aboutsummaryrefslogtreecommitdiff
path: root/net/bind
Commit message (Collapse)AuthorAge
* bind: bump to 9.18.24Noah Meyerhans2024-02-16
| | | | | | | | | | | | | | | | | | Fixes CVEs: - CVE-2023-50387: Validating DNS messages containing a lot of DNSSEC signatures could cause excessive CPU load, leading to a denial-of-service condition. - CVE-2023-50868: Preparing an NSEC3 closest encloser proof could cause excessive CPU load, leading to a denial-of-service condition. - CVE-2023-4408: Parsing DNS messages with many different names could cause excessive CPU load. - CVE-2023-5517: Specific queries could cause named to crash with an assertion failure when nxdomain-redirect was enabled. - CVE-2023-5679: A bad interaction between DNS64 and serve-stale could cause named to crash with an assertion failure, when both of these features were enabled. Signed-off-by: Noah Meyerhans <frodo@morgul.net>
* bind: bump to 9.18.19Noah Meyerhans2023-09-27
| | | | | | | | | | | | | | Fixes CVEs: CVE-2023-3341 - Previously, sending a specially crafted message over the control channel could cause the packet-parsing code to run out of available stack memory, causing named to terminate unexpectedly. CVE-2023-4236 - A flaw in the networking code handling DNS-over-TLS queries could cause named to terminate unexpectedly due to an assertion failure under significant DNS-over-TLS query load. Signed-off-by: Noah Meyerhans <frodo@morgul.net>
* bind: update to version 9.18.18Josef Schlehofer2023-09-20
| | | | | | | | Release notes: https://downloads.isc.org/isc/bind9/9.18.18/doc/arm/html/notes.html#notes-for-bind-9-18-18 https://downloads.isc.org/isc/bind9/9.18.17/doc/arm/html/notes.html#notes-for-bind-9-18-17 Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
* bind: bump to 9.18.16Noah Meyerhans2023-06-25
| | | | | | | | | | | | | | | | | | Fixes CVEs: - CVE-2023-2828: The overmem cleaning process has been improved, to prevent the cache from significantly exceeding the configured max-cache-size limit. - CVE-2023-2911: A query that prioritizes stale data over lookup triggers a fetch to refresh the stale data in cache. If the fetch is aborted for exceeding the recursion quota, it was possible for named to enter an infinite callback loop and crash due to stack overflow. The complete list of changes is available in the upstream release notes at https://ftp.isc.org/isc/bind9/cur/9.18/doc/arm/html/notes.html#notes-for-bind-9-18-16 Signed-off-by: Noah Meyerhans <frodo@morgul.net>
* treewide: refactor to use PKG_BUILD_FLAGS:=no-mips16Andre Heider2023-04-08
| | | | | | | See commit 5c545bdb "treewide: replace PKG_USE_MIPS16:=0 with PKG_BUILD_FLAGS:=no-mips16" on the main repository. Signed-off-by: Andre Heider <a.heider@gmail.com>
* bind: bump PKG_RELEASENoah Meyerhans2023-02-05
|
* bind: add option to enable GSSAPI supportStijn Tintel2023-02-05
| | | | | | | Samba4 running as Active Directory Domain Controller with the internal DNS backend requires the nsupdate binary with GSSAPI support. Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
* bind: bump release numberRucke Teg2023-02-05
| | | | Signed-off-by: Rucke Teg <rucketeg@protonmail.com>
* bind: Fix ipv6 detection logicRucke Teg2023-02-05
| | | | | | | Bug was introduced in a7b770eec4370087a5ccd27887386dac9266214e and results in bind always stating with the `-4` flag. Signed-off-by: Rucke Teg <rucketeg@protonmail.com>
* bind: update to 9.18.11Noah Meyerhans2023-01-28
| | | | | | | | | | | | | | | | | Fixes CVEs: - CVE-2022-3924: Fix serve-stale crash when recursive clients soft quota is reached. - CVE-2022-3736: Handle RRSIG lookups when serve-stale is active. - CVE-2022-3094: An UPDATE message flood could cause named to exhaust all available memory. This flaw was addressed by adding a new "update-quota" statement that controls the number of simultaneous UPDATE messages that can be processed or forwarded. The default is 100. A stats counter has been added to record events when the update quota is exceeded, and the XML and JSON statistics version numbers have been updated. Signed-off-by: Noah Meyerhans <frodo@morgul.net>
