forked from isc-projects/bind9
-
Notifications
You must be signed in to change notification settings - Fork 0
/
CHANGES
20734 lines (14499 loc) · 698 KB
/
CHANGES
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
6052. [func] Replace DNS over TCP and DNS over TLS transports
code with a new, unified transport implementation.
[GL #3374]
6051. [bug] Improve thread safety in the dns_dispatch unit.
[GL #3178] [GL #3636]
6050. [bug] Changes to the RPZ response-policy min-update-interval
and add-soa options now take effect as expected when
named is reconfigured. [GL #3740]
6049. [bug] Exclude ABD hashtables from the ADB memory
overmem checks and don't clean ADB names
and ADB entries used in the last 10 seconds
(ADB_CACHE_MINIMUM). [GL #3739]
6048. [bug] Fix a log message error in dns_catz_update_from_db(),
where serials with values of 2^31 or larger were logged
incorrectly as negative numbers. [GL #3742]
6047. [bug] Try the next server instead of trying the same
server again on an outgoing query timeout.
[GL #3637]
6046. [bug] TLS session resumption might lead to handshake
failures when client certificates are used for
authentication (Mutual TLS). This has been fixed.
[GL #3725]
6045. [cleanup] The list of supported DNSSEC algorithms changed log
level from "warning" to "notice" to match named's other
startup messages. [GL !7217]
6044. [bug] There was an "RSASHA236" typo in a log message.
[GL !7206]
6043. [bug] The key file IO locks objects would never get
deleted from the hashtable due to off-by-one error.
[GL #3727]
6042. [bug] ANY responses could sometimes have the wrong TTL.
[GL #3613]
6041. [func] Set the RLIMIT_NOFILE to rlim_max returned from
getrlimit() instead of trying to guess the maximum
allowed value. [GL #3676]
6040. [bug] Speed up the named shutdown time by explicitly
canceling all recursing ns_client objects for
each ns_clientmgr. [GL #3183]
6039. [bug] Removing a catalog zone from catalog-zones without
also removing the referenced zone could leave a
dangling pointer. [GL #3683]
6038. [placeholder]
6037. [func] Reject zones which have DS records not at delegation
points. [GL #3697]
6036. [bug] nslookup and host were not honoring the selected port
in TCP mode. [GL #3721]
6035. [bug] Refactor the dns_resolver unit to store the fetch
contexts and zone counter directly in the hash
tables without buckets and implement effective
cleaning of both objects. [GL #3709]
6034. [func] Deprecate alt-transfer-source, alt-transfer-source-v6
and use-alt-transfer-source. [GL #3694]
6033. [func] Log messages related to serve-stale now include the RR
type involved. [GL !7145]
6032. [bug] After change 5995, zone transfers were using a small
compression context that only had space for the first
few dozen names in each message. They now use a large
compression context with enough space for every name.
[GL #3706]
6031. [bug] Move the "final reference detached" log message
from dns_zone unit to the DEBUG(1) log level.
[GL #3707]
6030. [bug] Refactor the ADB to use a global LRU queue, store
the ADB names and ADB entries directly in the hash
tables instead of buckets, and properly clean the
ADB names and entries when not in use. [GL #3239]
[GL #3238] [GL #2615] [GL #2078] [GL #2437]
[GL #3312] [GL #2441]
6029. [cleanup] Remove the unused external cache cleaning mechanism
as RBTDB has its own internal cache cleaning
mechanism and we don't support any other database
implementations. [GL #3639]
6028. [performance] Build-time code generation of DNS RRtype switches
is now much faster. [GL !7121]
6027. [bug] Fix assertion failure in isc_http API used by
statschannel if the read callback would be called
on HTTP request that has been already closed.
[GL #3693]
6026. [cleanup] Deduplicate time unit conversion factors.
[GL !7033]
6025. [bug] Copy TLS identifier when setting up primaries for
catalog member zones. [GL #3638]
6024. [func] Deprecate 'auto-dnssec'. [GL #3667]
6023. [func] Remove dynamic update DNSSEC management feature.
[GL #3686]
6022. [performance] The decompression implementation in dns_name_fromwire()
is now smaller and faster. [GL #3655]
6021. [bug] Use the current domain name when checking answers from
a dual-stack-server. [GL #3607]
6020. [bug] Ensure 'named-checkconf -z' respects the check-wildcard
option when loading a zone. [GL #1905]
6019. [func] Deprecate `coresize`, `datasize`, `files`, and
`stacksize` named.conf options. [GL #3676]
6018. [cleanup] Remove the --with-tuning configure option.
