| 1.1.1.4 |
| 29-Jan-2026 |
christos | Import bind-9.20.18 (previous was 9.20.11)
BIND 9.20.18#
Security Fixes#
[CVE-2025-13878] Fix incorrect length checks for BRID and HHIT
records. d4c0d61701
Malformed BRID and HHIT records could trigger an assertion
failure. This has been fixed.
ISC would like to thank Vlatko Kosturjak from Marlink Cyber
for bringing this vulnerability to our attention. [GL #5616]
Feature Changes#
Support compilation with cmocka 2.0.0+ bb9234c6ce
The assert_in_range() function was deprecated in favor of
assert_int_in_range() and assert_uint_in_range(). Add compatibility
shims for cmocka<2.0.0 and use the new functions. [GL #5699]
[GL !11437]
Add more information to the rndc recursing output about fetches.
9766feb4df
This adds more information about the active fetches for debugging
and diagnostic purposes. [GL !11358]
Bug Fixes#
Make key rollovers more robust. 7a70d05b5d
A manual rollover when the zone is in an invalid DNSSEC state
causes predecessor keys to be removed too quickly. Additional
safeguards to prevent this have been added. DNSSEC records will
not be removed from the zone until the underlying state machine
has moved back into a valid DNSSEC state. [GL #5458] [GL !11329]
Fix a catalog zones issue when a member zone could fail to
load. 95cbc2c327
A catalog zone's member zone could fail to load in some rare
cases, when the internally generated zone configuration string
was exceeding 512 bytes. That condition only was not enough
for the issue to arise, but it was a necessary condition. This
could happen, for example, if the catalog zone's default primary
servers list contained a large number of items. This has been
fixed. [GL #5658] [GL !11349]
Allow glue in delegations with QTYPE=ANY. 441158ac18
When a query for type ANY triggered a delegation response, all
additional data was omitted from the response, including
mandatory glue. This has been corrected. [GL #5659] [GL !11283]
Adding NSEC3 opt-out records could leave invalid records in
chain. 1b90296e1f
When creating an NSEC3 opt-out chain, a node in the chain could
be removed too soon, causing the previous NSEC3 being unable
to be found, resulting in invalid NSEC3 records to be left in
the zone. This has been fixed. [GL #5671] [GL !11340]
Fix slow speed of NSEC3 optout large delegation zone signing.
88f915b77b
BIND 9.20 takes much more time signing a large delegation zone
with NSEC3 optout compared to version 9.18. This has been
restored. [GL #5672] [GL !11362]
Reconfigure NSEC3 opt-out zone to NSEC causes zone to be invalid.
1d0e19c612
A zone that is signed with NSEC3, opt-out enabled, and then
reconfigured to use NSEC, causes the zone to be published with
missing NSEC records. This has been fixed. [GL #5679] [GL
!11401]
Fix a possible catalog zone issue during reconfiguration.
911b45b2b3
The named process could terminate unexpectedly during
reconfiguration when a catalog zone update was taking place at
the same time. This has been fixed. [GL !11386]
Fix the charts in the statistics channel. 7c7b01dd65
The charts in the statistics channel could sometimes fail to
render in the browser, and were completely disabled for
Mozilla-based browsers for historical reasons. This has been
fixed. [GL !11364]
BIND 9.20.17#
New Features#
Add spatch to detect implicit bool/int/result cast. 02be363d1f
Detection of implicit cast from a boolean into an int, or an
isc_result_t into a boolean (either in an assignement or return
position).
If such pattern is found, a warning comment is added into the
code (and the CI will fails) so the error can be spotted and
manually fixed. [GL !11237]
Feature Changes#
Use atomics for CMM_{LOAD,STORE}_SHARED with ThreadSanitizer.
94fa721705
Upstream has removed the atomics implementation of CMM_LOAD_SHARED
and CMM_STORE_SHARED as these can be used also with non-stdatomics
types. As we only use the CMM api with stdatomics types, we
can restore the previous behaviour to prevent ThreadSanitizer
warnings. [GL #5660] [GL !11290]
Provide more information when the memory allocation fails.
6749725610
Provide more information about the failure when the memory
allocation fails. [GL !11304]
Reduce the number of outgoing queries. 457b470e96
Reduces the number of outgoing queries when resolving the
nameservers for delegation points. This helps the DNS resolver
with cold cache resolve client queries with complex delegation
chains and redirections. [GL !11258]
Bug Fixes#
Fix the spurious timeouts while resolving names. d96cf874fb
Sometimes the loops in the resolving (e.g. to resolve or validate
ns1.example.com we need to resolve ns1.example.com) were not
properly detected leading to spurious 10 seconds delay. This
has been fixed and such loops are properly detected. [GL #3033],
#5578 [GL !11298]
Fix bug where zone switches from NSEC3 to NSEC after retransfer.
