Commit Graph

39 Commits

Author SHA1 Message Date
Doug Barton
0df811a678 Update to version 9.6.1-P1 which addresses a remote DoS vulnerability:
Receipt of a specially-crafted dynamic update message may
	cause BIND 9 servers to exit. This vulnerability affects all
	servers -- it is not limited to those that are configured to
	allow dynamic updates. Access controls will not provide an
	effective workaround.

More details can be found here: https://www.isc.org/node/474

All BIND users are encouraged to update to a patched version ASAP.

Approved by:	re (re -> SO -> dougb)
2009-07-29 00:15:39 +00:00
Doug Barton
9d0520c4b2 This is the solution that ISC committed after 9.6.1-release for
the gcc warning issue. It should be included in the next upstream
release.
2009-06-25 19:52:45 +00:00
Doug Barton
d1fdc8795a Update to the final release version of BIND 9.6.1. It has the following
changes from the 9.6.1rc1 version. The first 2 only affect DNSSEC.

          named could incorrectly delete NSEC3 records for
          empty nodes when processing a update request.

          Accept DS responses from delegation only zones.

          "delegation-only" was not being accepted in
          delegation-only type zones.
2009-06-25 19:16:29 +00:00
Doug Barton
8df4f1e7be Local hack to get the build going again while ISC works on a more
permanent solution for 9.6.1-release.

"My suggestion is to remove the whole attribute construct.
It only suppresses a warning when a function is unused. In this case
the function is defined as inline, so it's not causing a warning when
not used."

Submitted by:	marcel
2009-06-01 06:31:04 +00:00
Doug Barton
86a672bc31 Update BIND to version 9.6.1rc1. This version has better performance and
lots of new features compared to 9.4.x, including:

	Full NSEC3 support
	Automatic zone re-signing
	New update-policy methods tcp-self and 6to4-self
	DHCID support.
	More detailed statistics counters including those supported in BIND 8.
	Faster ACL processing.
	Efficient LRU cache-cleaning mechanism.
	NSID support.
2009-05-31 05:44:21 +00:00
Doug Barton
6318052d9e Update BIND to version 9.6.1rc1. This version has better performance and
lots of new features compared to 9.4.x, including:

	Full NSEC3 support
	Automatic zone re-signing
	New update-policy methods tcp-self and 6to4-self
	DHCID support.
	More detailed statistics counters including those supported in BIND 8.
	Faster ACL processing.
	Efficient LRU cache-cleaning mechanism.
	NSID support.
2009-05-31 05:42:58 +00:00
Doug Barton
212b42b0a3 Merge from vendor/bind9/dist as of the 9.4.3-P2 import 2009-03-21 23:00:40 +00:00
Doug Barton
990eddd5b7 Merge from vendor/bind9/dist as of the 9.4.3-P1 import 2009-01-09 11:45:45 +00:00
Doug Barton
514216e8d6 Merge from vendor/bind9/dist as of the 9.4.3 import 2008-12-23 22:47:56 +00:00
Doug Barton
ac9a011f43 Merge from vendor/bind9/dist as of the 9.4.2-P2 import 2008-09-01 22:54:49 +00:00
Doug Barton
2e5453748e Merge from vendor/bind9/dist as of the 9.4.2-P1 import, including
the patch from ISC for lib/bind9/check.c and deletion of unused
files in lib/bind.

This version will by default randomize the UDP query source port
(and sequence number of course) for every query.

In order to take advantage of this randomization users MUST have an
appropriate firewall configuration to allow UDP queries to be sent and
answers to be received on random ports; and users MUST NOT specify a
port number using the query-source[-v6] options.

The avoid-v[46]-udp-ports options exist for users who wish to eliminate
certain port numbers from being chosen by named for this purpose. See
the ARM Chatper 6 for more information.

Also please note, this issue applies only to UDP query ports. A random
ephemeral port is always chosen for TCP queries.