[GL #3664]
6017. [bug] The view's zone table was not locked when it should
have been leading to race conditions when external
extensions that manipulate the zone table where in
use. [GL #3468]
6016. [func] Change NSEC3PARAM TTL to match the SOA MINIMUM.
[GL #3570]
6015. [bug] Some browsers (Firefox) send more than 10 HTTP
headers. Bump the number of allowed HTTP headers
to 100. [GL #3670]
6014. [func] Add isc_hashmap API implementation that implements
Robin Hood hashing. The API requires the keys to
be stored with the stored value. [GL !6790]
--- 9.19.7 released ---
6013. [bug] Fix a crash that could happen when you change
a dnssec-policy zone with NSEC3 to start using
inline-signing. [GL #3591]
6012. [placeholder]
6011. [func] Refactor the privilege setting part of named_os unit
to make libcap on Linux mandatory and use setreuid
and setregid if available. [GL #3583]
6010. [func] Make the initial interface scan happen before
dropping the privileges. This requires exiting
exclusive mode before scanning the interfaces
and re-entering it again when we are done. This
is because starting the listening on interfaces
requires the loopmgr to be running and not paused.
[GL #3583]
6009. [bug] Don't trust a placeholder KEYDATA from the managed-keys
zone by adding it into secroots. [GL #2895]
6008. [bug] Fixed a race condition that could cause a crash
in dns_zone_synckeyzone(). [GL #3617]
6007. [cleanup] Don't enforce the jemalloc use on NetBSD. [GL #3634]
6006. [cleanup] The zone dumping was using isc_task API to launch
the zonedump on the offloaded threadpool. Remove
the task and launch the offloaded work directly.
[GL #3628]
6005. [func] The zone loading has been moved to the offload
threadpool instead of doing incremental repeated
tasks, so zone loading scheduling is now driven
by the operating system scheduler rather than fixed
(100) quantum. [GL #3625]
6004. [func] Add check-svcb to control the checking of additional
constraints on SVBC records. This change impacts on
named, named-checkconf, named-checkzone,
named-compilezone and nsupdate. [GL #3576]
6003. [bug] Fix an inheritance bug when setting the port on
remote servers in configuration. [GL #3627]
6002. [bug] Fix a resolver prefetch bug when the record's TTL value
is equal to the configured prefetch eligibility value,
but the record was erroneously not treated as eligible
for prefetching. [GL #3603]
6001. [bug] Always call dns_adb_endudpfetch() after calling
dns_adb_beginudpfetch() for UDP queries in resolver.c,
in order to adjust back the quota. [GL #3598]
6000. [bug] Fix a startup issue on Solaris systems with many
(reportedly > 510) CPUs. Thanks to Stacey Marshall from
Oracle for deep investigation of the problem. [GL #3563]
5999. [bug] rpz-ip rules could be ineffective in some scenarios
with CD=1 queries. [GL #3247]
5998. [placeholder]
5997. [cleanup] Less ceremonial UNEXPECTED_ERROR() and FATAL_ERROR()
reporting macros. [GL !6914]
5996. [bug] Fix a couple of bugs in cfg_print_duration(), which
could result in generating incomplete duration values
when printing the configuration using named-checkconf.
[GL !6880]
5995. [performance] A new algorithm for DNS name compression based on a
hash set of message offsets. Name compression is now
more complete as well as being generally faster, and
the implementation is less complicated and requires
much less memory. [GL !6517]
5994. [func] Refactor the isc_httpd implementation used in the
statistics channel. [GL !6879]
5993. [cleanup] Store dns_name_t attributes as boolean members of
the structure. Remove DNS_NAMEATTR_* macros.
Fix latent attribute handling bug in RBT. [GL !6902]
--- 9.19.6 released ---
5992. [func] Introduce the new isc_mem_*x() APIs that takes extra
flags as the last argument. Currently ISC_MEM_ZERO
and ISC_MEM_ALIGN(n) flags have been implemented that
clears the memory to avoid the isc_mem_get()/memset()
pattern and make aligned allocation which replaces the
previous isc_mem_*_aligned() calls. [GL !6398]
5991. [protocol] Add support for parsing and validating "dohpath" to
SVCB. [GL #3544]
5990. [test] fuzz/dns_message_checksig now creates the key directory
it uses when testing in /tmp at run time. [GL #3569]
5989. [func] Implement support for DDNS update forwarding using DoT
to TLS-enabled primary servers. [GL #3512]
5988. [bug] Some out of memory conditions in opensslrsa_link.c
could lead to memory leaks. [GL #3551]
5987. [func] Provide custom isc_mem based allocators for libuv,
OpenSSL and libxml2 libraries that support replacing
the internal allocators. [GL #3559]
5986. [func] Make the memory context debugging options local to
the memory context and make it immutable for the memory
context lifetime. [GL #3559]
5985. [func] Bump the minimal libuv version to 1.34.0. [GL #3567]
5984. [func] 'named -V' now reports the list of supported
DNSSEC/DS/HMAC algorithms and the supported TKEY modes.
