summaryrefslogtreecommitdiff
path: root/dns/bind94/Makefile (follow)
Commit message (Collapse)AuthorAgeFilesLines
* BIND 9.4.x is now EOLDoug Barton2011-06-011-229/+0
| | | | Notes: svn path=/head/; revision=274905
* Upgrade to 9.4-ESV-R4-P1, which addresses the following issues:Doug Barton2011-05-271-2/+2
| | | | | | | | | | | | | | | | 1. Very large RRSIG RRsets included in a negative cache can trigger an assertion failure that will crash named (BIND 9 DNS) due to an off-by-one error in a buffer size check. This bug affects all resolving name servers, whether DNSSEC validation is enabled or not, on all BIND versions prior to today. There is a possibility of malicious exploitation of this bug by remote users. 2. Named could fail to validate zones listed in a DLV that validated insecure without using DLV and had DS records in the parent zone. Notes: svn path=/head/; revision=274745
* The actual EOL date is 2011-05-31, as clarified inDoug Barton2011-01-081-1/+1
| | | | | | | https://lists.isc.org/pipermail/bind-users/2011-January/082285.html Notes: svn path=/head/; revision=267501
* Give people fair warning:Doug Barton2010-12-181-1/+4
| | | | | | | | | | DEPRECATED= Reaches EOL May 2011 EXPIRATION_DATE= 2011-04-30 While I'm here update CONFLICTS for bind98 Notes: svn path=/head/; revision=266533
* Update to version 9.4-ESV-R4, the latest from ISC, which addressesDoug Barton2010-12-031-17/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | the following security vulnerability. For more information regarding these issues please see: http://www.isc.org/announcement/guidance-regarding-dec-1st-2010-security-advisories Key algorithm rollover http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3614 Affects resolver operators who are validating with DNSSEC, and querying zones which are in a key rollover period. The bug will cause answers to incorrectly be marked as insecure. For the port: 1. Add CONFLICT for the ../bind-tools port 2. Remove CONFLICT for the removed ../bind9 port 3. Remove OPTION for threads on < RELENG_7 4. Remove MD5 from distinfo 5. Switch to pkg-install to create the symlinks to /etc/namedb/ as requested in [1] PR: ports/151635 [1] Submitted by: Benjamin Lee <ben@b1c1l1.com> [1] Notes: svn path=/head/; revision=265652
* Update to 9.4-ESV-R3, the latest from ISC.Doug Barton2010-10-191-2/+2
| | | | Notes: svn path=/head/; revision=263220
* Update to the latest patch set from ISC, which addresses the following:Doug Barton2010-05-201-2/+2
| | | | | | | | Named could return SERVFAIL for negative responses from unsigned zones. Notes: svn path=/head/; revision=254632
* Update to the latest patchfix releases to deal with the problemsDoug Barton2010-03-171-3/+3
| | | | | | | | | | | related to the handling of broken DNSSEC trust chains. This fix is only necessary for those who have DNSSEC validation enabled and configure trust anchors from third parties, either manually, or through a system like DLV. Notes: svn path=/head/; revision=251154
* Upgrade to 9.4-ESV, the first of the "Extended Support Releases"Doug Barton2010-02-021-3/+3
| | | | | | | | | from ISC. It has numerous bug fixes compared to 9.4.3*, however in the case of this version "extended" only applies till 2010/12/31 so serious BIND users are still encouraged to upgrade to 9.6.x. Notes: svn path=/head/; revision=249074
* Upgrade to BIND 9.4.3-P5, 9.5.2-P2, and 9.6.1-P3. These versions addressDoug Barton2010-01-251-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | the following vulnerabilities: BIND 9 Cache Update from Additional Section https://www.isc.org/advisories/CVE-2009-4022v6 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4022 A nameserver with DNSSEC validation enabled may incorrectly add unauthenticated records to its cache that are received during the resolution of a recursive client query BIND 9 DNSSEC validation code could cause bogus NXDOMAIN responses https://www.isc.org/advisories/CVE-2010-0097 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0097 There was an error in the DNSSEC NSEC/NSEC3 validation code that could cause bogus NXDOMAIN responses (that is, NXDOMAIN responses for records proven by NSEC or NSEC3 to exist) to be cached as if they had validated correctly These issues only affect systems with DNSSEC validation enabled. Notes: svn path=/head/; revision=248498
