aboutsummaryrefslogtreecommitdiff
path: root/contrib/bind9
Commit message (Collapse)AuthorAgeFilesLines
* Update to 9.8.4-P1.Erwin Lansing2012-12-07213-4462/+6257
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Security Fixes Prevents named from aborting with a require assertion failure on servers with DNS64 enabled. These crashes might occur as a result of specific queries that are received. New Features * Elliptic Curve Digital Signature Algorithm keys and signatures in DNSSEC are now supported per RFC 6605. [RT #21918] Feature Changes * Improves OpenSSL error logging [RT #29932] * nslookup now returns a nonzero exit code when it is unable to get an answer. [RT #29492] Other critical bug fixes are included. Approved by: delphij (mentor) MFC after: 3 days Security: CVE-2012-5688 Sponsored by: DK Hostmaster A/S Notes: svn path=/head/; revision=243981
* | Upgrade to 9.8.3-P4:Xin LI2012-10-103-34/+40
|\| | | | | | | | | | | | | | | | | | | Prevents a lockup when queried a deliberately constructed combination of records. [CVE-2012-5166] For more information: https://kb.isc.org/article/AA-00801 Notes: svn path=/head/; revision=241414
* | Upgrade to 9.8.3-P3:Doug Barton2012-09-206-8/+41
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Prevents a crash when queried for a record whose RDATA exceeds 65535 bytes. Prevents a crash when validating caused by using "Bad cache" data before it has been initialized. ISC_QUEUE handling for recursive clients was updated to address a race condition that could cause a memory leak. This rarely occurred with UDP clients, but could be a significant problem for a server handling a steady rate of TCP queries. A condition has been corrected where improper handling of zero-length RDATA could cause undesirable behavior, including termination of the named process. For more information: https://kb.isc.org/article/AA-00788 Notes: svn path=/head/; revision=240729
* | Heavy DNSSEC Validation Load Can Cause a "Bad Cache" Assertion FailureDoug Barton2012-07-244-9/+33
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | in BIND9 High numbers of queries with DNSSEC validation enabled can cause an assertion failure in named, caused by using a "bad cache" data structure before it has been initialized. CVE: CVE-2012-3817 Posting date: 24 July, 2012 Notes: svn path=/head/; revision=238746
* | Upgrade to 9.8.3-P1, the latest from ISC. This version containsDoug Barton2012-06-044-9/+19
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | a critical bugfix: Processing of DNS resource records where the rdata field is zero length may cause various issues for the servers handling them. Processing of these records may lead to unexpected outcomes. Recursive servers may crash or disclose some portion of memory to the client. Secondary servers may crash on restart after transferring a zone containing these records. Master servers may corrupt zone data if the zone option "auto-dnssec" is set to "maintain". Other unexpected problems that are not listed here may also be encountered. All BIND users are strongly encouraged to upgrade. Notes: svn path=/head/; revision=236586
* | Upgrade to BIND version 9.8.3, the latest from ISC.Doug Barton2012-05-2827-292/+835
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Feature Change * BIND now recognizes the TLSA resource record type, created to support IETF DANE (DNS-based Authentication of Named Entities) Bug Fix * The locking strategy around the handling of iterative queries has been tuned to reduce unnecessary contention in a multi- threaded environment. Other critical bug fixes are included. All BIND users are encouraged to upgrade. Notes: svn path=/head/; revision=236196
* | The BIND 9.8.2 tarball was re-rolled to remove 9.8.1 release notes.Doug Barton2012-04-124-696/+0
|\| | | | | | | | | | | | | | | | | | | | | | | This change was noticed by ISC at: https://lists.isc.org/pipermail/bind-users/2012-April/087345.html and verified by me both by comparing the contents of the old and new distfiles and by verifying the PGP signature on the new distfile. Notes: svn path=/head/; revision=234165
* | Update to version 9.8.2, the latest from ISC, which contains numerous bug fixes.Doug Barton2012-04-05992-12761/+14784
|\| | | | | | | Notes: svn path=/head/; revision=233914
