From patchwork Wed Aug 19 17:34:23 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Matthias Fischer X-Patchwork-Id: 10163 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1 raw public key) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "YR2" (not verified)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4hQDHP4TP9z3wkB for ; Wed, 19 Aug 2026 17:35:29 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail02.haj.ipfire.org", Issuer "YE1" (not verified)) by mail01.ipfire.org (Postfix) with ESMTPS id 4hQDHD72h0z7PF for ; Wed, 19 Aug 2026 17:35:20 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4hQDGm4qMGz36Vr for ; Wed, 19 Aug 2026 17:34:56 +0000 (UTC) X-Original-To: development@lists.ipfire.org Received: from mail01.ipfire.org (mail01.haj.ipfire.org [IPv6:2001:678:b28::25]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1 raw public key) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "YR2" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4hQDGj6563z2xLt for ; Wed, 19 Aug 2026 17:34:53 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4hQDGV4Zxlz1yT; Wed, 19 Aug 2026 17:34:42 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1787160882; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=qBZIntNwPyvPxQAxeECbaAfArDRacPd64HayOtd8GiY=; b=DL+q25s2NYNHeArvJ/7+vCqlKCBdvCFoXoWh5bc1QVNeA5I/1dvlbEgnxFH6NPIABHNAyR xdH2lKH0gusYCBBQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1787160882; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=qBZIntNwPyvPxQAxeECbaAfArDRacPd64HayOtd8GiY=; b=Lq8ScYDsZK621LCQbBKVddOb1BLElXl6cROrKSpj+8hXifkLN4KqSb15C/ONmmcN7mkIOc 8hB1q+cnsAGaMN7mZT/4/PQYbg0tYzLmEiB9EpIGOa1LnQJdfKWO1j1z/CxwmSH9/Vzc/6 WVVMPRwnDui9OdjUsaIbqnJXiRjRx/rk8b5G8Bq/koJi+ksK8GjdmabfEE+zX8cPVoVs63 Yl75WJMB8qgfVw29kvAVErPA5Cp7qYaBS61GesSOp8W0oMMfy/3krVbjABW3VUpXHKLzS/ oo+dmxdmWmpELLC+edIEobscS2v/YL7TCu8C9dhGBhe5jfKJaMaMJ14MyivdUA== From: Matthias Fischer To: development@lists.ipfire.org Cc: Matthias Fischer Subject: [PATCH] bind: Update to 9.20.27 Date: Wed, 19 Aug 2026 19:34:23 +0200 Message-ID: <20260819173430.163046-1-matthias.fischer@ipfire.org> Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 For details see: https://downloads.isc.org/isc/bind9/9.20.27/doc/arm/html/notes.html#notes-for-bind-9-20-27 "Notes for BIND 9.20.27 New Features Disclose active Negative Trust Anchors with Extended DNS Error 33. A Negative Trust Anchor (RFC 7646) turns off DNSSEC validation for a domain, so a name that would normally fail validation resolves instead. named now marks such answers with Extended DNS Error code 33, "Negative Trust Anchor", so operators can see at a glance when a response came back only because an NTA was in effect. [GL #6268] Feature Changes Speed up RPZ policy zone updates. RPZ updates used to be applied one small step at a time, adding overhead on large policy zones. Updates are now applied as a single batch, improving update performance for large RPZ zones, at the cost of no longer overlapping with concurrent updates. [GL #5787] [GL #6270] Bug Fixes Ensure NSEC authority does not cross zonecut boundary. When using a cached NSEC record to prove that a delegation is insecure, named now checks that the signer name in the corresponding RRSIG is not above a known secure delegation point. This prevents a signed namespace from being downgraded to insecure using an NSEC record from the grandparent zone. [GL #5967] Treat an unusable NSEC3 chain as a verification failure. When transferring in a mirror zone, DNSSEC verification could incorrectly succeed when the zone had an invalid NSEC3PARAM record, leading to subsequent validation failures. This has been fixed. [GL #6136] Treat non-canonical RPZ prefixes as any other failure. RPZ prefixes that were not encoded in canonical form did not work. They are now handled in the same way as any other encoding error. [GL #6043] Negative caching stopped working with stale-answer-client-timeout set to 0. Negative answers were re-fetched on every query instead of once they actually expired, effectively disabling negative caching. This has been fixed. [GL #6245] An unterminated OpenSSL private-key Label: field could be read past its parser buffer. The Label: field in a .private key file is now checked for length and NUL-termination. Malformed files are rejected. [GL #6193] Restore SMF support on Solaris and illumos. [GL #6096] Fix compilation on GNU/Hurd. [GL #6285] dig +yaml was producing invalid YAML when a lookup failed. When no server could be reached, dig printed its plain-text startup banner ahead of the YAML output, making the result unparsable. dig no longer does this and correctly reflects options such as +nocmd, +short and +yaml, regardless of where they appear on the command line. [GL #1230] Properly prevent TSIG generation command line injection attacks. When key names are generated with rndc-confgen, tsig-keygen and ddns-confgen, special characters must be escaped to ensure that the configuration is parsed correctly. [GL #6071] Fix a potential heap bounds overflow write in dnssec-signzone. It was possible for dnssec-signzone to overflow array bounds while signing. This has been fixed. [GL #6076] Fix crashes on invalid DNSTAP input in dnstap-read. Malformed DNSTAP files could trigger a NULL pointer dereference or an out-of-bounds memory read in dnstap-read. This has been fixed. [GL #6077] [GL #6124]" Signed-off-by: Matthias Fischer --- config/rootfiles/common/bind | 10 +++++----- lfs/bind | 4 ++-- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/config/rootfiles/common/bind b/config/rootfiles/common/bind index 79fe4917d..e650d3ad0 100644 --- a/config/rootfiles/common/bind +++ b/config/rootfiles/common/bind @@ -241,18 +241,18 @@ usr/bin/nsupdate #usr/include/ns/types.h #usr/include/ns/update.h #usr/include/ns/xfrout.h -usr/lib/libdns-9.20.26.so +usr/lib/libdns-9.20.27.so #usr/lib/libdns.la #usr/lib/libdns.so -usr/lib/libisc-9.20.26.so +usr/lib/libisc-9.20.27.so #usr/lib/libisc.la #usr/lib/libisc.so -usr/lib/libisccc-9.20.26.so +usr/lib/libisccc-9.20.27.so #usr/lib/libisccc.la #usr/lib/libisccc.so -usr/lib/libisccfg-9.20.26.so +usr/lib/libisccfg-9.20.27.so #usr/lib/libisccfg.la #usr/lib/libisccfg.so -usr/lib/libns-9.20.26.so +usr/lib/libns-9.20.27.so #usr/lib/libns.la #usr/lib/libns.so diff --git a/lfs/bind b/lfs/bind index 29c2c7850..b5d6cdf60 100644 --- a/lfs/bind +++ b/lfs/bind @@ -25,7 +25,7 @@ include Config -VER = 9.20.26 +VER = 9.20.27 THISAPP = bind-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -43,7 +43,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 433d5ed7457367ce5b195a7d1a6f3fef21f929b158b14e3c86d8dc2004240119e4ec3b1d3cab1121be66ec77463fcb462e1207ec3339cf46ca4eec05f8c366ef +$(DL_FILE)_BLAKE2 = 7f2f0f030748e722d12800bae567f9cfb1ddeba712a8f3a2a1018572ef9be2a69c072cca2139cb723b928ebe62c502a2715ae0d4afab3d0ba526b0a5eb5e215e install : $(TARGET)