1 .. Copyright (C) Internet Systems Consortium, Inc. ("ISC") 2 .. 3 .. SPDX-License-Identifier: MPL-2.0 4 .. 5 .. This Source Code Form is subject to the terms of the Mozilla Public 6 .. License, v. 2.0. If a copy of the MPL was not distributed with this 7 .. file, you can obtain one at https://mozilla.org/MPL/2.0/. 8 .. 9 .. See the COPYRIGHT file distributed with this work for additional 10 .. information regarding copyright ownership. 11 12 Notes for BIND 9.20.24 13 ---------------------- 14 15 Removed Features 16 ~~~~~~~~~~~~~~~~ 17 18 - Remove ineffective TCP fallback after repeated UDP timeouts. 19 20 When an authoritative server failed to respond to two consecutive UDP 21 queries, :iscman:`named` marked the next retry as TCP but still sent 22 it over UDP, producing misleading dnstap records. The ineffective 23 retry path has been removed; a corrected TCP fallback will be restored 24 in future BIND 9 versions. :gl:`#5529` 25 26 Feature Changes 27 ~~~~~~~~~~~~~~~ 28 29 - Fall back to TCP on receipt of a UDP response with a mismatched query ID. 30 31 BIND used to wait silently for the correct DNS message ID on a UDP 32 fetch, even after receiving a response from the expected server with 33 the wrong ID, leaving room for off-path spoofing attempts to keep 34 guessing within that window. The resolver now retries the fetch over 35 TCP on the first such response, and a new ``MismatchTCP`` statistics 36 counter tracks how often the fallback fires. :gl:`#5449` 37 38 - Limit the number of glue records cached from a referral. 39 40 When a delegation response contained many glue addresses per listed 41 nameserver, all of them were cached without a per-nameserver bound, 42 inflating resolver cache memory beyond what resolution could ever use. 43 The cache now keeps at most 20 IPv4 and 20 IPv6 glue addresses per 44 nameserver from a delegation. :gl:`#5701` 45 46 - Fix a resolver stall on a CNAME response to a DS query. 47 48 A validating resolver could stall for about twelve seconds and then 49 return SERVFAIL when an authoritative server answered a DS query with 50 a CNAME. Such responses are now rejected promptly, so the query fails 51 quickly instead of hanging. :gl:`#5878` 52 53 Bug Fixes 54 ~~~~~~~~~ 55 56 - The resolver now removes other RRsets at the same name when caching a 57 CNAME. 58 59 When an RRset is in stale cache and the authoritative server changes 60 the record type to CNAME, the resolver fails to refresh the stale 61 cache. This has been fixed. :gl:`#5302` 62 63 - Fix :any:`nxdomain-redirect` combined with :any:`dns64`. 64 65 When a resolver was configured with both :any:`nxdomain-redirect` and 66 :any:`dns64` in the same view, an AAAA query for a nonexistent name 67 could abort :iscman:`named`. The combination failed whenever the 68 redirect zone held A records but no AAAA records. The server now 69 serves the empty AAAA response from the redirect zone as-is, instead 70 of attempting DNS64 synthesis on top of it. :gl:`#5789` 71 72 - Fix DNS64 owner case after DNAME restart. 73 74 When BIND 9 was configured to use DNS64 and encountered a DNAME 75 redirect, it could end up using freed memory for the DNS response 76 owner name. This caused the response to contain corrupted data. This 77 fix ensures the correct owner name is used when constructing the 78 synthesized response after a DNAME redirect. :gl:`#5934` 79 80 - Clear REDIRECT flag when it isn't needed. 81 82 When :any:`nxdomain-redirect` is in use, and a recursive query is used 83 to get the redirected answer, a flag is set to distinguish it from a 84 normal recursive response. Previously, that flag was left set 85 afterward, which could trigger an assertion if a normal recursive 86 query was sent later on behalf of the same client: for example, 87 because the :any:`filter-aaaa` plugin was in use. This has been 88 fixed. :gl:`#5936` 89 90 - Disable output escaping in ``bind9.xsl``. 91 92 The statistics charts were not displaying on some browsers. This has 93 been fixed. :gl:`#5990` 94 95 - Fix crash on badly configured secondary signer. 96 97 A badly configured secondary signer that was missing the ``file`` 98 entry caused the server to crash, rather than to reject the 99 configuration. This has been fixed. :gl:`#5993` 100 101 - Fix a possible crash on concurrent TKEY DELETE for the same key. 102 103 On a server configured with :any:`tkey-gssapi-keytab`, an 104 authenticated peer could crash :iscman:`named` by sending two TKEY 105 DELETE requests for the same dynamic key in rapid succession. This 106 has been fixed. :gl:`#6001` 107 108 - Reject RRSIG records covering meta-types. 109 110 A recursive resolver could accept and cache an RRSIG record whose 111 Type-Covered field named a meta-type (ANY, AXFR, IXFR, MAILA, MAILB), 112 even though no real RRset of those types ever exists. Such records are 113 now rejected by the DNS message parser. :gl:`#6002` 114
Indexes created Mon Oct 26 00:26:21 UTC 2026