forked from rizaziz/bind9
-
Notifications
You must be signed in to change notification settings - Fork 0
/
CHANGES
20324 lines (14198 loc) · 684 KB
/
CHANGES
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
5947. [func] Change dnssec-policy to allow graceful transition from
an NSEC only zone to NSEC3. [GL #3486]
5946. [bug] Fix statistics channel's handling of multiple HTTP
requests in a single connection which have non-empty
request bodies. [GL #3463]
5945. [bug] If parsing /etc/bind.key failed, delv could assert
when trying to parse the built in trust anchors as
the parser hadn't been reset. [GL !6468]
5944. [bug] Fix +http-plain-get and +http-plain-post options
support in dig. Thanks to Marco Davids at SIDN for
reporting the problem. [GL !6672]
5943. [placeholder]
5942. [bug] Fix tkey.c:buildquery() function's error handling by
adding the missing cleanup code. [GL #3492]
5941. [func] Zones with dnssec-policy now require dynamic DNS or
inline-siging to be configured explicitly. [GL #3381]
5940. [placeholder]
5939. [placeholder]
5938. [bug] An integer type overflow could cause an assertion
failure when freeing memory. [GL #3483]
5937. [cleanup] The dns_rdatalist_tordataset() and
dns_rdatalist_fromrdataset() functions can no
longer fail. Clean up their prototypes and error
handling, and that of other calling functions that
subsequently cannot fail, including
dns_message_setquerytsig(). [GL #3467]
5936. [bug] Don't enable serve-stale for lookups that error because
it is a duplicate query or a query that would be
dropped. [GL #2982]
5935. [bug] Fix DiG lookup reference counting bug, which could
be observed in NSSEARCH mode. [GL #3478]
--- 9.19.4 released ---
5934. [func] Improve fetches-per-zone fetch limit logging to log
the final allowed and spilled values of the fetch
counters before the counter object gets destroyed.
[GL #3461]
5933. [port] Automatically disable RSASHA1 and NSEC3RSASHA1 in
named on Fedorda 33, Oracle Linux 9 and RHEL9 when
they are disabled by the security policy. [GL #3469]
5932. [bug] Fix rndc dumpdb -expired and always include expired
RRsets, not just for RBTDB_VIRTUAL time window.
[GL #3462]
5931. [bug] Fix DiG query error handling robustness in NSSEARCH
mode by making sure that udp_ready(), tcp_connected(),
and send_done() callbacks start the next query in chain
even if there is some kind of error with the previous
query. [GL #3419]
5930. [bug] Fix DiG query retry and fail-over bug in UDP mode.
Also simplify the overall retry and fail-over logic to
make it behave predictably, and always respect the
documented +retry/+tries count set by a command-line
option (or use the default values of 2 or 3
respectively). [GL #3407]
5929. [func] The use of the "max-zone-ttl" option in "zone" and
"options" blocks is now deprecated; this should
now be configured as part of "dnssec-policy"
instead. The old option still works in zones
with no "dnssec-policy" configured, but a warning
will be logged when loading configuration. Its
functionality will be removed in a future release.
Using "max-zone-ttl" and "dnssec-policy" in the
same zone is now a fatal error. [GL #2918]
5928. [placeholder]
5927. [bug] A race was possible in dns_dispatch_connect()
that could trigger an assertion failure if two
threads called it near-simultaneously. [GL #3456]
5926. [func] Handle transient TCP connect() EADDRINUSE failures
on FreeBSD (and possibly other BSDs) by trying three
times before giving up. [GL #3451]
5925. [bug] With a forwarder configured for all queries, resolution
failures encountered during DS chasing could trigger
assertion failures due to a logic bug in
resume_dslookup() that caused it to call
dns_resolver_createfetch() with an invalid name.
[GL #3439]
5924. [func] When it's necessary to use AXFR to respond to an
IXFR request, a message explaining the reason
is now logged at level info. [GL #2683]
5923. [bug] Fix inheritance for dnssec-policy when checking for
inline-signing. [GL #3438]
5922. [bug] Forwarding of UPDATE message could fail with the
introduction of netmgr. This has been fixed. [GL #3389]
5921. [test] Convert system tests to use a default DNSKEY algorithm
where the test is not DNSKEY algorithm specific.
[GL #3440]
5920. [bug] Don't pass back the current name offset when the
compression is disabled in the non-improving case.
[GL #3423]
--- 9.19.3 released ---
5919. [func] The "rndc fetchlimit" command lists name servers
and domain names that are being rate-limited by
"fetches-per-server" or "fetches-per-zone" limits.
