| 1.1.1.2 |
| 29-Jan-2026 |
christos | Import bind-9.20.18 (previous was 9.20.11)
BIND 9.20.18#
Security Fixes#
[CVE-2025-13878] Fix incorrect length checks for BRID and HHIT
records. d4c0d61701
Malformed BRID and HHIT records could trigger an assertion
failure. This has been fixed.
ISC would like to thank Vlatko Kosturjak from Marlink Cyber
for bringing this vulnerability to our attention. [GL #5616]
Feature Changes#
Support compilation with cmocka 2.0.0+ bb9234c6ce
The assert_in_range() function was deprecated in favor of
assert_int_in_range() and assert_uint_in_range(). Add compatibility
shims for cmocka<2.0.0 and use the new functions. [GL #5699]
[GL !11437]
Add more information to the rndc recursing output about fetches.
9766feb4df
This adds more information about the active fetches for debugging
and diagnostic purposes. [GL !11358]
Bug Fixes#
Make key rollovers more robust. 7a70d05b5d
A manual rollover when the zone is in an invalid DNSSEC state
causes predecessor keys to be removed too quickly. Additional
safeguards to prevent this have been added. DNSSEC records will
not be removed from the zone until the underlying state machine
has moved back into a valid DNSSEC state. [GL #5458] [GL !11329]
Fix a catalog zones issue when a member zone could fail to
load. 95cbc2c327
A catalog zone's member zone could fail to load in some rare
cases, when the internally generated zone configuration string
was exceeding 512 bytes. That condition only was not enough
for the issue to arise, but it was a necessary condition. This
could happen, for example, if the catalog zone's default primary
servers list contained a large number of items. This has been
fixed. [GL #5658] [GL !11349]
Allow glue in delegations with QTYPE=ANY. 441158ac18
When a query for type ANY triggered a delegation response, all
additional data was omitted from the response, including
mandatory glue. This has been corrected. [GL #5659] [GL !11283]
Adding NSEC3 opt-out records could leave invalid records in
chain. 1b90296e1f
When creating an NSEC3 opt-out chain, a node in the chain could
be removed too soon, causing the previous NSEC3 being unable
to be found, resulting in invalid NSEC3 records to be left in
the zone. This has been fixed. [GL #5671] [GL !11340]
Fix slow speed of NSEC3 optout large delegation zone signing.
88f915b77b
BIND 9.20 takes much more time signing a large delegation zone
with NSEC3 optout compared to version 9.18. This has been
restored. [GL #5672] [GL !11362]
Reconfigure NSEC3 opt-out zone to NSEC causes zone to be invalid.
1d0e19c612
A zone that is signed with NSEC3, opt-out enabled, and then
reconfigured to use NSEC, causes the zone to be published with
missing NSEC records. This has been fixed. [GL #5679] [GL
!11401]
Fix a possible catalog zone issue during reconfiguration.
911b45b2b3
The named process could terminate unexpectedly during
reconfiguration when a catalog zone update was taking place at
the same time. This has been fixed. [GL !11386]
Fix the charts in the statistics channel. 7c7b01dd65
The charts in the statistics channel could sometimes fail to
render in the browser, and were completely disabled for
Mozilla-based browsers for historical reasons. This has been
fixed. [GL !11364]
BIND 9.20.17#
New Features#
Add spatch to detect implicit bool/int/result cast. 02be363d1f
Detection of implicit cast from a boolean into an int, or an
isc_result_t into a boolean (either in an assignement or return
position).
If such pattern is found, a warning comment is added into the
code (and the CI will fails) so the error can be spotted and
manually fixed. [GL !11237]
Feature Changes#
Use atomics for CMM_{LOAD,STORE}_SHARED with ThreadSanitizer.
94fa721705
Upstream has removed the atomics implementation of CMM_LOAD_SHARED
and CMM_STORE_SHARED as these can be used also with non-stdatomics
types. As we only use the CMM api with stdatomics types, we
can restore the previous behaviour to prevent ThreadSanitizer
warnings. [GL #5660] [GL !11290]
Provide more information when the memory allocation fails.
6749725610
Provide more information about the failure when the memory
allocation fails. [GL !11304]
Reduce the number of outgoing queries. 457b470e96
Reduces the number of outgoing queries when resolving the
nameservers for delegation points. This helps the DNS resolver
with cold cache resolve client queries with complex delegation
chains and redirections. [GL !11258]
Bug Fixes#
Fix the spurious timeouts while resolving names. d96cf874fb
Sometimes the loops in the resolving (e.g. to resolve or validate
ns1.example.com we need to resolve ns1.example.com) were not
properly detected leading to spurious 10 seconds delay. This
has been fixed and such loops are properly detected. [GL #3033],
#5578 [GL !11298]
Fix bug where zone switches from NSEC3 to NSEC after retransfer.
