-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathNEWS
20601 lines (14393 loc) · 693 KB
/
NEWS
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
--- 9.18.14 released ---
6145. [bug] Fix a possible use-after-free bug in the
dns__catz_done_cb() function. [GL #3997]
6143. [bug] A reference counting problem on the error path in
the xfrin_connect_done() might cause an assertion
failure on shutdown. [GL #3989]
6142. [bug] Reduce the number of dns_dnssec_verify calls made
determining if revoked keys needs to be removed from
the trust anchors. [GL #3981]
6141. [bug] Fix several issues in nsupdate timeout handling and
update the -t option's documentation. [GL #3674]
6138. [doc] Fix the DF-flag documentation on the outgoing
UDP packets. [GL #3710]
6136. [cleanup] Remove the isc_fsaccess API in favor of creating
temporary file first and atomically replace the key
with non-truncated content. [GL #3982]
6132. [doc] Remove a dead link in the DNSSEC guide. [GL #3967]
6129. [cleanup] Value stored to 'source' during its initialization is
never read. [GL #3965]
6128. [bug] Fix an omission in an earlier commit to avoid a race
between the 'dns__catz_update_cb()' and
'dns_catz_dbupdate_callback()' functions. [GL #3968]
6126. [cleanup] Deprecate zone type "delegation-only" and the
"delegation-only" and "root-delegation-only"
options. [GL #3953]
6125. [bug] Hold a catz reference while the update process is
running, so that the catalog zone is not destroyed
during shutdown until the update process is finished or
properly canceled by the activated 'shuttingdown' flag.
[GL #3955]
6124. [bug] When changing from a NSEC3 capable DNSSEC algorithm to
an NSEC3 incapable DNSSEC algorithm using KASP the zone
could sometimes be incompletely signed. [GL #3937]
6121. [bug] Fix BIND and dig zone transfer hanging when
downloading large zones over TLS from a primary server,
especially over unstable connections. [GL #3867]
--- 9.18.13 released ---
6120. [bug] Use two pairs of dns_db_t and dns_dbversion_t in a
catalog zone structure to avoid a race between the
dns__catz_update_cb() and dns_catz_dbupdate_callback()
functions. [GL #3907]
6119. [bug] Make sure to revert the reconfigured zones to the
previous version of the view, when the new view
reconfiguration fails during the configuration of
one of the configured zones. [GL #3911]
6116. [bug] Fix error path cleanup issues in dns_catz_new_zones()
and dns_catz_new_zone() functions. [GL #3900]
6115. [bug] Unregister db update notify callback before detaching
from the previous db inside the catz update notify
callback. [GL #3777]
6114. [func] Run the catalog zone update process on the offload
threads. [GL #3881]
6113. [func] Add shutdown signaling for catalog zones. [GL !7571]
6112. [func] Add reference count tracing for dns_catz_zone_t and
dns_catz_zones_t. [GL !7570]
6105. [bug] Detach 'rpzs' and 'catzs' from the previous view in
configure_rpz() and configure_catz(), respectively,
just after attaching it to the new view. [GL #3880]
6098. [test] Don't test HMAC-MD5 when not supported by libcrypto.
[GL #3871]
6096. [bug] Fix RPZ reference counting error on shutdown in
dns__rpz_timer_cb(). [GL #3866]
6095. [test] Test various 'islands of trust' configurations when
using managed keys. [GL #3662]
6094. [bug] Building against (or running with) libuv versions
1.35.0 and 1.36.0 is now a fatal error. The rules for
mixing and matching compile-time and run-time libuv
versions have been tightened for libuv versions between
1.35.0 and 1.40.0. [GL #3840]
6092. [bug] dnssec-cds failed to cleanup properly. [GL #3831]
6089. [bug] Source ports configured for query-source,
transfer-source, etc, were being ignored. (This
feature is deprecated, but it is not yet removed,
so the bug still needed fixing.) [GL #3790]
--- 9.18.12 released ---
6083. [bug] Fix DNSRPS-enabled builds as they were inadvertently
broken by change 6042. [GL #3827]
6082. [test] fuzz/dns_message_checksig leaked memory when shutting
down. [GL #3828]
6081. [bug] Handle primary server address lookup failures in
nsupdate more gracefully. [GL #3830]
6080. [bug] 'named -V' leaked memory. [GL #3829]
6079. [bug] Force set the DS state after a 'rdnc dnssec -checkds'
command. [GL #3822]
6075. [bug] Add missing node lock when setting node->wild in
add_wildcard_magic. [GL #3799]
6074. [func] Refactor the isc_nm_xfr_allowed() function to return
isc_result_t instead of boolean. [GL #3808]
6073. [bug] Set RD=1 on DS requests to parental-agents. [GL #3783]
6072. [bug] Avoid the OpenSSL lock contention when initializing
Message Digest Contexts by using explicit algorithm
fetching, initializing static contexts for every
supported algorithms, and initializing the new context
by copying the static copy. [GL #3795]
6071. [func] The use of "port" when configuring query-source,
transfer-source, notify-source and parental-source
addresses has been deprecated, along with the
use-v[46]-udp-ports and avoid-v[46]-udp-ports
options. A warning will be logged when these
options are used. In a future release, they
will be removed. [GL #3781]
6069. [bug] Detach from the view in zone_shutdown() to
release the memory held by the dead view
early. [GL #3801]
6068. [bug] Downloading a zone via TLS from a server which does
not negotiate "dot" ALPN token could crash BIND
on shutdown. That has been fixed. [GL #3767]
6057. [bug] Fix shutdown and error path bugs in the rpz unit.
