Log message:
net/bind918: update to 9.18.32

9.18.32 (2024-12-11)

New Features

* Update built-in bind.keys file with the new 2025 IANA root key.

* Add an initial-ds entry to bind.keys for the new root key, ID 38696, which
  is scheduled for publication in January 2025.  [GL #4896]

Removed Features

* Move contributed DLZ modules into a separate repository.  DLZ modules
  should not be used except in testing.

* The DLZ modules were not maintained, the DLZ interface itself is going to
  be scheduled for removal, and the DLZ interface is blocking.  Any module
  that blocks the query to the database blocks the whole server.

* The DLZ modules now live in
  https://gitlab.isc.org/isc-projects/dlz-modules repository.  [GL #4865]

Feature Changes

* Emit more helpful log messages for exceeding max-records-per-type.

* The new log message is emitted when adding or updating an RRset fails due
  to exceeding the max-records-per-type limit.  The log includes the owner
  name and type, corresponding zone name, and the limit value.  It will be
  emitted on loading a zone file, inbound zone transfer (both AXFR and
  IXFR), handling a DDNS update, or updating a cache DB.  It's especially
  helpful in the case of zone transfer, since the secondary side doesn't
  have direct access to the offending zone data.

* It could also be used for max-types-per-name, but this change doesn't
  implement it yet as it's much less likely to happen in practice.

* Harden key management when key files have become unavailable.

* Prior to doing key management, BIND 9 will check if the key files on disk
  match the expected keys.  If key files for previously observed keys have
  become unavailable, this will prevent the internal key manager from
  running.

Bug Fixes

* {&dns} is as valid as {?dns} in a SVCB's dohpath.

* dig failed to parse a valid SVCB record with a dohpath URI template
  containing a {&dns}, like \ 
"dohpath=/some/path?key=value{&dns}".  [GL
  #4922]

* Fix NSEC3 closest encloser lookup for names with empty non-terminals.

* A previous performance optimization for finding the NSEC3 closest encloser
  when generating authoritative responses could cause servers to return
  incorrect NSEC3 records in some cases.  This faulty optimization has been
  removed.  [GL #4950]

* dig options of the form [+-]option=<value> failed to display the value on
  the printed command line.  This has been fixed.  [GL #4993]

* Provide more visibility into TLS configuration errors by logging
  SSL_CTX_use_certificate_chain_file() and SSL_CTX_use_PrivateKey_file()
  errors individually.  [GL #5008]

Log message:
*: recursive bump for icu 76 shlib major version bump

Log message:
*: revbump for icu downgrade

Log message:
*: recursive bump for icu 76.1 shlib bump

Log message:
net/bind918: update to 9.18.31

9.18.31 (2024-10-16)

New Features

* Added WALLET type.

  Add the new record type WALLET (262).  This provides a mapping from a
  domain name to a cryptographic currency wallet.  Multiple mappings can
  exist if multiple records exist.  [GL #4947]

Feature Changes

* Allow IXFR-to-AXFR fallback on DNS_R_TOOMANYRECORDS.

  This change allows fallback from an IXFR failure to AXFR when the reason
  is DNS_R_TOOMANYRECORDS.  [GL #4928]

Bug Fixes

* Fix a statistics channel counter bug when "forward only" zones are used.

  When resolving a zone with a "forward only" policy, and finding out that
  all the forwarders were marked as "bad", the "ServerQuota" \ 
counter of the
  statistics channel was incorrectly increased.  This has been fixed.  [GL
  #1793]

* Fix a bug in the static-stub implementation.

  Static-stub addresses and addresses from other sources were being mixed
  together, resulting in static-stub queries going to addresses not
  specified in the configuration, or alternatively, static-stub addresses
  being used instead of the correct server addresses.  [GL #4850]

* Don't allow statistics-channels if libxml2 and libjson-c are not
  configured.

  When BIND 9 is not configured with the libxml2 and libjson-c libraries,
  the use of the statistics-channels option is a fatal error.  [GL #4895]

* Limit the outgoing UDP send queue size.

