Capture the ownership-instead-of-locking pattern for per-loop sharded
structures: owner-only mutation under isc_tid() affinity, foreign
deletion as mark plus wait-free handoff of the exact entry to the
owner (never an O(shard) scan for marked entries), shard-held
references with bounded zombie lifetime, and eviction pressure spread
across shards instead of draining one before the next.
Point agents at pahole on the developer build's DWARF instead of
compiling throwaway sizeof programs, and document the cacheline-padding
idiom (union arm with a plain ISC_OS_CACHELINE_SIZE multiplier plus a
STATIC_ASSERT) over the enumerated-sizeof formula, which silently
miscounts when members are added.
Add the lttng-tracing-root-cause-analysis agent skill
Describe the LTTng flight-recorder methodology for concurrency bugs
that static reading, printf and debuggers all miss: small snapshot
buffers to keep timing faithful, a self-diagnosing violation tracepoint
followed by snapshot-and-abort, and the trace-reading patterns —
notably that a stale-read-after-write "paradox" indicates a missing
happens-before edge, not a timing problem.
Capture the build-invisible/publish/reclaim discipline for mutating
RCU-read structures: what makes a node observable (forward, backward
and secondary-index channels), why allocation failure must stay in the
invisible phase, publish-ordering rules for reader consistency, and the
anti-patterns (mutate-then-rollback, wiring clusters via read-side
recovery) that lead to use-after-free. Includes a worked
compressed-split example.
Condense the isc_mem/isc_mempool contract into agent guidance: the two
allocation families and why mixing them detonates the inuse INSIST at
context destroy, the pointer-NULLing put/free macros, water-mark and
striped-statistics behavior, ISC_MEM_DEBUG* facilities, and mempool
locking/ASAN caveats. Ends with a review checklist for allocation code.
fix: usr: Properly prevent TSIG generation command line injection attacks
When key names are generated with `rndc-confgen`, `tsig-keygen` and `ddns-confgen`, special characters must be escaped to ensure the configuration is parsed correctly.
Closes #6071
Merge branch '6071-allow-all-valid-keynames' into 'main'
Mark Andrews [Tue, 7 Jul 2026 01:02:34 +0000 (11:02 +1000)]
Update tests_rndc_confgen.py to show escaped double quotes
The old INJECTION string was failing due to not being a valid
DNS name providing a false assertion that injections where
no longer possible. Shorten it to fit in a single label then
check that it is properly escaped to prevent the injection attack.
Mark Andrews [Tue, 5 May 2026 01:54:35 +0000 (11:54 +1000)]
Allow all valid key names
TSIG keys names need to be able to be set to any valid name so that
update self rules can work for any valid name. Restore this ability
to the key generating tool while preventing rndc.conf and named.conf
from being compromised due to specially crafted key names.
Mark Andrews [Mon, 6 Jul 2026 02:59:50 +0000 (12:59 +1000)]
Add DNS_NAME_QUOTED flag for dns_name_totext()
Names that are to be printed within a pair of double quotes,
(for example, in named.conf), don't need spaces and special
characters to be fully escaped.
fix: usr: Ensure NSEC authority does not cross zonecut boundary
When using a cached NSEC record to prove that a delegation is insecure,
we now check that the signer name in the corresponding RRSIG is not
above a known secure delegation point. This prevents a signed namespace
from being downgraded to insecure using an NSEC record from the
grandparent zone.
Alessio Podda [Thu, 4 Jun 2026 14:40:03 +0000 (16:40 +0200)]
Add a system test for the grandparent NSEC downgrade
A resolver must not accept an NSEC or NSEC3 record signed by a zone
above a known secure delegation as proof that the delegation is
insecure. Otherwise anyone able to answer for the grandparent can
downgrade the signed namespace below it and serve forged, unsigned
records for any name in it.
Checking for SERVFAIL alone would not pin this down: a resolver that
rejects the forged proof but keeps walking down fails too, on the
unvalidatable answer it meets further along. The tests therefore
assert the refusal itself -- it is logged, and no DS query for a name
below the forged proof ever reaches the authoritative server -- and
they do so both for a proof fetched on demand and for one already in
the cache.