* bind: disable geoipJavier Marcet2023-01-09
| | | | | Signed-off-by: Javier Marcet <javier@marcet.info> [modified also PKG_RELEASE]
* bind: start up with -4 if not listening on ipv6 addressesPhilip Prindeville2023-01-02
| | | | Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
* bind: update to version 9.18.10Philip Prindeville2022-12-28
| | | | Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
* bind: bump to 9.18.7Noah Meyerhans2022-09-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes multiple security issues: CVE-2022-38178 - Fix memory leak in EdDSA verify processing CVE-2022-3080 - Fix serve-stale crash that could happen when stale-answer-client-timeout was set to 0 and there was a stale CNAME in the cache for an incoming query CVE-2022-2906 - Fix memory leaks in the DH code when using OpenSSL 3.0.0 and later versions. The openssldh_compare(), openssldh_paramcompare(), and openssldh_todns() functions were affected CVE-2022-2881 - When an HTTP connection was reused to get statistics from the stats channel, and zlib compression was in use, each successive response sent larger and larger blocks of memory, potentially reading past the end of the allocated buffer CVE-2022-2795 - Prevent excessive resource use while processing large delegations Signed-off-by: Noah Meyerhans <frodo@morgul.net>
* bind: update to version 9.18.4Josef Schlehofer2022-06-24
| | | | | | | Fixes: - CVE-2022-1183 Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
* Merge pull request #18055 from pprindeville/bind-subpackage-ddns-confgenPhilip Prindeville2022-03-23
|\ | | | | bind: add subpackaging for ddns-confgen
| * bind: add subpackaging for ddns-confgenPhilip Prindeville2022-03-13
| | | | | | | | | | | | | | ddns-confgen is a useful tool for generating partial zones for transfer/update in dynamic DNS (ddns) scenarios. Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
* | bind: bump to 9.18.1Noah Meyerhans2022-03-18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes multiple security issues: * CVE-2022-0667 -- An assertion could occur in resume_dslookup() if the fetch had been shut down earlier * CVE-2022-0635 -- Lookups involving a DNAME could trigger an INSIST when "synth-from-dnssec" was enabled * CVE-2022-0396 -- A synchronous call to closehandle_cb() caused isc__nm_process_sock_buffer() to be called recursively, which in turn left TCP connections hanging in the CLOSE_WAIT state blocking indefinitely when out-of-order processing was disabled. * CVE-2021-25220 -- The rules for acceptance of records into the cache have been tightened to prevent the possibility of poisoning if forwarders send records outside the configured bailiwick Signed-off-by: Noah Meyerhans <frodo@morgul.net>
* | bind: fix warnings about unknown optionsPhilip Prindeville2022-03-17
| | | | | | | | Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
* | named: don't leak mktemp files on reloadPhilip Prindeville2022-03-15
| | | | | | | | | | | | | | | | | | Unless we're using "mktemp -u ..." (not recommended), it will create the temp file as part of its safety checking. Thus you should only create the name (file) if you're going to use it, and always remove it if you have created it. Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
* | bind: support compile-time exclusion of DNS-over-HTTPS supportNoah Meyerhans2022-02-07
| | | | | | | | | | | | | | | | DoH is enabled by default, but disabling it removes the need to link against libnghttp2, which may be desirable more constrained environments. Signed-off-by: Noah Meyerhans <frodo@morgul.net>
* | bind: bump to 9.18.0Noah Meyerhans2022-02-01
|/ | | | Signed-off-by: Noah Meyerhans <frodo@morgul.net>
* bind: bump to 9.17.20Noah Meyerhans2021-11-22
| | | | Signed-off-by: Noah Meyerhans <frodo@morgul.net>
* bind: created /var/run/named directoryPhilip Prindeville2021-10-31
| | | | | | | Side-effect of dropping capabilities(7) with last commit is now we need the `/var/run/named/` directory created for us at startup. Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
