Hello, this email is a notification from the Auto Upgrade Helper that the automatic attempt to upgrade the recipe(s) *bind* to *9.20.29* has Succeeded.
Next steps:
- apply the patch: git am 0001-bind-upgrade-9.20.27-9.20.29.patch
- check the changes to upstream patches and summarize them in the commit
message,
- compile an image that contains the package
- perform some basic sanity tests
- amend the patch and sign it off: git commit -s --reset-author --amend
- send it to the appropriate mailing list
Alternatively, if you believe the recipe should not be upgraded at this time,
you can fill RECIPE_NO_UPDATE_REASON in respective recipe file so that
automatic upgrades would no longer be attempted.
Please review the attached files for further information and build/update
failures.
Any problem please file a bug at
https://bugzilla.yoctoproject.org/enter_bug.cgi?product=Automated%20Update%20Handler
Regards,
The Upgrade Helper
-- >8 --
>From 64cefd8c4db9e91b9782d04d85d1e6c1d578ea9e Mon Sep 17 00:00:00 2001
From: Upgrade Helper <[email protected]>
Date: Thu, 17 Sep 2026 05:32:24 +0000
Subject: [PATCH] bind: upgrade 9.20.27 -> 9.20.29
Source: doc/changelog/changelog-9.20.28.rst, doc/changelog/changelog-9.20.29.rst
BIND 9.20.28
------------
.. note::
The BIND 9.20.28 release was withdrawn after the discovery of a
regression in it during pre-release testing.
BIND 9.20.29
------------
Security Fixes
~~~~~~~~~~~~~~
- [CVE-2026-19668] Prevent excessive CPU use validating crafted DNSSEC
responses. ``a0a61dba9e``
A malicious authoritative server could serve a securely delegated zone
whose DS and DNSKEY records carry many distinct key tags but no valid
match, forcing a validating resolver into excessive key-tag matching
and high CPU use for every query. BIND now bounds this work with the
per-query validation limit (max-validations-per-fetch). :gl:`#5349`
- [CVE-2026-19033] Require a TSIG on every message of incoming zone
transfers. ``9404cd2b8c``
BIND 9 used to accept TSIG-signed zone transfers in which some
messages were unsigned, and processed those messages before the next
signature could vouch for them. It now requires a TSIG on every
message of an incoming AXFR or IXFR; all modern nameserver already
sign every message, so no change is expected in practice. :gl:`#6062`
- [CVE-2026-77119] Prevent a DNSSEC downgrade of secure delegations via
unrelated NSEC3. ``3bed9c8e9e``
A validating resolver could be tricked into treating a secure
delegation as unsigned and accepting forged answers for names beneath
it, if an attacker could inject responses to its queries. Such forged
proofs are now rejected. :gl:`#6234`
- [CVE-2026-19941] Prevent forged DNSSEC-validated NXDOMAIN responses.
``a36bf58daf``
A validating resolver could accept a signed NSEC record from an
unrelated zone as proof that a wildcard did not exist. An on-path
attacker or malicious forwarder controlling a signed zone could
therefore forge an authenticated NXDOMAIN response for a name that
should resolve through a wildcard. BIND now requires the
wildcard-denial and name-nonexistence proofs to be signed by the same
zone. :gl:`#6253`
- [CVE-2026-19666] DNS64 with break-dnssec could cause an assertion
failure. ``4cec4965c4``
When a "dns64" statement is configured with "break-dnssec yes" and its
"exclude" list matches some but not all of the addresses in an AAAA
RRset, named removes the excluded addresses from the answer instead of
synthesizing new ones. If the answer being filtered had been cached
together with a proof that the queried name does not exist -- which is
what a wildcard match produces -- named terminated with an assertion
failure.
Only recursive resolvers are affected, and only when "break-dnssec
yes" is in use; the answer has to come from the cache, so a server
that is only authoritative cannot reach this. :gl:`#6301`
- [CVE-2026-19667] Reject negative cache records that do not fit in a
dns_rdata_t. ``dbf08c8581``
A single crafted response from a server could make a resolver cache a
malformed negative entry and th
[Changelog truncated as it exceeds 3000 characters;
the full changelog can be found in an attachment to the AUH email]
---
.../bind/bind/0001-avoid-start-failure-with-bind-user.patch | 2 +-
.../0001-m4-Backport-ax_prog_cc_for_build.m4-macros.patch | 2 +-
...0001-named-lwresd-V-and-start-log-hide-build-options.patch | 4 ++--
...bind-ensure-searching-for-json-headers-searches-sysr.patch | 4 ++--
meta/recipes-connectivity/bind/bind/conf.patch | 2 +-
.../bind/bind/init.d-add-support-for-read-only-rootfs.patch | 2 +-
.../bind/bind/make-etc-initd-bind-stop-work.patch | 2 +-
