summaryrefslogtreecommitdiff
path: root/dns/bind94/Makefile (unfollow)
Commit message (Collapse)AuthorFilesLines
2011-06-01BIND 9.4.x is now EOLDoug Barton1-229/+0
Notes: svn path=/head/; revision=274905
2011-05-27Upgrade to 9.4-ESV-R4-P1, which addresses the following issues:Doug Barton1-2/+2
1. Very large RRSIG RRsets included in a negative cache can trigger an assertion failure that will crash named (BIND 9 DNS) due to an off-by-one error in a buffer size check. This bug affects all resolving name servers, whether DNSSEC validation is enabled or not, on all BIND versions prior to today. There is a possibility of malicious exploitation of this bug by remote users. 2. Named could fail to validate zones listed in a DLV that validated insecure without using DLV and had DS records in the parent zone. Notes: svn path=/head/; revision=274745
2011-01-08The actual EOL date is 2011-05-31, as clarified inDoug Barton1-1/+1
https://lists.isc.org/pipermail/bind-users/2011-January/082285.html Notes: svn path=/head/; revision=267501
2010-12-18Give people fair warning:Doug Barton1-1/+4
DEPRECATED= Reaches EOL May 2011 EXPIRATION_DATE= 2011-04-30 While I'm here update CONFLICTS for bind98 Notes: svn path=/head/; revision=266533
2010-12-03Update to version 9.4-ESV-R4, the latest from ISC, which addressesDoug Barton1-17/+7
the following security vulnerability. For more information regarding these issues please see: http://www.isc.org/announcement/guidance-regarding-dec-1st-2010-security-advisories Key algorithm rollover http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3614 Affects resolver operators who are validating with DNSSEC, and querying zones which are in a key rollover period. The bug will cause answers to incorrectly be marked as insecure. For the port: 1. Add CONFLICT for the ../bind-tools port 2. Remove CONFLICT for the removed ../bind9 port 3. Remove OPTION for threads on < RELENG_7 4. Remove MD5 from distinfo 5. Switch to pkg-install to create the symlinks to /etc/namedb/ as requested in [1] PR: ports/151635 [1] Submitted by: Benjamin Lee <ben@b1c1l1.com> [1] Notes: svn path=/head/; revision=265652
2010-10-19Update to 9.4-ESV-R3, the latest from ISC.Doug Barton1-2/+2
Notes: svn path=/head/; revision=263220
2010-05-20Update to the latest patch set from ISC, which addresses the following:Doug Barton1-2/+2
Named could return SERVFAIL for negative responses from unsigned zones. Notes: svn path=/head/; revision=254632
2010-03-17Update to the latest patchfix releases to deal with the problemsDoug Barton1-3/+3
related to the handling of broken DNSSEC trust chains. This fix is only necessary for those who have DNSSEC validation enabled and configure trust anchors from third parties, either manually, or through a system like DLV. Notes: svn path=/head/; revision=251154
2010-02-02Upgrade to 9.4-ESV, the first of the "Extended Support Releases"Doug Barton1-3/+3
from ISC. It has numerous bug fixes compared to 9.4.3*, however in the case of this version "extended" only applies till 2010/12/31 so serious BIND users are still encouraged to upgrade to 9.6.x. Notes: svn path=/head/; revision=249074
2010-01-25Upgrade to BIND 9.4.3-P5, 9.5.2-P2, and 9.6.1-P3. These versions addressDoug Barton1-2/+2
the following vulnerabilities: BIND 9 Cache Update from Additional Section https://www.isc.org/advisories/CVE-2009-4022v6 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4022 A nameserver with DNSSEC validation enabled may incorrectly add unauthenticated records to its cache that are received during the resolution of a recursive client query BIND 9 DNSSEC validation code could cause bogus NXDOMAIN responses https://www.isc.org/advisories/CVE-2010-0097 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0097 There was an error in the DNSSEC NSEC/NSEC3 validation code that could cause bogus NXDOMAIN responses (that is, NXDOMAIN responses for records proven by NSEC or NSEC3 to exist) to be cached as if they had validated correctly These issues only affect systems with DNSSEC validation enabled. Notes: svn path=/head/; revision=248498
