This is a bugfix release.
- Fixed a bug that caused the NSEC salt to be changed for KASP zones on every
startup.
- Signed, insecure delegation responses prepared by named either lacked the
necessary NSEC records or contained duplicate NSEC records when both wildcard
expansion and CNAME chaining were required to prepare the response. This has
been fixed.
- Queries where the wildcard match contained the letter W failed to return the
correct response as the W was mapped to \000.
- Checking of key-directory and dnssec-policy was broken. The checks failed to
account for key-directory inheritance.
Full release notes:
https://bind9.readthedocs.io/en/v9_16/notes.html#notes-for-bind-9-16-18
Feature Changes:
- After the network manager was introduced to named to handle incoming traffic,
it was discovered that recursive performance had degraded compared to
previous BIND 9 versions. This has now been fixed by processing internal
tasks inside network manager worker threads, preventing resource contention
among two sets of threads.
- Zone dumping tasks are now run on separate asynchronous thread pools. This
change prevents zone dumping from blocking network I/O.
- inline-signing was incorrectly described as being inherited from the
options/view levels and was incorrectly accepted at those levels without
effect. This has been fixed; named.conf files with inline-signing at those
levels no longer load.
Full changelog:
https://bind9.readthedocs.io/en/v9_16/notes.html#notes-for-bind-9-16-17
Notes for BIND 9.16.16
Feature Changes
* DNSSEC responses containing NSEC3 records with iteration counts greater
than 150 are now treated as insecure. [GL #2445]
* The maximum supported number of NSEC3 iterations that can be configured
for a zone has been reduced to 150. [GL #2642]
* The default value of the max-ixfr-ratio option was changed to unlimited,
for better backwards compatibility in the stable release series. [GL
#2671]
* Zones that want to transition from secure to insecure mode without
becoming bogus in the process must now have their dnssec-policy changed
first to insecure, rather than none. After the DNSSEC records have been
removed from the zone, the dnssec-policy can be set to none or removed
from the configuration. Setting the dnssec-policy to insecure causes CDS
and CDNSKEY DELETE records to be published. [GL #2645]
* The implementation of the ZONEMD RR type has been updated to match RFC
8976. [GL #2658]
* The draft-vandijk-dnsop-nsec-ttl IETF draft was implemented: NSEC(3) TTL
values are now set to the minimum of the SOA MINIMUM value or the SOA TTL.
[GL #2347]
Bug Fixes
* It was possible for corrupt journal files generated by an earlier version
of named to cause problems after an upgrade. This has been fixed. [GL
#2670]
* TTL values in cache dumps were reported incorrectly when
stale-cache-enable was set to yes. This has been fixed. [GL #389] [GL
#2289]
* A deadlock could occur when multiple rndc addzone, rndc delzone, and/or
rndc modzone commands were invoked simultaneously for different zones.
This has been fixed. [GL #2626]
* named and named-checkconf did not report an error when multiple zones with
the dnssec-policy option set were using the same zone file. This has been
fixed. [GL #2603]
* If dnssec-policy was active and a private key file was temporarily offline
during a rekey event, named could incorrectly introduce replacement keys
and break a signed zone. This has been fixed. [GL #2596]
* When generating zone signing keys, KASP now also checks for key ID
conflicts among newly created keys, rather than just between new and
existing ones. [GL #2628]
Security release.
--- 9.16.15 released ---
5621. [bug] Due to a backporting mistake in change 5609, named
binaries built against a Kerberos/GSSAPI library whose
header files did not define the GSS_SPNEGO_MECHANISM
preprocessor macro were not able to start if their
configuration included the "tkey-gssapi-credential"
option. This has been fixed. [GL #2634]
5620. [bug] If zone journal files written by BIND 9.16.11 or earlier
were present when BIND was upgraded, the zone file for
that zone could have been inadvertently rewritten with
the current zone contents. This caused the original zone
file structure (e.g. comments, $INCLUDE directives) to
be lost, although the zone data itself was preserved.
This has been fixed. [GL #2623]
--- 9.16.14 released ---
5617. [security] A specially crafted GSS-TSIG query could cause a buffer
overflow in the ISC implementation of SPNEGO.