.../bind/{bind_9.20.27.bb => bind_9.20.29.bb} | 2 +-
8 files changed, 10 insertions(+), 10 deletions(-)
rename meta/recipes-connectivity/bind/{bind_9.20.27.bb => bind_9.20.29.bb}
(97%)
diff --git
a/meta/recipes-connectivity/bind/bind/0001-avoid-start-failure-with-bind-user.patch
b/meta/recipes-connectivity/bind/bind/0001-avoid-start-failure-with-bind-user.patch
index 30da1e9fd3..15796a15fb 100644
---
a/meta/recipes-connectivity/bind/bind/0001-avoid-start-failure-with-bind-user.patch
+++
b/meta/recipes-connectivity/bind/bind/0001-avoid-start-failure-with-bind-user.patch
@@ -1,4 +1,4 @@
-From 7682cbc2fa624fbeeb088736e154090d92c8b524 Mon Sep 17 00:00:00 2001
+From 95141cf9494292fc5645165ef3d5e9e2ed2208c6 Mon Sep 17 00:00:00 2001
From: Chen Qi <[email protected]>
Date: Mon, 15 Oct 2018 16:55:09 +0800
Subject: [PATCH] avoid start failure with bind user
diff --git
a/meta/recipes-connectivity/bind/bind/0001-m4-Backport-ax_prog_cc_for_build.m4-macros.patch
b/meta/recipes-connectivity/bind/bind/0001-m4-Backport-ax_prog_cc_for_build.m4-macros.patch
index f1d8a8e569..99e781799d 100644
---
a/meta/recipes-connectivity/bind/bind/0001-m4-Backport-ax_prog_cc_for_build.m4-macros.patch
+++
b/meta/recipes-connectivity/bind/bind/0001-m4-Backport-ax_prog_cc_for_build.m4-macros.patch
@@ -1,4 +1,4 @@
-From a633e336c248ceab41d3182848b65c95e90ef88c Mon Sep 17 00:00:00 2001
+From 06e9624eb7e474a08ed7e1a456bfe9759ba211da Mon Sep 17 00:00:00 2001
From: Khem Raj <[email protected]>
Date: Fri, 10 Apr 2026 23:33:49 +0000
Subject: [PATCH] m4: Backport ax_prog_cc_for_build.m4 macros
diff --git
a/meta/recipes-connectivity/bind/bind/0001-named-lwresd-V-and-start-log-hide-build-options.patch
b/meta/recipes-connectivity/bind/bind/0001-named-lwresd-V-and-start-log-hide-build-options.patch
index da4057064e..80a4f2abde 100644
---
a/meta/recipes-connectivity/bind/bind/0001-named-lwresd-V-and-start-log-hide-build-options.patch
+++
b/meta/recipes-connectivity/bind/bind/0001-named-lwresd-V-and-start-log-hide-build-options.patch
@@ -1,4 +1,4 @@
-From 4b870f60338fe45e036b8a76d47f053338920048 Mon Sep 17 00:00:00 2001
+From f28920a59b658fcda24efde1c45322f785a0b0fe Mon Sep 17 00:00:00 2001
From: Hongxu Jia <[email protected]>
Date: Mon, 27 Aug 2018 21:24:20 +0800
Subject: [PATCH] `named/lwresd -V' and start log hide build options
@@ -20,7 +20,7 @@ Signed-off-by: Armin Kuster <[email protected]>
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/configure.ac b/configure.ac
-index 56bca5b..4fd62ed 100644
+index 0bc3965..e1c2b12 100644
--- a/configure.ac
+++ b/configure.ac
@@ -35,7 +35,7 @@ AC_DEFINE([PACKAGE_VERSION_EXTRA],
["][bind_VERSION_EXTRA]["], [BIND 9 Extra par
diff --git
a/meta/recipes-connectivity/bind/bind/bind-ensure-searching-for-json-headers-searches-sysr.patch
b/meta/recipes-connectivity/bind/bind/bind-ensure-searching-for-json-headers-searches-sysr.patch
index 9adc101247..323985a402 100644
---
a/meta/recipes-connectivity/bind/bind/bind-ensure-searching-for-json-headers-searches-sysr.patch
+++
b/meta/recipes-connectivity/bind/bind/bind-ensure-searching-for-json-headers-searches-sysr.patch
@@ -1,4 +1,4 @@
-From f3736e5535236cf978fd368b6905098ff6e4fd84 Mon Sep 17 00:00:00 2001
+From f003f396067e6cc1e2ec609b296bb642b8ddf47b Mon Sep 17 00:00:00 2001
From: Paul Gortmaker <[email protected]>
Date: Tue, 9 Jun 2015 11:22:00 -0400
Subject: [PATCH] bind: ensure searching for json headers searches sysroot
@@ -32,7 +32,7 @@ Signed-off-by: Paul Gortmaker <[email protected]>
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/configure.ac b/configure.ac
-index c06a0d7..56bca5b 100644
+index 26c442a..0bc3965 100644
--- a/configure.ac
+++ b/configure.ac
@@ -872,7 +872,7 @@ AS_CASE([$with_lmdb],
diff --git a/meta/recipes-connectivity/bind/bind/conf.patch
b/meta/recipes-connectivity/bind/bind/conf.patch
index 803456c0b3..28ee4ae74d 100644
--- a/meta/recipes-connectivity/bind/bind/conf.patch
+++ b/meta/recipes-connectivity/bind/bind/conf.patch
@@ -1,4 +1,4 @@
-From 450187e8feac041de02afd4c0c9039cc41e04cb9 Mon Sep 17 00:00:00 2001
+From 5fc3dfd3f994b5fd97e97837eee2ad808cd8af93 Mon Sep 17 00:00:00 2001
From: Qing He <[email protected]>
Date: Tue, 30 Nov 2010 13:35:42 +0800
Subject: [PATCH] bind: add new recipe
diff --git
a/meta/recipes-connectivity/bind/bind/init.d-add-support-for-read-only-rootfs.patch
b/meta/recipes-connectivity/bind/bind/init.d-add-support-for-read-only-rootfs.patch
index a2c1fbb8f7..b373251c47 100644
---
a/meta/recipes-connectivity/bind/bind/init.d-add-support-for-read-only-rootfs.patch
+++
b/meta/recipes-connectivity/bind/bind/init.d-add-support-for-read-only-rootfs.patch
