From: Michał Kępień Date: Mon, 13 Jul 2026 10:40:29 +0000 (+0200) Subject: Tweak and reword release notes X-Git-Tag: v9.21.24~1^2~2 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=205df6a48b03dab2765fd5d59444410a883ce018;p=thirdparty%2Fbind9.git Tweak and reword release notes --- diff --git a/doc/notes/notes-9.21.24.rst b/doc/notes/notes-9.21.24.rst index 0395d812405..d8eb5909229 100644 --- a/doc/notes/notes-9.21.24.rst +++ b/doc/notes/notes-9.21.24.rst @@ -15,53 +15,54 @@ Notes for BIND 9.21.24 Security Fixes ~~~~~~~~~~~~~~ -- [CVE-2026-11331] Fix handling of rpz CNAME expansion that returns name - too long. +- Fix handling of RPZ CNAME expansion that returns too-long name. + :cve:`2026-11331` Previously, if the expansion of a wildcard CNAME RPZ policy resulted - in a name that exceeded the length limit, a self referential CNAME and + in a name that exceeded the length limit, a self-referential CNAME and the original address record were returned, allowing the policy to be - bypassed. In branches up to 9.20, this also left query processing in - an inconsistent state which could trigger an assertion failure. We - now return a YXDOMAIN response, without the address. + bypassed. In branches up to 9.20 this also left query processing in an + inconsistent state, which could trigger an assertion failure. + :iscman:`named` now returns a YXDOMAIN response, without the address. ISC would like to thank Laith Mash'al (0xmshal) for bringing this - issue to our attention. :gl:`#5856` + vulnerability to our attention. :gl:`#5856` -- [CVE-2026-11721] Invalid signed wildcard records were being accepted. +- Stop accepting invalid signed wildcard records. :cve:`2026-11721` - Signed wildcard responses in which the Labels field in the `RRSIG` + Signed wildcard responses in which the Labels field in the RRSIG record was less than the number of labels in the Signer Name field were being incorrectly accepted. This in turn broke - `synth-from-dnssec`, which depends on such records being correctly - validated. This has been fixed. + :namedconf:ref:`synth-from-dnssec`, which depends on such records + being correctly validated. This has been fixed. - ISC thanks Qifan Zhang of Palo Alto Networks for bringing this issue - to our attention. :gl:`#5871` + ISC would like to thank Qifan Zhang of Palo Alto Networks for bringing + this vulnerability to our attention. :gl:`#5871` -- [CVE-2026-13321] Fix DNSSEC validation bypass via out-of-zone NSEC - Next Field. +- Fix DNSSEC validation bypass via out-of-zone NSEC Next Field. + :cve:`2026-13321` - A malicious zone with out-of-zone NSEC next owner names can cause a - DNSSEC validating resolver to cache such record and, if - `synth-from-dnssec` is enabled, to generate negative answers for any - zone that is covered by the range. + Previously, a malicious zone with out-of-zone NSEC next-owner names + could cause a DNSSEC-validating resolver to cache such a record and, + if :namedconf:ref:`synth-from-dnssec` was enabled, to generate + negative answers for any zone that was covered by the range. This has + been fixed. - ISC would like to thank Qifan Zhang of Palo Alto Networks for - reporting the issue. :gl:`#5873` + ISC would like to thank Qifan Zhang of Palo Alto Networks for bringing + this vulnerability to our attention. :gl:`#5873` -- [CVE-2026-10723] Correct verification of NSEC3 signer name. +- Correct verification of NSEC3 signer name. :cve:`2026-10723` - BIND 9 accepted child-zone NSEC3 records where the first label equals - the hash of the parent zone as valid parent-zone closest encloser - proofs. This has been fixed. + Previously, :iscman:`named` accepted child-zone NSEC3 records where + the first label equaled the hash of the parent zone as valid + parent-zone closest encloser proofs. This has been fixed. - ISC thanks Qifan Zhang of Palo Alto Networks for reporting the issue. - :gl:`#5874` + ISC would like to thank Qifan Zhang of Palo Alto Networks for bringing + this vulnerability to our attention. :gl:`#5874` -- [CVE-2026-10822] Malformed DNSKEY records could trigger an assertion. +- Malformed DNSKEY records could trigger an assertion. :cve:`2026-10822` - Previously, `dns_name_fromwire()` did not honor the record boundary + Previously, ``dns_name_fromwire()`` did not honor the record boundary when reading names from the wire, allowing malformed records to be accepted when they should not have been. In particular, malformed DNSKEY records could trigger an assertion failure when being printed. @@ -70,32 +71,30 @@ Security Fixes - Reclaim memory promptly when DNSSEC validations are canceled. When a resolver is flooded with queries that require DNSSEC validation - — for example during a random-subdomain attack — many of those - validations are