forked from isc-projects/bind9
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathCHANGES
22074 lines (15463 loc) · 745 KB
/
CHANGES
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
6404. [placeholder]
6403. [placeholder]
6402. [placeholder]
6401. [placeholder]
6400. [placeholder]
6399. [placeholder]
6398. [placeholder]
6397. [placeholder]
6396. [func] Outgoing zone transfers are no longer enabled by
default. To enable them, an "allow-transfer" ACL
must be specified. [GL #4728]
6395. [bug] Handle ISC_R_HOSTDOWN and ISC_R_NETDOWN in resolver.c.
[GL #4736]
6394. [bug] Named's -4 and -6 options now apply to zone primaries,
also-notify and parental-agents. Report when a zone
has these options configured but does not have an IPv4
or IPv6 address listed respectively. [GL #3472]
6393. [func] Deal with uv_tcp_close_reset() error return codes
more gracefully. [GL #4708]
6392. [bug] Use a completely new memory context when flushing the
cache. [GL #2744]
6391. [placeholder]
6390. [placeholder]
6389. [bug] dnssec-verify and dnssec-signzone could fail if there
was an obscured DNSKEY RRset at a delegatation.
[GL #4517]
6388. [placeholder]
6387. [func] Added a new statistics variable "recursive high-water"
that reports the maximum number of simultaneous
recursive clients BIND has handled while running.
[GL #4668]
6386. [bug] When shutting down catzs->view could point to freed
memory. Obtain a reference to the view to prevent this.
[GL #4502]
6385. [func] Relax SVCB alias mode checks to allow parameters.
[GL #4704]
6384. [bug] Remove infinite loop when including a directory in a
zone file. [GL #4357]
6383. [bug] Address an infinite loop in $GENERATE when a negative
value was converted in nibble mode. [GL #4353]
6382. [bug] Fix RPZ response's SOA record TTL, which was incorrectly
set to 1 if 'add-soa' is used. [GL #3323]
--- 9.19.24 released ---
6381. [bug] dns_qp_lookup() could position the iterator at the
wrong predecessor when searching for names with
uncommon characters, which are encoded as two-octet
sequences in QP trie keys. [GL #4702]
6380. [func] Queries and responses now emit distinct dnstap entries
for DoT and DoH. [GL #4523]
6379. [bug] A QP iterator bug could result in DNSSEC validation
failing because the wrong NSEC was returned. [GL #4659]
6378. [func] The option to specify the number of UDP dispatches was
previously removed. An attempt to use the option now
prints a warning. [GL #1879]
6377. [func] Introduce 'dnssec-ksr', a DNSSEC tool to create
Key Signing Requests (KSRs) and Signed Key Responses
(SKRs). [GL #1128]
6376. [func] Allow 'dnssec-keygen' options '-f' and '-k' to be used
together to create a subset of keys from the DNSSEC
policy. [GL !8188]
6375. [func] Allow multiple RNDC message to be processed from
a single TCP read. [GL #4416]
6374. [func] Don't count expired / future RRSIGs in verification
failure quota. [GL #4586]
6373. [func] Offload the isc_http response processing to worker
thread. [GL #4680]
6372. [func] Implement signature jitter for dnssec-policy. [GL #4554]
6371. [bug] Access to the trust bytes in the ncache data needed to
be made thread safe. [GL #4475]
6370. [bug] Wrong source address used for IPv6 notify messages.
[GL #4669]
--- 9.19.23 released ---
6369. [func] The 'fixed' value for the 'rrset-order' option has
been marked and documented as deprecated. [GL #4446]
6368. [func] The 'sortlist' option has been marked and documented
as deprecated. [GL #4593]
6367. [bug] Since the dns_validator_destroy() function doesn't
guarantee that it destroys the validator, rename it to
dns_validator_shutdown() and require explicit
dns_validator_detach() to follow. Implement an expected
behavior of the function to release a name associated
with the validator. [GL #4654]
6366. [bug] An assertion could be triggered in the QPDB cache when
encountering a delegation below a DNAME. [GL #4652]
6365. [placeholder]
6364. [protocol] Add RESOLVER.ARPA to the built in empty zones.
[GL #4580]
6363. [bug] dig/mdig +ednsflags=<non-zero-value> did not re-enable
EDNS if it had been disabled. [GL #4641]
6362. [bug] Reduce memory consumption of QP-trie based databases
by dynamically allocating the nodenames. [GL #4614]
6361. [bug] Some invalid ISO 8601 durations were accepted
erroneously. [GL #4624]
6360. [bug] Don't return static-stub synthesised NS RRset.