[GL #3735]
5850. [func] Run the RPZ update process on the offload threads.
[GL #3190]
--- 9.18.11 released ---
6067. [security] Fix serve-stale crash when recursive clients soft quota
is reached. (CVE-2022-3924) [GL #3619]
6066. [security] Handle RRSIG lookups when serve-stale is active.
(CVE-2022-3736) [GL #3622]
6064. [security] An UPDATE message flood could cause named to exhaust all
available memory. This flaw was addressed by adding a
new "update-quota" statement that controls the number of
simultaneous UPDATE messages that can be processed or
forwarded. The default is 100. A stats counter has been
added to record events when the update quota is
exceeded, and the XML and JSON statistics version
numbers have been updated. (CVE-2022-3094) [GL #3523]
6062. [func] The DSCP implementation, which has been
nonfunctional for some time, is now marked as
obsolete and the implementation has been removed.
Configuring DSCP values in named.conf has no
effect, and a warning will be logged that
the feature should no longer be used. [GL #3773]
6061. [bug] Fix unexpected "Prohibited" extended DNS error
on allow-recursion. [GL #3743]
6060. [bug] Fix a use-after-free bug in dns_zonemgr_releasezone()
by detaching from the zone manager outside of the write
lock. [GL #3768]
6059. [bug] In some serve stale scenarios, like when following an
expired CNAME record, named could return SERVFAIL if the
previous request wasn't successful. Consider non-stale
data when in serve-stale mode. [GL #3678]
6058. [bug] Prevent named from crashing when "rndc delzone"
attempts to delete a zone added by a catalog zone.
[GL #3745]
6053. [bug] Fix an ADB quota management bug in resolver. [GL #3752]
6051. [bug] Improve thread safety in the dns_dispatch unit.
[GL #3178] [GL #3636]
6050. [bug] Changes to the RPZ response-policy min-update-interval
and add-soa options now take effect as expected when
named is reconfigured. [GL #3740]
6049. [bug] Exclude ABD hashtables from the ADB memory
overmem checks and don't clean ADB names
and ADB entries used in the last 10 seconds
(ADB_CACHE_MINIMUM). [GL #3739]
6048. [bug] Fix a log message error in dns_catz_update_from_db(),
where serials with values of 2^31 or larger were logged
incorrectly as negative numbers. [GL #3742]
6047. [bug] Try the next server instead of trying the same
server again on an outgoing query timeout.
[GL #3637]
6046. [bug] TLS session resumption might lead to handshake
failures when client certificates are used for
authentication (Mutual TLS). This has been fixed.
[GL #3725]
6045. [cleanup] The list of supported DNSSEC algorithms changed log
level from "warning" to "notice" to match named's other
startup messages. [GL !7217]
6044. [bug] There was an "RSASHA236" typo in a log message.
[GL !7206]
5845. [bug] Refactor the timer to keep track of posted events
as to use isc_task_purgeevent() instead of using
isc_task_purgerange(). The isc_task_purgeevent()
has been refactored to purge a single event instead
of walking through the list of posted events.
[GL #3252]
5830. [func] Implement incremental resizing of isc_ht hash tables to
perform the rehashing gradually. The catalog zone
implementation has been optimized to work with hundreds
of thousands of member zones. [GL #3212] [GL #3744]
--- 9.18.10 released ---
6043. [bug] The key file IO locks objects would never get
deleted from the hashtable due to off-by-one error.
[GL #3727]
6042. [bug] ANY responses could sometimes have the wrong TTL.