* Merge pull request #16992 from pprindeville/named-restart-intf-flapPhilip Prindeville2021-10-28
|\ | | | | bind: detect new interfaces when they come up
| * bind: detect new interfaces when they come upPhilip Prindeville2021-10-28
| | | | | | | | | | | | | | | | Reload the service when interfaces flap; note that libcap support is required to open new sockets on interfaces coming up during a reload, otherwise a full restart would be needed. Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
* | Merge pull request #17010 from pprindeville/bind-update-9.17.19Philip Prindeville2021-10-28
|\ \ | | | | | | bind: Bump to 9.17.19
| * | bind: Bump to 9.17.19Philip Prindeville2021-10-28
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | The following CVE updates are included: * CVE-2021-25219: The "lame-ttl" option is now forcibly set to 0. This effectively disables the lame server cache, as it could previously be abused by an attacker to significantly degrade resolver performance. * CVE-2021-25218: An assertion failure occurred when named attempted to send a UDP packet that exceeded the MTU size, if Response Rate Limiting (RRL) was enabled. Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
* / bind: deprecate managed-keysPhilip Prindeville2021-10-27
|/ | | | | | | | | | | | This has been replaced with the "trust-anchors" keyword, per section 8.21.1 New Features of the Bind 9 Administrator Reference Manual: • In order to clarify the configuration of DNSSEC keys, the trusted-keys and managed-keys statements have been deprecated, and the new trust-anchors statement should now be used for both types of key. When used with the keyword initial-key, trust-anchors has the same behavior as managed-keys, i.e., it configures a trust anchor that is to be maintained via RFC 5011. When used with the new keyword static-key, trust-anchors has the same behavior as trusted-keys, i.e., it configures a permanent trust anchor that will not automatically be updated. (This usage is not recommended for the root key.) [GL #6] Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
* bind: bump to 9.17.13Noah Meyerhans2021-05-27
| | | | Signed-off-by: Noah Meyerhans <frodo@morgul.net>
* bind: bump to 9.17.12Noah Meyerhans2021-04-29
| | | | | | | | | | | | | | | | Fixes the following security issues: * CVE-2021-25215 - named crashed when a DNAME record placed in the ANSWER section during DNAME chasing turned out to be the final answer to a client query. * CVE-2021-25214 - Insufficient IXFR checks could result in named serving a zone without an SOA record at the apex, leading to a RUNTIME_CHECK assertion failure when the zone was subsequently refreshed. This has been fixed by adding an owner name check for all SOA records which are included in a zone transfer. Signed-off-by: Noah Meyerhans <frodo@morgul.net>
* bind: update to 9.17.11Rosen Penev2021-03-21
| | | | | | Backport upstream OpenSSL deprecated API patch. Signed-off-by: Rosen Penev <rosenp@gmail.com>
* bind: fix linking with full language support enabledMichael Heimpold2021-03-04
| | | | | | | After d18692c, we need to include nls.mk to setup correct environment variables so that linking succeeds. Signed-off-by: Michael Heimpold <mhei@heimpold.de>
* bind: bump to 9.17.10Noah Meyerhans2021-02-18
| | | | | | Add build dependency on libnghttp2 for DNS-over-HTTPS support Signed-off-by: Noah Meyerhans <frodo@morgul.net>
* bind: bump to 9.17.9Noah Meyerhans2021-01-29
| | | | | | | | | | | | Drop obsolete patches - 001-no-tests.patch - 002-fix-cross-compilation.patch Move several user-executable binaries from /usr/sbin to /usr/bin per upstream. Signed-off-by: Noah Meyerhans <frodo@morgul.net>
* bind: start named early enough to be present when isc-dhcp startsPhilip Prindeville2020-12-15
| | | | | | | | | | | | Start named before dhcpd so that dhcpd can prime the local zones at startup. Restore the empty domain zone for rfc1918 addresses that previously existed. Create an additional subsidiary named.conf.local file (initially empty) in /tmp/bind/ that can be seeded with dynamic zones and primed with "rndc reload", and add it to the watched list of config files for procd. Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