* Update CONFLICTS for bind97Doug Barton2009-12-141-1/+1
| | | | Notes: svn path=/head/; revision=245755
* Update to the latest patchlevels for BINDs 9.[456]. The vulnerabilityDoug Barton2009-11-301-3/+2
| | | | | | | | | | this is designed to fix is related to DNSSEC validation on a resolving name server that allows access to untrusted users. If your system does not fall into all 3 of these categories you do not need to update immediately. Notes: svn path=/head/; revision=245002
* Wrap some query socket handling in dig with a socket != NULL bowDoug Barton2009-11-071-0/+1
| | | | | | | | | | | | | This patch or something similar will likely be included in a future BIND release. PR: bin/138061 Submitted by: Michael Baker <michael.baker@diversit.com.au> Original patch submitted by: Volker <volker@vwsoft.com> Patch reviewed and tweaked by: ISC Notes: svn path=/head/; revision=243943
* The new LINKS OPTION is not only useless it's harmful when combinedDoug Barton2009-09-011-2/+2
| | | | | | | | | | with the REPLACE_BASE option so if the latter is defined don't try to make the LINKS. Problem pointed out by: Chris Wopat <me@falz.net> Notes: svn path=/head/; revision=240641
* For all:Doug Barton2009-08-291-2/+53
| | | | | | | | | | | | | | | | | Add an OPTION (on by default) to install the appropriate symlinks for named.conf and rndc.key in /usr/local/etc and /var/named/usr/local/etc. For bind9[456]: Add OPTIONs (off by default) for the DLZ configure options, and their corresponding ports knobs. [1] The basic infrastructure for this was provided in the PR, but this version is slightly different in a few details so responsibility for bugs is mine. PR: ports/122974 [1] Submitted by: Michael Schout <mschout@gkg.net> [1] Notes: svn path=/head/; revision=240544
* Add a slave port to bind94 for the GeoIP patch from Caraytech.Doug Barton2009-08-151-0/+27
| | | | | | | | | | | | | | | | | | | | The most popular use of this patch is to send web site visitors to their nearest web server. Suppose you have a site called www.example555.com with two web servers: one in the US and one in England. You can use this patch in order for visitors from Europe to connect to the server in England and all other visitors to the server in the US. This is just one example of its usage. There are probably many others. WWW: http://www.caraytech.com/geodns/ I created a slave port rather than making this an option but other than that I was able to use the excellent work in the PR. PR: ports/119997 Submitted by: Jui-Nan Lin <jnlin@csie.nctu.edu.tw> Notes: svn path=/head/; revision=239612
* Update to patched versions which address a remote DoS vulnerability:Doug Barton2009-07-281-2/+2
| | | | | | | | | | | | | | | Receipt of a specially-crafted dynamic update message may cause BIND 9 servers to exit. This vulnerability affects all servers -- it is not limited to those that are configured to allow dynamic updates. Access controls will not provide an effective workaround. More details can be found here: https://www.isc.org/node/474 All BIND users are encouraged to update to a patched version ASAP. Notes: svn path=/head/; revision=238566
* - Flip from MAKE_JOBS_SAFE to MAKE_JOBS_UNSAFE, fails both on pointyhat and onPav Lucistnik2009-04-121-1/+1
| | | | | | | my local machine Notes: svn path=/head/; revision=232247
* Fix CONFLICTS (again). The previous example didn't work at all for portsDoug Barton2009-03-241-1/+1
| | | | | | | | other than plain bind9 since the real PORTNAMEs for the other ports are bind9[456]. This fix has the added advantage of covering REPLACE_BASE. Notes: svn path=/head/; revision=230905
* Where it matters, update regarding MAKE_JOBS_{UN}SAFE for my portsDoug Barton2009-03-241-0/+2
| | | | Notes: svn path=/head/; revision=230904
* BIND 9.4.3-P2 is a SECURITY patch for BIND 9.4.3. It addresses a bugDoug Barton2009-03-211-2/+2