[GL #3541]
5983. [bug] Changing just the TSIG key names for primaries in
catalog zones' member zones was not effective.
[GL #3557]
5982. [func] Extend dig to allow requests to be signed using SIG(0)
as well as providing a mechanism to specify the signing
time. [GL !5923]
5981. [test] Add dns_message_checksig fuzzer to check messages
signed using TSIG or SIG(0). [GL !5923]
5980. [func] The internal isc_entropy API provider has been
changed from OpenSSL RAND_bytes() to uv_random()
to use system provided entropy. [GL !6803]
5979. [func] Implement DoT support for nsupdate. [GL #1781]
5978. [port] The ability to use pkcs11 via engine_pkcs11 has been
restored, by only using deprecated APIs in
OpenSSL 3.0.0. BIND needs to be compiled with
'-DOPENSSL_API_COMPAT=10100' specified in the CFLAGS
at compile time. [GL !6711]
5977. [bug] named could incorrectly return non-truncated, glueless
referrals for responses whose size was close to the UDP
packet size limit. [GL #1967]
5976. [cleanup] isc_timer_t objects are now created, started and
destroyed in a particular loop, and timer callbacks
run in that loop. isc_timer_stop() can still be called
from any loop; when run from a different loop than
the one associated with the timer, the request will
be recorded in atomic variable and the timer will
be stopped on the next callback call. [GL #3202]
5975. [func] Implement TLS transport support for dns_request and
dns_dispatch. [GL #3529]
5974. [bug] Fix an assertion failure in dispatch caused by
extra read callback call. [GL #3545]
5973. [bug] Fixed a possible invalid detach in UPDATE
processing. [GL #3522]
5972. [bug] Gracefully handle when the statschannel HTTP connection
gets cancelled during sending data back to the client.
[GL #3542]
5971. [func] Add libsystemd sd_notify() support. [GL #1176]
5970. [func] Log the reason why a query was refused. [GL !6669]
5969. [bug] DNSSEC signing statistics failed to identify the
algorithm involved. The key names have been changed
to be the algorithm number followed by "+" followed
by the key id (e.g. "8+54274"). [GL #3525]
5968. [cleanup] Remove 'resolve' binary from tests. [GL !6733]
5967. [cleanup] Flagged the obsolete "random-device" option as
ancient; it is now an error to configure it. [GL #3399]
5966. [func] You can now specify if a server must return a DNS
COOKIE before accepting the response over UDP.
[GL #2295]
server <prefix> { require-cookie <yes_or_no>; };
5965. [cleanup] Move the duplicated ASCII case conversion tables to
isc_ascii where they can be shared, and replace the
various hot-path tolower() loops with calls to new
isc_ascii implementations. [GL !6516]
5964. [func] When an international domain name is not valid, DiG will
now pass it through unchanged, instead of stopping with
an error message. [GL #3527]
5963. [bug] Ensure struct named_server is properly initialized.
[GL #6531]
--- 9.19.5 released ---
5962. [security] Fix memory leak in EdDSA verify processing.
(CVE-2022-38178) [GL #3487]
5961. [placeholder]
5960. [security] Fix serve-stale crash that could happen when
stale-answer-client-timeout was set to 0 and there was
a stale CNAME in the cache for an incoming query.
(CVE-2022-3080) [GL #3517]
5959. [security] Fix memory leaks in the DH code when using OpenSSL 3.0.0
and later versions. The openssldh_compare(),
openssldh_paramcompare(), and openssldh_todns()
functions were affected. (CVE-2022-2906) [GL #3491]
5958. [security] When an HTTP connection was reused to get
statistics from the stats channel, and zlib
compression was in use, each successive
response sent larger and larger blocks of memory,
potentially reading past the end of the allocated
buffer. (CVE-2022-2881) [GL #3493]
5957. [security] Prevent excessive resource use while processing large
delegations. (CVE-2022-2795) [GL #3394]
5956. [func] Make RRL code treat all QNAMEs that are subject to
wildcard processing within a given zone as the same
name. [GL #3459]
5955. [port] The libxml2 library has deprecated the usage of
xmlInitThreads() and xmlCleanupThreads() functions. Use
xmlInitParser() and xmlCleanupParser() instead.
