The NetBSD Project

CVS log for src/external/mpl/bind/dist/bin/tests/system/cpu/ns1/Attic/named.conf.in

[BACK] Up to [cvs.NetBSD.org] / src / external / mpl / bind / dist / bin / tests / system / cpu / ns1

Request diff between arbitrary revisions


Keyword substitution: kv
Default branch: MAIN


Revision 1.1.1.2 (vendor branch): download - view: text, markup, annotated - select for diffs
Sun Sep 22 00:06:06 2024 UTC (2 months, 1 week ago) by christos
Branches: ISC
CVS tags: bind-9-18-30
Diff to: previous 1.1.1.1: preferred, colored
Changes since revision 1.1.1.1: +4 -2 lines
Import bind-9.18.30 (previous was 9.18.24)

Changes:

BIND 9.18.30
------------

New Features
~~~~~~~~~~~~

- Print the full path of the working directory in startup log messages.
  ``99ce0d6b838``

  named now prints its initial working directory during startup and the
  changed working directory when loading or reloading its configuration
  file if it has a valid 'directory' option defined. :gl:`#4731`
  :gl:`!9373`

Feature Changes
~~~~~~~~~~~~~~~

- Restore the ability to select individual unit tests. ``a59fe212a34``

  This adds the command line arguments: `-d` (debug), `-l` (list tests)
  and `-t test` (run this test) to the unit tests.

  e.g.  ```     % ./rdata_test -t zonemd     [==========] selected:
  Running 1 test(s).     [ RUN      ] zonemd     [       OK ] zonemd
  [==========] selected: 1 test(s) run.     [  PASSED  ] 1 test(s).
  %  ``` :gl:`#4579` :gl:`!9386`

- Process also the ISC_R_CANCELED result code in rpz_rewrite()
  ``26df9f6255b``

  Log canceled resolver queries (e.g. when shutting down a hung fetch)
  in DEBUG3 level instead of DEBUG1 which is used for the "unrecognized"
  result codes. :gl:`#4797` :gl:`!9348`

- Remove code to read and parse /proc/net/if_inet6 on Linux.
  ``887a61a4082``

  The getifaddr() works fine for years, so we don't have to keep the
  callback to parse /proc/net/if_inet6 anymore. :gl:`#4852` :gl:`!9342`

- Follow the number of CPU set by taskset/cpuset. ``17efe703cc2``

  Administrators may wish to constrain the set of cores that BIND 9 runs
  on via the 'taskset', 'cpuset' or 'numactl' programs (or equivalent on
  other O/S).

  If the admin has used taskset, the `named` will now follow to
  automatically use the given number of CPUs rather than the system wide
  count. :gl:`#4884` :gl:`!9443`

Bug Fixes
~~~~~~~~~

- Change the NS_PER_SEC (and friends) from enum to #define.
  ``0da22fc138e``

  New version of clang (19) has introduced a stricter checks when mixing
  integer (and float types) with enums.  In this case, we used enum {}
  as C17 doesn't have constexpr yet.  Change the time conversion
  constants to be #defined constants because of RHEL 8 compiler doesn't
  consider static const unsigned int to be constant. :gl:`#4845`
  :gl:`!9340`

- Check the result of dirfd() before calling unlinkat() ``b9f0df60972``

  Instead of directly using the result of dirfd() in the unlinkat()
  call, check whether the returned file descriptor is actually valid.
  That doesn't really change the logic as the unlinkat() would fail with
  invalid descriptor anyway, but this is cleaner and will report the
  right error returned directly by dirfd() instead of EBADF from
  unlinkat(). :gl:`#4853` :gl:`!9344`

- Checking whether a EDDSA key was private or not was broken.
  ``e04839c08e8``

  Checking whether a EDDSA key was private or not was broken could lead
  to attempting to sign records with a public key and this could cause a
  segmentation failure (read of a NULL pointer) within OpenSSL.
  :gl:`#4855` :gl:`!9329`

- Fix algoritm rollover bug when there are two keys with the same
  keytag. ``43c8ed45e53``

  If there is an algorithm rollover and two keys of different algorithm
  share the same keytags, then there is a possibility that if we check
  that a key matches a specific state, we are checking against the wrong
  key. This has been fixed by not only checking for matching key tag but
  also key algorithm. :gl:`#4878` :gl:`!9394`

- Stop using malloc_usable_size and malloc_size. ``cccd26e942c``

  The `malloc_usable_size()` can return size larger than originally
  allocated and when these sizes disagree the fortifier enabled by
  `_FORTIFY_SOURCE=3` detects overflow and stops the `named` execution
  abruptly.  Stop using these convenience functions as they are primary
  used for introspection-only. :gl:`#4880` :gl:`!9419`

- Preserve statement tag order in documentation. ``b4d1988c280``

  This supports bit-for-bit reproducibility of built documentation.
  :gl:`#4886` :gl:`!9409`

- Fix clang-scan 19 warnings. ``01ee251d130``

  Silence warnings generated by clang-scan. :gl:`!9388`


BIND 9.18.29
------------

New Features
~~~~~~~~~~~~

