Path to this page:
./
net/bind918,
Berkeley Internet Name Daemon implementation of DNS, version 9.18
Branch: CURRENT,
Version: 9.18.33nb1,
Package name: bind-9.18.33nb1,
Maintainer: sekiyaBIND, the Berkeley Internet Name Daemon.
Release notes are available via https://bind9.readthedocs.io/en/
This package contains the BIND 9.18 release. Upstream labels it
as supported.
MESSAGE.rcd [+/-]===========================================================================
$NetBSD: MESSAGE.rcd,v 1.1 2022/12/11 01:57:55 sekiya Exp $
Please consider running BIND under the pseudo user account "${BIND_USER}"
in a chroot environment for security reasons.
To achieve this, set the variable "named_chrootdir" in /etc/rc.conf to
the directory with the chroot environment e.g. "${BIND_DIR}".
Note: named(8) requires writable directories under "/etc/namedb" which
specified by "directory" in "options" statement:
cache
keys
nta
Make sure to these directories exists with writable by "${BIND_USER}" user.
===========================================================================
Package options: readline, threads
Master sites:
Filesize: 5216.422 KB
Version history: (Expand)
- (2025-02-09) Updated to version: bind-9.18.33nb1
- (2025-01-29) Updated to version: bind-9.18.33
- (2024-12-27) Updated to version: bind-9.18.32nb1
- (2024-12-13) Updated to version: bind-9.18.32
- (2024-11-15) Updated to version: bind-9.18.31nb3
- (2024-11-01) Updated to version: bind-9.18.31nb2
CVS history: (Expand)
2025-02-09 15:44:09 by Thomas Klausner | Files touched by this commit (62) |
Log message:
*: recursive bump for abseil 20250127.0
|
2025-01-29 16:13:54 by Takahiro Kambe | Files touched by this commit (2) |  |
Log message:
net/bind918: update to 9.18.33
BIND 9.18.33 (2025-01-29)
Security Fixes
* DNS-over-HTTPS flooding fixes. (CVE-2024-12705)
Fix DNS-over-HTTPS implementation issues that arise under heavy query
load. Optimize resource usage for named instances that accept queries
over DNS-over-HTTPS.
Previously, named processed all incoming HTTP/2 data at once, which could
overwhelm the server, especially when dealing with clients that sent
requests but did not wait for responses. That has been fixed. Now, named
handles HTTP/2 data in smaller chunks and throttles reading until the
remote side reads the response data. It also throttles clients that send
too many requests at once.
In addition, named now evaluates excessive streams opened by clients that
include no DNS data, which is considered "flooding." It logs these
clients and drops connections from them. [GL #4795]
In some cases, named could leave DNS-over-HTTPS connections in the
CLOSE_WAIT state indefinitely. That has also been fixed. [GL #5083]
ISC would like to thank Jean-François Billaud for his assistance with
investigating this issue.
* Limit additional section processing for large RDATA sets. (CVE-2024-11187)
When answering queries, don't add data to the additional section if the
answer has more than 13 names in the RDATA. This limits the number of
lookups into the database(s) during a single client query, reducing the
query-processing load. [GL #5034]
ISC would like to thank Toshifumi Sakaguchi for bringing this
vulnerability to our attention.
New Features
* Add a new option to configure the maximum number of outgoing queries per
client request.
The configuration option max-query-count sets how many outgoing queries
per client request are allowed. The existing max-recursion-queries value
is the number of permissible queries for a single name and is reset on
every CNAME redirection. This new option is a global limit on the client
request. The default is 200.
The default for max-recursion-queries is changed from 32 to 50. This
allows named to send a few more queries while looking up a single name.
[GL #4980] [GL #4921]
Bug Fixes
* Fix nsupdate hang when processing a large update.
To mitigate DNS flood attacks over a single TCP connection, throttle the
connection when the other side does not read the data. Throttling should
only occur on server-side sockets, but erroneously also happened for
nsupdate, which acts as a client. When nsupdate started throttling the
connection, it never attempted to read again. This has been fixed. [GL
#4910]
* Fix possible assertion failure when reloading server while processing
update policy rules. [GL #5006]
* Fix dnssec-signzone signing non-DNSKEY RRsets with revoked keys.
dnssec-signzone was using revoked keys for signing RRsets other than
DNSKEY. This has been corrected. [GL #5070]
* Fix improper handling of unknown directives in resolv.conf.
The line after an unknown directive in resolv.conf could accidentally be
skipped, potentially affecting dig, host, nslookup, nsupdate, or delv.
This has been fixed. [GL #5084].
|
2024-12-27 00:57:23 by Adam Ciarcinski | Files touched by this commit (46) |  |
Log message:
revbump after devel/protobuf update
|
2024-12-13 18:29:56 by Takahiro Kambe | Files touched by this commit (6) |  |
Log message:
net/bind918: update to 9.18.32
9.18.32 (2024-12-11)
New Features
* Update built-in bind.keys file with the new 2025 IANA root key.
