From patchwork Thu Oct 22 16:42:10 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Adolf Belka X-Patchwork-Id: 10459 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1 raw public key) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "YR1" (not verified)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4j9X4q2D6qz3wph for ; Thu, 22 Oct 2026 16:42:35 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [IPv6:2001:678:b28::201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail02.haj.ipfire.org", Issuer "YE2" (not verified)) by mail01.ipfire.org (Postfix) with ESMTPS id 4j9X4p4Q4Qz6bw for ; Thu, 22 Oct 2026 16:42:34 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4j9X4m4Zr0z377w for ; Thu, 22 Oct 2026 16:42:32 +0000 (UTC) X-Original-To: development@lists.ipfire.org Received: from mail01.ipfire.org (mail01.haj.ipfire.org [IPv6:2001:678:b28::25]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1 raw public key) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "YR1" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4j9X4d26y1z2ym2 for ; Thu, 22 Oct 2026 16:42:25 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4j9X4Z4hSjzHj; Thu, 22 Oct 2026 16:42:22 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1792687342; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=dWZUsqOlyS2QxzTZMcZT9pGcVGIykfkM04sLXP6rCy4=; b=vuawArIt64O4XYRldpXL1jytum4ZpmzR0Wm4RdTAvF9fn9HHDCas8MO9v6z7eK59+rzqLi PWgEzAV1NG4Cx2Cw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1792687343; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=dWZUsqOlyS2QxzTZMcZT9pGcVGIykfkM04sLXP6rCy4=; b=Loo6LG3HDEeCRx7uWe1ZbI/u7OfYaqRdSj2KMlUiI6HDDnDcmdaQ4tTJ5x5l4/Gh3kef6b t6napCu05vPHHJKv85PIb0HLigtgusrBvVFU4RzvVwf2EJ+JfulE9GMG/JyLDLXNrl2+Z4 Qfm7Tz+gCElnALN1REyv4foPSbJVBlw+H+9auvTJL4cIXJ4I3/7SHuvmJzfKwTD06WcjGn K2cjI2iF02SUZbqVv4IvKjK/TUtCGwqQeDqH66Zy6bjvXz5JKHV+eiGWFrJfIEzXUCb+C5 vw/G/7s9UThTdAPrxEAoVsOL0zsvzjCKsXfh/vb7LeQCvAT7Aq6WV3m4ld+Dhg== From: Adolf Belka To: development@lists.ipfire.org Cc: Adolf Belka Subject: [PATCH] bind: Update to version 9.20.30 Date: Thu, 22 Oct 2026 18:42:10 +0200 Message-ID: <20261022164218.3359591-1-adolf.belka@ipfire.org> Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 - Update from version 9.20.29 to 9.20.30 - Update of rootfile 4 CVE fixes - Changelog 9.20.30 Security Fixes - [CVE-2026-19630] Crafted DNS messages could exhaust CPU while being parsed. ``5e8a2e1c76a`` A crafted message could make named spend a disproportionate amount of time expanding compressed names in it, letting a client saturate all worker threads with very little traffic and time out legitimate queries. named now bounds how much name expansion a single message can require and answers FORMERR when that bound is exceeded; ordinary traffic, including zone transfers and dynamic updates, stays well inside it. :gl:`#5932` - [CVE-2026-94300] Fix remote termination of named under concurrent GSS-TSIG traffic. ``fe9cc14af0d`` A GSS-TSIG session negotiated through TKEY is shared by every message signed or verified with that key, and named did not serialize access to it, so concurrent signed messages could corrupt Kerberos-owned state and terminate named unexpectedly. :gl:`#6320` - [CVE-2026-96888] Possible crash with redirect and qname-minimization strict. ``1e1d0d42b59`` Processing an NXDOMAIN response with a redirect zone could cause `named` to crash if `qname-minimization` was set to `strict`. :gl:`#6386` - [CVE-2026-97313] Fix a bug when resuming from a query initiated by RPZ. ``3e4fe14392e`` The :iscman:`named` process could terminate unexpectedly when resuming from a query initiated by RPZ processing. This has been fixed. ISC would like to thank `whisperer` for reporting the issue. :gl:`#6408` Bug Fixes - Remove spurious named/named-checkconf warning. ``b066dde7047`` "static entry for the root zone WILL FAIL after key rollover - use trust-anchors with initial-key or initial-ds instead" only makes sense when you are using ICANN root keys as they use RFC 5011 for DNSKEY management. Don't log it in other circumstances. :gl:`#5572` :gl:`!12788` - Fix a data race in the RPZ summary database. ``f892fe7857b`` Reloading a response policy zone could modify entries