Content-Disposition: inline
Content-Transfer-Encoding: 8bit
Content-Type: text/plain; charset="US-ASCII"
MIME-Version: 1.0
Date: Mon, 2 May 2016 13:22:06 +0000
From: "Takahiro Kambe" <taca@netbsd.org>
Subject: CVS commit: pkgsrc/net/bind99
To: pkgsrc-changes@NetBSD.org
Reply-To: taca@netbsd.org
Message-Id: <20160502132206.9AF07FBBA@cvs.NetBSD.org>
Sender: pkgsrc-changes-owner@NetBSD.org
Precedence: bulk

Module Name:	pkgsrc
Committed By:	taca
Date:		Mon May  2 13:22:06 UTC 2016

Modified Files:
	pkgsrc/net/bind99: Makefile PLIST distinfo
	pkgsrc/net/bind99/patches: patch-lib_dns_rbt.c

Log Message:
Update bind99 to 9.9.9 (BIND 9.9.9).

All Security Fixes should be fixed by 9.9.8-P4.

Security Fixes

     * The resolver could abort with an assertion failure due to improper
       DNAME handling when parsing fetch reply messages. This flaw is
       disclosed in CVE-2016-1286. [RT #41753]
     * Malformed control messages can trigger assertions in named and
       rndc. This flaw is disclosed in CVE-2016-1285. [RT #41666]
     * Specific APL data could trigger an INSIST. This flaw is disclosed
       in CVE-2015-8704. [RT #41396]
     * Incorrect reference counting could result in an INSIST failure if a
       socket error occurred while performing a lookup. This flaw is
       disclosed in CVE-2015-8461. [RT#40945]
     * Insufficient testing when parsing a message allowed records with an
       incorrect class to be be accepted, triggering a REQUIRE failure
       when those records were subsequently cached. This flaw is disclosed
       in CVE-2015-8000. [RT #40987]

New Features

     * The following resource record types have been implemented: AVC,
       CSYNC, NINFO, RKEY, SINK, SMIMEA, TA, TALINK.
     * Added a warning for a common misconfiguration involving forwarded
       RFC 1918 and IPv6 ULA (Universal Local Address) zones.
     * Contributed software from Nominum is included in the source at
       contrib/dnsperf-2.1.0.0-1/. It includes dnsperf for measuring the
       performance of authoritative DNS servers, resperf for testing the
       resolution performance of a caching DNS server, resperf-report for
       generating a resperf report in HTML with gnuplot graphs, and
       queryparse to extract DNS queries from pcap capture files. This
       software is not installed by default with BIND.
     * When loading a signed zone, named will now check whether an RRSIG's
       inception time is in the future, and if so, it will regenerate the
       RRSIG immediately. This helps when a system's clock needs to be
       reset backwards.

Feature Changes

     * Updated the compiled-in addresses for H.ROOT-SERVERS.NET and
       L.ROOT-SERVERS.NET.
     * The default preferred glue is now the address type of the transport
       the query was received over.
     * On machines with 2 or more processors (CPU), the default value for
       the number of UDP listeners has been changed to the number of
       detected processors minus one.
     * Zone transfers now use smaller message sizes to improve message
       compression. This results in reduced network usage.
     * named -V output now also includes operating system details.

Porting Changes

     * The Microsoft Windows install tool BINDInstall.exe which requires a
       non-free version of Visual Studio to be built, now uses two files
       (lists of flags and files) created by the Configure perl script
       with all the needed information which were previously compiled in
       the binary. Read win32utils/build.txt for more details. [RT #38915]

Bug Fixes

     * rndc flushtree now works even if there wasn't a cached node at the
       specified name. [RT #41846]
     * Don't emit records with zero TTL unless the records were received
       with a zero TTL. After being returned to waiting clients, the
       answer will be discarded from the cache. [RT #41687]
     * When deleting records from a zone database, interior nodes could be
       left empty but not deleted, damaging search performance afterward.
       [RT #40997] [RT #41941]
     * The server could crash due to a use-after-free if a zone transfer
       timed out. [RT #41297]
     * Authoritative servers that were marked as bogus (e.g. blackholed in
       configuration or with invalid addresses) were being queried anyway.
       [RT #41321]


To generate a diff of this commit:
cvs rdiff -u -r1.54 -r1.55 pkgsrc/net/bind99/Makefile
cvs rdiff -u -r1.10 -r1.11 pkgsrc/net/bind99/PLIST
cvs rdiff -u -r1.37 -r1.38 pkgsrc/net/bind99/distinfo
cvs rdiff -u -r1.1.1.1 -r1.2 pkgsrc/net/bind99/patches/patch-lib_dns_rbt.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.