[GL #665]
5918. [test] Convert system tests to use a default HMAC algorithm
where the test is not HMAC specific. [GL #3433]
5917. [bug] Update ifconfig.sh script as is miscomputed interface
identifiers when destroying interfaces. [GL #3061]
5916. [bug] When resolving a name, don't give up immediately if an
authoritative server returns FORMERR; try the other
servers first. [GL #3152]
5915. [bug] Detect missing closing brace (}) and computational
overflows in $GENERATE directives. [GL #3429]
5914. [bug] When synth-from-dnssec generated a response using
records from a higher zone, it could unexpectedly prove
non-existance of records in a subordinate grafted-on
namespace. [GL #3402]
5913. [placeholder]
5912. [cleanup] The "glue-cache" option has been removed. The glue cache
feature still works and is now permanently enabled.
[GL #2147]
5911. [bug] Update HTTP listener settings on reconfiguration.
[GL #3415]
5910. [cleanup] Move built-in dnssec-policies into the defaultconf.
These are now printed with 'named -C'. [GL !6467]
5909. [bug] The server-side destination port was missing from dnstap
captures of client traffic. [GL #3309]
5908. [bug] Fix race conditions in route_connected(). [GL #3401]
5907. [bug] Fix a crash in dig NS search mode when one of the NS
server queries fail. [GL #3207]
5906. [cleanup] Various features (e.g. prefetch, RPZ) no longer share
common pointers when initiating recursion. This
rationalizes recursion quota handling and makes the
value of the RecursClients statistics counter more
accurate. [GL #3168]
5905. [bug] When the TCP connection would be closed/reset between
the connect/accept and the read, the uv_read_start()
return value would be unexpected and cause an assertion
failure. [GL #3400]
5904. [func] Changed dnssec-signzone -H default to 0 additional
NSEC3 iterations. [GL #3395]
5903. [bug] When named checks that the OPCODE in a response matches
that of the request, if there is a mismatch named logs
an error. Some of those error messages incorrectly
used RCODE instead of OPCODE to lookup the nemonic.
This has been corrected. [GL !6420]
5902. [func] NXDOMAIN cache records are no longer retained in
the cache after expiry, even when serve-stale is
in use. [GL #3386]
5901. [bug] When processing a catalog zone member zone make sure
that there is no configured pre-existing forward-only
forward zone with that name. [GL #2506]
5900. [placeholder]
--- 9.19.2 released ---
5899. [func] Don't try to process DNSSEC-related and ZONEMD records
in catz. [GL #3380]
5898. [cleanup] Simplify BIND's internal DNS name compression API. As
RFC 6891 explains, it isn't practical to deploy new
label types or compression methods, so it isn't
necessary to have an API designed to support them.
Remove compression terminology that refers to Internet
Drafts that expired in the 1990s. [GL !6270]
5897. [bug] Views that weren't configured to use RFC 5011 key
management would still set up an empty managed-keys
zone. This has been fixed. [GL #3349]
5896. [func] Add some more dnssec-policy checks to detect weird
policies. [GL #1611]
5895. [test] Add new set of unit test macros and move the unit
tests under single namespace in /tests/. [GL !6243]
5894. [func] Avoid periodic interface re-scans on Linux by
default, where a reliable event-based mechanism for
detecting interface state changes is available.
[GL #3064]
5893. [func] Add TLS session resumption support to the client-side
TLS code. [GL !6274]
5892. [cleanup] Refactored the the hash tables in resolver.c to
use the isc_ht API. [GL !6271]
5891. [func] Key timing options for `dnssec-settime` and related
utilities now accept "UNSET" times as printed by
`dnssec-settime -p`. [GL #3361]
5890. [bug] When the fetches-per-server quota was adjusted
because of an authoritative server timing out more
or less frequently, it was incorrectly set to 1
rather than the intended value. This has been
fixed. [GL #3327]
5889. [cleanup] Refactored and simplified the shutdown processes in
dns_view, dns_resolver, dns_requestmgr, and dns_adb
by reducing interdependencies between the objects.
[GL !6278]
5888. [bug] Only write key files if the dnssec-policy keymgr has
changed the metadata. [GL #3302]
5887. [cleanup] Remove the on-shutdown mechanics from isc_task API.
Replace it by isc_task_send() when we are shutting
down. [GL !6275]
--- 9.19.1 released ---
5886. [security] Fix a crash in DNS-over-HTTPS (DoH) code caused by
premature TLS stream socket object deletion.