[GL #3613]
6040. [bug] Speed up the named shutdown time by explicitly
canceling all recursing ns_client objects for
each ns_clientmgr. [GL #3183]
6039. [bug] Removing a catalog zone from catalog-zones without
also removing the referenced zone could leave a
dangling pointer. [GL #3683]
6036. [bug] nslookup and host were not honoring the selected port
in TCP mode. [GL #3721]
6034. [func] Deprecate alt-transfer-source, alt-transfer-source-v6
and use-alt-transfer-source. [GL #3694]
6031. [bug] Move the "final reference detached" log message
from dns_zone unit to the DEBUG(1) log level.
[GL #3707]
6027. [bug] Fix assertion failure in isc_http API used by
statschannel if the read callback would be called
on HTTP request that has been already closed.
[GL #3693]
6026. [cleanup] Deduplicate time unit conversion factors.
[GL !7033]
6025. [bug] Copy TLS identifier when setting up primaries for
catalog member zones. [GL #3638]
6024. [func] Deprecate 'auto-dnssec'. [GL #3667]
6022. [performance] The decompression implementation in dns_name_fromwire()
is now smaller and faster. [GL #3655]
6021. [bug] Use the current domain name when checking answers from
a dual-stack-server. [GL #3607]
6020. [bug] Ensure 'named-checkconf -z' respects the check-wildcard
option when loading a zone. [GL #1905]
6019. [func] Deprecate `coresize`, `datasize`, `files`, and
`stacksize` named.conf options. [GL #3676]
6017. [bug] The view's zone table was not locked when it should
have been leading to race conditions when external
extensions that manipulate the zone table where in
use. [GL #3468]
6015. [bug] Some browsers (Firefox) send more than 10 HTTP
headers. Bump the number of allowed HTTP headers
to 100. [GL #3670]
5902. [func] NXDOMAIN cache records are no longer retained in
the cache after expiry, even when serve-stale is
in use. [GL #3386]
--- 9.18.9 released ---
6013. [bug] Fix a crash that could happen when you change
a dnssec-policy zone with NSEC3 to start using
inline-signing. [GL #3591]
6009. [bug] Don't trust a placeholder KEYDATA from the managed-keys
zone by adding it into secroots. [GL #2895]
6008. [bug] Fixed a race condition that could cause a crash
in dns_zone_synckeyzone(). [GL #3617]
6007. [cleanup] Don't enforce the jemalloc use on NetBSD. [GL #3634]
6003. [bug] Fix an inheritance bug when setting the port on
remote servers in configuration. [GL #3627]
6002. [bug] Fix a resolver prefetch bug when the record's TTL value
is equal to the configured prefetch eligibility value,
but the record was erroneously not treated as eligible
for prefetching. [GL #3603]
6001. [bug] Always call dns_adb_endudpfetch() after calling
dns_adb_beginudpfetch() for UDP queries in resolver.c,
in order to adjust back the quota. [GL #3598]
6000. [bug] Fix a startup issue on Solaris systems with many
(reportedly > 510) CPUs. Thanks to Stacey Marshall from
Oracle for deep investigation of the problem. [GL #3563]
5999. [bug] rpz-ip rules could be ineffective in some scenarios
with CD=1 queries. [GL #3247]
5998. [bug] The RecursClients statistics counter could overflow
in certain resolution scenarios. [GL #3584]
5997. [cleanup] Less ceremonial UNEXPECTED_ERROR() and FATAL_ERROR()
reporting macros. [GL !6914]
5996. [bug] Fix a couple of bugs in cfg_print_duration(), which
could result in generating incomplete duration values
when printing the configuration using named-checkconf.
[GL !6880]
5994. [func] Refactor the isc_httpd implementation used in the
statistics channel. [GL !6879]
--- 9.18.8 released ---
5991. [protocol] Add support for parsing and validating "dohpath" to
SVCB. [GL #3544]
5990. [test] fuzz/dns_message_checksig now creates the key directory
it uses when testing in /tmp at run time. [GL #3569]
5988. [bug] Some out of memory conditions in opensslrsa_link.c
could lead to memory leaks. [GL #3551]
5984. [func] 'named -V' now reports the list of supported
DNSSEC/DS/HMAC algorithms and the supported TKEY modes.
[GL #3541]
5983. [bug] Changing just the TSIG key names for primaries in
catalog zones' member zones was not effective.
