1 .. Copyright (C) Internet Systems Consortium, Inc. ("ISC") 2 .. 3 .. SPDX-License-Identifier: MPL-2.0 4 .. 5 .. This Source Code Form is subject to the terms of the Mozilla Public 6 .. License, v. 2.0. If a copy of the MPL was not distributed with this 7 .. file, you can obtain one at https://mozilla.org/MPL/2.0/. 8 .. 9 .. See the COPYRIGHT file distributed with this work for additional 10 .. information regarding copyright ownership. 11 12 BIND 9.20.27 13 ------------ 14 15 New Features 16 ~~~~~~~~~~~~ 17 18 - Disclose active Negative Trust Anchors with Extended DNS Error 33. 19 ``566e7018278`` 20 21 A Negative Trust Anchor (RFC 7646) turns off DNSSEC validation for a 22 domain, so a name that would normally fail validation resolves 23 instead. named now marks such answers with Extended DNS Error code 33, 24 "Negative Trust Anchor", so operators can see at a glance when a 25 response came back only because an NTA was in effect. :gl:`#6268` 26 :gl:`!12426` 27 28 - Add development guidance for AI coding agents under .agents/skills/ 29 ``ef651c93709`` 30 31 This adds a set of skill documents that give AI coding agents the 32 project's established practices up front instead of having them 33 rediscovered (or gotten wrong) in every session: the canonical build 34 and test invocations, the memory-allocator contract, the disciplines 35 for RCU mutation, per-loop sharded structures, struct-layout work, and 36 flight-recorder debugging of concurrency bugs, plus the commit and 37 merge-request conventions. :gl:`!12401` 38 39 - Add more unit tests for isc_time API. ``9d6855ef735`` 40 41 While working on internal 64-bit time for BIND 9, the unit test suite 42 for isc_time API has been extended. 43 44 Backport the unit tests from 64-bit time branch to the main branch. 45 This should make the unit tests for isc_time API (mostly) complete. 46 47 Related to #2959 :gl:`!12432` 48 49 Feature Changes 50 ~~~~~~~~~~~~~~~ 51 52 - Batch qp transaction for RPZ updates. ``cb40fb91fa2`` 53 54 RPZ was built around fine-grained locking, but that forces the use of 55 many small qp transactions. With this MR, we switch qp transaction to 56 handle the full update to the rpz summary structure. While this 57 serializes the RPZ updates, the reduced overhead from batching qp 58 transactions more than compensates for it and results in improvements 59 for big RPZ zones. :gl:`#5787`, #6270 :gl:`!12493` 60 61 - Pass the work callback result to the done callback. ``65cdb7c7613`` 62 63 The `isc_work` callback now returns `isc_result_t` and the value is 64 handed to the done callback, so the callers no longer need their own 65 result-passing state. :gl:`!12391` 66 67 Bug Fixes 68 ~~~~~~~~~ 69 70 - Dig +yaml producing invalid YAML when a lookup fails. ``65d1776959e`` 71 72 When "dig +yaml" was run and no server could be reached, dig printed 73 its plain-text startup banner (the "; \<\<\>\> DiG ..." and ";; global 74 options" lines) ahead of the machine-readable output, so the result 75 was not valid YAML and could not be parsed. dig no longer emits that 76 banner in YAML mode. As part of the same change, the banner is now 77 built only after the whole command line has been read, so options 78 given after the query name (such as +nocmd, +short and +yaml) are 79 correctly reflected in it. :gl:`#1230` :gl:`!12430` 80 81 - Ensure NSEC authority does not cross zonecut boundary. ``0baaddd096a`` 82 83 When using a cached NSEC record to prove that a delegation is 84 insecure, we now check that the signer name in the corresponding RRSIG 85 is not above a known secure delegation point. This prevents a signed 86 namespace from being downgraded to insecure using an NSEC record from 87 the grandparent zone. :gl:`#5967` :gl:`!12394` 88 89 - Treat non canonical RPZ prefixes as any other failure. ``17f0828b460`` 90 91 RPZ prefixes that were not encoded in canonical form do not work. 92 Treat them as any other encoding error. :gl:`#6043` :gl:`!12482` 93 94 - Properly prevent TSIG generation command line injection attacks. 