@@ -1,4 +1,4 @@
-From 582334d31432969be7e10906de7540f1dc64b17e Mon Sep 17 00:00:00 2001
+From 42c109317070d19fda70635b7043cbc6f9ec36ef Mon Sep 17 00:00:00 2001
From: Chen Qi <[email protected]>
Date: Thu, 27 Mar 2014 02:34:41 +0000
Subject: [PATCH] init.d: add support for read-only rootfs
diff --git
a/meta/recipes-connectivity/bind/bind/make-etc-initd-bind-stop-work.patch
b/meta/recipes-connectivity/bind/bind/make-etc-initd-bind-stop-work.patch
index dc1f8f5a9a..74cf947787 100644
--- a/meta/recipes-connectivity/bind/bind/make-etc-initd-bind-stop-work.patch
+++ b/meta/recipes-connectivity/bind/bind/make-etc-initd-bind-stop-work.patch
@@ -1,4 +1,4 @@
-From 50601a7ee8fd19ddbe9a592c57ae6197782d4c2f Mon Sep 17 00:00:00 2001
+From 2e1314f2e71be15704ba18756250185b36a5c0da Mon Sep 17 00:00:00 2001
From: Roy Li <[email protected]>
Date: Thu, 15 Nov 2012 02:27:54 +0000
Subject: [PATCH] bind: make "/etc/init.d/bind stop" work
diff --git a/meta/recipes-connectivity/bind/bind_9.20.27.bb
b/meta/recipes-connectivity/bind/bind_9.20.29.bb
similarity index 97%
rename from meta/recipes-connectivity/bind/bind_9.20.27.bb
rename to meta/recipes-connectivity/bind/bind_9.20.29.bb
index e915161d8c..c280d5b98d 100644
--- a/meta/recipes-connectivity/bind/bind_9.20.27.bb
+++ b/meta/recipes-connectivity/bind/bind_9.20.29.bb
@@ -21,7 +21,7 @@ SRC_URI =
"https://ftp.isc.org/isc/bind9/${PV}/${BPN}-${PV}.tar.xz \
file://0001-m4-Backport-ax_prog_cc_for_build.m4-macros.patch \
"
-SRC_URI[sha256sum] =
"145ab7a50b33a06d9d488b5e668c887e754f42acf8954e2b5dc7e238b080e4a0"
+SRC_URI[sha256sum] =
"587029508b3b1b43229fae416c97e5543aba45809cefaca98a5004a02a5736c1"
UPSTREAM_CHECK_URI = "https://ftp.isc.org/isc/bind9/";
# follow the ESV versions divisible by 2
--
2.47.1
0001-bind-upgrade-9.20.27-9.20.29.patch
Description: Binary data
packages/x86-64-v3-poky-linux/bind/bind-libs: FILELIST: removed "/usr/lib/libisccfg-9.20.27.so /usr/lib/libdns-9.20.27.so /usr/lib/libisc-9.20.27.so /usr/lib/libisccc-9.20.27.so /usr/lib/libns-9.20.27.so", added "/usr/lib/libdns-9.20.29.so /usr/lib/libisc-9.20.29.so /usr/lib/libisccc-9.20.29.so /usr/lib/libisccfg-9.20.29.so /usr/lib/libns-9.20.29.so" Changes to packages/x86-64-v3-poky-linux/bind (sysroot): /usr/lib/libdns.so changed symlink target from libdns-9.20.27.so to libdns-9.20.29.so /usr/lib/libisccc.so changed symlink target from libisccc-9.20.27.so to libisccc-9.20.29.so /usr/lib/libisccfg.so changed symlink target from libisccfg-9.20.27.so to libisccfg-9.20.29.so /usr/lib/libisc.so changed symlink target from libisc-9.20.27.so to libisc-9.20.29.so /usr/lib/libns.so changed symlink target from libns-9.20.27.so to libns-9.20.29.so /usr/lib/libdns-9.20.27.so moved to /usr/lib/libdns-9.20.29.so /usr/lib/libisc-9.20.27.so moved to /usr/lib/libisc-9.20.29.so /usr/lib/libisccc-9.20.27.so moved to /usr/lib/libisccc-9.20.29.so /usr/lib/libisccfg-9.20.27.so moved to /usr/lib/libisccfg-9.20.29.so /usr/lib/libns-9.20.27.so moved to /usr/lib/libns-9.20.29.so
Changelog for bind: 9.20.27 -> 9.20.29
Source: doc/changelog/changelog-9.20.28.rst, doc/changelog/changelog-9.20.29.rst
BIND 9.20.28
------------
.. note::
The BIND 9.20.28 release was withdrawn after the discovery of a
regression in it during pre-release testing.
BIND 9.20.29
------------
Security Fixes
~~~~~~~~~~~~~~
- [CVE-2026-19668] Prevent excessive CPU use validating crafted DNSSEC
responses. ``a0a61dba9e``
A malicious authoritative server could serve a securely delegated zone
whose DS and DNSKEY records carry many distinct key tags but no valid
match, forcing a validating resolver into excessive key-tag matching
and high CPU use for every query. BIND now bounds this work with the
per-query validation limit (max-validations-per-fetch). :gl:`#5349`
- [CVE-2026-19033] Require a TSIG on every message of incoming zone
transfers. ``9404cd2b8c``
BIND 9 used to accept TSIG-signed zone transfers in which some
messages were unsigned, and processed those messages before the next
signature could vouch for them. It now requires a TSIG on every
message of an incoming AXFR or IXFR; all modern nameserver already
sign every message, so no change is expected in practice. :gl:`#6062`
- [CVE-2026-77119] Prevent a DNSSEC downgrade of secure delegations via
unrelated NSEC3. ``3bed9c8e9e``
A validating resolver could be tricked into treating a secure
delegation as unsigned and accepting forged answers for names beneath
it, if an attacker could inject responses to its queries. Such forged
proofs are now rejected. :gl:`#6234`
- [CVE-2026-19941] Prevent forged DNSSEC-validated NXDOMAIN responses.