(CVE-2021-25216) [GL #2604]
5616. [security] named crashed when a DNAME record placed in the ANSWER
section during DNAME chasing turned out to be the final
answer to a client query. (CVE-2021-25215) [GL #2540]
5615. [security] Insufficient IXFR checks could result in named serving a
zone without an SOA record at the apex, leading to a
RUNTIME_CHECK assertion failure when the zone was
subsequently refreshed. This has been fixed by adding an
owner name check for all SOA records which are included
in a zone transfer. (CVE-2021-25214) [GL #2467]
5614. [bug] Ensure all resources are properly cleaned up when a call
to gss_accept_sec_context() fails. [GL #2620]
5613. [bug] It was possible to write an invalid transaction header
in the journal file for a managed-keys database after
upgrading. This has been fixed. Invalid headers in
existing journal files are detected and named is able
to recover from them. [GL #2600]
5611. [func] Set "stale-answer-client-timeout" to "off" by default.
[GL #2608]
5610. [bug] Prevent a crash which could happen when a lookup
triggered by "stale-answer-client-timeout" was attempted
right after recursion for a client query finished.
[GL #2594]
5609. [func] The ISC implementation of SPNEGO was removed from BIND 9
source code. It was no longer necessary as all major
contemporary Kerberos/GSSAPI libraries include support
for SPNEGO. [GL #2607]
5608. [bug] When sending queries over TCP, dig now properly handles
"+tries=1 +retry=0" by not retrying the connection when
the remote server closes the connection prematurely.
[GL #2490]
5607. [bug] As "rndc dnssec -checkds" and "rndc dnssec -rollover"
commands may affect the next scheduled key event,
reconfiguration of zone keys is now triggered after
receiving either of these commands to prevent
unnecessary key rollover delays. [GL #2488]
5606. [bug] CDS/CDNSKEY DELETE records are now removed when a zone
transitions from a secure to an insecure state.
named-checkzone also no longer reports an error when
such records are found in an unsigned zone. [GL #2517]
5605. [bug] "dig -u" now uses the CLOCK_REALTIME clock source for
more accurate time reporting. [GL #2592]
5603. [bug] Fix a memory leak that occurred when named failed to
bind a UDP socket to a network interface. [GL #2575]
5602. [bug] Fix TCPDNS and TLSDNS timers in Network Manager. This
makes the "tcp-initial-timeout" and "tcp-idle-timeout"
options work correctly again. [GL #2583]
5601. [bug] Zones using KASP could not be thawed after they were
frozen using "rndc freeze". This has been fixed.
[GL #2523]
9.16.13 (2022-03-17)
New Features
* A new purge-keys option has been added to dnssec-policy. It sets the
period of time that key files are retained after becoming obsolete
due to a key rollover; the default is 90 days. This feature can be
disabled by setting purge-keys to 0. [GL #2408]
Feature Changes
* When serve-stale is enabled and stale data is available, named now
returns stale answers upon encountering any unexpected error in the
query resolution process. This may happen, for example, if the
fetches-per-server or fetches-per-zone limits are reached. In this
case, named attempts to answer DNS requests with stale data, but
does not start the stale-refresh-time window. [GL #2434]
Bug Fixes
* Zone journal (.jnl) files created by versions of named prior to
9.16.12 were no longer compatible; this could cause problems when
upgrading if journal files were not synchronized first. This has
been corrected: older journal files can now be read when starting
up. When an old-style journal file is detected, it is updated to the
new format immediately after loading.
Note that journals created by the current version of named are not
usable by versions prior to 9.16.12. Before downgrading to a prior
release, users are advised to ensure that all dynamic zones have
been synchronized using rndc sync -clean.
A journal file's format can be changed manually by running
named-journalprint -d (downgrade) or named-journalprint -u
(upgrade). Note that this must not be done while named is
running. [GL #2505]
* named crashed when it was allowed to serve stale answers and
stale-answer-client-timeout was triggered without any (stale) data
available in the cache to answer the query. [GL #2503]
* If an outgoing packet exceeded max-udp-size, named dropped it
instead of sending back a proper response. To prevent this problem,
the IP_DONTFRAG option is no longer set on UDP sockets, which has
been happening since BIND 9.16.11. [GL #2466]
* NSEC3 records were not immediately created when signing a dynamic
zone using dnssec-policy with nsec3param. This has been fixed. [GL
#2498]
* A memory leak occurred when named was reconfigured after adding an
inline-signed zone with auto-dnssec maintain enabled. This has been
fixed. [GL #2041]
* An invalid direction field (not one of N, S, E, W) in a LOC record
resulted in an INSIST failure when a zone file containing such a
record was loaded. [GL #2499]
XXX: why does this have so many patches?