[GL #4608]
6359. [bug] Fix bug in Depends (keymgr_dep) function. [GL #4552]
--- 9.19.22 released ---
6358. [bug] Fix validate_dnskey_dsset when KSK is not signing,
do not skip remainder of DS RRset. [GL #4625]
6357. [func] The QP zone database implementation introduced in
change #6355 has now been replaced with a version
based on the multithreaded dns_qpmulti API, which
is based on RCU and reduces the need for locking.
The new implementation is called "qpzone". The
previous "qp" implementation has been renamed
"qpcache", and can only be used for the cache.
[GL #4348]
6356. [bug] Attach the loop also in the dns_cache_flush(), so
the cache pruning still works after the flush.
[GL #4621]
6355. [func] The red-black tree data structure underlying the
RBTDB has been replaced with QP-tries. This is
expected to improve scalability and reduce
CPU consumption under load. It is currently known to
have higher memory consumption than the traditional
RBTDB; this will be addressed in future releases.
Nodes in a QP-trie contain the full domain name,
while nodes in a red-black tree only contain names
relative to a parent. Because of this difference,
zone files dumped with masterfile-style "relative"
will no longer have multiple different $ORIGIN
statements throughout the file.
This version is a minimal adaptation, keeping RBTDB
code largely unchanged, except as needed to replace
the underlying data structure. It uses the
single-thread "dns_qp" interface with locks for
synchronization. A future version will use the
multithreaded "dns_qpmulti" interface instead,
and will be renamed to QPDB.
The RBT-based version of RBTDB is still in place
for now, and can be used by specifying "database rbt"
in a "zone" statement, or by compiling with
"configure --with-zonedb=rbt --with-cachedb=rbt".
[GL #4411]
6354. [bug] Change 6035 introduced a regression when chasing DS
records resulting in an assertion failure. [GL #4612]
6353. [bug] Improve the TTL-based cleaning by removing the expired
headers from the heap, so they don't block the next
cleaning round and clean more than a single item for
each new addition to the RBTDB. [GL #4591]
6352. [bug] Revert change 6319 and decrease lock contention during
RBTDB tree pruning by not cleaning up nodes recursively
within a single prune_tree() call. [GL #4596]
6351. [protocol] Support for the RESINFO record type has been added.
[GL #4413]
6350. [bug] Address use after free in expire_lru_headers. [GL #4495]
6349. [placeholder]
6348. [bug] BIND could previously abort when trying to
establish a connection to a remote server using an
incorrect 'tls' configuration. That has been
fixed. Thanks to Tobias Wolter for bringing
the issue to our attention. [GL #4572]
6347. [func] Disallow stale-answer-client-timeout non-zero values.
[GL #4447]
6346. [bug] Cleaned up several minor bugs in the RBTDB dbiterator
implementation. [GL !8741]
6345. [bug] Added missing dns_rdataset_disassociate calls in
validator.c:findnsec3proofs. [GL #4571]
6344. [bug] Fix case insensitive setting for isc_ht hashtable.
[GL #4568]
6343. [bug] Fix case insensitive setting for isc_ht hashtable.
[GL #4568]
6342. [placeholder]
6341. [bug] Address use after free in ccmsg_senddone. [GL #4549]
6340. [test] Fix incorrectly reported errors when running tests
with `make test` on platforms with older pytest.
[GL #4560]
6339. [bug] The alignas() can't be used on types larger than
max_align_t; instead add padding into the structures
where we want avoid false memory sharing. [GL #4187]
6338. [func] Optimize slabheader placement, so the infrastructure
records are put in the beginning of the slabheader
linked list. [GL !8675]
6337. [bug] Nsupdate could assert while shutting down. [GL #4529]
6336. [func] Expose the zones with the 'first refresh' flag set in
statistics channel's "Incoming Zone Transfers" section
to indicate the zones that are not yet fully ready, and
their first refresh is pending or is in-progress. Also
expose the number of such zones in the output of the
'rndc status' command. [GL #4241]
6335. [func] The 'dnssec-validation yes' option now requires an
explicitly configured 'trust-anchors' statement (or
'managed-keys' or 'trusted-keys' statements, both
deprecated). [GL #4373]
6334. [doc] Improve ARM parental-agents definition. [GL #4531]
6333. [bug] Fix the DNS_GETDB_STALEFIRST flag, which was defined
incorrectly in lib/ns/query.c. [GL !8683]
6332. [bug] Range-check the arguments to fetch-quota-param.