| | | | | | | | | in DNSSEC lookaside validation (DLV): unrecognized signature algorithms, which should have been treated as the equivalent of an unsigned zone, were instead treated as a validation failure. Notes: svn path=/head/; revision=230603
* Update to the -P1 versions of the current BIND ports which containDoug Barton2009-01-081-8/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | the fix for the following vulnerability: https://www.isc.org/node/373 Description: Return values from OpenSSL library functions EVP_VerifyFinal() and DSA_do_verify() were not checked properly. Impact: It is theoretically possible to spoof answers returned from zones using the DNSKEY algorithms DSA (3) and NSEC3DSA (6). In short, if you're not using DNSSEC to verify signatures you have nothing to worry about. While I'm here, address the issues raised in the PR by adding a knob to disable building with OpenSSL altogether (which eliminates DNSSEC capability), and fix the configure arguments to better deal with the situation where the user has ssl bits in both the base and LOCALBASE. PR: ports/126297 Submitted by: Ronald F.Guilmette <rfg@tristatelogic.com> Notes: svn path=/head/; revision=225434
* Update CONFLICTS to reflect the addition of the bind96 port,Doug Barton2009-01-041-1/+1
| | | | | | | the demise of bind9-dlz, and updates to the bind9-sdb-* ports. Notes: svn path=/head/; revision=225213
* Update to version 9.4.3 which contains numerous bug fixes.Doug Barton2008-12-191-5/+5
| | | | | | | | This version also includes the use-v[46]-udp-ports options to configure a range of random UDP ports to initiate queries from. Notes: svn path=/head/; revision=224484
* Update to patchlevel 2 for all versions:Doug Barton2008-08-021-3/+2
| | | | | | | | | | | | | - performance improvement over the P1 releases, namely + significantly remedying the port allocation issues + allowing TCP queries and zone transfers while issuing as many outstanding UDP queries as possible + additional security of port randomization at the same level as P1 - also includes fixes for several bugs in the 9.5.0 base code Notes: svn path=/head/; revision=217934
* Add an OPTION to turn on the ability of dns/host/nslookup to doDoug Barton2008-07-161-0/+5
| | | | | | | | | | | DNSSEC validation. This is off by default, so no PORTREVISION bump. Submitted by: Andrei V. Lavreniyuk <andy.lavr@reactor-xg.kiev.ua> Notes: svn path=/head/; revision=216933
* Bump PORTREVISION for the patch to named-checkconfDoug Barton2008-07-111-2/+9
| | | | | | | | Add the logic for the THREADS OPTION to be on for 7-RELEASE and above (and off otherwise) that I'm using in dns/bind95 Notes: svn path=/head/; revision=216718
* Upgrade to the -P1 versions of each port, which add stronger randomizationDoug Barton2008-07-091-3/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | of the UDP query-source ports. The server will still use the same query port for the life of the process, so users for whom the issue of cache poisoning is highly significant may wish to periodically restart their server using /etc/rc.d/named restart, or other suitable method. In order to take advantage of this randomization users MUST have an appropriate firewall configuration to allow UDP queries to be sent and answers to be received on random ports; and users MUST NOT specify a port number using the query-source[-v6] option. The avoid-v[46]-udp-ports options exist for users who wish to eliminate certain port numbers from being chosen by named for this purpose. See the ARM Chatper 6 for more information. Also please note, this issue applies only to UDP query ports. A random ephemeral port is always chosen for TCP queries. This issue applies primarily to name servers whose main purpose is to resolve random queries (sometimes referred to as "caching" servers, or more properly as "resolving" servers), although even an "authoritative" name server will make some queries, primarily at startup time. This update addresses issues raised in: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447 http://www.kb.cert.org/vuls/id/800113 http://tools.ietf.org/html/draft-ietf-dnsext-forgery-resilience Notes: svn path=/head/; revision=216629
* Update CONFLICTS:Doug Barton2008-07-041-1/+1