2009-12-14Update CONFLICTS for bind97Doug Barton1-1/+1
Notes: svn path=/head/; revision=245755
2009-11-30Update to the latest patchlevels for BINDs 9.[456]. The vulnerabilityDoug Barton1-3/+2
this is designed to fix is related to DNSSEC validation on a resolving name server that allows access to untrusted users. If your system does not fall into all 3 of these categories you do not need to update immediately. Notes: svn path=/head/; revision=245002
2009-11-07Wrap some query socket handling in dig with a socket != NULL bowDoug Barton1-0/+1
This patch or something similar will likely be included in a future BIND release. PR: bin/138061 Submitted by: Michael Baker <michael.baker@diversit.com.au> Original patch submitted by: Volker <volker@vwsoft.com> Patch reviewed and tweaked by: ISC Notes: svn path=/head/; revision=243943
2009-09-01The new LINKS OPTION is not only useless it's harmful when combinedDoug Barton1-2/+2
with the REPLACE_BASE option so if the latter is defined don't try to make the LINKS. Problem pointed out by: Chris Wopat <me@falz.net> Notes: svn path=/head/; revision=240641
2009-08-29For all:Doug Barton1-2/+53
Add an OPTION (on by default) to install the appropriate symlinks for named.conf and rndc.key in /usr/local/etc and /var/named/usr/local/etc. For bind9[456]: Add OPTIONs (off by default) for the DLZ configure options, and their corresponding ports knobs. [1] The basic infrastructure for this was provided in the PR, but this version is slightly different in a few details so responsibility for bugs is mine. PR: ports/122974 [1] Submitted by: Michael Schout <mschout@gkg.net> [1] Notes: svn path=/head/; revision=240544
2009-08-15Add a slave port to bind94 for the GeoIP patch from Caraytech.Doug Barton1-0/+27
The most popular use of this patch is to send web site visitors to their nearest web server. Suppose you have a site called www.example555.com with two web servers: one in the US and one in England. You can use this patch in order for visitors from Europe to connect to the server in England and all other visitors to the server in the US. This is just one example of its usage. There are probably many others. WWW: http://www.caraytech.com/geodns/ I created a slave port rather than making this an option but other than that I was able to use the excellent work in the PR. PR: ports/119997 Submitted by: Jui-Nan Lin <jnlin@csie.nctu.edu.tw> Notes: svn path=/head/; revision=239612
2009-07-28Update to patched versions which address a remote DoS vulnerability:Doug Barton1-2/+2
Receipt of a specially-crafted dynamic update message may cause BIND 9 servers to exit. This vulnerability affects all servers -- it is not limited to those that are configured to allow dynamic updates. Access controls will not provide an effective workaround. More details can be found here: https://www.isc.org/node/474 All BIND users are encouraged to update to a patched version ASAP. Notes: svn path=/head/; revision=238566
2009-04-12- Flip from MAKE_JOBS_SAFE to MAKE_JOBS_UNSAFE, fails both on pointyhat and onPav Lucistnik1-1/+1
my local machine Notes: svn path=/head/; revision=232247
2009-03-24Fix CONFLICTS (again). The previous example didn't work at all for portsDoug Barton1-1/+1
other than plain bind9 since the real PORTNAMEs for the other ports are bind9[456]. This fix has the added advantage of covering REPLACE_BASE. Notes: svn path=/head/; revision=230905
2009-03-24Where it matters, update regarding MAKE_JOBS_{UN}SAFE for my portsDoug Barton1-0/+2
Notes: svn path=/head/; revision=230904
2009-03-21BIND 9.4.3-P2 is a SECURITY patch for BIND 9.4.3. It addresses a bugDoug Barton1-2/+2