Evan Hunt [Fri, 22 May 2026 02:34:00 +0000 (19:34 -0700)]
Ensure NSEC authority does not cross zonecut boundary
When using a cached NSEC record to prove that a delegation is insecure,
we now check that the signer name in the corresponding RRSIG is not
above a known secure delegation point. This prevents a signed namespace
from being downgraded to insecure using an NSEC record from the
grandparent zone.
chg: dev: Pass the work callback result to the done callback
The `isc_work` callback now returns `isc_result_t` and the value is
handed to the done callback, so the callers no longer need their own
result-passing state.
Merge branch 'ondrej/pass-result-from-work-callback' into 'main'
Pass the work callback result to the done callback
The isc_work callback returned void, so every user that cared about
the outcome of the offloaded work had to smuggle it through its own
context state (xfrin_work_t, the catz/rpz updateresult fields, result
members in the dump/load/checksig contexts). Make the work callback
return isc_result_t and have isc_work deliver that value to the done
callback.
fix: usr: Prevent aborts during expired cache dumps
Running rndc dumpdb -expired could cause named to abort when the cache contained internal deletion markers for records that had already been removed. BIND now skips those markers when preparing expired cache dumps, so the dump includes only real cached records and completes normally.
Closes #6064
Merge branch '6064-skip-nonexistent-headers' into 'main'
Add a regression test that deletes a cached rdataset and then walks
all rdatasets with expired entries allowed. The iterator must report no
datasets for the deleted type rather than exposing the tombstone.
The cache rdataset iterator must never bind delete tombstones, even
when expired cache entries are requested for dumpdb. Treat non-existent
slab headers as inactive so expired dumps cannot expose headers without
a backing rdataslab.
Remove prereq.sh support from the system test runner
With every prereq.sh converted to pytest markers, the conftest
fixture no longer needs to locate and run a per-directory prereq.sh.
Drop check_prerequisites() and the README entry for the file.
The libxml2/json-c requirement becomes with_libxml2_or_json_c. The
stale Net::DNS check and the core-Perl File::Fetch check are dropped
rather than carried over.
Nicki Křížek [Tue, 30 Jun 2026 14:53:10 +0000 (14:53 +0000)]
Move Perl-module prereq.sh checks to pytest markers
fetchlimit and nsupdate still invoke ungated Perl helpers that
need Net::DNS (ditch.pl, packet.pl); reclimit and serve_stale
still run Perl ans.pl servers needing Net::DNS::Nameserver and
Time::HiRes. Replace the directory-scoped prereq.sh with new
runtime-probing markers applied only to the tests.sh wrappers
that actually run the Perl code -- native pytest modules in the
same directory (e.g. nsupdate) no longer skip when these modules
are absent.
fix: usr: Negative caching stopped working with stale-answer-client-timeout 0
With "stale-answer-client-timeout 0" configured, every client query for a
name cached as NXDOMAIN or NODATA was sent on to the authoritative servers,
even while the cached negative answer was still within its TTL, so the
resolver effectively lost negative caching. Negative answers are now
refreshed only once they have actually gone stale.
Closes #6245
Merge branch '6245-fix-query_stale_refresh_ncache' into 'main'
Test that a fresh negative cache entry is not refreshed
The existing serve-stale tests all use negative answers with a two
second TTL, because they are there to exercise stale data. Nothing
covered the far more common case of a negative answer that is still
fresh, which is how the needless refresh went unnoticed.
ans2 grows a NODATA and an NXDOMAIN name backed by a SOA with a 600
second TTL and MINIMUM, so the cached entry cannot go stale while the
test runs, and the test counts the queries that reach ans2: priming the
cache may send one, the repeated client queries must send none.
Only refresh negative cache entries that are actually stale
query_ncache() always passed a NULL rdataset to query_stale_refresh(),
which reads NULL as "this RRset is stale". NULL is only meaningful for
the DNS64 caller, whose rdataset has already been detached by the time
the answer is turned into an NXDOMAIN; everywhere else a perfectly fresh
negative cache entry was taken for a stale one.
