Log message:
net/bind918: update to 9.18.34

Notes for BIND 9.18.34

New Features

* Print the expiration time of the stale records.

  Print the expiration time of the stale RRsets in the cache dump.

Removed Features

* Remove –with-tuning=small/large configuration option.

  The configuration option –with-tuning has been removed as it is no longer
  required or desired.

Bug Fixes

* Fix rndc flushname for longer name server names.

  rndc flushname did not work for name server names longer than 16
  bytes. This has been fixed. [GL #3885]

* Recently expired records could be returned with a timestamp in future.

  Under rare circumstances, an RRSet that expired at the time of the query
  could be returned with a TTL in the future. This has been fixed.

  As a side effect, the expiration time of expired RRSets is no longer
  returned in a cache dump. [GL #5094]

* YAML string not terminated in negative response in delv.

  [GL #5098]

* Apply the memory limit only to ADB database items.

  Under heavy load, a resolver could exhaust the memory available for
  storing the information in the Address Database (ADB), effectively
  discarding previously stored information in the ADB.  The memory used to
  retrieve and provide information from the ADB is no longer subject to the
  same memory limits that are applied to

  the Address Database. [GL #5127]

* Avoid unnecessary locking in the zone/cache database.

  Lock contention among many worker threads referring to the same database
  node at the same time is now prevented.  This improves zone and cache
  database performance for any heavily contended database nodes. [GL #5130]

* Improve the resolver performance under attack.

  Previously, a remote client could force the DNS resolver component to
  consume memory faster than resources were cleaned up for the canceled
  resolver fetches, due to the recursive-clients limit.  If such a traffic
  pattern was sustained for a long period of time, the DNS server might
  eventually run out of the available memory.  This has been fixed.

  It should be noted that, under such a heavy attack, no outgoing DNS
  queries will be successful in BIND 9 versions both with and without the
  fix, as the generated traffic pattern will consume all the available slots
  for the recursive clients.

Log message:
*: recursive bump for abseil 20250127.0

Log message:
net/bind918: update to 9.18.33

BIND 9.18.33 (2025-01-29)

Security Fixes

* DNS-over-HTTPS flooding fixes. (CVE-2024-12705)

  Fix DNS-over-HTTPS implementation issues that arise under heavy query
  load.  Optimize resource usage for named instances that accept queries
  over DNS-over-HTTPS.

  Previously, named processed all incoming HTTP/2 data at once, which could
  overwhelm the server, especially when dealing with clients that sent
  requests but did not wait for responses.  That has been fixed.  Now, named
  handles HTTP/2 data in smaller chunks and throttles reading until the
  remote side reads the response data.  It also throttles clients that send
  too many requests at once.

  In addition, named now evaluates excessive streams opened by clients that
  include no DNS data, which is considered "flooding."  It logs these
  clients and drops connections from them.  [GL #4795]

  In some cases, named could leave DNS-over-HTTPS connections in the
  CLOSE_WAIT state indefinitely.  That has also been fixed.  [GL #5083]

  ISC would like to thank Jean-François Billaud for his assistance with
  investigating this issue.

* Limit additional section processing for large RDATA sets. (CVE-2024-11187)

  When answering queries, don't add data to the additional section if the
  answer has more than 13 names in the RDATA.  This limits the number of
  lookups into the database(s) during a single client query, reducing the
  query-processing load.  [GL #5034]

  ISC would like to thank Toshifumi Sakaguchi for bringing this
  vulnerability to our attention.

New Features

* Add a new option to configure the maximum number of outgoing queries per
  client request.

  The configuration option max-query-count sets how many outgoing queries
  per client request are allowed.  The existing max-recursion-queries value
  is the number of permissible queries for a single name and is reset on
  every CNAME redirection.  This new option is a global limit on the client
  request.  The default is 200.

  The default for max-recursion-queries is changed from 32 to 50.  This
  allows named to send a few more queries while looking up a single name.
  [GL #4980] [GL #4921]

Bug Fixes

* Fix nsupdate hang when processing a large update.

  To mitigate DNS flood attacks over a single TCP connection, throttle the
  connection when the other side does not read the data.  Throttling should
  only occur on server-side sockets, but erroneously also happened for
  nsupdate, which acts as a client.  When nsupdate started throttling the
  connection, it never attempted to read again.  This has been fixed.  [GL
  #4910]

* Fix possible assertion failure when reloading server while processing
  update policy rules.  [GL #5006]

* Fix dnssec-signzone signing non-DNSKEY RRsets with revoked keys.

  dnssec-signzone was using revoked keys for signing RRsets other than
  DNSKEY.  This has been corrected.  [GL #5070]

* Fix improper handling of unknown directives in resolv.conf.

  The line after an unknown directive in resolv.conf could accidentally be
  skipped, potentially affecting dig, host, nslookup, nsupdate, or delv.
  This has been fixed.  [GL #5084].

Log message:
revbump after devel/protobuf update

Log message:
net/bind918: update to 9.18.32

9.18.32 (2024-12-11)

New Features

* Update built-in bind.keys file with the new 2025 IANA root key.

* Add an initial-ds entry to bind.keys for the new root key, ID 38696, which
  is scheduled for publication in January 2025.  [GL #4896]

Removed Features

* Move contributed DLZ modules into a separate repository.  DLZ modules
  should not be used except in testing.

* The DLZ modules were not maintained, the DLZ interface itself is going to
  be scheduled for removal, and the DLZ interface is blocking.  Any module
  that blocks the query to the database blocks the whole server.

* The DLZ modules now live in
  https://gitlab.isc.org/isc-projects/dlz-modules repository.  [GL #4865]

Feature Changes

* Emit more helpful log messages for exceeding max-records-per-type.

* The new log message is emitted when adding or updating an RRset fails due
  to exceeding the max-records-per-type limit.  The log includes the owner
  name and type, corresponding zone name, and the limit value.  It will be
  emitted on loading a zone file, inbound zone transfer (both AXFR and
  IXFR), handling a DDNS update, or updating a cache DB.  It's especially
  helpful in the case of zone transfer, since the secondary side doesn't
  have direct access to the offending zone data.

* It could also be used for max-types-per-name, but this change doesn't
  implement it yet as it's much less likely to happen in practice.

* Harden key management when key files have become unavailable.

* Prior to doing key management, BIND 9 will check if the key files on disk
  match the expected keys.  If key files for previously observed keys have
  become unavailable, this will prevent the internal key manager from
  running.

Bug Fixes

* {&dns} is as valid as {?dns} in a SVCB's dohpath.

* dig failed to parse a valid SVCB record with a dohpath URI template
  containing a {&dns}, like \ 
"dohpath=/some/path?key=value{&dns}".  [GL
  #4922]

* Fix NSEC3 closest encloser lookup for names with empty non-terminals.

* A previous performance optimization for finding the NSEC3 closest encloser
  when generating authoritative responses could cause servers to return
  incorrect NSEC3 records in some cases.  This faulty optimization has been
  removed.  [GL #4950]

* dig options of the form [+-]option=<value> failed to display the value on
  the printed command line.  This has been fixed.  [GL #4993]

* Provide more visibility into TLS configuration errors by logging
  SSL_CTX_use_certificate_chain_file() and SSL_CTX_use_PrivateKey_file()
  errors individually.  [GL #5008]

Log message:
*: recursive bump for icu 76 shlib major version bump

Log message:
*: revbump for icu downgrade

Log message:
*: recursive bump for icu 76.1 shlib bump