3b40ffbf83
When a zone is re-transferred, but the zone journal on an
inline-signing secondary is out of sync, the zone could fall
back to using NSEC records instead of NSEC3. This has been
fixed. [GL #5527] [GL !11274]
Attach socket before async streamdns_resume_processing. bb9451c73f
Call to streamdns_resume_processing is asynchronous but the
socket passed as argument is not attached when scheduling the
call.
While there is no reproducible way (so far) to make the socket
reference number down to 0 before streamdns_resume_processing
is called, attach the socket before scheduling the call. This
guard against an hypothetic case where, for some reasons, the
socket refcount would reach 0, and be freed from memory when
streamdns_resume_processing is called. [GL #5620] [GL !11260]
AMTRELAY type 0 presentation format handling was wrong. adf104a063
RFC 8777 specifies a placeholder value of "." for the gateway
field when the gateway type is 0 (no gateway). This was not
being checked for nor emitted when displaying the record. This
has been corrected.
Instances of this record will need the placeholder period added
to them when upgrading. [GL #5639] [GL !11255]
Fix parsing bug in remote-servers with key or tls. d9400c5967
The remote-servers clause enable the following pattern using
a named server-list:
remote-servers a { 1.2.3.4; ... }; remote-servers b { a key
foo; };
However, such configuration was wrongly rejected, with an
"unexpected token 'foo'" error. Such configuration is now
accepted. [GL #5646] [GL !11300]
Fix TLS contexts cache object usage bug in the resolver.
13adf94006
named could terminate unexpectedly when reconfiguring or
reloading, and if client-side TLS transport was in use (for
example, when forwarding queries to a DoT server). This has
been fixed. [GL #5653] [GL !11299]
Fix unitiailized pointer check on getipandkeylist. 5ed0cf091b
Function named_config_getipandkeylist could, in case of error
in the early code attempting to get the port or tls-port, make
a pointer check on a non-initialized value. This is now fixed.
[GL !11306]
Standardize CHECK and RETERR macros. ef714e91ac
previously, there were over 40 separate definitions of CHECK
macros, of which most used "goto cleanup", and the rest "goto
failure" or "goto out". there were another 10 definitions of
RETERR, of which most were identical to CHECK, but some simply
returned a result code instead of jumping to a cleanup label.
this has now been standardized throughout the code base: RETERR
is for returning an error code in the case of an error, and
CHECK is for jumping to a cleanup tag, which is now always
called "cleanup". both macros are defined in isc/util.h. [GL
!11069]
Adding NSEC3 opt-out records could leave invalid records in
chain. 1d83a8ad46
When creating an NSEC3 opt-out chain, a node in the chain could
be removed too soon, causing the previous NSEC3 being unable
to be found, resulting in invalid NSEC3 records to be left in
the zone. This has been fixed.
Closes [#5671](#5671)
BIND 9.20.16#
Feature Changes#
Fix assertion failure from arc4random_uniform with invalid
limit. 1040282de7e
When the arc4random_uniform() is called on NetBSD with upper_bound
that makes no sense statistically (0 or 1), the call crashes
the calling program. Fix this by returning 0 when upper bound
is < 2 as does Linux, FreeBSD and NetBSD. (Hint: System CSPRNG
should never crash.) [GL #5596] [GL !11151]
Bug Fixes#
Fix dnssec-keygen key collision checking for KEY rrtype keys.
ac8b23b80bf
The dnssec-keygen utility program failed to detect possible
Key ID collisions with the existing keys generated using the
non-default -T KEY option (e.g. for SIG(0)). This has been
fixed. [GL #5506] [GL !11128]
Fix shutdown INSIST in dns_dispatchmgr_getblackhole. f0aaaef166c
Previously, named could trigger an assertion in
dns_dispatchmgr_getblackhole while shutting down. This has been
fixed. [GL #5525] [GL !11162]
Dnssec-verify now uses exit code 1 when failing due to illegal
options. 6ead0aa4a2b
Previously, dnssec-verify exited with code 0 if the options
could not be parsed. This has been fixed. [GL #5574] [GL !11129]
Prevent assertion failures of dig when server is specified
before the -b option. deada63e2b2
Previously, dig could exit with an assertion failure when the
server was specified before the dig -b option. This has been
fixed. [GL #5609] [GL !11204]
Skip unsupported algorithms when looking for signing key.
c346fe88a1b
A mix of supported and unsupported DNSSEC algorithms in the
same zone could have caused validation failures. Ignore the
DNSSEC keys with unsupported algorithm when looking for the
signing keys. [GL #5622] [GL !11210]
Fix configuration bugs involving global defaults. a85d6fb581c
The configuration code for the max-cache-size, dnssec-validation,
and response-padding options were unnecessarily complicated,
and in the case of max-cache-size, buggy. These have been fixed.