- Tighten 'max-recursion-queries' and add 'max-query-restarts' option.
  ``fe3ae71e90``

  There were cases in resolver.c when the `max-recursion-queries` quota
  was ineffective. It was possible to craft zones that would cause a
  resolver to waste resources by sending excessive queries while
  attempting to resolve a name. This has been addressed by correcting
  errors in the implementation of `max-recursion-queries`, and by
  reducing the default value from 100 to 32.

  In addition, a new `max-query-restarts` option has been added which
  limits the number of times a recursive server will follow CNAME or
  DNAME records before terminating resolution. This was previously a
  hard-coded limit of 16, and now defaults to 11.   :gl:`#4741`
  :gl:`!9283`

- Generate changelog from git log. ``21a0b6aef7``

  Use a single source of truth, the git log, to generate the list of
  CHANGES. Use the .rst format and include it in the ARM for a quick
  reference with proper gitlab links to issues and merge requests.
  :gl:`#75` :gl:`!9181`

Feature Changes
~~~~~~~~~~~~~~~

- Use _exit() in the fatal() function. ``e4c483f45f``

  Since the fatal() isn't a correct but rather abrupt termination of the
  program, we want to skip the various atexit() calls because not all
  memory might be freed during fatal() call, etc.  Using _exit() instead
  of exit() has this effect - the program will end, but no destructors
  or atexit routines will be called. :gl:`!9263`

- Fix data race in clean_finds_at_name. ``541726871d``

  Stop updating `find.result_v4` and `find.result_v4` in
  `clean_finds_at_name`. The values are supposed to be
  static. :gl:`#4118` :gl:`!9198`

Bug Fixes
~~~~~~~~~

- Reconfigure catz member zones during named reconfiguration.
  ``944d0dc942``

  During a reconfiguration named wasn't reconfiguring catalog zones'
  member zones. This has been fixed. :gl:`#4733`

- Disassociate the SSL object from the cached SSL_SESSION.
  ``64fde41253``

  When the SSL object was destroyed, it would invalidate all SSL_SESSION
  objects including the cached, but not yet used, TLS session objects.

  Properly disassociate the SSL object from the SSL_SESSION before we
  store it in the TLS session cache, so we can later destroy it without
  invalidating the cached TLS sessions. :gl:`#4834` :gl:`!9279`

- Attach/detach to the listening child socket when accepting TLS.
  ``3ead47daff``

  When TLS connection (TLSstream) connection was accepted, the children
  listening socket was not attached to sock->server and thus it could
  have been freed before all the accepted connections were actually
  closed.

  In turn, this would cause us to call isc_tls_free() too soon - causing
  cascade errors in pending SSL_read_ex() in the accepted connections.

  Properly attach and detach the children listening socket when
  accepting and closing the server connections. :gl:`#4833` :gl:`!9278`

- Make hypothesis optional for system tests. ``0d1953d7a8``

  Ensure that system tests can be executed without Python hypothesis
  package. :gl:`#4831` :gl:`!9268`

- Don't loop indefinitely when isc_task quantum is 'unlimited'
  ``674420df64``

  Don't run more events than already scheduled.  If the quantum is set
  to a high value, the task_run() would execute already scheduled, and
  all new events that result from running event->ev_action().

