aboutsummaryrefslogtreecommitdiff
path: root/dns/bind97
Commit message (Collapse)AuthorAgeFilesLines
* Update to 9.7.3, the latest from ISC:Doug Barton2011-02-152-6/+6
| | | | | | | | | | | | | | | | | * Zones may be dynamically added and removed with the "rndc addzone" and "rndc delzone" commands. These dynamically added zones are written to a per-view configuration file. Do not rely on the configuration file name nor contents as this will change in a future release. This is an experimental feature at this time. * A new command "rndc secroots" was added to dump a combined summary of the currently managed keys combined with statically configured trust anchors. * Added support to load new keys into managed zones without signing immediately with "rndc loadkeys". Added support to link keys with "dnssec-keygen -S" and "dnssec-settime -S". Notes: svn path=/head/; revision=269173
* CONFLICTS for bind98Doug Barton2010-12-181-1/+1
| | | | Notes: svn path=/head/; revision=266535
* Update to version 9.7.2-P3, the latest from ISC, which addressesDoug Barton2010-12-033-12/+21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | the following security vulnerabilities. For more information regarding these issues please see: http://www.isc.org/announcement/guidance-regarding-dec-1st-2010-security-advisories 1. Cache incorrectly allows ncache and rrsig for the same type http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3613 Affects resolver operators whose servers are open to potential attackers. Triggering the bug will cause the server to crash. This bug applies even if you do not have DNSSEC enabled. 2. Using "allow-query" in the "options" or "view" statements to restrict access to authoritative zones has no effect. http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3615 Affects authoritative server operators who wish to generally restrict queries to their authoritative zones, and are running 9.6.2-P2 or any version of 9.7.x. The bug will allow unauthorized end users to receive answers to queries they should not. 3. Key algorithm rollover http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3614 Affects resolver operators who have 9.7.2-P2 installed, are validating with DNSSEC, and querying zones which are in a key rollover period. The bug will cause answers to incorrectly be marked as insecure. For the port: 1. Add CONFLICT for the ../bind-tools port 2. Switch to pkg-install to create the symlinks to /etc/namedb/ as requested in [1] PR: ports/151635 [1] Submitted by: Benjamin Lee <ben@b1c1l1.com> [1] Notes: svn path=/head/; revision=265648
* Convert this to a master port for ../bind-toolsDoug Barton2010-12-032-16/+15
| | | | | | | | | | | Remove CONFLICTS for the now-removed BIND 9.3 Remove OPTION for threads on < RELENG_7 Remove MD5 from distinfo Notes: svn path=/head/; revision=265635
* Update to 9.7.2-P2, the latest version from ISCDoug Barton2010-10-182-8/+8
| | | | Notes: svn path=/head/; revision=263212
* Updgrade to version 9.7.1-P2 which addresses a DNSSEC-related bug.Doug Barton2010-07-172-8/+8
| | | | | | | | | | | | | | | | | | | | | If a query is made explicitly for a record of type 'RRSIG' to a validating recursive server running BIND 9.7.1 or 9.7.1-P1, and the server has one or more trust anchors configured statically and/or via DLV, then if the answer is not already in cache, the server enters a loop which repeatedly generates queries for RRSIGs to the authoritative servers for the zone containing the queried name. CVE: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0213 CERT: http://www.kb.cert.org/vuls/id/211905 Versions affected: 9.7.1, 9.7.1-P1 Severity: High Exploitable: remotely http://www.isc.org/software/bind/advisories/cve-2010-0213 Notes: svn path=/head/; revision=257883
* Upgrade to version 9.7.1-P1. The patch addresses 2 areas in the resolverDoug Barton2010-07-102-8/+8
| | | | | | | | | | | | | | | | | | code where the 9.7.x series tightened its adherence to the DNS protocol as written, vs. the 9.6.x series which was more liberal in what it accepted. Specifically: 1. Restore processing of certain forms of negative responses that do not contain all of the required elements to avoid aggressive re-querying of authority servers. 2. Accept answers from authority servers without the AA bit set if they meet the other requirements of an answer packet. More detail can be found here: https://www.isc.org/community/blog/201007/compatibility-issues-bind-970-and-971 Notes: svn path=/head/; revision=257622
* Turns out that the bind.keys.h file is not a new dependency, so my previousDoug Barton2010-06-182-53/+4
| | | | | | | | | | | | | fix was too hasty. Employ a more robust fix that removes the _perl_ dep for both this file and bind9.xsl.h. The pre-generated versions of these files are identical to the newly generated ones, which is why this perl issue never came up previously. I still have reservations about baking the ISC DLV key into named, but given that this was already done in 9.7.0+ at least this way we don't violate POLA. Notes: svn path=/head/; revision=256641
* The newly added bind.keys.h file requires perl for its creation,Doug Barton2010-06-181-0/+53
| | | | | | | | | | | | which is a problem, however what it's doing is baking the ISC DLV key into named which is not something I think is reasonable to do by default. So, instead of adding perl as a build dependency eliminate the need for the file altogether. Notes: svn path=/head/; revision=256639
* Update to version 9.7.1, the latest from ISC.Doug Barton2010-06-172-8/+8
| | | | | | | | | | This version has numerous minor bug fixes, please refer to the CHANGES file for details. Many (but not all) of the fixes are DNSSEC-related, and all users who are doing DNSSEC validation are encouraged to upgrade to this version. Notes: svn path=/head/; revision=256633
* Update to the latest patch set from ISC, which addresses the following:Doug Barton2010-05-202-8/+8
| | | | | | | | Named could return SERVFAIL for negative responses from unsigned zones. Notes: svn path=/head/; revision=254632
* Update to the latest patchfix releases to deal with the problemsDoug Barton2010-03-172-8/+8
| | | | | | | | | | | related to the handling of broken DNSSEC trust chains. This fix is only necessary for those who have DNSSEC validation enabled and configure trust anchors from third parties, either manually, or through a system like DLV. Notes: svn path=/head/; revision=251154
* Update to the release version of BIND 9.7.0, and remove the -develDoug Barton2010-02-174-14/+8
| | | | | | | | | suffix as a result. Feature safe: yes Notes: svn path=/head/; revision=249992
* Update to 9.7.0rc2 which has numerous bug fixes, especiallyDoug Barton2010-02-013-8/+11
| | | | | | | for DNSSEC. Notes: svn path=/head/; revision=249052
* Disable the (optional, debugging) symtable feature till I can figureDoug Barton2009-12-141-0/+1
| | | | | | | out the depth of the perl dependency. Notes: svn path=/head/; revision=245759
* Add BIND 9.7.0rc1 with a -devel suffix for now so that people canDoug Barton2009-12-145-0/+558
start testing it sooner rather than later. When the final version is released the -devel will be removed. Some of the new features of BIND 9.7.x are: - Fully automatic signing of zones by "named" - Simplified configuration of DNSSEC Lookaside Validation (DLV) - Simplified configuration of Dynamic DNS, using the "ddns-confgen" command line tool or the "local" update-policy option - New named option "attach-cache" that allows multiple views to share a single cache - DNS rebinding attack prevention - New default values for dnssec-keygen parameters - Support for RFC 5011 automated trust anchor maintenance (see README.rfc5011 for additional details) - Smart signing: simplified tools for zone signing and key maintenance - Improved PKCS#11 support Notes: svn path=/head/; revision=245754
generated by cgit v1.2.3 (git 2.25.1) at 2024-10-28 17:26:14 +0000