The optionmaps variable in configure_view() is no longer needed
and has been removed. [GL !11172]
Skip buffer allocations if not logging. 4f601175bd0
Currently, during IXFR we allocate a 2KB buffer for IXFR change
logging regardless of the log level. This commit introduces an
early check on the log level in dns_diff_print to avoid this.
Results in a speedup from 28% in the test case from issue #5442.
[GL !11192]
BIND 9.20.15#
Security Fixes#
[CVE-2025-8677] DNSSEC validation fails if matching but invalid
DNSKEY is found. 0d676bf9f23
Previously, if a matching but cryptographically invalid key
was encountered during DNSSEC validation, the key was skipped
and not counted towards validation failures. named now treats
such DNSSEC keys as hard failures and the DNSSEC validation
fails immediately, instead of continuing with the next DNSKEYs
in the RRset.
ISC would like to thank Zuyao Xu and Xiang Li from the All-in-One
Security and Privacy Laboratory at Nankai University for bringing
this vulnerability to our attention. [GL #5343]
[CVE-2025-40778] Address various spoofing attacks. 23de94fd236
Previously, several issues could be exploited to poison a DNS
cache with spoofed records for zones which were not DNSSEC-signed
or if the resolver was configured to not do DNSSEC validation.
These issues were assigned CVE-2025-40778 and have now been
fixed.
As an additional layer of protection, named no longer accepts
DNAME records or extraneous NS records in the AUTHORITY section
unless these are received via spoofing-resistant transport
(TCP, UDP with DNS cookies, TSIG, or SIG(0)).
ISC would like to thank Yuxiao Wu, Yunyi Zhang, Baojun Liu,
and Haixin Duan from Tsinghua University for bringing this
vulnerability to our attention. [GL #5414]
[CVE-2025-40780] Cache-poisoning due to weak pseudo-random
number generator. 34af35c2df8
It was discovered during research for an upcoming academic
paper that a xoshiro128** internal state can be recovered by
an external 3rd party, allowing the prediction of UDP ports
and DNS IDs in outgoing queries. This could lead to an attacker
spoofing the DNS answers with great efficiency and poisoning
the DNS cache.
The internal random generator has been changed to a cryptographically
secure pseudo-random generator.
ISC would like to thank Prof. Amit Klein and Omer Ben Simhon
from Hebrew University of Jerusalem for bringing this vulnerability
to our attention. [GL #5484]
New Features#
Add dnssec-policy keys configuration check to named-checkconf.
1f5a0405f72
A new option -k is added to named-checkconf that allows checking
the dnssec-policy keys configuration against the configured
key stores. If the found key files are not in sync with the
given dnssec-policy, the check will fail.
This is useful to run before migrating to dnssec-policy. [GL
#5486] [GL !11011]
Feature Changes#
Minor refactor of dst code. c6acbaa020b
Convert the defines to enums. Initialize the tags more explicitly
and less ugly. [GL !11038]
Bug Fixes#
Use signer name when disabling DNSSEC algorithms. 986816baa74
disable-algorithms could cause DNSSEC validation failures when
the parent zone was signed with the algorithms that were being
disabled for the child zone. This has been fixed; disable-algorithms
now works on a whole-of-zone basis.
If the zone's name is at or below the disable-algorithms name
the algorithm is disabled for that zone, using deepest match
when there are multiple disable-algorithms clauses. [GL #5165]
[GL !11014]
Rndc sign during ZSK rollover will now replace signatures.
d2f551140cd
When performing a ZSK rollover, if the new DNSKEY is omnipresent,
the rndc sign command now signs the zone completely with the
successor key, replacing all zone signatures from the predecessor
key with new ones. [GL #5483] [GL !11017]
Missing DNSSEC information when CD bit is set in query.
968a6be41fb
The RRSIGs for glue records were not being cached correctly
for CD=1 queries. This has been fixed. [GL #5502] [GL !10956]
Preserve cache when reload fails and reload the server again.
975aeda10b4
Fixes an issue where failing to reconfigure/reload the server
would prevent to preserved the views caches on the subsequent
server reconfiguration/reload. [GL #5523] [GL !10988]
Check plugin config before registering. e2260b80702
In named_config_parsefile(), when checking the validity of
named.conf, the checking of plugin correctness was deliberately
postponed until the plugin is loaded and registered. However,
the checking was never actually done: the plugin_register()
implementation was called, but plugin_check() was not.
ns_plugin_register() (used by named) now calls the check function
before the register function, and aborts if either one fails.
ns_plugin_check() (used by named-checkconf) calls only the
check function. [GL !11032]
BIND 9.20.14#
Note
The BIND 9.20.14 release was withdrawn after the discovery of a
regression in a security fix in it during pre-release testing.
BIND 9.20.13# New Features#
Add manual mode configuration option to dnsec-policy. 1e435b107f
Add a new option manual-mode to dnssec-policy. The intended
use is that if it is enabled, it will not automatically move
to the next state transition, but instead the transition is
logged. Only after manual confirmation with rndc dnssec -step
the transition is made. [GL #4606] [GL !10880]
Add a new 'servfail-until-ready' configuration option for RPZ.