  Setting quantum to a number of scheduled events will postpone events
  scheduled after we enter the loop here to the next task_run()
  invocation. :gl:`!9257`

- Raise the log level of priming failures. ``c948babeeb``

  When a priming query is complete, it's currently logged at level
  ISC_LOG_DEBUG(1), regardless of success or failure. We are now raising
  it to ISC_LOG_NOTICE in the case of failure. [GL #3516] :gl:`#3516`
  :gl:`!9251`

- Add a compatibility shim for older libuv versions (< 1.19.0)
  ``61ff983f00``

  The uv_stream_get_write_queue_size() is supported only in relatively
  newer versions of libuv (1.19.0 or higher).  Provide a compatibility
  shim for this function , so BIND 9 can be built in environments with
  older libuv version.

- Remove extra newline from yaml output. ``1222dbe9f9``

  I split this into two commits, one for the actual newline removal, and
  one for issues I found, ruining the yaml output when some errors were
  outputted.

- CID 498025 and CID 498031: Overflowed constant INTEGER_OVERFLOW.
  ``bbdd888b8e``

  Add INSIST to fail if the multiplication would cause the variables to
  overflow. :gl:`#4798` :gl:`!9230`

- Remove unnecessary operations. ``2374a1a2bd``

  Decrementing optlen immediately before calling continue is unneccesary
  and inconsistent with the rest of dns_message_pseudosectiontoyaml and
  dns_message_pseudosectiontotext.  Coverity was also reporting an
  impossible false positive overflow of optlen (CID 499061). :gl:`!9224`

- Fix generation of 6to4-self name expansion from IPv4 address.
  ``df55c15ebb``

  The period between the most significant nibble of the encoded IPv4
  address and the 2.0.0.2.IP6.ARPA suffix was missing resulting in the
  wrong name being checked. Add system test for 6to4-self
  implementation. :gl:`#4766` :gl:`!9218`

- Fix false QNAME minimisation error being reported. ``4984afc80c``

  Remove the false positive "success resolving" log message when QNAME
  minimisation is in effect and the final result is NXDOMAIN.
  :gl:`#4784` :gl:`!9216`

- Dig +yaml was producing unexpected and/or invalid YAML output.
  ``2db62a4dba``

  :gl:`#4796` :gl:`!9214`

- SVBC alpn text parsing failed to reject zero length alpn.
  ``8f7be89052``

  :gl:`#4775` :gl:`!9210`

- Return SERVFAIL for a too long CNAME chain. ``f7de909b98``

  When cutting a long CNAME chain, named was returning NOERROR  instead
  of SERVFAIL (alongside with a partial answer). This has been fixed.
  :gl:`#4449` :gl:`!9204`

- Properly calculate the amount of system memory. ``9faf355a5c``

  On 32 bit machines isc_meminfo_totalphys could return an incorrect
  value. :gl:`#4799` :gl:`!9200`

- Update key lifetime and metadata after dnssec-policy reconfig.
  ``2107a64ee6``

  Adjust key state and timing metadata if dnssec-policy key lifetime
  configuration is updated, so that it also affects existing keys.
  :gl:`#4677` :gl:`!9192`

- Fix dig +timeout argument when using +https. ``381d6246d6``

  The +timeout argument was not used on DoH connections. This has been
  fixed.  :gl:`#4806` :gl:`!9161`


Changes prior to 9.18.28
------------------------

.. code-block:: none

		--- 9.18.28 released ---

	6404.	[security]	Remove SIG(0) support from named as a countermeasure
				for CVE-2024-1975. [GL #4480]

	6403.	[security]	qctx-zversion was not being cleared when it should have
				been leading to an assertion failure if it needed to be
				reused. (CVE-2024-4076) [GL #4507]

	6401.	[security]	An excessively large number of rrtypes per owner can
				slow down database query processing, so a limit has been
				placed on the number of rrtypes that can be stored per
				owner (node) in a cache or zone database. This is
				configured with the new "max-rrtypes-per-name" option,
				and defaults to 100. (CVE-2024-1737)
				[GL #3403] [GL #4548]

	6400.	[security]	Excessively large rdatasets can slow down database
				query processing, so a limit has been placed on the
				number of records that can be stored per rdataset
				in a cache or zone database. This is configured
				with the new "max-records-per-type" option, and
				defaults to 100. (CVE-2024-1737)
				[GL #497] [GL #3405]

	6399.	[security]	Malicious DNS client that sends many queries over
				TCP but never reads responses can cause server to
				respond slowly or not respond at all for other
				clients. (CVE-2024-0760) [GL #4481]

