mirror of
https://gitlab.isc.org/isc-projects/bind9
synced 2025-08-22 10:10:06 +00:00
Generate changelog for BIND 9.21.8
This commit is contained in:
Michał Kępień
parent
1665e05438
commit
3388084860
@ -18,6 +18,7 @@ Changelog
|
||||
development. Regular users should refer to :ref:`Release Notes <relnotes>`
|
||||
for changes relevant to them.
|
||||
|
||||
.. include:: ../changelog/changelog-9.21.8.rst
|
||||
.. include:: ../changelog/changelog-9.21.7.rst
|
||||
.. include:: ../changelog/changelog-9.21.6.rst
|
||||
.. include:: ../changelog/changelog-9.21.5.rst
|
||||
|
||||
170
doc/changelog/changelog-9.21.8.rst
Normal file
170
doc/changelog/changelog-9.21.8.rst
Normal file
@ -0,0 +1,170 @@
|
||||
.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
||||
..
|
||||
.. SPDX-License-Identifier: MPL-2.0
|
||||
..
|
||||
.. This Source Code Form is subject to the terms of the Mozilla Public
|
||||
.. License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
..
|
||||
.. See the COPYRIGHT file distributed with this work for additional
|
||||
.. information regarding copyright ownership.
|
||||
|
||||
BIND 9.21.8
|
||||
-----------
|
||||
|
||||
Security Fixes
|
||||
~~~~~~~~~~~~~~
|
||||
|
||||
- [CVE-2025-40775] Prevent assertion when processing TSIG algorithm.
|
||||
``1665e05438a``
|
||||
|
||||
DNS messages that included a Transaction Signature (TSIG) containing
|
||||
an invalid value in the algorithm field caused :iscman:`named` to
|
||||
crash with an assertion failure. This has been fixed.
|
||||
:cve:`2025-40775` :gl:`#5300`
|
||||
|
||||
New Features
|
||||
~~~~~~~~~~~~
|
||||
|
||||
- Implement tcp-primaries-timeout. ``2054186f408``
|
||||
|
||||
The new `tcp-primaries-timeout` configuration option works the same
|
||||
way as the older `tcp-initial-timeout` option, but applies only to the
|
||||
TCP connections made to the primary servers, so that the timeout value
|
||||
can be set separately for them. By default, it's set to 150, which is
|
||||
15 seconds. :gl:`#3649` :gl:`!9376`
|
||||
|
||||
Feature Changes
|
||||
~~~~~~~~~~~~~~~
|
||||
|
||||
- Use jinja2 templates in system tests. ``dfe755a5d6f``
|
||||
|
||||
`python-jinja2` is now required to run system tests. :gl:`#4938`
|
||||
:gl:`!9588`
|
||||
|
||||
- Reduce QPDB_VIRTUAL to 10 seconds. ``ed8421f405a``
|
||||
|
||||
The QPDB_VIRTUAL value was introduced to allow the clients (presumably
|
||||
ns_clients) that has been running for some time to access the cached
|
||||
data that was valid at the time of its inception. The default value
|
||||
of 5 minutes is way longer than longevity of the ns_client object as
|
||||
the resolver will give up after 2 minutes.
|
||||
|
||||
Reduce the value to 10 seconds to accomodate to honour the original
|
||||
more closely, but still allow some leeway for clients that started
|
||||
some time in the past.
|
||||
|
||||
Our measurements show that even setting this value to 0 has no
|
||||
statistically significant effect, thus the value of 10 seconds should
|
||||
be on the safe side. :gl:`!10309`
|
||||
|
||||
Bug Fixes
|
||||
~~~~~~~~~
|
||||
|
||||
- Fix EDNS yaml output. ``6285cc3476c``
|
||||
|
||||
`dig` was producing invalid YAML when displaying some EDNS options.
|
||||
This has been corrected.
|
||||
|
||||
Several other improvements have been made to the display of EDNS
|
||||
option data: - We now use the correct name for the UPDATE-LEASE
|
||||
option, which was previously displayed as "UL", and split it into
|
||||
separate LEASE and LEASE-KEY components in YAML mode. - Human-readable
|
||||
durations are now displayed as comments in YAML mode so as not to
|
||||
interfere with machine parsing. - KEY-TAG options are now displayed as
|
||||
an array of integers in YAML mode. - EDNS COOKIE options are displayed
|
||||
as separate CLIENT and SERVER components, and cookie STATUS is a
|
||||
retrievable variable in YAML mode. :gl:`#5014` :gl:`!9695`
|
||||
|
||||
- Return DNS COOKIE and NSID with BADVERS. ``79c50d45384``
|
||||
|
||||
This change allows the client to identify the server that returns the
|
||||
BADVERS and to provide a DNS SERVER COOKIE to be included in the
|
||||
resend of the request. :gl:`#5235` :gl:`!10334`
|
||||
|
||||
- Disable own memory context for libxml2 on macOS. ``6f3fea837f0``
|
||||
|
||||
Apple broke custom memory allocation functions in the system-wide
|
||||
libxml2 starting with macOS Sequoia 15.4. Usage of the custom memory
|
||||
allocation functions has been disabled on macOS. :gl:`#5268`
|
||||
:gl:`!10374`
|
||||
|
||||
- `check_private` failed to account for the length byte before the OID.