* Add an initial-ds entry to bind.keys for the new root key, ID 38696, which
is scheduled for publication in January 2025. [GL #4896]
Removed Features
* Move contributed DLZ modules into a separate repository. DLZ modules
should not be used except in testing.
* The DLZ modules were not maintained, the DLZ interface itself is going to
be scheduled for removal, and the DLZ interface is blocking. Any module
that blocks the query to the database blocks the whole server.
* The DLZ modules now live in
https://gitlab.isc.org/isc-projects/dlz-modules repository. [GL #4865]
Feature Changes
* Emit more helpful log messages for exceeding max-records-per-type.
* The new log message is emitted when adding or updating an RRset fails due
to exceeding the max-records-per-type limit. The log includes the owner
name and type, corresponding zone name, and the limit value. It will be
emitted on loading a zone file, inbound zone transfer (both AXFR and
IXFR), handling a DDNS update, or updating a cache DB. It's especially
helpful in the case of zone transfer, since the secondary side doesn't
have direct access to the offending zone data.
* It could also be used for max-types-per-name, but this change doesn't
implement it yet as it's much less likely to happen in practice.
* Harden key management when key files have become unavailable.
* Prior to doing key management, BIND 9 will check if the key files on disk
match the expected keys. If key files for previously observed keys have
become unavailable, this will prevent the internal key manager from
running.
Bug Fixes
* {&dns} is as valid as {?dns} in a SVCB's dohpath.
* dig failed to parse a valid SVCB record with a dohpath URI template
containing a {&dns}, like \
"dohpath=/some/path?key=value{&dns}". [GL
#4922]
* Fix NSEC3 closest encloser lookup for names with empty non-terminals.
* A previous performance optimization for finding the NSEC3 closest encloser
when generating authoritative responses could cause servers to return
incorrect NSEC3 records in some cases. This faulty optimization has been
removed. [GL #4950]
* dig options of the form [+-]option=<value> failed to display the value on
the printed command line. This has been fixed. [GL #4993]
* Provide more visibility into TLS configuration errors by logging
SSL_CTX_use_certificate_chain_file() and SSL_CTX_use_PrivateKey_file()
errors individually. [GL #5008]
|
2024-11-14 23:22:33 by Thomas Klausner | Files touched by this commit (2429) |
Log message:
*: recursive bump for icu 76 shlib major version bump
|
2024-11-01 13:55:19 by Thomas Klausner | Files touched by this commit (2426) |
Log message:
*: revbump for icu downgrade
|
2024-11-01 01:54:33 by Thomas Klausner | Files touched by this commit (2427) |
Log message:
*: recursive bump for icu 76.1 shlib bump
|
2024-10-21 15:24:45 by Takahiro Kambe | Files touched by this commit (2) |  |
Log message:
net/bind918: update to 9.18.31
9.18.31 (2024-10-16)
New Features
* Added WALLET type.
Add the new record type WALLET (262). This provides a mapping from a
domain name to a cryptographic currency wallet. Multiple mappings can
exist if multiple records exist. [GL #4947]
Feature Changes
* Allow IXFR-to-AXFR fallback on DNS_R_TOOMANYRECORDS.
This change allows fallback from an IXFR failure to AXFR when the reason
is DNS_R_TOOMANYRECORDS. [GL #4928]
Bug Fixes
* Fix a statistics channel counter bug when "forward only" zones are used.
When resolving a zone with a "forward only" policy, and finding out that
all the forwarders were marked as "bad", the "ServerQuota" \
counter of the
statistics channel was incorrectly increased. This has been fixed. [GL
#1793]
* Fix a bug in the static-stub implementation.
Static-stub addresses and addresses from other sources were being mixed
together, resulting in static-stub queries going to addresses not
specified in the configuration, or alternatively, static-stub addresses
being used instead of the correct server addresses. [GL #4850]
* Don't allow statistics-channels if libxml2 and libjson-c are not
configured.
When BIND 9 is not configured with the libxml2 and libjson-c libraries,
the use of the statistics-channels option is a fatal error. [GL #4895]
* Limit the outgoing UDP send queue size.
If the operating system UDP queue got full and the outgoing UDP sending
started to be delayed, BIND 9 could exhibit memory spikes as it tried to
enqueue all the outgoing UDP messages. It now tries to deliver the
outgoing UDP messages synchronously; if that fails, it drops the outgoing
DNS message that would get queued up and then timeout on the client side.
[GL #4930]
* Do not set SO_INCOMING_CPU.
Remove the SO_INCOMING_CPU setting as kernel scheduling performs better
without constraints. [GL #4936]
Known Issues
* There are no new known issues with this release. See above for a list of
all known issues affecting this BIND 9 branch.
|