	6398.	[bug]		Fix potential data races in our DoH implementation
				related to HTTP/2 session object management and
				endpoints set object management after reconfiguration.
				We would like to thank Dzintars and Ivo from nic.lv
				for bringing this to our attention. [GL #4473]

	6397.	[bug]		Clear DNS_FETCHOPT_TRYSTALE_ONTIMEOUT when looking for
				parent NS records needed to get the DS result.
				[GL #4661]

	6395.	[bug]		Handle ISC_R_HOSTDOWN and ISC_R_NETDOWN in resolver.c.
				[GL #4736]

	6394.	[bug]		Named's -4 and -6 options now apply to zone primaries,
				also-notify and parental-agents.  Report when a zone
				has these options configured but does not have an IPv4
				or IPv6 address listed respectively. [GL #3472]

	6393.	[func]		Deal with uv_tcp_close_reset() error return codes
				more gracefully. [GL #4708]

	6392.	[bug]		Use a completely new memory context when flushing the
				cache. [GL #2744]

	6391.	[bug]		TCP client statistics could sometimes fail to decrease
				when accepting client connection fails. [GL #4742]

	6390.	[bug]		Fix a data race in isc_task_purgeevent(). [GL !8937]

	6389.	[bug]		dnssec-verify and dnssec-signzone could fail if there
				was an obscured DNSKEY RRset at a delegatation.
				[GL #4517]

	6388.	[bug]		Prevent an assertion failure caused by passing NULL to
				dns_dispatch_resume() when a dns_request times out close
				to view shutdown. [GL #4719]

	6386.	[bug]		When shutting down catzs->view could point to freed
				memory. Obtain a reference to the view to prevent this.
				[GL #4502]

	6385.	[func]		Relax SVCB alias mode checks to allow parameters.
				[GL #4704]

	6384.	[bug]		Remove infinite loop when including a directory in a
				zone file. [GL #4357]

	6383.	[bug]		Address an infinite loop in $GENERATE when a negative
				value was converted in nibble mode. [GL #4353]

	6382.	[bug]		Fix RPZ response's SOA record TTL, which was incorrectly
				set to 1 if 'add-soa' is used. [GL #3323]

.. code-block:: none

		--- 9.18.27 released ---

	6374.	[bug]		Skip to next RRSIG if signature has expired or is in
				the future rather than failing immediately. [GL #4586]

	6372.	[func]		Implement signature jitter for dnssec-policy. [GL #4554]

.. code-block:: none

		--- 9.18.26 released ---

	6364.	[protocol]	Add RESOLVER.ARPA to the built in empty zones.
				[GL #4580]

	6363.	[bug]		dig/mdig +ednsflags=<non-zero-value> did not re-enable
				EDNS if it had been disabled. [GL #4641]

	6361.	[bug]		Some invalid ISO 8601 durations were accepted
				erroneously. [GL #4624]

	6360.	[bug]		Don't return static-stub synthesised NS RRset.
				[GL #4608]

	6359.	[bug]		Fix bug in Depends (keymgr_dep) function. [GL #4552]

	6351.	[protocol]	Support for the RESINFO record type has been added.
				[GL #4413]

	6346.	[bug]		Cleaned up several minor bugs in the RBTDB dbiterator
				implementation. [GL !8741]

	6345.	[bug]		Added missing dns_rdataset_disassociate calls in
				validator.c:findnsec3proofs. [GL #4571]

	6340.	[test]		Fix incorrectly reported errors when running tests
				with `make test` on platforms with older pytest.
				[GL #4560]

	6338.	[func]		Optimize slabheader placement, so the infrastructure
				records are put in the beginning of the slabheader
				linked list. [GL !8675]

	6334.	[doc]		Improve ARM parental-agents definition. [GL #4531]

	6333.	[bug]		Fix the DNS_GETDB_STALEFIRST flag, which was defined
				incorrectly in lib/ns/query.c. [GL !8683]

	6330.	[doc]		Update ZSK minimum lifetime documentation in ARM, also
				depends on signing delay. [GL #4510]

	6328.	[func]		Add workaround to enforce dynamic linker to pull
				jemalloc earlier than libc to ensure all memory
				allocations are done via jemalloc. [GL #4404]