[GL #3518]
5954. [func] Fallback to IDNA2003 processing in dig when IDNA2008
conversion fails. [GL #3485]
5953. [bug] Fix a crash on shutdown in delete_trace_entry(). Add
mctx attach/detach pair to make sure that the memory
context used by a memory pool is not destroyed before
the memory pool itself. [GL #3515]
5952. [bug] Use quotes around address strings in YAML output.
[GL #3511]
5951. [bug] In some cases, the dnstap query_message field was
erroneously set when logging response messages.
[GL #3501]
5950. [func] Implement a feature to set an Extended DNS Error (EDE)
code on responses modified by RPZ. [GL #3410]
5949. [func] Add new isc_loopmgr API that runs the application
event loops and completely replaces the isc_app
API. Refactor the isc_taskmgr, isc_timermgr and
isc_netmgr to use the isc_loopmgr event loops.
[GL #3508]
5948. [bug] Fix nsec3.c:dns_nsec3_activex() function, add a missing
dns_db_detachnode() call. [GL #3500]
5947. [func] Change dnssec-policy to allow graceful transition from
an NSEC only zone to NSEC3. [GL #3486]
5946. [bug] Fix statistics channel's handling of multiple HTTP
requests in a single connection which have non-empty
request bodies. [GL #3463]
5945. [bug] If parsing /etc/bind.key failed, delv could assert
when trying to parse the built in trust anchors as
the parser hadn't been reset. [GL !6468]
5944. [bug] Fix +http-plain-get and +http-plain-post options
support in dig. Thanks to Marco Davids at SIDN for
reporting the problem. [GL !6672]
5943. [placeholder]
5942. [bug] Fix tkey.c:buildquery() function's error handling by
adding the missing cleanup code. [GL #3492]
5941. [func] Zones with dnssec-policy now require dynamic DNS or
inline-siging to be configured explicitly. [GL #3381]
5940. [placeholder]
5939. [placeholder]
5938. [bug] An integer type overflow could cause an assertion
failure when freeing memory. [GL #3483]
5937. [cleanup] The dns_rdatalist_tordataset() and
dns_rdatalist_fromrdataset() functions can no
longer fail. Clean up their prototypes and error
handling, and that of other calling functions that
subsequently cannot fail, including
dns_message_setquerytsig(). [GL #3467]
5936. [bug] Don't enable serve-stale for lookups that error because
it is a duplicate query or a query that would be
dropped. [GL #2982]
5935. [bug] Fix DiG lookup reference counting bug, which could
be observed in NSSEARCH mode. [GL #3478]
--- 9.19.4 released ---
5934. [func] Improve fetches-per-zone fetch limit logging to log
the final allowed and spilled values of the fetch
counters before the counter object gets destroyed.
[GL #3461]
5933. [port] Automatically disable RSASHA1 and NSEC3RSASHA1 in
named on Fedorda 33, Oracle Linux 9 and RHEL9 when
they are disabled by the security policy. [GL #3469]
5932. [bug] Fix rndc dumpdb -expired and always include expired
RRsets, not just for RBTDB_VIRTUAL time window.
[GL #3462]
5931. [bug] Fix DiG query error handling robustness in NSSEARCH
mode by making sure that udp_ready(), tcp_connected(),
and send_done() callbacks start the next query in chain
even if there is some kind of error with the previous
query. [GL #3419]
5930. [bug] Fix DiG query retry and fail-over bug in UDP mode.
Also simplify the overall retry and fail-over logic to
make it behave predictably, and always respect the
documented +retry/+tries count set by a command-line
option (or use the default values of 2 or 3
respectively). [GL #3407]
5929. [func] The use of the "max-zone-ttl" option in "zone" and
"options" blocks is now deprecated; this should
now be configured as part of "dnssec-policy"
instead. The old option still works in zones
with no "dnssec-policy" configured, but a warning
will be logged when loading configuration. Its
functionality will be removed in a future release.
Using "max-zone-ttl" and "dnssec-policy" in the
same zone is now a fatal error. [GL #2918]
5928. [placeholder]
5927. [bug] A race was possible in dns_dispatch_connect()
that could trigger an assertion failure if two
threads called it near-simultaneously. [GL #3456]
5926. [func] Handle transient TCP connect() EADDRINUSE failures
on FreeBSD (and possibly other BSDs) by trying three
times before giving up. [GL #3451]
5925. [bug] With a forwarder configured for all queries, resolution
failures encountered during DS chasing could trigger
assertion failures due to a logic bug in
resume_dslookup() that caused it to call
dns_resolver_createfetch() with an invalid name.