(CVE-2022-1183) [GL #3216]
5885. [bug] RPZ NSIP and NSDNAME rule processing didn't handle stub
and static-stub zones at or above the query name. This
has now been addressed. [GL #3232]
5884. [cleanup] Reduce struct padding in ADB address entries, and use a
binary hash function to find addresses. [GL !6219]
5883. [cleanup] Move netmgr/uv-compat.{c,h} to <isc/uv.h>, so
the compatibility libuv shims could be used outside
the network manager. [GL !6199]
5882. [contrib] Avoid name space collision in dlz modules by prefixing
functions with 'dlz_'. [GL !5778]
5881. [placeholder]
5880. [func] Add new named command-line option -C to print built-in
defaults. [GL #1326]
5879. [contrib] dlz: Add FALLTHROUGH and UNREACHABLE macros. [GL #3306]
5878. [func] Check the algorithm name or OID embedded at the start
of the signature field for PRIVATEDNS and PRIVATEOID
SIG and RRSIG records are well formed. [GL #3296]
5877. [func] Introduce the concept of broken catalog zones described
in the DNS catalog zones draft version 5 document.
[GL #3224]
5876. [func] Add DNS Extended Errors when stale answers are returned
from cache. [GL #2267]
5875. [bug] Fixed a deadlock that could occur if an rndc
connection arrived during the shutdown of network
interfaces. [GL #3272]
5874. [placeholder]
5873. [bug] Refactor the fctx_done() function to set fctx to
NULL after detaching, so that reference counting
errors will be easier to avoid. [GL #2969]
5872. [bug] udp_recv() in dispatch could trigger an INSIST when the
callback's result indicated success but the response
was canceled in the meantime. [GL #3300]
5871. [bug] Fix dig hanging on TLS context creation errors.
[GL #3285]
5870. [cleanup] Remove redundant macros in the RBT implementation.
[GL !6158]
5869. [func] Enable use of IP(V6)_RECVERR on Linux that allows
the kernel to report destination host/network
unreachable errors to the userspace application.
[GL #4251]
5868. [cleanup] Use Daniel Lemire's "nearly divisionless" algorithm
for unbiased bounded random numbers, and move
re-seeding out of the hot path. [GL !6161]
5867. [bug] Fix assertion failure triggered by attaching to dns_adb
in dns_adb_createfind() that has been triggered to shut
down in different thread between the check for shutting
down condition and the attach to dns_adb. [GL #3298]
5866. [bug] Work around a jemalloc quirk which could trigger an
out-of-memory condition in named over time. [GL #3287]
5865. [func] Make statistics channel and control channel listen
on a single network manager thread. [GL !6032]
5864. [func] The OID embedded at the start of a PRIVATEOID public
key in a KEY, DNSKEY, CDNSKEY, or RKEY RR is now
checked for validity when reading from wire or from
zone files, and the OID is printed when
'dig +rrcomments' is used. Similarly, the name
embedded at the start of a PRIVATEDNS public key
is also checked for validity. [GL #3234]
5863. [bug] If there was a pending negative cache DS entry,
validations depending upon it could fail. [GL #3279]
5862. [bug] dig returned a 0 exit status on UDP connection failure.
[GL #3235]
5861. [func] Implement support for catalog zones change of ownership
(coo) mechanism described in the DNS catalog zones draft
version 5 document. [GL #3223]
5860. [func] Implement support for catalog zones options new syntax
based on catalog zones custom properties with "ext"
suffix described in the DNS catalog zones draft version
5 document. [GL #3222]
5859. [bug] Fix an assertion failure when using dig with +nssearch
and +tcp options by starting the next query in the
send_done() callback (like in the UDP mode) instead
of doing that recursively in start_tcp(). Also
ensure that queries interrupted while connecting
are detached properly. [GL #3144]
5858. [bug] Don't remove CDS/CDNSKEY DELETE records on zone sign
when using 'auto-dnssec maintain;'. [GL #2931]
5857. [bug] Fixed a possible crash during shutdown due to ADB
entries being unlinked from the hash table too
soon. [GL #3256]
--- 9.19.0 released ---
5856. [bug] The "starting maxtime timer" message related to outgoing
zone transfers was incorrectly logged at the ERROR level
instead of DEBUG(1). [GL #3208]
5855. [bug] Ensure that zone maintenance queries have a retry limit.
[GL #3242]
5854. [func] Implement reference counting for TLS contexts and
allow reloading of TLS certificates on reconfiguration
without destroying the underlying TCP listener sockets
for TLS-based DNS transports. [GL #3122]
5853. [bug] When using both the `+qr` and `+y` options `dig` could
crash if the connection to the first server was not
successful. [GL #3244]
5852. [func] Add new "reuseport" option to enable/disable load
balancing of sockets. [GL #3249]
5851. [placeholder]
5850. [func] Run the RPZ update process on the offload threads.
