Commit Message
For details see:
https://downloads.isc.org/isc/bind9/9.20.27/doc/arm/html/notes.html#notes-for-bind-9-20-27
"Notes for BIND 9.20.27
New Features
Disclose active Negative Trust Anchors with Extended DNS Error 33.
A Negative Trust Anchor (RFC 7646) turns off DNSSEC validation for a
domain, so a name that would normally fail validation resolves instead.
named now marks such answers with Extended DNS Error code 33, "Negative
Trust Anchor", so operators can see at a glance when a response came
back only because an NTA was in effect. [GL #6268]
Feature Changes
Speed up RPZ policy zone updates.
RPZ updates used to be applied one small step at a time, adding
overhead on large policy zones. Updates are now applied as a single
batch, improving update performance for large RPZ zones, at the cost of
no longer overlapping with concurrent updates. [GL #5787] [GL #6270]
Bug Fixes
Ensure NSEC authority does not cross zonecut boundary.
When using a cached NSEC record to prove that a delegation is insecure,
named now checks that the signer name in the corresponding RRSIG is not
above a known secure delegation point. This prevents a signed namespace
from being downgraded to insecure using an NSEC record from the
grandparent zone. [GL #5967]
Treat an unusable NSEC3 chain as a verification failure.
When transferring in a mirror zone, DNSSEC verification could
incorrectly succeed when the zone had an invalid NSEC3PARAM record,
leading to subsequent validation failures. This has been fixed. [GL
#6136]
Treat non-canonical RPZ prefixes as any other failure.
RPZ prefixes that were not encoded in canonical form did not work. They
are now handled in the same way as any other encoding error. [GL #6043]
Negative caching stopped working with stale-answer-client-timeout set
to 0.
Negative answers were re-fetched on every query instead of once they
actually expired, effectively disabling negative caching. This has been
fixed. [GL #6245]
An unterminated OpenSSL private-key Label: field could be read past its
parser buffer.
The Label: field in a .private key file is now checked for length and
NUL-termination. Malformed files are rejected. [GL #6193]
Restore SMF support on Solaris and illumos. [GL #6096]
Fix compilation on GNU/Hurd. [GL #6285]
dig +yaml was producing invalid YAML when a lookup failed.
When no server could be reached, dig printed its plain-text startup
banner ahead of the YAML output, making the result unparsable. dig no
longer does this and correctly reflects options such as +nocmd, +short
and +yaml, regardless of where they appear on the command line. [GL
#1230]
Properly prevent TSIG generation command line injection attacks.
When key names are generated with rndc-confgen, tsig-keygen and
ddns-confgen, special characters must be escaped to ensure that the
configuration is parsed correctly. [GL #6071]
Fix a potential heap bounds overflow write in dnssec-signzone.
It was possible for dnssec-signzone to overflow array bounds while
signing. This has been fixed. [GL #6076]
Fix crashes on invalid DNSTAP input in dnstap-read.
Malformed DNSTAP files could trigger a NULL pointer dereference or an
out-of-bounds memory read in dnstap-read. This has been fixed. [GL
#6077] [GL #6124]"
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
---
config/rootfiles/common/bind | 10 +++++-----
lfs/bind | 4 ++--
2 files changed, 7 insertions(+), 7 deletions(-)
@@ -241,18 +241,18 @@ usr/bin/nsupdate
#usr/include/ns/types.h
#usr/include/ns/update.h
#usr/include/ns/xfrout.h
-usr/lib/libdns-9.20.26.so
+usr/lib/libdns-9.20.27.so
#usr/lib/libdns.la
#usr/lib/libdns.so
-usr/lib/libisc-9.20.26.so
+usr/lib/libisc-9.20.27.so
#usr/lib/libisc.la
#usr/lib/libisc.so
-usr/lib/libisccc-9.20.26.so
+usr/lib/libisccc-9.20.27.so
#usr/lib/libisccc.la
#usr/lib/libisccc.so
-usr/lib/libisccfg-9.20.26.so
+usr/lib/libisccfg-9.20.27.so
#usr/lib/libisccfg.la
#usr/lib/libisccfg.so
-usr/lib/libns-9.20.26.so
+usr/lib/libns-9.20.27.so
#usr/lib/libns.la
#usr/lib/libns.so
@@ -25,7 +25,7 @@
include Config
-VER = 9.20.26
+VER = 9.20.27
THISAPP = bind-$(VER)
DL_FILE = $(THISAPP).tar.xz
@@ -43,7 +43,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = 433d5ed7457367ce5b195a7d1a6f3fef21f929b158b14e3c86d8dc2004240119e4ec3b1d3cab1121be66ec77463fcb462e1207ec3339cf46ca4eec05f8c366ef
+$(DL_FILE)_BLAKE2 = 7f2f0f030748e722d12800bae567f9cfb1ddeba712a8f3a2a1018572ef9be2a69c072cca2139cb723b928ebe62c502a2715ae0d4afab3d0ba526b0a5eb5e215e
install : $(TARGET)