of the summary database in place while queries were reading them without a lock, which ThreadSanitizer reported as a data race. Entries are now replaced with a fresh copy instead, so queries keep reading a consistent entry and the query path stays lock-free. :gl:`#5594` :gl:`!12696` - Fix private-type RRset handling during apex delete updates. ``f0aa2a0fab3`` When DNS UPDATE processing manipulates `diff.tuples` (e.g. during delete-all-at-name or delete-RRset operations at a zone apex with TYPE65534 private signing state), tuples were being unlinked from the list using `ISC_LIST_UNLINK()` directly. This bypassed the `diff.size` counter, causing it to drift out of sync with the actual list contents. This commit introduces `dns_diff_unlink()`, which keeps `diff.size` accurate when removing a tuple, and updates all call sites in `lib/dns/` and `lib/ns/` that previously manipulated the list directly. ISC thanks Mcsky23 and Qifan Zhang of Palo Alto Networks for reporting the issue. :gl:`#5802` :gl:`!12703` - Revert "Prevent overwriting an existing iptable node when merging" ``12dda38637f`` This reverts commit ebd86076bc30322d2955599bbc36ecfcbf8c0664. The above change had unintended side effects. The issue it attempted to address will be fixed properly in due course. :gl:`#6049` :gl:`!12740` - Don't accept HMAC-based keys and signatures for SIG(0) or DNSSEC. ``52326a3fd05`` Due to an oversight HMAC keys could be accepted for SIG(0) and DNSSEC purposes. This has been fixed. :gl:`#6086` :gl:`!12700` - Fix DNSSEC tool dates read one hour late during daylight saving time. ``78be42b3fdd`` When a key timing value was passed to the DNSSEC tools in the format that dnssec-settime -p prints (for example Wed Jul 1 12:00:00 2026), it was read as standard time. While daylight saving time was in effect, the resulting time was one hour late. These values are now read in the correct local time. :gl:`#6089` :gl:`!12889` - "libisccc flat S-expression free can exhaust stack" ``bcb45f4c696`` It was possible to exceed the stack in rndc if it had to free really deep answer chains from a hostile server. Flatten the freeing of answer chains. Printing the sexpr tree for debugging also suffers from the same stack exhaustion problem due to excessive recursion. Flatten sexpr tree printing. :gl:`#6090` :gl:`!12786` - Fix RRL qps-scale TCP credit age check uses the response bucket age. ``0f047525d94`` There was a cut-and-paste bug in `debit_rrl_entry` where the age from the wrong entry was used to set scale. Use `credit_e` instead of `e`. :gl:`#6106` :gl:`!12850` - Enforce non empty URI target field in URI record. ``409b4c82e19`` RFC 7553 requires that the URI target field MUST NOT be an empty URI (""). This is now enforced by the from text and from wire methods. :gl:`#6134` :gl:`!12699` - Fix a space calculation bug when loading a zone in "RAW" format. ``f6a08c7f34e`` When loading a specially crafted zone file in "RAW" format, the :iscman:`named` process could terminate unexpectedly. This has been fixed. :gl:`#6141` :gl:`!12782` - Dst_key_fromdns should fail on unsupported algorithms. ``ce7c7704f30`` dst_key_fromdns could succeed on unsupported algorithms causing failures later in code which assumed that a dst_key_t always had a supported algorithms. :gl:`#6192` :gl:`!12707` - Dynamic update prerequisites could probe zones that refuse queries. ``0421a637880`` Dynamic update prerequisites did not honor `allow-query-on`, nor `allow-query` for inline-signed zones, so clients that were refused queries could use them to learn whether records exist in the zone. These ACLs are now enforced for dynamic updates. :gl:`#6216` :gl:`#6217` :gl:`!12905` - Fix delv +ns view reference counting. ``109c80c74e9`` Delv's matchview doesn't attach to the view as named does when called with +ns. This can result in a view reference underflow if an unexpected request is received by delv. This has been fixed. :gl:`#6236` :gl:`!12737` - Named-journalprint -x could dereference a NULL pointer. ``26f87b37a26`` When a journal is built without an index table, named-journalprint could dereference a NULL pointer when printing extended diagnostics (-x). This has been fixed. :gl:`#6238` :gl:`!12721` - Initialise dstip in