``a36bf58daf``
A validating resolver could accept a signed NSEC record from an
unrelated zone as proof that a wildcard did not exist. An on-path
attacker or malicious forwarder controlling a signed zone could
therefore forge an authenticated NXDOMAIN response for a name that
should resolve through a wildcard. BIND now requires the
wildcard-denial and name-nonexistence proofs to be signed by the same
zone. :gl:`#6253`
- [CVE-2026-19666] DNS64 with break-dnssec could cause an assertion
failure. ``4cec4965c4``
When a "dns64" statement is configured with "break-dnssec yes" and its
"exclude" list matches some but not all of the addresses in an AAAA
RRset, named removes the excluded addresses from the answer instead of
synthesizing new ones. If the answer being filtered had been cached
together with a proof that the queried name does not exist -- which is
what a wildcard match produces -- named terminated with an assertion
failure.
Only recursive resolvers are affected, and only when "break-dnssec
yes" is in use; the answer has to come from the cache, so a server
that is only authoritative cannot reach this. :gl:`#6301`
- [CVE-2026-19667] Reject negative cache records that do not fit in a
dns_rdata_t. ``dbf08c8581``
A single crafted response from a server could make a resolver cache a
malformed negative entry and then terminate with an assertion failure
when reading it back. Only recursive resolvers are affected, on a
default configuration. :gl:`#6302`
- [CVE-2026-19662] Prevent resolver crash with cached DNSSEC proofs.
``c884cc1ba0``
Under certain timing conditions, concurrent recursive queries could
cause named to crash when cached DNSSEC NOQNAME proof data was
replaced while still in use. Cached proof data is now retained until
all queries using it have completed. :gl:`#6333`
- [CVE-2026-75029] Discard repeated SOA, CNAME, and DNAME records when
parsing DNS messages. ``0d630758c2``
A DNS message could carry the same SOA, CNAME, or DNAME record many
times, and named kept every copy while parsing it. With name
compression those copies took up far more memory internally than in
the message itself, and every later processing step had to handle all
of them. named now keeps the first copy of such a record and discards
identical repeats. :gl:`#6335`
- [CVE-2026-77692] Fix an unauthenticated crash on HTTPS using SIG(0)
``5a24401c5c``
A specifically crafted HTTPS query using SIG(0) as authentication
could crash named if the client closes the connection before named
actually verifies the signature. This is now fixed. :gl:`#6343`
- [CVE-2026-81736] Cached HTTPS/SVCB aliases could exhaust resolver CPU.
``20bbb1639a``
A recursive resolver that had cached a large set of interlinked HTTPS
or SVCB records in alias form could be driven to do an excessive
amount of work assembling a single response, because it followed every
cached alias target when building the additional section. A client
permitted to use recursion, together with an attacker-controlled zone
used to plant the records, could repeat small queries to consume
enough CPU to delay or deny service to other clients. The amount of
additional processing done for one query is now bounded. :gl:`#6347`
- [CVE-2026-76163] Prevent TKEY queries from terminating named without
global options. ``7645138538``
named could terminate unexpectedly when a remote client sent a TKEY
query if the configuration did not include a global options statement.
This has been fixed.
ISC thanks Owais Lone (thesecguy) for reporting the issue. :gl:`#6357`
- [CVE-2026-78301] Out-of-zone records in a zone database could be
served as authoritative. ``72a10c3a0b``
When a zone database contained records for names outside the zone —
such as a delegation above the zone apex, left behind by a secondary
that had accepted out-of-zone data from its primary — the server could
treat them as authoritative and answer queries for names inside the
zone with that out-of-zone data instead of the zone's own. A server
that was also a resolver could follow such a delegation and cache the
answers of the server it named, affecting names outside the configured
zone. Zone database lookups are now confined to names at or below the
zone's origin.
ISC would like to thank Henrique Pereira for reporting the issue.
:gl:`#6361`
- [CVE-2026-80274] Crash on wildcard answers carrying both NSEC and
NSEC3 proofs. ``0e44451b1a``
When a wildcard answer arrived with both NSEC and NSEC3 records at the
name proving that the queried name does not exist, the resolver could
pick different records when caching the answer and when retrieving the
proof, depending on the order in which the authoritative server sent
them. This could terminate named with an assertion failure, fail the
query with SERVFAIL, or serve a denial record other than the one that
had been verified. The resolver now caches and serves the same denial
record it accepted when the answer was received.
ISC would like to thank hythyt for reporting the issue. :gl:`#6369`
- [CVE-2026-81563] Following HTTPS/SVCB aliases could leak resolver
cache memory. ``3162df369e``
When a recursive server answered a query for an HTTPS or SVCB record
in alias form and the alias target had more than 13 records, the
target records were pinned in the cache permanently instead of being
released once the answer was sent. A remote party who could make the
server follow such aliases to a steady stream of fresh names could
grow the cache beyond the configured max-cache-size until the server
was unable to resolve unrelated names. The records are now released
correctly.
ISC would like to thank Samy Medjahed/Ap4sh for reporting the issue.
:gl:`#6374`
New Features
~~~~~~~~~~~~
- Add an agent skill for the isc_job/isc_async/isc_work APIs.
