/bind99, Berkeley Internet Name Daemon implementation of DNS, version 9.9
9.9.9pl2, Package name:
bind-9.9.9pl2, Maintainer: pkgsrc-users
BIND, the Berkeley Internet Name Daemon, version 9 is a major rewrite
of nearly all aspects of the underlying BIND architecture. Some
of the important features of BIND-9 are:
- DNS Security
- IP version 6
- DNS Protocol Enhancements
- Multiprocessor Support
- Improved Portability Architecture
- Full NSEC3 support
- Automatic zone re-signing
- New update-policy methods tcp-self and 6to4-self
This package contains the BIND 9.9 release.
: inet6, readline, threads
Master sites: (Expand) SHA1:
Version history: (Expand)
- (2016-07-19) Updated to version: bind-9.9.9pl2
- (2016-07-09) Updated to version: bind-9.9.9nb1
- (2016-05-02) Updated to version: bind-9.9.9
- (2016-03-10) Updated to version: bind-9.9.8pl4
- (2016-03-05) Updated to version: bind-9.9.8pl3nb1
- (2016-01-21) Updated to version: bind-9.9.8pl3
CVS history: (Expand)
| 2016-07-19 03:05:20 by Takahiro Kambe | Files touched by this commit (2) | |
Update bind99 to 9.9.9pl2 (BIND 9.9.9-P2).
--- 9.9.9-P2 released ---
4406. [bug] getrrsetbyname with a non absolute name could
trigger an infinite recursion bug in lwresd
and named with lwres configured if when combined
with a search list entry the resulting name is
too long. (CVE-2016-2775) [RT #42694]
4405. [bug] Change 4342 introduced a regression where you could
not remove a delegation in a NSEC3 signed zone using
OPTOUT via nsupdate. [RT #42702]
4387. [bug] Change 4336 was not complete leading to SERVFAIL
being return as NS records expired. [RT #42683]
--- 9.9.9-P1 released ---
4366. [bug] Address race condition when updating rbtnode bit
fields. [RT #42379]
4363. [port] win32: Disable explicit triggering UAC when running
| 2016-07-09 08:39:18 by Thomas Klausner | Files touched by this commit (1068) | |
Bump PKGREVISION for perl-5.24.0 for everything mentioning perl.
| 2016-06-08 12:16:57 by Jonathan Perkin | Files touched by this commit (89) |
Remove the stability entity, it has no meaning outside of an official context.
| 2016-06-08 12:02:27 by Jonathan Perkin | Files touched by this commit (44) |
Change the service_bundle name to "export" to reduce diffs between the
original manifest.xml file and the output from "svccfg export".
| 2016-05-02 15:22:06 by Takahiro Kambe | Files touched by this commit (4) | |
Update bind99 to 9.9.9 (BIND 9.9.9).
All Security Fixes should be fixed by 9.9.8-P4.
* The resolver could abort with an assertion failure due to improper
DNAME handling when parsing fetch reply messages. This flaw is
disclosed in CVE-2016-1286. [RT #41753]
* Malformed control messages can trigger assertions in named and
rndc. This flaw is disclosed in CVE-2016-1285. [RT #41666]
* Specific APL data could trigger an INSIST. This flaw is disclosed
in CVE-2015-8704. [RT #41396]
* Incorrect reference counting could result in an INSIST failure if a
socket error occurred while performing a lookup. This flaw is
disclosed in CVE-2015-8461. [RT#40945]
* Insufficient testing when parsing a message allowed records with an
incorrect class to be be accepted, triggering a REQUIRE failure
when those records were subsequently cached. This flaw is disclosed
in CVE-2015-8000. [RT #40987]
* The following resource record types have been implemented: AVC,
CSYNC, NINFO, RKEY, SINK, SMIMEA, TA, TALINK.
* Added a warning for a common misconfiguration involving forwarded
RFC 1918 and IPv6 ULA (Universal Local Address) zones.
* Contributed software from Nominum is included in the source at
contrib/dnsperf-188.8.131.52-1/. It includes dnsperf for measuring the
performance of authoritative DNS servers, resperf for testing the
resolution performance of a caching DNS server, resperf-report for
generating a resperf report in HTML with gnuplot graphs, and
queryparse to extract DNS queries from pcap capture files. This
software is not installed by default with BIND.
* When loading a signed zone, named will now check whether an RRSIG's
inception time is in the future, and if so, it will regenerate the
RRSIG immediately. This helps when a system's clock needs to be
* Updated the compiled-in addresses for H.ROOT-SERVERS.NET and
* The default preferred glue is now the address type of the transport
the query was received over.
* On machines with 2 or more processors (CPU), the default value for
the number of UDP listeners has been changed to the number of
detected processors minus one.
* Zone transfers now use smaller message sizes to improve message
compression. This results in reduced network usage.
* named -V output now also includes operating system details.
* The Microsoft Windows install tool BINDInstall.exe which requires a
non-free version of Visual Studio to be built, now uses two files
(lists of flags and files) created by the Configure perl script
with all the needed information which were previously compiled in
the binary. Read win32utils/build.txt for more details. [RT #38915]
* rndc flushtree now works even if there wasn't a cached node at the
specified name. [RT #41846]
* Don't emit records with zero TTL unless the records were received
with a zero TTL. After being returned to waiting clients, the
answer will be discarded from the cache. [RT #41687]
* When deleting records from a zone database, interior nodes could be
left empty but not deleted, damaging search performance afterward.
[RT #40997] [RT #41941]
* The server could crash due to a use-after-free if a zone transfer
timed out. [RT #41297]
* Authoritative servers that were marked as bogus (e.g. blackholed in
configuration or with invalid addresses) were being queried anyway.
| 2016-03-10 01:50:35 by Takahiro Kambe | Files touched by this commit (2) | |
Update bind99 package to 9.9.8pl4 (BIND 9.9.8-P4).
--- 9.9.8-P4 released ---
4319. [security] Fix resolver assertion failure due to improper
DNAME handling when parsing fetch reply messages.
(CVE-2016-1286) [RT #41753]
4318. [security] Malformed control messages can trigger assertions
in named and rndc. (CVE-2016-1285) [RT #41666]
| 2016-03-05 12:29:49 by Jonathan Perkin | Files touched by this commit (1813) | |
Bump PKGREVISION for security/openssl ABI bump.
| 2016-02-25 17:20:53 by Jonathan Perkin | Files touched by this commit (47) |