canceled before they complete. Previously a canceled + - for example during a random-subdomain attack - many of those + validations are canceled before they complete. Previously, a canceled validation still kept its place in the internal work queue and held the associated response in memory until that queued work eventually - ran, so memory could climb sharply under sustained load. The canceled - work is now dropped as soon as the validation is canceled, releasing - the memory it was holding. - -- [CVE-2026-11605] Prevent excessive validation work from crafted - negative responses. - - A validating resolver could be made to perform a large amount of - DNSSEC validation work in response to a single answer, consuming - excessive CPU. A malicious authoritative server triggers this by - returning a signed negative answer (NXDOMAIN or NODATA) padded with - many denial-of-existence proof records, which the resolver continued - to verify beyond its per-query validation limit. It now enforces that - limit on negative answers and returns SERVFAIL once the limit is - reached. - - Closes: https://gitlab.isc.org/isc-projects/bind9/-/work_items/4463 + ran, so memory could climb sharply under sustained load. The internal + work queue is now dropped as soon as the validation is canceled, + releasing the memory it was holding. :gl:`#4760` + +- Prevent excessive validation work from crafted negative responses. + :cve:`2026-11605` + + Previously, a validating resolver could be made to perform a large + amount of DNSSEC validation work in response to a single answer, + consuming excessive CPU. A malicious authoritative server could + trigger this by returning a signed negative answer (NXDOMAIN or + NODATA) padded with many denial-of-existence proof records, which the + resolver continued to verify beyond its per-query validation limit. It + now enforces that limit on negative answers and returns SERVFAIL once + the limit is reached. :gl:`#4463` Removed Features ~~~~~~~~~~~~~~~~ -- Remove the secondary validator in query.c. +- Remove the secondary validator in ``query.c``. Previously, when the additional section of a response was being populated, if cached data was found with pending trust, it would be @@ -104,19 +103,20 @@ Removed Features removed: RRsets with pending trust are now omitted from responses. :gl:`#5966` :gl:`#5968` :gl:`#5972` -- Remove GeoIP2 `metro` and `metrocode` +- Remove GeoIP2 ``metro`` and ``metrocode``. - The `geoip metro` and `geoip metrocode` configuration options has been - removed as metro code are deprecated from MaxMind library. + The ``geoip metro`` and ``geoip metrocode`` configuration options have + been removed, as metro codes are deprecated in the MaxMind library. + :gl:`!12217` - Restrict views to the Internet (IN) class. Views could previously be declared in classes other than Internet - (IN), but that support was inconsistent — ``named-checkconf`` accepted - configurations that ``named`` then refused to load. Views are now - restricted to class IN, and both tools reject any other class. - Configurations declaring a non-IN view must drop the class to keep - working. + (IN), but that support was inconsistent - :iscman:`named-checkconf` + accepted configurations that :iscman:`named` then refused to load. + Views are now restricted to class IN, and both tools reject any other + class. Configurations declaring a non-IN :namedconf:ref:`view` must + drop the class to keep working. :gl:`#5784` Feature Changes ~~~~~~~~~~~~~~~ @@ -125,54 +125,56 @@ Feature Changes Delegations are now cached with a minimum TTL of 60 seconds by default. Any NS record or A/AAAA glue record with a TTL below this - threshold will be raised to 60 seconds. + threshold is raised to 60 seconds. - A new configuration option `min-delegation-ttl` has been added to - adjust this limit, or disable it by setting the value to `0`. The - corresponding `max-delegation-ttl` option allows the user to configure - a maximum TTL for delegations; it is disabled by default. :gl:`#6031` + A new configuration option :namedconf:ref:`min-delegation-ttl` has + been added to adjust this limit, or to disable it by setting the value + to ``0``. The corresponding :namedconf:ref:`max-delegation-ttl` option + allows the user to configure a maximum TTL for delegations; it is + disabled by default. :gl:`#6031` Bug Fixes ~~~~~~~~~ - Fix recursion loop in case of badly behaving forwarders. - When forwarding DNS queries, the CD bit is cleared on the first query, - and the CD bit is only used as a fallback if the first query fails. - However, due to a logic bug this could lead to an unbounded loop - re-sending the same message, until the maximum query count is hit. - This has been fixed. :gl:`#5804` + When forwarding DNS