  If the operating system UDP queue got full and the outgoing UDP sending
  started to be delayed, BIND 9 could exhibit memory spikes as it tried to
  enqueue all the outgoing UDP messages.  It now tries to deliver the
  outgoing UDP messages synchronously; if that fails, it drops the outgoing
  DNS message that would get queued up and then timeout on the client side.
  [GL #4930]

* Do not set SO_INCOMING_CPU.

  Remove the SO_INCOMING_CPU setting as kernel scheduling performs better
  without constraints. [GL #4936]

Known Issues

* There are no new known issues with this release.  See above for a list of
  all known issues affecting this BIND 9 branch.

Log message:
*: recursive bump for protobuf 28.2

two static library became shared libraries - bump to be on the safe side

Log message:
net/bind918: update to 9.18.30

BIND 9.18.30 (2024-09-18)

New Features

* Print the full path of the working directory in startup log messages.

  named now prints its initial working directory during startup, and the
  changed working directory when loading or reloading its configuration
  file, if it has a valid directory option defined.  [GL #4731]

Feature Changes

* Follow the number of CPUs set by taskset/cpuset.

  Administrators may wish to constrain the set of cores that named runs on
  via the taskset, cpuset, or numactl programs (or equivalents on other
  OSes).

  If the admin has used taskset, named now automatically uses the given
  number of CPUs rather than the system-wide count. [GL #4884]

Bug Fixes

* Verification of the privacy of an EDDSA key was broken.

  The check could lead to an attempt to sign records with a public key,
  which could cause a segmentation failure (read of a NULL pointer) within
  OpenSSL.  This has been fixed. [GL #4855]

* Fix algorithm rollover bug when there are two keys with the same keytag.

  If there was an algorithm rollover and two keys of different algorithms
  shared the same keytags, there was the possibility that the check of
  whether the key matched a specific state could be performed against the
  wrong key.  This has been fixed by not only checking for the matching key
  tag but also the key algorithm.  [GL #4878]

Known Issues

* There are no new known issues with this release. See above for a list of
  all known issues affecting this BIND 9 branch.

Log message:
net/bind: update to version 9.18.29.

Pkgsrc changes:
 * None (just version + checksums)

Upstream changes:

BIND 9.18.29
------------

New Features
~~~~~~~~~~~~

- Tighten 'max-recursion-queries' and add 'max-query-restarts' option.
  ``fe3ae71e90``

  There were cases in resolver.c when the `max-recursion-queries` quota
  was ineffective. It was possible to craft zones that would cause a
  resolver to waste resources by sending excessive queries while
  attempting to resolve a name. This has been addressed by correcting
  errors in the implementation of `max-recursion-queries`, and by
  reducing the default value from 100 to 32.

  In addition, a new `max-query-restarts` option has been added which
  limits the number of times a recursive server will follow CNAME or
  DNAME records before terminating resolution. This was previously a
  hard-coded limit of 16, and now defaults to 11.   :gl:`#4741`
  :gl:`!9283`

- Generate changelog from git log. ``21a0b6aef7``

  Use a single source of truth, the git log, to generate the list of
  CHANGES. Use the .rst format and include it in the ARM for a quick
  reference with proper gitlab links to issues and merge requests.
  :gl:`#75` :gl:`!9181`

Feature Changes
~~~~~~~~~~~~~~~

- Use _exit() in the fatal() function. ``e4c483f45f``

  Since the fatal() isn't a correct but rather abrupt termination of the
  program, we want to skip the various atexit() calls because not all
  memory might be freed during fatal() call, etc.  Using _exit() instead
  of exit() has this effect - the program will end, but no destructors
  or atexit routines will be called. :gl:`!9263`

- Fix data race in clean_finds_at_name. ``541726871d``

  Stop updating `find.result_v4` and `find.result_v4` in
  `clean_finds_at_name`. The values are supposed to be
  static. :gl:`#4118` :gl:`!9198`