[GL #362]
6331. [func] Add HSM support for dnssec-policy. You can now
configure keys with a key-store that allows you to
set the directory to store key files and to set a
PKCS #11 URI string. [GL #1129]
6330. [doc] Update ZSK minimum lifetime documentation in ARM, also
depends on signing delay. [GL #4510]
6329. [func] Nsupdate can now set the UL EDNS option when sending
UPDATE requests. [GL #4419]
6328. [func] Add workaround to enforce dynamic linker to pull
jemalloc earlier than libc to ensure all memory
allocations are done via jemalloc. [GL #4404]
6327. [func] Expose the TCP client count in statistics channel.
[GL #4425]
6326. [bug] Changes to "listen-on" statements were ignored on
reconfiguration unless the port or interface address was
changed, making it impossible to change a related
listener transport type. Thanks to Thomas Amgarten.
[GL #4518] [GL #4528]
6325. [func] The 'tls' block was extended with a new
'cipher-suites' option that allows setting
allowed cipher suites for TLSv1.3.
[GL #3504]
6324. [bug] Fix a possible crash in 'dig +nssearch +nofail' and
'host -C' commands when one of the name servers returns
SERVFAIL. [GL #4508]
--- 9.19.21 released ---
6323. [placeholder]
6322. [security] Specific DNS answers could cause a denial-of-service
condition due to DNS validation taking a long time.
(CVE-2023-50387) [GL #4424]
The same code change also addresses another problem:
preparing NSEC3 closest encloser proofs could exhaust
available CPU resources. (CVE-2023-50868) [GL #4459]
6321. [security] Change 6315 inadvertently introduced regressions that
could cause named to crash. [GL #4234]
6320. [placeholder]
--- 9.19.20 released ---
6319. [func] Limit isc_async_run() overhead for RBTDB tree pruning.
[GL #4383]
6318. [placeholder]
6317. [security] Restore DNS64 state when handling a serve-stale timeout.
(CVE-2023-5679) [GL #4334]
6316. [security] Specific queries could trigger an assertion check with
nxdomain-redirect enabled. (CVE-2023-5517) [GL #4281]
6315. [security] Speed up parsing of DNS messages with many different
names. (CVE-2023-4408) [GL #4234]
6314. [bug] Address race conditions in dns_tsigkey_find().
[GL #4182]
6313. [bug] When dnssec-policy is in effect the DNSKEY's TTLs in
the zone where not being updated to match the policy.
This lead to failures when DNSKEYs where updated as the
TTLs mismatched. [GL #4466]
6312. [bug] Conversion from NSEC3 signed to NSEC signed could
temporarily put the zone into a state where it was
treated as unsigned until the NSEC chain was built.
Additionally conversion from one set of NSEC3 parameters
to another could also temporarily put the zone into a
state where it was treated as unsigned until the new
NSEC3 chain was built. [GL #1794] [GL #4495]
6311. [func] Zone content checks are now disabled by default
when running named-compilezone. named-checkzone
can still be used for checking zone integrity,
or the former checks in named-compilezone can be
re-enabled by using "named-compilezone -i full
-k fail -n fail -r warn -m warn -M warn -S warn
-T warn -W warn -C check-svcb:fail". [GL #4364]
6310. [bug] Memory leak in zone.c:sign_zone. When named signed a
zone it could leak dst_keys due to a misplaced
'continue'. [GL #4488]
6309. [bug] Changing a zone's primaries while a refresh was in
progress could trigger an assertion. [GL #4310]
6308. [bug] Prevent crashes caused by the zone journal getting
destroyed before all changes from an incoming IXFR are
written to it. [GL #4496]
6307. [bug] Obtain a client->handle reference when calling
async_restart. [GL #4439]
6306. [func] Log more details about the cause of "not exact" errors.
[GL #4500]
6305. [placeholder]
6304. [bug] The wrong time was being used to determine what RRSIGs
where to be generated when dnssec-policy was in use.
