| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
|
|
9.6.35 (2022-11-16)
Bug Fixes
* A crash was fixed that happened when a dnssec-policy zone that used NSEC3
was reconfigured to enable inline-signing. [GL #3591]
* In certain resolution scenarios, quotas could be erroneously reached for
servers, including any configured forwarders, resulting in SERVFAIL
answers being sent to clients. This has been fixed. [GL #3598]
* rpz-ip rules in response-policy zones could be ineffective in some cases
if a query had the CD (Checking Disabled) bit set to 1. This has been
fixed. [GL #3247]
* Previously, if Internet connectivity issues were experienced during the
initial startup of named, a BIND resolver with dnssec-validation set to
auto could enter into a state where it would not recover without stopping
named, manually deleting the managed-keys.bind and managed-keys.bind.jnl
files, and starting named again. This has been fixed. [GL #2895]
* The statistics counter representing the current number of clients awaiting
recursive resolution results (RecursClients) could overflow in certain
resolution scenarios. This has been fixed. [GL #3584]
* Previously, BIND failed to start on Solaris-based systems with hundreds of
CPUs. This has been fixed. [GL #3563]
* When a DNS resource record's TTL value was equal to the resolver's
configured prefetch "eligibility" value, the record was erroneously not
treated as eligible for prefetching. This has been fixed. [GL #3603]
|
|
9.16.34
Known Issues
* Upgrading from BIND 9.16.32 or any older version may require a manual
configuration change. The following configurations are affected:
- type primary zones configured with dnssec-policy but without
either allow-update or update-policy,
- type secondary zones configured with dnssec-policy.
* In these cases please add inline-signing yes; to the individual zone
configuration(s). Without applying this change, named will fail to start.
For more details, see
https://kb.isc.org/docs/dnssec-policy-requires-dynamic-dns-or-inline-signing
New Features
* Support for parsing and validating the dohpath service parameter in SVCB
records was added. [GL #3544]
* named now logs the supported cryptographic algorithms during startup and
in the output of named -V. [GL #3541]
Bug Fixes
* Changing just the TSIG key names for primaries in catalog zones' member
zones was not effective. This has been fixed. [GL #3557]
|
|
OKed by wiz@
Pkgsrc changes:
* Just checksum updates.
Upstream changes:
--- 9.16.33 released ---
5962. [security] Fix memory leak in EdDSA verify processing.
(CVE-2022-38178) [GL #3487]
5961. [security] Fix memory leak in ECDSA verify processing.
(CVE-2022-38177) [GL #3487]
5960. [security] Fix serve-stale crash that could happen when
stale-answer-client-timeout was set to 0 and there was
a stale CNAME in the cache for an incoming query.
(CVE-2022-3080) [GL #3517]
5957. [security] Prevent excessive resource use while processing large
delegations. (CVE-2022-2795) [GL #3394]
5956. [func] Make RRL code treat all QNAMEs that are subject to
wildcard processing within a given zone as the same
name. [GL #3459]
5955. [port] The libxml2 library has deprecated the usage of
xmlInitThreads() and xmlCleanupThreads() functions. Use
xmlInitParser() and xmlCleanupParser() instead.
[GL #3518]
5954. [func] Fallback to IDNA2003 processing in dig when IDNA2008
conversion fails. [GL #3485]
5953. [bug] Fix a crash on shutdown in delete_trace_entry(). Add
mctx attach/detach pair to make sure that the memory
context used by a memory pool is not destroyed before
the memory pool itself. [GL #3515]
5952. [bug] Use quotes around address strings in YAML output.
[GL #3511]
5951. [bug] In some cases, the dnstap query_message field was
erroneously set when logging response messages.
[GL #3501]
5948. [bug] Fix nsec3.c:dns_nsec3_activex() function, add a missing
dns_db_detachnode() call. [GL #3500]
5945. [bug] If parsing /etc/bind.key failed, delv could assert
when trying to parse the built in trust anchors as
the parser hadn't been reset. [GL !6468]
5942. [bug] Fix tkey.c:buildquery() function's error handling by
adding the missing cleanup code. [GL #3492]
5941. [func] Zones with dnssec-policy now require dynamic DNS or
inline-siging to be configured explicitly. [GL #3381]
5936. [bug] Don't enable serve-stale for lookups that error because
it is a duplicate query or a query that would be
dropped. [GL #2982]
|
|
9.16.32 (2022-08-17)
Notes for BIND 9.16.32
Feature Changes
* The DNSSEC algorithms RSASHA1 and NSEC3RSASHA1 are now automatically
disabled on systems where they are disallowed by the security policy
(e.g. Red Hat Enterprise Linux 9). Primary zones using those algorithms
need to be migrated to new algorithms prior to running on these systems,
as graceful migration to different DNSSEC algorithms is not possible when
RSASHA1 is disallowed by the operating system. [GL #3469]
* Log messages related to fetch limiting have been improved to provide more
complete information. Specifically, the final counts of allowed and
spilled fetches are now logged before the counter object is destroyed.
