forked from isc-projects/bind9
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathCHANGES
18767 lines (13019 loc) · 625 KB
/
CHANGES
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
5587. [bug] A standalone libtool script no longer needs to be
present in PATH in order to build BIND 9 from a source
tarball prepared using "make dist". [GL #2504]
5586. [bug] An invalid direction field in a LOC record resulted in
an INSIST failure. [GL #2499]
5585. [func] Implementations of memory contexts and memory pools were
refactored to reduce lock contention for shared memory
contexts by replacing mutexes with atomic operations.
The internal memory allocator was simplified so that it
is only a thin wrapper around the system allocator.
Since this change makes the "-M external" named option
redundant, the latter was removed. [GL #2433]
5584. [bug] Rollback setting IP_DONTFRAG option on the UDP sockets.
[GL #2487]
5583. [func] Changes to DoH configuration syntax:
- When "http" is specified in "listen-on" or
"listen-on-v6" statements, "tls" must also now
be specified. If an unencrypted connection is
desired (for example, when running behind a
reverse proxy), use "tls none".
- "http default" can how be specified in "listen-on"
and "listen-on-v6" statements to use the default
HTTP endpoint, "/dns-query". It is no longer
necessary to include an "http" statement in
named.conf unless overriding this value.
[GL #2472]
5582. [bug] BIND 9 failed to build when static OpenSSL libraries
were used and the *.pc files for libssl and/or libcrypto
were unavailable. This has been fixed by ensuring the
correct linking order for libssl and libcrypto is always
used. [GL #2402]
5581. [bug] Fix memory leak happening when inline-signed zones
were added to the configuration followed by a
reconfiguration of named. [GL #2041]
5580. [test] The system test framework no longer differentiates
between SKIPPED and UNTESTED system test results. Any
system test which is not run is now marked as SKIPPED.
[GL !4517]
5579. [bug] If an invalid key name (e.g. "a..b") is
specified in an primaries list in named.conf
the wrong size is passed to isc_mem_put
resulting in the returned memory being put
on the wrong freed list. [GL #2460]
--- 9.17.10 released ---
5578. [protocol] Make "check-names" accept A records below "_spf",
"_spf_rate", and "_spf_verify" labels in order to cater
for the "exists" SPF mechanism specified in RFC 7208
section 5.7 and appendix D.1. [GL #2377]
5577. [bug] Fix the "three is a crowd" key rollover bug in KASP by
correctly implementing Equation (2) of the "Flexible and
Robust Key Rollover" paper. [GL #2375]
5576. [experimental] Initial server-side implementation of DNS-over-HTTPS
(DoH). Support for both TLS-encrypted and unencrypted
HTTP/2 connections has been added to the network manager
and integrated into named. (Note: there is currently no
client-side support for DNS-over-HTTPS; this will be
added to dig in a future release.) [GL #1144]
5575. [bug] When migrating to KASP, BIND 9 considered keys with the
"Inactive" and/or "Delete" timing metadata to be
possible active keys. This has been fixed. [GL #2406]
5574. [func] Incoming zone transfers can now use TLS. Addresses in a
"primaries" list take an optional "tls" argument,
specifying either a previously configured "tls" block or
"ephemeral"; SOA queries and zone transfer requests are
then sent via TLS. [GL #2392]
5573. [func] When serve-stale is enabled and stale data is available,
named now returns stale answers upon encountering any
unexpected error in the query resolution process.
However, the "stale-refresh-time" window is still only
started upon a timeout. [GL #2434]
5572. [bug] Address potential double free in generatexml().
[GL #2420]
5571. [bug] named failed to start when its configuration included a
zone with a non-builtin "allow-update" ACL attached.
[GL #2413]
5570. [bug] Improve performance of the DNSSEC verification code by
reducing the number of repeated calls to
dns_dnssec_keyfromrdata(). [GL #2073]
5569. [bug] Emit useful error message when "rndc retransfer" is
applied to a zone of inappropriate type. [GL #2342]
5568. [bug] Fixed a crash in "dnssec-keyfromlabel" when using ECDSA
keys. [GL #2178]
5567. [bug] Dig now reports unknown dash options while pre-parsing
the options. This prevents "-multi" instead of "+multi"
from reporting memory usage before ending option parsing
with "Invalid option: -lti". [GL #2403]
5566. [func] Add "stale-answer-client-timeout" option, which is the
amount of time a recursive resolver waits before
attempting to answer the query using stale data from
cache. [GL #2247]
5565. [func] The SONAMEs for BIND 9 libraries now include the current
BIND 9 version number, in an effort to tightly couple
internal libraries with a specific release. [GL #2387]
5564. [cleanup] Network manager's TLSDNS module was refactored to use
libuv and libssl directly instead of a stack of TCP/TLS
sockets. [GL #2335]
5563. [cleanup] Changed several obsolete configuration options to
ancient, making them fatal errors. Also cleaned up the
number of clause flags in the configuration parser.