925af17d21
By default, when named is started it may start answering to
queries before the response policy zones are completely loaded
and processed. This new feature gives an option to the users
to tell named that incoming requests should result in SERVFAIL
answer until all the response policy zones are processed and
ready. Note that if one or more response policy zones fail to
load, named starts responding to queries according to those
zones that did load.
Note, that enabling this option has no effect when a DNS Response
Policy Service (DNSRPS) interface is used. [GL #5222] [GL
!10889]
Support for parsing HHIT and BRID records has been added.
1f051af24d
[GL #5444] [GL !10932]
Removed Features#
Deprecate the "tkey-gssapi-credential" statement. b239a70cac
The tkey-gssapi-keytab statement allows GSS-TSIG to be set up
in a simpler and more reliable way than using the
tkey-gssapi-credential statement and setting environment
variables (e.g. KRB5_KTNAME). Therefore, the tkey-gssapi-credential
statement has been deprecated; tkey-gssapi-keytab should be
used instead.
For configurations currently using a combination of both
tkey-gssapi-keytab and tkey-gssapi-credential, the latter should
be dropped and the keytab pointed to by tkey-gssapi-keytab
should now only contain the credential previously specified by
tkey-gssapi-credential. [GL #4204] [GL !10924]
Obsolete the "tkey-domain" statement. 9352ae65d7
Mark the tkey-domain statement as obsolete, since it has not
had any effect on server behavior since support for TKEY Mode
2 (Diffie-Hellman) was removed (in BIND 9.20.0). [GL #4204]
[GL !10926]
Feature Changes#
Update clang-format style with options added in newer versions.
0c2c477c31
Add and apply InsertBraces statement to add missing curly braces
around one-line statements and use ControlStatementsExceptControlMacros
for SpaceBeforeParens to remove space between foreach macro
and the brace, e.g. FOREACH (x) { becomes FOREACH(x) {. [GL
!10864]
Bug Fixes#
Ensure file descriptors 0-2 are in use. 35dee6eb90
libuv expect file descriptors <= STDERR_FILENO are in use.
otherwise, it may abort when closing a file descriptor it
opened. [GL #5226] [GL !10908]
Prevent spurious SERVFAILs for certain 0-TTL resource records.
6b266b222c
Under certain circumstances, BIND 9 can return SERVFAIL when
updating existing entries in the cache with new NS, A, AAAA,
or DS records with 0-TTL. [GL #5294] [GL !10898]
Use DNS_RDATACOMMON_INIT to hide branch differences. a64df9729b
Initialization of the common members of rdata type structures
varies across branches. Standardize it by using the
DNS_RDATACOMMON_INIT macro for all types, so that new types
are more likely to use it, and hence backport more cleanly.
[GL #5467] [GL !10834]
RPZ canonical warning displays zone entry incorrectly. d833676515
When an IPv6 rpz prefix entry is entered incorrectly the log
message was just displaying the prefix rather than the full
entry. This has been corrected. [GL #5491] [GL !10930]
Fix a catalog zone issue when having an unset 'default-primaries'
configuration clause. 293e75af28
A catalog zone with an unset default-primaries clause could
cause an unexpected termination of the named process after two
reloading or reconfiguration commands. This has been fixed.
[GL #5494] [GL !10905]
Add and use __attribute__((nonnull)) in dnssec-signzone.c.
a8eed36d3e
Clang 20 was spuriously warning about the possibility of passing
a NULL file pointer to fprintf(), which uses the 'nonnull'
attribute. To silence the warning, the functions calling
fprintf() have been marked with the same attribute to assure
that NULL can't be passed to them in the first place.
Close #5487 [GL !10913]
RPZ 'servfail-until-ready': skip updating SERVFAIL cache.
af2fb26325
In order to not pollute the SERVFAIL cache with the configured
SERVFAIL answers while RPZ is loading, set the NS_CLIENTATTR_NOSETFC
attribute for the client. [GL !10940]
BIND 9.20.12#
New Features#
Support for parsing the DSYNC record has been added. f440fe712d
[GL #5440] [GL !10820]
Feature Changes#
Adaptive memory allocation strategy for qp-tries. 9a046cbed5
qp-tries allocate their nodes (twigs) in chunks to reduce
allocator pressure and improve memory locality. The choice of
chunk size presents a tradeoff: larger chunks benefit qp-tries
with many values (as seen in large zones and resolvers) but
waste memory in smaller use cases.
Previously, our fixed chunk size of 2^10 twigs meant that even
an empty qp-trie would consume 12KB of memory, while reducing
this size would negatively impact resolver performance.
This MR implements an adaptive chunking strategy that tracks
the size of the most recently allocated chunk and doubles the
chunk size for each new allocation until reaching a predefined
maximum.