[GL #3461]
Bug Fixes
* Non-dynamic zones that inherit dnssec-policy from the view or options
blocks were not marked as inline-signed and therefore never scheduled to
be re-signed. This has been fixed. [GL #3438]
* The old max-zone-ttl zone option was meant to be superseded by the
max-zone-ttl option in dnssec-policy; however, the latter option was not
fully effective. This has been corrected: zones no longer load if they
contain TTLs greater than the limit configured in dnssec-policy. For
zones with both the old max-zone-ttl option and dnssec-policy configured,
the old option is ignored, and a warning is generated. [GL #2918]
* rndc dumpdb -expired was fixed to include expired RRsets, even if
stale-cache-enable is set to no and the cache-cleaning time window has
passed. [GL #3462]
|
|
9.6.31 (2022-07-20)
5917. [bug] Update ifconfig.sh script as is miscomputed interface
identifiers when destroying interfaces. [GL #3061]
5915. [bug] Detect missing closing brace (}) and computational
overflows in $GENERATE directives. [GL #3429]
5913. [bug] Fix a race between resolver query timeout and
validation in resolver.c:validated(). Remove
resolver.c:maybe_destroy() as it is no loger needed.
[GL #3398]
5909. [bug] The server-side destination port was missing from dnstap
captures of client traffic. [GL #3309]
5905. [bug] When the TCP connection would be closed/reset between
the connect/accept and the read, the uv_read_start()
return value would be unexpected and cause an assertion
failure. [GL #3400]
5903. [bug] When named checks that the OPCODE in a response matches
that of the request, if there is a mismatch named logs
an error. Some of those error messages incorrectly
used RCODE instead of OPCODE to lookup the nemonic.
This has been corrected. [GL !6420]
|
|
|
|
|
|
--- 9.16.30 released ---
5899. [func] Don't try to process DNSSEC-related and ZONEMD records
in catz. [GL #3380]
5890. [bug] When the fetches-per-server quota was adjusted
because of an authoritative server timing out more
or less frequently, it was incorrectly set to 1
rather than the intended value. This has been
fixed. [GL #3327]
5888. [bug] Only write key files if the dnssec-policy keymgr has
changed the metadata. [GL #3302]
5823. [func] Replace hazard pointers based lock-free list with
locked-list based queue that's simpler and has no or
little performance impact. [GL #3180]
|
|
This release contains a fix for CVE-2022-1183.
--- 9.16.29 released ---
5885. [bug] RPZ NSIP and NSDNAME rule processing didn't handle stub
and static-stub zones at or above the query name. This
has now been addressed. [GL #3232]
5881. [bug] dig +nssearch could hang in rare cases when recv_done()
callback was being called earlier than send_done().
[GL #3278]
5880. [func] Add new named command-line option -C to print built-in
defaults. [GL #1326]
5879. [contrib] dlz: Add FALLTHROUGH and UNREACHABLE macros. [GL #3306]
5874. [bug] keymgr didn't work with python 3.11. [GL !6157]
5866. [bug] Work around a jemalloc quirk which could trigger an
out-of-memory condition in named over time. [GL #3287]
5863. [bug] If there was a pending negative cache DS entry,
validations depending upon it could fail. [GL #3279]
5858. [bug] Don't remove CDS/CDNSKEY DELETE records on zone sign
when using 'auto-dnssec maintain;'. [GL #2931]
|
|
--- 9.16.28 released ---
5856. [bug] The "starting maxtime timer" message related to outgoing
zone transfers was incorrectly logged at the ERROR level
instead of DEBUG(1). [GL #3208]
5852. [func] Add new "reuseport" option to enable/disable load
balancing of sockets. [GL #3249]
5843. [bug] When an UPDATE targets a zone that is not configured,
the requested zone name is now logged in the "not
authoritative" error message, so that it is easier to
track down problematic update clients. [GL #3209]
5836. [bug] Quote the dns64 prefix in error messages that complain
about problems with it, to avoid confusion with the
following dns64 ACLs. [GL #3210]
5834. [cleanup] C99 variable-length arrays are difficult to use safely,
so avoid them except in test code. [GL #3201]
5828. [bug] Replace single TCP write timer with per-TCP write
timers. [GL #3200]
5824. [bug] Invalid dnssec-policy definitions were being accepted
where the defined keys did not cover both KSK and ZSK
