From patchwork Thu Jun 18 16:46:06 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Matthias Fischer X-Patchwork-Id: 9947 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1 raw public key) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "YR2" (not verified)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4gh67f0Fmpz3wbB for ; Thu, 18 Jun 2026 16:46:38 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [IPv6:2001:678:b28::201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail02.haj.ipfire.org", Issuer "YE1" (not verified)) by mail01.ipfire.org (Postfix) with ESMTPS id 4gh67d3cbSz75h for ; Thu, 18 Jun 2026 16:46:37 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4gh67d2sbJz32ZF for ; Thu, 18 Jun 2026 16:46:37 +0000 (UTC) X-Original-To: development@lists.ipfire.org Received: from mail01.ipfire.org (mail01.haj.ipfire.org [IPv6:2001:678:b28::25]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1 raw public key) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "YR2" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4gh67Z4DW0z2xbk for ; Thu, 18 Jun 2026 16:46:34 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4gh67W1jVszNL; Thu, 18 Jun 2026 16:46:31 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1781801191; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=KcnsABSKtffB2UK/YZfTiHqCUcCFukokekYUavAHZZo=; b=55E8t/LXc4gRBFFmN7Q8BBRnT9jSq/4FKUaq7BmxHQxXnf66GtLN8knGv2hyUgMYzJ+VjB yd/FHvEdmXw2ieBQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1781801191; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=KcnsABSKtffB2UK/YZfTiHqCUcCFukokekYUavAHZZo=; b=mYZ3zK8CgixwBlZ3IrI3X9ZxBAwRzreIYdDx/pbOrQuHuPDiWfxm/TJbejLfH7xCf5O61z c9+WjnqG5Dbad5jHVUquLvHViZnhQ5SyaaFAXy+QNVXHgEPRmNCKsIqEVYfT85vHN/dVLC DTw11O7kgbm7zwXSzwiwooFCGp7hGrIXGP0h1MclBvcy/OmpOidRTz7u7d88bs9T36gkac uUZBCF0umH6kHdrIo/PO61cJMJSCJf1+YAK6N3wLm7sLRieeHNxBBEkCbkjL3yeiN8lCum hYrWBE8uV9ikMJUpYYrL54Z4QeRtPABnMRMo1qFxQx3/M0H6Uc0AKI/xxOw6aQ== From: Matthias Fischer To: development@lists.ipfire.org Cc: Matthias Fischer Subject: [PATCH] bind: Update to 9.20.24 Date: Thu, 18 Jun 2026 18:46:06 +0200 Message-ID: <20260618164621.3377001-1-matthias.fischer@ipfire.org> Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 For details see: https://downloads.isc.org/isc/bind9/9.20.24/doc/arm/html/notes.html#notes-for-bind-9-20-24 "Notes for BIND 9.20.24 Removed Features Remove ineffective TCP fallback after repeated UDP timeouts. When an authoritative server failed to respond to two consecutive UDP queries, named marked the next retry as TCP but still sent it over UDP, producing misleading dnstap records. The ineffective retry path has been removed; a corrected TCP fallback will be restored in future BIND 9 versions. [GL #5529] Feature Changes Fall back to TCP on receipt of a UDP response with a mismatched query ID. BIND used to wait silently for the correct DNS message ID on a UDP fetch, even after receiving a response from the expected server with the wrong ID, leaving room for off-path spoofing attempts to keep guessing within that window. The resolver now retries the fetch over TCP on the first such response, and a new MismatchTCP statistics counter tracks how often the fallback fires. [GL #5449] Limit the number of glue records cached from a referral. When a delegation response contained many glue addresses per listed nameserver, all of them were cached without a per-nameserver bound, inflating resolver cache memory beyond what resolution could ever use. The cache now keeps at most 20 IPv4 and 20 IPv6 glue addresses per nameserver from a delegation. [GL #5701] Fix a resolver stall on a CNAME response to a DS query. A validating resolver could stall for about twelve seconds and then return SERVFAIL when an authoritative server answered a DS query with a CNAME. Such responses are now rejected promptly, so the query fails quickly instead of