``fe32990b06``
Documents when to use isc_job_run(), isc_async_run() or
isc_work_enqueue(), and the contract each one imposes. No functional
change. :gl:`!12561`
Removed Features
~~~~~~~~~~~~~~~~
- Remove unused closest encloser proof caching. ``abd8b5bfd8``
BIND used to cache an NSEC3 closest encloser proof alongside positive
wildcard answers so that a resolver could re-send it when answering
from its cache. That stopped being used in BIND 9.9 (2011), when
positive wildcard responses were changed to omit that NSEC3 record —
RFC 5155 requires only the next closer name proof — and the closest
encloser came to be derived during validation instead. The caching
code has been unreachable ever since, so this removes it with no
change in behaviour. :gl:`#5803` :gl:`!12660`
Feature Changes
~~~~~~~~~~~~~~~
- Reject oversized and malformed DNSKEY records up front. ``6c22109924``
Oversized RSA key material in a DNSKEY record was only rejected after
it had been converted, allocating memory proportional to the record
size. Such records are now rejected before conversion, as are Ed25519
and Ed448 keys with trailing bytes that were previously silently
ignored. :gl:`#4537` :gl:`!12560`
Bug Fixes
~~~~~~~~~
- Prevent a crash when using both dns64 and filter-a. ``bce5d10d18``
An assertion failure was possible when using both `dns64` and the
`filter-a` plugin simultaneously; this has been fixed. :gl:`#5979`
:gl:`!12663`
- Fix update-policy grant external address passing. ``b1e955c326``
Only TCP client addresses are supposed to be passed to an `external`
handler for the associated `update-policy` rule, but UDP client
addresses were also being passed. This could have caused the external
handler to return a result it otherwise wouldn't. This has been fixed.
:gl:`#6061` :gl:`!12555`
- Missing required NSEC3 for delegation not detected. ``e84ed2e9d7``
A missing required NSEC3 record for an insecure delegation in a non
OPTOUT range was not being detected. This has been fixed. :gl:`#6063`
:gl:`!12611`
- Tighten EUI48 and EUI48 text parsing. ``ff50f2cdf1``
Malformed EUI48 and EUI64 records could be accepted. This has been
fixed. :gl:`#6082` :gl:`!12521`
- GeoIP ACL state can be stale or wrong after reload. ``63baf425b3``
`named` caches GeoIP information after looking it up, but the cached
information was not invalidated when the GeoIP database was reloaded,
so it could continue to be used. We now invalidate existing cached
GeoIP information as part of the reloading process. :gl:`#6083`
:gl:`!12662`
- Honor DNSSEC policy key tag ranges. ``b82e5834b7``
When a DNSSEC policy configured a non-default tag-range, dnssec-keygen
and dnssec-ksr could accept generated keys outside that range. Both
tools now honor the configured minimum and maximum key tags.
:gl:`#6091` :gl:`!12549`
- Fix double free in mdig when EDNS options are specified.
``af5bd0b0ff``
When the default_query is cloned the EDNS options need to be cloned
rather than the pointer copied. The old behaviour results in a double
free of the options. This has been fixed. :gl:`#6095` :gl:`!12661`
- Fix a crash when an IXFR falls back to AXFR with updates still
pending. ``e34062bc7e``
When a secondary zone received an incremental transfer (IXFR) and the
primary then caused named to fall back to a full transfer (AXFR) while
some of the already-received incremental changes were still waiting to
be applied, named could later crash when that transfer finished. The
pending changes are now discarded correctly before the AXFR retry.
:gl:`#6114` :gl:`!12624`
- Fix DS requests to parental agents over TLS. ``55830d30f6``
TLS configuration for parental agents was being ignored when sending
DS requests. This has been fixed. :gl:`#6135` :gl:`!12613`
- Fix a crash when resolving names below a cached DNAME. ``b94e940f52``
A recursive resolver could crash when it answered a query for a name
beneath a cached DNAME while that same DNAME record was concurrently
refreshed or evicted from the cache. :gl:`#6182` :gl:`!12593`
- Rndc-confgen `-q` (quiet) option is documented but doesn't work.
``7e4a7ca1a7``
The command line parsing in rndc-confgen was broken so `rndc-confgen
-q` did not work. This has been fixed. :gl:`#6187` :gl:`!12575`
- Enforce query ACLs for redirect zones and searched DLZs.
``bc69876b2e``
Queries answered from redirect zones or searched DLZ databases did not
consistently honor `allow-query` and `allow-query-on`, potentially
exposing restricted DNS data to excluded clients or through excluded
listening addresses. These ACLs are now enforced before redirect or
DLZ data is returned. :gl:`#6251`, #6252 :gl:`!12646`
- Check "asnum" validity in GeoIP ACLs. ``28c2bfdc7b``
We now check the validity of autonomous system (AS) numbers when
parsing GeoIP ACLs that use `asnum` elements at configuration time.
`asnum` values start with an optional case-insensitive "AS" prefix,
followed only by decimal digits, with no spaces or other extraneous
characters. The value represented cannot exceed 2^32. :gl:`#6255`
:gl:`!12511`
- Prevent crashes while reporting DNSSEC signing statistics.
``c190514f0a``
Servers with zone-statistics full could terminate while reporting
DNSSEC signing statistics for a zone tracking adding more than four
signing keys. :gl:`#6256` :gl:`!12674`
- Fix various nits in the netmgr code. ``c28cdad51b``
The MR consists of couple of small fixes and uncaught errors in the
Network Manager. :gl:`#6257` :gl:`!12576`
- Fix a crash on remote-servers lists that reference themselves.
``aaae614f9d``
Since 9.21.16 and 9.20.17, a remote-servers, primaries, masters, or
parental-agents list that referenced itself, directly or through
another list, made named crash on startup or reconfiguration. Such
references are again skipped and the remaining entries in the list are
used, as in earlier versions. :gl:`#6287` :gl:`!12604`
- A record from outside a response policy zone could stop named.
