- Add EUI_RRTYPES option
While here:
- Remove leading article from COMMENT
- Convert tab to space in WWW: line
PR: ports/180741
Submitted by: Jaap Akkerhuis <jaap@NLnetLabs.nl> (maintainer)
changelog:
- 1.11.0 is mostly a bug fix release, but two new features are support
for the $GENERATE syntax and the TLSA RR type.
- A number of bugs have been fixed as well.
- Python 2.4 or later is required.
- Change pkgconfig:build to pkgconfig since it's the same and it's bad practice.
It accidentally slipped in during the original introduction
- Trim header
It consists of a client that regularly sends UDP packets and a
server that updates a bind zone file or runs a command using the
peer IPv4 address of recieved UDP packets.
WWW: http://fossil.instinctive.eu/ddns/home
PR: ports/179316
Submitted by: Natacha Porte <natbsd@instinctive.eu>
Security Fixes
Prevents exploitation of a runtime_check which can crash named
when satisfying a recursive query for particular malformed zones.
(CVE-2013-3919) [RT #33690]
Now supports NAPTR regular expression validation on all platforms,
and avoids memory exhaustion compiling pathological regular
expressions. (CVE-2013-2266) [RT #32688]
Prevents named from aborting with a require assertion failure
on servers with DNS64 enabled. These crashes might occur as a
result of specific queries that are received. (CVE-2012-5688)
[RT #30792 / #30996]
Prevents an assertion failure in named when RPZ and DNS64 are
used together. (CVE-2012-5689) [RT #32141]
See release notes for further features and bug fixes:
https://kb.isc.org/article/AA-00970/0/BIND-9.9.3-P1-Extended-Support-Version-Release-Notes.html
Security: CVE-2013-3919
CVE-2013-2266
CVE-2012-5688
CVE-2012-5689
Security Fixes
Prevents exploitation of a runtime_check which can crash named
when satisfying a recursive query for particular malformed zones.
(CVE-2013-3919) [RT #33690]
A deliberately constructed combination of records could cause
named to hang while populating the additional section of a
response. (CVE-2012-5166) [RT #31090]
Now supports NAPTR regular expression validation on all platforms,
and avoids memory exhaustion compiling pathological regular
expressions. (CVE-2013-2266) [RT #32688]
Prevents named from aborting with a require assertion failure
on servers with DNS64 enabled. These crashes might occur as a
result of specific queries that are received. (CVE-2012-5688)
[RT #30792 / #30996]
Prevents an assertion failure in named when RPZ and DNS64 are
used together. (CVE-2012-5689) [RT #32141]
See release notes for further features and bug fixes:
https://kb.isc.org/article/AA-00969/0/BIND-9.8.5-P1-Release-Notes.html
Security: CVE-2013-3919
CVE-2012-5166
CVE-2013-2266
CVE-2012-5688
CVE-2012-5689
Security Fixes
Prevents exploitation of a runtime_check which can crash named
when satisfying a recursive query for particular malformed zones.
(CVE-2013-3919) [RT #33690]
Prevents a named assert (crash) when validating caused by using
"Bad cache" data before it has been initialized. [CVE-2012-3817]
[RT #30025]
A condition has been corrected where improper handling of
zero-length RDATA could cause undesirable behavior, including
termination of the named process. [CVE-2012-1667] [RT #29644]
See release notes for further features and bug fixes:
https://kb.isc.org/article/AA-00968/0/BIND-9.6-ESV-R9-P1-Release-Notes.html
Security: CVE-2013-3919
CVE-2012-3817
CVE-2012-1667
- address the issue raised by Bob Harold. RRL on recursive servers
applies rate limits after waiting for recursion except on
sub-domains of domains for which the server is authoritative.
- fix the bug reported by Roy Arends in which "slipped" NXDOMAIN
responses had rcode values of 0 (NoError) instead of 3 (NXDOMAIN).
- move reports of RRL drop and slip actions from the "queries"
log category to the "query-errors" category. Because they are not
in the "queres" category, enabling or disabling query logging no
longer affects them.
Changelog is here:
http://doc.powerdns.com/html/changelog.html#changelog-recursor-3.5.1
Also pet the Makefile:
- Change ${LOCALBASE} to ${PREFIX} where applicable
- Fix overwrite of recursor.conf by changing to bsd.port.pre/post.mk (and
thus fixing ${PREFIX})
PR: ports/178340
Submitted by: Ralf van der Enden <tremere@cainites.net>
Approved by: Sten Spans <sten@blinkenlights.nl> (maintainer)
for domain name registries/registrars/resellers
what Perl DBI is for databases.
