Changes in f025.py

Changes in f025.py http://nxr.netbsd.org/rss/src/external/mpl/bind/dist/bin/tests/system/dnssec_nsec3/ans1/f025.py en Copyright 2005 Java branches: 1.1.1; Initial revision /src/external/mpl/bind/dist/bin/tests/system/dnssec_nsec3/ans1/f025.py - 1.1 Sat Aug 29 14:32:03 UTC 2026 christos Import bind-9-20-27 (Previous was bind-9-20-24) iNotes for BIND 9.20.27# New Features# Disclose active Negative Trust Anchors with Extended DNS Error 33. A Negative Trust Anchor (RFC 7646) turns off DNSSEC validation for a domain, so a name that would normally fail validation resolves instead. named now marks such answers with Extended DNS Error code 33, "Negative Trust Anchor", so operators can see at a glance when a response came back only because an NTA was in effect. [GL #6268] Feature Changes# Speed up RPZ policy zone updates. RPZ updates used to be applied one small step at a time, adding overhead on large policy zones. Updates are now applied as a single batch, improving update performance for large RPZ zones, at the cost of no longer overlapping with concurrent updates. [GL #5787] [GL #6270] Bug Fixes# Ensure NSEC authority does not cross zonecut boundary. When using a cached NSEC record to prove that a delegation is insecure, named now checks that the signer name in the corresponding RRSIG is not above a known secure delegation point. This prevents a signed namespace from being downgraded to insecure using an NSEC record from the grandparent zone. [GL #5967] Treat an unusable NSEC3 chain as a verification failure. When transferring in a mirror zone, DNSSEC verification could incorrectly succeed when the zone had an invalid NSEC3PARAM record, leading to subsequent validation failures. This has been fixed. [GL #6136] Treat non-canonical RPZ prefixes as any other failure. RPZ prefixes that were not encoded in canonical form did not work. They are now handled in the same way as any other encoding error. [GL #6043] Negative caching stopped working with stale-answer-client-timeout set to 0. Negative answers were re-fetched on every query instead of once they actually expired, effectively disabling negative caching. This has been fixed. [GL #6245] An unterminated OpenSSL private-key Label: field could be read past its parser buffer. The Label: field in a .private key file is now checked for length and NUL-termination. Malformed files are rejected. [GL #6193] Restore SMF support on Solaris and illumos. [GL #6096] Fix compilation on GNU/Hurd. [GL #6285] dig +yaml was producing invalid YAML when a lookup failed. When no server could be reached, dig printed its plain-text startup banner ahead of the YAML output, making the result unparsable. dig no longer does this and correctly reflects options such as +nocmd, +short and +yaml, regardless of where they appear on the command line. [GL #1230] Properly prevent TSIG generation command line injection attacks. When key names are generated with rndc-confgen, tsig-keygen and ddns-confgen, special characters must be escaped to ensure that the configuration is parsed correctly. [GL #6071] Fix a potential heap bounds overflow write in dnssec-signzone. It was possible for dnssec-signzone to overflow array bounds while signing. This has been fixed. [GL #6076] Fix crashes on invalid DNSTAP input in dnstap-read. Malformed DNSTAP files could trigger a NULL pointer dereference or an out-of-bounds memory read in dnstap-read. This has been fixed. [GL #6077] [GL #6124] Notes for BIND 9.20.26# Security Fixes# Correct verification of NSEC3 signer name. (CVE-2026-10723) Previously, named accepted child-zone NSEC3 records where the first label equaled the hash of the parent zone as valid parent-zone closest encloser proofs. This has been fixed. ISC would like to thank Qifan Zhang of Palo Alto Networks for bringing this vulnerability to our attention. [GL #5874] Malformed DNSKEY records could trigger an assertion. (CVE-2026-10822) Previously, dns_name_fromwire() did not honor the record boundary when reading names from the wire, allowing malformed records to be accepted when they should not have been. In particular, malformed DNSKEY records could trigger an assertion failure when being printed. This has been fixed. [GL #6004] Fix handling of RPZ CNAME expansion that returns too-long name. (CVE-2026-11331) Previously, if the expansion of a wildcard CNAME RPZ policy resulted in a name that exceeded the length limit, a self-referential CNAME and the original address record were returned, allowing the policy to be bypassed. In branches up to 9.20 this also left query processing in an inconsistent state, which could trigger an assertion failure. named now returns a YXDOMAIN response, without the address. ISC would like to thank Laith Mash'al (0xmshal) for bringing this vulnerability to our attention. [GL #5856] Prevent excessive validation work from crafted negative responses. (CVE-2026-11605) Previously, a validating resolver could be made to perform a large amount of DNSSEC validation work in response to a single answer, consuming excessive CPU. A malicious authoritative server could trigger this by returning a signed negative answer (NXDOMAIN or NODATA) padded with many denial-of-existence proof records, which the resolver continued to verify beyond its per-query validation limit. It now enforces that limit on negative answers and returns SERVFAIL once the limit is reached. [GL #4463] Prevent cache exhaustion under sustained attack. (CVE-2026-11622) Cache memory could become exhausted with expired entries whose memory was not released, due to a sustained attack on the same DNS name that prevented the cleanup. This has been fixed. [GL #4760] Stop accepting invalid signed wildcard records. (CVE-2026-11721) Signed wildcard responses in which the Labels field in the RRSIG record was less than the number of labels in the Signer Name field were being incorrectly accepted. This in turn broke synth-from-dnssec, which depends on such records being correctly validated. This has been fixed. ISC would like to thank Qifan Zhang of Palo Alto Networks for bringing this vulnerability to our attention. [GL #5871] Do not assert for some specific CNAME and DNAME queries. (CVE-2026-12617) A bug in the resolver's handling of certain cached DNAME and CNAME responses could cause named to trigger an assertion failure and exit. An attacker controlling a domain name and the authoritative DNS server it was hosted on could exploit this behavior to cause a denial-of-service. This has been fixed. ISC would like to thank Qifan Zhang of Palo Alto Networks for bringing this vulnerability to our attention. [GL #5946] Prevent crash from malformed NSEC/NSEC3 response. (CVE-2026-13204) An assertion could be triggered by an improperly signed NOQNAME proof. This has been fixed. ISC would like to thank Qifan Zhang of Palo Alto Networks for bringing this vulnerability to our attention. [GL #5985] Fix DNSSEC validation bypass via out-of-zone NSEC Next Field. (CVE-2026-13321) Previously, a malicious zone with out-of-zone NSEC next-owner names could cause a DNSSEC-validating resolver to cache such a record and, if synth-from-dnssec was enabled, to generate negative answers for any zone that was covered by the range. This has been fixed. ISC would like to thank Qifan Zhang of Palo Alto Networks for bringing this vulnerability to our attention. [GL #5873] Reclaim memory promptly when DNSSEC validations are canceled. When a resolver is flooded with queries that require DNSSEC validation - for example during a random-subdomain attack - many of those validations are canceled before they complete. Previously, a canceled validation still kept its place in the internal work queue and held the associated response in memory until that queued work eventually ran, so memory could climb sharply under sustained load. The internal work queue is now dropped as soon as the validation is canceled, releasing the memory it was holding. [GL #4760] Removed Features# Remove the secondary validator in query.c. Previously, when the additional section of a response was being populated, if cached data was found with pending trust, it would be opportunistically validated. The code implementing this validation was not quite formally correct. Rather than fixing it, the code has been removed: RRsets with pending trust are now omitted from responses. [GL #5966] [GL #5968] [GL #5972] Bug Fixes# Fix a bug in DNS UPDATE processing with inline-signing enabled. In rare cases the named process could terminate unexpectedly when processing authorized DNS UPDATE messages in quick succession that were updating a zone with inline-signing enabled. This has been fixed. [GL #5816] Properly detect private records before copying. Previously, an assertion was triggered when trying to copy a private record to a buffer for modification. named now extends the private type detection and copies the contents after rejecting invalid private records. [GL #5857] Tighten referral DS acceptance. Previously, named accepted DS records for sibling zones when it shouldn't have. This has been fixed. [GL #5870] Don't synthesize negative responses with pending NSEC. If an NSEC record has not yet been validated and is cached with trust pending, named no longer uses it to synthesize negative responses. [GL #5872] [GL #5887] [GL #5977] Check that an NSEC signer is at or above the name to be validated. A check has been added to ensure that an NSEC record being used as a proof of nonexistence for a given name is not signed by a name lower in the DNS hierarchy than the one in question. [GL #5876] Don't evict DNSSEC-validated cache data on a CD=1 NXDOMAIN. When a client sent a query with the checking-disabled (CD) bit set and the answer was NXDOMAIN, the resolver cached that unvalidated negative response and discarded any DNSSEC-validated records it already held for the same name, even though the validated data was more trustworthy. A single such response - including a forged one - could flush validated records from the cache and force the resolver to fetch them again. The resolver now checks the trust level of the existing data first and leaves the cache unchanged when it is already validated. [GL #5877] Fix a deny-answer-aliases configuration bypass issue. It was possible to use a maliciously crafted authoritative zone to make a named resolver synthesize a DNAME "alias" that should have been rejected by the configured deny-answer-aliases option. This has been fixed. [GL #5930] Reject external referrals from forwarders. Under a forward first; policy in a forwarding zone, named could accept NS records above the forward zone apex from negative responses. This has been fixed. [GL #5937] Fix a zone transfer over TLS (XoT) issue when using the opportunistic TLS mode. The named process, running as