[GL #1086]
5562. [placeholder]
5561. [bug] KASP incorrectly set signature validity to the value of
the DNSKEY signature validity. This is now fixed.
[GL #2383]
5560. [func] The default value of "max-stale-ttl" has been changed
from 12 hours to 1 day and the default value of
"stale-answer-ttl" has been changed from 1 second to 30
seconds, following RFC 8767 recommendations. [GL #2248]
--- 9.17.9 released ---
5559. [bug] The --with-maxminddb=PATH form of the build-time option
enabling support for libmaxminddb was not working
correctly. This has been fixed. [GL #2366]
5558. [bug] Asynchronous hook modules could trigger an assertion
failure when the fetch handle was detached too late.
Thanks to Jinmei Tatuya at Infoblox. [GL #2379]
5557. [bug] Prevent RBTDB instances from being destroyed by multiple
threads at the same time. [GL #2317]
5556. [bug] Further tweak newline printing in dnssec-signzone and
dnssec-verify. [GL #2359]
5555. [placeholder]
5554. [bug] dnssec-signzone and dnssec-verify were missing newlines
between log messages. [GL #2359]
5553. [bug] When reconfiguring named, removing "auto-dnssec" did not
turn off DNSSEC maintenance. [GL #2341]
5552. [func] When switching to "dnssec-policy none;", named now
permits a safe transition to insecure mode and publishes
the CDS and CDNSKEY DELETE records, as described in RFC
8078. [GL #1750]
5551. [bug] named no longer attempts to assign threads to CPUs
outside the CPU affinity set. Thanks to Ole Bjørn
Hessen. [GL #2245]
5550. [func] dnssec-signzone and named now log a warning when falling
back to the "increment" SOA serial method. [GL #2058]
5549. [protocol] ipv4only.arpa is now served when DNS64 is configured.
[GL #385]
5548. [placeholder]
5547. [placeholder]
--- 9.17.8 released ---
5546. [placeholder]
5545. [func] OS support for load-balanced sockets is no longer
required to receive incoming queries in multiple netmgr
threads. [GL #2137]
5544. [func] Restore the default value of "nocookie-udp-size" to 4096
bytes. [GL #2250]
5543. [bug] Fix UDP performance issues caused by making netmgr
callbacks asynchronous-only. [GL #2320]
5542. [bug] Refactor netmgr. [GL #1920] [GL #2034] [GL #2061]
[GL #2194] [GL #2221] [GL #2266] [GL #2283] [GL #2318]
[GL #2321]
5541. [func] Adjust the "max-recursion-queries" default from 75 to
100. [GL #2305]
5540. [port] Fix building with native PKCS#11 support for AEP Keyper.
[GL #2315]
5539. [bug] Tighten handling of missing DNS COOKIE responses over
UDP by falling back to TCP. [GL #2275]
5538. [func] Add NSEC3 support to KASP. A new option for
"dnssec-policy", "nsec3param", can be used to set the
desired NSEC3 parameters. NSEC3 salt collisions are
automatically prevented during resalting. Salt
generation is now logged with zone context. [GL #1620]
5537. [func] The query plugin mechanism has been extended
to support asynchronous operations. For example, a
plugin can now trigger recursion and resume
processing when it is complete. Thanks to Jinmei
Tatuya at Infoblox. [GL #2141]
5536. [func] Dig can now report the DNS64 prefixes in use
(+dns64prefix). [GL #1154]
5535. [bug] dig/nslookup/host could crash on shutdown after an
interrupt. [GL #2287] [GL #2288]
5534. [bug] The CNAME synthesized from a DNAME was incorrectly
followed when the QTYPE was CNAME or ANY. [GL #2280]
--- 9.17.7 released ---
5533. [func] Add the "stale-refresh-time" option, a time window that
starts after a failed lookup, during which a stale RRset
is served directly from cache before a new attempt to
refresh it is made. [GL #2066]
5532. [cleanup] Unused header files were removed:
bin/rndc/include/rndc/os.h, lib/isc/timer_p.h,
lib/isccfg/include/isccfg/dnsconf.h and code related
to those files. [GL #1913]
5531. [func] Add support for DNS over TLS (DoT) to dig and named.
dig output now includes the transport protocol used.