[GL #4494]
6303. [bug] Dig failed to correctly process a SIGINT received while
waiting for a TCP connection to complete. [GL #4138]
6302. [func] The "trust-anchor-telemetry" statement is no longer
marked as experimental. This silences a relevant log
message that was emitted even when the feature was
explicitly disabled. [GL #4497]
6301. [bug] Fix data races with atomic members of the xfrin
structure in xfrin_start() and xfrin_send_request()
functions. [GL #4493]
6300. [bug] Fix statistics export to use full 64 bit signed numbers
instead of truncating values to unsigned 32 bits.
[GL #4467]
6299. [port] NetBSD has added 'hmac' to libc which collides with our
use of 'hmac'. [GL #4478]
6298. [bug] Fix dns_qp_lookup bugs related to the iterator.
[GL !8558]
--- 9.19.19 released ---
6297. [bug] Improve LRU cleaning behaviour. [GL #4448]
6296. [func] The "resolver-nonbackoff-tries" and
"resolver-retry-interval" options have been removed;
Using them is now a fatal error. [GL #4405]
6295. [bug] Fix an assertion failure which could occur during
shutdown when DNSSEC validation was running. [GL #4462]
6294. [bug] BIND might sometimes crash after startup or
re-configuration when one 'tls' entry is used multiple
times to connect to remote servers due to initialisation
attempts from contexts of multiple threads. That has
been fixed. [GL #4464]
6293. [func] Initial support for accepting the PROXYv2 protocol in
all currently implemented DNS transports in BIND and
complementary support for sending it in dig are included
into this release. [GL #4388]
6292. [func] Lower the maximum number of allowed NSEC3 iterations,
from 150 to 50. DNSSEC responses with a higher
iteration count are treated as insecure. For signing
with dnssec-policy, iterations must be set to zero.
[GL #4363]
6291. [bug] SIGTERM failed to properly stop multiple outstanding
lookup in dig. [GL #4457]
6290. [bug] Dig +yaml will now report "no servers could be reached"
also for UDP setup failure when no other servers or
tries are left. [GL #1229]
6289. [test] Remove legacy system test runner in favor of pytest.
[GL #4251]
6288. [func] Refactor the isc_mem overmem handling to always use
isc_mem_isovermem and remove the water callback.
[GL #4451]
6287. [bug] Recognize escapes when reading the public key from file.
[GL !8502]
6286. [bug] Dig +yaml will now report "no servers could be reached"
on TCP connection failure as well as for UDP timeouts.
[GL #4396]
6285. [func] Remove AES-based DNS cookies. [GL #4421]
6284. [bug] Fix a catz db update notification callback registration
logic error, which could cause an assertion failure when
receiving an AXFR update for a catalog zone while the
previous update process of the catalog zone was already
running. [GL #4418]
6283. [bug] Fix a data race in isc_hashmap by using atomics for the
iterators number. [GL !8474]
6282. [func] Deprecate AES-based DNS cookies. [GL #4421]
6281. [bug] Fix a data race in dns_tsigkeyring_dump(). [GL #4328]
--- 9.19.18 released ---
6280. [bug] Fix missing newlines in the output of "rndc nta -dump".
[GL !8454]
6279. [func] Use QNAME minimization when fetching nameserver
addresses. [GL #4209]
6278. [bug] The call to isc_mem_setwater() was incorrectly
removed from dns_cache_setcachesize(), causing
cache overmem conditions not to be detected. [GL #4340]
6277. [bug] Take into account local authoritative zones when
falling back to serve-stale. [GL #4355]
6276. [cleanup] Remove both lock-file configuration option and the
-X argument to named. [GL #4391]
6275. [bug] Fix assertion failure when using lock-file configuration
option together -X argument to named. [GL #4386]
6274. [bug] The 'lock-file' file was being removed when it
shouldn't have been making it ineffective if named was
started 3 or more times. [GL #4387]
6273. [bug] Don't reuse the existing TCP streams in dns_xfrin, so
parallel TCP transfers works again. [GL #4379]
6272. [func] Enable systemd units support with the 'notify-reload'
service type by settng the MONOTONIC_USEC field when
sending an sd_notify() message to the service manager
to notify it about reloading the service. Note that the
'NotifyAccess=all' option is required in the systemd
unit file's '[Service]' section. [GL #4377]
6271. [bug] Fix a shutdown race in dns__catz_update_cb(). [GL #4381]