This approach effectively balances memory efficiency for small
tries while maintaining the performance benefits of larger
chunk sizes for bigger data structures. [GL #5445] [GL !10804]
Add deprecation warnings for RSASHA1, RSASHA1-NSEC3SHA1 and DS
digest type 1. 5aefaa4b97
RSASHA1 and RSASHA1-NSEC-SHA1 DNSKEY algorithms have been
deprecated by the IETF and should no longer be used for DNSSEC.
DS digest type 1 (SHA1) has also been deprecated. Validators
are now expected to treat these algorithms and digest as unknown,
resulting in some zones being treated as insecure when they
were previously treated as secure. Warnings have been added to
named and tools when these algorithms and this digest are being
used for signing.
Zones signed with RSASHA1 or RSASHA1-NSEC-SHA1 should be migrated
to a different DNSKEY algorithm.
Zones with DS or CDS records with digest type 1 (SHA1) should
be updated to use a different digest type (e.g. SHA256) and
the digest type 1 records should be removed.
Related to #5358 [GL !10738]
Bug Fixes#
Stale RRsets in a CNAME chain were not always refreshed.
ed37c7825e
With serve-stale enabled, a CNAME chain that contains a stale
RRset, the refresh query doesn't always properly refresh the
stale RRsets. This has been fixed. [GL #5243] [GL !10767]
Add RPZ extended DNS error for zones with a CNAME override
policy configured. 39ad2016c1
When the zone is configured with a CNAME override policy, or
the response policy zone contains a wildcard CNAME, the extended
DNS error code was not added. This has been fixed. [GL #5342]
[GL !10819]
Fix a possible crash when adding a zone while recursing.
7a3ec8dd94
A query for a zone that was not yet loaded may yield an unexpected
result such as a CNAME or DNAME, triggering an assertion failure.
This has been fixed. [GL #5357] [GL !10718]
Fix dig issues. 8c50819aa8
When used with the +keepopen option with a TCP connection,
iscman:dig could terminate unexpectedly in rare situations.
Additionally, iscman:dig could hang and fail to shutdown properly
when interrupted during a query. These have been fixed. [GL
#5381] [GL !10727]
Log dropped or slipped responses in the query-errors category.
47470b586d
Responses which were dropped or slipped because of RRL (Response
Rate Limiting) were logged in the rate-limit category instead
of the query-errors category, as documented in ARM. This has
been fixed. [GL #5388] [GL !10725]
Separate out adbname type flags. fc689c6525
There are three adbname flags that are used to identify different
types of adbname lookups when hashing rather than using multiple
hash tables. Separate these to their own structure element as
these need to be able to be read without locking the adbname
structure. [GL #5404] [GL !10695]
Synth-from-dnssec was not working in some scenarios. bc54f059e0
Aggressive use of DNSSEC-Validated cache with NSEC was not
working in scenarios when no parent NSEC was not in cache. This
has been fixed. [GL #5422] [GL !10754]
Clean enough memory when adding new ADB names/entries under
memory pressure. b7e7923daa
The ADB memory cleaning is opportunistic even when we are under
memory pressure (in the overmem condition). Split the opportunistic
LRU cleaning and overmem cleaning and make the overmem cleaning
always cleanup double of the newly allocated adbname/adbentry
to ensure we never allocate more memory than the assigned limit.
[GL !10707]
Prevent spurious validation failures. 3b98c7cc9d
Under rare circumstances, validation could fail if multiple
clients simultaneously iterated the same set of signatures.
References #3014 [GL !10815]
Rename variable called 'free' to prevent the clash with free()
7f25d92c5d
[GL !10757]
|
| 1.1.1.2 |
| 23-Sep-2022 |
christos | branches: 1.1.1.2.2;
Import 9.16.33; last imported was 9.16.20
--- 9.16.33 released ---
5962. [security] Fix memory leak in EdDSA verify processing.
(CVE-2022-38178) [GL #3487]
5961. [security] Fix memory leak in ECDSA verify processing.
(CVE-2022-38177) [GL #3487]
5960. [security] Fix serve-stale crash that could happen when
stale-answer-client-timeout was set to 0 and there was
a stale CNAME in the cache for an incoming query.
(CVE-2022-3080) [GL #3517]
5957. [security] Prevent excessive resource use while processing large
delegations. (CVE-2022-2795) [GL #3394]
5956. [func] Make RRL code treat all QNAMEs that are subject to
wildcard processing within a given zone as the same
name. [GL #3459]
5955. [port] The libxml2 library has deprecated the usage of
xmlInitThreads() and xmlCleanupThreads() functions. Use
xmlInitParser() and xmlCleanupParser() instead.