[GL #3439]
5924. [func] When it's necessary to use AXFR to respond to an
IXFR request, a message explaining the reason
is now logged at level info. [GL #2683]
5923. [bug] Fix inheritance for dnssec-policy when checking for
inline-signing. [GL #3438]
5922. [bug] Forwarding of UPDATE message could fail with the
introduction of netmgr. This has been fixed. [GL #3389]
5921. [test] Convert system tests to use a default DNSKEY algorithm
where the test is not DNSKEY algorithm specific.
[GL #3440]
5920. [bug] Don't pass back the current name offset when the
compression is disabled in the non-improving case.
[GL #3423]
--- 9.19.3 released ---
5919. [func] The "rndc fetchlimit" command lists name servers
and domain names that are being rate-limited by
"fetches-per-server" or "fetches-per-zone" limits.
[GL #665]
5918. [test] Convert system tests to use a default HMAC algorithm
where the test is not HMAC specific. [GL #3433]
5917. [bug] Update ifconfig.sh script as is miscomputed interface
identifiers when destroying interfaces. [GL #3061]
5916. [bug] When resolving a name, don't give up immediately if an
authoritative server returns FORMERR; try the other
servers first. [GL #3152]
5915. [bug] Detect missing closing brace (}) and computational
overflows in $GENERATE directives. [GL #3429]
5914. [bug] When synth-from-dnssec generated a response using
records from a higher zone, it could unexpectedly prove
non-existance of records in a subordinate grafted-on
namespace. [GL #3402]
5913. [placeholder]
5912. [cleanup] The "glue-cache" option has been removed. The glue cache
feature still works and is now permanently enabled.
[GL #2147]
5911. [bug] Update HTTP listener settings on reconfiguration.
[GL #3415]
5910. [cleanup] Move built-in dnssec-policies into the defaultconf.
These are now printed with 'named -C'. [GL !6467]
5909. [bug] The server-side destination port was missing from dnstap
captures of client traffic. [GL #3309]
5908. [bug] Fix race conditions in route_connected(). [GL #3401]
5907. [bug] Fix a crash in dig NS search mode when one of the NS
server queries fail. [GL #3207]
5906. [cleanup] Various features (e.g. prefetch, RPZ) no longer share
common pointers when initiating recursion. This
rationalizes recursion quota handling and makes the
value of the RecursClients statistics counter more
accurate. [GL #3168]
5905. [bug] When the TCP connection would be closed/reset between
the connect/accept and the read, the uv_read_start()
return value would be unexpected and cause an assertion
failure. [GL #3400]
5904. [func] Changed dnssec-signzone -H default to 0 additional
NSEC3 iterations. [GL #3395]
5903. [bug] When named checks that the OPCODE in a response matches
that of the request, if there is a mismatch named logs
an error. Some of those error messages incorrectly
used RCODE instead of OPCODE to lookup the nemonic.
This has been corrected. [GL !6420]
5902. [func] NXDOMAIN cache records are no longer retained in
the cache after expiry, even when serve-stale is
in use. [GL #3386]
5901. [bug] When processing a catalog zone member zone make sure
that there is no configured pre-existing forward-only
forward zone with that name. [GL #2506]
5900. [placeholder]
--- 9.19.2 released ---
5899. [func] Don't try to process DNSSEC-related and ZONEMD records
in catz. [GL #3380]
5898. [cleanup] Simplify BIND's internal DNS name compression API. As
RFC 6891 explains, it isn't practical to deploy new
label types or compression methods, so it isn't
necessary to have an API designed to support them.
Remove compression terminology that refers to Internet
Drafts that expired in the 1990s. [GL !6270]
5897. [bug] Views that weren't configured to use RFC 5011 key
management would still set up an empty managed-keys
zone. This has been fixed. [GL #3349]
5896. [func] Add some more dnssec-policy checks to detect weird
policies. [GL #1611]
5895. [test] Add new set of unit test macros and move the unit
tests under single namespace in /tests/. [GL !6243]
5894. [func] Avoid periodic interface re-scans on Linux by
default, where a reliable event-based mechanism for
detecting interface state changes is available.
