BIND version 9 is a major rewrite of nearly all aspects of the underlying BIND
architecture. Some of the important features of BIND 9 are:
DNS Security: DNSSEC (signed zones), TSIG (signed DNS requests)
IP version 6: Answers DNS queries on IPv6 sockets, IPv6 resource records (AAAA)
Experimental IPv6 Resolver Library
DNS Protocol Enhancements: IXFR, DDNS, Notify, EDNS0
Improved standards conformance
Views: One server process can provide multiple "views" of the DNS namespace,
e.g. an "inside" view to certain clients, and an "outside" view to others.
Multiprocessor Support
BIND 9.9 includes a number of changes from BIND 9.8 and earlier releases,
including:
NXDOMAIN redirection
Improved startup and reconfiguration time, especially with large
numbers of authoritative zones
New "inline-signing" option, allows named to sign zones completely
transparently, including static zones
Many other new features, especially for DNSSEC
See the CHANGES file for more information on features.
WWW: https://www.isc.org/software/bind
===> The following configuration options are available for bind99-9.9.12_2:
DOCS=on: Build and/or install documentation
FETCHLIMIT=off: Enable the query quotas for resolvers
FILTER_AAAA=on: Enable filtering of AAAA records
FIXED_RRSET=off: Enable fixed rrset ordering
GOST=off: Enable GOST ciphers, needs SSL
IDN=on: International Domain Names support
IPV6=on: IPv6 protocol support
LARGE_FILE=off: 64-bit file support
MINCACHE=off: Use the mincachettl patch
NEWSTATS=off: Enable alternate xml statistics channel format
PORTREVISION=off: Show PORTREVISION in the version string
PYTHON=on: Build with Python utilities
QUERYTRACE=off: Enable the very verbose query tracelogging
RPZ_NSDNAME=on: Enable RPZ NSDNAME policy records
RPZ_NSIP=on: Enable RPZ NSIP trigger rules
RRL=on: Response Rate Limiting
SIGCHASE=on: dig/host/nslookup will do DNSSEC validation
SSL=on: Build with OpenSSL (Required for DNSSEC)
START_LATE=off: Start BIND late in the boot process (see help)
THREADS=on: Threading support
====> Dynamically Loadable Zones
DLZ_POSTGRESQL=off: DLZ Postgres driver
DLZ_MYSQL=off: DLZ MySQL driver (no threading)
DLZ_BDB=off: DLZ BDB driver
DLZ_LDAP=off: DLZ LDAP driver
DLZ_FILESYSTEM=on: DLZ filesystem driver
DLZ_STUB=off: DLZ stub driver
====> GSSAPI Security API support: you have to select exactly one of them
GSSAPI_BASE=off: GSSAPI Security API support (Heimdal in base)
GSSAPI_HEIMDAL=off: GSSAPI Security API support (security/heimdal)
GSSAPI_MIT=off: GSSAPI Security API support (security/krb5)
GSSAPI_NONE=on: No GSSAPI Security API support
===> Use 'make config' to modify these settings
Remove expired ports:
2018-06-30 dns/bind99: Going out of support, please migrate to dns/bind911
2018-06-30 dns/bind910: Going out of support, please migrate to dns/bind911
Add BIND9 9.13.0.
The ISC changed their release model, they are now doing
odd-unstable/even-stable release numbering. This is a development
version, consider it alpha/beta quality. The next stable release will
be 9.14.0.
Changes: https://kb.isc.org/article/AA-01612
Sponsored by: Absolight
Enable the FILTER_AAAA option by default, the feature was made non
optional in recent versions, so might as well do it in older ones.
PR: 226383
Sponsored by: Absolight
Teach named where its pid file should be by default, to be consistent
with the default configuration, rc script, man pages...
PR: 225687
Reported by: John W. O'Brien
Sponsored by: Absolight
Add a symlink to named's session-keyfile.
Using nsupdate -l, and chroot was broken because nsupdate could not find
the keyfile by itself.
PR: 223403
Submitted by: Harald Schmalzbauer
Sponsored by: Absolight
Remove special handling for testing and documentation domains, per RFC
6761 recommendations.
While there:
- Fix invalid syntax in sample slave config.
- Add a message about having syslogd working with BIND9 chroot.
PR: 217915
Reported by: eserte12 yahoo de
Sponsored by: Absolight
Update to 9.9.10, 9.10.5, 9.11.1 and 9.12 to latest snapshot.
While there:
Make it more maintainable by sorting stuff in the Makefile and removing
vestigial pre 10.3 things.
Refresh the root zone hints.
"Fix" the configuration section telling you to get some top level
zones from f.root-servers.net, which does not allow axfr any more. [1]
PR: 218656 [1]
Reported by: Thomas Steen Rasmussen / Tykling [1]
MFH: 2017Q2
Sponsored by: Absolight
Update to 9.9.9-P6, 9.10.4-P6 and 9.11.0-P3.
While there, remove the RPZ_PATCH for BIND9 9.9, it has not been updated
for years, and, it does not build any more.
MFH: 2017Q1
Security: CVE-2017-3135
Sponsored by: Absolight
So, on 9, it is failing to build it with jobs.
It builds .a before all the .o that are supposed to go in the .a are
built. Imagine what happens after that...
Reported by: Craig Leres
Sponsored by: Absolight
Remove MAKE_JOBS_UNSAFE for BIND9.