6270. [bug] Handle an assertion when the primary server returned
NOTIMP to IXFR or FORMERR to EDNS to SOA/IXFR/AXFR
request when transfering a zone. [GL #4372]
6269. [maint] B.ROOT-SERVERS.NET addresses are now 170.247.170.2 and
2801:1b8:10::b. [GL #4101]
6268. [func] Offload the IXFR and AXFR processing to unblock
the networking threads. [GL #4367]
6267. [func] The timeouts for resending zone refresh queries over UDP
were lowered to enable named to more quickly determine
that a primary is down. [GL #4260]
6266. [func] The zone option 'inline-signing' is ignored from now
on iff there is no 'dnssec-policy' configured for the
corresponding zone. [GL #4349]
6265. [bug] Don't schedule resign operations on the raw version
of an inline-signing zone. [GL #4350]
6264. [func] Use atomics to handle some ADB entry members
to reduce ADB locking contention. [GL #4326]
6263. [func] Convert the RPZ summary database to use a QP trie
instead of an RBT. [GL !8352]
6262. [bug] Duplicate control sockets didn't generate a
configuration failure leading to hard to diagnose
rndc connection errors. These are now caught by
named-checkconf and named. [GL #4253]
6261. [bug] Fix a possible assertion failure on an error path in
resolver.c:fctx_query(), when using an uninitialized
link. [GL #4331]
6260. [func] Added options to the QP trie that will be needed
when it is used as a zone or cache database: backward
iteration, and retrieval of DNSSEC predecessor
nodes and node chains. [GL !8338]
6259. [placeholder]
6258. [func] Use explictly created external memory pools for
dns_message in the ns_client and dns_resolver.
[GL #4325]
6257. [func] Expose the "Refresh SOA" query state (before the XFR)
in the incoming zone transfers section of the
statistics channel and show the local and remote
addresses for that query. Also Improve the
"Duration (s)" field to show the duration of the
"Pending" and "Refresh SOA" states too, before the
actual transfer starts. [GL !8305]
6256. [func] Expose the SOA query transport type (used before/during
XFR) in the incoming zone transfers section of the
statistics channel. [GL !8240]
6255. [func] Expose data about incoming zone transfers in progress
using statistics channel. [GL #3883]
6254. [cleanup] Add semantic patch to do an explicit cast from char
to unsigned char in ctype.h class of functions.
[GL #4327]
6253. [cleanup] Remove the support for control channel over Unix
Domain Sockets. [GL #4311]
6252. [test] Python system tests have to be executed by invoking
pytest directly. Executing them with the legacy test
runner is no longer supported. [GL #4250]
6251. [bug] Interating a hashmap could return the same element
twice. [GL #3422]
6250. [bug] The wrong covered value was being set by
dns_ncache_current for RRSIG records in the returned
rdataset structure. This resulted in TYPE0 being
reported as the covered value of the RRSIG when dumping
the cache contents. [GL #4314]
6249. [cleanup] Reduce the number of reserved UDP dispatches
to the number of loops, replace the round-robin
mechanism in dns_dispatchset_t with dispatches
pinned to loops, and use lock-free hash tables
for looking up query IDs and active TCP
connections. [GL !8304]
6248. [func] Add an option "resolver-use-dns64", which enables
application of DNS64 rules to server addresses
when sending recursive queries. This allows
resolution to be performed via NAT64. [GL #608]
6247. [func] Implement incremental hashing in both isc_siphash
and isc_hash units. [GL #4306]
--- 9.19.17 released ---
6246. [placeholder]
6245. [security] Limit the amount of recursion that can be performed
by isccc_cc_fromwire. (CVE-2023-3341) [GL #4152]
6244. [bug] Adjust log levels on malformed messages to NOTICE when
transferring in a zone. [GL #4290]
6243. [bug] Restore the call order of dns_validator_destroy and
fetchctx_detach to prevent use after free. [GL #4214]
6242. [func] Ignore jemalloc versions before 4.0.0 as we now
need explicit memory arenas and tcache support.
[GL #4296]
6241. [placeholder]
6240. [bug] Use dedicated per-worker thread jemalloc memory
arenas for send buffers allocation to reduce memory
consumption and avoid lock contention. [GL #4038]
6239. [func] Deprecate the 'dnssec-must-be-secure' option.
[GL #3700]
6238. [cleanup] Refactor several objects relying on dns_rbt trees
to instead of dns_nametree, a wrapper around dns_qp.