notify_send_toaddr and checkds_send_toaddr. ``3260bf7b513`` The dstip structure was not initialised on all paths before it was used in notify_send_toaddr and checkds_send_toaddr. This could cause server clauses to be ineffective. This has been fixed. :gl:`#6239` :gl:`!12722` - Fix a catalog zone update bug. ``a694601fafe`` During a catalog zone update with an unusual case when a new member zone appeared in the new version of the catalog zone under the same label as used for another member in the old version of the catalog zone, the old member zone could remain in the view and be authoritatively served until :iscman:`named` was reloaded or restarted. This has been fixed. :gl:`#6305` :gl:`!12751` - Fix empty SSLKEYLOGFILE environment variable handling. ``da53d3097d3`` If named is started with an empty SSLKEYLOGFILE environment variable it could trigger a REQUIRE failure. Treat an empty SSLKEYLOGFILE environment variable as if it doesn't exist. :gl:`#6306` :gl:`!12873` - Dig +dns64prefix could process non-IN AAAA records. ``8a05bd1db04`` dig +dns64prefix could process non-IN AAAA records if there was a hostile resolver resulting in an out of bounds read. This has been fixed. :gl:`#6312` :gl:`!12793` - Save_command_line mishandles byte with high bit set. ``fe35e694536`` save_command_line fails to handle char with high bit set correctly when char is treated as signed. This has been fixed. :gl:`#6316` :gl:`!12720` - Account for null terminator when using NAME_MAX. ``2230c781761`` The `NAME_MAX` value in `limits.h` is not guaranteed to include space for the terminating null character in a string. This can cause unexpected behavior on some platforms, such as a directory scan stopping too soon if a 255-character filename is encountered. Buffers intended to hold filenames are now allocated with `NAME_MAX + 1` bytes. :gl:`#6324` :gl:`!12903` - Prevent excessive RRL table scans under load. ``76afd2b2b65`` Bound RRL entry recycling to prevent large tables from delaying other responses. :gl:`#6351` :gl:`!12794` - Named-checkconf exits without returning a error with a bad command line. ``f187d92dde7`` Named-checkconf was exiting with a 0 exit status when there was a bad command line argument. This meant that `named-checkconf $ARGS && reload` could call reload when $ARGS was bad. This has been fixed. :gl:`#6400` :gl:`!12727` - Unlink the temporary file on rename failure in masterdump.c:closeandrename. ``9fd230d7e06`` If the rename fails in masterdump.c:closeandrename there is no useful purpose keeping the temporary file. We already remove it on other error conditions in that function. :gl:`#6405` :gl:`!12741` - Statistics channel serves data on unregistered URL prefixes. ``89ad99d551d`` The code to match the requested URL with the URLs named serves wasn't correct. Truncated request URLs where being matched when they shouldn't have been. This has been fixed. :gl:`#6415` :gl:`!12789` - Fix a crash on OpenBSD when a signal reaches an idle worker thread. ``2e7855b1577`` On OpenBSD, a signal delivered to named while one of its worker threads was idle could make the server abort with a fatal "Operation canceled" error, because OpenBSD reports such an interrupted wait differently from Linux and the other supported systems. The wait is now resumed after the signal, as it already was elsewhere. :gl:`#6427` :gl:`!12771` - Resolve names in insecure zones whose apex answers with a CNAME. ``ffa1efabddb`` A validating resolver returned SERVFAIL for names in an unsigned zone whose apex answers with a CNAME, because the validator refused to look up the DS proof that shows the zone is insecure. That lookup is now allowed, and the cache keeps a CNAME next to other records at the same name (including the parent's delegation data) instead of deleting one for the other, choosing the fresher record at lookup time; this supersedes the earlier fix for stale answers after a record changes to or from a CNAME. :gl:`#6435` :gl:`!12890` - Add sign delay to offline KSK ZRRSIG state timing. ``6a4acfe5a43`` With offline KSK, the ZRRSIG state of a ZSK was derived from the key timing without the sign delay, and retire-safety only counted towards the next rekey time, so during a ZSK rollover the signatures