* | Upgrade to BIND 9.8.1-P1 to address the following DDOS bug:Doug Barton2011-11-174-18/+21
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Recursive name servers are failing with an assertion: INSIST(! dns_rdataset_isassociated(sigrdataset)) At this time it is not thought that authoritative-only servers are affected, but information about this bug is evolving rapidly. Because it may be possible to trigger this bug even on networks that do not allow untrusted users to access the recursive name servers (perhaps via specially crafted e-mail messages, and/or malicious web sites) it is recommended that ALL operators of recursive name servers upgrade immediately. For more information see: https://www.isc.org/software/bind/advisories/cve-2011-tbd which will be updated as more information becomes available. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4313 Notes: svn path=/head/; revision=227596
* | Upgrade to BIND version 9.8.1. Release notes at:Doug Barton2011-09-03212-8393/+12060
|\| | | | | | | | | | | | | | | | | | | | | https://deepthought.isc.org/article/AA-00446/81/ or /usr/src/contrib/bind9/ Approved by: re (kib) Notes: svn path=/head/; revision=225361
* | Upgrade to version 9.8.0-P4Doug Barton2011-07-16609-17302/+75304
|\| | | | | | | | | | | | | | | This version has many new features, see /usr/share/doc/bind9/README for details. Notes: svn path=/head/; revision=224092
* | Update to version 9.6-ESV-R4-P3Doug Barton2011-07-0613-64/+96
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ALL BIND USERS ARE ENCOURAGED TO UPGRADE IMMEDIATELY This update addresses the following vulnerability: CVE-2011-2464 ============= Severity: High Exploitable: Remotely Description: A defect in the affected BIND 9 versions allows an attacker to remotely cause the "named" process to exit using a specially crafted packet. This defect affects both recursive and authoritative servers. The code location of the defect makes it impossible to protect BIND using ACLs configured within named.conf or by disabling any features at compile-time or run-time. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2464 https://www.isc.org/software/bind/advisories/cve-2011-2464 Notes: svn path=/head/; revision=223812
* | Apply bug fixesDoug Barton2011-07-061-10/+9
| | | | | | | | | | | | | | Submitted by: marius Notes: svn path=/head/; revision=223811
* | Upgrade to 9.6-ESV-R4-P1, which address the following issues:Doug Barton2011-05-28724-1139/+886
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 1. Very large RRSIG RRsets included in a negative cache can trigger an assertion failure that will crash named (BIND 9 DNS) due to an off-by-one error in a buffer size check. This bug affects all resolving name servers, whether DNSSEC validation is enabled or not, on all BIND versions prior to today. There is a possibility of malicious exploitation of this bug by remote users. 2. Named could fail to validate zones listed in a DLV that validated insecure without using DLV and had DS records in the parent zone. Add a patch provided by ru@ and confirmed by ISC to fix a crash at shutdown time when a SIG(0) key is being used. Notes: svn path=/head/; revision=222395
* | Update to BIND 9.6.3, the latest from ISC on the 9.6 branch.Doug Barton2011-02-06142-8071/+9812
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | All 9.6 users with DNSSEC validation enabled should upgrade to this version, or the latest version in the 9.7 branch, prior to 2011-03-31 in order to avoid validation failures for names in .COM as described here: https://www.isc.org/announcement/bind-9-dnssec-validation-fails-new-ds-record In addition the fixes for this and other bugs, there are also the following: * Various fixes to kerberos support, including GSS-TSIG * Various fixes to avoid leaking memory, and to problems that could prevent a clean shutdown of named Notes: svn path=/head/; revision=218384
* | Update to version 9.6-ESV-R3, the latest from ISC, which addressesDoug Barton2010-12-0423-91/+706
