BIND version 9 is a major rewrite of nearly all aspects of the underlying BIND
architecture. Some of the important features of BIND 9 are:
DNS Security: DNSSEC (signed zones), TSIG (signed DNS requests)
IP version 6: Answers DNS queries on IPv6 sockets, IPv6 resource records (AAAA)
Experimental IPv6 Resolver Library
DNS Protocol Enhancements: IXFR, DDNS, Notify, EDNS0
Improved standards conformance
Views: One server process can provide multiple "views" of the DNS namespace,
e.g. an "inside" view to certain clients, and an "outside" view to others.
Multiprocessor Support
See the CHANGES file for more information on new features.
WWW: https://www.isc.org/bind/
===> The following configuration options are available for bind911-9.11.37_1:
ACCFDNS=off: Prefer DNS accept filter over generic one
DNSTAP=on: Provides fast passive logging of DNS messages
DOCS=on: Build and/or install documentation
FILTER_AAAA=on: Enable filtering of AAAA records
FIXED_RRSET=off: Enable fixed rrset ordering
GEOIP=off: GeoIP IP location support
IDN=on: International Domain Names support
IPV6=on: IPv6 protocol support
JSON=on: JSON file/format/parser support
LARGE_FILE=off: 64-bit file support
LMDB=on: Use LMDB for zone management
MINCACHE=off: Use the mincachettl patch
PORTREVISION=off: Show PORTREVISION in the version string
QUERYTRACE=off: Enable the very verbose query tracelogging
RPZ_NSDNAME=on: Enable RPZ NSDNAME policy records
RPZ_NSIP=on: Enable RPZ NSIP trigger rules
SIGCHASE=on: dig/host/nslookup will do DNSSEC validation
START_LATE=off: Start BIND late in the boot process (see help)
TCP_FASTOPEN=on: RFC 7413 support
THREADS=on: Threading support
TUNING_LARGE=off: Tune named for large systems (**READ HELP**)
====> Dynamically Loadable Zones
DLZ_POSTGRESQL=off: DLZ Postgres driver
DLZ_MYSQL=off: DLZ MySQL driver (no threading)
DLZ_BDB=off: DLZ BDB driver
DLZ_LDAP=off: DLZ LDAP driver
DLZ_FILESYSTEM=on: DLZ filesystem driver
DLZ_STUB=off: DLZ stub driver
====> GSSAPI Security API support: you have to select exactly one of them
GSSAPI_BASE=off: Using Heimdal in base
GSSAPI_HEIMDAL=off: Using security/heimdal
GSSAPI_MIT=off: Using security/krb5
GSSAPI_NONE=on: Disable
====> Choose which crypto engine to use: you can only select none or one of them
SSL=on: Build with OpenSSL (Required for DNSSEC)
NATIVE_PKCS11=off: Use PKCS#11 native API (**READ HELP**)
===> Use 'make config' to modify these settings
BIND requires configuration of rndc, including a "secret"
key. The easiest, and most secure way to configure rndc is
to run 'rndc-confgen -a' to generate the proper conf file,
with a new random key, and appropriate file permissions.
The /usr/local/etc/rc.d/named script will do that for you.
If using syslog to log the BIND9 activity, and using a
chroot'ed installation, you will need to tell syslog to install
a log socket in the BIND9 chroot by running:
# sysrc altlog_proglist+=named
And then restarting syslogd with: service syslogd restart
cleanup: Remove expired ports:
2022-03-31 security/revealrk: Deprecate, marked BROKEN on 12+ in 2018
2022-03-31 devel/apache-commons-modeler: Abandoned upstream, last release in
2013
2022-03-31 security/afl: Abandoned upstream, no new release since 2017. Please
consider using security/afl++ instead
2022-03-31 www/mod_line_edit: Abandoned upstream, last release in 2006, Apache
includes mod_sed
2022-03-31 www/myfaces: Unsupported by upstream, released in 2005
2022-03-31 www/mod_backtrace: Abandoned upstream in 2012 (version 2.0)
2022-03-31 security/base: Broken with PHP 7+, forked here
https://github.com/NathanGibbs3/BASE/
2022-03-31 security/find-zlib: Deprecated, no longer relevant
2022-03-31 security/razorback-clamavNugget: Abandonware, last release in 2012
and listed as alpha quality by upstream
2022-03-31 security/shimmer: Abandonware, last release in 2008
2022-03-31 security/kripp: Abandonware, upstream returns 404 and last release
was back in 2007
2022-03-31 security/ipfilter2dshield: Abandonware, no word of it on upstream web
site
2022-03-31 security/sha: Obsolete, we have tools in base
(Only the first 15 lines of the commit message are shown above )
textproc/libxml2: bump all dependencies
This should make sure that all dependent ports will pick
up the new version commited with a13ec21cd733f67a9fc0dc00ab45268bdc236246
Fix CONFLICTS entries of multiple ports
There have been lots of missing CONFLICTS_INSTALL entries, either
because conflicting ports were added without updating existing ports,
due to name changes of generated packages, due to mis-understanding
the format and semantics of the conflicts entries, or just due to
typoes in package names.
This patch is the result of a comparison of all files contained in
the official packages with each other. This comparison was based on
packages built with default options and may therefore have missed
further conflicts with optionally installed files.
