1 .. Copyright (C) Internet Systems Consortium, Inc. ("ISC") 2 .. 3 .. SPDX-License-Identifier: MPL-2.0 4 .. 5 .. This Source Code Form is subject to the terms of the Mozilla Public 6 .. License, v. 2.0. If a copy of the MPL was not distributed with this 7 .. file, you can obtain one at https://mozilla.org/MPL/2.0/. 8 .. 9 .. See the COPYRIGHT file distributed with this work for additional 10 .. information regarding copyright ownership. 11 12 BIND 9.20.24 13 ------------ 14 15 Security Fixes 16 ~~~~~~~~~~~~~~ 17 18 - Fix DNS64 owner case after DNAME restart. ``4de2229364`` 19 20 When BIND 9 is configured to use DNS64 and encounters a DNAME 21 redirect, it could end up using freed memory for the DNS response 22 owner name. This caused the response to contain corrupted data. This 23 fix ensures the correct owner name is used when constructing the 24 synthesized response after a DNAME redirect. 25 26 ISC thanks Qifan Zhang of Palo Alto Networks for reporting the issue. 27 :gl:`#5934` 28 29 New Features 30 ~~~~~~~~~~~~ 31 32 - Enable PR-Agent reviews on merge requests. ``46e4c236a3`` 33 34 Adds a CI job that runs PR-Agent against each merge request opened 35 from the canonical repository, posting an automated review and 36 code-improvement suggestions as MR comments. The job is gated to 37 same-project source branches so the OpenAI key and personal access 38 token are not exposed to fork pipelines. :gl:`!12034` 39 40 Removed Features 41 ~~~~~~~~~~~~~~~~ 42 43 - Remove ineffective TCP fallback after repeated UDP timeouts. 44 ``eb13adcb47`` 45 46 When an authoritative server failed to respond to two consecutive UDP 47 queries, named marked the next retry as TCP but still sent it over 48 UDP, producing misleading dnstap records. The ineffective retry path 49 has been removed; a corrected TCP fallback will be restored in future 50 BIND 9 versions. :gl:`#5529` :gl:`!12049` 51 52 - Remove useless PR-Agent jobs. ``8851b279d0`` 53 54 The experiment was a failure, the PR-Agent doesn't send a full context 55 to the AI Agents and the results are abysmal because of that. 56 :gl:`!12120` 57 58 Feature Changes 59 ~~~~~~~~~~~~~~~ 60 61 - Fall back to TCP on a UDP response with a mismatched query id. 62 ``b2367aaea2`` 63 64 BIND used to wait silently for the correct DNS message id on a UDP 65 fetch even after receiving a response from the expected server with 66 the wrong id, leaving room for off-path spoofing attempts to keep 67 guessing within that window. The resolver now retries the fetch over 68 TCP on the first such response, and a new MismatchTCP statistics 69 counter tracks how often the fallback fires. :gl:`#5449` :gl:`!12025` 70 71 - Limit the number of glue records cached from a referral. 72 ``eb401f6b92`` 73 74 When a delegation response contained many glue addresses per listed 75 nameserver, all of them were cached without a per-nameserver bound, 76 inflating resolver cache memory beyond what resolution could ever use. 77 The cache now keeps at most 20 IPv4 and 20 IPv6 glue addresses per 78 nameserver from a delegation. :gl:`#5701` :gl:`!11972` 79 80 - Fix a resolver stall on a CNAME response to a DS query. ``1407f48670`` 81 82 A validating resolver could stall for about twelve seconds and then 83 return SERVFAIL when an authoritative server answered a DS query with 84 a CNAME. Such responses are now rejected promptly, so the query fails 85 fast instead of hanging. :gl:`#5878` :gl:`!12147` 86 87 - Named could crash on concurrent TKEY DELETE for the same key. 88 ``dd02abde67`` 89 90 On a server configured with tkey-gssapi-keytab (or 91 tkey-gssapi-credential), an authenticated peer could crash named by 92 sending two TKEY DELETE requests for the same dynamic key in rapid 93 succession. This has been fixed. :gl:`#6001` :gl:`!12042` 94 95 Bug Fixes 96 ~~~~~~~~~ 97 98 - The resolver now removes other RRsets at the same name when caching a 99 CNAME. ``1547447491`` 100 101 When an RRset is in stale cache, and the authoritative server changes 102 the record type to CNAME, the resolver fails to refresh the stale 103 cache. This has been fixed. :gl:`#5302` :gl:`!12040` 104 105 - Fix nxdomain-redirect combined with dns64. ``95274e9455`` 106 107 When a resolver was configured with both `nxdomain-redirect` and 108 `dns64` in the same view, an AAAA query for a nonexistent name could 109 abort `named`. The combination failed whenever the redirect zone held 110 A records but no AAAA records. The server now serves the empty AAAA 111 response from the redirect zone as-is, instead of attempting DNS64 112 synthesis on top of it. :gl:`#5789` :gl:`!12123` 113 114 - Clear REDIRECT flag when it isn't needed. ``86bb27060c`` 115 116 When `nxdomain-redirect` is in use, and a recursive query is used to 117 get the redirected answer, a flag is set to distinguish it from a 118 normal recursive response. Previously, that flag was left set 119 afterward, which could trigger an assertion if a normal recursive 120 query was sent later on behalf of the same client: for example, 121 because the `filter-aaaa` plugin was in use. This has been fixed. 