Changes in added.db http://nxr.netbsd.org/rss/src/external/mpl/bind/dist/bin/tests/system/cname_recursion/ns2/added.db en Copyright 2005 Java branches: 1.1.1;<br/>Initial revision /src/external/mpl/bind/dist/bin/tests/system/cname_recursion/ns2/added.db - 1.1 Thu Sep 17 17:45:01 UTC 2026 christos Import bind-9.20.29 (previous was 9.20.27)<br/><br/>BIND 9.20.29<br/>Security Fixes<br/>[CVE-2026-19668] Prevent excessive CPU use validating crafted DNSSEC<br/>responses. a0a61dba9e<br/> A malicious authoritative server could serve a securely delegated zone<br/> whose DS and DNSKEY records carry many distinct key tags but no valid<br/> match, forcing a validating resolver into excessive key-tag matching<br/> and high CPU use for every query. BIND now bounds this work with the<br/> per-query validation limit (max-validations-per-fetch). [GL #5349]<br/><br/>[CVE-2026-19033] Require a TSIG on every message of incoming zone<br/>transfers. 9404cd2b8c<br/> BIND 9 used to accept TSIG-signed zone transfers in which some messages<br/> were unsigned, and processed those messages before the next signature<br/> could vouch for them. It now requires a TSIG on every message of an<br/> incoming AXFR or IXFR; all modern nameserver already sign every message,<br/> so no change is expected in practice. [GL #6062]<br/><br/>[CVE-2026-77119] Prevent a DNSSEC downgrade of secure delegations via<br/>unrelated NSEC3. 3bed9c8e9e<br/> A validating resolver could be tricked into treating a secure delegation<br/> as unsigned and accepting forged answers for names beneath it, if an<br/> attacker could inject responses to its queries. Such forged proofs are now<br/> rejected. [GL #6234]<br/><br/>[CVE-2026-19941] Prevent forged DNSSEC-validated NXDOMAIN<br/>responses. a36bf58daf<br/> A validating resolver could accept a signed NSEC record from an unrelated<br/> zone as proof that a wildcard did not exist. An on-path attacker or<br/> malicious forwarder controlling a signed zone could therefore forge an<br/> authenticated NXDOMAIN response for a name that should resolve through<br/> a wildcard. BIND now requires the wildcard-denial and name-nonexistence<br/> proofs to be signed by the same zone. [GL #6253]<br/><br/>[CVE-2026-19666] DNS64 with break-dnssec could cause an assertion<br/>failure. 4cec4965c4<br/> When a "dns64" statement is configured with "break-dnssec yes" and its<br/> "exclude" list matches some but not all of the addresses in an AAAA RRset,<br/> named removes the excluded addresses from the answer instead of<br/> synthesizing new ones. If the answer being filtered had been cached<br/> together with a proof that the queried name does not exist -- which is what<br/> a wildcard match produces -- named terminated with an assertion failure.<br/> Only recursive resolvers are affected, and only when "break-dnssec yes"<br/> is in use; the answer has to come from the cache, so a server that is only<br/> authoritative cannot reach this. [GL #6301]<br/><br/>[CVE-2026-19667] Reject negative cache records that do not fit in a<br/>dns_rdata_t. dbf08c8581<br/> A single crafted response from a server could make a resolver cache a<br/> malformed negative entry and then terminate with an assertion failure when<br/> reading it back. Only recursive resolvers are affected, on a default<br/> configuration. [GL #6302]<br/><br/>[CVE-2026-19662] Prevent resolver crash with cached DNSSEC<br/>proofs. c884cc1ba0<br/> Under certain timing conditions, concurrent recursive queries could cause<br/> named to crash when cached DNSSEC NOQNAME proof data was replaced while<br/> still in use. Cached proof data is now retained until all queries using<br/> it have completed. [GL #6333]<br/><br/>[CVE-2026-75029] Discard repeated SOA, CNAME, and DNAME records when<br/>parsing DNS messages. 