[GL #3557]
5982. [func] Extend dig to allow requests to be signed using SIG(0)
as well as providing a mechanism to specify the signing
time. [GL !5923]
5981. [test] Add dns_message_checksig fuzzer to check messages
signed using TSIG or SIG(0). [GL !5923]
5978. [port] The ability to use pkcs11 via engine_pkcs11 has been
restored, by only using deprecated APIs in
OpenSSL 3.0.0. BIND needs to be compiled with
'-DOPENSSL_API_COMPAT=10100' specified in the CFLAGS
at compile time. [GL !6711]
5973. [bug] Fixed a possible invalid detach in UPDATE
processing. [GL #3522]
5972. [bug] Gracefully handle when the statschannel HTTP connection
gets cancelled during sending data back to the client.
[GL #3542]
5970. [func] Log the reason why a query was refused. [GL !6669]
5967. [cleanup] Flagged the "random-device" option (which was
already nonoperational) as obsolete; configuring it
will generate a warning. [GL #3399]
5963. [bug] Ensure struct named_server is properly initialized.
[GL #6531]
--- 9.18.7 released ---
5962. [security] Fix memory leak in EdDSA verify processing.
(CVE-2022-38178) [GL #3487]
5960. [security] Fix serve-stale crash that could happen when
stale-answer-client-timeout was set to 0 and there was
a stale CNAME in the cache for an incoming query.
(CVE-2022-3080) [GL #3517]
5959. [security] Fix memory leaks in the DH code when using OpenSSL 3.0.0
and later versions. The openssldh_compare(),
openssldh_paramcompare(), and openssldh_todns()
functions were affected. (CVE-2022-2906) [GL #3491]
5958. [security] When an HTTP connection was reused to get
statistics from the stats channel, and zlib
compression was in use, each successive
response sent larger and larger blocks of memory,
potentially reading past the end of the allocated
buffer. (CVE-2022-2881) [GL #3493]
5957. [security] Prevent excessive resource use while processing large
delegations. (CVE-2022-2795) [GL #3394]
5956. [func] Make RRL code treat all QNAMEs that are subject to
wildcard processing within a given zone as the same
name. [GL #3459]
5955. [port] The libxml2 library has deprecated the usage of
xmlInitThreads() and xmlCleanupThreads() functions. Use
xmlInitParser() and xmlCleanupParser() instead.
[GL #3518]
5954. [func] Fallback to IDNA2003 processing in dig when IDNA2008
conversion fails. [GL #3485]
5953. [bug] Fix a crash on shutdown in delete_trace_entry(). Add
mctx attach/detach pair to make sure that the memory
context used by a memory pool is not destroyed before
the memory pool itself. [GL #3515]
5952. [bug] Use quotes around address strings in YAML output.
[GL #3511]
5951. [bug] In some cases, the dnstap query_message field was
erroneously set when logging response messages.
[GL #3501]
5948. [bug] Fix nsec3.c:dns_nsec3_activex() function, add a missing
dns_db_detachnode() call. [GL #3500]
5947. [func] Change dnssec-policy to allow graceful transition from
an NSEC only zone to NSEC3. [GL #3486]
5946. [bug] Fix statistics channel's handling of multiple HTTP
requests in a single connection which have non-empty
request bodies. [GL #3463]
5945. [bug] If parsing /etc/bind.key failed, delv could assert
when trying to parse the built in trust anchors as
the parser hadn't been reset. [GL !6468]
5944. [bug] Fix +http-plain-get and +http-plain-post options
support in dig. Thanks to Marco Davids at SIDN for
reporting the problem. [GL !6672]
5942. [bug] Fix tkey.c:buildquery() function's error handling by
adding the missing cleanup code. [GL #3492]
5941. [func] Zones with dnssec-policy now require dynamic DNS or
inline-siging to be configured explicitly. [GL #3381]
5938. [bug] An integer type overflow could cause an assertion
failure when freeing memory. [GL #3483]
5936. [bug] Don't enable serve-stale for lookups that error because
it is a duplicate query or a query that would be
dropped. [GL #2982]
5935. [bug] Fix DiG lookup reference counting bug, which could
be observed in NSSEARCH mode. [GL #3478]
--- 9.18.6 released ---
5934. [func] Improve fetches-per-zone fetch limit logging to log
the final allowed and spilled values of the fetch
counters before the counter object gets destroyed.
[GL #3461]
5933. [port] Automatically disable RSASHA1 and NSEC3RSASHA1 in
named on Fedorda 33, Oracle Linux 9 and RHEL9 when
they are disabled by the security policy. [GL #3469]
5932. [bug] Fix rndc dumpdb -expired and always include expired
RRsets, not just for RBTDB_VIRTUAL time window.