--- 9.16.12 released ---
5578. [protocol] Make "check-names" accept A records below "_spf",
"_spf_rate", and "_spf_verify" labels in order to cater
for the "exists" SPF mechanism specified in RFC 7208
section 5.7 and appendix D.1. [GL #2377]
5577. [bug] Fix the "three is a crowd" key rollover bug in KASP by
correctly implementing Equation (2) of the "Flexible and
Robust Key Rollover" paper. [GL #2375]
5575. [bug] When migrating to KASP, BIND 9 considered keys with the
"Inactive" and/or "Delete" timing metadata to be
possible active keys. This has been fixed. [GL #2406]
5572. [bug] Address potential double free in generatexml().
[GL #2420]
5571. [bug] named failed to start when its configuration included a
zone with a non-builtin "allow-update" ACL attached.
[GL #2413]
5570. [bug] Improve performance of the DNSSEC verification code by
reducing the number of repeated calls to
dns_dnssec_keyfromrdata(). [GL #2073]
5569. [bug] Emit useful error message when "rndc retransfer" is
applied to a zone of inappropriate type. [GL #2342]
5568. [bug] Fixed a crash in "dnssec-keyfromlabel" when using ECDSA
keys. [GL #2178]
5567. [bug] Dig now reports unknown dash options while pre-parsing
the options. This prevents "-multi" instead of "+multi"
from reporting memory usage before ending option parsing
with "Invalid option: -lti". [GL #2403]
5566. [func] Add "stale-answer-client-timeout" option, which is the
amount of time a recursive resolver waits before
attempting to answer the query using stale data from
cache. [GL #2247]
5565. [func] The SONAMEs for BIND 9 libraries now include the current
BIND 9 version number, in an effort to tightly couple
internal libraries with a specific release. [GL #2387]
5562. [security] Fix off-by-one bug in ISC SPNEGO implementation.
(CVE-2020-8625) [GL #2354]
5561. [bug] KASP incorrectly set signature validity to the value of
the DNSKEY signature validity. This is now fixed.
[GL #2383]
5560. [func] The default value of "max-stale-ttl" has been changed
from 12 hours to 1 day and the default value of
"stale-answer-ttl" has been changed from 1 second to 30
seconds, following RFC 8767 recommendations. [GL #2248]
5456. [func] Added "primaries" as a synonym for "masters" in
named.conf, and "primary-only" as a synonym for
"master-only" in the parameters to "notify", to bring
terminology up-to-date with RFC 8499. [GL #1948]
5362. [func] Limit the size of IXFR responses so that AXFR will
be used instead if it would be smaller. This is
controlled by the "max-ixfr-ratio" option, which
is a percentage representing the ratio of IXFR size
to the size of the entire zone. This value cannot
exceed 100%, which is the default. [GL #1515]
- Fix build (at least) on SmartOS
- Changelog:
* Feature Changes:
- The new networking code introduced in BIND 9.16 (netmgr) was overhauled
in order to make it more stable, testable, and maintainable. [GL #2321]
- Earlier releases of BIND versions 9.16 and newer required the operating
system to support load-balanced sockets in order for named to be able to
achieve high performance (by distributing incoming queries among multiple
threads). However, the only operating systems currently known to support
load-balanced sockets are Linux and FreeBSD 12, which means both UDP and
TCP performance were limited to a single thread on other systems. As of
BIND 9.17.8, named attempts to distribute incoming queries among multiple
threads on systems which lack support for load-balanced sockets (except
Windows). [GL #2137]
- It is now possible to transition a zone from secure to insecure mode
without making it bogus in the process; changing to dnssec-policy none;
also causes CDS and CDNSKEY DELETE records to be published, to signal
that the entire DS RRset at the parent must be removed, as described in
RFC 8078. [GL #1750]
- When using the unixtime or date method to update the SOA serial number,
named and dnssec-signzone silently fell back to the increment method to
prevent the new serial number from being smaller than the old serial
number (using serial number arithmetics). dnssec-signzone now prints a
warning message, and named logs a warning, when such a fallback happens.