[GL #1816] [GL #1840]
5530. [bug] dnstap did not capture responses to forwarded UPDATE
requests. [GL #2252]
5529. [func] The network manager API is now used by named to send
zone transfer requests. [GL #2016]
5528. [func] Convert dig, host, and nslookup to use the network
manager API. As a side effect of this change, "dig
+unexpected" no longer works, and has been disabled.
[GL #2140]
5527. [bug] A NULL pointer dereference occurred when creating an NTA
recheck query failed. [GL #2244]
5526. [bug] Fix a race/NULL dereference in TCPDNS read. [GL #2227]
5525. [placeholder]
5524. [func] Added functionality to the network manager to support
outgoing DNS queries in addition to incoming ones.
[GL #2235]
5523. [bug] The initial lookup in a zone transitioning to/from a
signed state could fail if the DNSKEY RRset was not
found. [GL #2236]
5522. [bug] Fixed a race/NULL dereference in TCPDNS send. [GL #2227]
5521. [func] All use of libltdl was dropped. libuv's shared library
handling interface is now used instead. [GL !4278]
5520. [bug] Fixed a number of shutdown races, reference counting
errors, and spurious log messages that could occur
in the network manager. [GL #2221]
5519. [cleanup] Unused source code was removed: lib/dns/dbtable.c,
lib/dns/portlist.c, lib/isc/bufferlist.c, and code
related to those files. [GL #2060]
5518. [bug] Stub zones now work correctly with primary servers using
"minimal-responses yes". [GL #1736]
5517. [bug] Do not treat UV_EOF as a TCP4RecvErr or a TCP6RecvErr.
[GL #2208]
--- 9.17.6 released ---
5516. [func] The default EDNS buffer size has been changed from 4096
to 1232 bytes, the EDNS buffer size probing has been
removed, and named now sets the DF (Don't Fragment) flag
on outgoing UDP packets. [GL #2183]
5515. [func] Add 'rndc dnssec -rollover' command to trigger a manual
rollover for a specific key. [GL #1749]
5514. [bug] Fix KASP expected key size for Ed25519 and Ed448.
[GL #2171]
5513. [doc] The ARM section describing the "rrset-order" statement
was rewritten to make it unambiguous and up-to-date with
the source code. [GL #2139]
5512. [bug] "rrset-order" rules using "order none" were causing
named to crash despite named-checkconf treating them as
valid. [GL #2139]
5511. [bug] 'dig -u +yaml' failed to display timestamps to the
microsecond. [GL #2190]
5510. [bug] Implement the attach/detach semantics for dns_message_t
to fix a data race in accessing an already-destroyed
fctx->rmessage. [GL #2124]
5509. [bug] filter-aaaa: named crashed upon shutdown if it was in
the process of recursing for A RRsets. [GL #1040]
5508. [func] Added new parameter "-expired" for "rndc dumpdb" that
also prints expired RRsets (awaiting cleanup) to the
dump file. [GL #1870]
5507. [bug] Named could compute incorrect SIG(0) responses.
[GL #2109]
5506. [bug] Properly handle failed sysconf() calls, so we don't
report invalid memory size. [GL #2166]
5505. [bug] Updating contents of a mixed-case RPZ could cause some
rules to be ignored. [GL #2169]
5504. [func] The "glue-cache" option has been marked as deprecated.
The glue cache feature will be permanently enabled in a
future release. [GL #2146]
5503. [bug] Cleaned up reference counting of network manager
handles, now using isc_nmhandle_attach() and _detach()
instead of _ref() and _unref(). [GL #2122]
--- 9.17.5 released ---
5502. [func] 'dig +bufsize=0' no longer disables EDNS. [GL #2054]
5501. [func] Log CDS/CDNSKEY publication. [GL #1748]
5500. [bug] Fix (non-)publication of CDS and CDNSKEY records.
[GL #2103]
5499. [func] Add '-P ds' and '-D ds' arguments to dnssec-settime.
[GL #1748]
5498. [test] The --with-gperftools-profiler configure option was
removed. [GL !4045]
5497. [placeholder]
5496. [bug] Address a TSAN report by ensuring each rate limiter
object holds a reference to its task. [GL #2081]
5495. [bug] With query minimization enabled, named failed to
resolve ip6.arpa. names that had extra labels to the
left of the IPv6 part. [GL #1847]
5494. [bug] Silence the EPROTO syslog message on older systems.