``d135513b37``
A response policy zone transferred from a primary can contain a record
whose name lies outside the zone. Such a record could stop named, both
when it arrived and again at every startup afterwards, because a
secondary keeps it in its own copy of the zone. Records like this are
now rejected and logged; previously one could also silently create a
policy entry for an unrelated name. :gl:`#6304` :gl:`!12543`
- "rndc flushtree ." failed to flush the cache. ``96e8b585ed``
`rndc flushtree` flushes cache data below a specified name. If the
name specified is the DNS root, it should fully empty the cache, the
same as `rndc flush`. However, there was a bug causing the command,
in that case, to have no effect on the cache at all; this has been
fixed. :gl:`#6308` :gl:`!12582`
- Invalid key-store configuration could abort the DNSSEC tools.
``1d796ab072``
Invalid configured key-stores named "key-directory" in configuration
files could abort the DNSSEC tools. This has been fixed. :gl:`#6313`
:gl:`!12653`
- NSEC signature set could bypass the secure-delegation check.
``c966177f6c``
When proving that a delegation is insecure, the validator bounded an
NSEC record's authority by the signer of whichever RRSIG happened to
come first in the record's signature set, rather than the signature
that actually verified. A grandparent NSEC padded with an extra,
unverifiable signature could therefore pass the check that keeps such
proofs from reaching below a signed child zone. The validator now
requires every signature on the NSEC to name the same signer and
refuses proofs whose signature set is malformed or larger than
max-validations-per-fetch allows. :gl:`#6321`
- Fix a possible nsupdate issue when using GSS-TSIG. ``4ddcab2d3c``
The :iscman:`nsupdate` process could terminate unexpectedly when using
the GSS-TSIG mode executed with the :option:`nsupdate -g` option. This
has been fixed. :gl:`#6325` :gl:`!12588`
- Fix isccc_alist_define error paths. ``af1349552a``
If there is an out of memory error in isccc_alist_define a memory leak
(the sexpr holding the key name) or a double free (value) could occur.
This has been fixed. :gl:`#6329` :gl:`!12636`
- Check for empty 'endpoints' list. ``23f58af443``
Configuring an `http` block with `endpoints {};` previously caused a
crash in `named`. This is now rejected earlier by the configuration
check. :gl:`#6330` :gl:`!12552`
- Named could crash with a single-element geoip sortlist. ``0e996a4d3b``
If `named` was configured with a single-element sortlist containing a
`geoip` ACL element, any matching query triggered an assertion
failure. This has been fixed. :gl:`#6342` :gl:`!12583`
- Prevent out-of-bailiwick CNAMEs from evicting cached records.
``cdedd4acd5``
A recursive resolver could remove valid cached records when a DNS
response contained an out-of-bailiwick CNAME with the same owner name.
Out-of-bailiwick data is now discarded before it can modify the cache.
:gl:`#6345` :gl:`!12651`
- Restore periodic cleanup of stale resolver address data.
``356f4013f8``
Stale resolver address data could remain cached until memory pressure
or an explicit flush. Correct the cleanup interval so it is removed
periodically. :gl:`#6346` :gl:`!12589`
- Fix named-checkconf/named crash with malformed key name.
``9f218f6aaf``
When a primary/remote-server key name was malformed, named-checkconf
and named were both crashing (after warning about the invalid key
name). This is now fixed. :gl:`#6362` :gl:`!12639`
- Fix -Wformat-truncation warning in totext_in_wks() ``f97c2bea40``
BIND 9 failed to build with GCC 16 at -O3: rendering a WKS record as
text triggered a -Wformat-truncation error, which is fatal in
developer builds. The port number is now printed with a 16-bit format
specifier, so the compiler can see it always fits the output buffer.
:gl:`!12542`
- Fix off-by-one errors caused by magic hardcoded values. ``726c6cb795``
Fix off-by-one comparinson errors: "named -p http=" dropped the first
digit of the given port (for example, "http=8080" selected port 80)
and now uses the port as given, and "named-rrchecker -C" compared only
part of the "CLASS" prefix when filtering generic class names, which
was harmless in practice but is now corrected. :gl:`!12616`
- Hmac_verify() now accepts truncated HMACs only when requested.
``c81b111496``
The hmac_verify() function incorrectly compares only up to
'sig->length' bytes, but the signature and its length should not be
trusted, e.g. in case if it comes from a user query.
Don't accept signatures which length isn't equal to the expected
calculated HMAC length unless it is explicitly requested by the
caller, e.g. for truncated TSIG [1] support.