[GL #3462]
5931. [bug] Fix DiG query error handling robustness in NSSEARCH
mode by making sure that udp_ready(), tcp_connected(),
and send_done() callbacks start the next query in chain
even if there is some kind of error with the previous
query. [GL #3419]
5930. [bug] Fix DiG query retry and fail-over bug in UDP mode.
Also simplify the overall retry and fail-over logic to
make it behave predictably, and always respect the
documented +retry/+tries count set by a command-line
option (or use the default values of 2 or 3
respectively). [GL #3407]
5929. [bug] The "max-zone-ttl" option in "dnssec-policy" was
not fully effective; it was used for timing key
rollovers but did not actually place an upper limit
on TTLs when loading a zone. This has been
corrected, and the documentation has been clarified
to indicate that the old "max-zone-ttl" zone option
is now ignored when "dnssec-policy" is in use.
[GL #2918]
5927. [bug] A race was possible in dns_dispatch_connect()
that could trigger an assertion failure if two
threads called it near-simultaneously. [GL #3456]
5926. [func] Handle transient TCP connect() EADDRINUSE failures
on FreeBSD (and possibly other BSDs) by trying three
times before giving up. [GL #3451]
5925. [bug] With a forwarder configured for all queries, resolution
failures encountered during DS chasing could trigger
assertion failures due to a logic bug in
resume_dslookup() that caused it to call
dns_resolver_createfetch() with an invalid name.
[GL #3439]
5924. [func] When it's necessary to use AXFR to respond to an
IXFR request, a message explaining the reason
is now logged at level info. [GL #2683]
5923. [bug] Fix inheritance for dnssec-policy when checking for
inline-signing. [GL #3438]
5922. [bug] Forwarding of UPDATE message could fail with the
introduction of netmgr. This has been fixed. [GL #3389]
5921. [test] Convert system tests to use a default DNSKEY algorithm
where the test is not DNSKEY algorithm specific.
[GL #3440]
--- 9.18.5 released ---
5917. [bug] Update ifconfig.sh script as is miscomputed interface
identifiers when destroying interfaces. [GL #3061]
5916. [bug] When resolving a name, don't give up immediately if an
authoritative server returns FORMERR; try the other
servers first. [GL #3152]
5915. [bug] Detect missing closing brace (}) and computational
overflows in $GENERATE directives. [GL #3429]
5914. [bug] When synth-from-dnssec generated a response using
records from a higher zone, it could unexpectedly prove
non-existance of records in a subordinate grafted-on
namespace. [GL #3402]
5911. [bug] Update HTTP listener settings on reconfiguration.
[GL #3415]
5910. [cleanup] Move built-in dnssec-policies into the defaultconf.
These are now printed with 'named -C'. [GL !6467]
5909. [bug] The server-side destination port was missing from dnstap
captures of client traffic. [GL #3309]
5908. [bug] Fix race conditions in route_connected(). [GL #3401]
5907. [bug] Fix a crash in dig NS search mode when one of the NS
server queries fail. [GL #3207]
5905. [bug] When the TCP connection would be closed/reset between
the connect/accept and the read, the uv_read_start()
return value would be unexpected and cause an assertion
failure. [GL #3400]
5904. [func] Changed dnssec-signzone -H default to 0 additional
NSEC3 iterations. [GL #3395]
5903. [bug] When named checks that the OPCODE in a response matches
that of the request, if there is a mismatch named logs
an error. Some of those error messages incorrectly
used RCODE instead of OPCODE to lookup the nemonic.
This has been corrected. [GL !6420]
5901. [bug] When processing a catalog zone member zone make sure
that there is no configured pre-existing forward-only
forward zone with that name. [GL #2506]
--- 9.18.4 released ---
5899. [func] Don't try to process DNSSEC-related and ZONEMD records
in catz. [GL #3380]
5896. [func] Add some more dnssec-policy checks to detect weird
policies. [GL #1611]
5895. [test] Add new set of unit test macros and move the unit
tests under single namespace in /tests/. [GL !6243]
5893. [func] Add TLS session resumption support to the client-side
TLS code. [GL !6274]
5891. [func] Key timing options for `dnssec-settime` and related
utilities now accept "UNSET" times as printed by
`dnssec-settime -p`. [GL #3361]
5890. [bug] When the fetches-per-server quota was adjusted
because of an authoritative server timing out more
or less frequently, it was incorrectly set to 1
rather than the intended value. This has been
fixed. [GL #3327]
5888. [bug] Only write key files if the dnssec-policy keymgr has
changed the metadata. [GL #3302]
5837. [func] Key timing options for `dnssec-keygen` and
`dnssec-settime` now accept times as printed by
`dnssec-settime -p`. [GL !2947]
--- 9.18.3 released ---
5886. [security] Fix a crash in DNS-over-HTTPS (DoH) code caused by
premature TLS stream socket object deletion.