| | | | | | | | | 1. To take bind95 into account 2. s/bind9-sdb-ldap/bind9-sdb-mysql/ 3. Delete references to BIND 8 Notes: svn path=/head/; revision=216305
* Fix pkg-plist by including a new file.Doug Barton2007-12-051-0/+1
| | | | | | | | Pointy hat number N:M (where M = many) goes to: dougb Approved by: portmgr (erwin) Notes: svn path=/head/; revision=202908
* ISC recently announced that BIND 8 has been End-of-Life'd:Doug Barton2007-12-031-1/+1
| | | | | | | | | | | | | | http://www.isc.org/index.pl?/sw/bind/bind8-eol.php Therefore, per the previous announcement, remove the ports for BIND 8. This includes the chinese/bind8 slave port, and mail/smc-milter which has a dependency on libbind_r.a from BIND 8.x. The latter has been unmaintained since 2005, and is 3 versions behind. Approved by: portmgr (linimon) Notes: svn path=/head/; revision=202883
* Update to BIND 9.4.2. Many bugs are fixed, please see the CHANGESDoug Barton2007-12-011-2/+2
| | | | | | | | | file for more details. Approved by: portmgr (erwin) Notes: svn path=/head/; revision=202873
* Update to 9.4.1-P1, which has fixes for the following:Doug Barton2007-07-241-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | 1. The default access control lists (acls) are not being correctly set. If not set anyone can make recursive queries and/or query the cache contents. See also: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2925 2. The DNS query id generation is vulnerable to cryptographic analysis which provides a 1 in 8 chance of guessing the next query id for 50% of the query ids. This can be used to perform cache poisoning by an attacker. This bug only affects outgoing queries, generated by BIND 9 to answer questions as a resolver, or when it is looking up data for internal uses, such as when sending NOTIFYs to slave name servers. All users are encouraged to upgrade. See also: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2926 Notes: svn path=/head/; revision=196229
* - Set --mandir and --infodir in CONFIGURE_ARGS if the configure scriptRong-En Fan2007-07-231-2/+1
| | | | | | | | | | | | | | | | | | | | | supports them. This is determined by running ``configure --help'' in do-configure target and set the shell variable _LATE_CONFIGURE_ARGS which is then passed to CONFIGURE_ARGS. - Remove --mandir and --infodir in ports' Makefile where applicable Few ports use REINPLACE_CMD to achieve the same effect, remove them too. - Correct some manual pages location from PREFIX/man to MANPREFIX/man - Define INFO_PATH where necessary - Document that .info files are installed in a subdirectory relative to PREFIX/INFO_PATH and slightly change add-plist-info to use INFO_PATH and subdirectory detection. PR: ports/111470 Approved by: portmgr Discussed with: stas (Mk/*), gerald (info related stuffs) Tested by: pointyhat exp run Notes: svn path=/head/; revision=196111
* Update to version 9.4.1, a security update from ISC:Doug Barton2007-05-011-2/+2
| | | | | | | | | | | 2172. [bug] query_addsoa() was being called with a non zone db. [RT #16834] If you are running BIND 9.4.0 (either pre-release or final), you are advised to upgrade as soon as possible to BIND 9.4.1. Notes: svn path=/head/; revision=191246
* Update to the release version of 9.4.0.Doug Barton2007-02-261-2/+2
| | | | Notes: svn path=/head/; revision=185961
* Complete the update for bind94 after the repocopy, and hook it up.Doug Barton2007-01-281-23/+25
| | | | Notes: svn path=/head/; revision=183578
* Upgrade to version 9.3.4, the latest from ISC, which addresses theDoug Barton2007-01-251-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | following security issues. All users of BIND are encouraged to upgrade to this version. 2126. [security] Serialise validation of type ANY responses. [RT #16555] 2124. [security] It was possible to dereference a freed fetch context. [RT #16584] 2089. [security] Raise the minimum safe OpenSSL versions to OpenSSL 0.9.7l and OpenSSL 0.9.8d. Versions prior to these have known security flaws which are (potentially) exploitable in named. [RT #16391] 2088. [security] Change the default RSA exponent from 3 to 65537. [RT #16391] 2066. [security] Handle SIG queries gracefully. [RT #16300] 1941. [bug] ncache_adderesult() should set eresult even if no rdataset is passed to it. [RT #15642] Notes: svn path=/head/; revision=183229
