertion failure in named when RPZ and DNS64 are used together. (CVE-2012-5689) [RT #32141] See release notes for further features and bug fixes: https://kb.isc.org/article/AA-00970/0/BIND-9.9.3-P1-Extended-Support-Version-Release-Notes.html Security: CVE-2013-3919 CVE-2013-2266 CVE-2012-5688 CVE-2012-5689
* Update to 9.9.3Erwin Lansing2013-05-313-7/+8
|
* Update RPZ and RRL patch set:Erwin Lansing2013-05-312-3/+3
| | | | | | | | | | | | | | - address the issue raised by Bob Harold. RRL on recursive servers applies rate limits after waiting for recursion except on sub-domains of domains for which the server is authoritative. - fix the bug reported by Roy Arends in which "slipped" NXDOMAIN responses had rcode values of 0 (NoError) instead of 3 (NXDOMAIN). - move reports of RRL drop and slip actions from the "queries" log category to the "query-errors" category. Because they are not in the "queres" category, enabling or disabling query logging no longer affects them.
* Fix typo in RPZRRL_PATCHErwin Lansing2013-05-061-1/+1
| | | | Submitted by: Alexander Yerenkow <yerenkow@gmail.com>
* Readd dns/bind-tools.Niclas Zeising2013-04-241-9/+22
| | | | | | | | | This is done in a similar manner as the old bind-tools, but uses bind99 instead of bind97 as master port. Change bind99 to facilitate the bind-tools slave, in a simlar way as was done for bind97. Approved by: erwin (maintainer)
* Make pkg-message and pkg-install a local file to the bind98 and bind99Erwin Lansing2013-04-233-2/+31
| | | | | ports and not include the one from the deprecated bind97 port, which is to be removed.
* Update RPZ+RRL patchset to the latest version.Erwin Lansing2013-04-172-3/+3
| | | | | | | | | | | | | The change makes "slip 1;" send only truncated (TC=1) responses. Without the change, "slip 1;" is the same as the default of "slip 2;". That default, which alternates truncated with dropped responses when the rate limit is exceeded, is better for authoritative DNS servers, because it further reduces the amplification of an attack from about 1X to about 0.5X. DNS RRL is not recommended for recursive servers. Feature safe: yes
* Update to 9.9.2-P2Erwin Lansing2013-03-272-4/+4
| | | | | | | | | Removed the check for regex.h in configure in order to disable regex syntax checking, as it exposes BIND to a critical flaw in libregex on some platforms. [RT #32688] Security: CVE-2013-2266
* Update the RPZ+RRL patch files which removeErwin Lansing2013-03-152-3/+3
| | | | | | | | working files that should not have been in the patches[1] Also move to a versioned filename for the patches[2] Submitted by: Robert Sargent <robtsgt@gmail.com> [1], Vernon Schryver <vjs@rhyolite.com> [2]
* Update RPZ+RRL patch to 028.23Erwin Lansing2013-02-051-2/+2
| | | | | | | | | | | | | | | A serious Multiple Zone Response Policy Zone (RPZ2) Speed Improvement bug has been fixed. `./configure --enable-rpz-nsip --enable-rpz-nsdname` is now the default. Responses affected by the all-per-second parameter are always dropped. The slip value has no effect on them. There are improved log messages for responses that are dropped or "slipped," because they would require an excessive identical referral.
* Reduce lenght of the option description for RPZRRL_PATCH toErwin Lansing2013-01-101-1/+1
| | | | | | avoid problems with the older dialog(1) on FreeBSD 8.x Noticed by: Terry Kennedy <terry@tmk.com>
* Update the response rate limiting patch to the latestErwin Lansing2013-01-092-7/+7
| | | | | | | | | | | released version of January 5, 2013. This also includes performance patches to the BIND9 Response Policy Zones (DNS RPZ), Single Zone Response Policy Zone (RPZ) Speed Improvement, in the same patch. More information: http://ss.vix.su/~vjs/rrlrpz.html
* Add LICENSE.Erwin Lansing2013-01-041-0/+2
|
* Add experimental option for Response Rate Limiting patch.Erwin Lansing2013-01-042-1/+9
|
* - Use new OPTIONS_GROUP for DLZ options.[1]Erwin Lansing2012-12-141-3/+3
| | | | | | | | - This also allows more than one DLZ option to be set.[2] Submitted by: bapt [1] (as RADIO) Suggested by: az [2] (thus GROUP instead)
* Update to the latest patch level from ISC:Erwin Lansing2012-12-052-6/+4
| | | | | | | | | | | | | BIND 9 nameservers using the DNS64 IPv6 transition mechanism are vulnerable to a software defect that allows a crafted query to crash the server with a REQUIRE assertion failure. Remote exploitation of this defect can be achieved without extensive effort, resulting in a denial-of-service (DoS) vector against affected servers. Security: 2892a8e2-3d68-11e2-8e01-0800273fe665 CVE-2012-5688 Feature safe: yes
* Improve the SSL option descriptionErwin Lansing2012-12-031-1/+1
| | | | | Submitted by: Kazunori Fujiwara <fujiwara@jprs.co.jp> Feature safe: yes
* Remove gpg signature checking that in itself does notErwin Lansing2012-12-031-5/+0
| | | | | | provide any additional security. Feature safe: yes
* - Update CONFLICTSErwin Lansing2012-11-271-4/+19
| | | | | | | | | | - Fix a typo in the OPTIONSNG conversion - Add FIXED_RRSET option - Add RPZ options (9.8 and 9.8 only) PR: 172586 Submitted by: Craig Leres <leres@ee.lbl.gov> Feature safe: yes
* Reduce lenght of the option description for DLZ_MYSQL toErwin Lansing2012-10-261-1/+1
| | | | | | | avoid problems with the older dialog(1) on FreeBSD 8.x Noticed by: Terry Kennedy <terry@tmk.com> Feature safe: yes
* - Convert to OPTIONSNGErwin Lansing2012-10-251-37/+39
| | | | | | - Turn on IPv6 support by default Feature safe: yes
* Force python off to disable build time detection of python.Erwin Lansing2012-10-191-1/+2
| | | | | Submitted by: zeising Feature safe: yes
* Update to 9.9.2Erwin Lansing2012-10-193-6/+8
| | | | Feature safe: yes
* Upgrade to the latest BIND patch level:Erwin Lansing2012-10-102-6/+6
| | | | | | | A deliberately constructed combination of records could cause named to hang while populating the additional section of a response. Security: http://www.vuxml.org/freebsd/57a700f9-12c0-11e2-9f86-001d923933b6.html
* Take maintainership of the BIND ports while I'm working on the latestErwin Lansing2012-10-101-1/+1
| | | | security releases.