|
||||
``ecbae71fe9a``
|
||||
|
||||
In PRIVATEOID keys, the key data begins with a length byte followed
|
||||
by an ASN.1 object identifier that indicates the cryptographic
|
||||
algorithm to use. Previously, the length byte was not accounted for
|
||||
when checking the contents of keys and signatures, which could have
|
||||
led to interoperability problems with any zones signed using
|
||||
PRIVATEOID. This has been fixed. :gl:`#5270` :gl:`!10372`
|
||||
|
||||
- Fix a serve-stale issue with a delegated zone. ``58a0e6cc614``
|
||||
|
||||
When ``stale-answer-client-timeout 0`` option was enabled, it could be
|
||||
ignored when resolving a zone which is a delegation of an
|
||||
authoritative zone belonging to the resolver. This has been fixed.
|
||||
:gl:`#5275` :gl:`!10381`
|
||||
|
||||
- Move the call_rcu_thread explicit create and shutdown to isc_loop.
|
||||
``e373f4062fe``
|
||||
|
||||
When isc__thread_initialize() is called from a library constructor, it
|
||||
could be called before we fork the main process. This happens with
|
||||
named, and then we have the call_rcu_thread attached to the pre-fork
|
||||
process and not the post-fork process, which means that the initial
|
||||
process will never shutdown, because there's noone to tell it so.
|
||||
|
||||
Move the isc__thread_initialize() and isc__thread_shutdown() to the
|
||||
isc_loop unit where we call it before creating the extra thread and
|
||||
after joining all the extra threads respectively. :gl:`#5281`
|
||||
:gl:`!10394`
|
||||
|
||||
- Fix a date race in qpcache_addrdataset() ``47ccf613eb0``
|
||||
|
||||
The 'qpnode->nsec' structure member isn't protected by a lock and
|
||||
there's a data race between the reading and writing parts in the
|
||||
qpcache_addrdataset() function. Use a node read lock for accessing
|
||||
'qpnode->nsec' in qpcache_addrdataset(). Add an additional
|
||||
'qpnode->nsec != DNS_DB_NSEC_HAS_NSEC' check under a write lock to be
|
||||
sure that no other competing thread changed it in the time when the
|
||||
read lock is unlocked and a write lock is not acquired yet.
|
||||
:gl:`#5285` :gl:`!10397`
|
||||
|
||||
- Fix the ksr two-tone test. ``405f8a7bd85``
|
||||
|
||||
The two-tone ksr subtest (test_ksr_twotone) depended on the
|
||||
dnssec-policy keys algorithm values in named.conf being entered in
|
||||
numerical order. As the algorithms used in the test can be selected
|
||||
randomly this does not always happen. Sort the dnssec-policy keys by
|
||||
algorithm when adding them to the key list from named.conf.
|
||||
:gl:`#5286` :gl:`!10395`
|
||||
|
||||
- Return the correct NSEC3 records for NXDOMAIN responses.
|
||||
``1ec15358278``
|
||||
|
||||
The wrong NSEC3 records were sometimes returned as proof that the
|
||||
QNAME did not exist. This has been fixed. :gl:`#5292` :gl:`!10447`
|
||||
|
||||
- Call rcu_barrier earlier in the destructor. ``962b75dca46``
|
||||
|
||||
If a call_rcu thread is running, there is a possible race condition
|
||||
where the destructors run before all call_rcu callbacks have finished
|
||||
running. This can happen, for example, if the call_rcu callback tries
|
||||
to log something after the logging context has been torn down.
|
||||
|
||||
In !10394, we tried to counter this by explicitely creating a call_rcu
|
||||
thread an shutting it down before running the destructors, but it is
|
||||
possible for things to "slip" and end up on the default call_rcu
|
||||
thread.
|
||||
|
||||
As a quickfix, this commit moves an rcu_barrier() that was in the mem
|
||||
context destructor earlier, so that it "protects" all libisc
|
||||
destructors. :gl:`#5296` :gl:`!10423`
|
||||
|
||||
- Fix the error handling of put_yamlstr calls. ``fad97e3cd11``
|
||||
|
||||
The return value was sometimes being ignored when it shouldn't have
|
||||
been. :gl:`#5301` :gl:`!10432`
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user