(CVE-2022-1183) [GL #3216]
5885. [bug] RPZ NSIP and NSDNAME rule processing didn't handle stub
and static-stub zones at or above the query name. This
has now been addressed. [GL #3232]
5882. [contrib] Avoid name space collision in dlz modules by prefixing
functions with 'dlz_'. [GL !5778]
5880. [func] Add new named command-line option -C to print built-in
defaults. [GL #1326]
5879. [contrib] dlz: Add FALLTHROUGH and UNREACHABLE macros. [GL #3306]
5877. [func] Introduce the concept of broken catalog zones described
in the DNS catalog zones draft version 5 document.
[GL #3224]
5876. [func] Add DNS Extended Errors when stale answers are returned
from cache. [GL #2267]
5875. [bug] Fixed a deadlock that could occur if an rndc
connection arrived during the shutdown of network
interfaces. [GL #3272]
5873. [bug] Refactor the fctx_done() function to set fctx to
NULL after detaching, so that reference counting
errors will be easier to avoid. [GL #2969]
5872. [bug] udp_recv() in dispatch could trigger an INSIST when the
callback's result indicated success but the response
was canceled in the meantime. [GL #3300]
5866. [bug] Work around a jemalloc quirk which could trigger an
out-of-memory condition in named over time. [GL #3287]
5863. [bug] If there was a pending negative cache DS entry,
validations depending upon it could fail. [GL #3279]
5862. [bug] dig returned a 0 exit status on UDP connection failure.
[GL #3235]
5861. [func] Implement support for catalog zones change of ownership
(coo) mechanism described in the DNS catalog zones draft
version 5 document. [GL #3223]
5860. [func] Implement support for catalog zones options new syntax
based on catalog zones custom properties with "ext"
suffix described in the DNS catalog zones draft version
5 document. [GL #3222]
5859. [bug] Fix an assertion failure when using dig with +nssearch
and +tcp options by starting the next query in the
send_done() callback (like in the UDP mode) instead
of doing that recursively in start_tcp(). Also
ensure that queries interrupted while connecting
are detached properly. [GL #3144]
5858. [bug] Don't remove CDS/CDNSKEY DELETE records on zone sign
when using 'auto-dnssec maintain;'. [GL #2931]
5854. [func] Implement reference counting for TLS contexts and
allow reloading of TLS certificates on reconfiguration
without destroying the underlying TCP listener sockets
for TLS-based DNS transports. [GL #3122]
5849. [cleanup] Remove use of exclusive mode in ns_interfacemgr in
favor of rwlocked access to localhost and localnets
members of dns_aclenv_t structure. [GL #3229]
5842. [cleanup] Remove the task exclusive mode use in ns_clientmgr.
[GL #3230]
5839. [func] Add support for remote TLS certificates
verification, both to BIND and dig, making it possible
to implement Strict and Mutual TLS authentication,
as described in RFC 9103, Section 9.3. [GL #3163]
--- 9.18.2 released ---
5856. [bug] The "starting maxtime timer" message related to outgoing
zone transfers was incorrectly logged at the ERROR level
instead of DEBUG(1). [GL #3208]
5855. [bug] Ensure that zone maintenance queries have a retry limit.
[GL #3242]
5853. [bug] When using both the `+qr` and `+y` options `dig` could
crash if the connection to the first server was not
successful. [GL #3244]
5852. [func] Add new "reuseport" option to enable/disable load
balancing of sockets. [GL #3249]
5848. [bug] dig could hang in some cases involving multiple servers
in a lookup, when a request fails and the next one
refuses to start for some reason, for example if it was
an IPv4 mapped IPv6 address. [GL #3248]
5844. [bug] dig +nssearch was hanging until manually interrupted.
[GL #3145]
5843. [bug] When an UPDATE targets a zone that is not configured,
the requested zone name is now logged in the "not
authoritative" error message, so that it is easier to
track down problematic update clients. [GL #3209]
5838. [cleanup] When modifying a member zone in a catalog zone, and it
is detected that the zone exists and was not created by
the current catalog zone, distinguish the two cases when
the zone was not added by a catalog zone at all, and
when the zone was added by a different catalog zone,
and log a warning message accordingly. [GL #3221]
5836. [bug] Quote the dns64 prefix in error messages that complain
about problems with it, to avoid confusion with the
following dns64 ACLs. [GL #3210]
5834. [cleanup] C99 variable-length arrays are difficult to use safely,
so avoid them except in test code. [GL #3201]
5833. [bug] When encountering socket error while trying to initiate
a TCP connection to a server, dig could hang
indefinitely, when there were more servers to try.