[GL #3064]
5893. [func] Add TLS session resumption support to the client-side
TLS code. [GL !6274]
5892. [cleanup] Refactored the the hash tables in resolver.c to
use the isc_ht API. [GL !6271]
5891. [func] Key timing options for `dnssec-settime` and related
utilities now accept "UNSET" times as printed by
`dnssec-settime -p`. [GL #3361]
5890. [bug] When the fetches-per-server quota was adjusted
because of an authoritative server timing out more
or less frequently, it was incorrectly set to 1
rather than the intended value. This has been
fixed. [GL #3327]
5889. [cleanup] Refactored and simplified the shutdown processes in
dns_view, dns_resolver, dns_requestmgr, and dns_adb
by reducing interdependencies between the objects.
[GL !6278]
5888. [bug] Only write key files if the dnssec-policy keymgr has
changed the metadata. [GL #3302]
5887. [cleanup] Remove the on-shutdown mechanics from isc_task API.
Replace it by isc_task_send() when we are shutting
down. [GL !6275]
--- 9.19.1 released ---
5886. [security] Fix a crash in DNS-over-HTTPS (DoH) code caused by
premature TLS stream socket object deletion.
(CVE-2022-1183) [GL #3216]
5885. [bug] RPZ NSIP and NSDNAME rule processing didn't handle stub
and static-stub zones at or above the query name. This
has now been addressed. [GL #3232]
5884. [cleanup] Reduce struct padding in ADB address entries, and use a
binary hash function to find addresses. [GL !6219]
5883. [cleanup] Move netmgr/uv-compat.{c,h} to <isc/uv.h>, so
the compatibility libuv shims could be used outside
the network manager. [GL !6199]
5882. [contrib] Avoid name space collision in dlz modules by prefixing
functions with 'dlz_'. [GL !5778]
5881. [placeholder]
5880. [func] Add new named command-line option -C to print built-in
defaults. [GL #1326]
5879. [contrib] dlz: Add FALLTHROUGH and UNREACHABLE macros. [GL #3306]
5878. [func] Check the algorithm name or OID embedded at the start
of the signature field for PRIVATEDNS and PRIVATEOID
SIG and RRSIG records are well formed. [GL #3296]
5877. [func] Introduce the concept of broken catalog zones described
in the DNS catalog zones draft version 5 document.
[GL #3224]
5876. [func] Add DNS Extended Errors when stale answers are returned
from cache. [GL #2267]
5875. [bug] Fixed a deadlock that could occur if an rndc
connection arrived during the shutdown of network
interfaces. [GL #3272]
5874. [placeholder]
5873. [bug] Refactor the fctx_done() function to set fctx to
NULL after detaching, so that reference counting
errors will be easier to avoid. [GL #2969]
5872. [bug] udp_recv() in dispatch could trigger an INSIST when the
callback's result indicated success but the response
was canceled in the meantime. [GL #3300]
5871. [bug] Fix dig hanging on TLS context creation errors.
[GL #3285]
5870. [cleanup] Remove redundant macros in the RBT implementation.
[GL !6158]
5869. [func] Enable use of IP(V6)_RECVERR on Linux that allows
the kernel to report destination host/network
unreachable errors to the userspace application.
[GL #4251]
5868. [cleanup] Use Daniel Lemire's "nearly divisionless" algorithm
for unbiased bounded random numbers, and move
re-seeding out of the hot path. [GL !6161]
5867. [bug] Fix assertion failure triggered by attaching to dns_adb
in dns_adb_createfind() that has been triggered to shut
down in different thread between the check for shutting
down condition and the attach to dns_adb. [GL #3298]
5866. [bug] Work around a jemalloc quirk which could trigger an
out-of-memory condition in named over time. [GL #3287]
5865. [func] Make statistics channel and control channel listen
on a single network manager thread. [GL !6032]
5864. [func] The OID embedded at the start of a PRIVATEOID public
key in a KEY, DNSKEY, CDNSKEY, or RKEY RR is now
checked for validity when reading from wire or from
zone files, and the OID is printed when
'dig +rrcomments' is used. Similarly, the name
embedded at the start of a PRIVATEDNS public key
is also checked for validity. [GL #3234]
5863. [bug] If there was a pending negative cache DS entry,
validations depending upon it could fail. [GL #3279]
5862. [bug] dig returned a 0 exit status on UDP connection failure.