[GL #2058]
* Bug Fixes:
- Multiple threads could attempt to destroy a single RBTDB instance at the
same time, resulting in an unpredictable but low-probability assertion
failure in free_rbtdb(). This has been fixed. [GL #2317]
- named no longer attempts to assign threads to CPUs outside the CPU
affinity set. Thanks to Ole Bjørn Hessen. [GL #2245]
- When reconfiguring named, removing auto-dnssec did not turn off DNSSEC
maintenance. This has been fixed. [GL #2341]
- The report of intermittent BIND assertion failures triggered in
lib/dns/resolver.c:dns_name_issubdomain() has now been closed without
further action. Our initial response to this was to add diagnostic
logging instead of terminating named, anticipating that we would receive
further useful troubleshooting input. This workaround first appeared in
BIND releases 9.17.5 and 9.16.7. However, since those releases were
published, there have been no new reports of assertion failures matching
this issue, but also no further diagnostic input, so we have closed the
issue. [GL #2091]
- Full Changelog at:
https://downloads.isc.org/isc/bind9/9.16.11/doc/arm/html/notes.html
Update bind916 to 9.16.10 (BIND 9.16.10).
pkgsrc changes:
* Make blocklist/blacklist support really compiled in.
* Fix build problem with pkcs11 PKG_OPTIONS and allow to use it.
--- 9.16.10 released ---
5544. [func] Restore the default value of "nocookie-udp-size" to 4096
bytes. [GL #2250]
5541. [func] Adjust the "max-recursion-queries" default from 75 to
100. [GL #2305]
5540. [port] Fix building with native PKCS#11 support for AEP Keyper.
[GL #2315]
5539. [bug] Tighten handling of missing DNS COOKIE responses over
UDP by falling back to TCP. [GL #2275]
5538. [func] Add NSEC3 support to KASP. A new option for
"dnssec-policy", "nsec3param", can be used to set the
desired NSEC3 parameters. NSEC3 salt collisions are
automatically prevented during resalting. Salt
generation is now logged with zone context. [GL #1620]
5534. [bug] The CNAME synthesized from a DNAME was incorrectly
followed when the QTYPE was CNAME or ANY. [GL #2280]
--- 9.16.9 released ---
5533. [func] Add the "stale-refresh-time" option, a time window that
starts after a failed lookup, during which a stale RRset
is served directly from cache before a new attempt to
refresh it is made. [GL #2066]
5530. [bug] dnstap did not capture responses to forwarded UPDATE
requests. [GL #2252]
5527. [bug] A NULL pointer dereference occurred when creating an NTA
recheck query failed. [GL #2244]
5525. [bug] Change 5503 inadvertently broke cross-compilation by
replacing a call to AC_LINK_IFELSE() with a call to
AC_RUN_IFELSE() in configure.ac. This has been fixed,
making cross-compilation possible again. [GL #2237]
5523. [bug] The initial lookup in a zone transitioning to/from a
signed state could fail if the DNSKEY RRset was not
found. [GL #2236]
5522. [bug] Fixed a race/NULL dereference in TCPDNS send. [GL #2227]
5520. [bug] Fixed a number of shutdown races, reference counting
errors, and spurious log messages that could occur
in the network manager. [GL #2221]
5518. [bug] Stub zones now work correctly with primary servers using
"minimal-responses yes". [GL #1736]
5517. [bug] Do not treat UV_EOF as a TCP4RecvErr or a TCP6RecvErr.
[GL #2208]
--- 9.16.8 released ---
5516. [func] The default EDNS buffer size has been changed from 4096
to 1232 bytes. [GL #2183]
5515. [func] Add 'rndc dnssec -rollover' command to trigger a manual
rollover for a specific key. [GL #1749]
5514. [bug] Fix KASP expected key size for Ed25519 and Ed448.
[GL #2171]
5513. [doc] The ARM section describing the "rrset-order" statement
was rewritten to make it unambiguous and up-to-date with
the source code. [GL #2139]
5512. [bug] "rrset-order" rules using "order none" were causing
named to crash despite named-checkconf treating them as
valid. [GL #2139]
5511. [bug] 'dig -u +yaml' failed to display timestamps to the
microsecond. [GL #2190]
5510. [bug] Implement the attach/detach semantics for dns_message_t
to fix a data race in accessing an already-destroyed
fctx->rmessage. [GL #2124]
5509. [bug] filter-aaaa: named crashed upon shutdown if it was in
the process of recursing for A RRsets. [GL #1040]
5508. [func] Added new parameter "-expired" for "rndc dumpdb" that
also prints expired RRsets (awaiting cleanup) to the
dump file. [GL #1870]
5507. [bug] Named could compute incorrect SIG(0) responses.