[GL #3205]
5832. [bug] When timing-out or having other types of socket errors
during a query, dig wasn't trying to perform the lookup
using other servers, in case they exist. [GL #3128]
5831. [bug] When resending a UDP request in the result of a timeout,
the recv_done() function in dighost.c was prepending
the new query into the loookup's queries list instead
of inserting, which could cause an assertion failure
when the resent query's result was SERVFAIL. [GL #3020]
5828. [bug] Replace single TCP write timer with per-TCP write
timers. [GL #3200]
5825. [func] Set the minimum MTU on UDPv6 and TCPv6 sockets and
limit TCP maximum segment size (TCP_MAXSEG) to (1220)
for both TCPv4 and TCPv6 sockets. [GL #2201]
5824. [bug] Invalid dnssec-policy definitions were being accepted
where the defined keys did not cover both KSK and ZSK
roles for a given algorithm. This is now checked for
and the dnssec-policy is rejected if both roles are
not present for all algorithms in use. [GL #3142]
5823. [func] Replace hazard pointers based lock-free list with
locked-list based queue that's simpler and has no or
little performance impact. [GL #3180]
5822. [bug] When calling dns_dispatch_send(), attach/detach
dns_request_t object as the read callback could
be called before send callback dereferencing
dns_request_t object too early. [GL #3105]
5821. [bug] Fix query context management issues in the TCP part
of dig. [GL #3184]
--- 9.18.1 released ---
5820. [security] An assertion could occur in resume_dslookup() if the
fetch had been shut down earlier. (CVE-2022-0667)
[GL #3129]
5819. [security] Lookups involving a DNAME could trigger an INSIST when
"synth-from-dnssec" was enabled. (CVE-2022-0635)
[GL #3158]
5818. [security] A synchronous call to closehandle_cb() caused
isc__nm_process_sock_buffer() to be called recursively,
which in turn left TCP connections hanging in the
CLOSE_WAIT state blocking indefinitely when
out-of-order processing was disabled. (CVE-2022-0396)
[GL #3112]
5817. [security] The rules for acceptance of records into the cache
have been tightened to prevent the possibility of
poisoning if forwarders send records outside
the configured bailiwick. (CVE-2021-25220) [GL #2950]
5816. [bug] Make BIND compile with LibreSSL 3.5.0, as it was using
not very accurate pre-processor checks for using shims.
[GL #3172]
5815. [bug] If an oversized key name of a specific length was used
in the text form of an HTTP or SVBC record, an INSIST
could be triggered when parsing it. [GL #3175]
5814. [bug] The RecursClients statistics counter could underflow
in certain resolution scenarios. [GL #3147]
5812. [func] Drop the artificial limit on the number of queries
processed in a single TCP read callback. [GL #3141]
5811. [bug] Reimplement the maximum and idle timeouts for outgoing
zone transfers. [GL #1897]
5809. [bug] Reset client TCP connection when data received cannot
be parsed as a valid DNS request. [GL #3149]
5808. [bug] Certain TCP failures were not caught and handled
correctly by the dispatch manager, causing
connections to time out rather than returning
SERVFAIL. [GL #3133]
5807. [bug] Add a TCP "write" timer, and time out writing
connections after the "tcp-idle-timeout" period
has elapsed. [GL #3132]
5806. [bug] An error in checking the "blackhole" ACL could cause
DNS requests sent by named to fail if the
destination address or prefix was specifically
excluded from the ACL. [GL #3157]
5805. [func] The result of each resolver priming attempt is now
included in the "resolver priming query complete" log
message. [GL #3139]
5804. [func] Add a debug log message when starting and ending
the task exclusive mode. [GL #3137]
5803. [func] Use compile-time paths in the documentation.
