Index: head/dns/bind910/Makefile =================================================================== --- head/dns/bind910/Makefile (revision 379325) +++ head/dns/bind910/Makefile (revision 379326) @@ -1,238 +1,238 @@ # $FreeBSD$ PORTNAME= bind PORTVERSION= ${ISCVERSION:S/-P/P/} .if defined(BIND_TOOLS_SLAVE) # dns/bind-tools here -PORTREVISION= 1 +PORTREVISION= 0 .else # dns/bind910 here -PORTREVISION= 2 +PORTREVISION= 0 .endif CATEGORIES= dns net ipv6 MASTER_SITES= ISC/bind9/${ISCVERSION} PKGNAMESUFFIX?= 910 DISTNAME= ${PORTNAME}-${ISCVERSION} MAINTAINER= mat@FreeBSD.org COMMENT?= BIND DNS suite with updated DNSSEC and DNS64 LICENSE= ISCL # ISC releases things like 9.8.0-P1, which our versioning doesn't like -ISCVERSION= 9.10.1-P1 +ISCVERSION= 9.10.1-P2 MAKE_JOBS_UNSAFE= yes USES= cpe CPE_VENDOR= isc CPE_VERSION= ${ISCVERSION:C/-.*//} .if ${ISCVERSION:M*-*} CPE_UPDATE= ${ISCVERSION:C/.*-//:tl} .endif LIB_DEPENDS= libxml2.so:${PORTSDIR}/textproc/libxml2 GNU_CONFIGURE= yes CONFIGURE_ARGS+= --localstatedir=/var --disable-linux-caps \ --disable-symtable \ --with-randomdev=/dev/random \ --with-libxml2=${LOCALBASE} ETCDIR= ${PREFIX}/etc/namedb CONFLICTS+= bind9*-9.[456789].* bind9*-sdb-9.[456789].* .if !defined(BIND_TOOLS_SLAVE) SUB_FILES= pkg-message .endif OPTIONS_DEFAULT= IPV6 SSL THREADS SIGCHASE IDN GSSAPI_NONE OPTIONS_DEFINE= IDN LARGE_FILE GOST PYTHON \ FIXED_RRSET SIGCHASE IPV6 THREADS FILTER_AAAA OPTIONS_RADIO= CRYPTO OPTIONS_RADIO_CRYPTO= SSL NATIVE_PKCS11 .if !defined(BIND_TOOLS_SLAVE) OPTIONS_DEFAULT+= RRL OPTIONS_DEFINE+= LINKS RPZ_NSIP RPZ_NSDNAME RRL DOCS NEWSTATS GEOIP OPTIONS_GROUP= DLZ OPTIONS_GROUP_DLZ= DLZ_POSTGRESQL DLZ_MYSQL DLZ_BDB \ DLZ_LDAP DLZ_FILESYSTEM DLZ_STUB .endif # BIND_TOOLS_SLAVE OPTIONS_SINGLE= GSSAPI OPTIONS_SINGLE_GSSAPI= GSSAPI_BASE GSSAPI_HEIMDAL GSSAPI_MIT GSSAPI_NONE OPTIONS_SUB= yes SSL_DESC= Build with OpenSSL (Required for DNSSEC) LARGE_FILE_DESC= 64-bit file support FIXED_RRSET_DESC= Enable fixed rrset ordering SIGCHASE_DESC= dig/host/nslookup will do DNSSEC validation FILTER_AAAA_DESC= Enable filtering of AAAA records CRYPTO_DESC= Choose which crypto engine to use NATIVE_PKCS11_DESC= Use PKCS\#11 native API (**READ HELP**) GEOIP_DESC= Allow geographically based ACL. GOST_DESC= Enable GOST ciphers, needs SSL (see help) PYTHON_DESC= Build with Python utilities LINKS_DESC= Create conf file symlinks in ${PREFIX} NEWSTATS_DESC= Enable alternate xml statistics channel format RPZ_NSIP_DESC= Enable RPZ NSIP trigger rules RPZ_NSDNAME_DESC= Enable RPZ NSDNAME policy records RRL_DESC= Response Rate Limiting DLZ_DESC= Dynamically Loadable Zones DLZ_POSTGRESQL_DESC= DLZ Postgres driver DLZ_MYSQL_DESC= DLZ MySQL driver (no threading) DLZ_BDB_DESC= DLZ BDB driver DLZ_LDAP_DESC= DLZ LDAP driver DLZ_FILESYSTEM_DESC= DLZ filesystem driver DLZ_STUB_DESC= DLZ stub driver GSSAPI_BASE_DESC= ${GSSAPI_DESC} (Heimdal in base) GSSAPI_HEIMDAL_DESC= ${GSSAPI_DESC} (security/heimdal) GSSAPI_MIT_DESC= ${GSSAPI_DESC} (security/krb5) GSSAPI_NONE_DESC= No ${GSSAPI_DESC} .if !defined(BIND_TOOLS_SLAVE) CONFLICTS+= bind-tools-9.