[GL #3190]
5849. [cleanup] Remove use of exclusive mode in ns_interfacemgr in
favor of rwlocked access to localhost and localnets
members of dns_aclenv_t structure. [GL #3229]
5848. [bug] dig could hang in some cases involving multiple servers
in a lookup, when a request fails and the next one
refuses to start for some reason, for example if it was
an IPv4 mapped IPv6 address. [GL #3248]
5847. [cleanup] Remove task privileged mode in favor of processing
all events in the loadzone task in a single run
by setting the quantum to UINT_MAX. [GL #3253]
5846. [func] In dns_zonemgr, create per-thread task, zonetask, and
loadtask and pin the zones to individual threads,
instead of having "many", spreading the zones among
them and hoping for the best. This also removes any
need to dynamically reallocate the pools with memory
contexts and tasks. [GL #3226]
5845. [bug] Refactor the timer to keep track of posted events
as to use isc_task_purgeevent() instead of using
isc_task_purgerange(). The isc_task_purgeevent()
has been refactored to purge a single event instead
of walking through the list of posted events.
[GL #3252]
5844. [bug] dig +nssearch was hanging until manually interrupted.
[GL #3145]
5843. [bug] When an UPDATE targets a zone that is not configured,
the requested zone name is now logged in the "not
authoritative" error message, so that it is easier to
track down problematic update clients. [GL #3209]
5842. [cleanup] Remove the task exclusive mode use in ns_clientmgr.
[GL #3230]
5841. [bug] Refactor the address database:
- Use self-resizing hash tables, eliminating the
need to go into task-exclusive mode when resizing.
- Simplify reference counting of ADB objects
and the process for shutting down. [GL #3213]
5840. [cleanup] Remove multiple application context use in dns_client
unit. [GL !6041]
5839. [func] Add support for remote TLS certificates
verification, both to BIND and dig, making it possible
to implement Strict and Mutual TLS authentication,
as described in RFC 9103, Section 9.3. [GL #3163]
5838. [cleanup] When modifying a member zone in a catalog zone, and it
is detected that the zone exists and was not created by
the current catalog zone, distinguish the two cases when
the zone was not added by a catalog zone at all, and
when the zone was added by a different catalog zone,
and log a warning message accordingly. [GL #3221]
5837. [func] Key timing options for `dnssec-keygen` and
`dnssec-settime` now accept times as printed by
`dnssec-settime -p`. [GL !2947]
5836. [bug] Quote the dns64 prefix in error messages that complain
about problems with it, to avoid confusion with the
following dns64 ACLs. [GL #3210]
5835. [cleanup] Remove extrahandlesize from the netmgr, the callers
now have to allocate the object before calling
isc_nm_setdata() and deallocate the memory in the close
callback passed to isc_nm_setdata(). [GL #3227]
5834. [cleanup] C99 variable-length arrays are difficult to use safely,
so avoid them except in test code. [GL #3201]
5833. [bug] When encountering socket error while trying to initiate
a TCP connection to a server, dig could hang
indefinitely, when there were more servers to try.
