1
0
mirror of https://git.FreeBSD.org/ports.git synced 2024-12-05 01:55:52 +00:00
Commit Graph

115 Commits

Author SHA1 Message Date
Doug Barton
54465f3762 Update the hashes of the PGP signature files for the new releases.
The previous signatures were derived from the wrong key.
The new signatures all verify correctly.

No changes to the hashes for the software itself.
2009-07-29 18:23:41 +00:00
Doug Barton
bb1cfdfe1f Update to patched versions which address a remote DoS vulnerability:
Receipt of a specially-crafted dynamic update message may
	cause BIND 9 servers to exit. This vulnerability affects all
	servers -- it is not limited to those that are configured to
	allow dynamic updates. Access controls will not provide an
	effective workaround.

More details can be found here: https://www.isc.org/node/474

All BIND users are encouraged to update to a patched version ASAP.
2009-07-28 22:13:34 +00:00
Pav Lucistnik
6d3f66735b - Flip from MAKE_JOBS_SAFE to MAKE_JOBS_UNSAFE, fails both on pointyhat and on
my local machine
2009-04-12 21:33:23 +00:00
Doug Barton
389960986f Fix CONFLICTS (again). The previous example didn't work at all for ports
other than plain bind9 since the real PORTNAMEs for the other ports are
bind9[456]. This fix has the added advantage of covering REPLACE_BASE.
2009-03-24 20:00:21 +00:00
Doug Barton
d31cadffee Where it matters, update regarding MAKE_JOBS_{UN}SAFE for my ports 2009-03-24 19:51:28 +00:00
Doug Barton
4713640f13 BIND 9.4.3-P2 is a SECURITY patch for BIND 9.4.3. It addresses a bug
in DNSSEC lookaside validation (DLV): unrecognized signature algorithms,
which should have been treated as the equivalent of an unsigned zone,
were instead treated as a validation failure.
2009-03-21 20:40:07 +00:00
Doug Barton
0a1b168539 Update to the -P1 versions of the current BIND ports which contain
the fix for the following vulnerability: https://www.isc.org/node/373

Description:
Return values from OpenSSL library functions EVP_VerifyFinal()
and DSA_do_verify() were not checked properly.

Impact:
It is theoretically possible to spoof answers returned from
zones using the DNSKEY algorithms DSA (3) and NSEC3DSA (6).

In short, if you're not using DNSSEC to verify signatures you have
nothing to worry about.

While I'm here, address the issues raised in the PR by adding a knob
to disable building with OpenSSL altogether (which eliminates DNSSEC
capability), and fix the configure arguments to better deal with the
situation where the user has ssl bits in both the base and LOCALBASE.

PR:		ports/126297
Submitted by:	Ronald F.Guilmette <rfg@tristatelogic.com>
2009-01-08 08:18:45 +00:00
Doug Barton
c288151fe5 Update CONFLICTS to reflect the addition of the bind96 port,
the demise of bind9-dlz, and updates to the bind9-sdb-* ports.
2009-01-04 07:26:28 +00:00
Doug Barton
2af736c195 9.4.3 adds one additional file in doc/misc 2008-12-19 22:13:28 +00:00
Doug Barton
1876a0203b Update to version 9.4.3 which contains numerous bug fixes.
This version also includes the use-v[46]-udp-ports options to configure
a range of random UDP ports to initiate queries from.
2008-12-19 21:40:19 +00:00
Doug Barton
71222d4392 This patch is no longer relevant, it has been included in version 9.4.3 2008-12-19 21:35:13 +00:00
Doug Barton
338244c44d Adjust WWWs for new ISC website 2008-12-19 21:18:27 +00:00
Doug Barton
6ed39ee6e5 All -P2 versions now have PGP signatures with ISC's standard
signing key.

PR:		ports/126389 (for bind9)
Submitted by:	Tsurutani Naoki <turutani@scphys.kyoto-u.ac.jp>
2008-08-09 07:23:35 +00:00
Doug Barton
da42c80ed9 Update to patchlevel 2 for all versions:
- performance improvement over the P1 releases, namely
   + significantly remedying the port allocation issues
   + allowing TCP queries and zone transfers while issuing as many
      outstanding UDP queries as possible
   + additional security of port randomization at the same level as P1

- also includes fixes for several bugs in the 9.5.0 base code
2008-08-02 07:01:20 +00:00
Doug Barton
79ba42d10b Add an OPTION to turn on the ability of dns/host/nslookup to do
DNSSEC validation.

This is off by default, so no PORTREVISION bump.