roles for a given algorithm. This is now checked for
and the dnssec-policy is rejected if both roles are
not present for all algorithms in use. [GL #3142]
|
|
|
|
|
|
|
|
--- 9.16.27 released ---
5818. [security] A synchronous call to closehandle_cb() caused
isc__nm_process_sock_buffer() to be called recursively,
which in turn left TCP connections hanging in the
CLOSE_WAIT state blocking indefinitely when
out-of-order processing was disabled. (CVE-2022-0396)
[GL #3112]
|
|
--- 9.16.26 released ---
5801. [bug] Log "quota reached" message when hard quota
is reached when accepting a connection. [GL #3125]
5800. [func] Add ECS support to the DLZ interface. [GL #3082]
5797. [bug] A failed view configuration during a named
reconfiguration procedure could cause inconsistencies
in BIND internal structures, causing a crash or other
unexpected errors. [GL #3060]
5795. [bug] rndc could crash when interrupted by a signal
before receiving a response. [GL #3080]
5793. [bug] Correctly detect and enable UDP recvmmsg support
in all versions of libuv that support it. [GL #3095]
|
|
A patch fixing SunOS builds was lost during a recent update, restore
it. (And s/SmartOS/SunOS/ in comment, this doesn't just affect SmartOS,
reproduced and fixed on OmniOS. This package also fails to build on
Linux, but that's another issue entirely.) Addresses PR pkg/56716 from
Russell Hansen.
|
|
Notes for BIND 9.16.25
Feature Changes
* Overall memory use by named has been optimized and reduced, especially on
systems with many CPU cores. The default memory allocator has been
switched from internal to external. A new command-line option -M internal
allows named to be started with the old internal memory allocator. [GL
#2398]
Bug Fixes
* On FreeBSD, TCP connections leaked a small amount of heap memory, leading
to an eventual out-of-memory problem. This has been fixed. [GL #3051]
* If signatures created by the ZSK were expired and the ZSK private key was
offline, the signatures were not replaced. This behavior has been amended
to replace the expired signatures with new signatures created using the
KSK. [GL #3049]
* Under certain circumstances, the signed version of an inline-signed zone
could be dumped to disk without the serial number of the unsigned version
of the zone. This prevented resynchronization of the zone contents after
named restarted, if the unsigned zone file was modified while named was
not running. This has been fixed. [GL #3071]
|
|
|
|
Upstream changes:
--- 9.16.24 released ---
5773. [func] Change the message when accepting TCP connection has
failed to say "Accepting TCP connection failed" and
change the log level for ISC_R_NOTCONNECTED, ISC_R_QUOTA
and ISC_R_SOFTQUOTA results codes from ERROR to INFO.
[GL #2700]
5768. [bug] dnssec-dsfromkey failed to omit revoked keys. [GL #853]
5764. [bug] dns_sdlz_putrr failed to process some valid resource
records. [GL #3021]
5762. [bug] Fix a "named" crash related to removing and restoring a
`catalog-zone` entry in the configuration file and
running `rndc reconfig`. [GL #1608]
5758. [bug] mdig now honors the operating system's preferred
ephemeral port range. [GL #2374]
5757. [test] Replace sed in nsupdate system test with awk to
construct the nsupdate command. The sed expression
was not reliably changing the ttl. [GL #3003]
|
|
|
|
--- 9.16.23 released ---
5752. [bug] Fix an assertion failure caused by missing member zones
during a reload of a catalog zone. [GL #2308]
5750. [bug] Fix a bug when comparing two RSA keys. There was a typo
which caused the "p" prime factors to not being
compared. [GL #2972]
5737. [bug] Address Coverity warning in lib/dns/dnssec.c.
[GL #2935]
|
|
Fix for: Shared object "libprotobuf.so.29" not found
|
|
Update distinfo with latest digest(1).
|
|
This release contains security fix.
--- 9.16.22 released ---
5736. [security] The "lame-ttl" option is now forcibly set to 0. This
effectively disables the lame server cache, as it could
previously be abused by an attacker to significantly
degrade resolver performance. (CVE-2021-25219)
[GL #2899]
5724. [bug] Address a potential deadlock when checking zone content
consistency. [GL #2908]
5723. [bug] Change 5709 broke backward compatibility for the
"check-names master ..." and "check-names slave ..."