* .endif # BIND_TOOLS_SLAVE SSL_CONFIGURE_ON= --with-openssl=${OPENSSLBASE} SSL_USE= openssl=yes SSL_CONFIGURE_OFF= --disable-openssl-version-check --without-openssl NEWSTATS_CONFIGURE_ENABLE= newstats IDN_USES= iconv IDN_CONFIGURE_ON= --with-idn=${LOCALBASE} ${ICONV_CONFIGURE_BASE} IDN_LIB_DEPENDS= libidnkit.so:${PORTSDIR}/dns/idnkit IDN_CONFIGURE_OFF= --without-idn LARGE_FILE_CONFIGURE_ENABLE= largefile SIGCHASE_CONFIGURE_ON= STD_CDEFINES="-DDIG_SIGCHASE=1" IPV6_CONFIGURE_ENABLE= ipv6 FILTER_AAAA_CONFIGURE_ENABLE= filter-aaaa NATIVE_PKCS11_CONFIGURE_ENABLE= native-pkcs11 GEOIP_CONFIGURE_WITH= geoip GEOIP_LIB_DEPENDS= libGeoIP.so:${PORTSDIR}/net/GeoIP GOST_CONFIGURE_WITH= gost PYTHON_CONFIGURE_WITH= python PYTHON_USES= python DLZ_POSTGRESQL_CONFIGURE_ON= --with-dlz-postgres=yes DLZ_POSTGRESQL_USES= pgsql FIXED_RRSET_CONFIGURE_ENABLE= fixed-rrset RPZ_NSIP_CONFIGURE_ENABLE= rpz-nsip RPZ_NSDNAME_CONFIGURE_ENABLE= rpz-nsdname RRL_CONFIGURE_ENABLE= rrl DLZ_MYSQL_CONFIGURE_ON= --with-dlz-mysql=yes DLZ_MYSQL_USE= mysql=yes DLZ_BDB_CONFIGURE_ON= --with-dlz-bdb=yes DLZ_BDB_USE= bdb=yes DLZ_LDAP_CONFIGURE_ON= --with-dlz-ldap=yes DLZ_LDAP_USE= openldap=yes DLZ_FILESYSTEM_CONFIGURE_ON= --with-dlz-filesystem=yes DLZ_STUB_CONFIGURE_ON= --with-dlz-stub=yes GSSAPI_BASE_USES= gssapi GSSAPI_BASE_CONFIGURE_ON= \ --with-gssapi=${GSSAPIBASEDIR} ${GSSAPI_CONFIGURE_ARGS} GSSAPI_HEIMDAL_USES= gssapi:heimdal GSSAPI_HEIMDAL_CONFIGURE_ON= \ --with-gssapi=${GSSAPIBASEDIR} ${GSSAPI_CONFIGURE_ARGS} GSSAPI_MIT_USES= gssapi:mit GSSAPI_MIT_CONFIGURE_ON= \ --with-gssapi=${GSSAPIBASEDIR} ${GSSAPI_CONFIGURE_ARGS} GSSAPI_NONE_CONFIGURE_ON= --without-gssapi .include .if !${PORT_OPTIONS:MLINKS} PKGINSTALL=${NONEXISTENT} .endif .if ${PORT_OPTIONS:MTHREADS} && !${PORT_OPTIONS:MDLZ_MYSQL} CONFIGURE_ARGS+= --enable-threads .else CONFIGURE_ARGS+= --disable-threads .endif .if ${OPSYS} == FreeBSD && ${OSVERSION} >= 1000100 PKGINSTALL= ${NONEXISTENT} PLIST_SUB+= NOBASE="" BASE="@comment " SUB_LIST+= NOBASE="" BASE="@comment " .if !defined(BIND_TOOLS_SLAVE) USE_RC_SUBR+= named SUB_FILES+= named.conf .endif # !defined(BIND_TOOLS_SLAVE) .if ${PORT_OPTIONS:MGOST} WITH_OPENSSL_PORT=yes .endif .else ETCDIR= ${PREFIX}/etc PLIST_SUB+= NOBASE="@comment " BASE="" SUB_LIST+= NOBASE="@comment " BASE="" .if ${PORT_OPTIONS:MSSL} WITH_OPENSSL_PORT= yes .endif .endif PKGDEINSTALL= ${PKGINSTALL} CONFIGURE_ARGS+= --prefix=${PREFIX} \ --sysconfdir=${ETCDIR} PORTDOCS= * .if !defined(BIND_TOOLS_SLAVE) post-patch: .for FILE in check/named-checkconf.8 named/named.8 nsupdate/nsupdate.1 \ rndc/rndc.8 @${REINPLACE_CMD} -e 's#/etc/named.conf#${ETCDIR}/named.conf#g' \ -e 's#/etc/rndc.conf#${ETCDIR}/rndc.conf#g' \ -e "s#/var\/run\/named\/named.pid#/var/run/named/pid#" \ ${WRKSRC}/bin/${FILE} .endfor post-install: .if ${PORT_OPTIONS:MDOCS} ${MKDIR} ${STAGEDIR}${DOCSDIR}/arm ${INSTALL_DATA} ${WRKSRC}/doc/arm/*.html ${STAGEDIR}${DOCSDIR}/arm ${INSTALL_DATA} ${WRKSRC}/doc/arm/Bv9ARM.pdf ${STAGEDIR}${DOCSDIR} ${INSTALL_DATA} ${WRKSRC}/CHANGES ${WRKSRC}/COPYRIGHT ${WRKSRC}/FAQ \ ${WRKSRC}/HISTORY ${WRKSRC}/README ${STAGEDIR}${DOCSDIR} .endif .if ${OPSYS} == FreeBSD && ${OSVERSION} >= 1000100 ${MKDIR} ${STAGEDIR}${ETCDIR} .for i in dynamic master slave working @${MKDIR} ${STAGEDIR}${ETCDIR}/$i .endfor ${INSTALL_DATA} ${WRKDIR}/named.conf ${STAGEDIR}${ETCDIR}/named.conf.sample ${INSTALL_DATA} ${FILESDIR}/named.root ${STAGEDIR}${ETCDIR} ${INSTALL_DATA} ${FILESDIR}/empty.db ${STAGEDIR}${ETCDIR}/master ${INSTALL_DATA} ${FILESDIR}/localhost-forward.db ${STAGEDIR}${ETCDIR}/master ${INSTALL_DATA} ${FILESDIR}/localhost-reverse.db ${STAGEDIR}${ETCDIR}/master .endif ${INSTALL_DATA} ${WRKSRC}/bin/rndc/rndc.conf \ ${STAGEDIR}${ETCDIR}/rndc.conf.sample .endif # BIND_TOOLS_SLAVE .include Index: head/dns/bind910/distinfo =================================================================== --- head/dns/bind910/distinfo (revision 379325) +++ head/dns/bind910/distinfo (revision 379326) @@ -1,2 +1,2 @@ -SHA256 (bind-9.10.1-P1.tar.gz) = 974343108d32f253a130383d0ba51290fb7bf372092f1451f264a9e3ac09898d -SIZE (bind-9.10.1-P1.tar.gz) = 8356463 +SHA256 (bind-9.10.1-P2.tar.gz) = 42dced2300ba6147168fe1b7faa2e7740e47b75e481290cd5e4483bd8b8a7feb +SIZE (bind-9.10.1-P2.tar.gz) = 8356565 Index: head/dns/bind910/files/patch-CVE-2015-1349 =================================================================== --- head/dns/bind910/files/patch-CVE-2015-1349 (revision 379325) +++ head/dns/bind910/files/patch-CVE-2015-1349 (nonexistent) @@ -1,52 +0,0 @@ -commit 12df718c23e29b16fcb5c12eace4b4a924de104d -Author: Evan Hunt -Date: Tue Feb 3 18:32:05 2015 -0800 - - [v9_10_1_patch] avoid crash due to managed-key rollover - - 4053. [security] Revoking a managed trust anchor and supplying - an untrusted replacement could cause named - to crash with an assertion failure. - (CVE-2015-1349) [RT #38344] - -diff --git a/CHANGES b/CHANGES -index 1234469..fc58de7 100644 ---- CHANGES -+++ CHANGES -@@ -1,3 +1,10 @@ -+ --- 9.10.1-P2 released --- -+ -+4053. [security] Revoking a managed trust anchor and supplying -+ an untrusted replacement could cause named -+ to crash with an assertion failure. -+ (CVE-2015-1349) [RT #38344] -+ - --- 9.10.1-P1 released --- - - 4006. [security] A flaw in delegation handling could be exploited -diff --git a/lib/dns/zone.c b/lib/dns/zone.c -index ef60454..2c4558e 100644 ---- lib/dns/zone.c -+++ lib/dns/zone.c -@@ -8946,6 +8946,12 @@ keyfetch_done(isc_task_t *task, isc_event_t *event) { - namebuf, tag); - trustkey = ISC_TRUE; - } -+ } else { -+ /* -+ * No previously known key, and the key is not -+ * secure, so skip it. -+ */ -+ continue; - } - - /* Delete old version */ -@@ -8994,7 +9000,7 @@ keyfetch_done(isc_task_t *task, isc_event_t *event) { - trust_key(zone, keyname, &dnskey, mctx); - } - -- if (!deletekey) { -+ if (secure && !deletekey) { - INSIST(newkey || updatekey); - set_refreshkeytimer(zone, &keydata, now); - } Property changes on: head/dns/bind910/files/patch-CVE-2015-1349 ___________________________________________________________________ Deleted: fbsd:nokeywords ## -1 +0,0 ## -yes \ No newline at end of property Deleted: svn:eol-style ## -1 +0,0 ## -native \ No newline at end of property Deleted: svn:mime-type ## -1 +0,0 ## -text/plain \ No newline at end of property Index: head/dns/bind99/Makefile =================================================================== --- head/dns/bind99/Makefile (revision 379325) +++ head/dns/bind99/Makefile (revision 379326) @@ -1,219 +1,219 @@ # $FreeBSD$ PORTNAME= bind PORTVERSION= ${ISCVERSION:S/-P/P/} -PORTREVISION= 4 +PORTREVISION= 0 CATEGORIES= dns net ipv6 MASTER_SITES= ISC/bind9/${ISCVERSION} PKGNAMESUFFIX= 99 DISTNAME= ${PORTNAME}-${ISCVERSION} MAINTAINER= mat@FreeBSD.org COMMENT= BIND DNS suite with updated DNSSEC and DNS64 LICENSE= ISCL # ISC releases things like 9.8.0-P1, which our versioning doesn't like -ISCVERSION= 9.9.6-P1 +ISCVERSION= 9.9.6-P2 MAKE_JOBS_UNSAFE= yes USES= cpe CPE_VENDOR= isc CPE_VERSION= ${ISCVERSION:C/-.*//} .if ${ISCVERSION:M*-*} CPE_UPDATE= ${ISCVERSION:C/.*-//:tl} .endif LIB_DEPENDS= libxml2.so:${PORTSDIR}/textproc/libxml2 GNU_CONFIGURE= yes CONFIGURE_ARGS= --localstatedir=/var --disable-linux-caps \ --disable-symtable \ --with-randomdev=/dev/random \ --with-libxml2=${LOCALBASE} ETCDIR= ${PREFIX}/etc/namedb CONFLICTS= bind9*-9.[45678].* bind9*-sdb-9.[45678].* bind-tools-9.