With stale-answer-client-timeout 0 the staleness check is the only gate
left on the refresh, so every client query for a cached NXDOMAIN or
NODATA name started another fetch and negative caching stopped having
any effect.
Aydın Mercan [Fri, 3 Jul 2026 11:49:15 +0000 (14:49 +0300)]
[CVE-2026-13321] sec: usr: Fix DNSSEC validation bypass via out-of-zone NSEC Next Field
A malicious zone with out-of-zone NSEC next owner names can cause a DNSSEC validating resolver to cache such record and, if `synth-from-dnssec` is enabled, to generate negative answers for any zone that is covered by the range.
ISC would like to thank Qifan Zhang of Palo Alto Networks for reporting the issue.
Closes isc-projects/bind9#5873
Merge branch '5873-security-out-of-zone-nsec-dnssec-bypass' into 'security-main'
Evan Hunt [Thu, 14 May 2026 03:45:57 +0000 (20:45 -0700)]
dns_rdataset_addnoqname() could find unsigned NSEC/NSEC3
The dns_rdatalist addnoqname() implementation searches for the first
NSEC or NSEC3 record in a message, then for the first RRSIG covering
that type in the same message. Previously, if no RRSIG for the type was
found, the function accepted the unsigned record. Now, it will instead
continue searching until an NSEC or NSEC3 that does have a matching
signature is found.
When this function is called from validated() in resolver.c, a
non-success return code is now treated as an error instead of triggering
an assertion failure.
[CVE-2026-10723] sec: usr: Correct verification of NSEC3 signer name
BIND 9 accepted child-zone NSEC3 records where the first label equals the hash of the parent zone as valid parent-zone closest encloser proofs. This has been fixed.
ISC thanks Qifan Zhang of Palo Alto Networks for reporting the issue.
Closes isc-projects/bind9#5874
Merge branch '5874-confidential-nsec3-apex-hash-bypass' into 'security-main'
Update the llm generated reproducer:
- Move server.py into ans1/ans.py
- Remove unnecessary named.conf configuration options
- Add comments describing the steps (copied from GL issue)
- Rename system test
Aydın Mercan [Thu, 7 May 2026 15:59:20 +0000 (18:59 +0300)]
Reject out-of-zone NSEC next owner names
When verifying DNSSEC records, make sure that a next owner name of
an NSEC record is a subdomain of the signer field.
This follows the specification RFC 4034, section 4.1.1:
Owner names of RRsets for which the given zone is not authoritative
(such as glue records) MUST NOT be listed in the Next Domain Name
unless at least one authoritative RRset exists at the same owner
name.
While the above paragraph is intended for glue records, it also
applies to out-of-zone data.
sec: usr: Reclaim memory promptly when DNSSEC validations are canceled
When a resolver is flooded with queries that require DNSSEC
validation — for example during a random-subdomain attack —
many of those validations are canceled before they complete.
Previously a canceled validation still kept its place in the
internal work queue and held the associated response in memory
until that queued work eventually ran, so memory could climb
sharply under sustained load. The canceled work is now dropped
as soon as the validation is canceled, releasing the memory it
was holding.
Merge branch '4760-cancel-dns_validator-jobs-early' into 'security-main'
Ondřej Surý [Tue, 23 Jun 2026 05:03:43 +0000 (07:03 +0200)]
Make the per-fetch validation quota terminal in sub-validations
Negative-proof validation stops once the per-fetch validation quota is
exhausted, but the DNSKEY, DS and CNAME sub-validator callbacks did
not — they re-fetched the record or relabelled the quota as a broken
chain. Treat ISC_R_QUOTA as terminal in all three, as
validator_callback_nsec already does.
Aydın Mercan [Wed, 6 May 2026 13:54:57 +0000 (16:54 +0300)]
Add system test for out-of-zone nsec dnssec bypass
A malicious zone with out-of-zone NSEC entries can get a DNSSEC
validating resolver's cache to cover the victim zone for non-existence
and prevent nameserver queries without DNSSEC failure.
Test for this case with an `evil.test` zone that tries to cover the
`victim.test` zone.