[GL #3235]
5861. [func] Implement support for catalog zones change of ownership
(coo) mechanism described in the DNS catalog zones draft
version 5 document. [GL #3223]
5860. [func] Implement support for catalog zones options new syntax
based on catalog zones custom properties with "ext"
suffix described in the DNS catalog zones draft version
5 document. [GL #3222]
5859. [bug] Fix an assertion failure when using dig with +nssearch
and +tcp options by starting the next query in the
send_done() callback (like in the UDP mode) instead
of doing that recursively in start_tcp(). Also
ensure that queries interrupted while connecting
are detached properly. [GL #3144]
5858. [bug] Don't remove CDS/CDNSKEY DELETE records on zone sign
when using 'auto-dnssec maintain;'. [GL #2931]
5857. [bug] Fixed a possible crash during shutdown due to ADB
entries being unlinked from the hash table too
soon. [GL #3256]
--- 9.19.0 released ---
5856. [bug] The "starting maxtime timer" message related to outgoing
zone transfers was incorrectly logged at the ERROR level
instead of DEBUG(1). [GL #3208]
5855. [bug] Ensure that zone maintenance queries have a retry limit.
[GL #3242]
5854. [func] Implement reference counting for TLS contexts and
allow reloading of TLS certificates on reconfiguration
without destroying the underlying TCP listener sockets
for TLS-based DNS transports. [GL #3122]
5853. [bug] When using both the `+qr` and `+y` options `dig` could
crash if the connection to the first server was not
successful. [GL #3244]
5852. [func] Add new "reuseport" option to enable/disable load
balancing of sockets. [GL #3249]
5851. [placeholder]
5850. [func] Run the RPZ update process on the offload threads.
[GL #3190]
5849. [cleanup] Remove use of exclusive mode in ns_interfacemgr in
favor of rwlocked access to localhost and localnets
members of dns_aclenv_t structure. [GL #3229]
5848. [bug] dig could hang in some cases involving multiple servers
in a lookup, when a request fails and the next one
refuses to start for some reason, for example if it was
an IPv4 mapped IPv6 address. [GL #3248]
5847. [cleanup] Remove task privileged mode in favor of processing
all events in the loadzone task in a single run
by setting the quantum to UINT_MAX. [GL #3253]
5846. [func] In dns_zonemgr, create per-thread task, zonetask, and
loadtask and pin the zones to individual threads,
instead of having "many", spreading the zones among
them and hoping for the best. This also removes any
need to dynamically reallocate the pools with memory
contexts and tasks. [GL #3226]
5845. [bug] Refactor the timer to keep track of posted events
as to use isc_task_purgeevent() instead of using
isc_task_purgerange(). The isc_task_purgeevent()
has been refactored to purge a single event instead
of walking through the list of posted events.
[GL #3252]
5844. [bug] dig +nssearch was hanging until manually interrupted.
[GL #3145]
5843. [bug] When an UPDATE targets a zone that is not configured,
the requested zone name is now logged in the "not
authoritative" error message, so that it is easier to
track down problematic update clients. [GL #3209]
5842. [cleanup] Remove the task exclusive mode use in ns_clientmgr.
[GL #3230]
5841. [bug] Refactor the address database:
- Use self-resizing hash tables, eliminating the
need to go into task-exclusive mode when resizing.
- Simplify reference counting of ADB objects
and the process for shutting down. [GL #3213]
5840. [cleanup] Remove multiple application context use in dns_client
unit. [GL !6041]
5839. [func] Add support for remote TLS certificates
verification, both to BIND and dig, making it possible
to implement Strict and Mutual TLS authentication,
as described in RFC 9103, Section 9.3. [GL #3163]
5838. [cleanup] When modifying a member zone in a catalog zone, and it
is detected that the zone exists and was not created by
the current catalog zone, distinguish the two cases when
the zone was not added by a catalog zone at all, and
when the zone was added by a different catalog zone,
and log a warning message accordingly. [GL #3221]
5837. [func] Key timing options for `dnssec-keygen` and
`dnssec-settime` now accept times as printed by
`dnssec-settime -p`. [GL !2947]
5836. [bug] Quote the dns64 prefix in error messages that complain
about problems with it, to avoid confusion with the
following dns64 ACLs. [GL #3210]
5835. [cleanup] Remove extrahandlesize from the netmgr, the callers
now have to allocate the object before calling
isc_nm_setdata() and deallocate the memory in the close
callback passed to isc_nm_setdata(). [GL #3227]
5834. [cleanup] C99 variable-length arrays are difficult to use safely,
so avoid them except in test code. [GL #3201]
5833. [bug] When encountering socket error while trying to initiate
a TCP connection to a server, dig could hang
indefinitely, when there were more servers to try.