* Apply the markup fixes from the base to the nsupdate.8 andDoug Barton2006-12-211-0/+8
| | | | | | | nslookup.1 man pages. Notes: svn path=/head/; revision=180313
* Upgrade to version 9.3.3, the latest from ISC. This isDoug Barton2006-12-091-2/+2
| | | | | | | | | | | a maintenance release, with the usual round of bug and security fixes. All users of BIND 9 are encouraged to upgrade to this version. Notes: svn path=/head/; revision=179339
* Update to version 9.3.2-P2, which addresses the vulnerabilityDoug Barton2006-11-031-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | announced by ISC dated 31 October (delivered via e-mail to the bind-announce@isc.org list today): Description: Because of OpenSSL's recently announced vulnerabilities (CAN-2006-4339, CVE-2006-2937 and CVE-2006-2940) which affect named, we are announcing this workaround and releasing patches. A proof of concept attack on OpenSSL has been demonstrated for CAN-2006-4339. OpenSSL is required to use DNSSEC with BIND. Fix for version 9.3.2-P1 and lower: Upgrade to BIND 9.2.3-P2, then generate new RSASHA1 and RSAMD5 keys for all old keys using the old default exponent and perform a key rollover to these new keys. These versions also change the default RSA exponent to be 65537 which is not vulnerable to the attacks described in CAN-2006-4339. Notes: svn path=/head/; revision=176257
* Upgrade to version 9.3.2-P1, which addresses the following securityDoug Barton2006-09-061-2/+2
| | | | | | | | | | | | | | | | vulnerabilities: http://www.niscc.gov.uk/niscc/docs/re-20060905-00590.pdf?lang=en 2066. [security] Handle SIG queries gracefully. [RT #16300] http://www.kb.cert.org/vuls/id/697164 1941. [bug] ncache_adderesult() should set eresult even if no rdataset is passed to it. [RT #15642] All users of BIND 9 are encouraged to upgrade to this version. Notes: svn path=/head/; revision=172416
* Add OPTIONS to the rest of my ports that need them.Doug Barton2006-08-281-16/+10
| | | | | | | Add CONFLICTS to the bind* ports. Notes: svn path=/head/; revision=171498
* Update to 9.3.2, the latest from ISCDoug Barton2005-12-281-2/+2
| | | | Notes: svn path=/head/; revision=152247
* Move the verify target after pre-fetch.Doug Barton2005-12-061-3/+3
| | | | Notes: svn path=/head/; revision=150511
* Committed the wrong version ... s#/usr/local#${LOCALBASE}#Doug Barton2005-11-271-1/+1
| | | | Notes: svn path=/head/; revision=149630
* Fix a long-standing problem that appears when users installDoug Barton2005-11-271-1/+7
| | | | | | | | | | | | | | openssl from ports, and do not use the option to have the port version overwrite the base version. Several folks have mentioned this problem in the past, but a good workaround (and more importantly, solid testing) were provided by the submitter. Submitted by: Uffe Vedenbrant <uffe@vedenbrant.se> Notes: svn path=/head/; revision=149628
* For the ports that I maintain, do the following as appropriate:Doug Barton2005-10-291-1/+5
| | | | | | | | | | | | 1. Add myself as a backup master site (Sourceforge and CPAN ports already have good enough coverage, so skip them). 2. For all ports that have them, download the PGP signature files. 3. For ports in 2, add a verify target to the Makefile 4. For ports where I was already providing a master site, update the URL. 5. Pet portlint in a couple of places. Notes: svn path=/head/; revision=146646
* ISC staff has informed me that in BIND 9.3.x, threads are always aDoug Barton2005-06-291-1/+3
| | | | | | | | bad idea, so disable them in all cases unless the user has affirmatively requested this through the define. Notes: svn path=/head/; revision=138160
* 1. The OPTIONS stuff isn't working the way it should according to reports,Doug Barton2005-03-171-4/+2
| | | | | | | | | so rip it out until I have a chance to debug it. 2. Improve the comment about deprecating an old knob. Notes: svn path=/head/; revision=131473
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-14 14:34:45 +0000