Copy stable/9 to releng/9.3 as part of the 9.3-RELEASE cycle.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

MFV 262445:
Update BIND to 9.9.5

Release note:
https://lists.isc.org/pipermail/bind-announce/2013-September/000871.html
https://lists.isc.org/pipermail/bind-announce/2014-January/000896.html

Note this is a commit straight to stable as BIND no longer exists in head.

Sponsored by: DK Hostmaster A/S

MFC r233909:

Add Bv9ARM.pdf to the list of docs to install.

MFV/MFC r233914:

Update to version 9.8.2, the latest from ISC, which contains numerous bug fixes.

Copy head to stable/9 as part of 9.0-RELEASE release cycle.

Approved by: re (implicit)

Upgrade to version 9.8.0-P4

This version has many new features, see /usr/share/doc/bind9/README
for details.

Update to BIND 9.6.3, the latest from ISC on the 9.6 branch.

All 9.6 users with DNSSEC validation enabled should upgrade to this
version, or the latest version in the 9.7 branch, prior to 2011-03-31
in order to avoid validation failures for names in .COM as described
here:

https://www.isc.org/announcement/bind-9-dnssec-validation-fails-new-ds-record

In addition the fixes for this and other bugs, there are also the
following:

* Various fixes to kerberos support, including GSS-TSIG
* Various fixes to avoid leaking memory, and to problems that could
prevent a clean shutdown of named

Update to version 9.6-ESV-R3, the latest from ISC, which addresses
the following security vulnerabilities.

For more information regarding these issues please see:
http://www.isc.org/announcement/guidance-regarding-dec-1st-2010-security-advisories

1. Cache incorrectly allows ncache and rrsig for the same type

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3613

Affects resolver operators whose servers are open to potential
attackers. Triggering the bug will cause the server to crash.

This bug applies even if you do not have DNSSEC enabled.

2. Key algorithm rollover

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3614

Affects resolver operators who are validating with DNSSEC, and
querying zones which are in a key rollover period. The bug will
cause answers to incorrectly be marked as insecure.

Update BIND to version 9.6.1rc1. This version has better performance and
lots of new features compared to 9.4.x, including:

Full NSEC3 support
Automatic zone re-signing
New update-policy methods tcp-self and 6to4-self
DHCID support.
More detailed statistics counters including those supported in BIND 8.
Faster ACL processing.
Efficient LRU cache-cleaning mechanism.
NSID support.

This commit was generated by cvs2svn to compensate for changes in r170222,
which included commits to RCS files with non-trunk default branches.

Vendor import of BIND 9.4.1

Vender import of BIND 9.3.0rc4.