This issue applies primarily to name servers whose main purpose is to
resolve random queries (sometimes referred to as "caching" servers, or
more properly as "resolving" servers), although even an "authoritative"
name server will make some queries, primarily at startup time.

All users of BIND are strongly encouraged to upgrade to the latest
version, and to utilize the source port randomization feature.

This update addresses issues raised in:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447
http://www.kb.cert.org/vuls/id/800113
http://tools.ietf.org/html/draft-ietf-dnsext-forgery-resilience
2008-07-12 09:38:35 +00:00
Doug Barton
632c4e7871 The vendor area is the proper home for these files now. 2008-07-12 08:46:21 +00:00
Peter Wemm
a988131922 Flatten bind9 vendor work area 2008-07-12 05:00:28 +00:00
Doug Barton
5de57ff6ba Add proper mime-types for files that they are relevant for.
This is useful for things like *.pdf files that svn needs
to know about, and will probably be useful down the road
for other things.
2008-06-02 20:37:11 +00:00
Doug Barton
3104e2690b Update this file so that BIND on ARM can actually work. I quote:
The problem was, isc_atomic_cmpxchg() is almost like our
	atomic_cmpset_32(), except it expects the old value to be
	returned, whereas our atomic_cmpset_32 returns 1 on success,
	or 0 on failure. So I re-implemented something suitable.

Submitted by:	cognet
Reviewed by:	bsdimp
2007-12-03 08:26:34 +00:00
Doug Barton
1061ff7e54 This commit was generated by cvs2svn to compensate for changes in r174206,
which included commits to RCS files with non-trunk default branches.
2007-12-03 08:26:34 +00:00
Doug Barton
a6861a2eb3 These files are not part of the distribution.
Brought to you by:	PEBCAK
2007-12-02 19:21:31 +00:00
Doug Barton
e99bdb9937 This commit was generated by cvs2svn to compensate for changes in r174190,
which included commits to RCS files with non-trunk default branches.
2007-12-02 19:17:26 +00:00
Doug Barton
2f4b1e8790 This file is no longer in BIND 9.4.2 2007-12-02 19:17:26 +00:00
Doug Barton
995ea97467 Vendor import of BIND 9.4.2 2007-12-02 19:10:41 +00:00
Doug Barton
56a78b5211 Vendor import of 9.4.1-P1, which has fixes for the following:
1. The default access control lists (acls) are not being
correctly set. If not set anyone can make recursive queries
and/or query the cache contents.

See also:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2925

2. The DNS query id generation is vulnerable to cryptographic
analysis which provides a 1 in 8 chance of guessing the next
query id for 50% of the query ids. This can be used to perform
cache poisoning by an attacker.

This bug only affects outgoing queries, generated by BIND 9 to
answer questions as a resolver, or when it is looking up data
for internal uses, such as when sending NOTIFYs to slave name
servers.

All users are encouraged to upgrade.

See also:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2926

Approved by:	re (kensmith, implicit)
2007-07-25 08:12:36 +00:00
Doug Barton
c197e4d678 Add a custom atomic.h file which implements the C versions of the
code we already have assembly versions of.

Written by:	imp
2007-06-05 22:15:38 +00:00
Doug Barton
d6a1012ea9 Remove from the vendor branch files that are no longer
present in BIND 9.4.1.
2007-06-02 23:29:48 +00:00
Doug Barton
141cfa5029 Vendor import of BIND 9.4.1 2007-06-02 23:21:47 +00:00
Doug Barton
fa5fb0343e Vendor import of BIND 9.3.4 2007-01-29 18:31:57 +00:00
Doug Barton
fcb35ad9ef Remove from the vendor branch files that are no longer in the
9.3.3 sources.
2006-12-10 07:12:50 +00:00
Doug Barton
e99fbbb680 Vendor import of BIND 9.3.3 2006-12-10 07:09:56 +00:00
Doug Barton
a02f92e875 Update to version 9.3.2-P2, which addresses the vulnerability
announced by ISC dated 31 October (delivered via e-mail to the
bind-announce@isc.org list on 2 November):

Description:
        Because of OpenSSL's recently announced vulnerabilities
        (CAN-2006-4339, CVE-2006-2937 and CVE-2006-2940) which affect named,
        we are announcing this workaround and releasing patches.  A proof of
        concept attack on OpenSSL has been demonstrated for CAN-2006-4339.