options. This has been fixed. [GL #2911]
5720. [contrib] Old-style DLZ drivers that had to be enabled at
build-time have been marked as deprecated. [GL #2814]
5719. [func] The "map" zone file format has been marked as
deprecated. [GL #2882]
5717. [func] The "cache-file" option, which was documented as "for
testing purposes only" and not to be used, has been
removed. [GL #2903]
5716. [bug] Multiple library names were mistakenly passed to the
krb5-config utility when ./configure was invoked with
the --with-gssapi=[/path/to/]krb5-config option. This
has been fixed by invoking krb5-config separately for
each required library. [GL #2866]
5715. [func] Add a check for ports specified in "*-source(-v6)"
options clashing with a global listening port. Such a
configuration was already unsupported, but it failed
silently; it is now treated as an error. [GL #2888]
5714. [bug] Remove the "adjust interface" mechanism which was
responsible for setting up listeners on interfaces when
the "*-source(-v6)" address and port were the same as
the "listen-on(-v6)" address and port. Such a
configuration is no longer supported; under certain
timing conditions, that mechanism could prevent named
from listening on some TCP ports. This has been fixed.
[GL #2852]
5712. [doc] Add deprecation notice about removing native PKCS#11
support in the next major BIND 9 release. [GL #2691]
|
|
All checksums have been double-checked against existing RMD160 and
SHA512 hashes
Not committed (merge conflicts...):
net/radsecproxy/distinfo
The following distfiles could not be fetched (fetched conditionally?):
./net/citrix_ica/distinfo citrix_ica-10.6.115659/en.linuxx86.tar.gz
./net/djbdns/distinfo dnscache-1.05-multiple-ip.patch
./net/djbdns/distinfo djbdns-1.05-test28.diff.xz
./net/djbdns/distinfo djbdns-1.05-ignoreip2.patch
./net/djbdns/distinfo djbdns-1.05-multiip.diff
./net/djbdns/distinfo djbdns-cachestats.patch
|
|
Catch up changes from NetBSD; update them for BIND 9.16.
Bump PKGREVISION.
|
|
Fix for: Shared object "libprotobuf.so.28" not found
|
|
|
|
--- 9.16.21 released ---
5711. [bug] "map" files exceeding 2GB in size failed to load due to
a size comparison that incorrectly treated the file size
as a signed integer. [GL #2878]
5710. [port] win32: incorrect parentheses resulted in the wrong
sizeof() tests being used to pick the appropriate
Windows atomic operations for the object's size.
[GL #2891]
5709. [cleanup] Enum values throughout the code have been updated
to use the terms "primary" and "secondary" instead of
"master" and "slave", respectively. [GL #1944]
5708. [bug] The thread-local isc_tid_v variable was not properly
initialized when running BIND 9 as a Windows Service,
leading to a crash on startup. [GL #2837]
5705. [bug] Change #5686 altered the internal memory structure of
zone databases, but neglected to update the MAPAPI value
for zone files in "map" format. This caused named to
attempt to load incompatible map files, triggering an
assertion failure on startup. The MAPAPI value has now
been updated, so named rejects outdated files when
encountering them. [GL #2872]
5704. [bug] Change #5317 caused the EDNS TCP Keepalive option to be
ignored inadvertently in client requests. It has now
been fixed and this option is handled properly again.
[GL #1927]
5701. [bug] named-checkconf failed to detect syntactically invalid
values of the "key" and "tls" parameters used to define
members of remote server lists. [GL #2461]
5700. [bug] When a member zone was removed from a catalog zone,
journal files for the former were not deleted.
[GL #2842]
5699. [func] Data structures holding DNSSEC signing statistics are
now grown and shrunk as necessary upon key rollover
events. [GL #1721]
5698. [bug] When a DNSSEC-signed zone which only has a single
signing key available is migrated to use KASP, that key
is now treated as a Combined Signing Key (CSK).
[GL #2857]
5696. [protocol] Support for HTTPS and SVCB record types has been added.
(This does not include ADDITIONAL section processing for
these record types, only basic support for RR type
parsing and printing.) [GL #1132]
5694. [bug] Stale data in the cache could cause named to send
non-minimized queries despite QNAME minimization being
enabled. [GL #2665]
5691. [bug] When a dynamic zone was made available in another view
using the "in-view" statement, running "rndc freeze"
always reported an "already frozen" error even though
the zone was successfully frozen. [GL #2844]
5690. [func] dnssec-signzone now honors Predecessor and Successor
metadata found in private key files: if a signature for
an RRset generated by the inactive predecessor exists
and does not need to be replaced, no additional
signature is now created for that RRset using the
successor key. This enables dnssec-signzone to gradually
replace RRSIGs during a ZSK rollover. [GL #1551]
|
|
Add patch: <https://kb.isc.org/docs/map-zone-format-incompatibility-in-bind-9-16-20-and-9-17-17>.
Bump PKGREVISION.
|
|
This update contains security fix: CVE-2021-25218.