3b40ffbf83
When a zone is re-transferred, but the zone journal on an
inline-signing secondary is out of sync, the zone could fall
back to using NSEC records instead of NSEC3. This has been
fixed. [GL #5527] [GL !11274]
Attach socket before async streamdns_resume_processing. bb9451c73f
Call to streamdns_resume_processing is asynchronous but the
socket passed as argument is not attached when scheduling the
call.
While there is no reproducible way (so far) to make the socket
reference number down to 0 before streamdns_resume_processing
is called, attach the socket before scheduling the call. This
guard against an hypothetic case where, for some reasons, the
socket refcount would reach 0, and be freed from memory when
streamdns_resume_processing is called. [GL #5620] [GL !11260]
AMTRELAY type 0 presentation format handling was wrong. adf104a063
RFC 8777 specifies a placeholder value of "." for the gateway
field when the gateway type is 0 (no gateway). This was not
being checked for nor emitted when displaying the record. This
has been corrected.
Instances of this record will need the placeholder period added
to them when upgrading. [GL #5639] [GL !11255]
Fix parsing bug in remote-servers with key or tls. d9400c5967
The remote-servers clause enable the following pattern using
a named server-list:
remote-servers a { 1.2.3.4; ... }; remote-servers b { a key
foo; };
However, such configuration was wrongly rejected, with an
"unexpected token 'foo'" error. Such configuration is now
accepted. [GL #5646] [GL !11300]
Fix TLS contexts cache object usage bug in the resolver.
13adf94006
named could terminate unexpectedly when reconfiguring or
reloading, and if client-side TLS transport was in use (for
example, when forwarding queries to a DoT server). This has
been fixed. [GL #5653] [GL !11299]
Fix unitiailized pointer check on getipandkeylist. 5ed0cf091b
Function named_config_getipandkeylist could, in case of error
in the early code attempting to get the port or tls-port, make
a pointer check on a non-initialized value. This is now fixed.
[GL !11306]
Standardize CHECK and RETERR macros. ef714e91ac
previously, there were over 40 separate definitions of CHECK
macros, of which most used "goto cleanup", and the rest "goto
failure" or "goto out". there were another 10 definitions of
RETERR, of which most were identical to CHECK, but some simply
returned a result code instead of jumping to a cleanup label.
this has now been standardized throughout the code base: RETERR
is for returning an error code in the case of an error, and
CHECK is for jumping to a cleanup tag, which is now always
called "cleanup". both macros are defined in isc/util.h. [GL
!11069]
Adding NSEC3 opt-out records could leave invalid records in
chain. 1d83a8ad46
When creating an NSEC3 opt-out chain, a node in the chain could
be removed too soon, causing the previous NSEC3 being unable
to be found, resulting in invalid NSEC3 records to be left in
the zone. This has been fixed.
Closes [#5671](#5671)
BIND 9.20.16#
Feature Changes#
Fix assertion failure from arc4random_uniform with invalid
limit. 1040282de7e
When the arc4random_uniform() is called on NetBSD with upper_bound
that makes no sense statistically (0 or 1), the call crashes
the calling program. Fix this by returning 0 when upper bound
is < 2 as does Linux, FreeBSD and NetBSD. (Hint: System CSPRNG
should never crash.) [GL #5596] [GL !11151]
Bug Fixes#
Fix dnssec-keygen key collision checking for KEY rrtype keys.
ac8b23b80bf
The dnssec-keygen utility program failed to detect possible
Key ID collisions with the existing keys generated using the
non-default -T KEY option (e.g. for SIG(0)). This has been
fixed. [GL #5506] [GL !11128]
Fix shutdown INSIST in dns_dispatchmgr_getblackhole. f0aaaef166c
Previously, named could trigger an assertion in
dns_dispatchmgr_getblackhole while shutting down. This has been
fixed. [GL #5525] [GL !11162]
Dnssec-verify now uses exit code 1 when failing due to illegal
options. 6ead0aa4a2b
Previously, dnssec-verify exited with code 0 if the options
could not be parsed. This has been fixed. [GL #5574] [GL !11129]
Prevent assertion failures of dig when server is specified
before the -b option. deada63e2b2
Previously, dig could exit with an assertion failure when the
server was specified before the dig -b option. This has been
fixed. [GL #5609] [GL !11204]
Skip unsupported algorithms when looking for signing key.
c346fe88a1b
A mix of supported and unsupported DNSSEC algorithms in the
same zone could have caused validation failures. Ignore the
DNSSEC keys with unsupported algorithm when looking for the
signing keys. [GL #5622] [GL !11210]
Fix configuration bugs involving global defaults. a85d6fb581c
The configuration code for the max-cache-size, dnssec-validation,
and response-padding options were unnecessarily complicated,
and in the case of max-cache-size, buggy. These have been fixed.
