FreeBSD source tree https://cgit-dev.freebsd.org/src/atom?h=releng%2F9.3 2014-03-03T09:18:19Z 2014-03-03T09:18:19Z Erwin Lansing erwin@FreeBSD.org 2014-03-03T09:18:19Z urn:sha1:f23f6c46d9a70ab33525f99cd97770347383a6f9 Update BIND to 9.9.5 Release note: https://lists.isc.org/pipermail/bind-announce/2013-September/000871.html https://lists.isc.org/pipermail/bind-announce/2014-January/000896.html Note this is a commit straight to stable as BIND no longer exists in head. Sponsored by: DK Hostmaster A/S 2013-08-26T07:17:41Z Erwin Lansing erwin@FreeBSD.org 2013-08-26T07:17:41Z urn:sha1:87311eaba15a074313643f3d3bb28ba8bb3da606 Update Bind to 9.9.3-P2 Notable new features: * Elliptic Curve Digital Signature Algorithm keys and signatures in DNSSEC are now supported per RFC 6605. [RT #21918] * Introduces a new tool "dnssec-verify" that validates a signed zone, checking for the correctness of signatures and NSEC/NSEC3 chains. [RT #23673] * BIND now recognizes the TLSA resource record type, created to support IETF DANE (DNS-based Authentication of Named Entities) [RT #28989] * The new "inline-signing" option, in combination with the "auto-dnssec" option that was introduced in BIND 9.7, allows named to sign zones completely transparently. Approved by: delphij (mentor) Sponsored by: DK Hostmaster A/S 2013-08-16T07:11:13Z Erwin Lansing erwin@FreeBSD.org 2013-08-16T07:11:13Z urn:sha1:6d8de010e370899d0115eaf0353c6990a308d79a Update Bind to 9.8.5-P2 New Features Adds a new configuration option, "check-spf"; valid values are "warn" (default) and "ignore". When set to "warn", checks SPF and TXT records in spf format, warning if either resource record type occurs without a corresponding record of the other resource record type. [RT #33355] Adds support for Uniform Resource Identifier (URI) resource records. [RT #23386] Adds support for the EUI48 and EUI64 RR types. [RT #33082] Adds support for the RFC 6742 ILNP record types (NID, LP, L32, and L64). [RT #31836] Feature Changes Changes timing of when slave zones send NOTIFY messages after loading a new copy of the zone. They now send the NOTIFY before writing the zone data to disk. This will result in quicker propagation of updates in multi-level server structures. [RT #27242] "named -V" can now report a source ID string. (This is will be of most interest to developers and troubleshooters). The source ID for ISC's production versions of BIND is defined in the "srcid" file in the build tree and is normally set to the most recent git hash. [RT #31494] Response Policy Zone performance enhancements. New "response-policy" option "min-ns-dots". "nsip" and "nsdname" now enabled by default with RPZ. [RT #32251] Approved by: delphij (mentor) Sponsored by: DK Hostmaster A/S 2013-01-08T09:05:09Z Erwin Lansing erwin@FreeBSD.org 2013-01-08T09:05:09Z urn:sha1:bb4df1c0b48860b488548a6bd1bdf67c2261bc55 Update to 9.8.4-P1. New Features * Elliptic Curve Digital Signature Algorithm keys and signatures in DNSSEC are now supported per RFC 6605. [RT #21918] Feature Changes * Improves OpenSSL error logging [RT #29932] * nslookup now returns a nonzero exit code when it is unable to get an answer. [RT #29492] Other critical bug fixes are included. Approved by: delphij (mentor) Sponsored by: DK Hostmaster A/S 2011-07-16T11:20:54Z Doug Barton dougb@FreeBSD.org 2011-07-16T11:20:54Z urn:sha1:25630ba729c2d175add02aae3bf5bc66a89d2e3e This includes a structural change regarding atomic ops. Previously they were enabled on all platforms unless we had knowledge that they did not work. However both work performed by marius@ on sparc64 and the fact that the 9.8.x branch is fussier in this area has demonstrated that this is not a safe approach. So I've modified a patch provided by marius to enable them for i386, amd64, and ia64 only. 2011-02-06T22:46:07Z Doug Barton dougb@FreeBSD.org 2011-02-06T22:46:07Z urn:sha1:5143adb5490e2ce9f3b7d74307c8f70197df2afe All 9.6 users with DNSSEC validation enabled should upgrade to this version, or the latest version in the 9.7 branch, prior to 2011-03-31 in order to avoid validation failures for names in .COM as described here: https://www.isc.org/announcement/bind-9-dnssec-validation-fails-new-ds-record In addition the fixes for this and other bugs, there are also the following: * Various fixes to kerberos support, including GSS-TSIG * Various fixes to avoid leaking memory, and to problems that could prevent a clean shutdown of named 2010-10-31T04:45:25Z Doug Barton dougb@FreeBSD.org 2010-10-31T04:45:25Z urn:sha1:031f70f09fe6ab44525dc332810447918f9e7029 2009-05-31T05:42:58Z Doug Barton dougb@FreeBSD.org 2009-05-31T05:42:58Z urn:sha1:6318052d9e161cbc69e4085125ef824d94de16ef lots of new features compared to 9.4.x, including: Full NSEC3 support Automatic zone re-signing New update-policy methods tcp-self and 6to4-self DHCID support. More detailed statistics counters including those supported in BIND 8. Faster ACL processing. Efficient LRU cache-cleaning mechanism. NSID support. 2009-05-30T23:50:12Z Doug Barton dougb@FreeBSD.org 2009-05-30T23:50:12Z urn:sha1:9097ac2a7ff12d10a4bb41b10496fdce85cadfae The libbind library is no longer distributed as part of the main BIND package, and we never built it in any case. 2008-12-23T22:50:39Z Doug Barton dougb@FreeBSD.org 2008-12-23T22:50:39Z urn:sha1:d851678b62e36caf6ab968dcf3b43c09378e1b57