--- 9.16.20 released ---
5689. [security] An assertion failure occurred when named attempted to
send a UDP packet that exceeded the MTU size, if
Response Rate Limiting (RRL) was enabled.
(CVE-2021-25218) [GL #2856]
5688. [bug] Zones using KASP and inline-signed zones failed to apply
changes from the unsigned zone to the signed zone under
certain circumstances. This has been fixed. [GL #2735]
5687. [bug] "rndc reload <zonename>" could trigger a redundant
reload for an inline-signed zone whose zone file was not
modified since the last "rndc reload". This has been
fixed. [GL #2855]
5686. [func] The number of internal data structures allocated for
each zone was reduced. [GL #2829]
5685. [bug] named failed to check the opcode of responses when
performing zone refreshes, stub zone updates, and UPDATE
forwarding. This has been fixed. [GL #2762]
5682. [bug] Some changes to "zone-statistics" settings were not
properly processed by "rndc reconfig". This has been
fixed. [GL #2820]
5681. [func] Relax the checks in the dns_zone_cdscheck() function to
allow CDS and CDNSKEY records in the zone that do not
match an existing DNSKEY record, as long as the
algorithm matches. This allows a clean rollover from one
provider to another in a multi-signer DNSSEC
configuration. [GL #2710]
5679. [func] Thread affinity is no longer set. [GL #2822]
5678. [bug] The "check DS" code failed to release all resources upon
named shutdown when a refresh was in progress. This has
been fixed. [GL #2811]
5672. [bug] Authentication of rndc messages could fail if a
"controls" statement was configured with multiple key
algorithms for the same listener. This has been fixed.
[GL #2756]
|
|
|
|
Upstream changes:
--- 9.16.19 released ---
5671. [bug] A race condition could occur where two threads were
competing for the same set of key file locks, leading to
a deadlock. This has been fixed. [GL #2786]
5670. [bug] create_keydata() created an invalid placeholder keydata
record upon a refresh failure, which prevented the
database of managed keys from subsequently being read
back. This has been fixed. [GL #2686]
5669. [func] KASP support was extended with the "check DS" feature.
Zones with "dnssec-policy" and "parental-agents"
configured now check for DS presence and can perform
automatic KSK rollovers. [GL #1126]
5668. [bug] Rescheduling a setnsec3param() task when a zone failed
to load on startup caused a hang on shutdown. This has
been fixed. [GL #2791]
5667. [bug] The configuration-checking code failed to account for
the inheritance rules of the "dnssec-policy" option.
This has been fixed. [GL #2780]
5666. [doc] The safe "edns-udp-size" value was tweaked to match the
probing value from BIND 9.16 for better compatibility.
[GL #2183]
5665. [bug] If nsupdate sends an SOA request and receives a REFUSED
response, it now fails over to the next available
server. [GL #2758]
5664. [func] For UDP messages larger than the path MTU, named now
sends an empty response with the TC (TrunCated) bit set.
In addition, setting the DF (Don't Fragment) flag on
outgoing UDP sockets was re-enabled. [GL #2790]
5662. [bug] Views with recursion disabled are now configured with a
default cache size of 2 MB unless "max-cache-size" is
explicitly set. This prevents cache RBT hash tables from
being needlessly preallocated for such views. [GL #2777]
5661. [bug] Change 5644 inadvertently introduced a deadlock: when
locking the key file mutex for each zone structure in a
different view, the "in-view" logic was not considered.
This has been fixed. [GL #2783]
5658. [bug] Increasing "max-cache-size" for a running named instance
(using "rndc reconfig") did not cause the hash tables
used by cache databases to be grown accordingly. This
has been fixed. [GL #2770]
5655. [bug] Signed, insecure delegation responses prepared by named
either lacked the necessary NSEC records or contained
duplicate NSEC records when both wildcard expansion and
CNAME chaining were required to prepare the response.
This has been fixed. [GL #2759]
5653. [bug] A bug that caused the NSEC3 salt to be changed on every
restart for zones using KASP has been fixed. [GL #2725]
|
|
|
|
|
|
Mostly taken from NetBSD base:
- For counters, make sure to use 32-bit integers for !_LP64 platforms.
In the previous revisions, this is partially done, i.e., incomplete.
- For flags fit within 32-bit width, use 32-bit integers for everyone.
In the previous, this is incomplete, and restricted for __NetBSD__.
Fix and generalize to everyone.
- Make comments in patches more helpful.
Fix build for ILP32 platforms as reported in PR pkg/56315.
Thanks jklos@ for testing.
|
|
|
|
This is a bugfix release.
- Fixed a bug that caused the NSEC salt to be changed for KASP zones on every
startup.
