openssl from ports, and do not use the option to have the port
version overwrite the base version.
Several folks have mentioned this problem in the past, but a
good workaround (and more importantly, solid testing) were
provided by the submitter.
Submitted by: Uffe Vedenbrant <uffe@vedenbrant.se>
1. Add myself as a backup master site (Sourceforge and CPAN ports
already have good enough coverage, so skip them).
2. For all ports that have them, download the PGP signature files.
3. For ports in 2, add a verify target to the Makefile
4. For ports where I was already providing a master site, update the URL.
5. Pet portlint in a couple of places.
incorporated by ISC into the next version of BIND.
The patch addresses a problem with high-load resolvers which
hit memory barriers. Without this patch, running the resolving
name server out of memory would lead to "unpredictable results."
Of course, the canonical answer to this problem is to put more
memory into the system, however that is not always possible, and
the code should be able to handle this situation gracefully in
any case.
Approved by: portmgr (krion)
several important fixes, including a remote (although unlikely) exploit.
See the CHANGES file for details.
All users of BIND 9 are highly encouraged to upgrade to this version.
Changes to the port include:
1. Remove ISC patch to 9.3.0 that addressed the remote exploit
2. Change to OPTIONS, and thereby
3. --enable-threads is now the default. Users report that the new thread
code in 9.3.x works significantly better than the old on all versions of
FreeBSD.
4. Add a temporary shim for the old PORT_REPLACES_BASE_BIND9 option.
The OPTIONS framework requires knobs to start with WITH_ or WITHOUT_
5. Remove patch that shoehorned named.conf.5 into the right place,
it has been fixed in the code.
Name: BIND: Self Check Failing [Added 2005.25.01]
Versions affected: BIND 9.3.0
Severity: LOW
Exploitable: Remotely
Type: Denial of Service
Description:
An incorrect assumption in the validator (authvalidated) can result in a
REQUIRE (internal consistancy) test failing and named exiting.
Workarounds:
Turn off dnssec validation (off by default) at the options/view level.
dnssec-enable no;
Active Exploits: None known
Bump PORTREVISION accordingly.
It should be noted that the vast majority of users would not have
DNSSEC enabled, and therefore are not vulnerable to this bug.
provide anything useful for newer systems, so remove them.
PR: ports/72118
Submitted by: Michel Lavondes <fox@vader.aacc.cc.md.us>
Approved by: portmgr (eik)
significant updates, not the least of which is the new and improved
DNSSEC code based on the latest standards (including DS).
Various updates to the port, including:
1. Download the PGP signature
2. If running on ${OSVERSION} >= 503000, configure with threads
3. Update pkg-descr re IPv6 RRs
4. Update pkg-message to reflect a world with 6-current
There is also a patch to correct a man page installation error.
This problem should be fixed in the next release.
Approved by: portmgr (marcus)
I realize that my error in version numbering previously caused some confusion
about 9.2.3 being a more up to date version than 9.2.3.4, but this will quickly
be resolved with the next version, and affected only a few users who installed
the release candidate. The portepoch change is permanent, and perpetuates a
silly kludge for no good reason.
Please do not change this again without discussing it with me.
The 9.2.3 code has many many bugs fixed from 9.2.2, check CHANGES
for more information.
The rc4 code has the delegation-only options. Check the ARM for
information on how to enable it.
is widely considered to be more stable than 9.2.1. I would have preferred
a -REL version, but better is better.
* Clean up the Makefile a little
* Just say no to threads
* Add the PORT_REPLACES_BASE magic, similar to the bind8 port
In my previous commit I forgot to mention that 'pkg_add -r bind' is
only half the rationale for changing PORTNAME. The other half is so
that people who really want to can 'pkg_add -r bind9'.
are fixed in this version, however BIND 9 is still recommended only
for early adopters, and those that have time to closely monitor
their name service.
* Change PORTNAME to bind9 so that 'pkg_add -r bind' does the right thing
* Use the local version of openssl, and disable threads on all but
the most recent -current. Thread support is still considered experimental.
to make the location of etc/ files prefix-safe. Install a sample
rndc.conf file. Since rndc won't start without one the user should have
an example to work from. Add the installation of various docs wrapped
in a NOPORTDOCS test.
Last but not least, add a patch that turns off the debugging code ISC
left on by default. This should help solve the problems with
misbehaving assert's, related to nmap and other causes.