[GL #1928]
5493. [bug] Fix off-by-one error when calculating new hash table
size. [GL #2104]
5492. [bug] Tighten LOC parsing to reject a period (".") and/or "m"
as a value. Fix handling of negative altitudes which are
not whole meters. [GL #2074]
5491. [bug] rbtversion->glue_table_size could be read without the
appropriate lock being held. [GL #2080]
5490. [func] Refactor readline support to use pkg-config and add
support for the editline library. [GL !3942]
5489. [bug] Named erroneously accepted certain invalid resource
records that were incorrectly processed after
subsequently being written to disk and loaded back, as
the wire format differed. Such records include: CERT,
IPSECKEY, NSEC3, NSEC3PARAM, NXT, SIG, TLSA, WKS, and
X25. [GL !3953]
5488. [bug] NTA code needed to have a weak reference on its
associated view to prevent the latter from being deleted
while NTA tests were being performed. [GL #2067]
5487. [cleanup] Update managed keys log messages to be less confusing.
[GL #2027]
5486. [func] Add 'rndc dnssec -checkds' command, which signals to
named that the DS record for a given zone or key has
been updated in the parent zone. [GL #1613]
--- 9.17.4 released ---
5485. [placeholder]
5484. [func] Expire zero TTL records quickly rather than using them
for stale answers. [GL #1829]
5483. [func] Keeping "stale" answers in cache has been disabled by
default and can be re-enabled with a new configuration
option "stale-cache-enable". [GL #1712]
5482. [bug] If the Duplicate Address Detection (DAD) mechanism had
not yet finished after adding a new IPv6 address to the
system, BIND 9 would fail to bind to IPv6 addresses in a
tentative state. [GL #2038]
5481. [security] "update-policy" rules of type "subdomain" were
incorrectly treated as "zonesub" rules, which allowed
keys used in "subdomain" rules to update names outside
of the specified subdomains. The problem was fixed by
making sure "subdomain" rules are again processed as
described in the ARM. (CVE-2020-8624) [GL #2055]
5480. [security] When BIND 9 was compiled with native PKCS#11 support, it
was possible to trigger an assertion failure in code
determining the number of bits in the PKCS#11 RSA public
key with a specially crafted packet. (CVE-2020-8623)
[GL #2037]
5479. [security] named could crash in certain query resolution scenarios
where QNAME minimization and forwarding were both
enabled. (CVE-2020-8621) [GL #1997]
5478. [security] It was possible to trigger an assertion failure by
sending a specially crafted large TCP DNS message.
(CVE-2020-8620) [GL #1996]
5477. [bug] The idle timeout for connected TCP sockets, which was
previously set to a high fixed value, is now derived
from the client query processing timeout configured for
a resolver. [GL #2024]
5476. [security] It was possible to trigger an assertion failure when
verifying the response to a TSIG-signed request.
(CVE-2020-8622) [GL #2028]
5475. [bug] Wildcard RPZ passthru rules could incorrectly be
overridden by other rules that were loaded from RPZ
zones which appeared later in the "response-policy"
statement. This has been fixed. [GL #1619]
5474. [bug] dns_rdata_hip_next() failed to return ISC_R_NOMORE
when it should have. [GL !3880]
5473. [func] The RBT hash table implementation has been changed
to use a faster hash function (HalfSipHash2-4) and
Fibonacci hashing for better distribution. Setting
"max-cache-size" now preallocates a fixed-size hash
table so that rehashing does not cause resolution
brownouts while the hash table is grown. [GL #1775]
5472. [func] The statistics channel has been updated to use the
new network manager. [GL #2022]
5471. [bug] The introduction of KASP support inadvertently caused
the second field of "sig-validity-interval" to always be
calculated in hours, even in cases when it should have
been calculated in days. This has been fixed. (Thanks to
Tony Finch.) [GL !3735]
5470. [port] gsskrb5_register_acceptor_identity() is now only called
if gssapi_krb5.h is present. [GL #1995]
5469. [port] On illumos, a constant called SEC is already defined in
<sys/time.h>, which conflicts with an identically named
constant in libbind9. This conflict has been resolved.
[GL #1993]
5468. [bug] Addressed potential double unlock in process_fd().
[GL #2005]
5467. [func] The control channel and the rndc utility have been
updated to use the new network manager. To support
this, the network manager was updated to enable
the initiation of client TCP connections. Its
internal reference counting has been refactored.
Note: As a side effect of this change, rndc cannot
currently be used with UNIX-domain sockets, and its
default timeout has changed from 60 seconds to 30.