- Signed, insecure delegation responses prepared by named either lacked the
necessary NSEC records or contained duplicate NSEC records when both wildcard
expansion and CNAME chaining were required to prepare the response. This has
been fixed.
- Queries where the wildcard match contained the letter W failed to return the
correct response as the W was mapped to \000.
- Checking of key-directory and dnssec-policy was broken. The checks failed to
account for key-directory inheritance.
Full release notes:
https://bind9.readthedocs.io/en/v9_16/notes.html#notes-for-bind-9-16-18
|
|
Feature Changes:
- After the network manager was introduced to named to handle incoming traffic,
it was discovered that recursive performance had degraded compared to
previous BIND 9 versions. This has now been fixed by processing internal
tasks inside network manager worker threads, preventing resource contention
among two sets of threads.
- Zone dumping tasks are now run on separate asynchronous thread pools. This
change prevents zone dumping from blocking network I/O.
- inline-signing was incorrectly described as being inherited from the
options/view levels and was incorrectly accepted at those levels without
effect. This has been fixed; named.conf files with inline-signing at those
levels no longer load.
Full changelog:
https://bind9.readthedocs.io/en/v9_16/notes.html#notes-for-bind-9-16-17
|
|
Do not use priorities attribute as they are not supported
at least on SmartOS with gcc 7.5
|
|
|
|
Notes for BIND 9.16.16
Feature Changes
* DNSSEC responses containing NSEC3 records with iteration counts greater
than 150 are now treated as insecure. [GL #2445]
* The maximum supported number of NSEC3 iterations that can be configured
for a zone has been reduced to 150. [GL #2642]
* The default value of the max-ixfr-ratio option was changed to unlimited,
for better backwards compatibility in the stable release series. [GL
#2671]
* Zones that want to transition from secure to insecure mode without
becoming bogus in the process must now have their dnssec-policy changed
first to insecure, rather than none. After the DNSSEC records have been
removed from the zone, the dnssec-policy can be set to none or removed
from the configuration. Setting the dnssec-policy to insecure causes CDS
and CDNSKEY DELETE records to be published. [GL #2645]
* The implementation of the ZONEMD RR type has been updated to match RFC
8976. [GL #2658]
* The draft-vandijk-dnsop-nsec-ttl IETF draft was implemented: NSEC(3) TTL
values are now set to the minimum of the SOA MINIMUM value or the SOA TTL.
[GL #2347]
Bug Fixes
* It was possible for corrupt journal files generated by an earlier version
of named to cause problems after an upgrade. This has been fixed. [GL
#2670]
* TTL values in cache dumps were reported incorrectly when
stale-cache-enable was set to yes. This has been fixed. [GL #389] [GL
#2289]
* A deadlock could occur when multiple rndc addzone, rndc delzone, and/or
rndc modzone commands were invoked simultaneously for different zones.
This has been fixed. [GL #2626]
* named and named-checkconf did not report an error when multiple zones with
the dnssec-policy option set were using the same zone file. This has been
fixed. [GL #2603]
* If dnssec-policy was active and a private key file was temporarily offline
during a rekey event, named could incorrectly introduce replacement keys
and break a signed zone. This has been fixed. [GL #2596]
* When generating zone signing keys, KASP now also checks for key ID
conflicts among newly created keys, rather than just between new and
existing ones. [GL #2628]
|
|
|
|
Security release.
--- 9.16.15 released ---
5621. [bug] Due to a backporting mistake in change 5609, named
binaries built against a Kerberos/GSSAPI library whose
header files did not define the GSS_SPNEGO_MECHANISM
preprocessor macro were not able to start if their
configuration included the "tkey-gssapi-credential"
option. This has been fixed. [GL #2634]
5620. [bug] If zone journal files written by BIND 9.16.11 or earlier
were present when BIND was upgraded, the zone file for
that zone could have been inadvertently rewritten with
the current zone contents. This caused the original zone
file structure (e.g. comments, $INCLUDE directives) to
be lost, although the zone data itself was preserved.
This has been fixed. [GL #2623]
--- 9.16.14 released ---
5617. [security] A specially crafted GSS-TSIG query could cause a buffer
overflow in the ISC implementation of SPNEGO.
(CVE-2021-25216) [GL #2604]
5616. [security] named crashed when a DNAME record placed in the ANSWER
section during DNAME chasing turned out to be the final
answer to a client query. (CVE-2021-25215) [GL #2540]
5615. [security] Insufficient IXFR checks could result in named serving a
zone without an SOA record at the apex, leading to a
RUNTIME_CHECK assertion failure when the zone was
subsequently refreshed. This has been fixed by adding an
owner name check for all SOA records which are included
in a zone transfer. (CVE-2021-25214) [GL #2467]
5614. [bug] Ensure all resources are properly cleaned up when a call
to gss_accept_sec_context() fails. [GL #2620]
5613. [bug] It was possible to write an invalid transaction header
in the journal file for a managed-keys database after
upgrading. This has been fixed. Invalid headers in
existing journal files are detected and named is able
to recover from them. [GL #2600]
5611. [func] Set "stale-answer-client-timeout" to "off" by default.