[GL #3205]
5832. [bug] When timing-out or having other types of socket errors
during a query, dig wasn't trying to perform the lookup
using other servers, in case they exist. [GL #3128]
5831. [bug] When resending a UDP request in the result of a timeout,
the recv_done() function in dighost.c was prepending
the new query into the loookup's queries list instead
of inserting, which could cause an assertion failure
when the resent query's result was SERVFAIL. [GL #3020]
5830. [func] Implement incremental resizing of isc_ht hash tables to
perform the rehashing gradually. [GL #3212]
5829. [func] Refactor and simplify isc_timer API in preparation
for further refactoring on top of network manager
loops. [GL #3202]
5828. [bug] Replace single TCP write timer with per-TCP write
timers. [GL #3200]
5827. [cleanup] The command-line utilities printed their version numbers
inconsistently; they all now print to stdout. (They are
still inconsistent abotut whether you use `-v` or `-V`
to request the version). [GL #3189]
5826. [cleanup] Stop dig from complaining about lack of IDN support when
the user asks for no IDN translation. [GL #3188]
5825. [func] Set the minimum MTU on UDPv6 and TCPv6 sockets and
limit TCP maximum segment size (TCP_MAXSEG) to (1220)
for both TCPv4 and TCPv6 sockets. [GL #2201]
5824. [bug] Invalid dnssec-policy definitions were being accepted
where the defined keys did not cover both KSK and ZSK
roles for a given algorithm. This is now checked for
and the dnssec-policy is rejected if both roles are
not present for all algorithms in use. [GL #3142]
5823. [func] Replace hazard pointers based lock-free list with
locked-list based queue that's simpler and has no or
little performance impact. [GL #3180]
5822. [bug] When calling dns_dispatch_send(), attach/detach
dns_request_t object as the read callback could
be called before send callback dereferencing
dns_request_t object too early. [GL #3105]
5821. [bug] Fix query context management issues in the TCP part
of dig. [GL #3184]
5820. [security] An assertion could occur in resume_dslookup() if the
fetch had been shut down earlier. (CVE-2022-0667)
[GL #3129]
5819. [security] Lookups involving a DNAME could trigger an INSIST when
"synth-from-dnssec" was enabled. (CVE-2022-0635)
[GL #3158]
5818. [security] A synchronous call to closehandle_cb() caused
isc__nm_process_sock_buffer() to be called recursively,
which in turn left TCP connections hanging in the
CLOSE_WAIT state blocking indefinitely when
out-of-order processing was disabled. (CVE-2022-0396)
[GL #3112]
5817. [security] The rules for acceptance of records into the cache
have been tightened to prevent the possibility of
poisoning if forwarders send records outside
the configured bailiwick. (CVE-2021-25220) [GL #2950]
5816. [bug] Make BIND compile with LibreSSL 3.5.0, as it was using
not very accurate pre-processor checks for using shims.
[GL #3172]
5815. [bug] If an oversized key name of a specific length was used
in the text form of an HTTP or SVBC record, an INSIST
could be triggered when parsing it. [GL #3175]
5814. [bug] The RecursClients statistics counter could underflow
in certain resolution scenarios. [GL #3147]
5813. [func] The "keep-response-order" ACL has been declared
obsolete, and is now non-operational. [GL #3140]
5812. [func] Drop the artificial limit on the number of queries
processed in a single TCP read callback. [GL #3141]
5811. [bug] Reimplement the maximum and idle timeouts for outgoing
zone tranfers. [GL #1897]
5810. [func] New option '-J' for dnssec-signzone and dnssec-verify
allows loading journal files. [GL #2486]
5809. [bug] Reset client TCP connection when data received cannot
be parsed as a valid DNS request. [GL #3149]
5808. [bug] Certain TCP failures were not caught and handled
correctly by the dispatch manager, causing
connections to time out rather than returning
SERVFAIL. [GL #3133]
5807. [bug] Add a TCP "write" timer, and time out writing
connections after the "tcp-idle-timeout" period
has elapsed. [GL #3132]
5806. [bug] An error in checking the "blackhole" ACL could cause
DNS requests sent by named to fail if the
destination address or prefix was specifically
excluded from the ACL. [GL #3157]
5805. [func] The result of each resolver priming attempt is now
included in the "resolver priming query complete" log
message. [GL #3139]
5804. [func] Add a debug log message when starting and ending
the task exclusive mode. [GL #3137]
5803. [func] Use compile-time paths in the documentation.
[GL #2717]
5802. [test] Add system test to test engine_pkcs11. [GL !5727]