	6326.	[bug]		Changes to "listen-on" statements were ignored on
				reconfiguration unless the port or interface address was
				changed, making it impossible to change a related
				listener transport type. Thanks to Thomas Amgarten.
				[GL #4518] [GL #4528]

	6325.	[func]		Expose the TCP client count in statistics channel.
				[GL #4425]

	6324.	[bug]		Fix a possible crash in 'dig +nssearch +nofail' and
				'host -C' commands when one of the name servers returns
				SERVFAIL. [GL #4508]

	6313.	[bug]		When dnssec-policy is in effect the DNSKEY's TTLs in
				the zone where not being updated to match the policy.
				This lead to failures when DNSKEYs where updated as the
				TTLs mismatched. [GL #4466]

.. code-block:: none

		--- 9.18.25 released ---

	6356.	[bug]		Create the pruning task in the dns_cache_flush(), so
				the cache pruning still works after the flush.
				[GL #4621]

	6353.	[bug]		Improve the TTL-based cleaning by removing the expired
				headers from the heap, so they don't block the next
				cleaning round and clean more than a single item for
				each new addition to the RBTDB. [GL #4591]

	6352.	[bug]		Revert change 6319 and decrease lock contention during
				RBTDB tree pruning by not cleaning up nodes recursively
				within a single prune_tree() call. [GL #4596]

	6350.	[bug]		Address use after free in expire_lru_headers. [GL #4495]

.. code-block:: none

Revision 1.2
Fri Sep 23 12:15:25 2022 UTC (2 years, 2 months ago) by christos
Branches: MAIN
CVS tags: perseant-exfatfs-base-20240630, perseant-exfatfs-base, perseant-exfatfs, HEAD
FILE REMOVED
Changes since revision 1.1: +0 -0 lines
Merge conflicts between 9.16.20 and 9.16.33

Revision 1.1.1.1 (vendor branch): download - view: text, markup, annotated - select for diffs
Fri Feb 19 16:37:05 2021 UTC (3 years, 9 months ago) by christos
Branches: ISC
CVS tags: cjep_sun2x-base1, cjep_sun2x-base, cjep_sun2x, cjep_staticlib_x-base1, cjep_staticlib_x-base, cjep_staticlib_x, bind-9-16-20, bind-9-16-15, bind-9-16-12
Diff to: previous 1.1: preferred, colored
Changes since revision 1.1: +0 -0 lines
	--- 9.16.12 released ---

5578.	[protocol]	Make "check-names" accept A records below "_spf",
			"_spf_rate", and "_spf_verify" labels in order to cater
			for the "exists" SPF mechanism specified in RFC 7208
			section 5.7 and appendix D.1. [GL #2377]

5577.	[bug]		Fix the "three is a crowd" key rollover bug in KASP by
			correctly implementing Equation (2) of the "Flexible and
			Robust Key Rollover" paper. [GL #2375]

5575.	[bug]		When migrating to KASP, BIND 9 considered keys with the
			"Inactive" and/or "Delete" timing metadata to be
			possible active keys. This has been fixed. [GL #2406]

5572.	[bug]		Address potential double free in generatexml().
			[GL #2420]

5571.	[bug]		named failed to start when its configuration included a
			zone with a non-builtin "allow-update" ACL attached.
			[GL #2413]

5570.	[bug]		Improve performance of the DNSSEC verification code by
			reducing the number of repeated calls to
			dns_dnssec_keyfromrdata(). [GL #2073]

5569.	[bug]		Emit useful error message when "rndc retransfer" is
			applied to a zone of inappropriate type. [GL #2342]

5568.	[bug]		Fixed a crash in "dnssec-keyfromlabel" when using ECDSA
			keys. [GL #2178]

5567.	[bug]		Dig now reports unknown dash options while pre-parsing
			the options. This prevents "-multi" instead of "+multi"
			from reporting memory usage before ending option parsing
			with "Invalid option: -lti". [GL #2403]

5566.	[func]		Add "stale-answer-client-timeout" option, which is the
			amount of time a recursive resolver waits before
			attempting to answer the query using stale data from
			cache. [GL #2247]

5565.	[func]		The SONAMEs for BIND 9 libraries now include the current
			BIND 9 version number, in an effort to tightly couple
			internal libraries with a specific release. [GL #2387]