It was added in 2009 in r232247 without the reason it was failing, I've
tried with -J 2-10, and can't have one of the BIND9 port fail.
Feel free to add it back, but please, add the reason why it fails.
Sponsored by: Absolight
The NEWSTATS and RRL options were removed in BIND9 9.10, so remove them
from here, also, make the upstream default options default for real.
While there, put back the BIND_TOOLS knobs in bind9-devel.
Sponsored by: Absolight
Introduce BIND9 9.11.0b1. (beta1)
BIND 9.11 brings many changes to BIND, including a new license
(the Mozilla Public License 2.0 -- you can read about it here:
https://www.isc.org/blogs/bind9-adopts-the-mpl-2-0-license-with-bind-9-11-0/)
and many new features, including:
- Catalog zones, a new way to provision zones on slave servers
- dyndb api, a fast new api enabling BIND to serve zones stored
in a database (Developed by Petr Spacek of RedHat)
- RNDC showzone, view-only mode and other improvements
- dnstap query and response logging (Robert Edmonds is the author
of dnstap, see www.dnstap.info)
- EDNS Client-subnet (authoritative server functions)
- DNSSEC key manager, a new utility (Thanks to Sebastian Castro
for helping with development.)
- Automatic CDS/CDSKEY generation
- Negative Trust Anchors for DNSSEC validators
- IPv6 bias to encourage use of IPv6 DNS servers
- Minimal response to "any" queries (Thanks to Tony Finch for
the contribution)
- DNS Cookies are now enabled by default, using the standardized code point
Changes: https://lists.isc.org/pipermail/bind-announce/2016-June/000994.html
Sponsored by: Absolight
Fix usage of WITH_OPENSSL_BASE, WITH_OPENSSL_PORT and OPENSSL_PORT.
WITH_OPENSSL_* can't be set after bsd.port.pre.mk.
Fold all other usage into using SSL_DEFAULT == foo
PR: 210149
Submitted by: mat
Exp-run by: antoine
Sponsored by: The FreeBSD Foundation, Absolight
Differential Revision: https://reviews.freebsd.org/D6577
Add --with-dlopen=yes to the default options to allow using third
parties dlz drivers.
While there:
- enable the DLZ_FILESYSTEM option by default
- convert to USES=mysql and USES=bdb
Requested by: borius i ua
Sponsored by: Absolight
Stop bringing in OpenSSL from ports, it builds fine with the base one on
9, and WITH_OPENSSL_PORT does not belong in a port's Makefile anyway.
Not bumping PORTREVISION because:
- if you are building with poudriere, it will detect that a dependency
has changed and rebuild it.
- if you are building from ports, you will have OpenSSL from ports
installed, and it will choose to use it.
Sponsored by: Absolight
Fix build on -CURRENT. [1]
- Force building with libedit
- Bump PORTREVISION to account for accidental succesful builds
PR: 203273 [1]
Sponsored by: Absolight
When not using OpenSSL from ports, do not try to unmount the chrooted
engines directory.
PR: 201423 (based on)
Submitted by: girgen
Sponsored by: Absolight
Allow BIND 9.10 users to select the old key format when using GOST.[1]
While there, reword the options a bit, and the pkg-help files.
PR: 200031 [1]
Submitted by: Leo Vandewoestijne [1]
Sponsored by: Absolight
Update dns/bind99 to 9.9.7 and dns/bind910 to 9.10.2.
On 8 and 9, use the same configuration path than on 10+, ${PREFIX}/etc/namedb/.
Sponsored by: Absolight
configure no longer has problems detecting our arch like it had in bind95's
time, so remove ARCH modification, which leads to other problems, like [1]
PR: 193359 [1]
Submitted by: dinoex [1]
Sponsored by: Absolight
net/openldap24-*:
- Convert to USES=libtool and bump dependent ports
- Avoid USE_AUTOTOOLS
- Don't use PTHREAD_LIBS
- Use MAKE_CMD
databases/glom:
- Drop :keepla
- Add INSTALL_TARGET=install-strip
databases/libgda4* databases/libgda5*:
- Convert to USES=libtool and bump dependent ports
- USES=tar:xz
- Use INSTALL_TARGET=install-strip
- Use @sample
(Only the first 15 lines of the commit message are shown above )
Add a PYTHON option to bind99 and bind910, it installs a couple of dnssec
related utilities.
Use bind's own Makefiles for installation in bind-tools.
Sponsored by: Absolight
Don't install rndc.conf
It is generated by the rc script during the first startup. And if
the file is present, it messes up the rndc.key generation.
Poked by: Alain Audebert
Sponsored by: Absolight
The FreeBSD x11@ and graphics team proudly presents
a zeising, kwm production, with help from dumbbell, bdrewery:
NEW XORG ON FREEBSD 9-STABLE AND 10-STABLE
This update switches over to use the new xorg stack by default on FreeBSD 9
and 10 stable, on osversions where vt(9) is available.
It is still possible to use the old stack by specifying WITHOUT_NEW_XORG in
/etc/make.conf .
FreeBSD 8-STABLE and released versions of FreeBSD still use
the old version.
A package repository with binary packages for new xorg will
be available soon.
This patch also contains updates of libxcb and related ports, pixman, as well
(Only the first 15 lines of the commit message are shown above )
Two changes to the RC script
- Add a dependency on ldconfig
- Allow people to change the pidfile
PR: 188439
Submitted by: Oliver Lehmann
Sponsored by: Absolight