[GL #2109]
5506. [bug] Properly handle failed sysconf() calls, so we don't
report invalid memory size. [GL #2166]
5505. [bug] Updating contents of a mixed-case RPZ could cause some
rules to be ignored. [GL #2169]
5503. [bug] Cleaned up reference counting of network manager
handles, now using isc_nmhandle_attach() and _detach()
instead of _ref() and _unref(). [GL #2122]
Update bind916 pacakge to 9.16.7.
--- 9.16.7 released ---
5501. [func] Log CDS/CDNSKEY publication. [GL #1748]
5500. [bug] Fix (non-)publication of CDS and CDNSKEY records.
[GL #2103]
5499. [func] Add '-P ds' and '-D ds' arguments to dnssec-settime.
[GL #1748]
5497. [bug] 'dig +bufsize=0' failed to disable EDNS. [GL #2054]
5496. [bug] Address a TSAN report by ensuring each rate limiter
object holds a reference to its task. [GL #2081]
5495. [bug] With query minimization enabled, named failed to
resolve ip6.arpa. names that had extra labels to the
left of the IPv6 part. [GL #1847]
5494. [bug] Silence the EPROTO syslog message on older systems.
[GL #1928]
5493. [bug] Fix off-by-one error when calculating new hash table
size. [GL #2104]
5492. [bug] Tighten LOC parsing to reject a period (".") and/or "m"
as a value. Fix handling of negative altitudes which are
not whole meters. [GL #2074]
5491. [bug] rbtversion->glue_table_size could be read without the
appropriate lock being held. [GL #2080]
5489. [bug] Named erroneously accepted certain invalid resource
records that were incorrectly processed after
subsequently being written to disk and loaded back, as
the wire format differed. Such records include: CERT,
IPSECKEY, NSEC3, NSEC3PARAM, NXT, SIG, TLSA, WKS, and
X25. [GL !3953]
5488. [bug] NTA code needed to have a weak reference on its
associated view to prevent the latter from being deleted
while NTA tests were being performed. [GL #2067]
5486. [func] Add 'rndc dnssec -checkds' command, which signals to
named that the DS record for a given zone or key has
been updated in the parent zone. [GL #1613]
Update bind916 to 9.16.5 (BIND 9.16.5).
--- 9.16.5 released ---
5458. [bug] Prevent a theoretically possible NULL dereference caused
by a data race between zone_maintenance() and
dns_zone_setview_helper(). [GL #1627]
5455. [bug] named could crash when cleaning dead nodes in
lib/dns/rbtdb.c that were being reused. [GL #1968]
5454. [bug] Address a startup crash that occurred when the server
was under load and the root zone had not yet been
loaded. [GL #1862]
5453. [bug] named crashed on shutdown when a new rndc connection was
received during shutdown. [GL #1747]
5452. [bug] The "blackhole" ACL was accidentally disabled for client
queries. [GL #1936]
5451. [func] Add 'rndc dnssec -status' command. [GL #1612]
5449. [bug] Fix a socket shutdown race in netmgr udp. [GL #1938]
5448. [bug] Fix a race condition in isc__nm_tcpdns_send().
[GL #1937]
5447. [bug] IPv6 addresses ending in "::" could break YAML
parsing. A "0" is now appended to such addresses
in YAML output from dig, mdig, delv, and dnstap-read.
[GL #1952]
5446. [bug] The validator could fail to accept a properly signed
RRset if an unsupported algorithm appeared earlier in
the DNSKEY RRset than a supported algorithm. It could
also stop if it detected a malformed public key.
[GL #1689]
5444. [bug] 'rndc dnstap -roll <value>' did not limit the number of
saved files to <value>. [GL !3728]
5443. [bug] The "primary" and "secondary" keywords, when used
as parameters for "check-names", were not
processed correctly and were being ignored. [GL #1949]
5441. [bug] ${LMDB_CFLAGS} was missing from make/includes.in.
[GL #1955]
5440. [test] Properly handle missing kyua. [GL #1950]
5439. [bug] The DS RRset returned by dns_keynode_dsset() was used in
a non-thread-safe manner. [GL #1926]
Add bind916 version 9.16.5 package (BIND 9.16.5).
BIND, the Berkeley Internet Name Daemon. This package contains the BIND
9.16 release.
* New dnssec-policy statement to configure a key and signing policy for
zones, enabling automatic key regeneration and rollover.
* New network manager based on libuv.
* Added support for the new GeoIP2 geolocation API, libmaxminddb.
* Improved DNSSEC trust anchor configuration using the trust-anchors
statement, permitting configuration of trust anchors in DS as well as
DNSKEY format.
* YAML output for dig, mdig, and delv.