[GL #2717]
5802. [test] Add system test to test engine_pkcs11. [GL !5727]
5801. [bug] Log "quota reached" message when hard quota
is reached when accepting a connection. [GL #3125]
5800. [func] Add ECS support to the DLZ interface. [GL #3082]
5799. [bug] Use L1 cache-line size detected at runtime. [GL #3108]
5798. [test] Add system test to test dnssec-keyfromlabel. [GL #3092]
5797. [bug] A failed view configuration during a named
reconfiguration procedure could cause inconsistencies
in BIND internal structures, causing a crash or other
unexpected errors. [GL #3060]
--- 9.18.0 released ---
5796. [bug] Ignore the invalid (<= 0) values returned
by the sysconf() check for the L1 cache line
size. [GL #3108]
5795. [bug] rndc could crash when interrupted by a signal
before receiving a response. [GL #3080]
5794. [func] Set the IPV6_V6ONLY on all IPv6 sockets to
restrict the IPv6 sockets to sending and
receiving IPv6 packets only. [GL #3093]
5793. [bug] Correctly detect and enable UDP recvmmsg support
in all versions of libuv that support it. [GL #3095]
5792. [bug] Don't schedule zone events on ISC_R_SHUTTINGDOWN
event failures. [GL #3084]
5791. [func] Remove workaround for servers returning FORMERR
when receiving NOTIFY query with SOA record in
ANSWER section. [GL #3086]
5790. [bug] The control channel was incorrectly looking for
ISC_R_CANCELED as a signal that the named is
shutting down. In the dispatch refactoring,
the result code returned from network manager
is now ISC_R_SHUTTINGDOWN. Change the control
channel code to use ISC_R_SHUTTINGDOWN result
code to detect named being shut down. [GL #3079]
--- 9.17.22 released ---
5789. [bug] Allow replacing expired zone signatures with
signatures created by the KSK. [GL #3049]
5788. [bug] An assertion could occur if a catalog zone event was
scheduled while the task manager was being shut
down. [GL #3074]
5787. [doc] Update 'auto-dnssec' documentation, it may only be
activated at zone level. [GL #3023]
5786. [bug] Defer detaching from zone->raw in zone_shutdown() if
the zone is in the process of being dumped to disk, to
ensure that the unsigned serial number information is
always written in the raw-format header of the signed
version on an inline-signed zone. [GL #3071]
5785. [bug] named could leak memory when two dnssec-policy clauses
had the same name. named failed to log this error.
[GL #3085]
5784. [func] Implement TLS-contexts reuse. Reusing the
previously created TLS context objects can reduce
initialisation time for some configurations and enables
TLS session resumption for incoming zone transfers over
TLS (XoT). [GL #3067]
5783. [func] named is now able to log TLS pre-master secrets for
debugging purposes. This requires setting the
SSLKEYLOGFILE environment variable appropriately.
[GL #2723]
5782. [func] Use ECDSA P-256 instead of a 4096-bit RSA when
generating ephemeral key and certificate for the
'tls ephemeral' configuration. [GL #2264]
5781. [bug] Make BIND work with OpenSSL 3.0.1 as it is now
enforcing minimum buffer lengths in EVP_MAC_final and
hence EVP_DigestSignFinal. rndc and TSIG at a minimum
were broken by this change. [GL #3057]
5780. [bug] The Linux kernel may send netlink messages
indicating that network interfaces have changed
when they have not. This caused frequent unnecessary
re-scans of the interfaces. Netlink messages now
only trigger re-scanning if a new address is seen
or an existing address is removed. [GL #3055]
5779. [test] Drop cppcheck suppressions and workarounds. [GL #2886]
5778. [bug] Destroyed TLS contexts could have been used after a
reconfiguration, making BIND unable to serve queries
over TLS and HTTPS. [GL #3053]
5777. [bug] TCP connections could hang after receiving
non-matching responses. [GL #3042]
5776. [bug] Add a missing isc_condition_destroy() for nmsocket
condition variable and add missing isc_mutex_destroy()
for nmworker lock. [GL #3051]
--- 9.17.21 released ---
5775. [bug] Added a timer in the resolver to kill fetches that
have deadlocked as a result of dependency loops
with the ADB or the validator. This condition is
now logged with the message "shut down hung fetch
while resolving '<name>/<type>'". [GL #3040]
5774. [func] Restore NSEC Aggressive Cache ("synth-from-dnssec")
as active by default. It is limited to NSEC only
and by default ignores NSEC records with next name
in form \000.domain. [GL #1265]
5773. [func] Change the message when accepting TCP connection has
failed to say "Accepting TCP connection failed" and
change the log level for ISC_R_NOTCONNECTED, ISC_R_QUOTA
and ISC_R_SOFTQUOTA results codes from ERROR to INFO.
[GL #2700]
5772. [bug] The resolver could hang on shutdown due to dispatch
resources not being cleaned up when a TCP connection
was reset. [GL #3026]
5771. [bug] Use idn2 UseSTD3ASCIIRules=false to disable additional
unicode validity checks because enabling the additional
checks would break valid domain names that contains
non-alphanumerical characters such as underscore
character (_) or wildcard (*). This reverts change