Bug Fixes
~~~~~~~~~

- Reconfigure catz member zones during named reconfiguration.
  ``944d0dc942``

  During a reconfiguration named wasn't reconfiguring catalog zones'
  member zones. This has been fixed. :gl:`#4733`

- Disassociate the SSL object from the cached SSL_SESSION.
  ``64fde41253``

  When the SSL object was destroyed, it would invalidate all SSL_SESSION
  objects including the cached, but not yet used, TLS session objects.

  Properly disassociate the SSL object from the SSL_SESSION before we
  store it in the TLS session cache, so we can later destroy it without
  invalidating the cached TLS sessions. :gl:`#4834` :gl:`!9279`

- Attach/detach to the listening child socket when accepting TLS.
  ``3ead47daff``

  When TLS connection (TLSstream) connection was accepted, the children
  listening socket was not attached to sock->server and thus it could
  have been freed before all the accepted connections were actually
  closed.

  In turn, this would cause us to call isc_tls_free() too soon - causing
  cascade errors in pending SSL_read_ex() in the accepted connections.

  Properly attach and detach the children listening socket when
  accepting and closing the server connections. :gl:`#4833` :gl:`!9278`

- Make hypothesis optional for system tests. ``0d1953d7a8``

  Ensure that system tests can be executed without Python hypothesis
  package. :gl:`#4831` :gl:`!9268`

- Don't loop indefinitely when isc_task quantum is 'unlimited'
  ``674420df64``

  Don't run more events than already scheduled.  If the quantum is set
  to a high value, the task_run() would execute already scheduled, and
  all new events that result from running event->ev_action().

  Setting quantum to a number of scheduled events will postpone events
  scheduled after we enter the loop here to the next task_run()
  invocation. :gl:`!9257`

- Raise the log level of priming failures. ``c948babeeb``

  When a priming query is complete, it's currently logged at level
  ISC_LOG_DEBUG(1), regardless of success or failure. We are now raising
  it to ISC_LOG_NOTICE in the case of failure. [GL #3516] :gl:`#3516`
  :gl:`!9251`

- Add a compatibility shim for older libuv versions (< 1.19.0)
  ``61ff983f00``

  The uv_stream_get_write_queue_size() is supported only in relatively
  newer versions of libuv (1.19.0 or higher).  Provide a compatibility
  shim for this function , so BIND 9 can be built in environments with
  older libuv version.

- Remove extra newline from yaml output. ``1222dbe9f9``

  I split this into two commits, one for the actual newline removal, and
  one for issues I found, ruining the yaml output when some errors were
  outputted.

- CID 498025 and CID 498031: Overflowed constant INTEGER_OVERFLOW.
  ``bbdd888b8e``

  Add INSIST to fail if the multiplication would cause the variables to
  overflow. :gl:`#4798` :gl:`!9230`

- Remove unnecessary operations. ``2374a1a2bd``

  Decrementing optlen immediately before calling continue is unneccesary
  and inconsistent with the rest of dns_message_pseudosectiontoyaml and
  dns_message_pseudosectiontotext.  Coverity was also reporting an
  impossible false positive overflow of optlen (CID 499061). :gl:`!9224`

- Fix generation of 6to4-self name expansion from IPv4 address.
  ``df55c15ebb``

  The period between the most significant nibble of the encoded IPv4
  address and the 2.0.0.2.IP6.ARPA suffix was missing resulting in the
  wrong name being checked. Add system test for 6to4-self
  implementation. :gl:`#4766` :gl:`!9218`

- Fix false QNAME minimisation error being reported. ``4984afc80c``

  Remove the false positive "success resolving" log message when QNAME
  minimisation is in effect and the final result is NXDOMAIN.
  :gl:`#4784` :gl:`!9216`

- Dig +yaml was producing unexpected and/or invalid YAML output.
  ``2db62a4dba``

  :gl:`#4796` :gl:`!9214`

- SVBC alpn text parsing failed to reject zero length alpn.
  ``8f7be89052``

  :gl:`#4775` :gl:`!9210`

- Return SERVFAIL for a too long CNAME chain. ``f7de909b98``

