summaryrefslogtreecommitdiffstats
path: root/contrib/bind9
Commit message (Collapse)AuthorAgeFilesLines
* Update to BIND 9.6.3, the latest from ISC on the 9.6 branch.dougb2011-02-06142-8071/+9812
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | All 9.6 users with DNSSEC validation enabled should upgrade to this version, or the latest version in the 9.7 branch, prior to 2011-03-31 in order to avoid validation failures for names in .COM as described here: https://www.isc.org/announcement/bind-9-dnssec-validation-fails-new-ds-record In addition the fixes for this and other bugs, there are also the following: * Various fixes to kerberos support, including GSS-TSIG * Various fixes to avoid leaking memory, and to problems that could prevent a clean shutdown of named
* \ Update to version 9.6-ESV-R3, the latest from ISC, which addressesdougb2010-12-0423-91/+706
|\ \ | |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | the following security vulnerabilities. For more information regarding these issues please see: http://www.isc.org/announcement/guidance-regarding-dec-1st-2010-security-advisories 1. Cache incorrectly allows ncache and rrsig for the same type http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3613 Affects resolver operators whose servers are open to potential attackers. Triggering the bug will cause the server to crash. This bug applies even if you do not have DNSSEC enabled. 2. Key algorithm rollover http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3614 Affects resolver operators who are validating with DNSSEC, and querying zones which are in a key rollover period. The bug will cause answers to incorrectly be marked as insecure.
* | Update to 9.6-ESV-R2, the latest from ISC.dougb2010-10-3174-10723/+3925
| | | | | | | | | | | | This version contains bug fixes that are relevant to any caching/resolving name server; as well as DNSSEC-related fixes.
* | Upgrade to 9.6.2-P2, which addresses the following;dougb2010-05-204-5/+10
| | | | | | | | | | Named could return SERVFAIL for negative responses from unsigned zones.
* | Update to 9.6.2-P1, the latest patchfix release which deals withdougb2010-03-1856-1858/+2455
| | | | | | | | | | | | | | | | the problems related to the handling of broken DNSSEC trust chains. This fix is only relevant for those who have DNSSEC validation enabled and configure trust anchors from third parties, either manually, or through a system like DLV.
* | Upgrade to version 9.6.2. This version includes all previously releaseddougb2010-03-03179-8330/+10790
| | | | | | | | | | | | | | | | | | | | | | | | security patches to the 9.6.1 version, as well as many other bug fixes. This version also incorporates a different fix for the problem we had patched in contrib/bind9/bin/dig/dighost.c, so that file is now back to being the same as the vendor version. Due to the fact that the DNSSEC algorithm that will be used to sign the root zone is only included in this version and in 9.7.x those who wish to do validation MUST upgrade to one of these prior to July 2010.
* | Upgrade to BIND 9.6.1-P3.dougb2010-01-2539-7581/+7874
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This version address the following vulnerabilities: BIND 9 Cache Update from Additional Section https://www.isc.org/advisories/CVE-2009-4022v6 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4022 A nameserver with DNSSEC validation enabled may incorrectly add unauthenticated records to its cache that are received during the resolution of a recursive client query BIND 9 DNSSEC validation code could cause bogus NXDOMAIN responses https://www.isc.org/advisories/CVE-2010-0097 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0097 There was an error in the DNSSEC NSEC/NSEC3 validation code that could cause bogus NXDOMAIN responses (that is, NXDOMAIN responses for records proven by NSEC or NSEC3 to exist) to be cached as if they had validated correctly These issues only affect systems with DNSSEC validation enabled.
* | Fix Read-After-Write (RAW) dependency violation for ar.ccv inmarcel2009-12-071-2/+2
| | | | | | | | | | | | | | isc_atomic_xadd() and isc_atomic_cmpxchg(). Approved by: dougb@ MFC after: 1 week
* | Update to BIND 9.6.1-P2. The vulnerability this is designed to fix isdougb2009-11-309-43/+129
| | | | | | | | | | | | related to DNSSEC validation on a resolving name server that allows access to untrusted users. If your system does not fall into all 3 of these categories you do not need to update immediately.
* | Wrap some socket handling code in a !NULL bowdougb2009-11-071-4/+6
| | | | | | | | | | | | | | | | | | | | This patch or something similar will likely be included in a future BIND release. PR: bin/138061 Submitted by: Michael Baker <michael.baker@diversit.com.au> Original patch submitted by: Volker <volker@vwsoft.com> Patch reviewed and tweaked by: ISC
* | Update to version 9.6.1-P1 which addresses a remote DoS vulnerability:dougb2009-07-293-5/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Receipt of a specially-crafted dynamic update message may cause BIND 9 servers to exit. This vulnerability affects all servers -- it is not limited to those that are configured to allow dynamic updates. Access controls will not provide an effective workaround. More details can be found here: https://www.isc.org/node/474 All BIND users are encouraged to update to a patched version ASAP. Approved by: re (re -> SO -> dougb)
* | This is the solution that ISC committed after 9.6.1-release fordougb2009-06-251-0/+9
| | | | | | | | | | the gcc warning issue. It should be included in the next upstream release.