in DNSSEC lookaside validation (DLV): unrecognized signature algorithms, which should have been treated as the equivalent of an unsigned zone, were instead treated as a validation failure. Notes: svn path=/head/; revision=230603
2009-01-08Update to the -P1 versions of the current BIND ports which containDoug Barton1-8/+11
the fix for the following vulnerability: https://www.isc.org/node/373 Description: Return values from OpenSSL library functions EVP_VerifyFinal() and DSA_do_verify() were not checked properly. Impact: It is theoretically possible to spoof answers returned from zones using the DNSKEY algorithms DSA (3) and NSEC3DSA (6). In short, if you're not using DNSSEC to verify signatures you have nothing to worry about. While I'm here, address the issues raised in the PR by adding a knob to disable building with OpenSSL altogether (which eliminates DNSSEC capability), and fix the configure arguments to better deal with the situation where the user has ssl bits in both the base and LOCALBASE. PR: ports/126297 Submitted by: Ronald F.Guilmette <rfg@tristatelogic.com> Notes: svn path=/head/; revision=225434
2009-01-04Update CONFLICTS to reflect the addition of the bind96 port,Doug Barton1-1/+1
the demise of bind9-dlz, and updates to the bind9-sdb-* ports. Notes: svn path=/head/; revision=225213
2008-12-19Update to version 9.4.3 which contains numerous bug fixes.Doug Barton1-5/+5
This version also includes the use-v[46]-udp-ports options to configure a range of random UDP ports to initiate queries from. Notes: svn path=/head/; revision=224484
2008-08-02Update to patchlevel 2 for all versions:Doug Barton1-3/+2
- performance improvement over the P1 releases, namely + significantly remedying the port allocation issues + allowing TCP queries and zone transfers while issuing as many outstanding UDP queries as possible + additional security of port randomization at the same level as P1 - also includes fixes for several bugs in the 9.5.0 base code Notes: svn path=/head/; revision=217934
2008-07-16Add an OPTION to turn on the ability of dns/host/nslookup to doDoug Barton1-0/+5
DNSSEC validation. This is off by default, so no PORTREVISION bump. Submitted by: Andrei V. Lavreniyuk <andy.lavr@reactor-xg.kiev.ua> Notes: svn path=/head/; revision=216933
2008-07-11Bump PORTREVISION for the patch to named-checkconfDoug Barton1-2/+9
Add the logic for the THREADS OPTION to be on for 7-RELEASE and above (and off otherwise) that I'm using in dns/bind95 Notes: svn path=/head/; revision=216718
2008-07-09Upgrade to the -P1 versions of each port, which add stronger randomizationDoug Barton1-3/+2
of the UDP query-source ports. The server will still use the same query port for the life of the process, so users for whom the issue of cache poisoning is highly significant may wish to periodically restart their server using /etc/rc.d/named restart, or other suitable method. In order to take advantage of this randomization users MUST have an appropriate firewall configuration to allow UDP queries to be sent and answers to be received on random ports; and users MUST NOT specify a port number using the query-source[-v6] option. The avoid-v[46]-udp-ports options exist for users who wish to eliminate certain port numbers from being chosen by named for this purpose. See the ARM Chatper 6 for more information. Also please note, this issue applies only to UDP query ports. A random ephemeral port is always chosen for TCP queries. This issue applies primarily to name servers whose main purpose is to resolve random queries (sometimes referred to as "caching" servers, or more properly as "resolving" servers), although even an "authoritative" name server will make some queries, primarily at startup time. This update addresses issues raised in: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447 http://www.kb.cert.org/vuls/id/800113 http://tools.ietf.org/html/draft-ietf-dnsext-forgery-resilience Notes: svn path=/head/; revision=216629