[GL #3205]
5832. [bug] When timing-out or having other types of socket errors
during a query, dig wasn't trying to perform the lookup
using other servers, in case they exist. [GL #3128]
5831. [bug] When resending a UDP request in the result of a timeout,
the recv_done() function in dighost.c was prepending
the new query into the loookup's queries list instead
of inserting, which could cause an assertion failure
when the resent query's result was SERVFAIL. [GL #3020]
5830. [func] Implement incremental resizing of isc_ht hash tables to
perform the rehashing gradually. [GL #3212]
5829. [func] Refactor and simplify isc_timer API in preparation
for further refactoring on top of network manager
loops. [GL #3202]
5828. [bug] Replace single TCP write timer with per-TCP write
timers. [GL #3200]
5827. [cleanup] The command-line utilities printed their version numbers
inconsistently; they all now print to stdout. (They are
still inconsistent abotut whether you use `-v` or `-V`
to request the version). [GL #3189]
5826. [cleanup] Stop dig from complaining about lack of IDN support when
the user asks for no IDN translation. [GL #3188]
5825. [func] Set the minimum MTU on UDPv6 and TCPv6 sockets and
limit TCP maximum segment size (TCP_MAXSEG) to (1220)
for both TCPv4 and TCPv6 sockets. [GL #2201]
5824. [bug] Invalid dnssec-policy definitions were being accepted
where the defined keys did not cover both KSK and ZSK
roles for a given algorithm. This is now checked for
and the dnssec-policy is rejected if both roles are
not present for all algorithms in use. [GL #3142]
5823. [func] Replace hazard pointers based lock-free list with
locked-list based queue that's simpler and has no or
little performance impact. [GL #3180]
5822. [bug] When calling dns_dispatch_send(), attach/detach
dns_request_t object as the read callback could
be called before send callback dereferencing
dns_request_t object too early. [GL #3105]
5821. [bug] Fix query context management issues in the TCP part
of dig. [GL #3184]
5820. [security] An assertion could occur in resume_dslookup() if the
fetch had been shut down earlier. (CVE-2022-0667)
[GL #3129]
5819. [security] Lookups involving a DNAME could trigger an INSIST when
"synth-from-dnssec" was enabled. (CVE-2022-0635)
[GL #3158]
5818. [security] A synchronous call to closehandle_cb() caused
isc__nm_process_sock_buffer() to be called recursively,
which in turn left TCP connections hanging in the
CLOSE_WAIT state blocking indefinitely when
out-of-order processing was disabled. (CVE-2022-0396)
[GL #3112]
5817. [security] The rules for acceptance of records into the cache
have been tightened to prevent the possibility of
poisoning if forwarders send records outside
the configured bailiwick. (CVE-2021-25220) [GL #2950]
5816. [bug] Make BIND compile with LibreSSL 3.5.0, as it was using
not very accurate pre-processor checks for using shims.
[GL #3172]
5815. [bug] If an oversized key name of a specific length was used
in the text form of an HTTP or SVBC record, an INSIST
could be triggered when parsing it. [GL #3175]
5814. [bug] The RecursClients statistics counter could underflow
in certain resolution scenarios. [GL #3147]
5813. [func] The "keep-response-order" ACL has been declared
obsolete, and is now non-operational. [GL #3140]
5812. [func] Drop the artificial limit on the number of queries
processed in a single TCP read callback. [GL #3141]
5811. [bug] Reimplement the maximum and idle timeouts for outgoing
zone tranfers. [GL #1897]
5810. [func] New option '-J' for dnssec-signzone and dnssec-verify
allows loading journal files. [GL #2486]
5809. [bug] Reset client TCP connection when data received cannot
be parsed as a valid DNS request. [GL #3149]
5808. [bug] Certain TCP failures were not caught and handled
correctly by the dispatch manager, causing
connections to time out rather than returning
SERVFAIL. [GL #3133]
5807. [bug] Add a TCP "write" timer, and time out writing
connections after the "tcp-idle-timeout" period
has elapsed. [GL #3132]
5806. [bug] An error in checking the "blackhole" ACL could cause
DNS requests sent by named to fail if the
destination address or prefix was specifically
excluded from the ACL. [GL #3157]
5805. [func] The result of each resolver priming attempt is now
included in the "resolver priming query complete" log
message. [GL #3139]
5804. [func] Add a debug log message when starting and ending
the task exclusive mode. [GL #3137]
5803. [func] Use compile-time paths in the documentation.
[GL #2717]
5802. [test] Add system test to test engine_pkcs11. [GL !5727]
5801. [bug] Log "quota reached" message when hard quota
is reached when accepting a connection. [GL #3125]
5800. [func] Add ECS support to the DLZ interface. [GL #3082]
5799. [bug] Use L1 cache-line size detected at runtime. [GL #3108]
5798. [test] Add system test to test dnssec-keyfromlabel. [GL #3092]
5797. [bug] A failed view configuration during a named
reconfiguration procedure could cause inconsistencies
in BIND internal structures, causing a crash or other
unexpected errors. [GL #3060]
5796. [bug] Ignore the invalid (<= 0) values returned
by the sysconf() check for the L1 cache line
size. [GL #3108]
5795. [bug] rndc could crash when interrupted by a signal
before receiving a response. [GL #3080]
5794. [func] Set the IPV6_V6ONLY on all IPv6 sockets to
restrict the IPv6 sockets to sending and
receiving IPv6 packets only. [GL #3093]
5793. [bug] Correctly detect and enable UDP recvmmsg support
in all versions of libuv that support it. [GL #3095]
5792. [bug] Don't schedule zone events on ISC_R_SHUTTINGDOWN
event failures. [GL #3084]
5791. [func] Remove workaround for servers returning FORMERR
when receiving NOTIFY query with SOA record in
ANSWER section. [GL #3086]
5790. [bug] The control channel was incorrectly looking for
ISC_R_CANCELED as a signal that the named is
shutting down. In the dispatch refactoring,
the result code returned from network manager
is now ISC_R_SHUTTINGDOWN. Change the control
channel code to use ISC_R_SHUTTINGDOWN result
code to detect named being shut down. [GL #3079]
--- 9.17.22 released ---
5789. [bug] Allow replacing expired zone signatures with
signatures created by the KSK. [GL #3049]
5788. [bug] An assertion could occur if a catalog zone event was
scheduled while the task manager was being shut
down. [GL #3074]
5787. [doc] Update 'auto-dnssec' documentation, it may only be
activated at zone level. [GL #3023]
5786. [bug] Defer detaching from zone->raw in zone_shutdown() if
the zone is in the process of being dumped to disk, to
ensure that the unsigned serial number information is
always written in the raw-format header of the signed
version on an inline-signed zone. [GL #3071]
5785. [bug] named could leak memory when two dnssec-policy clauses
had the same name. named failed to log this error.