queries, the checking-disabled (CD) bit is cleared + on the first query, and the CD bit is only used as a fallback if the + first query fails. However, due to a logic bug this could lead to an + unbounded loop re-sending the same message, until the maximum query + count was hit. This has been fixed. :gl:`#5804` -- Fix a bug in DNS UPDATE processing with inline-signing enabled. +- Fix a bug in DNS UPDATE processing with + :namedconf:ref:`inline-signing` enabled. In rare cases the :iscman:`named` process could terminate unexpectedly - when processing authorized DNS UPDATE messages in quick procession - which are updating a zone with inline-signing enabled. This has been - fixed. :gl:`#5816` + when processing authorized DNS UPDATE messages in quick succession + that were updating a zone with :namedconf:ref:`inline-signing` + enabled. This has been fixed. :gl:`#5816` - Properly detect private records before copying. - We were triggering an assertion when trying to copy a private record - to a buffer for modifying. Extend the private type detection and copy - the contents after we have rejected invalid private records. - :gl:`#5857` + Previously, an assertion was triggered when trying to copy a private + record to a buffer for modification. :iscman:`named` now extends the + private type detection and copies the contents after rejecting invalid + private records. :gl:`#5857` -- Tighten referral DS acceptance. +- Tighten referral DS acceptance. - Named was accepting DS records for sibling zones when it shouldn't - have. This has been fixed. :gl:`#5870` + Previously, :iscman:`named` accepted DS records for sibling zones when + it shouldn't have. This has been fixed. :gl:`#5870` - Don't synthesize negative responses with pending NSEC. If an NSEC record has not yet been validated and is cached with trust - pending, don't use it to synthesize negative responses. :gl:`#5872` - :gl:`#5887` :gl:`#5977` + pending, :iscman:`named` no longer uses it to synthesize negative + responses. :gl:`#5872` :gl:`#5887` :gl:`#5977` - Check that an NSEC signer is at or above the name to be validated. - Add a check that an NSEC record being used as a proof of nonexistence - for a given name is not signed by a name lower in the DNS hierarchy - than the one in question. :gl:`#5876` + A check has been added to ensure that an NSEC record being used as a + proof of nonexistence for a given name is not signed by a name lower + in the DNS hierarchy than the one in question. :gl:`#5876` - Don't evict DNSSEC-validated cache data on a CD=1 NXDOMAIN. @@ -186,35 +188,32 @@ Bug Fixes data first and leaves the cache unchanged when it is already validated. :gl:`#5877` -- Fix a 'deny-answer-aliases' configuration bypass issue. +- Fix a :namedconf:ref:`deny-answer-aliases` configuration bypass issue. It was possible to use a maliciously crafted authoritative zone to - make :iscman:`named` resolver synthesize a ``DNAME`` "alias" that - should have been rejected by the configured :any:`deny-answer-aliases` + make a :iscman:`named` resolver synthesize a DNAME "alias" that should + have been rejected by the configured :any:`deny-answer-aliases` option. This has been fixed. :gl:`#5930` - Reject external referrals from forwarders. - Under `forward-first` policy in a forwarding zone BIND could accept NS - above the forward zone apex from negative responses. This has been - fixed. - - ISC would like to thank Qifan Zhang, of Palo Alto Networks, for the - report. :gl:`#5937` + Under a ``forward first;`` policy in a forwarding zone, + :iscman:`named` could accept NS records above the forward zone apex + from negative responses. This has been fixed. :gl:`#5937` - Fix a zone transfer over TLS (XoT) issue when using the opportunistic TLS mode. - The :iscman:`named` process, running as secondary DNS server, + The :iscman:`named` process, running as a secondary DNS server and configured to transfer a zone from a primary server using an encrypted XoT transport in opportunistic TLS mode (i.e. without peer - certificate/hostname validation) could terminate unexpectedly when the - TLS ALPN negotiation with primary server was unsuccessful. This has - been fixed. :gl:`#5957` + certificate/hostname validation), could terminate unexpectedly when + the TLS ALPN negotiation with the primary server was unsuccessful. + This has been fixed. :gl:`#5957` - Unvalidated opt-out NSEC3 could be accepted in insecurity proof. - When determining whether an insecure delegation is legitimate, NSEC3 + When determining whether an insecure delegation was legitimate, NSEC3 opt-out records which had not yet passed validation could be used. This has been fixed. :gl:`#5970` @@ -225,10 +224,10 @@ Bug Fixes Otherwise, an NSEC3 from an ancestor zone could be used