a secondary DNS server and configured to transfer a zone from a primary server using an encrypted XoT transport in opportunistic TLS mode (i.e. without peer certificate/hostname validation), could terminate unexpectedly when the TLS ALPN negotiation with the primary server was unsuccessful. This has been fixed. [GL #5957] Unvalidated opt-out NSEC3 could be accepted in insecurity proof. When determining whether an insecure delegation was legitimate, NSEC3 opt-out records which had not yet passed validation could be used. This has been fixed. [GL #5970] Check wildcard signer and NOQNAME signer match. A positive wildcard answer, and the NSEC3 proof that the requested name doesn't exist in the zone, must both be from the same zone. Otherwise, an NSEC3 from an ancestor zone could be used to interfere with validation. named now retrieves the signer name from a wildcard response's signature. An NSEC3 record cannot be used as a NOQNAME proof for the wildcard unless it exactly matches the name one level above the NSEC3. [GL #5971] Fix CNAME resolution failure caused by a cached SERVFAIL response. Under certain circumstances, a cached SERVFAIL response could incorrectly prevent successful resolution of a CNAME target. This could cause resolution failures to persist until the cached SERVFAIL entry expired, even when the CNAME target itself was otherwise resolvable. This has been fixed. [GL #5983] Reject unsupported RSA DNSKEY shapes during DNSSEC validation. An authoritative server publishing an RSA DNSKEY with an unusually large modulus or an exotic public exponent could make each DNSSEC signature check on a validating recursive resolver noticeably more expensive than for a normally sized key. Such DNSKEYs are now treated as invalid. [GL #6008] Fix a bug in GeoIP2 string matching. When using GeoIP2 ACLs (see acl), named could incorrectly match a name using a sub-string instead of the full name match. This has been fixed. [GL #6019] Fix DNS-over-HTTPS (DoH) quota configuration issue. The http-listener-clients and http-streams-per-connection configuration options could be truncated to smaller values (or to 0, which means unlimited) when very large configuration values in excess of 65535 were used. It is very unlikely that such large values were used in production, and the default values for the affected options are 300 and 100, respectively. This has been fixed. [GL #6021] Truncated reply to a TSIG query no longer stalls the resolver. When an upstream server returned a truncated reply to a query that named had signed with TSIG, the resolver could keep waiting for a follow-up UDP packet that never arrived, stalling the query until it hit the resolver-query-timeout and the client received no answer. named now treats any reply it cannot authenticate as an immediate failure and returns SERVFAIL right away as a defense in depth. [GL #6028] Ignore updates removing DNSKEY RRset with class ANY. When a dynamic update is received that removes the DNSKEY (or CDNSKEY, or CDS) RRset, named now removes all records except the ones that are in use for signing the zone. [GL #6045] Ignore 0-byte reads in the TCP read callback. Callbacks for libuv stream reads do not signal zero-length reads as a failure signal but rather as EAGAIN/EWOULDBLOCK. This could trigger an assertion when a zero-length read was pushed onto a PROXYv2 endpoint that had not yet processed the headers, as it expected a non-NULL region of positive length. [GL #6140] Only print per-zone glue stats when zone-statistics is set to full. The code printing query statistics was ignoring the zone-statistics option. This has been fixed. [GL #6164] CDS/CDNSKEY records were not removed when re-configuring the server. When on an rndc reconfig the DNSSEC policy changes such that it changes the expected CDNSKEY and/or CDS records in the zone, the RRset should be updated accordingly. This did not happen when removing digests from the configuration, or setting cdnskey no;. This has been fixed. [GL #6166] Fix a crash when querying an empty non-terminal in a wildcard zone in RBTDB. A query for an empty non-terminal in a wildcard zone served from the RBT zone database could abort named with an assertion failure. It now returns the correct NODATA answer. [GL #6170] Stop reusing outgoing TCP connections the peer has already closed. Previously, named could hand a new query to an idle forwarder/upstream TCP or TLS connection that the peer had already closed, causing the query to fail (and CLOSE-WAIT sockets to pile up). Idle reused connections are now watched, so a close is noticed and the connection is dropped instead of reused. A new tcp-reuse-timeout option controls how long an idle outgoing connection is kept open for reuse (default 5 seconds). [GL #6171] Fix DNSSEC validation failures for names under an apex DNAME. DNSSEC validation could fail with SERVFAIL for names covered by a DNAME at the apex of a signed zone, unless the zone's keys were already validated in the cache. This regression was introduced by the recent fix for resolver stalls on CNAME responses to DS queries, and has now been addressed. [GL #6176] Notes for BIND 9.20.25# Note The BIND 9.20.25 release was withdrawn after the discovery of a regression in a security fix in it during pre-release testing. /src/external/mpl/bind/dist/bin/tests/system/dnssec_nsec3/ans1/f025.py - 1.1.1.1 Sat Aug 29 14:32:03 UTC 2026 christos