Colin Vidal [Wed, 1 Jul 2026 09:56:41 +0000 (11:56 +0200)]
chg: dev: Follow-up of disambiguate `query_cname()` and `query_dname()` usage
Previous commit "Disambiguate `query_cname()` and `query_dname()` usage"
was harmless but also useless, as it was checking `qctx->result` which
is always set to `ISC_R_SUCCESS` when `qctx` is initialized. The intent
was to check `qctx->fresp->result` (which is the result provided by the
resolver). But this was also wrong (this is actually the case we do
expect `query_cname()`/`query_dname()` to be called, to follow the
chain).
The actual invarant that needs to be checked is if the qtype is CNAME
then we do not follow the chain, so we can't call `query_cname()`. This
invariant has been added.
If the qtype is DNAME, it's more complex, because a DNAME can be found
from a local zone or cache and the chain can be locally followed. In
which case, calling `query_dname()` is legit, as soon as the qname is a
subname of the DNAME target. This invariant is already checked.
Merge branch 'colin/follow-up-disambiguate-query_cname_dname' into 'security-main'
Ondřej Surý [Fri, 12 Jun 2026 15:37:16 +0000 (17:37 +0200)]
Cancel the offloaded verification job when canceling a validator
The offloaded jobs were fire-and-forget: dns_validator_cancel() could
only raise a flag and wait for the queued crypto to get its turn, so
under a random-subdomain attack canceled validations piled up in the
worker queues, pinning memory. Keep the isc_work handle and cancel it:
a still-queued job never runs its crypto and unwinds on dequeue; a
running one is unaffected.
Colin Vidal [Wed, 1 Jul 2026 08:59:01 +0000 (10:59 +0200)]
Convert some chain shell-based system tests in python
Rewriting a couple of shell-based chain system test into python. Those
tests exercise the dname resolution of either an authoritative or
resolver without extra queries (it is self resolver either because the
target is in an authoritative zone or in the same authoritative answer).
Also add an extra test checking the same mechanism, this time, from the
resolver cache (no resolver involed).
Those highlight the fact that `query_dname()` can be called in situation
where the query type is DNAME, and even though, it needs to be resolved.
Colin Vidal [Wed, 24 Jun 2026 06:40:52 +0000 (08:40 +0200)]
chg: dev: Disambiguate `query_cname()` and `query_dname()` usage
Make explicit the fact that `query_cname()` and `query_dname()` must be
called only from a context where the resolver is answering a question
which is _not_ respectively `CNAME` or `DNAME`.
Merge branch 'colin/explicit-dname-cname-libns-query-usage' into 'security-main'
Colin Vidal [Wed, 1 Jul 2026 08:58:41 +0000 (10:58 +0200)]
Follow-up of disambiguate `query_cname()` and `query_dname()` usage
Previous commit "Disambiguate `query_cname()` and `query_dname()` usage"
was harmless but also useless, as it was checking `qctx->result` which
is always set to `ISC_R_SUCCESS` when `qctx` is initialized. The intent
was to check `qctx->fresp->result` (which is the result provided by the
resolver). But this was also wrong (this is actually the case we do
expect `query_cname()`/`query_dname()` to be called, to follow the
chain).
The actual invarant that needs to be checked is if the qtype is CNAME
then we do not follow the chain, so we can't call `query_cname()`. This
invariant has been added.
If the qtype is DNAME, it's more complex, because a DNAME can be found
from a local zone or cache and the chain can be locally followed. In
which case, calling `query_dname()` is legit, as soon as the qname is a
subname of the DNAME target. This invariant is already checked.
Ondřej Surý [Tue, 23 Jun 2026 05:05:01 +0000 (07:05 +0200)]
[CVE-2026-11605] sec: usr: Prevent excessive validation work from crafted negative responses
A validating resolver could be made to perform a large amount of DNSSEC
validation work in response to a single answer, consuming excessive CPU. A
malicious authoritative server triggers this by returning a signed negative
answer (NXDOMAIN or NODATA) padded with many denial-of-existence proof
records, which the resolver continued to verify beyond its per-query
validation limit. It now enforces that limit on negative answers and returns
SERVFAIL once the limit is reached.