to interfere with validation. - We now retrieve the signer name from a wildcard response's signature. - An NSEC3 record cannot be used as a NOQNAME proof for the wildcard - unless it exactly matches the name one level above the NSEC3. - :gl:`#5971` + :iscman:`named` now retrieves the signer name from a wildcard + response's signature. An NSEC3 record cannot be used as a NOQNAME + proof for the wildcard unless it exactly matches the name one level + above the NSEC3. :gl:`#5971` - Fix CNAME resolution failure caused by a cached SERVFAIL response. @@ -236,22 +235,22 @@ Bug Fixes incorrectly prevent successful resolution of a CNAME target. This could cause resolution failures to persist until the cached SERVFAIL entry expired, even when the CNAME target itself was otherwise - resolvable. This issue has been fixed. :gl:`#5983` + resolvable. This has been fixed. :gl:`#5983` -- [CVE-2026-13204] Prevent crash from malformed NSEC/NSEC3 response. +- Prevent crash from malformed NSEC/NSEC3 response. :cve:`2026-13204` An assertion could be triggered by an improperly signed NOQNAME proof. This has been fixed. - ISC thanks Qifan Zhang of Palo Alto Networks for reporting the issue. - :gl:`#5985` + ISC would like to thank Qifan Zhang of Palo Alto Networks for bringing + this vulnerability to our attention. :gl:`#5985` - Reject unsupported RSA DNSKEY shapes during DNSSEC validation. An authoritative server publishing an RSA DNSKEY with an unusually large modulus or an exotic public exponent could make each DNSSEC signature check on a validating recursive resolver noticeably more - expensive than for a normally sized key. Such DNSKEYs are now treated + expensive than for a normally sized key. Such DNSKEYs are now treated as invalid. :gl:`#6008` - Fix a bug in GeoIP2 string matching. @@ -265,73 +264,77 @@ Bug Fixes The :any:`http-listener-clients` and :any:`http-streams-per-connection` configuration options could be truncated to smaller values (or to ``0``, which means unlimited) when - very big configuration values were used, which exceeded ``65535``. As - a note - it is very unlikely that such big values are used in - production, and the default values for the affected options are - ``300`` and ``100``, correspondingly. This has been fixed. :gl:`#6021` + very large configuration values in excess of ``65535`` were used. It + is very unlikely that such large values were used in production, and + the default values for the affected options are ``300`` and ``100``, + respectively. This has been fixed. :gl:`#6021` - Truncated reply to a TSIG query no longer stalls the resolver. When an upstream server returned a truncated reply to a query that - BIND had signed with TSIG, the resolver could keep waiting for a - follow-up UDP packet that never arrived, so the query stalled until it - hit resolver-query-timeout and the client received no answer. BIND now - treats any reply it cannot authenticate as an immediate failure and - returns SERVFAIL right away as a defense in depth. :gl:`#6028` + :iscman:`named` had signed with TSIG, the resolver could keep waiting + for a follow-up UDP packet that never arrived, stalling the query + until it hit the :namedconf:ref:`resolver-query-timeout` and the + client received no answer. :iscman:`named` now treats any reply it + cannot authenticate as an immediate failure and returns SERVFAIL right + away as a defense in depth. :gl:`#6028` - Ignore updates removing DNSKEY RRset with class ANY. - When a Dynamic Update is received that removes the ``DNSKEY`` (or - ``CDNSKEY``, or ``CDS``) RRset, remove all records except the ones - that are in use for signing for the zone. :gl:`#6045` + When a dynamic update is received that removes the DNSKEY (or CDNSKEY, + or CDS) RRset, :iscman:`named` now removes all records except the ones + that are in use for signing the zone. :gl:`#6045` -- Do not assert on synthrecord reverse mode with huge prefix. +- Do not assert on :iscman:`synthrecord` reverse mode with huge prefix. - When using the `synthrecord` plugin in reverse mode, if a very long - prefix is configured by the operator such that there is no room to fit - the reversed IP address into a DNS name, `named` could assert. This - has now been fixed. In such situations, an error is logged so the - operator is aware of the problem, and `NXDOMAIN` is answered. - :gl:`#6115` + When using the :iscman:`synthrecord` plugin in reverse mode, if a very + long prefix was configured by the operator such that there was no room + to fit the reversed IP address into a DNS name, :iscman:`named` could + assert. This has now been fixed. In such situations, an error is + logged so the operator is aware of the problem, and NXDOMAIN is + answered. :gl:`#6115` -- Validate query and response time