[GL !8213]
6237. [bug] Address memory leaks due to not clearing OpenSSL error
stack. [GL #4159]
6236. [func] Add isc_mem_cget() and isc_mem_cput() calloc-like
functions that take nmemb and size, do checked
multiplication and zero the memory before returning
it to the user. Replace isc_mem_getx(..., ISC_MEM_ZERO)
with isc_mem_cget(...) usage. [GL !8237]
6235. [doc] Clarify BIND 9 time formats. [GL #4266]
6234. [bug] Restore stale-refresh-time value after flushing the
cache. [GL #4278]
6233. [func] Extend client side support for the EDNS EXPIRE option
to IXFR and AXFR query types. [GL #4170]
6232. [bug] Following the introduction of krb5-subdomain-self-rhs
and ms-subdomain-self-rhs update rules, removal of
nonexistent PTR and SRV records via UPDATE could fail.
[GL #4280]
6231. [func] Make nsupdate honor -v for SOA requests only if the
server is specified. [GL #1181]
6230. [bug] Prevent an unnecessary query restart if a synthesized
CNAME target points to the CNAME owner. [GL #3835]
6229. [func] Add basic USDT framework for adding static
tracing points. [GL #4041]
6228. [func] Limit the number of inactive network manager handles
and uvreq objects that we keep around for reusing
later. [GL #4265]
6227. [bug] Check the statistics-channel HTTP Content-length
to prevent negative or overflowing values from
causing a crash. [GL #4125]
6226. [bug] Attach dispatchmgr in the dns_view object to prevent
use-after-free when shutting down. [GL #4228]
6225. [func] Convert dns_nta, dns_forward and dns_keytable units
to use QP trie instead of an RBT. [GL !7811]
6224. [bug] Check the If-Modified-Since value length to prevent
out-of-bounds write. [GL #4124]
6223. [func] Make -E engine option for OpenSSL Engine API use only.
OpenSSL Provider API will now require engine to not be
set. [GL #8153]
6222. [func] Fixes to provider/engine based ECDSA key handling.
[GL !8152]
--- 9.19.16 released ---
6221. [cleanup] Refactor dns_rdataset internals, move rdatasetheader
declarations out of rbtdb.c so they can be used by other
databases in the future, and split the zone and cache
functions from rbtdb.c into separate modules. [GL !7873]
6220. [func] Deprecate the 'dialup' and 'heartbeat-interval'
options. [GL #3700]
6219. [bug] Ignore 'max-zone-ttl' on 'dnssec-policy insecure'.
[GL #4032]
6218. [func] Add inline-signing to dnssec-policy. [GL #3677]
6217. [func] The dns_badcache unit was refactored to use cds_lfht
instead of hand-crafted locked hashtable. [GL #4223]
6216. [bug] Pin dns_request events to the originating loop
to serialize access to the data. [GL #4086]
6215. [protocol] Return REFUSED to GSS-API TKEY requests if GSS-API
support is not configured. [GL #4225]
6214. [bug] Fix the memory leak in for struct stub_glue_request
allocated in stub_request_nameserver_address() but not
freed in stub_glue_response(). [GL #4227]
6213. [bug] Mark a primary server as temporarily unreachable if the
TCP connection attempt times out. [GL #4215]
6212. [placeholder]
6211. [func] Remove 'auto-dnssec'. This obsoletes the configuration
options 'dnskey-sig-validity', 'dnssec-dnskey-kskonly',
'dnssec-update-mode', 'sig-validity-interval', and
'update-check-ksk'. [GL #3672]
6210. [func] Don't add signing records for DNSKEY added with dynamic
update. The dynamic update DNSSEC management feature was
removed with GL #3686. [GL !8070]
6209. [func] Reduce query-response latency by making recursive
queries (CNAME, DNAME, NSEC) asynchronous instead
of directly calling the respective functions. [GL #4185]
6208. [func] Return BADCOOKIE for out-of-date or otherwise bad, well
formed DNS SERVER COOKIES. [GL #4194]
--- 9.19.15 released ---
6207. [cleanup] The code implementing TSIG/TKEY support has been cleaned
up and refactored for improved robustness, readability,
and consistency with other code modules. [GL !7828]
6206. [bug] Add shutdown checks in dns_catz_dbupdate_callback() to
avoid a race with dns_catz_shutdown_catzs(). [GL #4171]
6205. [bug] Restore support to read legacy HMAC-MD5 K file pairs.
[GL #4154]
6204. [bug] Use NS records for relaxed QNAME-minimization mode.