Submitted by:	Andrei V. Lavreniyuk <andy.lavr@reactor-xg.kiev.ua>
2008-07-16 20:39:24 +00:00
Doug Barton
e849102db7 Bump PORTREVISION for the patch to named-checkconf
Add the logic for the THREADS OPTION to be on for 7-RELEASE and above
(and off otherwise) that I'm using in dns/bind95
2008-07-11 19:07:17 +00:00
Doug Barton
35eb96538b Add a patch to fix named-checkconf. The error condition was not being
properly tested for, so it would not report the error in some cases.

Thanks to marck@FreeBSD and mark@ISC for tracking this one down.
2008-07-11 19:05:41 +00:00
Doug Barton
ab54e43037 Upgrade to the -P1 versions of each port, which add stronger randomization
of the UDP query-source ports. The server will still use the same query
port for the life of the process, so users for whom the issue of cache
poisoning is highly significant may wish to periodically restart their
server using /etc/rc.d/named restart, or other suitable method.

In order to take advantage of this randomization users MUST have an
appropriate firewall configuration to allow UDP queries to be sent and
answers to be received on random ports; and users MUST NOT specify a
port number using the query-source[-v6] option.

The avoid-v[46]-udp-ports options exist for users who wish to eliminate
certain port numbers from being chosen by named for this purpose. See
the ARM Chatper 6 for more information.

Also please note, this issue applies only to UDP query ports. A random
ephemeral port is always chosen for TCP queries.

This issue applies primarily to name servers whose main purpose is to
resolve random queries (sometimes referred to as "caching" servers, or
more properly as "resolving" servers), although even an "authoritative"
name server will make some queries, primarily at startup time.

This update addresses issues raised in:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447
http://www.kb.cert.org/vuls/id/800113
http://tools.ietf.org/html/draft-ietf-dnsext-forgery-resilience
2008-07-09 19:02:01 +00:00
Doug Barton
6321276ecb Update CONFLICTS:
1. To take bind95 into account
2. s/bind9-sdb-ldap/bind9-sdb-mysql/
3. Delete references to BIND 8
2008-07-04 15:43:37 +00:00
Doug Barton
9f92d93730 Update the pkg-message to be even less version-specific, and tell the user
that /etc/rc.d/named will handle everything for them.
2008-06-02 04:18:45 +00:00
Doug Barton
538afbc5ce Fix pkg-plist by including a new file.
Pointy hat number N:M (where M = many) goes to:	dougb
Approved by:	portmgr (erwin)
2007-12-05 00:44:01 +00:00
Doug Barton
53fb30ab2d ISC recently announced that BIND 8 has been End-of-Life'd:
http://www.isc.org/index.pl?/sw/bind/bind8-eol.php

Therefore, per the previous announcement, remove the ports for BIND 8.
This includes the chinese/bind8 slave port, and mail/smc-milter which
has a dependency on libbind_r.a from BIND 8.x. The latter has been
unmaintained since 2005, and is 3 versions behind.

Approved by:	portmgr (linimon)
2007-12-03 09:43:44 +00:00
Doug Barton
5920e1781c Update to BIND 9.4.2. Many bugs are fixed, please see the CHANGES
file for more details.

Approved by:	portmgr (erwin)
2007-12-01 21:53:34 +00:00
Doug Barton
83aa56c48f Update to 9.4.1-P1, which has fixes for the following:
1. The default access control lists (acls) are not being
correctly set. If not set anyone can make recursive queries
and/or query the cache contents.

See also:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2925

2. The DNS query id generation is vulnerable to cryptographic
analysis which provides a 1 in 8 chance of guessing the next
query id for 50% of the query ids. This can be used to perform
cache poisoning by an attacker.

This bug only affects outgoing queries, generated by BIND 9 to
answer questions as a resolver, or when it is looking up data
for internal uses, such as when sending NOTIFYs to slave name
servers.

All users are encouraged to upgrade.

See also:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2926
2007-07-24 22:02:16 +00:00
Rong-En Fan
f935a609c5 - Set --mandir and --infodir in CONFIGURE_ARGS if the configure script
supports them.  This is determined by running ``configure --help'' in
  do-configure target and set the shell variable _LATE_CONFIGURE_ARGS
  which is then passed to CONFIGURE_ARGS.
- Remove --mandir and --infodir in ports' Makefile where applicable
  Few ports use REINPLACE_CMD to achieve the same effect, remove them too.
- Correct some manual pages location from PREFIX/man to MANPREFIX/man
- Define INFO_PATH where necessary
- Document that .info files are installed in a subdirectory relative to
  PREFIX/INFO_PATH and slightly change add-plist-info to use INFO_PATH and
  subdirectory detection.