2008-07-04Update CONFLICTS:Doug Barton1-1/+1
1. To take bind95 into account 2. s/bind9-sdb-ldap/bind9-sdb-mysql/ 3. Delete references to BIND 8 Notes: svn path=/head/; revision=216305
2007-12-05Fix pkg-plist by including a new file.Doug Barton1-0/+1
Pointy hat number N:M (where M = many) goes to: dougb Approved by: portmgr (erwin) Notes: svn path=/head/; revision=202908
2007-12-03ISC recently announced that BIND 8 has been End-of-Life'd:Doug Barton1-1/+1
http://www.isc.org/index.pl?/sw/bind/bind8-eol.php Therefore, per the previous announcement, remove the ports for BIND 8. This includes the chinese/bind8 slave port, and mail/smc-milter which has a dependency on libbind_r.a from BIND 8.x. The latter has been unmaintained since 2005, and is 3 versions behind. Approved by: portmgr (linimon) Notes: svn path=/head/; revision=202883
2007-12-01Update to BIND 9.4.2. Many bugs are fixed, please see the CHANGESDoug Barton1-2/+2
file for more details. Approved by: portmgr (erwin) Notes: svn path=/head/; revision=202873
2007-07-24Update to 9.4.1-P1, which has fixes for the following:Doug Barton1-2/+2
1. The default access control lists (acls) are not being correctly set. If not set anyone can make recursive queries and/or query the cache contents. See also: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2925 2. The DNS query id generation is vulnerable to cryptographic analysis which provides a 1 in 8 chance of guessing the next query id for 50% of the query ids. This can be used to perform cache poisoning by an attacker. This bug only affects outgoing queries, generated by BIND 9 to answer questions as a resolver, or when it is looking up data for internal uses, such as when sending NOTIFYs to slave name servers. All users are encouraged to upgrade. See also: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2926 Notes: svn path=/head/; revision=196229
2007-07-23- Set --mandir and --infodir in CONFIGURE_ARGS if the configure scriptRong-En Fan1-2/+1
supports them. This is determined by running ``configure --help'' in do-configure target and set the shell variable _LATE_CONFIGURE_ARGS which is then passed to CONFIGURE_ARGS. - Remove --mandir and --infodir in ports' Makefile where applicable Few ports use REINPLACE_CMD to achieve the same effect, remove them too. - Correct some manual pages location from PREFIX/man to MANPREFIX/man - Define INFO_PATH where necessary - Document that .info files are installed in a subdirectory relative to PREFIX/INFO_PATH and slightly change add-plist-info to use INFO_PATH and subdirectory detection. PR: ports/111470 Approved by: portmgr Discussed with: stas (Mk/*), gerald (info related stuffs) Tested by: pointyhat exp run Notes: svn path=/head/; revision=196111
2007-05-01Update to version 9.4.1, a security update from ISC:Doug Barton1-2/+2
2172. [bug] query_addsoa() was being called with a non zone db. [RT #16834] If you are running BIND 9.4.0 (either pre-release or final), you are advised to upgrade as soon as possible to BIND 9.4.1. Notes: svn path=/head/; revision=191246
2007-02-26Update to the release version of 9.4.0.Doug Barton1-2/+2
Notes: svn path=/head/; revision=185961
2007-01-28Complete the update for bind94 after the repocopy, and hook it up.Doug Barton1-23/+25
Notes: svn path=/head/; revision=183578
2007-01-25Upgrade to version 9.3.4, the latest from ISC, which addresses theDoug Barton1-2/+2
following security issues. All users of BIND are encouraged to upgrade to this version. 2126. [security] Serialise validation of type ANY responses. [RT #16555] 2124. [security] It was possible to dereference a freed fetch context. [RT #16584] 2089. [security] Raise the minimum safe OpenSSL versions to OpenSSL 0.9.7l and OpenSSL 0.9.8d. Versions prior to these have known security flaws which are (potentially) exploitable in named. [RT #16391] 2088. [security] Change the default RSA exponent from 3 to 65537. [RT #16391] 2066. [security] Handle SIG queries gracefully. [RT #16300] 1941. [bug] ncache_adderesult() should set eresult even if no rdataset is passed to it. [RT #15642] Notes: svn path=/head/; revision=183229