These will be addressed in a future release.
[GL #1759]
5466. [bug] Addressed an error in recursive clients stats reporting.
[GL #1719]
5465. [func] Added fallback to built-in trust-anchors, managed-keys,
or trusted-keys if the bindkeys-file (bind.keys) cannot
be parsed. [GL #1235]
5464. [bug] Requesting more than 128 files to be saved when rolling
dnstap log files caused a buffer overflow. This has been
fixed. [GL #1989]
5463. [placeholder]
5462. [bug] Move LMDB locking from LMDB itself to named. [GL #1976]
5461. [bug] The STALE rdataset header attribute was updated while
the write lock was not being held, leading to incorrect
statistics. The header attributes are now converted to
use atomic operations. [GL #1475]
5460. [cleanup] tsig-keygen was previously an alias for
ddns-confgen and was documented in the ddns-confgen
man page. This has been reversed; tsig-keygen is
now the primary name. [GL #1998]
5459. [bug] Fixed bad isc_mem_put() size when an invalid type was
specified in an "update-policy" rule. [GL #1990]
--- 9.17.3 released ---
5458. [bug] Prevent a theoretically possible NULL dereference caused
by a data race between zone_maintenance() and
dns_zone_setview_helper(). [GL #1627]
5457. [placeholder]
5456. [func] Added "primaries" as a synonym for "masters" in
named.conf, and "primary-only" as a synonym for
"master-only" in the parameters to "notify", to bring
terminology up-to-date with RFC 8499. [GL #1948]
5455. [bug] named could crash when cleaning dead nodes in
lib/dns/rbtdb.c that were being reused. [GL #1968]
5454. [bug] Address a startup crash that occurred when the server
was under load and the root zone had not yet been
loaded. [GL #1862]
5453. [bug] named crashed on shutdown when a new rndc connection was
received during shutdown. [GL #1747]
5452. [bug] The "blackhole" ACL was accidentally disabled for client
queries. [GL #1936]
5451. [func] Add 'rndc dnssec -status' command. [GL #1612]
5450. [placeholder]
5449. [bug] Fix a socket shutdown race in netmgr udp. [GL #1938]
5448. [bug] Fix a race condition in isc__nm_tcpdns_send().
[GL #1937]
5447. [bug] IPv6 addresses ending in "::" could break YAML
parsing. A "0" is now appended to such addresses
in YAML output from dig, mdig, delv, and dnstap-read.
[GL #1952]
5446. [bug] The validator could fail to accept a properly signed
RRset if an unsupported algorithm appeared earlier in
the DNSKEY RRset than a supported algorithm. It could
also stop if it detected a malformed public key.
[GL #1689]
5445. [cleanup] Disable and disallow static linking. [GL #1933]
5444. [bug] 'rndc dnstap -roll <value>' did not limit the number of
saved files to <value>. [GL !3728]
5443. [bug] The "primary" and "secondary" keywords, when used
as parameters for "check-names", were not
processed correctly and were being ignored. [GL #1949]
5442. [func] Add support for outgoing TCP connections in netmgr.
[GL #1958]
5441. [placeholder]
5440. [placeholder]
5439. [bug] The DS RRset returned by dns_keynode_dsset() was used in
a non-thread-safe manner. [GL #1926]
--- 9.17.2 released ---
5438. [bug] Fix a race in TCP accepting code. [GL #1930]
5437. [bug] Fix a data race in lib/dns/resolver.c:log_formerr().
[GL #1808]
5436. [security] It was possible to trigger an INSIST when determining
whether a record would fit into a TCP message buffer.
(CVE-2020-8618) [GL #1850]
5435. [tests] Add RFC 4592 responses examples to the wildcard system
test. [GL #1718]
5434. [security] It was possible to trigger an INSIST in
lib/dns/rbtdb.c:new_reference() with a particular zone
content and query patterns. (CVE-2020-8619) [GL #1111]
[GL #1718]
5433. [placeholder]
5432. [bug] Check the question section when processing AXFR, IXFR,
and SOA replies when transferring a zone in. [GL #1683]
5431. [func] Reject DS records at the zone apex when loading
master files. Log but otherwise ignore attempts to
add DS records at the zone apex via UPDATE. [GL #1798]
5430. [doc] Update docs - with netmgr, a separate listening socket
is created for each IPv6 interface (just as with IPv4).