0d630758c2<br/> A DNS message could carry the same SOA, CNAME, or DNAME record many<br/> times, and named kept every copy while parsing it. With name compression<br/> those copies took up far more memory internally than in the message<br/> itself, and every later processing step had to handle all of them. named<br/> now keeps the first copy of such a record and discards identical<br/> repeats. [GL #6335]<br/><br/>[CVE-2026-77692] Fix an unauthenticated crash on HTTPS using<br/>SIG(0) 5a24401c5c<br/> A specifically crafted HTTPS query using SIG(0) as authentication could<br/> crash named if the client closes the connection before named actually<br/> verifies the signature. This is now fixed. [GL #6343]<br/><br/>[CVE-2026-81736] Cached HTTPS/SVCB aliases could exhaust resolver<br/>CPU. 20bbb1639a<br/> A recursive resolver that had cached a large set of interlinked HTTPS<br/> or SVCB records in alias form could be driven to do an excessive amount<br/> of work assembling a single response, because it followed every cached<br/> alias target when building the additional section. A client permitted<br/> to use recursion, together with an attacker-controlled zone used to<br/> plant the records, could repeat small queries to consume enough CPU to<br/> delay or deny service to other clients. The amount of additional<br/> processing done for one query is now bounded. [GL #6347]<br/><br/>[CVE-2026-76163] Prevent TKEY queries from terminating named without global<br/>options. 7645138538<br/> named could terminate unexpectedly when a remote client sent a TKEY<br/> query if the configuration did not include a global options statement.<br/> This has been fixed.<br/> ISC thanks Owais Lone (thesecguy) for reporting the issue. [GL #6357]<br/><br/>[CVE-2026-78301] Out-of-zone records in a zone database could be served as<br/>authoritative. 72a10c3a0b<br/> When a zone database contained records for names outside the zone -- such<br/> as a delegation above the zone apex, left behind by a secondary that had<br/> accepted out-of-zone data from its primary -- the server could treat them<br/> as authoritative and answer queries for names inside the zone with that<br/> out-of-zone data instead of the zone's own. A server that was also a<br/> resolver could follow such a delegation and cache the answers of the<br/> server it named, affecting names outside the configured zone. Zone<br/> database lookups are now confined to names at or below the zone's<br/> origin.<br/> ISC would like to thank Henrique Pereira for reporting the<br/> issue. [GL #6361]<br/><br/>[CVE-2026-80274] Crash on wildcard answers carrying both NSEC and NSEC3<br/>proofs. 0e44451b1a<br/> When a wildcard answer arrived with both NSEC and NSEC3 records at the<br/> name proving that the queried name does not exist, the resolver could<br/> pick different records when caching the answer and when retrieving the<br/> proof, depending on the order in which the authoritative server sent<br/> them. This could terminate named with an assertion failure, fail the<br/> query with SERVFAIL, or serve a denial record other than the one that<br/> had been verified. The resolver now caches and serves the same denial<br/> record it accepted when the answer was received.<br/> ISC would like to thank hythyt for reporting the issue. [GL #6369]<br/><br/>[CVE-2026-81563] Following HTTPS/SVCB aliases could leak resolver cache<br/>memory. 3162df369e<br/> When a recursive server answered a query for an HTTPS or SVCB record in<br/> alias form and the alias target had more than 13 records, the target<br/> records were pinned in the cache permanently instead of being released<br/> once the answer was sent. A remote party who could make the server follow<br/> such aliases to a steady stream of fresh names could grow the cache<br/> beyond the configured max-cache-size until the server was unable to<br/> resolve unrelated names. The records are now released<br/> correctly.