5562.	[security]	Fix off-by-one bug in ISC SPNEGO implementation.
			(CVE-2020-8625) [GL #2354]

5561.	[bug]		KASP incorrectly set signature validity to the value of
			the DNSKEY signature validity. This is now fixed.
			[GL #2383]

5560.	[func]		The default value of "max-stale-ttl" has been changed
			from 12 hours to 1 day and the default value of
			"stale-answer-ttl" has been changed from 1 second to 30
			seconds, following RFC 8767 recommendations. [GL #2248]

5456.	[func]		Added "primaries" as a synonym for "masters" in
			named.conf, and "primary-only" as a synonym for
			"master-only" in the parameters to "notify", to bring
			terminology up-to-date with RFC 8499. [GL #1948]

5362.	[func]		Limit the size of IXFR responses so that AXFR will
			be used instead if it would be smaller. This is
			controlled by the "max-ixfr-ratio" option, which
			is a percentage representing the ratio of IXFR size
			to the size of the entire zone. This value cannot
			exceed 100%, which is the default. [GL #1515]

	--- 9.16.11 released ---

5559.	[bug]		The --with-maxminddb=PATH form of the build-time option
			enabling support for libmaxminddb was not working
			correctly. This has been fixed. [GL #2366]

5557.	[bug]		Prevent RBTDB instances from being destroyed by multiple
			threads at the same time. [GL #2317]

5556.	[bug]		Further tweak newline printing in dnssec-signzone and
			dnssec-verify. [GL #2359]

5555.	[bug]		server->reload_status was not properly initialized.
			[GL #2361]

5554.	[bug]		dnssec-signzone and dnssec-verify were missing newlines
			between log messages. [GL #2359]

5553.	[bug]		When reconfiguring named, removing "auto-dnssec" did not
			turn off DNSSEC maintenance. [GL #2341]

5552.	[func]		When switching to "dnssec-policy none;", named now
			permits a safe transition to insecure mode and publishes
			the CDS and CDNSKEY DELETE records, as described in RFC
			8078. [GL #1750]

5551.	[bug]		named no longer attempts to assign threads to CPUs
			outside the CPU affinity set. Thanks to Ole Bjørn
			Hessen. [GL #2245]

5550.	[func]		dnssec-signzone and named now log a warning when falling
			back to the "increment" SOA serial method. [GL #2058]

5545.	[func]		OS support for load-balanced sockets is no longer
			required to receive incoming queries in multiple netmgr
			threads. [GL #2137]

5543.	[bug]		Fix UDP performance issues caused by making netmgr
			callbacks asynchronous-only. [GL #2320]

5542.	[bug]		Refactor netmgr. [GL #1920] [GL #2034] [GL #2061]
			[GL #2194] [GL #2221] [GL #2266] [GL #2283] [GL #2318]
			[GL #2321]

	--- 9.16.10 released ---

5544.	[func]		Restore the default value of "nocookie-udp-size" to 4096
			bytes. [GL #2250]

5541.	[func]		Adjust the "max-recursion-queries" default from 75 to
			100. [GL #2305]

5540.	[port]		Fix building with native PKCS#11 support for AEP Keyper.
			[GL #2315]

5539.	[bug]		Tighten handling of missing DNS COOKIE responses over
			UDP by falling back to TCP. [GL #2275]

5538.	[func]		Add NSEC3 support to KASP. A new option for
			"dnssec-policy", "nsec3param", can be used to set the
			desired NSEC3 parameters. NSEC3 salt collisions are
			automatically prevented during resalting. Salt
			generation is now logged with zone context. [GL #1620]

5534.	[bug]		The CNAME synthesized from a DNAME was incorrectly
			followed when the QTYPE was CNAME or ANY. [GL #2280]

	--- 9.16.9 released ---

5533.	[func]		Add the "stale-refresh-time" option, a time window that
			starts after a failed lookup, during which a stale RRset
			is served directly from cache before a new attempt to
			refresh it is made. [GL #2066]

5530.	[bug]		dnstap did not capture responses to forwarded UPDATE
			requests. [GL #2252]

5527.	[bug]		A NULL pointer dereference occurred when creating an NTA
			recheck query failed. [GL #2244]

