diff options
| author | Doug Barton <dougb@FreeBSD.org> | 2008-07-09 19:02:01 +0000 |
|---|---|---|
| committer | Doug Barton <dougb@FreeBSD.org> | 2008-07-09 19:02:01 +0000 |
| commit | ab54e4303769499862ad9ace7292725794c1e17b (patch) | |
| tree | f59bbf6388f7f2dae973aa8e78c3977c60c96200 /dns/bind94/Makefile | |
| parent | - Updated to 3.7.3.1 (diff) | |
Upgrade to the -P1 versions of each port, which add stronger randomization
of the UDP query-source ports. The server will still use the same query
port for the life of the process, so users for whom the issue of cache
poisoning is highly significant may wish to periodically restart their
server using /etc/rc.d/named restart, or other suitable method.
In order to take advantage of this randomization users MUST have an
appropriate firewall configuration to allow UDP queries to be sent and
answers to be received on random ports; and users MUST NOT specify a
port number using the query-source[-v6] option.
The avoid-v[46]-udp-ports options exist for users who wish to eliminate
certain port numbers from being chosen by named for this purpose. See
the ARM Chatper 6 for more information.
Also please note, this issue applies only to UDP query ports. A random
ephemeral port is always chosen for TCP queries.
This issue applies primarily to name servers whose main purpose is to
resolve random queries (sometimes referred to as "caching" servers, or
more properly as "resolving" servers), although even an "authoritative"
name server will make some queries, primarily at startup time.
This update addresses issues raised in:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447
http://www.kb.cert.org/vuls/id/800113
http://tools.ietf.org/html/draft-ietf-dnsext-forgery-resilience
Notes
Notes:
svn path=/head/; revision=216629
Diffstat (limited to 'dns/bind94/Makefile')
| -rw-r--r-- | dns/bind94/Makefile | 5 |
1 files changed, 2 insertions, 3 deletions
diff --git a/dns/bind94/Makefile b/dns/bind94/Makefile index 20f579d1e784..0f1836701ba7 100644 --- a/dns/bind94/Makefile +++ b/dns/bind94/Makefile @@ -12,8 +12,7 @@ # release you can generally build it cleanly from the source - Doug PORTNAME= bind94 -PORTVERSION= 9.4.2 -PORTREVISION= 1 +PORTVERSION= 9.4.2.1 CATEGORIES= dns net ipv6 MASTER_SITES= ${MASTER_SITE_ISC} \ http://dougbarton.us/Downloads/%SUBDIR%/ @@ -26,7 +25,7 @@ MAINTAINER= dougb@FreeBSD.org COMMENT= The BIND DNS suite with updated DNSSEC and threads # ISC releases things like 9.4.0b3, which our versioning doesn't like -ISCVERSION= 9.4.2 +ISCVERSION= 9.4.2-P1 GNU_CONFIGURE= yes CONFIGURE_ARGS= --localstatedir=/var --disable-linux-caps \ |