<br/> ISC would like to thank Samy Medjahed/Ap4sh for reporting the<br/> issue. [GL #6374]<br/><br/>New Features<br/>Add an agent skill for the isc_job/isc_async/isc_work APIs. fe32990b06<br/> Documents when to use isc_job_run(), isc_async_run() or<br/> isc_work_enqueue(), and the contract each one imposes. No functional<br/> change. [GL !12561]<br/><br/>Removed Features<br/>Remove unused closest encloser proof caching. abd8b5bfd8<br/> BIND used to cache an NSEC3 closest encloser proof alongside positive<br/> wildcard answers so that a resolver could re-send it when answering<br/> from its cache. That stopped being used in BIND 9.9 (2011), when<br/> positive wildcard responses were changed to omit that NSEC3 record --<br/> RFC 5155 requires only the next closer name proof -- and the closest<br/> encloser came to be derived during validation instead. The caching code<br/> has been unreachable ever since, so this removes it with no change in<br/> behaviour. [GL #5803] [GL !12660]<br/><br/>Feature Changes<br/>Reject oversized and malformed DNSKEY records up front. 6c22109924<br/> Oversized RSA key material in a DNSKEY record was only rejected after it<br/> had been converted, allocating memory proportional to the record size.<br/> Such records are now rejected before conversion, as are Ed25519 and<br/> Ed448 keys with trailing bytes that were previously silently<br/> ignored. [GL #4537] [GL !12560]<br/><br/>Bug Fixes<br/>Prevent a crash when using both dns64 and filter-a. bce5d10d18<br/> An assertion failure was possible when using both dns64 and the<br/> filter-a plugin simultaneously; this has been fixed. [GL #5979] [GL !12663]<br/><br/>Fix update-policy grant external address passing. b1e955c326<br/> Only TCP client addresses are supposed to be passed to an external<br/> handler for the associated update-policy rule, but UDP client addresses<br/> were also being passed. This could have caused the external handler to<br/> return a result it otherwise wouldn't. This has been fixed. [GL #6061]<br/> [GL !12555]<br/><br/>Missing required NSEC3 for delegation not detected. e84ed2e9d7<br/> A missing required NSEC3 record for an insecure delegation in a non<br/> OPTOUT range was not being detected. This has been fixed. [GL #6063]<br/> [GL !12611]<br/><br/>Tighten EUI48 and EUI48 text parsing. ff50f2cdf1<br/> Malformed EUI48 and EUI64 records could be accepted. This has been<br/> fixed. [GL #6082] [GL !12521]<br/><br/>GeoIP ACL state can be stale or wrong after reload. 63baf425b3<br/> named caches GeoIP information after looking it up, but the cached<br/> information was not invalidated when the GeoIP database was reloaded, so<br/> it could continue to be used. We now invalidate existing cached GeoIP<br/> information as part of the reloading process. [GL #6083] [GL !12662]<br/><br/>Honor DNSSEC policy key tag ranges. b82e5834b7<br/> When a DNSSEC policy configured a non-default tag-range, dnssec-keygen and<br/> dnssec-ksr could accept generated keys outside that range. Both tools<br/> now honor the configured minimum and maximum key tags. [GL #6091]<br/> [GL !12549]<br/><br/>Fix double free in mdig when EDNS options are specified. af5bd0b0ff<br/> When the default_query is cloned the EDNS options need to be cloned<br/> rather than the pointer copied. The old behaviour results in a double<br/> free of the options. This has been fixed. [GL #6095] [GL !12661]<br/><br/>Fix a crash when an IXFR falls back to AXFR with updates still<br/>pending. e34062bc7e<br/> When a secondary zone received an incremental transfer (IXFR) and the<br/> primary then caused named to fall back to a full transfer (AXFR) while<br/> some of the already-received incremental changes were still waiting to be<br/> applied, named could later crash when that transfer finished. The pending<br/> changes are now discarded correctly before the AXFR retry. [GL #6114]<br/> [GL !12624]<br/><br/>Fix DS requests to parental agents over TLS. 55830d30f6<br/> TLS configuration for parental agents was being ignored when sending DS<br/> requests. This has been fixed. [GL #6135] [GL !12613]<br/><br/>Fix a crash when resolving names below a cached DNAME. b94e940f52<br/> A recursive resolver could crash when it answered a query for a name<br/> beneath a cached DNAME while that same DNAME record was concurrently<br/> refreshed or evicted from the cache. [GL #6182] [GL !12593]<br/><br/>Rndc-confgen -q (quiet) option is documented but doesn't work. 7e4a7ca1a7<br/> The command line parsing in rndc-confgen was broken so rndc-confgen -q<br/> did not work. This has been fixed. [GL #6187] [GL !12575]<br/><br/>Enforce query ACLs for redirect zones and searched DLZs. bc69876b2e<br/> Queries answered from redirect zones or searched DLZ databases did not<br/> consistently honor allow-query and allow-query-on, potentially exposing<br/> restricted DNS data to excluded clients or through excluded listening<br/> addresses. These ACLs are now enforced before redirect or DLZ data is<br/> returned. [GL #6251], #6252 [GL !12646]<br/><br/>Check "asnum" validity in GeoIP ACLs. 28c2bfdc7b<br/> We now check the validity of autonomous system (AS) numbers when parsing<br/> GeoIP ACLs that use asnum elements at configuration time.<br/> asnum values start with an optional case-insensitive "AS" prefix,<br/> followed only by decimal digits, with no spaces or other extraneous<br/> characters. The value represented cannot exceed 2^32. [GL #6255]<br/> [GL !12511]<br/><br/>Prevent crashes while reporting DNSSEC signing statistics. c190514f0a<br/> Servers with zone-statistics full could terminate while reporting<br/> DNSSEC signing statistics for a zone tracking adding more than four<br/> signing keys. [GL #6256] [GL !12674]<br/><br/>Fix various nits in the netmgr code. c28cdad51b<br/> The MR consists of couple of small fixes and uncaught errors in the<br/> Network Manager. [GL #6257] [GL !12576]<br/><br/>Fix a crash on remote-servers lists that reference themselves. aaae614f9d<br/> Since 9.21.16 and 9.20.17, a remote-servers, primaries, masters, or<br/> parental-agents list that referenced itself, directly or through<br/> another list, made named crash on startup or reconfiguration. Such<br/> references are again skipped and the remaining entries in the list are<br/> used, as in earlier versions. [GL #6287] [GL !12604]<br/><br/>A record from outside a response policy zone could stop named. d135513b37<br/> A response policy zone transferred from a primary can contain a record<br/> whose name lies outside the zone. Such a record could stop named, both<br/> when it arrived and again at every startup afterwards, because a<br/> secondary keeps it in its own copy of the zone. Records like this are now<br/> rejected and logged; previously one could also silently create a policy<br/> entry for an unrelated name. [GL #6304] [GL !12543]<br/><br/>"rndc flushtree ." failed to flush the cache. 96e8b585ed<br/> rndc flushtree flushes cache data below a specified name. If the name<br/> specified is the DNS root, it should fully empty the cache, the same as<br/> rndc flush. However, there was a bug causing the command, in that case,<br/> to have no effect on the cache at all; this has been fixed. [GL #6308]<br/> [GL !12582]<br/><br/>Invalid key-store configuration could abort the DNSSEC tools. 1d796ab072<br/> Invalid configured key-stores named "key-directory" in configuration<br/> files could abort the DNSSEC tools. This has been fixed. [GL #6313]<br/> [GL !12653]<br/><br/>NSEC signature set could bypass the secure-delegation check. c966177f6c<br/> When proving that a delegation is insecure, the validator bounded an<br/> NSEC record's authority by the signer of whichever RRSIG happened to<br/> come first in the record's signature set, rather than the signature that<br/> actually verified. A grandparent NSEC padded with an extra, unverifiable<br/> signature could therefore pass the check that keeps such proofs from<br/> reaching below a signed child zone. The validator now requires every<br/> signature