[GL #2608]
5610. [bug] Prevent a crash which could happen when a lookup
triggered by "stale-answer-client-timeout" was attempted
right after recursion for a client query finished.
[GL #2594]
5609. [func] The ISC implementation of SPNEGO was removed from BIND 9
source code. It was no longer necessary as all major
contemporary Kerberos/GSSAPI libraries include support
for SPNEGO. [GL #2607]
5608. [bug] When sending queries over TCP, dig now properly handles
"+tries=1 +retry=0" by not retrying the connection when
the remote server closes the connection prematurely.
[GL #2490]
5607. [bug] As "rndc dnssec -checkds" and "rndc dnssec -rollover"
commands may affect the next scheduled key event,
reconfiguration of zone keys is now triggered after
receiving either of these commands to prevent
unnecessary key rollover delays. [GL #2488]
5606. [bug] CDS/CDNSKEY DELETE records are now removed when a zone
transitions from a secure to an insecure state.
named-checkzone also no longer reports an error when
such records are found in an unsigned zone. [GL #2517]
5605. [bug] "dig -u" now uses the CLOCK_REALTIME clock source for
more accurate time reporting. [GL #2592]
5603. [bug] Fix a memory leak that occurred when named failed to
bind a UDP socket to a network interface. [GL #2575]
5602. [bug] Fix TCPDNS and TLSDNS timers in Network Manager. This
makes the "tcp-initial-timeout" and "tcp-idle-timeout"
options work correctly again. [GL #2583]
5601. [bug] Zones using KASP could not be thawed after they were
frozen using "rndc freeze". This has been fixed.
[GL #2523]
|
|
|
|
9.16.13 (2022-03-17)
New Features
* A new purge-keys option has been added to dnssec-policy. It sets the
period of time that key files are retained after becoming obsolete
due to a key rollover; the default is 90 days. This feature can be
disabled by setting purge-keys to 0. [GL #2408]
Feature Changes
* When serve-stale is enabled and stale data is available, named now
returns stale answers upon encountering any unexpected error in the
query resolution process. This may happen, for example, if the
fetches-per-server or fetches-per-zone limits are reached. In this
case, named attempts to answer DNS requests with stale data, but
does not start the stale-refresh-time window. [GL #2434]
Bug Fixes
* Zone journal (.jnl) files created by versions of named prior to
9.16.12 were no longer compatible; this could cause problems when
upgrading if journal files were not synchronized first. This has
been corrected: older journal files can now be read when starting
up. When an old-style journal file is detected, it is updated to the
new format immediately after loading.
Note that journals created by the current version of named are not
usable by versions prior to 9.16.12. Before downgrading to a prior
release, users are advised to ensure that all dynamic zones have
been synchronized using rndc sync -clean.
A journal file's format can be changed manually by running
named-journalprint -d (downgrade) or named-journalprint -u
(upgrade). Note that this must not be done while named is
running. [GL #2505]
* named crashed when it was allowed to serve stale answers and
stale-answer-client-timeout was triggered without any (stale) data
available in the cache to answer the query. [GL #2503]
* If an outgoing packet exceeded max-udp-size, named dropped it
instead of sending back a proper response. To prevent this problem,
the IP_DONTFRAG option is no longer set on UDP sockets, which has
been happening since BIND 9.16.11. [GL #2466]
* NSEC3 records were not immediately created when signing a dynamic
zone using dnssec-policy with nsec3param. This has been fixed. [GL
#2498]
* A memory leak occurred when named was reconfigured after adding an
inline-signed zone with auto-dnssec maintain enabled. This has been
fixed. [GL #2041]
* An invalid direction field (not one of N, S, E, W) in a LOC record
resulted in an INSIST failure when a zone file containing such a
record was loaded. [GL #2499]
|
|
XXX: why does this have so many patches?
--- 9.16.12 released ---
5578. [protocol] Make "check-names" accept A records below "_spf",
"_spf_rate", and "_spf_verify" labels in order to cater
for the "exists" SPF mechanism specified in RFC 7208
section 5.7 and appendix D.1. [GL #2377]
5577. [bug] Fix the "three is a crowd" key rollover bug in KASP by
correctly implementing Equation (2) of the "Flexible and
Robust Key Rollover" paper. [GL #2375]
5575. [bug] When migrating to KASP, BIND 9 considered keys with the
"Inactive" and/or "Delete" timing metadata to be
possible active keys. This has been fixed. [GL #2406]
5572. [bug] Address potential double free in generatexml().