nanosecs when parsing dnstap. +- Validate query and response time nanoseconds when parsing dnstap. - An assertion is triggered inside `isc_time_set` when dnstap-read calls - `dns_dt_parse` on dnstap files with query/response time nanosecond - fields greater than a second. + An assertion is triggered inside ``isc_time_set()`` when + :iscman:`dnstap-read` calls ``dns_dt_parse()`` on dnstap files with + query/response time nanosecond fields greater than a second. - Avoid the assertion by validating the nanosecond fields to be + The assertion is now avoided by validating the nanosecond fields to be subsecond when parsing. :gl:`#6123` - Ignore 0-byte reads in the TCP read callback. Callbacks for libuv stream reads do not signal zero-length reads as a - failure signal but rather as EAGAIN/EWOULDBLOCK. This can trigger an - assertion when a zero-length read is pushed onto a PROXYv2 endpoint - that has not yet processed the headers as it expects a non-NULL region - of positive length. :gl:`#6140` + failure signal but rather as EAGAIN/EWOULDBLOCK. This could trigger an + assertion when a zero-length read was pushed onto a PROXYv2 endpoint + that had not yet processed the headers, as it expected a non-NULL + region of positive length. :gl:`#6140` -- Only print per zone glue stats when query statistics is full. +- Only print per-zone glue stats when :namedconf:ref:`zone-statistics` + is set to ``full``. - The code printing query statistics was ignoring the zone-statistics - option. This has been fixed. :gl:`#6164` + The code printing query statistics was ignoring the + :namedconf:ref:`zone-statistics` option. This has been fixed. + :gl:`#6164` - CDS/CDNSKEY records were not removed when re-configuring the server. - When on an ``rndc reconfig`` the DNSSEC policy changes such that it - changes the expected ``CDNSKEY`` and/or ``CDS`` records in the zone, - the RRset should be updated accordingly. This did not happen when - removing digests from the configuration, or setting `cdnskey no;`. - This has been fixed. :gl:`#6166` + When on an :option:`rndc reconfig` the DNSSEC policy changes such that + it changes the expected CDNSKEY and/or CDS records in the zone, the + RRset should be updated accordingly. This did not happen when removing + digests from the configuration, or setting ``cdnskey no;``. This has + been fixed. :gl:`#6166` - Stop reusing outgoing TCP connections the peer has already closed. - ``named`` could hand a new query an idle forwarder/upstream TCP or TLS - connection that the peer had already closed, causing the query to fail - (and CLOSE-WAIT sockets to pile up). Idle reused connections are now - watched, so a close is noticed and the connection is dropped instead - of reused. A new ``tcp-reuse-timeout`` option controls how long an - idle outgoing connection is kept open for reuse (default 5 seconds). + Previously, :iscman:`named` could hand a new query to an idle + forwarder/upstream TCP or TLS connection that the peer had already + closed, causing the query to fail (and CLOSE-WAIT sockets to pile up). + Idle reused connections are now watched, so a close is noticed and the + connection is dropped instead of reused. A new + :namedconf:ref:`tcp-reuse-timeout` option controls how long an idle + outgoing connection is kept open for reuse (default 5 seconds). :gl:`#6171` - Fix DNSSEC validation failures for names under an apex DNAME. @@ -339,10 +342,10 @@ Bug Fixes DNSSEC validation could fail with SERVFAIL for names covered by a DNAME at the apex of a signed zone, unless the zone's keys were already validated in the cache. This regression was introduced by the - recent fix for resolver stalls on CNAME responses to DS queries. - :gl:`#6176` + recent fix for resolver stalls on CNAME responses to DS queries, and + has now been addressed. :gl:`#6176` -- Resolver could terminate unexpectedly when processing a malformed +- Prevent unexpected resolver termination when processing a malformed RRSIG. A recursive resolver could terminate unexpectedly when an @@ -351,10 +354,9 @@ Bug Fixes - Cache glue only for enabled address families. - When caching delegation NS data, only use A/AAAA glue records if the - resolver has the corresponding IPv4/IPv6 dispatcher configured. If - IPv4 or IPv6 is disabled, ignore glue for that family and fall back to - caching the nameserver name if there is no glue from the other - supported family. - - + When caching delegation NS data, :iscman:`named` now only uses A/AAAA + glue records if the resolver has the corresponding IPv4/IPv6 + dispatcher configured. If IPv4 or IPv6 is disabled, glue is ignored + for that family and :iscman:`named` falls back to caching the + nameserver name if there is no glue from the other supported family. + :gl:`!11889`