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | the following security vulnerabilities. For more information regarding these issues please see: http://www.isc.org/announcement/guidance-regarding-dec-1st-2010-security-advisories 1. Cache incorrectly allows ncache and rrsig for the same type http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3613 Affects resolver operators whose servers are open to potential attackers. Triggering the bug will cause the server to crash. This bug applies even if you do not have DNSSEC enabled. 2. Key algorithm rollover http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3614 Affects resolver operators who are validating with DNSSEC, and querying zones which are in a key rollover period. The bug will cause answers to incorrectly be marked as insecure. Notes: svn path=/head/; revision=216175
* | Update to 9.6-ESV-R2, the latest from ISC.Doug Barton2010-10-3174-10723/+3925
|\| | | | | | | | | | | | | | | | | This version contains bug fixes that are relevant to any caching/resolving name server; as well as DNSSEC-related fixes. Notes: svn path=/head/; revision=214586
* | Upgrade to 9.6.2-P2, which addresses the following;Doug Barton2010-05-204-5/+10
|\| | | | | | | | | | | | | | | Named could return SERVFAIL for negative responses from unsigned zones. Notes: svn path=/head/; revision=208337
* | Update to 9.6.2-P1, the latest patchfix release which deals withDoug Barton2010-03-1856-1858/+2455
|\| | | | | | | | | | | | | | | | | | | | | the problems related to the handling of broken DNSSEC trust chains. This fix is only relevant for those who have DNSSEC validation enabled and configure trust anchors from third parties, either manually, or through a system like DLV. Notes: svn path=/head/; revision=205292
* | Upgrade to version 9.6.2. This version includes all previously releasedDoug Barton2010-03-03179-8330/+10790
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | security patches to the 9.6.1 version, as well as many other bug fixes. This version also incorporates a different fix for the problem we had patched in contrib/bind9/bin/dig/dighost.c, so that file is now back to being the same as the vendor version. Due to the fact that the DNSSEC algorithm that will be used to sign the root zone is only included in this version and in 9.7.x those who wish to do validation MUST upgrade to one of these prior to July 2010. Notes: svn path=/head/; revision=204619
* | Upgrade to BIND 9.6.1-P3.Doug Barton2010-01-2539-7581/+7874
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This version address the following vulnerabilities: BIND 9 Cache Update from Additional Section https://www.isc.org/advisories/CVE-2009-4022v6 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4022 A nameserver with DNSSEC validation enabled may incorrectly add unauthenticated records to its cache that are received during the resolution of a recursive client query BIND 9 DNSSEC validation code could cause bogus NXDOMAIN responses https://www.isc.org/advisories/CVE-2010-0097 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0097 There was an error in the DNSSEC NSEC/NSEC3 validation code that could cause bogus NXDOMAIN responses (that is, NXDOMAIN responses for records proven by NSEC or NSEC3 to exist) to be cached as if they had validated correctly These issues only affect systems with DNSSEC validation enabled. Notes: svn path=/head/; revision=202961
* | Fix Read-After-Write (RAW) dependency violation for ar.ccv inMarcel Moolenaar2009-12-071-2/+2
| | | | | | | | | | | | | | | | | | | | isc_atomic_xadd() and isc_atomic_cmpxchg(). Approved by: dougb@ MFC after: 1 week Notes: svn path=/head/; revision=200202
* | Update to BIND 9.6.1-P2. The vulnerability this is designed to fix isDoug Barton2009-11-309-43/+129
|\| | | | | | | | | | | | | | | | | related to DNSSEC validation on a resolving name server that allows access to untrusted users. If your system does not fall into all 3 of these categories you do not need to update immediately. Notes: svn path=/head/; revision=199958
* | Wrap some socket handling code in a !NULL bowDoug Barton2009-11-071-4/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | This patch or something similar will likely be included in a future BIND release. PR: bin/138061 Submitted by: Michael Baker <michael.baker@diversit.com.au> Original patch submitted by: Volker <volker@vwsoft.com> Patch reviewed and tweaked by: ISC Notes: svn path=/head/; revision=199019
* | Update to version 9.6.1-P1 which addresses a remote DoS vulnerability:Doug Barton2009-07-293-5/+13