Closes: https://gitlab.isc.org/isc-projects/bind9/-/work_items/4463
Merge branch '4463-limit-the-number-of-negative-validations' into 'security-main'
Colin Vidal [Mon, 22 Jun 2026 11:27:09 +0000 (13:27 +0200)]
Disambiguate `query_cname()` and `query_dname()` usage
Make explicit the fact that `query_cname()` and `query_dname()` must be
called only from a context where the resolver is answering a question
which is _not_ respectively `CNAME` or `DNAME`.
Mark Andrews [Mon, 22 Jun 2026 11:27:01 +0000 (21:27 +1000)]
[CVE-2026-11721] sec: usr: Invalid signed wildcard records were being accepted
Signed wildcard responses in which the Labels field in the `RRSIG` record was less than the number of labels in the Signer Name field were being incorrectly accepted. This in turn broke `synth-from-dnssec`, which depends on such records being correctly validated. This has been fixed.
ISC thanks Qifan Zhang of Palo Alto Networks for bringing this issue to our attention.
Mark Andrews [Mon, 15 Jun 2026 01:29:54 +0000 (11:29 +1000)]
[CVE-2026-10822] sec: usr: Malformed DNSKEY records could trigger an assertion
Previously, `dns_name_fromwire()` did not honor the record boundary when reading names from the wire, allowing malformed records to be accepted when they should not have been. In particular, malformed DNSKEY records could trigger an assertion failure when being printed. This has been fixed.
Closes: https://gitlab.isc.org/isc-projects/bind9/-/issues/6004
Merge branch '6004-confidential-issue' into 'security-main'
Tests that BIND rejects RRSIGs where Labels < (signer_labels - 1), the
underflow condition described in the fix to lib/dns/dnssec.c.
A crafted authoritative server (ans4) serves the zone
attacker.rrsig-labels-signer. with synthetically constructed responses:
an A record covered by an RRSIG whose Labels=1 was produced by signing
*.rrsig-labels-signer. with a key whose signer name sits two labels
deeper (attacker.rrsig-labels-signer., 3 non-root labels). On unfixed
BIND, the resolver accepts the signature and caches the wildcard with
SECURE rank, enabling a synth-from-dnssec cache-poisoning attack on
subsequent queries.
The test verifies two properties: the poison query returns SERVFAIL
(DNS_R_SIGINVALID), and a follow-up victim query is not answered from
the poisoned wildcard cache.
Ondřej Surý [Sun, 7 Jun 2026 08:19:44 +0000 (10:19 +0200)]
Limit DNSSEC denial proof validation per fetch
Negative response validation reuses the per-fetch validation counters,
but NSEC/NSEC3 subvalidator quota failures were not terminal. The
parent validator logged the child failure and resumed validate_nx(),
so a response stuffed with many denial proof RRsets could keep driving
more validation work and still eventually validate.
Treat ISC_R_QUOTA from an NSEC/NSEC3 subvalidator as terminal and
propagate the quota reason to the parent validator. This lets the
existing fctx->nvalidations and fctx->nfails limits stop excessive
negative proof validation without a separate resolver-side pre-scan.
Mark Andrews [Fri, 12 Jun 2026 05:48:37 +0000 (15:48 +1000)]
[CVE-2026-11331] sec: usr: Fix handling of rpz CNAME expansion that returns name too long
Previously, if the expansion of a wildcard CNAME RPZ policy resulted in a name that exceeded the length limit, a self referential CNAME and the original address record were returned, allowing the policy to be bypassed. In branches up to 9.20, this also left query processing in an inconsistent state which could trigger an assertion failure. We now return a YXDOMAIN response, without the address.
ISC would like to thank Laith Mash'al (0xmshal) for bringing this issue to our attention.
Mark Andrews [Thu, 4 Jun 2026 23:18:30 +0000 (09:18 +1000)]
POC for PRIVATEDNS DNSKEY overrun not being detected
Construct a DNS message where a PRIVATEDNS DNSKEY identifier
overruns the record boundary by 3 byte so that the label ends
at the end of the compression pointer for the next record. The
next type is less than 256 so the next octet is 00 terminating
the identifier name. The transfered zone is then written to
disk using master-format text triggering the assertion when the
truncated identier is discovered.