[GL #1782]
5429. [cleanup] Move BIND binaries which are neither daemons nor
administrative programs to $bindir. [GL #1724]
5428. [bug] Clean up GSSAPI resources in nsupdate only after taskmgr
has been destroyed. Thanks to Petr Menšík. [GL !3316]
5427. [placeholder]
5426. [bug] Don't abort() when setting SO_INCOMING_CPU on the socket
fails. [GL #1911]
5425. [func] The default value of "max-stale-ttl" has been changed
from 1 week to 12 hours. [GL #1877]
5424. [bug] With KASP, when creating a successor key, the "goal"
state of the current active key (predecessor) was not
changed and thus never removed from the zone. [GL #1846]
5423. [bug] Fix a bug in keymgr_key_has_successor(): it incorrectly
returned true if any other key in the keyring had a
successor. [GL #1845]
5422. [bug] When using dnssec-policy, print correct key timing
metadata. [GL #1843]
5421. [bug] Fix a race that could cause named to crash when looking
up the nodename of an RBT node if the tree was modified.
[GL #1857]
5420. [bug] Add missing isc_{mutex,conditional}_destroy() calls
that caused a memory leak on FreeBSD. [GL #1893]
5419. [func] Add new dig command line option, "+qid=<num>", which
allows the query ID to be set to an arbitrary value.
Add a new ./configure option, --enable-singletrace,
which allows trace logging of a single query when QID is
set to 0. [GL #1851]
5418. [bug] delv failed to parse deprecated trusted-keys-style
trust anchors. [GL #1860]
5417. [cleanup] The code determining the advertised UDP buffer size in
outgoing EDNS queries has been refactored to improve its
clarity. [GL #1868]
5416. [bug] Fix a lock order inversion in lib/isc/unix/socket.c.
[GL #1859]
5415. [test] Address race in dnssec system test that led to
test failures. [GL #1852]
5414. [test] Adjust time allowed for journal truncation to occur
in nsupdate system test to avoid test failure.
[GL #1855]
5413. [test] Address race in autosign system test that led to
test failures. [GL #1852]
5412. [bug] 'provide-ixfr no;' failed to return up-to-date responses
when the serial was greater than or equal to the
current serial. [GL #1714]
5411. [cleanup] TCP accept code has been refactored to use a single
accept() and pass the accepted socket to child threads
for processing. [GL !3320]
5410. [func] Add the ability to specify per-type record count limits,
which are enforced when adding records via UPDATE, in an
"update-policy" statement. [GL #1657]
5409. [performance] When looking up NSEC3 data in a zone database, skip the
check for empty non-terminal nodes; the NSEC3 tree does
not have any. [GL #1834]
5408. [protocol] Print Extended DNS Errors if present in OPT record.
[GL #1835]
5407. [func] Zone timers are now exported via statistics channel.
Thanks to Paul Frieden, Verizon Media. [GL #1232]
5406. [func] Add a new logging category, "rpz-passthru", which allows
RPZ passthru actions to be logged in a separate channel.
[GL #54]
5405. [bug] 'named-checkconf -p' could include spurious text in
server-addresses statements due to an uninitialized DSCP
value. [GL #1812]
5404. [bug] 'named-checkconf -z' could incorrectly indicate
success if errors were found in one view but not in a
subsequent one. [GL #1807]
5403. [func] Do not set UDP receive/send buffer sizes - use system
defaults. [GL #1713]
5402. [bug] On FreeBSD, use SO_REUSEPORT_LB instead of SO_REUSEPORT.
Enable use of SO_REUSEADDR on all platforms which
support it. [GL !3365]
5401. [bug] The number of input queues allocated during dnstap
initialization was too low, which could prevent some
dnstap data from being logged. [GL #1795]
5400. [func] Add engine support to OpenSSL EdDSA implementation.
[GL #1763]
5399. [func] Add engine support to OpenSSL ECDSA implementation.
[GL #1534]
5398. [bug] Named could fail to restart if a zone with a double
quote (") in its name was added with 'rndc addzone'.
[GL #1695]
5397. [func] Update PKCS#11 EdDSA implementation to PKCS#11 v3.0.
Thanks to Aaron Thompson. [GL !3326]
5396. [func] When necessary (i.e. in libuv >= 1.37), use the
UV_UDP_RECVMMSG flag to enable recvmmsg() support in
libuv. [GL #1797]
5395. [security] Further limit the number of queries that can be
triggered from a request. Root and TLD servers
are no longer exempt from max-recursion-queries.