This reduces the number of queries named makes when
resolving, as it allows the non-existence of NS RRsets
at non-referral nodes to be cached in addition to the
referrals that are normally cached. [GL #3325]
6203. [cleanup] Ensure that the size calculation does not overflow
when allocating memory for an array.
[GL #4120] [GL #4121] [GL #4122]
6202. [func] Use per-loop memory contexts for dns_resolver
objects. [GL !8015]
6201. [bug] The free_all_cpu_call_rcu_data() call at the end
of isc_loopmgr_run() was causing ~200 ms extra
latency. [GL #4163]
6200. [placeholder]
6199. [bug] Improve HTTP Connection: header protocol conformance
in the statistics channel. [GL #4126]
6198. [func] Remove the holes in the isc_result_t enum to compact
the isc_result tables. [GL #4149]
6197. [bug] Fix a data race between the dns_zone and dns_catz
modules when registering/unregistering a database
update notification callback for a catalog zone.
[GL #4132]
6196. [cleanup] Report "permission denied" instead of "unexpected error"
when trying to update a zone file on a read-only file
system. Thanks to Midnight Veil. [GL #4134]
6195. [bug] Use rcu to reference view->adb. [GL #4021]
6194. [func] Change function 'find_zone_keys()' to look for signing
keys by looking for key files instead of a DNSKEY
RRset lookup. [GL #4141]
6193. [bug] Fix a catz db update notification callback registration
logic error, which could crash named when receiving an
AXFR update for a catalog zone while the previous update
process of the catalog zone was already running.
[GL #4136]
--- 9.19.14 released ---
6192. [placeholder]
6191. [placeholder]
6190. [security] Improve the overmem cleaning process to prevent the
cache going over the configured limit. (CVE-2023-2828)
[GL #4055]
6189. [bug] Fix an extra dns_validator deatch when encountering
deadling which would lead to assertion failure.
[GL #4115]
6188. [performance] Reduce memory consumption by allocating properly
sized send buffers for stream-based transports.
[GL #4038]
6187. [bug] Address view shutdown INSIST when accessing the
zonetable. [GL #4093]
6186. [bug] Fix a 'clients-per-query' miscalculation bug. When the
'stale-answer-enable' options was enabled and the
'stale-answer-client-timeout' option was enabled and
larger than 0, named was taking two places from the
'clients-per-query' limit for each client and was
failing to gradually auto-tune its value, as configured.
[GL #4074]
6185. [func] Add "ClientQuota" statistics channel counter, which
indicates the number of the resolver's spilled queries
due to reaching the clients per query quota. [GL !7978]
6184. [func] Special-case code that was added to allow GSS-TSIG
to work around bugs in the Windows 2000 version of
Active Directory has been removed. The 'nsupdate -o'
option and 'oldgsstsig' command have been
deprecated, and are now treated as synonyms for
'nsupdate -g' and 'gsstsig' respectively. [GL #4012]
6183. [bug] Fix a serve-stale bug where a delegation from cache
could be returned to the client. [GL #3950]
6182. [cleanup] Remove configure checks for epoll, kqueue and
/dev/poll. [GL #4098]
6181. [placeholder]
6180. [bug] The session key object could be incorrectly added
to multiple different views' keyrings. [GL #4079]
6179. [bug] Fix an interfacemgr use-after-free error in
zoneconf.c:isself(). [GL #3765]
6178. [func] Add support for the multi-signer model 2 (RFC 8901) when
using inline-signing. [GL #2710]
6177. [placeholder]
6176. [test] Add support for using pytest & pytest-xdist to
execute the system test suite. [GL #3978]
6175. [test] Fix the `upforwd` system test to be more reliable,
6174. [placeholder]
6173. [bug] Properly process extra "nameserver" lines in
resolv.conf otherwise the next line is not properly
processed. [GL #4066]
6172. [cleanup] Refactor the loop manager and qp-trie code to remove
isc_qsbr and use liburcu instead. [GL #3936]
6171. [cleanup] Remove the stack implementation added in change 6108:
we are using the liburcu concurrent data structures
instead. [GL !7920]
6170. [func] The 'rndc -t' option allows a timeout to be set in
seconds, so that commands that take a long time to
complete (e.g., reloading a very large configuration)
can be given time to do so. The default is 60
seconds. [GL #4046]
6169. [bug] named could crash when deleting inline-signing zones
with "rndc delzone". [GL #4054]
6168. [func] Refactor the glue cache to store list of the GLUE
directly in the rdatasetheader instead of keeping
it in the hashtable indexed by the node pointer.