[GL #3085]
5784. [func] Implement TLS-contexts reuse. Reusing the
previously created TLS context objects can reduce
initialisation time for some configurations and enables
TLS session resumption for incoming zone transfers over
TLS (XoT). [GL #3067]
5783. [func] named is now able to log TLS pre-master secrets for
debugging purposes. This requires setting the
SSLKEYLOGFILE environment variable appropriately.
[GL #2723]
5782. [func] Use ECDSA P-256 instead of a 4096-bit RSA when
generating ephemeral key and certificate for the
'tls ephemeral' configuration. [GL #2264]
5781. [bug] Make BIND work with OpenSSL 3.0.1 as it is now
enforcing minimum buffer lengths in EVP_MAC_final and
hence EVP_DigestSignFinal. rndc and TSIG at a minimum
were broken by this change. [GL #3057]
5780. [bug] The Linux kernel may send netlink messages
indicating that network interfaces have changed
when they have not. This caused frequent unnecessary
re-scans of the interfaces. Netlink messages now
only trigger re-scanning if a new address is seen
or an existing address is removed. [GL #3055]
5779. [test] Drop cppcheck suppressions and workarounds. [GL #2886]
5778. [bug] Destroyed TLS contexts could have been used after a
reconfiguration, making BIND unable to serve queries
over TLS and HTTPS. [GL #3053]
5777. [bug] TCP connections could hang after receiving
non-matching responses. [GL #3042]
5776. [bug] Add a missing isc_condition_destroy() for nmsocket
condition variable and add missing isc_mutex_destroy()
for nmworker lock. [GL #3051]
--- 9.17.21 released ---
5775. [bug] Added a timer in the resolver to kill fetches that
have deadlocked as a result of dependency loops
with the ADB or the validator. This condition is
now logged with the message "shut down hung fetch
while resolving '<name>/<type>'". [GL #3040]
5774. [func] Restore NSEC Aggressive Cache ("synth-from-dnssec")
as active by default. It is limited to NSEC only
and by default ignores NSEC records with next name
in form \000.domain. [GL #1265]
5773. [func] Change the message when accepting TCP connection has
failed to say "Accepting TCP connection failed" and
change the log level for ISC_R_NOTCONNECTED, ISC_R_QUOTA
and ISC_R_SOFTQUOTA results codes from ERROR to INFO.
[GL #2700]
5772. [bug] The resolver could hang on shutdown due to dispatch
resources not being cleaned up when a TCP connection
was reset. [GL #3026]
5771. [bug] Use idn2 UseSTD3ASCIIRules=false to disable additional
unicode validity checks because enabling the additional
checks would break valid domain names that contains
non-alphanumerical characters such as underscore
character (_) or wildcard (*). This reverts change
[GL !5738] from the previous release. [GL #1610]
5770. [func] BIND could abort on startup on systems using old
OpenSSL versions when 'protocols' option is used inside
a 'tls' statement. [GL !5602]
5769. [func] Added support for client-side 'tls' parameters when
doing incoming zone transfers via XoT. [GL !5602]
5768. [bug] dnssec-dsfromkey failed to omit revoked keys. [GL #853]
5767. [func] Extend allow-transfer option with 'port' and
'transport' options to restrict zone transfers to
a specific port and DNS transport protocol.
[GL #2776]
5766. [func] Unused 'tls' clause options 'ca-file' and 'hostname'
were disabled. [GL !5600]
5765. [bug] Fix a bug in DoH implementation making 'dig'
abort when ALPN negotiation fails. [GL #3022]
5764. [bug] dns_sdlz_putrr failed to process some valid resource
records. [GL #3021]
5763. [bug] Fix a bug in DoT code leading to an abort when
a zone transfer ends with an unexpected DNS message.