Fetches for missing name server address records
are limited to 4 for any domain. (CVE-2020-8616)
[GL #1388]
5394. [cleanup] Named formerly attempted to change the effective UID and
GID in named_os_openfile(), which could trigger a
spurious log message if they were already set to the
desired values. This has been fixed. [GL #1042]
[GL #1090]
5393. [cleanup] Unused and/or redundant APIs were removed from libirs.
[GL #1758]
5392. [bug] It was possible for named to crash during shutdown
or reconfiguration if an RPZ zone was still being
updated. [GL #1779]
5391. [func] The BIND 9 build system has been changed to use a
typical autoconf+automake+libtool stack. When building
from the Git repository, run "autoreconf -fi" first.
[GL #4]
5390. [security] Replaying a TSIG BADTIME response as a request could
trigger an assertion failure. (CVE-2020-8617)
[GL #1703]
5389. [bug] Finish PKCS#11 code cleanup, fix a couple of smaller
bugs and use PKCS#11 v3.0 EdDSA macros and constants.
Thanks to Aaron Thompson. [GL !3391]
5388. [func] Reject AXFR streams where the message ID is not
consistent. [GL #1674]
5387. [placeholder]
5386. [cleanup] Address Coverity warnings in lib/dns/keymgr.c.
[GL #1737]
5385. [func] Make ISC rwlock implementation the default again.
[GL #1753]
5384. [bug] With "dnssec-policy" in effect, "inline-signing" was
implicitly set to "yes". Now "inline-signing" is only
set to "yes" if the zone is not dynamic. [GL #1709]
--- 9.17.1 released ---
5383. [func] Add a quota attach function with a callback and clean up
the isc_quota API. [GL !3280]
5382. [bug] Use clock_gettime() instead of gettimeofday() for
isc_stdtime() function. [GL #1679]
5381. [bug] Fix logging API data race by adding rwlock and caching
logging levels in stdatomic variables to restore
performance to original levels. [GL #1675] [GL #1717]
5380. [contrib] Fix building MySQL DLZ modules against MySQL 8
libraries. [GL #1678]
5379. [placeholder]
5378. [bug] Receiving invalid DNS data was triggering an assertion
failure in nslookup. [GL #1652]
5377. [placeholder]
5376. [bug] Fix ineffective DNS rebinding protection when BIND is
configured as a forwarding DNS server. Thanks to Tobias
Klein. [GL #1574]
5375. [test] Fix timing issues in the "kasp" system test. [GL #1669]
5374. [bug] Statistics counters tracking recursive clients and
active connections could underflow. [GL #1087]
5373. [bug] Collecting statistics for DNSSEC signing operations
(change 5254) caused an array of significant size (over
100 kB) to be allocated for each configured zone. Each
of these arrays is tracking all possible key IDs; this
could trigger an out-of-memory condition on servers with
a high enough number of zones configured. Fixed by
tracking up to four keys per zone and rotating counters
when keys are replaced. This fixes the immediate problem
of high memory usage, but should be improved in a future
release by growing or shrinking the number of keys to
track upon key rollover events. [GL #1179]
5372. [bug] Fix migration from existing DNSSEC key files
("auto-dnssec maintain") to "dnssec-policy". [GL #1706]
5371. [bug] Improve incremental updates of the RPZ summary
database to reduce delays that could occur when
a policy zone update included a large number of
record deletions. [GL #1447]
5370. [bug] Deactivation of a netmgr handle associated with a
socket could be skipped in some circumstances.
Fixed by deactivating the netmgr handle before
scheduling the asynchronous close routine. [GL #1700]
5369. [func] Add the ability to specify whether to wait for
nameserver domain names to be looked up, with a new RPZ
modifying directive 'nsdname-wait-recurse'. [GL #1138]
5368. [bug] Named failed to restart if 'rndc addzone' names
contained special characters (e.g. '/'). [GL #1655]
5367. [placeholder]
--- 9.17.0 released ---
5366. [bug] Fix a race condition with the keymgr when the same
zone plus dnssec-policy is configured in multiple
views. [GL #1653]
5365. [bug] Algorithm rollover was stuck on submitting DS
because keymgr thought it would move to an invalid
state. Fixed by checking the current key against
the desired state, not the existing state. [GL #1626]
5364. [bug] Algorithm rollover waited too long before introducing
zone signatures. It waited to make sure all signatures
were regenerated, but when introducing a new algorithm,
all signatures are regenerated immediately. Only
add the sign delay if there is a predecessor key.
[GL #1625]
5363. [bug] When changing a dnssec-policy, existing keys with
properties that no longer match were not being retired.