PR:		ports/111470
Approved by:	portmgr
Discussed with:	stas (Mk/*), gerald (info related stuffs)
Tested by:	pointyhat exp run
2007-07-23 09:36:51 +00:00
Doug Barton
086ad81b2c Update to version 9.4.1, a security update from ISC:
2172.   [bug]       query_addsoa() was being called with a non zone db.
                    [RT #16834]

	If you are running BIND 9.4.0 (either pre-release or final),
	you are advised to upgrade as soon as possible to BIND 9.4.1.
2007-05-01 01:00:01 +00:00
Doug Barton
d192a302c6 Update to the release version of 9.4.0. 2007-02-26 07:57:58 +00:00
Doug Barton
79a046498a Complete the update for bind94 after the repocopy, and hook it up. 2007-01-28 22:45:54 +00:00
Doug Barton
b7bd298280 Upgrade to version 9.3.4, the latest from ISC, which addresses the
following security issues. All users of BIND are encouraged to upgrade
to this version.

2126.	[security]	Serialise validation of type ANY responses. [RT #16555]

2124.	[security]	It was possible to dereference a freed fetch
			context. [RT #16584]

2089.	[security]	Raise the minimum safe OpenSSL versions to
			OpenSSL 0.9.7l and OpenSSL 0.9.8d.  Versions
			prior to these have known security flaws which
			are (potentially) exploitable in named. [RT #16391]

2088.	[security]	Change the default RSA exponent from 3 to 65537.
			[RT #16391]

2066.   [security]      Handle SIG queries gracefully. [RT #16300]

1941.   [bug]           ncache_adderesult() should set eresult even if no
                        rdataset is passed to it. [RT #15642]
2007-01-25 01:57:42 +00:00
Doug Barton
d276d76128 Apply the markup fixes from the base to the nsupdate.8 and
nslookup.1 man pages.
2006-12-21 08:49:20 +00:00
Doug Barton
4dc8dde88e Upgrade to version 9.3.3, the latest from ISC. This is
a maintenance release, with the usual round of bug and
security fixes.

All users of BIND 9 are encouraged to upgrade to this
version.
2006-12-09 22:20:38 +00:00
Doug Barton
49b20cc2f2 Update to version 9.3.2-P2, which addresses the vulnerability
announced by ISC dated 31 October (delivered via e-mail to the
bind-announce@isc.org list today):

Description:
	Because of OpenSSL's recently announced vulnerabilities
	(CAN-2006-4339, CVE-2006-2937 and CVE-2006-2940) which affect named,
	we are announcing this workaround and releasing patches.  A proof of
	concept attack on OpenSSL has been demonstrated for CAN-2006-4339.

	OpenSSL is required to use DNSSEC with BIND.

Fix for version 9.3.2-P1 and lower:
	Upgrade to BIND 9.2.3-P2, then generate new RSASHA1 and
	RSAMD5 keys for all old keys using the old default exponent
	and perform a key rollover to these new keys.

	These versions also change the default RSA exponent to be
	65537 which is not vulnerable to the attacks described in
	CAN-2006-4339.
2006-11-03 07:47:21 +00:00
Doug Barton
e1099e8d62 Upgrade to version 9.3.2-P1, which addresses the following security
vulnerabilities:

http://www.niscc.gov.uk/niscc/docs/re-20060905-00590.pdf?lang=en
2066.  [security]      Handle SIG queries gracefully. [RT #16300]

http://www.kb.cert.org/vuls/id/697164
1941.  [bug]           ncache_adderesult() should set eresult even if no
                       rdataset is passed to it. [RT #15642]

All users of BIND 9 are encouraged to upgrade to this version.
2006-09-06 18:42:40 +00:00
Doug Barton
f7b8b9e6a3 Add OPTIONS to the rest of my ports that need them.
Add CONFLICTS to the bind* ports.
2006-08-28 06:03:13 +00:00
Edwin Groothuis
e33233f948 Replace ugly "@unexec rmdir %D... 2>/dev/null || true" with @dirrmtry
Approved by:    krion@
PR:             ports/88711 (related)
2006-01-22 01:55:36 +00:00
Doug Barton
cf2106bfeb Update to 9.3.2, the latest from ISC 2005-12-28 01:07:22 +00:00
Doug Barton
9bca1fdf04 Move the verify target after pre-fetch. 2005-12-06 09:36:48 +00:00
Doug Barton
2a60dce585 Committed the wrong version ... s#/usr/local#${LOCALBASE}# 2005-11-27 01:11:31 +00:00
Doug Barton
64bab3473c Fix a long-standing problem that appears when users install
openssl from ports, and do not use the option to have the port
version overwrite the base version.