Note this test will produce a false result in versions of
BIND that do not check the PRIVATEDNS identifier as it looks
for the error message when the transfer is aborted.
Mark Andrews [Tue, 14 Apr 2026 02:24:33 +0000 (12:24 +1000)]
Invalid signed wildcard records were being accepted
An RRSIG whose Labels field indicates fewer labels than its signer
name requires was being accepted. When such a record covers a
wildcard, the validator reconstructs a wildcard owner name above the
signer's zone and caches it as secure. RFC 8198 cache synthesis
(synth-from-dnssec) then serves that forged wildcard for unrelated
names, poisoning the cache.
These records are now rejected, both when an RRSIG is parsed and when
its signature is verified.
Mark Andrews [Tue, 19 May 2026 01:24:01 +0000 (11:24 +1000)]
Make it clearer that decompression is not allowed here
For DNSKEY and RRSIG as per RFC 4034, A.1.1. Private Algorithm Types
For KEY, SIG as per RFC 2535 3.2 The KEY Algorithm Number Specification,
which only allowed local domain compression which itself is no
longer allowed.
Other key types inherit from these or the general proscription that
compression is not allow in new types.
Mark Andrews [Tue, 19 May 2026 01:12:46 +0000 (11:12 +1000)]
Fix dns_name_fromwire to honour the active region
dns_name_fromwire was not honouring the source buffer's active
region when reading names from the wire. This allowed malformed
records to be accepted when they shouldn't have been. This has
been corrected.
Mark Andrews [Tue, 19 May 2026 05:14:06 +0000 (15:14 +1000)]
Fix dst_algorithm_fromdata to set the active range
When the buffer to check extract the PRIVATEDNS name was constructed
isc_buffer_setactive was not called. This is now needed as
dns_name_fromwire is being corrected to check the active region.
Mark Andrews [Tue, 19 May 2026 05:00:17 +0000 (15:00 +1000)]
Fix the yaml query zone name code in dnstap-read
When the buffer to read the query zone name was constructed
isc_buffer_setactive was not called. This is now needed as
dns_name_fromwire is being corrected to check the active region.
Mark Andrews [Tue, 19 May 2026 01:09:02 +0000 (11:09 +1000)]
Fix EDNS Report Channel checking code
When the buffer to check the Report Channel domain was constructed
isc_buffer_setactive was not called. This is now needed as
dns_name_fromwire is being corrected to check the active region.
Mark Andrews [Tue, 19 May 2026 00:44:04 +0000 (10:44 +1000)]
Check that dns_name_fromwire honours the active region
When reading DNS records from the wire the active region of the
source buffer is set to the end of the current record. dns_name_fromwire
should fail if it attempts to read past this setting.
The OID printed in the "; alg = ..." comment of a PRIVATEOID KEY,
DNSKEY, CDNSKEY or RKEY record was truncated to sixteen characters:
1.2.840.113549.1.1.11 came out as 1.2.840.113549.1. Only the comment
was ever affected, never the record itself.
fix: dev: Fix a crash when resolving names below a cached DNAME
A recursive resolver could crash when it answered a query for a name beneath a
cached DNAME while that same DNAME record was concurrently refreshed or evicted
from the cache.
Closes #6182
Merge branch '6182-qpcache-dname-zonecut-uaf' into 'main'
check_dname() cached the DNAME header and its RRSIG in the search block
and dropped the node lock holding only a node reference. Since cache
headers became reference counted and are freed synchronously, and
delegation adds no longer take the tree write lock, a concurrent refresh
or eviction can free the header before setup_delegation() reads it. Take
a reference on the headers in check_dname() and release it once the
lookup finishes.
chg: dev: Support larger DNSSEC keys and signatures
Some DNSSEC tools and trust-anchor handling could fail when
working with unusually large DNSSEC keys or signatures,
including those used by post-quantum algorithms. These paths
now accept DNSKEY, CDNSKEY, CDS, and RRSIG data up to the DNS
record size limits, so large key material can be parsed, written,
checked, and signed consistently.
Merge branch 'ondrej/dynamic-dnssec-buffers' into 'main'
projects / thirdparty / bind9.git / log