2006-12-21Apply the markup fixes from the base to the nsupdate.8 andDoug Barton1-0/+8
nslookup.1 man pages. Notes: svn path=/head/; revision=180313
2006-12-09Upgrade to version 9.3.3, the latest from ISC. This isDoug Barton1-2/+2
a maintenance release, with the usual round of bug and security fixes. All users of BIND 9 are encouraged to upgrade to this version. Notes: svn path=/head/; revision=179339
2006-11-03Update to version 9.3.2-P2, which addresses the vulnerabilityDoug Barton1-2/+2
announced by ISC dated 31 October (delivered via e-mail to the bind-announce@isc.org list today): Description: Because of OpenSSL's recently announced vulnerabilities (CAN-2006-4339, CVE-2006-2937 and CVE-2006-2940) which affect named, we are announcing this workaround and releasing patches. A proof of concept attack on OpenSSL has been demonstrated for CAN-2006-4339. OpenSSL is required to use DNSSEC with BIND. Fix for version 9.3.2-P1 and lower: Upgrade to BIND 9.2.3-P2, then generate new RSASHA1 and RSAMD5 keys for all old keys using the old default exponent and perform a key rollover to these new keys. These versions also change the default RSA exponent to be 65537 which is not vulnerable to the attacks described in CAN-2006-4339. Notes: svn path=/head/; revision=176257
2006-09-06Upgrade to version 9.3.2-P1, which addresses the following securityDoug Barton1-2/+2
vulnerabilities: http://www.niscc.gov.uk/niscc/docs/re-20060905-00590.pdf?lang=en 2066. [security] Handle SIG queries gracefully. [RT #16300] http://www.kb.cert.org/vuls/id/697164 1941. [bug] ncache_adderesult() should set eresult even if no rdataset is passed to it. [RT #15642] All users of BIND 9 are encouraged to upgrade to this version. Notes: svn path=/head/; revision=172416
2006-08-28Add OPTIONS to the rest of my ports that need them.Doug Barton1-16/+10
Add CONFLICTS to the bind* ports. Notes: svn path=/head/; revision=171498
2005-12-28Update to 9.3.2, the latest from ISCDoug Barton1-2/+2
Notes: svn path=/head/; revision=152247
2005-12-06Move the verify target after pre-fetch.Doug Barton1-3/+3
Notes: svn path=/head/; revision=150511
2005-11-27Committed the wrong version ... s#/usr/local#${LOCALBASE}#Doug Barton1-1/+1
Notes: svn path=/head/; revision=149630
2005-11-27Fix a long-standing problem that appears when users installDoug Barton1-1/+7
openssl from ports, and do not use the option to have the port version overwrite the base version. Several folks have mentioned this problem in the past, but a good workaround (and more importantly, solid testing) were provided by the submitter. Submitted by: Uffe Vedenbrant <uffe@vedenbrant.se> Notes: svn path=/head/; revision=149628
2005-10-29For the ports that I maintain, do the following as appropriate:Doug Barton1-1/+5
1. Add myself as a backup master site (Sourceforge and CPAN ports already have good enough coverage, so skip them). 2. For all ports that have them, download the PGP signature files. 3. For ports in 2, add a verify target to the Makefile 4. For ports where I was already providing a master site, update the URL. 5. Pet portlint in a couple of places. Notes: svn path=/head/; revision=146646
2005-06-29ISC staff has informed me that in BIND 9.3.x, threads are always aDoug Barton1-1/+3
bad idea, so disable them in all cases unless the user has affirmatively requested this through the define. Notes: svn path=/head/; revision=138160
2005-03-171. The OPTIONS stuff isn't working the way it should according to reports,Doug Barton1-4/+2
so rip it out until I have a chance to debug it. 2. Improve the comment about deprecating an old knob. Notes: svn path=/head/; revision=131473
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-15 18:14:10 +0000