Several folks have mentioned this problem in the past, but a
good workaround (and more importantly, solid testing) were
provided by the submitter.

Submitted by:	Uffe Vedenbrant <uffe@vedenbrant.se>
2005-11-27 01:03:06 +00:00
Doug Barton
622fd39b2a Add SHA256 checksums to my ports 2005-11-24 00:08:51 +00:00
Doug Barton
cfda064524 For the ports that I maintain, do the following as appropriate:
1. Add myself as a backup master site (Sourceforge and CPAN ports
already have good enough coverage, so skip them).
2. For all ports that have them, download the PGP signature files.
3. For ports in 2, add a verify target to the Makefile
4. For ports where I was already providing a master site, update the URL.
5. Pet portlint in a couple of places.
2005-10-29 07:13:29 +00:00
Doug Barton
700756844d This issue was researched by glebius, and this patch was
incorporated by ISC into the next version of BIND.

The patch addresses a problem with high-load resolvers which
hit memory barriers. Without this patch, running the resolving
name server out of memory would lead to "unpredictable results."

Of course, the canonical answer to this problem is to put more
memory into the system, however that is not always possible, and
the code should be able to handle this situation gracefully in
any case.

Approved by:	portmgr (krion)
2005-08-18 19:12:08 +00:00
Doug Barton
6d4b4b627b ISC staff has informed me that in BIND 9.3.x, threads are always a
bad idea, so disable them in all cases unless the user has
affirmatively requested this through the define.
2005-06-29 08:10:25 +00:00
Doug Barton
96dbf2741c 1. The OPTIONS stuff isn't working the way it should according to reports,
so rip it out until I have a chance to debug it.

2. Improve the comment about deprecating an old knob.
2005-03-17 07:07:51 +00:00
Doug Barton
8f80a0e30e Upgrade to 9.3.1, the latest version from ISC. This version contains
several important fixes, including a remote (although unlikely) exploit.
See the CHANGES file for details.

All users of BIND 9 are highly encouraged to upgrade to this version.

Changes to the port include:
1. Remove ISC patch to 9.3.0 that addressed the remote exploit
2. Change to OPTIONS, and thereby
3. --enable-threads is now the default. Users report that the new thread
code in 9.3.x works significantly better than the old on all versions of
FreeBSD.
4. Add a temporary shim for the old PORT_REPLACES_BASE_BIND9 option.
The OPTIONS framework requires knobs to start with WITH_ or WITHOUT_
5. Remove patch that shoehorned named.conf.5 into the right place,
it has been fixed in the code.
2005-03-13 10:52:52 +00:00
Doug Barton
400315c158 Include a patch from ISC to deal with the following vulnerability:
Name:			BIND: Self Check Failing [Added 2005.25.01]
Versions affected:	BIND 9.3.0
Severity:		LOW
Exploitable:		Remotely
Type:			Denial of Service
Description:
An incorrect assumption in the validator (authvalidated) can result in a
REQUIRE (internal consistancy) test failing and named exiting.

Workarounds:
Turn off dnssec validation (off by default) at the options/view level.

	dnssec-enable no;

Active Exploits:	None known

Bump PORTREVISION accordingly.

It should be noted that the vast majority of users would not have
DNSSEC enabled, and therefore are not vulnerable to this bug.
2005-01-28 20:47:44 +00:00
Doug Barton
48ccb4f2c8 The parens around the OSVERSION test were fatal for < 4.9, and did not
provide anything useful for newer systems, so remove them.

PR:		ports/72118
Submitted by:	Michel Lavondes <fox@vader.aacc.cc.md.us>
Approved by:	portmgr (eik)
2004-09-27 04:43:55 +00:00
Doug Barton
d4984bf979 Update to BIND 9.3.0, the latest from ISC. This version has several
significant updates, not the least of which is the new and improved
DNSSEC code based on the latest standards (including DS).

Various updates to the port, including:
1. Download the PGP signature
2. If running on ${OSVERSION} >= 503000, configure with threads
3. Update pkg-descr re IPv6 RRs
4. Update pkg-message to reflect a world with 6-current

There is also a patch to correct a man page installation error.
This problem should be fixed in the next release.

Approved by:	portmgr (marcus)
2004-09-24 04:03:31 +00:00
Doug Barton
c2809c490a The ringserver sites don't have the latest BIND 9.
Submitted by:	fenner's distfile survey
2004-04-04 06:19:46 +00:00
Doug Barton
23f07f556e DISTNAME is a slightly less painful way of dealing with wacky
version numbers.
2004-03-14 23:06:52 +00:00