95 ``f777451d261`` 96 97 When key names are generated with `rndc-confgen`, `tsig-keygen` and 98 `ddns-confgen`, special characters must be escaped to ensure the 99 configuration is parsed correctly. :gl:`#6071` :gl:`!12396` 100 101 - Dig with IDN output could leak memory on ISC_R_NOSPACE retry. 102 ``c4e53b59b2e`` 103 104 The IDN to text display call back could leak the memory holding the 105 converted name if it did not fit into the buffer. This has been 106 fixed. :gl:`#6073` :gl:`!12483` 107 108 - Dnssec-signzone had a potential heap bounds overflow write. 109 ``994c3bd4323`` 110 111 It was possible for `dnssec-signzone` to overflow array bounds while 112 signing. This has been fixed. :gl:`#6076` :gl:`!12503` 113 114 - Restore SMF support on Solaris and illumos. ``8bde9318f63`` 115 116 SMF support on Solaris and illumos was silently dropped by a build 117 system rewrite in 2018; it is now detected and enabled again. 118 :gl:`#6096` :gl:`!12456` 119 120 - Fix NULL pointer dereference in dnstap-read. ``9c459b1854d`` 121 122 It was possible to dereference a NULL pointer in dnstap-read causing 123 it to exit on a malformed DNSTAP file. This has been fixed. 124 :gl:`#6124` :gl:`!12494` 125 126 - Change catz coo locking. ``78265c8f6fc`` 127 128 Catalog zones might need to inspect the change-of-ownership records of 129 other catalog zones, which required to release the lock in the middle 130 of certain operations, leading to possible race conditions. 131 132 Since the operations on change-of-ownership records are limited, we 133 can instead use a design with a second lock protecting the 134 change-of-ownership records on read. We structure the API so that 135 holding two change-of-ownership locks at the same time is impossible. 136 :gl:`#6131` :gl:`!12410` 137 138 - Treat an unusable NSEC3 chain as a verification failure. 139 ``879a383ef16`` 140 141 When transferring in a mirror zone, DNSSEC verification could 142 incorrectly succeed when the zone had an invalid `NSEC3PARAM` record, 143 leading to subsequent validation failures. This has been fixed. 144 :gl:`#6136` :gl:`!12431` 145 146 - Unterminated OpenSSL private-key `Label:` field can be read past its 147 parser buffer. ``932581b74bd`` 148 149 Check that the string encoded in the Label: field of the .private file 150 of a key pair is NUL terminated and the correct length. Reject the 151 .private file if it is not. :gl:`#6193` :gl:`!12417` 152 153 - Negative caching stopped working with stale-answer-client-timeout 0. 154 ``2687d16ed2f`` 155 156 With "stale-answer-client-timeout 0" configured, every client query 157 for a name cached as NXDOMAIN or NODATA was sent on to the 158 authoritative servers, even while the cached negative answer was still 159 within its TTL, so the resolver effectively lost negative caching. 160 Negative answers are now refreshed only once they have actually gone 161 stale. :gl:`#6245` :gl:`!12384` 162 163 - MacOS byte swapping macros already defined. ``5c1d3df49c0`` 164 165 Don't redefine them if the development environment already defines 166 them. :gl:`#6250` :gl:`!12406` 167 168 - Use memmove in isc_sockaddr_fromin/isc_sockaddr_fromin6. 169 ``3f3c82292c9`` 170 171 Use memmove instead of direct assignment from the source pointer 172 because the source pointer is not guaranteed to be correctly aligned. 173 :gl:`#6260` :gl:`!12449` 174 175 - Fix compilation on GNU/Hurd. ``20f5580e017`` 176 177 Fix compilation issues on GNU/Hurd. :gl:`#6285` :gl:`!12496` 178 179 - Restore arc4random() detection dropped in the v9.21.14 merge. 180 ``86ad6866eeb`` 181 182 Commit 4db9e5d90e2 ("Use arc4random for CSPRNG when available", part 183 of the CVE-2025-40780 fix) guarded the arc4random() code paths in 184 lib/isc/random.h and lib/isc/random.c with HAVE_ARC4RANDOM and added 185 the corresponding function check to meson.build. The manual conflict 186 resolution in merge c2a672bbaef ("Merge tag 'v9.21.14'") kept the code 187 changes but dropped the meson.build hunk, so HAVE_ARC4RANDOM was never 188 defined and platforms with arc4random() (macOS and the BSDs) silently 189 fell back to the internal ChaCha-based CSPRNG. Restore the check. 190 191 Assisted-by: Claude:claude-fable-5 :gl:`!12452` 192 193 194
Indexes created Mon Oct 26 00:26:21 UTC 2026