* bind: add support for the 'rndc' utilityPhilip Prindeville2020-12-13
| | | | | | | | Enable the control port on named that rncd uses to talk to it. Use rndc to allow for lightweight reloads of some (per-zone) or all of the database without an interruption of service. Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
* bind: update to version 9.16.8Josef Schlehofer2020-10-31
| | | | | | | | | | | - DNS Flag Day 2020 (default EDNS buffer size changed from 4096 to 1232 bytes) -- Added patch, which should be part of the next release It fixes an issue while cross-compilation (I linked it in the commit message with issue link) Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
* bind: update to version 9.16.7Josef Schlehofer2020-10-05
| | | | Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
* bind: New upstream version 9.16.6Noah Meyerhans2020-08-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | Several security issures are addressed: - CVE-2020-8620 It was possible to trigger an assertion failure by sending a specially crafted large TCP DNS message. - CVE-2020-8621 named could crash after failing an assertion check in certain query resolution scenarios where QNAME minimization and forwarding were both enabled. To prevent such crashes, QNAME minimization is now always disabled for a given query resolution process, if forwarders are used at any point. - CVE-2020-8622 It was possible to trigger an assertion failure when verifying the response to a TSIG-signed request. - CVE-2020-8623 When BIND 9 was compiled with native PKCS#11 support, it was possible to trigger an assertion failure in code determining the number of bits in the PKCS#11 RSA public key with a specially crafted packet. - CVE-2020-8624 update-policy rules of type subdomain were incorrectly treated as zonesub rules, which allowed keys used in subdomain rules to update names outside of the specified subdomains. The problem was fixed by making sure subdomain rules are again processed as described in the ARM. Full release notes are available at https://ftp.isc.org/isc/bind9/9.16.6/doc/arm/html/notes.html#notes-for-bind-9-16-6 Signed-off-by: Noah Meyerhans <frodo@morgul.net>
* bind: update to 9.16.4Tiago Gaspar2020-07-04
| | | | | | | | | | | This update fixes the following CVE's: - CVE-2020-8618 - CVE-2020-8619 More info on bug fixes and feature changes in: https://downloads.isc.org/isc/bind9/9.16.4/doc/arm/html/notes.html Signed-off-by: Tiago Gaspar <tiagogaspar8@gmail.com>
* bind: add nslookup alternative to busybox nslookupIan Cooper2020-05-26
| | | | | | | Add alternative to busybox nslookup. Busybox throws an error when the host does not have an AAAA record. Signed-off-by: Ian Cooper <iancooper@hotmail.com>
* bind: update to version 9.16.3Josef Schlehofer2020-05-20
| | | | | | | | Fixes: CVE-2020-8616 CVE-2020-8617 Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
* bind: update to version (security fix)Jan Pavlinec2020-05-01
| | | | Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
* bind9: update to 9.16.1Noah Meyerhans2020-04-07
| | | | | | | | Add libuv dependency Fix optional libxml and c-json dependency handling Signed-off-by: Noah Meyerhans <frodo@morgul.net>
* bind: use json-c instead of jsoncppRosen Penev2020-04-07
| | | | | | | The configure script prefers the latter whereas the code prefers the latter. Hack around it. Signed-off-by: Rosen Penev <rosenp@gmail.com>
* bind: update to version 9.14.8 (security fix)Jan Pavlinec2019-11-21
| | | | | | Fixes CVE-2019-6477 Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
* bind: Update to version 9.14.7Josef Schlehofer2019-11-06
| | | | | | Fixes CVE-2019-6475 and CVE-2019-6476 Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
* bind: Update to version 9.14.6Josef Schlehofer2019-09-19
| | | | Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
* bind: Update to version 9.14.5Josef Schlehofer2019-09-01
| | | | | | Add PKG_LICENSE_FILES Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Powered by cgit, Themed by Ted Yin.