5525.	[bug]		Change 5503 inadvertently broke cross-compilation by
			replacing a call to AC_LINK_IFELSE() with a call to
			AC_RUN_IFELSE() in configure.ac.  This has been fixed,
			making cross-compilation possible again. [GL #2237]

5523.	[bug]		The initial lookup in a zone transitioning to/from a
			signed state could fail if the DNSKEY RRset was not
			found. [GL #2236]

5522.	[bug]		Fixed a race/NULL dereference in TCPDNS send. [GL #2227]

5520.	[bug]		Fixed a number of shutdown races, reference counting
			errors, and spurious log messages that could occur
			in the network manager. [GL #2221]

5518.	[bug]		Stub zones now work correctly with primary servers using
			"minimal-responses yes". [GL #1736]

5517.	[bug]		Do not treat UV_EOF as a TCP4RecvErr or a TCP6RecvErr.
			[GL #2208]

	--- 9.16.8 released ---

5516.	[func]		The default EDNS buffer size has been changed from 4096
			to 1232 bytes. [GL #2183]

5515.	[func]		Add 'rndc dnssec -rollover' command to trigger a manual
			rollover for a specific key. [GL #1749]

5514.	[bug]		Fix KASP expected key size for Ed25519 and Ed448.
			[GL #2171]

5513.	[doc]		The ARM section describing the "rrset-order" statement
			was rewritten to make it unambiguous and up-to-date with
			the source code. [GL #2139]

5512.	[bug]		"rrset-order" rules using "order none" were causing
			named to crash despite named-checkconf treating them as
			valid. [GL #2139]

5511.	[bug]		'dig -u +yaml' failed to display timestamps to the
			microsecond. [GL #2190]

5510.	[bug]		Implement the attach/detach semantics for dns_message_t
			to fix a data race in accessing an already-destroyed
			fctx->rmessage. [GL #2124]

5509.	[bug]		filter-aaaa: named crashed upon shutdown if it was in
			the process of recursing for A RRsets. [GL #1040]

5508.	[func]		Added new parameter "-expired" for "rndc dumpdb" that
			also prints expired RRsets (awaiting cleanup) to the
			dump file. [GL #1870]

5507.	[bug]		Named could compute incorrect SIG(0) responses.
			[GL #2109]

5506.	[bug]		Properly handle failed sysconf() calls, so we don't
			report invalid memory size. [GL #2166]

5505.	[bug]		Updating contents of a mixed-case RPZ could cause some
			rules to be ignored. [GL #2169]

5503.	[bug]		Cleaned up reference counting of network manager
			handles, now using isc_nmhandle_attach() and _detach()
			instead of _ref() and _unref(). [GL #2122]

	--- 9.16.7 released ---

5501.	[func]		Log CDS/CDNSKEY publication. [GL #1748]

5500.	[bug]		Fix (non-)publication of CDS and CDNSKEY records.
			[GL #2103]

5499.	[func]		Add '-P ds' and '-D ds' arguments to dnssec-settime.
			[GL #1748]

5497.	[bug]		'dig +bufsize=0' failed to disable EDNS. [GL #2054]

5496.	[bug]		Address a TSAN report by ensuring each rate limiter
			object holds a reference to its task. [GL #2081]

5495.	[bug]		With query minimization enabled, named failed to
			resolve ip6.arpa. names that had extra labels to the
			left of the IPv6 part. [GL #1847]

5494.	[bug]		Silence the EPROTO syslog message on older systems.
			[GL #1928]

5493.	[bug]		Fix off-by-one error when calculating new hash table
			size. [GL #2104]

5492.	[bug]		Tighten LOC parsing to reject a period (".") and/or "m"
			as a value. Fix handling of negative altitudes which are
			not whole meters. [GL #2074]

5491.	[bug]		rbtversion->glue_table_size could be read without the
			appropriate lock being held. [GL #2080]

5489.	[bug]		Named erroneously accepted certain invalid resource
			records that were incorrectly processed after
			subsequently being written to disk and loaded back, as
			the wire format differed. Such records include: CERT,
			IPSECKEY, NSEC3, NSEC3PARAM, NXT, SIG, TLSA, WKS, and
			X25. [GL !3953]

5488.	[bug]		NTA code needed to have a weak reference on its
			associated view to prevent the latter from being deleted
			while NTA tests were being performed. [GL #2067]