  When cutting a long CNAME chain, named was returning NOERROR  instead
  of SERVFAIL (alongside with a partial answer). This has been fixed.
  :gl:`#4449` :gl:`!9204`

- Properly calculate the amount of system memory. ``9faf355a5c``

  On 32 bit machines isc_meminfo_totalphys could return an incorrect
  value. :gl:`#4799` :gl:`!9200`

- Update key lifetime and metadata after dnssec-policy reconfig.
  ``2107a64ee6``

  Adjust key state and timing metadata if dnssec-policy key lifetime
  configuration is updated, so that it also affects existing keys.
  :gl:`#4677` :gl:`!9192`

- Fix dig +timeout argument when using +https. ``381d6246d6``

  The +timeout argument was not used on DoH connections. This has been
  fixed.  :gl:`#4806` :gl:`!9161`

Log message:
bind918: dont accidentally find sphinx

Log message:
net/bind918: update to 9.18.28

9.18.28 (2024-07-23)

6404.	[security]	Remove SIG(0) support from named as a countermeasure
			for CVE-2024-1975. [GL #4480]

6403.	[security]	qctx-zversion was not being cleared when it should have
			been leading to an assertion failure if it needed to be
			reused. (CVE-2024-4076) [GL #4507]

6401.	[security]	An excessively large number of rrtypes per owner can
			slow down database query processing, so a limit has been
			placed on the number of rrtypes that can be stored per
			owner (node) in a cache or zone database. This is
			configured with the new "max-rrtypes-per-name" option,
			and defaults to 100. (CVE-2024-1737)
			[GL #3403] [GL #4548]

6400.	[security]	Excessively large rdatasets can slow down database
			query processing, so a limit has been placed on the
			number of records that can be stored per rdataset
			in a cache or zone database. This is configured
			with the new "max-records-per-type" option, and
			defaults to 100. (CVE-2024-1737)
			[GL #497] [GL #3405]

6399.	[security]	Malicious DNS client that sends many queries over
			TCP but never reads responses can cause server to
			respond slowly or not respond at all for other
			clients. (CVE-2024-0760) [GL #4481]

6398.	[bug]		Fix potential data races in our DoH implementation
			related to HTTP/2 session object management and
			endpoints set object management after reconfiguration.
			We would like to thank Dzintars and Ivo from nic.lv
			for bringing this to our attention. [GL #4473]

6397.	[bug]		Clear DNS_FETCHOPT_TRYSTALE_ONTIMEOUT when looking for
			parent NS records needed to get the DS result.
			[GL #4661]

6395.	[bug]		Handle ISC_R_HOSTDOWN and ISC_R_NETDOWN in resolver.c.
			[GL #4736]

6394.	[bug]		Named's -4 and -6 options now apply to zone primaries,
			also-notify and parental-agents.  Report when a zone
			has these options configured but does not have an IPv4
			or IPv6 address listed respectively. [GL #3472]

6393.	[func]		Deal with uv_tcp_close_reset() error return codes
			more gracefully. [GL #4708]

6392.	[bug]		Use a completely new memory context when flushing the
			cache. [GL #2744]

6391.	[bug]		TCP client statistics could sometimes fail to decrease
			when accepting client connection fails. [GL #4742]

6390.	[bug]		Fix a data race in isc_task_purgeevent(). [GL !8937]

6389.	[bug]		dnssec-verify and dnssec-signzone could fail if there
			was an obscured DNSKEY RRset at a delegatation.
			[GL #4517]

6388.	[bug]		Prevent an assertion failure caused by passing NULL to
			dns_dispatch_resume() when a dns_request times out close
			to view shutdown. [GL #4719]

6386.	[bug]		When shutting down catzs->view could point to freed
			memory. Obtain a reference to the view to prevent this.
			[GL #4502]

6385.	[func]		Relax SVCB alias mode checks to allow parameters.
			[GL #4704]

6384.	[bug]		Remove infinite loop when including a directory in a
			zone file. [GL #4357]

6383.	[bug]		Address an infinite loop in $GENERATE when a negative
			value was converted in nibble mode. [GL #4353]

6382.	[bug]		Fix RPZ response's SOA record TTL, which was incorrectly
			set to 1 if 'add-soa' is used. [GL #3323]