* SUB_FILES= pkg-message OPTIONS_DEFAULT= IPV6 SSL THREADS SIGCHASE IDN GSSAPI_NONE RRL OPTIONS_DEFINE= SSL IDN REPLACE_BASE LARGE_FILE FIXED_RRSET SIGCHASE \ IPV6 THREADS FILTER_AAAA GOST PYTHON \ LINKS RPZ_NSIP RPZ_NSDNAME RRL DOCS RPZ_PATCH NEWSTATS OPTIONS_GROUP= DLZ OPTIONS_GROUP_DLZ= DLZ_POSTGRESQL DLZ_MYSQL DLZ_BDB \ DLZ_LDAP DLZ_FILESYSTEM DLZ_STUB OPTIONS_SINGLE= GSSAPI OPTIONS_SINGLE_GSSAPI= GSSAPI_BASE GSSAPI_HEIMDAL GSSAPI_MIT GSSAPI_NONE OPTIONS_SUB= yes SSL_DESC= Build with OpenSSL (Required for DNSSEC) REPLACE_BASE_DESC= EOL, no longer supported LARGE_FILE_DESC= 64-bit file support FIXED_RRSET_DESC= Enable fixed rrset ordering SIGCHASE_DESC= dig/host/nslookup will do DNSSEC validation FILTER_AAAA_DESC= Enable filtering of AAAA records GOST_DESC= Enable GOST ciphers, needs SSL (see help) PYTHON_DESC= Build with Python utilities LINKS_DESC= Create conf file symlinks in ${PREFIX} NEWSTATS_DESC= Enable alternate xml statistics channel format RPZ_NSIP_DESC= Enable RPZ NSIP trigger rules RPZ_NSDNAME_DESC= Enable RPZ NSDNAME policy records RPZ_PATCH_DESC= RPZ improvements RRL_DESC= Response Rate Limiting DLZ_DESC= Dynamically Loadable Zones DLZ_POSTGRESQL_DESC= DLZ Postgres driver DLZ_MYSQL_DESC= DLZ MySQL driver (no threading) DLZ_BDB_DESC= DLZ BDB driver DLZ_LDAP_DESC= DLZ LDAP driver DLZ_FILESYSTEM_DESC= DLZ filesystem driver DLZ_STUB_DESC= DLZ stub driver GSSAPI_BASE_DESC= ${GSSAPI_DESC} (Heimdal in base) GSSAPI_HEIMDAL_DESC= ${GSSAPI_DESC} (security/heimdal) GSSAPI_MIT_DESC= ${GSSAPI_DESC} (security/krb5) GSSAPI_NONE_DESC= No ${GSSAPI_DESC} SSL_CONFIGURE_ON= --with-openssl=${OPENSSLBASE} SSL_USE= openssl=yes SSL_CONFIGURE_OFF= --disable-openssl-version-check --without-openssl NEWSTATS_CONFIGURE_ENABLE= newstats IDN_USES= iconv IDN_CONFIGURE_ON= --with-idn=${LOCALBASE} ${ICONV_CONFIGURE_BASE} IDN_LIB_DEPENDS= libidnkit.so:${PORTSDIR}/dns/idnkit IDN_CONFIGURE_OFF= --without-idn LARGE_FILE_CONFIGURE_ENABLE= largefile SIGCHASE_CONFIGURE_ON= STD_CDEFINES="-DDIG_SIGCHASE=1" IPV6_CONFIGURE_ENABLE= ipv6 FILTER_AAAA_CONFIGURE_ENABLE= filter-aaaa GOST_CONFIGURE_WITH= gost PYTHON_CONFIGURE_WITH= python PYTHON_USES= python DLZ_POSTGRESQL_CONFIGURE_ON= --with-dlz-postgres=yes DLZ_POSTGRESQL_USES= pgsql FIXED_RRSET_CONFIGURE_ENABLE= fixed-rrset RPZ_NSIP_CONFIGURE_ENABLE= rpz-nsip RPZ_NSDNAME_CONFIGURE_ENABLE= rpz-nsdname -RPZ_PATCH_PATCHFILES= ${ISCVERSION}-rpz2+rl.14038.05.patch:vix -RPZ_PATCH_PATCH_SITES= http://ss.vix.su/~vjs/:vix ${MASTER_SITE_LOCAL:S/%SUBDIR%/mat\/bind/:S/$/:vix/} +RPZ_PATCH_PATCHFILES= ${ISCVERSION}-rpz2+rl.14038.05.patch.xz:vix +RPZ_PATCH_PATCH_SITES= http://ss.vix.su/~vjs/:vix LOCAL/mat/bind:vix RRL_CONFIGURE_ENABLE= rrl DLZ_MYSQL_CONFIGURE_ON= --with-dlz-mysql=yes DLZ_MYSQL_USE= mysql=yes DLZ_BDB_CONFIGURE_ON= --with-dlz-bdb=yes DLZ_BDB_USE= bdb=yes DLZ_LDAP_CONFIGURE_ON= --with-dlz-ldap=yes DLZ_LDAP_USE= openldap=yes DLZ_FILESYSTEM_CONFIGURE_ON= --with-dlz-filesystem=yes DLZ_STUB_CONFIGURE_ON= --with-dlz-stub=yes GSSAPI_BASE_USES= gssapi GSSAPI_BASE_CONFIGURE_ON= \ --with-gssapi=${GSSAPIBASEDIR} ${GSSAPI_CONFIGURE_ARGS} GSSAPI_HEIMDAL_USES= gssapi:heimdal GSSAPI_HEIMDAL_CONFIGURE_ON= \ --with-gssapi=${GSSAPIBASEDIR} ${GSSAPI_CONFIGURE_ARGS} GSSAPI_MIT_USES= gssapi:mit GSSAPI_MIT_CONFIGURE_ON= \ --with-gssapi=${GSSAPIBASEDIR} ${GSSAPI_CONFIGURE_ARGS} GSSAPI_NONE_CONFIGURE_ON= --without-gssapi .include .if !