hanging. [GL #5878] Bug Fixes The resolver now removes other RRsets at the same name when caching a CNAME. When an RRset is in stale cache and the authoritative server changes the record type to CNAME, the resolver fails to refresh the stale cache. This has been fixed. [GL #5302] Fix nxdomain-redirect combined with dns64. When a resolver was configured with both nxdomain-redirect and dns64 in the same view, an AAAA query for a nonexistent name could abort named. The combination failed whenever the redirect zone held A records but no AAAA records. The server now serves the empty AAAA response from the redirect zone as-is, instead of attempting DNS64 synthesis on top of it. [GL #5789] Fix DNS64 owner case after DNAME restart. When BIND 9 was configured to use DNS64 and encountered a DNAME redirect, it could end up using freed memory for the DNS response owner name. This caused the response to contain corrupted data. This fix ensures the correct owner name is used when constructing the synthesized response after a DNAME redirect. [GL #5934] Clear REDIRECT flag when it isn't needed. When nxdomain-redirect is in use, and a recursive query is used to get the redirected answer, a flag is set to distinguish it from a normal recursive response. Previously, that flag was left set afterward, which could trigger an assertion if a normal recursive query was sent later on behalf of the same client: for example, because the filter-aaaa plugin was in use. This has been fixed. [GL #5936] Disable output escaping in bind9.xsl. The statistics charts were not displaying on some browsers. This has been fixed. [GL #5990] Fix crash on badly configured secondary signer. A badly configured secondary signer that was missing the file entry caused the server to crash, rather than to reject the configuration. This has been fixed. [GL #5993] Fix a possible crash on concurrent TKEY DELETE for the same key. On a server configured with tkey-gssapi-keytab, an authenticated peer could crash named by sending two TKEY DELETE requests for the same dynamic key in rapid succession. This has been fixed. [GL #6001] Reject RRSIG records covering meta-types. A recursive resolver could accept and cache an RRSIG record whose Type-Covered field named a meta-type (ANY, AXFR, IXFR, MAILA, MAILB), even though no real RRset of those types ever exists. Such records are now rejected by the DNS message parser. [GL #6002]" Signed-off-by: Matthias Fischer --- config/rootfiles/common/bind | 10 +++++----- lfs/bind | 4 ++-- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/config/rootfiles/common/bind b/config/rootfiles/common/bind index d85eb2b3f..43e1a813d 100644 --- a/config/rootfiles/common/bind +++ b/config/rootfiles/common/bind @@ -241,18 +241,18 @@ usr/bin/nsupdate #usr/include/ns/types.h #usr/include/ns/update.h #usr/include/ns/xfrout.h -usr/lib/libdns-9.20.23.so +usr/lib/libdns-9.20.24.so #usr/lib/libdns.la #usr/lib/libdns.so -usr/lib/libisc-9.20.23.so +usr/lib/libisc-9.20.24.so #usr/lib/libisc.la #usr/lib/libisc.so -usr/lib/libisccc-9.20.23.so +usr/lib/libisccc-9.20.24.so #usr/lib/libisccc.la #usr/lib/libisccc.so -usr/lib/libisccfg-9.20.23.so +usr/lib/libisccfg-9.20.24.so #usr/lib/libisccfg.la #usr/lib/libisccfg.so -usr/lib/libns-9.20.23.so +usr/lib/libns-9.20.24.so #usr/lib/libns.la #usr/lib/libns.so diff --git a/lfs/bind b/lfs/bind index 67a1a1ef0..ef03c4e7b 100644 --- a/lfs/bind +++ b/lfs/bind @@ -25,7 +25,7 @@ include Config -VER = 9.20.23 +VER = 9.20.24 THISAPP = bind-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -43,7 +43,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = f4f5526fac2832685204ccc93087df3ce2dd3fbb267a5b68d0cf8074365a8f1d6e7b9ff130b41a023ea8dd96499a361a0396188f0a71a08630c54ec13e63c39a +$(DL_FILE)_BLAKE2 = 06fde034ef2d3f4432caf5d9a701f70f32dec94be63e64dfd5484d9e008245ca5707c067c0fa19e1e2c0a3d83d2bbeb465c6ec18aceed48ffaad6973c8a77a54 install : $(TARGET)