        OpenSSL is required to use DNSSEC with BIND.

Fix for version 9.3.2-P1 and lower:
        Upgrade to BIND 9.3.2-P2, then generate new RSASHA1 and
        RSAMD5 keys for all old keys using the old default exponent
        and perform a key rollover to these new keys.

        These versions also change the default RSA exponent to be
        65537 which is not vulnerable to the attacks described in
        CAN-2006-4339.
2006-11-04 07:53:25 +00:00
Doug Barton
42b74b2549 Vendor import of BIND 9.3.2-P1, which addresses the following security
vulnerabilities:

http://www.niscc.gov.uk/niscc/docs/re-20060905-00590.pdf?lang=en
2066.  [security]      Handle SIG queries gracefully. [RT #16300]

http://www.kb.cert.org/vuls/id/697164
1941.  [bug]           ncache_adderesult() should set eresult even if no
                       rdataset is passed to it. [RT #15642]

All users of BIND 9 are encouraged to upgrade to this version.
2006-09-06 21:27:11 +00:00
Doug Barton
16cf7c033f Remove files from the vendor branch that are no longer present
in BIND 9.3.2 that were mistakenly removed from HEAD.
2006-01-14 02:11:56 +00:00
Doug Barton
b824835191 After some discussion with the folks at ISC, it turns out that the _ai_pad
part of the structure was a hack to maintain binary compatibility with
Sun binaries, and my understanding is that it's not needed generally
on sparc systems running other operating systems. Therefore, hide this
code behind the same set of tests as in lib/bind/include/netdb.h.

This file is being imported on the vendor branch because a similar change
(or change with similar effect) will be in the next version of BIND 9.

This change will not affect other platforms in any way.
2006-01-04 19:18:43 +00:00
Doug Barton
a00aca3467 Vendor import of BIND 9.3.2 2005-12-29 04:22:58 +00:00
Doug Barton
adaaaab975 Update the vendor branch with a patch to this file that was
researched by glebius, and incorporated by ISC into the next
version of BIND. Unfortunately, it looks like their release
will come after the release of FreeBSD 6, so we will bring
this in now.

The patch addresses a problem with high-load resolvers which
hit memory barriers. Without this patch, running the resolving
name server out of memory would lead to "unpredictable results."

Of course, the canonical answer to this problem is to put more
memory into the system, however that is not always possible, and
the code should be able to handle this situation gracefully in
any case.
2005-08-18 18:39:31 +00:00
Doug Barton
94b2911216 Remove files from the vendor branch that were [re]moved in 9.3.1 2005-03-17 08:10:34 +00:00
Doug Barton
6bc6438a36 Vendor import of BIND 9.3.1 2005-03-17 08:04:02 +00:00
Dag-Erling Smørgrav
8e4912ed06 Vendor import of BIND 9.3.0. 2004-09-23 07:18:50 +00:00
cvs2svn
444dbe19dd This commit was manufactured by cvs2svn to create branch 'VENDOR-bind9'. 2004-09-21 19:01:49 +00:00
Tom Rhodes
64aa1955c5 Vendor import of BIND 9.3.0rc4.
These three files were missed in the original import because their names
contained the magic letters w, i and n in that sequence.
2004-09-19 18:34:53 +00:00
Tom Rhodes
b1e4bd53e0 Vender import of BIND 9.3.0rc4. 2004-09-19 01:30:24 +00:00