were reported omnipresent (or hidden) days too early. Signing itself is not affected. :gl:`!12863` - Fix TSIG session loss across a reload. ``5b63fff3efc`` Dynamic TSIG sessions negotiated through TKEY were saved to disk by whichever view released the key ring first, which during a reload was the outgoing view — consuming sessions the incoming view was still using and forcing clients to renegotiate. Sessions are now saved only when the last view releases them, and a failed save no longer replaces the stored sessions with a truncated file. :gl:`!12802` - GSS-TSIG keys now last as long as the negotiated context. ``c9af511a867`` When GSS-TSIG is in use, the TSIG key that named derives from a completed TKEY negotiation always expired after at most one hour, even when the negotiated security context was valid for far longer, so clients had to repeat the TKEY exchange every hour to keep sending dynamic updates. named now keeps such a key for as long as that context remains valid, and applies the one-hour limit only when its lifetime cannot be determined. :gl:`!12783` - Keep the zone table read section open until the zone is attached. ``5f35fd6c5c5`` dns_zt_find() ended its qp-trie read transaction before checking the zone type and attaching to the zone, which is only safe as long as the callers in view.c happen to hold an RCU read lock of their own. The read section is now closed after the reference has been taken, so the zone can no longer be reclaimed out from under the lookup. :gl:`!12780` - Pass the message pools to destroypools() in the declared order. ``23aef824bfb`` The arguments were swapped, so the emptiness assertion named the wrong pool. :gl:`!12814` - Support program suffixes of tsig-keygen and ddns-confgen. ``b2cd0c5d0a7`` Suffixes different than .exe are used on Fedora. But those commands require exact names only. Allow switching between two variants only from prefix. That should work on all platforms. It should support also names like tsig-keygen-9.18 or tsig-keygen-9.21. The same case applies to named-checkzone and named-compilezone. :gl:`!12901` Signed-off-by: Adolf Belka --- config/rootfiles/common/bind | 13 +++++-------- lfs/bind | 4 ++-- 2 files changed, 7 insertions(+), 10 deletions(-) diff --git a/config/rootfiles/common/bind b/config/rootfiles/common/bind index 571294134..6959e4233 100644 --- a/config/rootfiles/common/bind +++ b/config/rootfiles/common/bind @@ -127,7 +127,6 @@ usr/bin/nsupdate #usr/include/isc/dir.h #usr/include/isc/dnsstream.h #usr/include/isc/endian.h -#usr/include/isc/entropy.h #usr/include/isc/errno.h #usr/include/isc/error.h #usr/include/isc/file.h @@ -138,7 +137,6 @@ usr/bin/nsupdate #usr/include/isc/hash.h #usr/include/isc/hashmap.h #usr/include/isc/heap.h -#usr/include/isc/helper.h #usr/include/isc/hex.h #usr/include/isc/histo.h #usr/include/isc/hmac.h @@ -199,7 +197,6 @@ usr/bin/nsupdate #usr/include/isc/time.h #usr/include/isc/timer.h #usr/include/isc/tls.h -#usr/include/isc/tm.h #usr/include/isc/types.h #usr/include/isc/urcu.h #usr/include/isc/url.h @@ -241,18 +238,18 @@ usr/bin/nsupdate #usr/include/ns/types.h #usr/include/ns/update.h #usr/include/ns/xfrout.h -usr/lib/libdns-9.20.29.so +usr/lib/libdns-9.20.30.so #usr/lib/libdns.la #usr/lib/libdns.so -usr/lib/libisc-9.20.29.so +usr/lib/libisc-9.20.30.so #usr/lib/libisc.la #usr/lib/libisc.so -usr/lib/libisccc-9.20.29.so +usr/lib/libisccc-9.20.30.so #usr/lib/libisccc.la #usr/lib/libisccc.so -usr/lib/libisccfg-9.20.29.so +usr/lib/libisccfg-9.20.30.so #usr/lib/libisccfg.la #usr/lib/libisccfg.so -usr/lib/libns-9.20.29.so +usr/lib/libns-9.20.30.so #usr/lib/libns.la #usr/lib/libns.so diff --git a/lfs/bind b/lfs/bind index ae684c364..08fd4e3cd 100644 --- a/lfs/bind +++ b/lfs/bind @@ -25,7 +25,7 @@ include Config -VER = 9.20.29 +VER = 9.20.30 THISAPP = bind-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -43,7 +43,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 0707c48f2d8eb898578bf1d6c2e626e17f93b50394855dd697ccd7e8b98c0926366112cc7dab9f6becd3d01210958e365bcc60142558cdf4ce28002dcc2906de +$(DL_FILE)_BLAKE2 = 5ab0bba53c631817984d03a630f2f71a52a06a5a17bae34229af723e9acddcd13d12c4f40a90ecdb1967ce2fa8406977a84590985a143b38dc93c5894839424a install : $(TARGET)