The optionmaps variable in configure_view() is no longer needed
and has been removed. [GL !11172]
Skip buffer allocations if not logging. 4f601175bd0
Currently, during IXFR we allocate a 2KB buffer for IXFR change
logging regardless of the log level. This commit introduces an
early check on the log level in dns_diff_print to avoid this.
Results in a speedup from 28% in the test case from issue #5442.
[GL !11192]
BIND 9.20.15#
Security Fixes#
[CVE-2025-8677] DNSSEC validation fails if matching but invalid
DNSKEY is found. 0d676bf9f23
Previously, if a matching but cryptographically invalid key
was encountered during DNSSEC validation, the key was skipped
and not counted towards validation failures. named now treats
such DNSSEC keys as hard failures and the DNSSEC validation
fails immediately, instead of continuing with the next DNSKEYs
in the RRset.
ISC would like to thank Zuyao Xu and Xiang Li from the All-in-One
Security and Privacy Laboratory at Nankai University for bringing
this vulnerability to our attention. [GL #5343]
[CVE-2025-40778] Address various spoofing attacks. 23de94fd236
Previously, several issues could be exploited to poison a DNS
cache with spoofed records for zones which were not DNSSEC-signed
or if the resolver was configured to not do DNSSEC validation.
These issues were assigned CVE-2025-40778 and have now been
fixed.
As an additional layer of protection, named no longer accepts
DNAME records or extraneous NS records in the AUTHORITY section
unless these are received via spoofing-resistant transport
(TCP, UDP with DNS cookies, TSIG, or SIG(0)).
ISC would like to thank Yuxiao Wu, Yunyi Zhang, Baojun Liu,
and Haixin Duan from Tsinghua University for bringing this
vulnerability to our attention. [GL #5414]
[CVE-2025-40780] Cache-poisoning due to weak pseudo-random
number generator. 34af35c2df8
It was discovered during research for an upcoming academic
paper that a xoshiro128** internal state can be recovered by
an external 3rd party, allowing the prediction of UDP ports
and DNS IDs in outgoing queries. This could lead to an attacker
spoofing the DNS answers with great efficiency and poisoning
the DNS cache.
The internal random generator has been changed to a cryptographically
secure pseudo-random generator.
ISC would like to thank Prof. Amit Klein and Omer Ben Simhon
from Hebrew University of Jerusalem for bringing this vulnerability
to our attention. [GL #5484]
New Features#
Add dnssec-policy keys configuration check to named-checkconf.
1f5a0405f72
A new option -k is added to named-checkconf that allows checking
the dnssec-policy keys configuration against the configured
key stores. If the found key files are not in sync with the
given dnssec-policy, the check will fail.
This is useful to run before migrating to dnssec-policy. [GL
#5486] [GL !11011]
Feature Changes#
Minor refactor of dst code. c6acbaa020b
Convert the defines to enums. Initialize the tags more explicitly
and less ugly. [GL !11038]
Bug Fixes#
Use signer name when disabling DNSSEC algorithms. 986816baa74
disable-algorithms could cause DNSSEC validation failures when
the parent zone was signed with the algorithms that were being
disabled for the child zone. This has been fixed; disable-algorithms
now works on a whole-of-zone basis.
If the zone's name is at or below the disable-algorithms name
the algorithm is disabled for that zone, using deepest match
when there are multiple disable-algorithms clauses. [GL #5165]
[GL !11014]
Rndc sign during ZSK rollover will now replace signatures.
d2f551140cd
When performing a ZSK rollover, if the new DNSKEY is omnipresent,
the rndc sign command now signs the zone completely with the
successor key, replacing all zone signatures from the predecessor
key with new ones. [GL #5483] [GL !11017]
Missing DNSSEC information when CD bit is set in query.
968a6be41fb
The RRSIGs for glue records were not being cached correctly
for CD=1 queries. This has been fixed. [GL #5502] [GL !10956]
Preserve cache when reload fails and reload the server again.