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Receipt of a specially-crafted dynamic update message may cause BIND 9 servers to exit. This vulnerability affects all servers -- it is not limited to those that are configured to allow dynamic updates. Access controls will not provide an effective workaround. More details can be found here: https://www.isc.org/node/474 All BIND users are encouraged to update to a patched version ASAP. Approved by: re (re -> SO -> dougb) Notes: svn path=/head/; revision=195936
* | This is the solution that ISC committed after 9.6.1-release forDoug Barton2009-06-251-0/+9
| | | | | | | | | | | | | | | | the gcc warning issue. It should be included in the next upstream release. Notes: svn path=/head/; revision=195000
* | Update to the final release version of BIND 9.6.1. It has the followingDoug Barton2009-06-2536-581/+796
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | changes from the 9.6.1rc1 version. The first 2 only affect DNSSEC. named could incorrectly delete NSEC3 records for empty nodes when processing a update request. Accept DS responses from delegation only zones. "delegation-only" was not being accepted in delegation-only type zones. Notes: svn path=/head/; revision=194995
* | Local hack to get the build going again while ISC works on a moreDoug Barton2009-06-011-9/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | permanent solution for 9.6.1-release. "My suggestion is to remove the whole attribute construct. It only suppresses a warning when a function is unused. In this case the function is defined as inline, so it's not causing a warning when not used." Submitted by: marcel Notes: svn path=/head/; revision=193202
* | Update BIND to version 9.6.1rc1. This version has better performance andDoug Barton2009-05-311-0/+149
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | lots of new features compared to 9.4.x, including: Full NSEC3 support Automatic zone re-signing New update-policy methods tcp-self and 6to4-self DHCID support. More detailed statistics counters including those supported in BIND 8. Faster ACL processing. Efficient LRU cache-cleaning mechanism. NSID support. Notes: svn path=/head/; revision=193150
* | Update BIND to version 9.6.1rc1. This version has better performance andDoug Barton2009-05-311216-230497/+58176
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | lots of new features compared to 9.4.x, including: Full NSEC3 support Automatic zone re-signing New update-policy methods tcp-self and 6to4-self DHCID support. More detailed statistics counters including those supported in BIND 8. Faster ACL processing. Efficient LRU cache-cleaning mechanism. NSID support. Notes: svn path=/head/; revision=193149
* | Merge from vendor/bind9/dist as of the 9.4.3-P2 importDoug Barton2009-03-213-14/+74
|\| | | | | | | Notes: svn path=/head/; revision=190227
* | Merge from vendor/bind9/dist as of the 9.4.3-P1 importDoug Barton2009-01-096-12/+19
|\| | | | | | | Notes: svn path=/head/; revision=186942
* | Merge from vendor/bind9/dist as of the 9.4.3 importDoug Barton2008-12-23194-8046/+18079
|\| | | | | | | Notes: svn path=/head/; revision=186462
* | Merge from vendor/bind9/dist as of the 9.4.2-P2 importDoug Barton2008-09-0133-160/+558
|\| | | | | | | Notes: svn path=/head/; revision=182645
* | Merge from vendor/bind9/dist as of the 9.4.2-P1 import, includingDoug Barton2008-07-1215-36620/+2567
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | the patch from ISC for lib/bind9/check.c and deletion of unused files in lib/bind. This version will by default randomize the UDP query source port (and sequence number of course) for every query. In order to take advantage of this randomization users MUST have an appropriate firewall configuration to allow UDP queries to be sent and answers to be received on random ports; and users MUST NOT specify a port number using the query-source[-v6] options. The avoid-v[46]-udp-ports options exist for users who wish to eliminate certain port numbers from being chosen by named for this purpose. See the ARM Chatper 6 for more information. Also please note, this issue applies only to UDP query ports. A random ephemeral port is always chosen for TCP queries. This issue applies primarily to name servers whose main purpose is to resolve random queries (sometimes referred to as "caching" servers, or more properly as "resolving" servers), although even an "authoritative" name server will make some queries, primarily at startup time. All users of BIND are strongly encouraged to upgrade to the latest version, and to utilize the source port randomization feature. This update addresses issues raised in: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447 http://www.kb.cert.org/vuls/id/800113 http://tools.ietf.org/html/draft-ietf-dnsext-forgery-resilience Notes: svn path=/head/; revision=180477