* | Update to the final release version of BIND 9.6.1. It has the followingdougb2009-06-2536-581/+796
|\ \ | |/ | | | | | | | | | | | | | | | | | | | | changes from the 9.6.1rc1 version. The first 2 only affect DNSSEC. named could incorrectly delete NSEC3 records for empty nodes when processing a update request. Accept DS responses from delegation only zones. "delegation-only" was not being accepted in delegation-only type zones.
* | Local hack to get the build going again while ISC works on a moredougb2009-06-011-9/+0
| | | | | | | | | | | | | | | | | | | | | | permanent solution for 9.6.1-release. "My suggestion is to remove the whole attribute construct. It only suppresses a warning when a function is unused. In this case the function is defined as inline, so it's not causing a warning when not used." Submitted by: marcel
* | Update BIND to version 9.6.1rc1. This version has better performance anddougb2009-05-311-0/+149
| | | | | | | | | | | | | | | | | | | | | | | | | | lots of new features compared to 9.4.x, including: Full NSEC3 support Automatic zone re-signing New update-policy methods tcp-self and 6to4-self DHCID support. More detailed statistics counters including those supported in BIND 8. Faster ACL processing. Efficient LRU cache-cleaning mechanism. NSID support.
* | Update BIND to version 9.6.1rc1. This version has better performance anddougb2009-05-311216-230497/+58176
|\ \ | |/ | | | | | | | | | | | | | | | | | | | | | | lots of new features compared to 9.4.x, including: Full NSEC3 support Automatic zone re-signing New update-policy methods tcp-self and 6to4-self DHCID support. More detailed statistics counters including those supported in BIND 8. Faster ACL processing. Efficient LRU cache-cleaning mechanism. NSID support.
* | Merge from vendor/bind9/dist as of the 9.4.3-P2 importdougb2009-03-213-14/+74
| |
* | Merge from vendor/bind9/dist as of the 9.4.3-P1 importdougb2009-01-096-12/+19
| |
* | Merge from vendor/bind9/dist as of the 9.4.3 importdougb2008-12-23194-8046/+18079
|\ \ | |/
| * Flatten bind9 vendor work areapeter2008-07-121179-586393/+0
| |
* | Merge from vendor/bind9/dist as of the 9.4.2-P2 importdougb2008-09-0133-160/+558
| |
* | Merge from vendor/bind9/dist as of the 9.4.2-P1 import, includingdougb2008-07-1215-36620/+2567
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | the patch from ISC for lib/bind9/check.c and deletion of unused files in lib/bind. This version will by default randomize the UDP query source port (and sequence number of course) for every query. In order to take advantage of this randomization users MUST have an appropriate firewall configuration to allow UDP queries to be sent and answers to be received on random ports; and users MUST NOT specify a port number using the query-source[-v6] options. The avoid-v[46]-udp-ports options exist for users who wish to eliminate certain port numbers from being chosen by named for this purpose. See the ARM Chatper 6 for more information. Also please note, this issue applies only to UDP query ports. A random ephemeral port is always chosen for TCP queries. This issue applies primarily to name servers whose main purpose is to resolve random queries (sometimes referred to as "caching" servers, or more properly as "resolving" servers), although even an "authoritative" name server will make some queries, primarily at startup time. All users of BIND are strongly encouraged to upgrade to the latest version, and to utilize the source port randomization feature. This update addresses issues raised in: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447 http://www.kb.cert.org/vuls/id/800113 http://tools.ietf.org/html/draft-ietf-dnsext-forgery-resilience
* | The vendor area is the proper home for these files now.dougb2008-07-122-187/+0
| |
* | Add proper mime-types for files that they are relevant for.dougb2008-06-021-0/+0
| | | | | | | | | | | | This is useful for things like *.pdf files that svn needs to know about, and will probably be useful down the road for other things.
* | This commit was generated by cvs2svn to compensate for changes in r174206,dougb2007-12-031-1/+23
|\ \ | |/ | | | | which included commits to RCS files with non-trunk default branches.
| * Update this file so that BIND on ARM can actually work. I quote:dougb2007-12-031-1/+23
| | | | | | | | | | | | | | | | | | | | The problem was, isc_atomic_cmpxchg() is almost like our atomic_cmpset_32(), except it expects the old value to be returned, whereas our atomic_cmpset_32 returns 1 on success, or 0 on failure. So I re-implemented something suitable. Submitted by: cognet Reviewed by: bsdimp
| * These files are not part of the distribution.dougb2007-12-022-187/+0
| | | | | | | | Brought to you by: PEBCAK
| * This file is no longer in BIND 9.4.2dougb2007-12-021-3136/+0
| |
* | This commit was generated by cvs2svn to compensate for changes in r174190,dougb2007-12-021-3136/+0
|/ | | | which included commits to RCS files with non-trunk default branches.