975aeda10b4
Fixes an issue where failing to reconfigure/reload the server
would prevent to preserved the views caches on the subsequent
server reconfiguration/reload. [GL #5523] [GL !10988]
Check plugin config before registering. e2260b80702
In named_config_parsefile(), when checking the validity of
named.conf, the checking of plugin correctness was deliberately
postponed until the plugin is loaded and registered. However,
the checking was never actually done: the plugin_register()
implementation was called, but plugin_check() was not.
ns_plugin_register() (used by named) now calls the check function
before the register function, and aborts if either one fails.
ns_plugin_check() (used by named-checkconf) calls only the
check function. [GL !11032]
BIND 9.20.14#
Note
The BIND 9.20.14 release was withdrawn after the discovery of a
regression in a security fix in it during pre-release testing.
BIND 9.20.13# New Features#
Add manual mode configuration option to dnsec-policy. 1e435b107f
Add a new option manual-mode to dnssec-policy. The intended
use is that if it is enabled, it will not automatically move
to the next state transition, but instead the transition is
logged. Only after manual confirmation with rndc dnssec -step
the transition is made. [GL #4606] [GL !10880]
Add a new 'servfail-until-ready' configuration option for RPZ.
925af17d21
By default, when named is started it may start answering to
queries before the response policy zones are completely loaded
and processed. This new feature gives an option to the users
to tell named that incoming requests should result in SERVFAIL
answer until all the response policy zones are processed and
ready. Note that if one or more response policy zones fail to
load, named starts responding to queries according to those
zones that did load.
Note, that enabling this option has no effect when a DNS Response
Policy Service (DNSRPS) interface is used. [GL #5222] [GL
!10889]
Support for parsing HHIT and BRID records has been added.
1f051af24d
[GL #5444] [GL !10932]
Removed Features#
Deprecate the "tkey-gssapi-credential" statement. b239a70cac
The tkey-gssapi-keytab statement allows GSS-TSIG to be set up
in a simpler and more reliable way than using the
tkey-gssapi-credential statement and setting environment
variables (e.g. KRB5_KTNAME). Therefore, the tkey-gssapi-credential
statement has been deprecated; tkey-gssapi-keytab should be
used instead.
For configurations currently using a combination of both
tkey-gssapi-keytab and tkey-gssapi-credential, the latter should
be dropped and the keytab pointed to by tkey-gssapi-keytab
should now only contain the credential previously specified by
tkey-gssapi-credential. [GL #4204] [GL !10924]
Obsolete the "tkey-domain" statement. 9352ae65d7
Mark the tkey-domain statement as obsolete, since it has not
had any effect on server behavior since support for TKEY Mode
2 (Diffie-Hellman) was removed (in BIND 9.20.0). [GL #4204]
[GL !10926]
Feature Changes#
Update clang-format style with options added in newer versions.
0c2c477c31
Add and apply InsertBraces statement to add missing curly braces
around one-line statements and use ControlStatementsExceptControlMacros
for SpaceBeforeParens to remove space between foreach macro
and the brace, e.g. FOREACH (x) { becomes FOREACH(x) {. [GL
!10864]
Bug Fixes#
Ensure file descriptors 0-2 are in use. 35dee6eb90
libuv expect file descriptors <= STDERR_FILENO are in use.
otherwise, it may abort when closing a file descriptor it
opened. [GL #5226] [GL !10908]
Prevent spurious SERVFAILs for certain 0-TTL resource records.
6b266b222c
Under certain circumstances, BIND 9 can return SERVFAIL when
updating existing entries in the cache with new NS, A, AAAA,
or DS records with 0-TTL. [GL #5294] [GL !10898]
Use DNS_RDATACOMMON_INIT to hide branch differences. a64df9729b
Initialization of the common members of rdata type structures
varies across branches. Standardize it by using the
DNS_RDATACOMMON_INIT macro for all types, so that new types
are more likely to use it, and hence backport more cleanly.
[GL #5467] [GL !10834]
RPZ canonical warning displays zone entry incorrectly. d833676515
When an IPv6 rpz prefix entry is entered incorrectly the log
message was just displaying the prefix rather than the full
entry. This has been corrected. [GL #5491] [GL !10930]
Fix a catalog zone issue when having an unset 'default-primaries'
configuration clause. 293e75af28
A catalog zone with an unset default-primaries clause could
cause an unexpected termination of the named process after two
reloading or reconfiguration commands. This has been fixed.
[GL #5494] [GL !10905]
Add and use __attribute__((nonnull)) in dnssec-signzone.c.
a8eed36d3e
Clang 20 was spuriously warning about the possibility of passing
a NULL file pointer to fprintf(), which uses the 'nonnull'
attribute. To silence the warning, the functions calling
fprintf() have been marked with the same attribute to assure
that NULL can't be passed to them in the first place.