[GL #2420]
5571. [bug] named failed to start when its configuration included a
zone with a non-builtin "allow-update" ACL attached.
[GL #2413]
5570. [bug] Improve performance of the DNSSEC verification code by
reducing the number of repeated calls to
dns_dnssec_keyfromrdata(). [GL #2073]
5569. [bug] Emit useful error message when "rndc retransfer" is
applied to a zone of inappropriate type. [GL #2342]
5568. [bug] Fixed a crash in "dnssec-keyfromlabel" when using ECDSA
keys. [GL #2178]
5567. [bug] Dig now reports unknown dash options while pre-parsing
the options. This prevents "-multi" instead of "+multi"
from reporting memory usage before ending option parsing
with "Invalid option: -lti". [GL #2403]
5566. [func] Add "stale-answer-client-timeout" option, which is the
amount of time a recursive resolver waits before
attempting to answer the query using stale data from
cache. [GL #2247]
5565. [func] The SONAMEs for BIND 9 libraries now include the current
BIND 9 version number, in an effort to tightly couple
internal libraries with a specific release. [GL #2387]
5562. [security] Fix off-by-one bug in ISC SPNEGO implementation.
(CVE-2020-8625) [GL #2354]
5561. [bug] KASP incorrectly set signature validity to the value of
the DNSKEY signature validity. This is now fixed.
[GL #2383]
5560. [func] The default value of "max-stale-ttl" has been changed
from 12 hours to 1 day and the default value of
"stale-answer-ttl" has been changed from 1 second to 30
seconds, following RFC 8767 recommendations. [GL #2248]
5456. [func] Added "primaries" as a synonym for "masters" in
named.conf, and "primary-only" as a synonym for
"master-only" in the parameters to "notify", to bring
terminology up-to-date with RFC 8499. [GL #1948]
5362. [func] Limit the size of IXFR responses so that AXFR will
be used instead if it would be smaller. This is
controlled by the "max-ixfr-ratio" option, which
is a percentage representing the ratio of IXFR size
to the size of the entire zone. This value cannot
exceed 100%, which is the default. [GL #1515]
|
|
- Fix build (at least) on SmartOS
- Changelog:
* Feature Changes:
- The new networking code introduced in BIND 9.16 (netmgr) was overhauled
in order to make it more stable, testable, and maintainable. [GL #2321]
- Earlier releases of BIND versions 9.16 and newer required the operating
system to support load-balanced sockets in order for named to be able to
achieve high performance (by distributing incoming queries among multiple
threads). However, the only operating systems currently known to support
load-balanced sockets are Linux and FreeBSD 12, which means both UDP and
TCP performance were limited to a single thread on other systems. As of
BIND 9.17.8, named attempts to distribute incoming queries among multiple
threads on systems which lack support for load-balanced sockets (except
Windows). [GL #2137]
- It is now possible to transition a zone from secure to insecure mode
without making it bogus in the process; changing to dnssec-policy none;
also causes CDS and CDNSKEY DELETE records to be published, to signal
that the entire DS RRset at the parent must be removed, as described in
RFC 8078. [GL #1750]
- When using the unixtime or date method to update the SOA serial number,
named and dnssec-signzone silently fell back to the increment method to
prevent the new serial number from being smaller than the old serial
number (using serial number arithmetics). dnssec-signzone now prints a
warning message, and named logs a warning, when such a fallback happens.
[GL #2058]
* Bug Fixes:
- Multiple threads could attempt to destroy a single RBTDB instance at the
same time, resulting in an unpredictable but low-probability assertion
failure in free_rbtdb(). This has been fixed. [GL #2317]
- named no longer attempts to assign threads to CPUs outside the CPU
affinity set. Thanks to Ole Bjørn Hessen. [GL #2245]
- When reconfiguring named, removing auto-dnssec did not turn off DNSSEC
maintenance. This has been fixed. [GL #2341]
- The report of intermittent BIND assertion failures triggered in
lib/dns/resolver.c:dns_name_issubdomain() has now been closed without
further action. Our initial response to this was to add diagnostic
logging instead of terminating named, anticipating that we would receive
further useful troubleshooting input. This workaround first appeared in
BIND releases 9.17.5 and 9.16.7. However, since those releases were
published, there have been no new reports of assertion failures matching
this issue, but also no further diagnostic input, so we have closed the
issue. [GL #2091]
- Full Changelog at:
https://downloads.isc.org/isc/bind9/9.16.11/doc/arm/html/notes.html
|
|
|
