BIND version 9 is a major rewrite of nearly all aspects of the underlying BIND
architecture. Some of the important features of BIND 9 are:
DNS Security: DNSSEC (signed zones), TSIG (signed DNS requests)
IP version 6: Answers DNS queries on IPv6 sockets, IPv6 resource records (AAAA)
Experimental IPv6 Resolver Library
DNS Protocol Enhancements: IXFR, DDNS, Notify, EDNS0
Improved standards conformance
Views: One server process can provide multiple "views" of the DNS namespace,
e.g. an "inside" view to certain clients, and an "outside" view to others.
Multiprocessor Support
See the CHANGES file for more information on new features.
WWW: https://www.isc.org/downloads/bind/
===> The following configuration options are available for bind912-9.12.4P1:
DNSTAP=off: Provides fast passive logging of DNS messages
DOCS=on: Build and/or install documentation
FIXED_RRSET=off: Enable fixed rrset ordering
IDN=on: International Domain Names support
IPV6=on: IPv6 protocol support
JSON=on: JSON file/format/parser support
LARGE_FILE=off: 64-bit file support
LMDB=on: Use LMDB for zone management
MINCACHE=off: Use the mincachettl patch
PORTREVISION=off: Show PORTREVISION in the version string
QUERYTRACE=off: Enable the very verbose query tracelogging
RPZ_NSDNAME=on: Enable RPZ NSDNAME policy records
RPZ_NSIP=on: Enable RPZ NSIP trigger rules
SIGCHASE=on: dig/host/nslookup will do DNSSEC validation
START_LATE=off: Start BIND late in the boot process (see help)
TCP_FASTOPEN=on: RFC 7413 support
THREADS=on: Threading support
TUNING_LARGE=off: Tune named for large systems (**READ HELP**)
====> Dynamically Loadable Zones
DLZ_POSTGRESQL=off: DLZ Postgres driver
DLZ_MYSQL=off: DLZ MySQL driver (no threading)
DLZ_BDB=off: DLZ BDB driver
DLZ_LDAP=off: DLZ LDAP driver
DLZ_FILESYSTEM=on: DLZ filesystem driver
DLZ_STUB=off: DLZ stub driver
====> GSSAPI Security API support: you have to select exactly one of them
GSSAPI_BASE=off: Using Heimdal in base
GSSAPI_HEIMDAL=off: Using security/heimdal
GSSAPI_MIT=off: Using security/krb5
GSSAPI_NONE=on: Disable
====> Choose which crypto engine to use: you can only select none or one of them
SSL=on: Build with OpenSSL (Required for DNSSEC)
NATIVE_PKCS11=off: Use PKCS#11 native API (**READ HELP**)
===> Use 'make config' to modify these settings
Remove expired ports:
2019-05-31 multimedia/gmerlin-avdecoder: unused in the ports tree and depends on
vulnerable multimedia/ffmpeg0
2019-05-31 security/racoon2-legacy: No longer supported upstream, use
security/racoon2
2019-05-31 www/pivotx: inactive upstream and does not work with PHP 7
2019-05-31 dns/bind912: Support ends, please move to dns/bind914.
2019-05-31 multimedia/vdr-plugin-softhddevice: unmaintained and depends on
vulnerable multimedia/ffmpeg0
Remove conflicts from bind-tools and the server ports.
All servers now depend on the same bind-tools, from the latest BIND9
release.
Chase dependencies to make sure they now depend on the correct port.
Differential Revision: https://reviews.freebsd.org/D19922
Update to 9.11.5-P1, 9.12.3-P1, 9.13.5.
While there:
- Don't disable symbol table generation when building WITH_DEBUG.
- Try and make sure nullfs can really be used in a more robustt and
centralized way.
- Make sure all changes are sync'ed among all BIND9 ports.
Bump PORTREVISION for ports depending on the canonical version of GCC
defined via Mk/bsd.default-versions.mk which has moved from GCC 7.4 t
GCC 8.2 under most circumstances.
This includes ports
- with USE_GCC=yes or USE_GCC=any,
- with USES=fortran,
- using Mk/bsd.octave.mk which in turn features USES=fortran, and
- with USES=compiler specifying openmp, nestedfct, c11, c++0x, c++11-lang,
c++11-lib, c++14-lang, c++17-lang, or gcc-c++11-lib
plus, as a double check, everything INDEX-11 showed depending on lang/gcc7.
PR: 231590
Make sure gost is really disabled.
It may get picked up from the base OpenSSL and break startup.
While there, make sure the correct engines are used.
Reported by: Kevin P. Neal (on ports@)
Remove GOST support from BIND9 9.11 and 9.12.
It was never (widely|really) used, and support for it has been dropped
in OpenSSL starting at 1.1, and BIND9 starting at 9.13.
PR: 231980
Reported by: mfechner
Permit using allow-new-zones, LMDB, and a chrooted environment.
Fixes this obscure and not at all helpful message:
mdb_env_open of '_default.nzd' failed: No such file or directory
PR: 229125
Reported by: Tomas Ciernik
MFH: 2018Q3
Add BIND9 9.13.0.
The ISC changed their release model, they are now doing
odd-unstable/even-stable release numbering. This is a development
version, consider it alpha/beta quality. The next stable release will
be 9.14.0.
Changes: https://kb.isc.org/article/AA-01612
Sponsored by: Absolight
Teach named where its pid file should be by default, to be consistent
with the default configuration, rc script, man pages...
PR: 225687
Reported by: John W. O'Brien
Sponsored by: Absolight
Add a TCP_FASTOPEN option (default on) to allow not building it in. [1]
It is annoying because it outputs one line saying it cannot enable
TCP_FASTOPEN when the deamon starts.
While there, discover that FILTER_AAAA is always enabled in 9.12+ and no
longer an option, so remove it.
PR: 217288 [1] (based on)
Reported by: doktornotor mailinator com
Sponsored by: Absolight
Add a TUNING_LARGE option.
https://kb.isc.org/article/AA-01314/0
Tunes certain compiled-in constants and default settings to
values better suited to large servers with 12/16GB+ of memory.
This can improve performance on such servers, but will consume
more memory and may degrade performance on smaller systems.
PR: 224859
Sponsored by: Absolight
Add a symlink to named's session-keyfile.
Using nsupdate -l, and chroot was broken because nsupdate could not find
the keyfile by itself.
PR: 223403
Submitted by: Harald Schmalzbauer
Sponsored by: Absolight