on the NSEC to name the same signer and refuses proofs whose<br/> signature set is malformed or larger than max-validations-per-fetch<br/> allows. [GL #6321]<br/><br/>Fix a possible nsupdate issue when using GSS-TSIG. 4ddcab2d3c<br/> The nsupdate process could terminate unexpectedly when using the<br/> GSS-TSIG mode executed with the nsupdate -g option. This has been<br/> fixed. [GL #6325] [GL !12588]<br/><br/>Fix isccc_alist_define error paths. af1349552a<br/> If there is an out of memory error in isccc_alist_define a memory leak<br/> (the sexpr holding the key name) or a double free (value) could occur.<br/> This has been fixed. [GL #6329] [GL !12636]<br/><br/>Check for empty 'endpoints' list. 23f58af443<br/> Configuring an http block with endpoints {}; previously caused a crash<br/> in named. This is now rejected earlier by the configuration check.<br/> [GL #6330] [GL !12552]<br/><br/>Named could crash with a single-element geoip sortlist. 0e996a4d3b<br/> If named was configured with a single-element sortlist containing a geoip<br/> ACL element, any matching query triggered an assertion failure. This<br/> has been fixed. [GL #6342] [GL !12583]<br/><br/>Prevent out-of-bailiwick CNAMEs from evicting cached records. cdedd4acd5<br/> A recursive resolver could remove valid cached records when a DNS<br/> response contained an out-of-bailiwick CNAME with the same owner name.<br/> Out-of-bailiwick data is now discarded before it can modify the<br/> cache. [GL #6345] [GL !12651]<br/><br/>Restore periodic cleanup of stale resolver address data. 356f4013f8<br/> Stale resolver address data could remain cached until memory pressure or<br/> an explicit flush. Correct the cleanup interval so it is removed<br/> periodically. [GL #6346] [GL !12589]<br/><br/>Fix named-checkconf/named crash with malformed key name. 9f218f6aaf<br/> When a primary/remote-server key name was malformed, named-checkconf and<br/> named were both crashing (after warning about the invalid key name).<br/> This is now fixed. [GL #6362] [GL !12639]<br/><br/>Fix -Wformat-truncation warning in totext_in_wks() f97c2bea40<br/> BIND 9 failed to build with GCC 16 at -O3: rendering a WKS record as<br/> text triggered a -Wformat-truncation error, which is fatal in developer<br/> builds. The port number is now printed with a 16-bit format specifier,<br/> so the compiler can see it always fits the output buffer. [GL !12542]<br/><br/>Fix off-by-one errors caused by magic hardcoded values. 726c6cb795<br/> Fix off-by-one comparinson errors: "named -p http=" dropped the first<br/> digit of the given port (for example, "http=8080" selected port 80) and<br/> now uses the port as given, and "named-rrchecker -C" compared only part<br/> of the "CLASS" prefix when filtering generic class names, which was<br/> harmless in practice but is now corrected. [GL !12616]<br/><br/>Hmac_verify() now accepts truncated HMACs only when requested. c81b111496<br/> The hmac_verify() function incorrectly compares only up to<br/> 'sig->length' bytes, but the signature and its length should not be<br/> trusted, e.g. in case if it comes from a user query.<br/> Don't accept signatures which length isn't equal to the expected<br/> calculated HMAC length unless it is explicitly requested by the caller,<br/> e.g. for truncated TSIG [1] support.<br/> [1] https://datatracker.ietf.org/doc/html/rfc8945#name-tsig-truncation<br/> -policy [GL !12629]<br/><br/>Prevent resolver crashes while processing DNS over TCP. 81b3b6d89f<br/> Recursive resolvers could terminate with an assertion failure while<br/> processing DNS responses over TCP under sustained traffic. The failure<br/> was observed on resolvers configured globally with forward only; the<br/> same transport path is also used by iterative resolution. This has been<br/> fixed. [GL !12537] /src/external/mpl/bind/dist/bin/tests/system/cname_recursion/ns2/added.db - 1.1.1.1 Thu Sep 17 17:45:01 UTC 2026 christos