Log Message:
net/bind918: update to 9.18.32

9.18.32 (2024-12-11)

New Features

* Update built-in bind.keys file with the new 2025 IANA root key.

* Add an initial-ds entry to bind.keys for the new root key, ID 38696, which
  is scheduled for publication in January 2025.  [GL #4896]

Removed Features

* Move contributed DLZ modules into a separate repository.  DLZ modules
  should not be used except in testing.

* The DLZ modules were not maintained, the DLZ interface itself is going to
  be scheduled for removal, and the DLZ interface is blocking.  Any module
  that blocks the query to the database blocks the whole server.

* The DLZ modules now live in
  https://gitlab.isc.org/isc-projects/dlz-modules repository.  [GL #4865]

Feature Changes

* Emit more helpful log messages for exceeding max-records-per-type.

* The new log message is emitted when adding or updating an RRset fails due
  to exceeding the max-records-per-type limit.  The log includes the owner
  name and type, corresponding zone name, and the limit value.  It will be
  emitted on loading a zone file, inbound zone transfer (both AXFR and
  IXFR), handling a DDNS update, or updating a cache DB.  It's especially
  helpful in the case of zone transfer, since the secondary side doesn't
  have direct access to the offending zone data.

* It could also be used for max-types-per-name, but this change doesn't
  implement it yet as it's much less likely to happen in practice.

* Harden key management when key files have become unavailable.

* Prior to doing key management, BIND 9 will check if the key files on disk
  match the expected keys.  If key files for previously observed keys have
  become unavailable, this will prevent the internal key manager from
  running.

Bug Fixes

* {&dns} is as valid as {?dns} in a SVCB's dohpath.

* dig failed to parse a valid SVCB record with a dohpath URI template
  containing a {&dns}, like \ 
"dohpath=/some/path?key=value{&dns}".  [GL
  #4922]

* Fix NSEC3 closest encloser lookup for names with empty non-terminals.

* A previous performance optimization for finding the NSEC3 closest encloser
  when generating authoritative responses could cause servers to return
  incorrect NSEC3 records in some cases.  This faulty optimization has been
  removed.  [GL #4950]

* dig options of the form [+-]option=<value> failed to display the value on
  the printed command line.  This has been fixed.  [GL #4993]

* Provide more visibility into TLS configuration errors by logging
  SSL_CTX_use_certificate_chain_file() and SSL_CTX_use_PrivateKey_file()
  errors individually.  [GL #5008]