[GL #1624]
5362. [func] Limit the size of IXFR responses so that AXFR will
be used instead if it would be smaller. This is
controlled by the "max-ixfr-ratio" option, which
is a percentage representing the ratio of IXFR size
to the size of the entire zone. This value cannot
exceed 100%, which is the default. [GL #1515]
5361. [bug] named might not accept new connections after
hitting tcp-clients quota. [GL #1643]
5360. [bug] delv could fail to load trust anchors in DNSKEY
format. [GL #1647]
5359. [func] "rndc nta -d" and "rndc secroots" now include
"validate-except" entries when listing negative
trust anchors. These are indicated by the keyword
"permanent" in place of an expiry date. [GL #1532]
5358. [bug] Inline master zones whose master files were touched
but otherwise unchanged and were subsequently reloaded
may have stopped re-signing. [GL !3135]
5357. [bug] Newly added RRSIG records with expiry times before
the previous earliest expiry times might not be
re-signed in time. This was a side effect of 5315.
[GL !3137]
5356. [func] Update dnssec-policy configuration statements:
- Rename "zone-max-ttl" dnssec-policy option to
"max-zone-ttl" for consistency with the existing
zone option.
- Allow for "lifetime unlimited" as a synonym for
"lifetime PT0S".
- Make "key-directory" optional.
- Warn if specifying a key length does not make
sense; fail if key length is out of range for
the algorithm.
- Allow use of mnemonics when specifying key
algorithm (e.g. "rsasha256", "ecdsa384", etc.).
- Make ISO 8601 durations case-insensitive.
[GL #1598]
5355. [func] What was set with --with-tuning=large option in
older BIND9 versions is now a default, and
a --with-tuning=small option was added for small
(e.g. OpenWRT) systems. [GL !2989]
5354. [bug] dnssec-policy created new KSK keys for zones in the
initial stage of signing (with the DS not yet in the
rumoured or omnipresent states). Fix by checking the
key goals rather than the active state when determining
whether new keys are needed. [GL #1593]
5353. [doc] Document port and dscp parameters in forwarders
configuration option. [GL #914]
5352. [bug] Correctly handle catalog zone entries containing
characters that aren't legal in filenames. [GL #1592]
5351. [bug] CDS / CDNSKEY consistency checks failed to handle
removal records. [GL #1554]
5350. [bug] When a view was configured with class CHAOS, the
server could crash while processing a query for a
non-existent record. [GL #1540]
5349. [bug] Fix a race in task_pause/unpause. [GL #1571]
5348. [bug] dnssec-settime -Psync was not being honoured.
[GL !2893]
--- 9.15.8 released ---
5347. [bug] Fixed a bug that could cause an intermittent crash
in validator.c when validating a negative cache
entry. [GL #1561]
5346. [bug] Make hazard pointer array allocations dynamic, fixing
a bug that caused named to crash on machines with more
than 40 cores. [GL #1493]
5345. [func] Key-style trust anchors and DS-style trust anchors
can now both be used for the same name. [GL #1237]
5344. [bug] Handle accept() errors properly in netmgr. [GL !2880]
5343. [func] Add statistics counters to the netmgr. [GL #1311]
5342. [bug] Disable pktinfo for IPv6 and bind to each interface
explicitly instead, because libuv doesn't support
pktinfo control messages. [GL #1558]
5341. [func] Simplify passing the bound TCP socket to child
threads by using isc_uv_export/import functions.
[GL !2825]
5340. [bug] Don't deadlock when binding to a TCP socket fails.
[GL #1499]
5339. [bug] With some libmaxminddb versions, named could erroneously
match an IP address not belonging to any subnet defined
in a given GeoIP2 database to one of the existing
entries in that database. [GL #1552]
5338. [bug] Fix line spacing in `rndc secroots`.
Thanks to Tony Finch. [GL !2478]
5337. [func] 'named -V' now reports maxminddb and protobuf-c
versions. [GL !2686]
--- 9.15.7 released ---
5336. [bug] The TCP high-water statistic could report an
incorrect value on startup. [GL #1392]
5335. [func] Make TCP listening code multithreaded. [GL !2659]
5334. [doc] Update documentation with dnssec-policy clarifications.
Also change some defaults. [GL !2711]
5333. [bug] Fix duration printing on Solaris when value is not
an ISO 8601 duration. [GL #1460]
5332. [func] Renamed "dnssec-keys" configuration statement
to the more descriptive "trust-anchors". [GL !2702]
5331. [func] Use compiler-provided mechanisms for thread local
storage, and make the requirement for such mechanisms