[GL #3518]
5954. [func] Fallback to IDNA2003 processing in dig when IDNA2008
conversion fails. [GL #3485]
5953. [bug] Fix a crash on shutdown in delete_trace_entry(). Add
mctx attach/detach pair to make sure that the memory
context used by a memory pool is not destroyed before
the memory pool itself. [GL #3515]
5952. [bug] Use quotes around address strings in YAML output.
[GL #3511]
5951. [bug] In some cases, the dnstap query_message field was
erroneously set when logging response messages.
[GL #3501]
5948. [bug] Fix nsec3.c:dns_nsec3_activex() function, add a missing
dns_db_detachnode() call. [GL #3500]
5945. [bug] If parsing /etc/bind.key failed, delv could assert
when trying to parse the built in trust anchors as
the parser hadn't been reset. [GL !6468]
5942. [bug] Fix tkey.c:buildquery() function's error handling by
adding the missing cleanup code. [GL #3492]
5941. [func] Zones with dnssec-policy now require dynamic DNS or
inline-siging to be configured explicitly. [GL #3381]
5936. [bug] Don't enable serve-stale for lookups that error because
it is a duplicate query or a query that would be
dropped. [GL #2982]
--- 9.16.32 released ---
5934. [func] Improve fetches-per-zone fetch limit logging to log
the final allowed and spilled values of the fetch
counters before the counter object gets destroyed.
[GL #3461]
5933. [port] Automatically disable RSASHA1 and NSEC3RSASHA1 in
named on Fedorda 33, Oracle Linux 9 and RHEL9 when
they are disabled by the security policy. [GL #3469]
5932. [bug] Fix rndc dumpdb -expired and always include expired
RRsets, not just for RBTDB_VIRTUAL time window.
[GL #3462]
5929. [bug] The "max-zone-ttl" option in "dnssec-policy" was
not fully effective; it was used for timing key
rollovers but did not actually place an upper limit
on TTLs when loading a zone. This has been
corrected, and the documentation has been clarified
to indicate that the old "max-zone-ttl" zone option
is now ignored when "dnssec-policy" is in use.
[GL #2918]
5924. [func] When it's necessary to use AXFR to respond to an
IXFR request, a message explaining the reason
is now logged at level info. [GL #2683]
5923. [bug] Fix inheritance for dnssec-policy when checking for
inline-signing. [GL #3438]
5922. [bug] Forwarding of UPDATE message could fail with the
introduction of netmgr. This has been fixed. [GL #3389]
--- 9.16.31 released ---
5917. [bug] Update ifconfig.sh script as is miscomputed interface
identifiers when destroying interfaces. [GL #3061]
5915. [bug] Detect missing closing brace (}) and computational
overflows in $GENERATE directives. [GL #3429]
5913. [bug] Fix a race between resolver query timeout and
validation in resolver.c:validated(). Remove
resolver.c:maybe_destroy() as it is no loger needed.
[GL #3398]
5909. [bug] The server-side destination port was missing from dnstap
captures of client traffic. [GL #3309]
5905. [bug] When the TCP connection would be closed/reset between
the connect/accept and the read, the uv_read_start()
return value would be unexpected and cause an assertion
failure. [GL #3400]
5903. [bug] When named checks that the OPCODE in a response matches
that of the request, if there is a mismatch named logs
an error. Some of those error messages incorrectly
used RCODE instead of OPCODE to lookup the nemonic.
This has been corrected. [GL !6420]
--- 9.16.30 released ---
5899. [func] Don't try to process DNSSEC-related and ZONEMD records
in catz. [GL #3380]
5890. [bug] When the fetches-per-server quota was adjusted
because of an authoritative server timing out more
or less frequently, it was incorrectly set to 1
rather than the intended value. This has been
fixed. [GL #3327]
5888. [bug] Only write key files if the dnssec-policy keymgr has
changed the metadata. [GL #3302]
5823. [func] Replace hazard pointers based lock-free list with
locked-list based queue that's simpler and has no or
little performance impact. [GL #3180]
--- 9.16.29 released ---
5885. [bug] RPZ NSIP and NSDNAME rule processing didn't handle stub
and static-stub zones at or above the query name. This
has now been addressed. [GL #3232]
5881. [bug] dig +nssearch could hang in rare cases when recv_done()
callback was being called earlier than send_done().