* Vendor import of BIND 9.4.2dougb2007-12-02204-9396/+24257
|
* Vendor import of 9.4.1-P1, which has fixes for the following:dougb2007-07-2530-1790/+2248
| | | | | | | | | | | | | | | | | | | | | | | | | | 1. The default access control lists (acls) are not being correctly set. If not set anyone can make recursive queries and/or query the cache contents. See also: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2925 2. The DNS query id generation is vulnerable to cryptographic analysis which provides a 1 in 8 chance of guessing the next query id for 50% of the query ids. This can be used to perform cache poisoning by an attacker. This bug only affects outgoing queries, generated by BIND 9 to answer questions as a resolver, or when it is looking up data for internal uses, such as when sending NOTIFYs to slave name servers. All users are encouraged to upgrade. See also: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2926 Approved by: re (kensmith, implicit)
* Add a custom atomic.h file which implements the C versions of thedougb2007-06-051-0/+59
| | | | | | code we already have assembly versions of. Written by: imp
* Remove from the vendor branch files that are no longerdougb2007-06-0212-10066/+0
| | | | present in BIND 9.4.1.
* Vendor import of BIND 9.4.1dougb2007-06-021000-40961/+116285
|
* Vendor import of BIND 9.3.4dougb2007-01-299-17/+223
|
* Remove from the vendor branch files that are no longer in thedougb2006-12-102-314/+0
| | | | 9.3.3 sources.
* Vendor import of BIND 9.3.3dougb2006-12-10251-7058/+11926
|
* Update to version 9.3.2-P2, which addresses the vulnerabilitydougb2006-11-046-44/+122
| | | | | | | | | | | | | | | | | | | | | | announced by ISC dated 31 October (delivered via e-mail to the bind-announce@isc.org list on 2 November): Description: Because of OpenSSL's recently announced vulnerabilities (CAN-2006-4339, CVE-2006-2937 and CVE-2006-2940) which affect named, we are announcing this workaround and releasing patches. A proof of concept attack on OpenSSL has been demonstrated for CAN-2006-4339. OpenSSL is required to use DNSSEC with BIND. Fix for version 9.3.2-P1 and lower: Upgrade to BIND 9.3.2-P2, then generate new RSASHA1 and RSAMD5 keys for all old keys using the old default exponent and perform a key rollover to these new keys. These versions also change the default RSA exponent to be 65537 which is not vulnerable to the attacks described in CAN-2006-4339.
* Vendor import of BIND 9.3.2-P1, which addresses the following securitydougb2006-09-064-28/+42
| | | | | | | | | | | | | vulnerabilities: http://www.niscc.gov.uk/niscc/docs/re-20060905-00590.pdf?lang=en 2066. [security] Handle SIG queries gracefully. [RT #16300] http://www.kb.cert.org/vuls/id/697164 1941. [bug] ncache_adderesult() should set eresult even if no rdataset is passed to it. [RT #15642] All users of BIND 9 are encouraged to upgrade to this version.
* Remove files from the vendor branch that are no longer presentdougb2006-01-1431-23572/+0
| | | | in BIND 9.3.2 that were mistakenly removed from HEAD.
* After some discussion with the folks at ISC, it turns out that the _ai_paddougb2006-01-041-3/+3
| | | | | | | | | | | | part of the structure was a hack to maintain binary compatibility with Sun binaries, and my understanding is that it's not needed generally on sparc systems running other operating systems. Therefore, hide this code behind the same set of tests as in lib/bind/include/netdb.h. This file is being imported on the vendor branch because a similar change (or change with similar effect) will be in the next version of BIND 9. This change will not affect other platforms in any way.
* Vendor import of BIND 9.3.2dougb2005-12-29284-38640/+66160
|
* Update the vendor branch with a patch to this file that wasdougb2005-08-181-2/+4
| | | | | | | | | | | | | | | | researched by glebius, and incorporated by ISC into the next version of BIND. Unfortunately, it looks like their release will come after the release of FreeBSD 6, so we will bring this in now. The patch addresses a problem with high-load resolvers which hit memory barriers. Without this patch, running the resolving name server out of memory would lead to "unpredictable results." Of course, the canonical answer to this problem is to put more memory into the system, however that is not always possible, and the code should be able to handle this situation gracefully in any case.
* Remove files from the vendor branch that were [re]moved in 9.3.1dougb2005-03-1726-16519/+0
|
* Vendor import of BIND 9.3.1dougb2005-03-17123-1694/+8350
|
* Vendor import of BIND 9.3.0.des2004-09-236-8/+35
|
* This commit was manufactured by cvs2svn to create branch 'VENDOR-bind9'.cvs2svn2004-09-212-0/+78
|
* Vendor import of BIND 9.3.0rc4.trhodes2004-09-193-0/+602
| | | | | These three files were missed in the original import because their names contained the magic letters w, i and n in that sequence.
* Vender import of BIND 9.3.0rc4.trhodes2004-09-191090-0/+509412
OpenPOWER on IntegriCloud