${PORT_OPTIONS:MLINKS} PKGINSTALL=${NONEXISTENT} .endif .if ${PORT_OPTIONS:MTHREADS} && !${PORT_OPTIONS:MDLZ_MYSQL} CONFIGURE_ARGS+= --enable-threads .else CONFIGURE_ARGS+= --disable-threads .endif .if ${PORT_OPTIONS:MREPLACE_BASE} IGNORE= REPLACE_BASE is no longer supported .endif # REPLACE_BASE .if ${OPSYS} == FreeBSD && ${OSVERSION} >= 1000100 PKGINSTALL= ${NONEXISTENT} PLIST_SUB+= NOBASE="" BASE="@comment " SUB_LIST+= NOBASE="" BASE="@comment " USE_RC_SUBR+= named SUB_FILES+= named.conf .if ${PORT_OPTIONS:MGOST} WITH_OPENSSL_PORT=yes .endif .else ETCDIR= ${PREFIX}/etc PLIST_SUB+= NOBASE="@comment " BASE="" SUB_LIST+= NOBASE="@comment " BASE="" .if ${PORT_OPTIONS:MSSL} WITH_OPENSSL_PORT= yes .endif .endif PKGDEINSTALL= ${PKGINSTALL} CONFIGURE_ARGS+= --prefix=${PREFIX} \ --sysconfdir=${ETCDIR} PORTDOCS= * post-patch: .for FILE in check/named-checkconf.8 named/named.8 nsupdate/nsupdate.1 \ rndc/rndc.8 @${REINPLACE_CMD} -e 's#/etc/named.conf#${ETCDIR}/named.conf#g' \ -e 's#/etc/rndc.conf#${ETCDIR}/rndc.conf#g' \ -e "s#/var\/run\/named\/named.pid#/var/run/named/pid#" \ ${WRKSRC}/bin/${FILE} .endfor post-configure: @${REINPLACE_CMD} -e '/^SO_LDFLAGS/s/-Wl,-rpath,/-rpath /' ${WRKSRC}/bin/tests/system/dlzexternal/Makefile post-install: .if ${PORT_OPTIONS:MDOCS} ${MKDIR} ${STAGEDIR}${DOCSDIR}/arm ${INSTALL_DATA} ${WRKSRC}/doc/arm/*.html ${STAGEDIR}${DOCSDIR}/arm ${INSTALL_DATA} ${WRKSRC}/doc/arm/Bv9ARM.pdf ${STAGEDIR}${DOCSDIR} ${INSTALL_DATA} ${WRKSRC}/CHANGES ${WRKSRC}/COPYRIGHT ${WRKSRC}/FAQ \ ${WRKSRC}/HISTORY ${WRKSRC}/README ${STAGEDIR}${DOCSDIR} .endif .if ${OPSYS} == FreeBSD && ${OSVERSION} >= 1000100 ${MKDIR} ${STAGEDIR}${ETCDIR} .for i in dynamic master slave working @${MKDIR} ${STAGEDIR}${ETCDIR}/$i .endfor ${INSTALL_DATA} ${WRKDIR}/named.conf ${STAGEDIR}${ETCDIR}/named.conf.sample ${INSTALL_DATA} ${FILESDIR}/named.root ${STAGEDIR}${ETCDIR} ${INSTALL_DATA} ${FILESDIR}/empty.db ${STAGEDIR}${ETCDIR}/master ${INSTALL_DATA} ${FILESDIR}/localhost-forward.db ${STAGEDIR}${ETCDIR}/master ${INSTALL_DATA} ${FILESDIR}/localhost-reverse.db ${STAGEDIR}${ETCDIR}/master .endif ${INSTALL_DATA} ${WRKSRC}/bin/rndc/rndc.conf \ ${STAGEDIR}${ETCDIR}/rndc.conf.sample .include Index: head/dns/bind99/distinfo =================================================================== --- head/dns/bind99/distinfo (revision 379325) +++ head/dns/bind99/distinfo (revision 379326) @@ -1,4 +1,4 @@ -SHA256 (bind-9.9.6-P1.tar.gz) = dfedcb2b414d2803accd1a9c21d183178a288f40a2486af5ec0d3369a8cb8526 -SIZE (bind-9.9.6-P1.tar.gz) = 7816337 -SHA256 (9.9.6-P1-rpz2+rl.14038.05.patch) = b978d634c3deb1de42418700ac28ec947373f8979a4bbe2230d0eea462a6cc86 -SIZE (9.9.6-P1-rpz2+rl.14038.05.patch) = 194778 +SHA256 (bind-9.9.6-P2.tar.gz) = 5e882f453a8c799a121272f68bdb90936ce97bb857f8c2b3af1c8ba3d1b749ed +SIZE (bind-9.9.6-P2.tar.gz) = 7816640 +SHA256 (9.9.6-P2-rpz2+rl.14038.05.patch.xz) = b69825ddee742dbb342f2da4265ff2139256ad79bd0d029ba010b7bf98f2d1e5 +SIZE (9.9.6-P2-rpz2+rl.14038.05.patch.xz) = 38792 Index: head/dns/bind99/files/patch-CVE-2015-1349 =================================================================== --- head/dns/bind99/files/patch-CVE-2015-1349 (revision 379325) +++ head/dns/bind99/files/patch-CVE-2015-1349 (nonexistent) @@ -1,52 +0,0 @@ -commit 2e9d79f169663c9aff5f0dcdc626a2cd2dbb5892 -Author: Evan Hunt -Date: Tue Feb 3 18:30:38 2015 -0800 - - [v9_9_6_patch] avoid crash due to managed-key rollover - - 4053. [security] Revoking a managed trust anchor and supplying - an untrusted replacement could cause named - to crash with an assertion failure. - (CVE-2015-1349) [RT #38344] - -diff --git a/CHANGES b/CHANGES -index e8d75ea..b45be6d 100644 ---- CHANGES -+++ CHANGES -@@ -1,3 +1,10 @@ -+ --- 9.9.6-P2 released --- -+ -+4053. [security] Revoking a managed trust anchor and supplying -+ an untrusted replacement could cause named -+ to crash with an assertion failure. -+ (CVE-2015-1349) [RT #38344] -+ - --- 9.9.6-P1 released --- - - 4006. [security] A flaw in delegation handling could be exploited -diff --git a/lib/dns/zone.c b/lib/dns/zone.c -index 7a9825b..5db2844 100644 ---- lib/dns/zone.c -+++ lib/dns/zone.c -@@ -8508,6 +8508,12 @@ keyfetch_done(isc_task_t *task, isc_event_t *event) { - namebuf, tag); - trustkey = ISC_TRUE; - } -+ } else { -+ /* -+ * No previously known key, and the key is not -+ * secure, so skip it. -+ */ -+ continue; - } - - /* Delete old version */ -@@ -8556,7 +8562,7 @@ keyfetch_done(isc_task_t *task, isc_event_t *event) { - trust_key(zone, keyname, &dnskey, mctx); - } - -- if (!deletekey) { -+ if (secure && !deletekey) { - INSIST(newkey || updatekey); - set_refreshkeytimer(zone, &keydata, now); - } Property changes on: head/dns/bind99/files/patch-CVE-2015-1349 ___________________________________________________________________ Deleted: fbsd:nokeywords ## -1 +0,0 ## -yes \ No newline at end of property Deleted: svn:eol-style ## -1 +0,0 ## -native \ No newline at end of property Deleted: svn:mime-type ## -1 +0,0 ## -text/plain \ No newline at end of property