[GL #4045]
6167. [func] Add 'cdnskey' configuration option. [GL #4050]
6166. [func] Retry without DNS COOKIE on FORMERR if it appears that
the FORMERR was due to the presence of a DNS COOKIE
option. [GL #4049]
6165. [bug] Fix a logic error in dighost.c which could call the
dighost_shutdown() callback twice and cause problems
if the callback function was not idempotent. [GL #4039]
--- 9.19.13 released ---
6164. [bug] Set the rndc idle read timeout back to 60 seconds,
from the netmgr default of 30 seconds, in order to
match the behavior of 9.16 and earlier. [GL #4046]
6163. [func] Add option to dnstap-read to use timestamps in
milliseconds (thanks to Oliver Ford). [GL #2360]
6162. [placeholder]
6161. [bug] Fix log file rotation when using absolute path as
file. [GL #3991]
6160. [bug] 'delv +ns' could print duplicate output. [GL #4020]
6159. [bug] Fix use-after-free bug in TCP accept connection
failure. [GL #4018]
6158. [func] Add ISC_LIST_FOREACH() and ISC_LIST_FOREACH_SAFE()
to walk the ISC_LIST() in a unified manner and use
the safe macro to fix the potential UAF when shutting
down the isc_httpd. [GL #4031]
6157. [bug] When removing delegations in an OPTOUT range
empty-non-terminal NSEC3 records generated by
those delegations were not removed. [GL #4027]
6156. [bug] Reimplement the maximum and idle timeouts for incoming
zone tranfers. [GL #4004]
6155. [bug] Treat ISC_R_INVALIDPROTO as a networking error
in the dispatch code to avoid retrying with the
same server. [GL #4005]
6154. [func] Add spinlock implementation. The spinlock is much
smaller (8 bytes) than pthread_mutex (40 bytes), so
it can be easily embedded into objects for more
fine-grained locking (per-object vs per-bucket).
On the other hand, the spinlock is unsuitable for
situations where the lock might be held for a long
time as it keeps the waiting threads in a spinning
busy loop. [GL #3977]
6153. [bug] Fix the streaming protocols (TCP, TLS) shutdown
sequence. [GL #4011]
6152. [bug] In dispatch, honour the configured source-port
selection when UDP connection fails with address
in use error.
Also treat ISC_R_NOPERM same as ISC_R_ADDRINUSE.
[GL #3986]
6151. [bug] When the same ``notify-source`` address and port number
was configured for multiple destinations and zones, an
unresponsive server could tie up the socket until it
timed out; in the meantime, NOTIFY messages for other
servers silently failed.``named`` will now retry these
failing messages over TCP. NOTIFY failures are now
logged at level INFO. [GL #4001] [GL #4002]
6150. [bug] If the zones have active upstream forwards, the
shutting down the server might cause assertion
failures as the forward were all canceled from
the main loop instead from the loops associated
with the zone. [GL #4015]
6149. [test] As a workaround, include an OpenSSL header file before
including cmocka.h in the unit tests, because OpenSSL
3.1.0 uses __attribute__(malloc), conflicting with a
redefined malloc in cmocka.h. [GL #4000]
6148. [bug] Fix a use-after-free bug in dns_xfrin_create().
[GL !7832]
6147. [performance] Fix the TCP server parent quota use. [GL #3985]
--- 9.19.12 released ---
6146. [performance] Replace the zone table red-black tree and associated
locking with a lock-free qp-trie. [GL !7582]
6145. [bug] Fix a possible use-after-free bug in the
dns__catz_done_cb() function. [GL #3997]
6144. [bug] A reference counting problem (double detach) might
occur when shutting down zone transfer early after
switching the dns_xfrin to use dns_dispatch API.
[GL #3984]
6143. [bug] A reference counting problem on the error path in
the xfrin_connect_done() might cause an assertion
failure on shutdown. [GL #3989]
6142. [bug] Reduce the number of dns_dnssec_verify calls made
determining if revoked keys needs to be removed from
the trust anchors. [GL #3981]
6141. [bug] Fix several issues in nsupdate timeout handling and
update the -t option's documentation. [GL #3674]
6140. [func] Implement automatic parental-agents ('checkds yes').
[GL #3901]