122 :gl:`#5936` :gl:`!12076` 123 124 - Fix data race during rndc dumpdb or zone load. ``947e5c7983`` 125 126 'rndc dumpdb' against a server with zones, and async zone load, had a 127 timing window where the operation's completion could fire before the 128 server had finished registering the operation, occasionally leading to 129 a possible crash. The completion is now delivered after the 130 registration is in place. :gl:`#5952` :gl:`!12021` 131 132 - Bound memory use during incoming zone transfers. ``5d7f241fdf`` 133 134 During an incoming zone transfer, an optimization could let the batch 135 of pending records grow without bound for a large zone, raising memory 136 usage. It gave no measurable performance benefit, so it has been 137 removed. :gl:`#5958` :gl:`!12142` 138 139 - Disable output escaping in bind9.xsl. ``b514e663eb`` 140 141 The statistics charts where not displaying on some browsers. This has 142 been fixed. :gl:`#5990` :gl:`!12019` 143 144 - Fix crash on badly configured secondary signer. ``edc1ef084f`` 145 146 A badly configured secondary signer that was missing the 'file' entry 147 caused the server to crash, rather than to reject the configuration. 148 This has been fixed. :gl:`#5993` :gl:`!12112` 149 150 - Avoid named assertion failure during parent-NS lookups when none 151 exist. ``5c0c4786dd`` 152 153 Configuring the root zone as a signed primary with parental agents (or 154 with notify-on-cds-changes) caused named to exit on an internal 155 assertion as soon as the DS-publication machinery tried to look up the 156 parent NS RRset the root has no parent. The lookup is now 157 short-circuited cleanly. 158 159 Similar, a zone with no NS records in the parent caused named to exit 160 in the same way. :gl:`#5910` :gl:`#5996` :gl:`!12053` 161 162 - Reject RRSIG records covering meta-types. ``7517e39504`` 163 164 A recursive resolver could accept and cache an RRSIG record whose 165 Type-Covered field names a meta-type (ANY, AXFR, IXFR, MAILA, MAILB), 166 even though no real RRset of those types ever exists. Such records are 167 now rejected by the DNS message parser. :gl:`#6002` :gl:`!12051` 168 169 - Validate nsec3hash arguments instead of relying on atoi() 170 ``a59080c053`` 171 172 The nsec3hash tool parsed its algorithm, flags, and iterations 173 arguments with atoi(), then range-checked the result. For values that 174 overflow int during digit-by-digit accumulation, atoi() is undefined; 175 in practice on musl libc the modular wrap leaves n == 0, which 176 silently passes the "iterations > 0xffffU" check. On Alpine Linux this 177 made nsec3hash succeed with iterations treated as 0 for inputs like 178 4294967296 (2^32). 179 180 The latent bug only surfaced when the recent image rebuild pulled in 181 Hypothesis 6.152.9 (2026-05-19), which unified the distribution used 182 for bounded and unbounded integers() strategies. The new smoother 183 distribution explores the 2^32 boundary on unbounded ranges like 184 integers(min_value=65536); earlier versions did not reach there, so 185 test_nsec3hash_too_many_iterations only started failing on Alpine 186 after the image refresh. 187 188 Replace the three atoi() calls with isc_parse_uint8 / 189 isc_parse_uint16, which uniformly reject overflow, trailing garbage, 190 leading sign, and non-numeric input across libc implementations. As a 191 side effect, error messages now include the offending argument and a 192 specific reason ("out of range" vs "not a valid number"). 193 194 Assisted-by: Claude:claude-opus-4-7 :gl:`#6013` :gl:`!12074` 195 196 - Fix wrong variable in named_server_sync() log message. ``09f9889ef6`` 197 198 named_server_sync() logged isc_result_totext(result) but returns 199 tresult. The loop accumulates errors into tresult, so result only 200 holds the last iteration's value. If the last view succeeded but an 201 earlier one failed, the log would incorrectly say "success". 202 :gl:`!12156` 203 204 - Refine resolver fetch loop detection. ``787faa02a7`` 205 206 The resolver's fetch loop detection now triggers only when a new fetch 207 would join an already in-flight fetch that is also one of its own 208 ancestors, which is the actual loop condition. Previously the check 209 ran against the original request before the fetch was set up. 210 :gl:`!12146` 211 212 213
Indexes created Mon Oct 26 00:26:21 UTC 2026