| * Flatten bind9 vendor work areaPeter Wemm2008-07-121179-586393/+0
| | | | | | | | Notes: svn path=/vendor/bind9/dist/; revision=180456
* | The vendor area is the proper home for these files now.Doug Barton2008-07-122-187/+0
| | | | | | | | Notes: svn path=/head/; revision=180475
* | Add proper mime-types for files that they are relevant for.Doug Barton2008-06-021-0/+0
| | | | | | | | | | | | | | | | | | This is useful for things like *.pdf files that svn needs to know about, and will probably be useful down the road for other things. Notes: svn path=/head/; revision=179494
* | This commit was generated by cvs2svn to compensate for changes in r174206,Doug Barton2007-12-031-1/+23
|\| | | | | | | | | | | | | which included commits to RCS files with non-trunk default branches. Notes: svn path=/head/; revision=174207
| * Update this file so that BIND on ARM can actually work. I quote:vendor/bind9/9.4.2Doug Barton2007-12-031-1/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The problem was, isc_atomic_cmpxchg() is almost like our atomic_cmpset_32(), except it expects the old value to be returned, whereas our atomic_cmpset_32 returns 1 on success, or 0 on failure. So I re-implemented something suitable. Submitted by: cognet Reviewed by: bsdimp Notes: svn path=/vendor/bind9/dist/; revision=174206 svn path=/vendor/bind9/9.4.2/; revision=174208; tag=vendor/bind9/9.4.2
| * These files are not part of the distribution.Doug Barton2007-12-022-187/+0
| | | | | | | | | | | | | | Brought to you by: PEBCAK Notes: svn path=/vendor/bind9/dist/; revision=174192
| * This file is no longer in BIND 9.4.2Doug Barton2007-12-021-3136/+0
| | | | | | | | Notes: svn path=/vendor/bind9/dist/; revision=174190
* | This commit was generated by cvs2svn to compensate for changes in r174190,Doug Barton2007-12-021-3136/+0
|/ | | | | | | which included commits to RCS files with non-trunk default branches. Notes: svn path=/head/; revision=174191
* Vendor import of BIND 9.4.2Doug Barton2007-12-02204-9396/+24257
| | | | Notes: svn path=/vendor/bind9/dist/; revision=174187
* Vendor import of 9.4.1-P1, which has fixes for the following:Doug Barton2007-07-2530-1790/+2248
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | 1. The default access control lists (acls) are not being correctly set. If not set anyone can make recursive queries and/or query the cache contents. See also: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2925 2. The DNS query id generation is vulnerable to cryptographic analysis which provides a 1 in 8 chance of guessing the next query id for 50% of the query ids. This can be used to perform cache poisoning by an attacker. This bug only affects outgoing queries, generated by BIND 9 to answer questions as a resolver, or when it is looking up data for internal uses, such as when sending NOTIFYs to slave name servers. All users are encouraged to upgrade. See also: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2926 Approved by: re (kensmith, implicit) Notes: svn path=/vendor/bind9/dist/; revision=171577
* Add a custom atomic.h file which implements the C versions of theDoug Barton2007-06-051-0/+59
| | | | | | | | | code we already have assembly versions of. Written by: imp Notes: svn path=/vendor/bind9/dist/; revision=170349
* Remove from the vendor branch files that are no longerDoug Barton2007-06-0212-10066/+0
| | | | | | | present in BIND 9.4.1. Notes: svn path=/vendor/bind9/dist/; revision=170225
* Vendor import of BIND 9.4.1Doug Barton2007-06-021000-40961/+116285
| | | | Notes: svn path=/vendor/bind9/dist/; revision=170222
* Vendor import of BIND 9.3.4Doug Barton2007-01-299-17/+223
| | | | Notes: svn path=/vendor/bind9/dist/; revision=166332
* Remove from the vendor branch files that are no longer in theDoug Barton2006-12-102-314/+0
| | | | | | | 9.3.3 sources. Notes: svn path=/vendor/bind9/dist/; revision=165078
generated by cgit v1.2.3 (git 2.25.1) at 2024-10-24 11:20:07 +0000