[1] https://datatracker.ietf.org/doc/html/rfc8945#name-tsig-truncation
-policy :gl:`!12629`
- Prevent resolver crashes while processing DNS over TCP. ``81b3b6d89f``
Recursive resolvers could terminate with an assertion failure while
processing DNS responses over TCP under sustained traffic. The failure
was observed on resolvers configured globally with forward only; the
same transport path is also used by iterative resolution. This has
been fixed. :gl:`!12537`
packages/x86-64-v3-poky-linux/bind/bind-dbg: PV changed from "9.20.27" to "9.20.29" packages/x86-64-v3-poky-linux/bind/bind-dbg: PKGSIZE changed from 16186376 to 16217712 (+0%) packages/x86-64-v3-poky-linux/bind/bind-dbg: PKGV changed from 9.20.27 [default] to 9.20.29 [default] packages/x86-64-v3-poky-linux/bind/bind-dbg: FILELIST: removed "/usr/lib/.debug/libns-9.20.27.so /usr/lib/.debug/libisccc-9.20.27.so /usr/lib/.debug/libisccfg-9.20.27.so /usr/lib/.debug/libisc-9.20.27.so /usr/lib/.debug/libdns-9.20.27.so", added "/usr/lib/.debug/libisccfg-9.20.29.so /usr/lib/.debug/libns-9.20.29.so /usr/lib/.debug/libdns-9.20.29.so /usr/lib/.debug/libisc-9.20.29.so /usr/lib/.debug/libisccc-9.20.29.so" packages/x86-64-v3-poky-linux/bind/bind-dev: PV changed from "9.20.27" to "9.20.29" packages/x86-64-v3-poky-linux/bind/bind-dev: PKGSIZE changed from 1607845 to 1607498 (-0%) packages/x86-64-v3-poky-linux/bind/bind-dev: PKGV changed from 9.20.27 [default] to 9.20.29 [default] packages/x86-64-v3-poky-linux/bind/bind-doc: PV changed from "9.20.27" to "9.20.29" packages/x86-64-v3-poky-linux/bind/bind-doc: PKGV changed from 9.20.27 [default] to 9.20.29 [default] packages/x86-64-v3-poky-linux/bind/bind-libs: PV changed from "9.20.27" to "9.20.29" packages/x86-64-v3-poky-linux/bind/bind-libs: FILES: removed "/usr/lib/*-9.20.27.so", added "/usr/lib/*-9.20.29.so" packages/x86-64-v3-poky-linux/bind/bind-libs: PKGSIZE changed from 3688328 to 3692392 (+0%) packages/x86-64-v3-poky-linux/bind/bind-libs: PKGV changed from 9.20.27 [default] to 9.20.29 [default] packages/x86-64-v3-poky-linux/bind/bind-libs: FILELIST: removed "/usr/lib/libisccc-9.20.27.so /usr/lib/libdns-9.20.27.so /usr/lib/libisc-9.20.27.so /usr/lib/libisccfg-9.20.27.so /usr/lib/libns-9.20.27.so", added "/usr/lib/libisccc-9.20.29.so /usr/lib/libdns-9.20.29.so /usr/lib/libisc-9.20.29.so /usr/lib/libisccfg-9.20.29.so /usr/lib/libns-9.20.29.so" packages/x86-64-v3-poky-linux/bind/bind-locale: PV changed from "9.20.27" to "9.20.29" packages/x86-64-v3-poky-linux/bind/bind-locale: PKGV changed from 9.20.27 [default] to 9.20.29 [default] packages/x86-64-v3-poky-linux/bind/bind-src: PV changed from "9.20.27" to "9.20.29" packages/x86-64-v3-poky-linux/bind/bind-src: PKGSIZE changed from 10144096 to 10155703 (+0%) packages/x86-64-v3-poky-linux/bind/bind-src: PKGV changed from 9.20.27 [default] to 9.20.29 [default] packages/x86-64-v3-poky-linux/bind/bind-src: FILELIST: directory renamed /usr/src/debug/bind/9.20.27/lib/isccc -> /usr/src/debug/bind/9.20.29/lib/isccc, directory renamed /usr/src/debug/bind/9.20.27/lib/dns/include/dst -> /usr/src/debug/bind/9.20.29/lib/dns/include/dst, directory renamed /usr/src/debug/bind/9.20.27/lib/isccc/include/isccc -> /usr/src/debug/bind/9.20.29/lib/isccc/include/isccc, directory renamed /usr/src/debug/bind/9.20.27/bin/plugins -> /usr/src/debug/bind/9.20.29/bin/plugins, directory renamed /usr/src/debug/bind/9.20.27/lib/isccfg/include/isccfg -> /usr/src/debug/bind/9.20.29/lib/isccfg/include/isccfg, directory renamed /usr/src/debug/bind/9.20.27/bin/dig -> /usr/src/debug/bind/9.20.29/bin/dig, directory renamed /usr/src/debug/bind/9.20.27/bin/named/include/dlz -> /usr/src/debug/bind/9.20.29/bin/named/include/dlz, directory renamed /usr/src/debug/bind/9.20.27/bin/dnssec -> /usr/src/debug/bind/9.20.29/bin/dnssec, directory renamed /usr/src/debug/bind/9.20.27/lib/isc -> /usr/src/debug/bind/9.20.29/lib/isc, directory renamed /usr/src/debug/bind/9.20.27/lib/dns/include/irs -> /usr/src/debug/bind/9.20.29/lib/dns/include/irs, directory renamed /usr/src/debug/bind/9.20.27/lib/dns/rdata/ch_3 -> /usr/src/debug/bind/9.20.29/lib/dns/rdata/ch_3, directory renamed /usr/src/debug/bind/9.20.27/lib/dns/rdata/any_255 -> /usr/src/debug/bind/9.20.29/lib/dns/rdata/any_255, directory renamed /usr/src/debug/bind/9.20.27/bin/rndc -> /usr/src/debug/bind/9.20.29/bin/rndc, directory renamed /usr/src/debug/bind/9.20.27/lib/ns/include/ns -> /usr/src/debug/bind/9.20.29/lib/ns/include/ns, directory renamed /usr/src/debug/bind/9.20.27/lib/dns/rdata/in_1 -> /usr/src/debug/bind/9.20.29/lib/dns/rdata/in_1, directory renamed /usr/src/debug/bind/9.20.27/bin/nsupdate -> /usr/src/debug/bind/9.20.29/bin/nsupdate, directory renamed /usr/src/debug/bind/9.20.27/lib/isccfg -> /usr/src/debug/bind/9.20.29/lib/isccfg, directory renamed /usr/src/debug/bind/9.20.27/lib/isc/include/isc -> / usr/src/debug/bind/9.20.29/lib/isc/include/isc, directory renamed /usr/src/debug/bind/9.20.27/lib/isc/netmgr -> /usr/src/debug/bind/9.20.29/lib/isc/netmgr, directory renamed /usr/src/debug/bind/9.20.27/bin/confgen/include/confgen -> /usr/src/debug/bind/9.20.29/bin/confgen/include/confgen, directory renamed /usr/src/debug/bind/9.20.27/bin/tools -> /usr/src/debug/bind/9.20.29/bin/tools, directory renamed /usr/src/debug/bind/9.20.27/bin/delv -> /usr/src/debug/bind/9.20.29/bin/delv, directory renamed /usr/src/debug/bind/9.20.27/bin/named/include/named -> /usr/src/debug/bind/9.20.29/bin/named/include/named, directory renamed /usr/src/debug/bind/9.20.27/bin/confgen -> /usr/src/debug/bind/9.20.29/bin/confgen, directory renamed /usr/src/debug/bind/9.20.27/lib/dns/include/dns -> /usr/src/debug/bind/9.20.29/lib/dns/include/dns, directory renamed /usr/src/debug/bind/9.20.27/lib/dns -> /usr/src/debug/bind/9.20.29/lib/dns, directory renamed /usr/src/debug/bind/9.20.27/lib/ns -> /usr/src/debug/bi nd/9.20.29/lib/ns, directory renamed /usr/src/debug/bind/9.20.27/lib/dns/rdata/hs_4 -> /usr/src/debug/bind/9.20.29/lib/dns/rdata/hs_4, directory renamed /usr/src/debug/bind/9.20.27/bin/named -> /usr/src/debug/bind/9.20.29/bin/named, directory renamed /usr/src/debug/bind/9.20.27/lib/dns/rdata/generic -> /usr/src/debug/bind/9.20.29/lib/dns/rdata/generic, directory renamed /usr/src/debug/bind/9.20.27/bin/check -> /usr/src/debug/bind/9.20.29/bin/check packages/x86-64-v3-poky-linux/bind/bind-staticdev: PV changed from "9.20.27" to "9.20.29" packages/x86-64-v3-poky-linux/bind/bind-staticdev: PKGV changed from 9.20.27 [default] to 9.20.29 [default] packages/x86-64-v3-poky-linux/bind/bind-utils: PV changed from "9.20.27" to "9.20.29" packages/x86-64-v3-poky-linux/bind/bind-utils: PKGV changed from 9.20.27 [default] to 9.20.29 [default] packages/x86-64-v3-poky-linux/bind/bind: PV changed from "9.20.27" to "9.20.29" packages/x86-64-v3-poky-linux/bind/bind: PKGSIZE changed from 1334881 to 1338969 (+0%) packages/x86-64-v3-poky-linux/bind/bind: PKGV changed from 9.20.27 [default] to 9.20.29 [default] packages/x86-64-v3-poky-linux/bind: SRC_URI changed from "https://ftp.isc.org/isc/bind9/9.20.27/bind-9.20.27.tar.xz file://conf.patch file://named.service file://bind9 file://generate-rndc-key.sh file://make-etc-initd-bind-stop-work.patch file://init.d-add-support-for-read-only-rootfs.patch file://bind-ensure-searching-for-json-headers-searches-sysr.patch file://0001-named-lwresd-V-and-start-log-hide-build-options.patch file://0001-avoid-start-failure-with-bind-user.patch file://0001-m4-Backport-ax_prog_cc_for_build.m4-macros.patch" to "https://ftp.isc.org/isc/bind9/9.20.29/bind-9.20.29.tar.xz file://conf.patch file://named.service file://bind9 file://generate-rndc-key.sh file://make-etc-initd-bind-stop-work.patch file://init.d-add-support-for-read-only-rootfs.patch file://bind-ensure-searching-for-json-headers-searches-sysr.patch file://0001-named-lwresd-V-and-start-log-hide-build-options.patch file://0001-avoid-start-failure-with-bind-user.patch file://0001-m4-Backport-ax_prog_cc_f or_build.m4-macros.patch" packages/x86-64-v3-poky-linux/bind: PKGV changed from 9.20.27 [default] to 9.20.29 [default] packages/x86-64-v3-poky-linux/bind: PV changed from "9.20.27" to "9.20.29" Changes to packages/x86-64-v3-poky-linux/bind (sysroot): /usr/lib/libdns.so changed symlink target from libdns-9.20.27.so to libdns-9.20.29.so /usr/lib/libisccc.so changed symlink target from libisccc-9.20.27.so to libisccc-9.20.29.so /usr/lib/libisccfg.so changed symlink target from libisccfg-9.20.27.so to libisccfg-9.20.29.so /usr/lib/libisc.so changed symlink target from libisc-9.20.27.so to libisc-9.20.29.so /usr/lib/libns.so changed symlink target from libns-9.20.27.so to libns-9.20.29.so /usr/lib/libdns-9.20.27.so moved to /usr/lib/libdns-9.20.29.so /usr/lib/libisc-9.20.27.so moved to /usr/lib/libisc-9.20.29.so /usr/lib/libisccc-9.20.27.so moved to /usr/lib/libisccc-9.20.29.so /usr/lib/libisccfg-9.20.27.so moved to /usr/lib/libisccfg-9.20.29.so /usr/lib/libns-9.20.27.so moved to /usr/lib/libns-9.20.29.so
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#246030): https://lists.openembedded.org/g/openembedded-core/message/246030 Mute This Topic: https://lists.openembedded.org/mt/121292662/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