* Throw my ports back in the pool, and make my intentions clear for theDoug Barton2012-10-081-7/+1
| | | | | | | | various ports that I've created. I bid fond fare well A chapter closes for me What opens for you?
* Upgrade to the latest BIND patch level:Doug Barton2012-09-192-11/+9
| | | | | | | | | | | | | | | | | | | Prevents a crash when queried for a record whose RDATA exceeds 65535 bytes. Prevents a crash when validating caused by using "Bad cache" data before it has been initialized. ISC_QUEUE handling for recursive clients was updated to address a race condition that could cause a memory leak. This rarely occurred with UDP clients, but could be a significant problem for a server handling a steady rate of TCP queries. A condition has been corrected where improper handling of zero-length RDATA could cause undesirable behavior, including termination of the named process. For more information: https://kb.isc.org/article/AA-00788
* Heavy DNSSEC Validation Load Can Cause a "Bad Cache" Assertion FailureDoug Barton2012-07-252-8/+7
| | | | | | | | | | | in BIND9 High numbers of queries with DNSSEC validation enabled can cause an assertion failure in named, caused by using a "bad cache" data structure before it has been initialized. CVE: CVE-2012-3817 Posting date: 24 July, 2012
* Upgrade to 9.6-ESV-R7-P1, 9.7.6-P1, 9.8.3-P1, and 9.9.1-P1, the latestDoug Barton2012-06-052-6/+6
| | | | | | | | | | | | | | | | from ISC. These patched versions contain a critical bugfix: Processing of DNS resource records where the rdata field is zero length may cause various issues for the servers handling them. Processing of these records may lead to unexpected outcomes. Recursive servers may crash or disclose some portion of memory to the client. Secondary servers may crash on restart after transferring a zone containing these records. Master servers may corrupt zone data if the zone option "auto-dnssec" is set to "maintain". Other unexpected problems that are not listed here may also be encountered. All BIND users are strongly encouraged to upgrade.
* Upgrade to BIND versions 9.9.1, 9.8.3, 9.7.6, and 9.6-ESV-R7,Doug Barton2012-05-233-7/+7
| | | | | | | | | | | | | | | | | | | | the latest from ISC. These versions all contain the following: Feature Change * BIND now recognizes the TLSA resource record type, created to support IETF DANE (DNS-based Authentication of Named Entities) [RT #28989] Bug Fix * The locking strategy around the handling of iterative queries has been tuned to reduce unnecessary contention in a multi- threaded environment. Each version also contains other critical bug fixes. All BIND users are encouraged to upgrade to these latest versions.
* Remove patch that is incorporated into version 9.9.1Doug Barton2012-05-231-11/+0
|
* Switch to using the PORTDOCS macroDoug Barton2012-04-052-51/+1
| | | | Feature safe: yes
* Add a patch from ISC slated for 9.9.1 which fixes an assertion failureDoug Barton2012-03-172-0/+12
| | | | Feature safe: yes
* Release version of 9.9.0. Code is identical to rc4.Doug Barton2012-03-012-7/+6
|
* Upgrade to rc4, rndc and dlz fixes, including DNSSEC key maintenance timerDoug Barton2012-02-242-6/+6
|
* Upgrade to 9.9.0rc3, various small bug fixesDoug Barton2012-02-192-6/+6
|
* Update to 9.9.0rc2, which addresses mostly in-line signing bugsDoug Barton2012-02-012-6/+6
|
* By popular demand add a port for the newest BIND branch, 9.9.x. This willDoug Barton2012-01-284-0/+545
stay as a -devel until it's formally released, which should be soon'ish. BIND 9.9 includes a number of changes from BIND 9.8 and earlier releases, including: NXDOMAIN redirection Improved startup and reconfiguration time, especially with large numbers of authoritative zones New "inline-signing" option, allows named to sign zones completely transparently, including static zones Many other new features, especially for DNSSEC See the CHANGES file for more information on features. https://kb.isc.org/article/AA-00592
generated by cgit (git 2.34.1) at 2025-02-25 01:33:13 +0800