[GL #3004]
5762. [bug] Fix a "named" crash related to removing and restoring a
`catalog-zone` entry in the configuration file and
running `rndc reconfig`. [GL #1608]
5761. [bug] OpenSSL 3.0.0 support could fail to correctly read
ECDSA private keys leading to incorrect signatures
being generated. [GL #3014]
5760. [bug] Prevent a possible use-after-free error in resolver.
[GL #3018]
5759. [func] Set Extended DNS Error Code 18 - Prohibited if query
access is denied to the specific client. [GL #1836]
5758. [bug] mdig now honors the operating system's preferred
ephemeral port range. [GL #2374]
5757. [test] Replace sed in nsupdate system test with awk to
construct the nsupdate command. The sed expression
was not reliably changing the ttl. [GL #3003]
5756. [func] Assign HTTP freshness lifetime to responses sent
via DNS-over-HTTPS, according to the recommendations
given in RFC 8484. [GL #2854]
--- 9.17.20 released ---
5755. [bug] The statistics channel wasn't correctly handling
multiple HTTP requests, or pipelined or truncated
requests. [GL #2973]
5754. [bug] "tls" statements may omit "key-file" and "cert-file",
but if either one is specified, then both must be.
[GL #2986]
5753. [placeholder]
5752. [bug] Fix an assertion failure caused by missing member zones
during a reload of a catalog zone. [GL #2308]
5751. [port] Add support for OpenSSL 3.0.0. OpenSSL 3.0.0
deprecated 'engine' support. If OpenSSL 3.0.0 has
been built without support for deprecated functionality
pkcs11 via engine_pkcs11 is no longer available.
[GL #2843]
5750. [bug] Fix a bug when comparing two RSA keys. There was a typo
which caused the "p" prime factors to not being
compared. [GL #2972]
5749. [bug] Handle duplicate references to the same catalog
zone gracefully. [GL #2916]
5748. [func] Update "nsec3param" defaults to iterations 0, salt
length 0. [GL #2956]
5747. [func] Update rndc serve-stale status output to be less
confusing. [GL #2742]
5746. [bug] A lame server delegation could lead to a loop in which
a resolver fetch depends on an ADB find which depends
on the same resolver fetch. Previously, this would
cause the fetch to hang until timing out, but after
change #5730 it would hang forever. The condition is
now detected and avoided. [GL #2927]
5745. [bug] Fetch context objects now use attach/detach
semantics to make it easier to find and debug
reference-counting errors, and several such errors
have been fixed. [GL #2953]
5744. [func] The network manager is now used for netlink sockets
to monitor network interface changes. This was the
last remaining use of the old isc_socket and
isc_socketmgr APIs, so they have now been removed.
The "named -S" argument and the "reserved-sockets"
option in named.conf have no function now, and are
deprecated. "socketmgr" statistics are no longer
reported in the statistics channel. [GL #2926]
5743. [func] Add finer-grained "update-policy" rules,
"krb5-subdomain-self-rhs" and "ms-subdomain-self-rhs",
which restrict SRV and PTR record changes, allowing
only records whose content matches the machine name
embedded in the Kerberos principal making the change.
[GL #481]
5742. [func] ISC_LIKELY() and ISC_UNLIKELY() macros have been
removed. [GL #2952]
5741. [bug] Log files with "timestamp" suffixes could be left in
place after rolling, even if the number of preserved
log files exceeded the configured "versions" limit.
[GL #828]
5740. [func] Implement incremental resizing of RBT hash table to
perform the rehashing gradually. [GL #2941]
5739. [func] Change default of 'dnssec-dnskey-kskonly' to 'yes'.
[GL #1316]
5738. [bug] Enable idn2 UseSTD3ASCIIRules=true to implement
additional unicode validity checks. [GL #1610]
5737. [bug] Address Coverity warning in lib/dns/dnssec.c.