Close #5487 [GL !10913]
RPZ 'servfail-until-ready': skip updating SERVFAIL cache.
af2fb26325
In order to not pollute the SERVFAIL cache with the configured
SERVFAIL answers while RPZ is loading, set the NS_CLIENTATTR_NOSETFC
attribute for the client. [GL !10940]
BIND 9.20.12#
New Features#
Support for parsing the DSYNC record has been added. f440fe712d
[GL #5440] [GL !10820]
Feature Changes#
Adaptive memory allocation strategy for qp-tries. 9a046cbed5
qp-tries allocate their nodes (twigs) in chunks to reduce
allocator pressure and improve memory locality. The choice of
chunk size presents a tradeoff: larger chunks benefit qp-tries
with many values (as seen in large zones and resolvers) but
waste memory in smaller use cases.
Previously, our fixed chunk size of 2^10 twigs meant that even
an empty qp-trie would consume 12KB of memory, while reducing
this size would negatively impact resolver performance.
This MR implements an adaptive chunking strategy that tracks
the size of the most recently allocated chunk and doubles the
chunk size for each new allocation until reaching a predefined
maximum.
This approach effectively balances memory efficiency for small
tries while maintaining the performance benefits of larger
chunk sizes for bigger data structures. [GL #5445] [GL !10804]
Add deprecation warnings for RSASHA1, RSASHA1-NSEC3SHA1 and DS
digest type 1. 5aefaa4b97
RSASHA1 and RSASHA1-NSEC-SHA1 DNSKEY algorithms have been
deprecated by the IETF and should no longer be used for DNSSEC.
DS digest type 1 (SHA1) has also been deprecated. Validators
are now expected to treat these algorithms and digest as unknown,
resulting in some zones being treated as insecure when they
were previously treated as secure. Warnings have been added to
named and tools when these algorithms and this digest are being
used for signing.
Zones signed with RSASHA1 or RSASHA1-NSEC-SHA1 should be migrated
to a different DNSKEY algorithm.
Zones with DS or CDS records with digest type 1 (SHA1) should
be updated to use a different digest type (e.g. SHA256) and
the digest type 1 records should be removed.
Related to #5358 [GL !10738]
Bug Fixes#
Stale RRsets in a CNAME chain were not always refreshed.
ed37c7825e
With serve-stale enabled, a CNAME chain that contains a stale
RRset, the refresh query doesn't always properly refresh the
stale RRsets. This has been fixed. [GL #5243] [GL !10767]
Add RPZ extended DNS error for zones with a CNAME override
policy configured. 39ad2016c1
When the zone is configured with a CNAME override policy, or
the response policy zone contains a wildcard CNAME, the extended
DNS error code was not added. This has been fixed. [GL #5342]
[GL !10819]
Fix a possible crash when adding a zone while recursing.
7a3ec8dd94
A query for a zone that was not yet loaded may yield an unexpected
result such as a CNAME or DNAME, triggering an assertion failure.
This has been fixed. [GL #5357] [GL !10718]
Fix dig issues. 8c50819aa8
When used with the +keepopen option with a TCP connection,
iscman:dig could terminate unexpectedly in rare situations.
Additionally, iscman:dig could hang and fail to shutdown properly
when interrupted during a query. These have been fixed. [GL
#5381] [GL !10727]
Log dropped or slipped responses in the query-errors category.
47470b586d
Responses which were dropped or slipped because of RRL (Response
Rate Limiting) were logged in the rate-limit category instead
of the query-errors category, as documented in ARM. This has
been fixed. [GL #5388] [GL !10725]
Separate out adbname type flags. fc689c6525
There are three adbname flags that are used to identify different
types of adbname lookups when hashing rather than using multiple
hash tables. Separate these to their own structure element as
these need to be able to be read without locking the adbname
structure. [GL #5404] [GL !10695]
Synth-from-dnssec was not working in some scenarios. bc54f059e0
Aggressive use of DNSSEC-Validated cache with NSEC was not
working in scenarios when no parent NSEC was not in cache. This
has been fixed. [GL #5422] [GL !10754]
Clean enough memory when adding new ADB names/entries under
memory pressure. b7e7923daa
The ADB memory cleaning is opportunistic even when we are under
memory pressure (in the overmem condition). Split the opportunistic
LRU cleaning and overmem cleaning and make the overmem cleaning
always cleanup double of the newly allocated adbname/adbentry
to ensure we never allocate more memory than the assigned limit.
[GL !10707]
Prevent spurious validation failures. 3b98c7cc9d
Under rare circumstances, validation could fail if multiple
clients simultaneously iterated the same set of signatures.
References #3014 [GL !10815]
Rename variable called 'free' to prevent the clash with free()
7f25d92c5d
[GL !10757]
|