[GL #3278]
5880. [func] Add new named command-line option -C to print built-in
defaults. [GL #1326]
5879. [contrib] dlz: Add FALLTHROUGH and UNREACHABLE macros. [GL #3306]
5874. [bug] keymgr didn't work with python 3.11. [GL !6157]
5866. [bug] Work around a jemalloc quirk which could trigger an
out-of-memory condition in named over time. [GL #3287]
5863. [bug] If there was a pending negative cache DS entry,
validations depending upon it could fail. [GL #3279]
5858. [bug] Don't remove CDS/CDNSKEY DELETE records on zone sign
when using 'auto-dnssec maintain;'. [GL #2931]
--- 9.16.28 released ---
5856. [bug] The "starting maxtime timer" message related to outgoing
zone transfers was incorrectly logged at the ERROR level
instead of DEBUG(1). [GL #3208]
5852. [func] Add new "reuseport" option to enable/disable load
balancing of sockets. [GL #3249]
5843. [bug] When an UPDATE targets a zone that is not configured,
the requested zone name is now logged in the "not
authoritative" error message, so that it is easier to
track down problematic update clients. [GL #3209]
5836. [bug] Quote the dns64 prefix in error messages that complain
about problems with it, to avoid confusion with the
following dns64 ACLs. [GL #3210]
5834. [cleanup] C99 variable-length arrays are difficult to use safely,
so avoid them except in test code. [GL #3201]
5828. [bug] Replace single TCP write timer with per-TCP write
timers. [GL #3200]
5824. [bug] Invalid dnssec-policy definitions were being accepted
where the defined keys did not cover both KSK and ZSK
roles for a given algorithm. This is now checked for
and the dnssec-policy is rejected if both roles are
not present for all algorithms in use. [GL #3142]
--- 9.16.27 released ---
5818. [security] A synchronous call to closehandle_cb() caused
isc__nm_process_sock_buffer() to be called recursively,
which in turn left TCP connections hanging in the
CLOSE_WAIT state blocking indefinitely when
out-of-order processing was disabled. (CVE-2022-0396)
[GL #3112]
5817. [security] The rules for acceptance of records into the cache
have been tightened to prevent the possibility of
poisoning if forwarders send records outside
the configured bailiwick. (CVE-2021-25220) [GL #2950]
5816. [bug] Make BIND compile with LibreSSL 3.5.0, as it was using
not very accurate pre-processor checks for using shims.
[GL #3172]
5815. [bug] If an oversized key name of a specific length was used
in the text form of an HTTP or SVBC record, an INSIST
could be triggered when parsing it. [GL #3175]
5814. [bug] The RecursClients statistics counter could underflow
in certain resolution scenarios. [GL #3147]
5811. [bug] Reimplement the maximum and idle timeouts for outgoing
zone transfers. [GL #1897]
5807. [bug] Add a TCP "write" timer, and time out writing
connections after the "tcp-idle-timeout" period
has elapsed. [GL #3132]
5804. [func] Add a debug log message when starting and ending
the task exclusive mode. [GL #3137]
--- 9.16.26 released ---
5801. [bug] Log "quota reached" message when hard quota
is reached when accepting a connection. [GL #3125]
5800. [func] Add ECS support to the DLZ interface. [GL #3082]
5797. [bug] A failed view configuration during a named
reconfiguration procedure could cause inconsistencies
in BIND internal structures, causing a crash or other
unexpected errors. [GL #3060]
5795. [bug] rndc could crash when interrupted by a signal
before receiving a response. [GL #3080]
5793. [bug] Correctly detect and enable UDP recvmmsg support
in all versions of libuv that support it. [GL #3095]
--- 9.16.25 released ---
5789. [bug] Allow replacing expired zone signatures with
signatures created by the KSK. [GL #3049]
5788. [bug] An assertion could occur if a catalog zone event was
scheduled while the task manager was being shut
down. [GL #3074]
5787. [doc] Update 'auto-dnssec' documentation, it may only be
activated at zone level. [GL #3023]
5786. [bug] Defer detaching from zone->raw in zone_shutdown() if
the zone is in the process of being dumped to disk, to
ensure that the unsigned serial number information is
always written in the raw-format header of the signed
version on an inline-signed zone. [GL #3071]
5785. [bug] named could leak memory when two dnssec-policy clauses
had the same name. named failed to log this error.
[GL #3085]
5776. [bug] Add a missing isc_condition_destroy() for nmsocket
condition variable and add missing isc_mutex_destroy()
for nmworker lock. [GL #3051]
5676. [func] Memory use in named was excessive. This has been
addressed by:
- Replacing locked memory pools with normal memory
allocations.
- Reducing the number of retained free items in
unlocked memory pools.
- Disabling the internal allocator by default.
"named -M internal" turns it back on.
[GL #2398]
--- 9.16.24 released ---
5773. [func] Change the message when accepting TCP connection has
failed to say "Accepting TCP connection failed" and
change the log level for ISC_R_NOTCONNECTED, ISC_R_QUOTA
and ISC_R_SOFTQUOTA results codes from ERROR to INFO.