5486.	[func]		Add 'rndc dnssec -checkds' command, which signals to
			named that the DS record for a given zone or key has
			been updated in the parent zone. [GL #1613]

	--- 9.16.6 released ---

5484.	[func]		Expire zero TTL records quickly rather than using them
			for stale answers. [GL #1829]

5483.	[func]		A new configuration option "stale-cache-enable" has been
			introduced to enable or disable keeping stale answers in
			cache. [GL #1712]

5482.	[bug]		If the Duplicate Address Detection (DAD) mechanism had
			not yet finished after adding a new IPv6 address to the
			system, BIND 9 would fail to bind to IPv6 addresses in a
			tentative state. [GL #2038]

5481.	[security]	"update-policy" rules of type "subdomain" were
			incorrectly treated as "zonesub" rules, which allowed
			keys used in "subdomain" rules to update names outside
			of the specified subdomains. The problem was fixed by
			making sure "subdomain" rules are again processed as
			described in the ARM. (CVE-2020-8624) [GL #2055]

5480.	[security]	When BIND 9 was compiled with native PKCS#11 support, it
			was possible to trigger an assertion failure in code
			determining the number of bits in the PKCS#11 RSA public
			key with a specially crafted packet. (CVE-2020-8623)
			[GL #2037]

5479.	[security]	named could crash in certain query resolution scenarios
			where QNAME minimization and forwarding were both
			enabled. (CVE-2020-8621) [GL #1997]

5478.	[security]	It was possible to trigger an assertion failure by
			sending a specially crafted large TCP DNS message.
			(CVE-2020-8620) [GL #1996]

5477.	[bug]		The idle timeout for connected TCP sockets, which was
			previously set to a high fixed value, is now derived
			from the client query processing timeout configured for
			a resolver. [GL #2024]

5476.	[security]	It was possible to trigger an assertion failure when
			verifying the response to a TSIG-signed request.
			(CVE-2020-8622) [GL #2028]

5475.	[bug]		Wildcard RPZ passthru rules could incorrectly be
			overridden by other rules that were loaded from RPZ
			zones which appeared later in the "response-policy"
			statement. This has been fixed. [GL #1619]

5474.	[bug]		dns_rdata_hip_next() failed to return ISC_R_NOMORE
			when it should have. [GL !3880]

5473.	[func]		The RBT hash table implementation has been changed
			to use a faster hash function (HalfSipHash2-4) and
			Fibonacci hashing for better distribution. Setting
			"max-cache-size" now preallocates a fixed-size hash
			table so that rehashing does not cause resolution
			brownouts while the hash table is grown. [GL #1775]

5471.	[bug]		The introduction of KASP support inadvertently caused
			the second field of "sig-validity-interval" to always be
			calculated in hours, even in cases when it should have
			been calculated in days. This has been fixed. (Thanks to
			Tony Finch.) [GL !3735]

5469.	[port]		On illumos, a constant called SEC is already defined in
			<sys/time.h>, which conflicts with an identically named
			constant in libbind9. This conflict has been resolved.
			[GL #1993]

5468.	[bug]		Addressed potential double unlock in process_fd().
			[GL #2005]

5466.	[bug]		Addressed an error in recursive clients stats reporting.
			[GL #1719]

5465.	[func]		Added fallback to built-in trust-anchors, managed-keys,
			or trusted-keys if the bindkeys-file (bind.keys) cannot
			be parsed. [GL #1235]

5464.	[bug]		Requesting more than 128 files to be saved when rolling
			dnstap log files caused a buffer overflow. This has been
			fixed. [GL #1989]

5462.	[bug]		Move LMDB locking from LMDB itself to named. [GL #1976]

5461.	[bug]		The STALE rdataset header attribute was updated while
			the write lock was not being held, leading to incorrect
			statistics. The header attributes are now converted to
			use atomic operations. [GL #1475]

Revision 1.1: download - view: text, markup, annotated - select for diffs
Fri Feb 19 16:37:05 2021 UTC (3 years, 9 months ago) by christos
Branches: MAIN
Initial revision

Diff request

This form allows you to request diffs between any two revisions of a file. You may select a symbolic revision name using the selection box or you may type in a numeric name using the type-in text box.

Log view options

CVSweb <webmaster@jp.NetBSD.org>