From owner-cvs-all@FreeBSD.ORG  Wed Jul  9 19:02:01 2008
Return-Path: <owner-cvs-all@FreeBSD.ORG>
Delivered-To: cvs-all@FreeBSD.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 7BAE61065671;
	Wed,  9 Jul 2008 19:02:01 +0000 (UTC)
	(envelope-from dougb@FreeBSD.org)
Received: from repoman.freebsd.org (repoman.freebsd.org
	[IPv6:2001:4f8:fff6::29])
	by mx1.freebsd.org (Postfix) with ESMTP id 65BCD8FC1C;
	Wed,  9 Jul 2008 19:02:01 +0000 (UTC)
	(envelope-from dougb@FreeBSD.org)
Received: from repoman.freebsd.org (localhost [127.0.0.1])
	by repoman.freebsd.org (8.14.1/8.14.1) with ESMTP id m69J21Oj022856;
	Wed, 9 Jul 2008 19:02:01 GMT
	(envelope-from dougb@repoman.freebsd.org)
Received: (from dougb@localhost)
	by repoman.freebsd.org (8.14.2/8.14.1/Submit) id m69J21eG022855;
	Wed, 9 Jul 2008 19:02:01 GMT (envelope-from dougb)
Message-Id: <200807091902.m69J21eG022855@repoman.freebsd.org>
From: Doug Barton <dougb@FreeBSD.org>
Date: Wed, 9 Jul 2008 19:02:01 +0000 (UTC)
To: ports-committers@FreeBSD.org, cvs-ports@FreeBSD.org, cvs-all@FreeBSD.org
X-FreeBSD-CVS-Branch: HEAD
Cc: 
Subject: cvs commit: ports/dns/bind9 Makefile distinfo ports/dns/bind94
 Makefile distinfo ports/dns/bind95 Makefile distinfo
X-BeenThere: cvs-all@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: CVS commit messages for the entire tree <cvs-all.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/cvs-all>,
	<mailto:cvs-all-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/cvs-all>
List-Post: <mailto:cvs-all@freebsd.org>
List-Help: <mailto:cvs-all-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/cvs-all>,
	<mailto:cvs-all-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 09 Jul 2008 19:02:01 -0000

dougb       2008-07-09 19:02:01 UTC

  FreeBSD ports repository

  Modified files:
    dns/bind9            Makefile distinfo 
    dns/bind94           Makefile distinfo 
    dns/bind95           Makefile distinfo 
  Log:
  Upgrade to the -P1 versions of each port, which add stronger randomization
  of the UDP query-source ports. The server will still use the same query
  port for the life of the process, so users for whom the issue of cache
  poisoning is highly significant may wish to periodically restart their
  server using /etc/rc.d/named restart, or other suitable method.
  
  In order to take advantage of this randomization users MUST have an
  appropriate firewall configuration to allow UDP queries to be sent and
  answers to be received on random ports; and users MUST NOT specify a
  port number using the query-source[-v6] option.
  
  The avoid-v[46]-udp-ports options exist for users who wish to eliminate
  certain port numbers from being chosen by named for this purpose. See
  the ARM Chatper 6 for more information.
  
  Also please note, this issue applies only to UDP query ports. A random
  ephemeral port is always chosen for TCP queries.
  
  This issue applies primarily to name servers whose main purpose is to
  resolve random queries (sometimes referred to as "caching" servers, or
  more properly as "resolving" servers), although even an "authoritative"
  name server will make some queries, primarily at startup time.
  
  This update addresses issues raised in:
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447
  http://www.kb.cert.org/vuls/id/800113
  http://tools.ietf.org/html/draft-ietf-dnsext-forgery-resilience
  
  Revision  Changes    Path
  1.82      +2 -2      ports/dns/bind9/Makefile
  1.44      +6 -6      ports/dns/bind9/distinfo
  1.85      +2 -3      ports/dns/bind94/Makefile
  1.47      +6 -6      ports/dns/bind94/distinfo
  1.87      +2 -2      ports/dns/bind95/Makefile
  1.49      +6 -6      ports/dns/bind95/distinfo