Net::DRI offers a uniform API to access services.
It can be used by registrars to access registries.
It can be used by clients to access registrars and/or resellers.
It can be used by anonyone to do whois, DAS or IRIS DCHK queries.
WWW: http://search.cpan.org/dist/Net-DRI/
PR: ports/178298
Submitted by: Mark Felder <feld@feld.me>
This is done in a similar manner as the old bind-tools, but uses bind99
instead of bind97 as master port.
Change bind99 to facilitate the bind-tools slave, in a simlar way as was
done for bind97.
Approved by: erwin (maintainer)
The change makes "slip 1;" send only truncated (TC=1) responses.
Without the change, "slip 1;" is the same as the default of "slip 2;".
That default, which alternates truncated with dropped responses
when the rate limit is exceeded, is better for authoritative DNS
servers, because it further reduces the amplification of an attack
from about 1X to about 0.5X.
DNS RRL is not recommended for recursive servers.
Feature safe: yes
Removed the check for regex.h in configure in order
to disable regex syntax checking, as it exposes
BIND to a critical flaw in libregex on some
platforms. [RT #32688]
Security: CVE-2013-2266
Removed the check for regex.h in configure in order
to disable regex syntax checking, as it exposes
BIND to a critical flaw in libregex on some
platforms. [RT #32688]
Security: CVE-2013-2266
console/service/daemon dynamic DNS client.
It gives the possibility to have your own fixed hostname registered on the
internet, although your IP might be changing. It checks periodically whether
the IP address stored by the DNS server is the real current IP address of the
machine that is running it.
WWW: http://sourceforge.net/projects/inadyn-mt/
PR: ports/177149
Submitted by: William Grzybowski <william88@gmail.com>
working files that should not have been in the patches[1]
Also move to a versioned filename for the patches[2]
Submitted by: Robert Sargent <robtsgt@gmail.com> [1],
Vernon Schryver <vjs@rhyolite.com> [2]
working files that should not have been in the patches[1]
Also move to a versioned filename for the patches[2]
Submitted by: Robert Sargent <robtsgt@gmail.com> [1],
Vernon Schryver <vjs@rhyolite.com> [2]
Features
* Support for ILNP RR types: NID, L32, L64, LP (RFC6742).
* RRL, --enable-ratelimit at configure time and config options.
* TSIG initialization only fails when there is no digest found at all.
Bugfixes
* Bugfix #478: Declaration after statement (for gcc 2.95).
* Bugfix #483: Better error message in case of TSIG error.
* Bugfix #485: TTL should not be greater than 2^31 - 1.
* Fix RCODE when CNAME loop final answer does not exist,
should return NXDOMAIN as stated by RFC 6604.
* Fix --disable-full-prehash bug, where after multiple incoming IXFRs,
NSEC3 can be removed unjustified.
PR: 175837
Submitted by: Jaap Akkerhuis <jaap@NLnetLabs.nl> (maintainer)
A serious Multiple Zone Response Policy Zone (RPZ2)
Speed Improvement bug has been fixed.
`./configure --enable-rpz-nsip --enable-rpz-nsdname`
is now the default.
Responses affected by the all-per-second parameter
are always dropped. The slip value has no effect on them.
There are improved log messages for responses that aredropped or "slipped," because they would require an
excessive identical referral.
A serious Multiple Zone Response Policy Zone (RPZ2)
Speed Improvement bug has been fixed.
`./configure --enable-rpz-nsip --enable-rpz-nsdname`
is now the default.
Responses affected by the all-per-second parameter
are always dropped. The slip value has no effect on them.
There are improved log messages for responses that are
dropped or "slipped," because they would require an
excessive identical referral.
- Add a patch to fix ECDSA keys (algorithms 13 & 14) for DNSSEC operation;
will be part of RC5.
- Fix CONFIGURE_ARGS for DNSSEC option (was CONFIGURE_FLAGS for some
mysterious reason) so cryptopp is actually compiled in.
Changelog: http://rtfm.powerdns.com/changelog.html#changelog-auth-3-2
PR: ports/175185
Submitted by: Ralf van der Enden <tremere@cainites.net> (maintainer)
released version of January 5, 2013.
This also includes performance patches to the BIND9
Response Policy Zones (DNS RPZ), Single Zone Response
Policy Zone (RPZ) Speed Improvement, in the same
patch.
More information: http://ss.vix.su/~vjs/rrlrpz.html