Where possible, version numbers in conflicts entries have been
generalized, some times taking advantage of the fact that a port
(Only the first 15 lines of the commit message are shown above )
cleanup: Remove expired ports:
2021-10-31 devel/sdl_sge: Upstream no longer maintained
2021-12-31 net/appkonference: Outdated, depends on unsupported version of
net/asterisk
2021-12-31 dns/bind911: End of life, please migrate to a newer version of BIND9
2021-12-31 net/zebra: Abandoned upstream, last release in 2005. Consider
migrating to net/frr7 or net/bird2
2021-12-31 audio/osalp: Abandoned upstream, listed as beta and no new release
since 2008
2021-12-31 games/stransball2: Depends on expired devel/sdl_sge
2021-12-31 devel/rubygem-ruby-sdl-ffi: Depends on expired devel/sdl_sge
2021-12-31 devel/rubygem-rubygame: Depends on expired devel/sdl_sge
2021-12-31 devel/ruby-sdl: Depends on expired devel/sdl_sge
2021-12-31 games/magicmaze: Depends on expired devel/sdl_sge
2021-12-31 games/trophy: Depends on expired devel/clanlib1
2021-12-31 devel/clanlib1: Older than expired and removed devel/clanlib
2021-12-31 www/py-django31: Upgrade to Django 3.2+. Mainstream support ended
(April 6, 2021). Extended support ends December 2021. See
https://www.djangoproject.com/download/
(Only the first 15 lines of the commit message are shown above )
devel/protobuf-c: Bump PORTREVISION of dependent ports
Bump the PORTREVISION of ports that use protobuf-c and bake in the value
of PROTOBUF_C_VERSION*.
Sponsored by: Farsight Security, Inc.
Enabled DNSTAP by default.
The ISC recommends having it by default (it is in the packages they
distribute) and the footprint of the dependecies is very small.
While there, cleanup plists.
PR: 237861
Reported by: Greg Rivers
Remove conflicts from bind-tools and the server ports.
All servers now depend on the same bind-tools, from the latest BIND9
release.
Chase dependencies to make sure they now depend on the correct port.
Differential Revision: https://reviews.freebsd.org/D19922
Update to 9.11.5-P1, 9.12.3-P1, 9.13.5.
While there:
- Don't disable symbol table generation when building WITH_DEBUG.
- Try and make sure nullfs can really be used in a more robustt and
centralized way.
- Make sure all changes are sync'ed among all BIND9 ports.
Make sure gost is really disabled.
It may get picked up from the base OpenSSL and break startup.
While there, make sure the correct engines are used.
Reported by: Kevin P. Neal (on ports@)
Remove GOST support from BIND9 9.11 and 9.12.
It was never (widely|really) used, and support for it has been dropped
in OpenSSL starting at 1.1, and BIND9 starting at 9.13.
PR: 231980
Reported by: mfechner
Permit using allow-new-zones, LMDB, and a chrooted environment.
Fixes this obscure and not at all helpful message:
mdb_env_open of '_default.nzd' failed: No such file or directory
PR: 229125
Reported by: Tomas Ciernik
MFH: 2018Q3
Add BIND9 9.13.0.
The ISC changed their release model, they are now doing
odd-unstable/even-stable release numbering. This is a development
version, consider it alpha/beta quality. The next stable release will
be 9.14.0.
Changes: https://kb.isc.org/article/AA-01612
Sponsored by: Absolight
Enable the FILTER_AAAA option by default, the feature was made non
optional in recent versions, so might as well do it in older ones.
PR: 226383
Sponsored by: Absolight
Teach named where its pid file should be by default, to be consistent
with the default configuration, rc script, man pages...
PR: 225687
Reported by: John W. O'Brien
Sponsored by: Absolight
Add a TCP_FASTOPEN option (default on) to allow not building it in. [1]
It is annoying because it outputs one line saying it cannot enable
TCP_FASTOPEN when the deamon starts.
While there, discover that FILTER_AAAA is always enabled in 9.12+ and no
longer an option, so remove it.
PR: 217288 [1] (based on)
Reported by: doktornotor mailinator com
Sponsored by: Absolight
Add a TUNING_LARGE option.
https://kb.isc.org/article/AA-01314/0
Tunes certain compiled-in constants and default settings to
values better suited to large servers with 12/16GB+ of memory.
This can improve performance on such servers, but will consume
more memory and may degrade performance on smaller systems.
PR: 224859
Sponsored by: Absolight
Add a symlink to named's session-keyfile.
Using nsupdate -l, and chroot was broken because nsupdate could not find
the keyfile by itself.
PR: 223403
Submitted by: Harald Schmalzbauer
Sponsored by: Absolight
Remove special handling for testing and documentation domains, per RFC
6761 recommendations.
While there:
- Fix invalid syntax in sample slave config.
- Add a message about having syslogd working with BIND9 chroot.
PR: 217915
Reported by: eserte12 yahoo de
Sponsored by: Absolight
Update to 9.9.10, 9.10.5, 9.11.1 and 9.12 to latest snapshot.
While there:
Make it more maintainable by sorting stuff in the Makefile and removing
vestigial pre 10.3 things.
Refresh the root zone hints.
"Fix" the configuration section telling you to get some top level
zones from f.root-servers.net, which does not allow axfr any more. [1]
PR: 218656 [1]
Reported by: Thomas Steen Rasmussen / Tykling [1]
MFH: 2017Q2
Sponsored by: Absolight