[GL #2935]
--- 9.17.19 released ---
5736. [security] The "lame-ttl" option is now forcibly set to 0. This
effectively disables the lame server cache, as it could
previously be abused by an attacker to significantly
degrade resolver performance. (CVE-2021-25219)
[GL #2899]
5735. [cleanup] The result codes which BIND 9 uses internally are now
all defined as a single list of enum values rather than
as multiple sets of integers scattered around shared
libraries. This prevents the need for locking in some
functions operating on result codes, and makes result
codes more debugger-friendly. [GL #719]
5734. [bug] Fix intermittent assertion failures in dig which were
triggered during zone transfers. [GL #2884]
5733. [func] Require the "dot" Application-Layer Protocol Negotiation
(ALPN) token to be selected in the TLS handshake for
zone transfers over TLS (XoT), as required by RFC 9103
section 7.1. [GL #2794]
5732. [cleanup] Remove the dns_lib_init(), dns_lib_shutdown(),
ns_lib_init(), and ns_lib_shutdown() functions, as they
no longer served any useful purpose. [GL #88]
5731. [bug] Disallow defining "http" configuration clauses called
"default" as they were silently ignored. [GL #2925]
5730. [func] The resolver and the request and dispatch managers have
been substantially refactored, and are now based on the
network manager instead of the old isc_socket API. All
outgoing DNS queries and requests now use the new API;
isc_socket is only used to monitor for network interface
changes. [GL #2401]
5729. [func] Allow finer control over TLS protocol configuration by
implementing new options for "tls" configuration clauses
("dhparam-file", "ciphers", "prefer-server-ciphers",
"session-tickets"). These options make achieving perfect
forward secrecy (PFS) possible for DNS-over-TLS (DoT)
and DNS-over-HTTPS (DoH). [GL #2796]
5728. [func] Allow specifying supported TLS protocol versions for
each "tls" configuration clause. [GL #2795]
5727. [placeholder]
5726. [bug] Fix a use-after-free bug which was triggered while
checking for duplicate "http" configuration clauses.
[GL #2924]
5725. [bug] Fix an assertion failure triggered by passing an invalid
HTTP path to dig. [GL #2923]
5724. [bug] Address a potential deadlock when checking zone content
consistency. [GL #2908]
5723. [bug] Change 5709 broke backward compatibility for the
"check-names master ..." and "check-names slave ..."
options. This has been fixed. [GL #2911]
5722. [bug] Preserve the contents of the receive buffer for TCPDNS
and TLSDNS when growing its size. [GL #2917]
5721. [func] A new realloc()-like function, isc_mem_reget(), was
added to the libisc API for resizing memory chunks
allocated using isc_mem_get(). Memory (re)allocation
functions are now guaranteed to return non-NULL pointers
for zero-sized allocation requests. [GL !5440]
5720. [contrib] Remove old-style DLZ drivers that had to be enabled at
build time. [GL #2814]
5719. [func] Remove support for the "map" zone file format.
[GL #2882]
5718. [bug] The "sig-signing-type" zone configuration option was
processed incorrectly, causing valid configurations to
be rejected. This has been fixed. [GL #2906]
5717. [func] The "cache-file" option, which was documented as "for
testing purposes only" and not to be used, has been
removed. [GL #2903]
5716. [placeholder]
5715. [func] Add a check for ports specified in "*-source(-v6)"
options clashing with a global listening port. Such a
configuration was already unsupported, but it failed
silently; it is now treated as an error. [GL #2888]
5714. [bug] Remove the "adjust interface" mechanism which was
responsible for setting up listeners on interfaces when
the "*-source(-v6)" address and port were the same as
the "listen-on(-v6)" address and port. Such a
configuration is no longer supported; under certain
timing conditions, that mechanism could prevent named
from listening on some TCP ports. This has been fixed.
[GL #2852]
5713. [func] Add "primaries" as a synonym for "masters" and
"default-primaries" as a synonym for "default-masters"
in catalog zone configuration options. [GL #2818]
5712. [func] Remove native PKCS#11 support in favor of engine_pkcs11
from the OpenSC project. [GL #2691]
--- 9.17.18 released ---
5711. [bug] "map" files exceeding 2GB in size failed to load due to
a size comparison that incorrectly treated the file size
as a signed integer. [GL #2878]
5710. [placeholder]
5709. [func] When reporting zone types in the statistics channel, the
terms "primary" and "secondary" are now used instead of
"master" and "slave", respectively. Enum values
throughout the code have been updated to use this
terminology as well. [GL #1944]
5708. [placeholder]
5707. [bug] A bug was fixed which prevented dig from querying
DNS-over-HTTPS (DoH) servers via IPv6. [GL #2860]
5706. [cleanup] Support for external applications to register with
libisc and use it has been removed. Export versions of
BIND 9 libraries have not been supported for some time,
but the isc_lib_register() function was still available;
it has now been removed. [GL !2420]
5705. [bug] Change #5686 altered the internal memory structure of
zone databases, but neglected to update the MAPAPI value
for zone files in "map" format. This caused named to
attempt to load incompatible map files, triggering an
assertion failure on startup. The MAPAPI value has now
been updated, so named rejects outdated files when
encountering them. [GL #2872]