[GL #2700]
5768. [bug] dnssec-dsfromkey failed to omit revoked keys. [GL #853]
5764. [bug] dns_sdlz_putrr failed to process some valid resource
records. [GL #3021]
5762. [bug] Fix a "named" crash related to removing and restoring a
`catalog-zone` entry in the configuration file and
running `rndc reconfig`. [GL #1608]
5758. [bug] mdig now honors the operating system's preferred
ephemeral port range. [GL #2374]
5757. [test] Replace sed in nsupdate system test with awk to
construct the nsupdate command. The sed expression
was not reliably changing the ttl. [GL #3003]
--- 9.16.23 released ---
5752. [bug] Fix an assertion failure caused by missing member zones
during a reload of a catalog zone. [GL #2308]
5750. [bug] Fix a bug when comparing two RSA keys. There was a typo
which caused the "p" prime factors to not being
compared. [GL #2972]
5737. [bug] Address Coverity warning in lib/dns/dnssec.c.
[GL #2935]
--- 9.16.22 released ---
5736. [security] The "lame-ttl" option is now forcibly set to 0. This
effectively disables the lame server cache, as it could
previously be abused by an attacker to significantly
degrade resolver performance. (CVE-2021-25219)
[GL #2899]
5724. [bug] Address a potential deadlock when checking zone content
consistency. [GL #2908]
5723. [bug] Change 5709 broke backward compatibility for the
"check-names master ..." and "check-names slave ..."
options. This has been fixed. [GL #2911]
5720. [contrib] Old-style DLZ drivers that had to be enabled at
build-time have been marked as deprecated. [GL #2814]
5719. [func] The "map" zone file format has been marked as
deprecated. [GL #2882]
5717. [func] The "cache-file" option, which was documented as "for
testing purposes only" and not to be used, has been
removed. [GL #2903]
5716. [bug] Multiple library names were mistakenly passed to the
krb5-config utility when ./configure was invoked with
the --with-gssapi=[/path/to/]krb5-config option. This
has been fixed by invoking krb5-config separately for
each required library. [GL #2866]
5715. [func] Add a check for ports specified in "*-source(-v6)"
options clashing with a global listening port. Such a
configuration was already unsupported, but it failed
silently; it is now treated as an error. [GL #2888]
5714. [bug] Remove the "adjust interface" mechanism which was
responsible for setting up listeners on interfaces when
the "*-source(-v6)" address and port were the same as
the "listen-on(-v6)" address and port. Such a
configuration is no longer supported; under certain
timing conditions, that mechanism could prevent named
from listening on some TCP ports. This has been fixed.
[GL #2852]
5712. [doc] Add deprecation notice about removing native PKCS#11
support in the next major BIND 9 release. [GL #2691]
--- 9.16.21 released ---
5711. [bug] "map" files exceeding 2GB in size failed to load due to
a size comparison that incorrectly treated the file size
as a signed integer. [GL #2878]
5710. [port] win32: incorrect parentheses resulted in the wrong
sizeof() tests being used to pick the appropriate
Windows atomic operations for the object's size.
[GL #2891]
5709. [cleanup] Enum values throughout the code have been updated
to use the terms "primary" and "secondary" instead of
"master" and "slave", respectively. [GL #1944]
5708. [bug] The thread-local isc_tid_v variable was not properly
initialized when running BIND 9 as a Windows Service,
leading to a crash on startup. [GL #2837]
5705. [bug] Change #5686 altered the internal memory structure of
zone databases, but neglected to update the MAPAPI value
for zone files in "map" format. This caused named to
attempt to load incompatible map files, triggering an
assertion failure on startup. The MAPAPI value has now
been updated, so named rejects outdated files when
encountering them. [GL #2872]
5704. [bug] Change #5317 caused the EDNS TCP Keepalive option to be
ignored inadvertently in client requests. It has now
been fixed and this option is handled properly again.
[GL #1927]
5701. [bug] named-checkconf failed to detect syntactically invalid
values of the "key" and "tls" parameters used to define
members of remote server lists. [GL #2461]
5700. [bug] When a member zone was removed from a catalog zone,
journal files for the former were not deleted.
[GL #2842]
5699. [func] Data structures holding DNSSEC signing statistics are
now grown and shrunk as necessary upon key rollover
events. [GL #1721]
5698. [bug] When a DNSSEC-signed zone which only has a single
signing key available is migrated to use KASP, that key
is now treated as a Combined Signing Key (CSK).
[GL #2857]
5696. [protocol] Support for HTTPS and SVCB record types has been added.
(This does not include ADDITIONAL section processing for
these record types, only basic support for RR type
parsing and printing.) [GL #1132]
5694. [bug] Stale data in the cache could cause named to send
non-minimized queries despite QNAME minimization being
enabled. [GL #2665]
5691. [bug] When a dynamic zone was made available in another view
using the "in-view" statement, running "rndc freeze"
always reported an "already frozen" error even though
the zone was successfully frozen. [GL #2844]
5690. [func] dnssec-signzone now honors Predecessor and Successor
metadata found in private key files: if a signature for
an RRset generated by the inactive predecessor exists
and does not need to be replaced, no additional
signature is now created for that RRset using the
successor key. This enables dnssec-signzone to gradually
replace RRSIGs during a ZSK rollover. [GL #1551]
|
