mirror of
https://github.com/isc-projects/bind9.git
synced 2026-05-28 04:34:54 -04:00
98 lines
3.6 KiB
ReStructuredText
98 lines
3.6 KiB
ReStructuredText
.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
|
..
|
|
.. SPDX-License-Identifier: MPL-2.0
|
|
..
|
|
.. This Source Code Form is subject to the terms of the Mozilla Public
|
|
.. License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
|
..
|
|
.. See the COPYRIGHT file distributed with this work for additional
|
|
.. information regarding copyright ownership.
|
|
|
|
Notes for BIND 9.20.20
|
|
----------------------
|
|
|
|
Security Fixes
|
|
~~~~~~~~~~~~~~
|
|
|
|
- Fix a use-after-free error in ``dns_client_resolve()`` triggered by a
|
|
DNAME response.
|
|
|
|
This issue only affected the :iscman:`delv` tool and it has now been
|
|
fixed.
|
|
|
|
ISC would like to thank Vitaly Simonovich for bringing this
|
|
vulnerability to our attention. :gl:`#5728`
|
|
|
|
Feature Changes
|
|
~~~~~~~~~~~~~~~
|
|
|
|
- Record query time for all dnstap responses.
|
|
|
|
Not all DNS responses had the query time set in their corresponding
|
|
dnstap messages. This has been fixed. :gl:`#3695`
|
|
|
|
- Optimize TCP source port selection on Linux.
|
|
|
|
Enable the ``IP_LOCAL_PORT_RANGE`` socket option on the outgoing TCP
|
|
sockets to allow faster selection of the source <address,port> tuple
|
|
for different destination <address,port> tuples, when nearing over
|
|
70-80% of the source port utilization. :gl:`!11569`
|
|
|
|
Bug Fixes
|
|
~~~~~~~~~
|
|
|
|
- Fix an assertion failure triggered by non-minimal IXFRs.
|
|
|
|
Processing an IXFR that included an RRset whose contents were not
|
|
changed by the transfer triggered an assertion failure. This has been
|
|
fixed. :gl:`#5759`
|
|
|
|
- Fix a crash when retrying a NOTIFY over TCP.
|
|
|
|
Furthermore, do not attempt to retry over TCP at all if the source
|
|
address is not available. :gl:`#5457`
|
|
|
|
- Fetch loop detection improvements.
|
|
|
|
Fix a case where an in-domain nameserver with expired glue would fail
|
|
to resolve. :gl:`#5588`
|
|
|
|
- Randomize nameserver selection.
|
|
|
|
Since BIND 9.20.17, when selecting nameserver addresses to be looked
|
|
up, :iscman:`named` selected them in DNSSEC order from the start of
|
|
the NS RRset. This could lead to a resolution failure despite there
|
|
being an address that could be resolved using the other nameserver
|
|
names. :iscman:`named` now randomizes the order in which nameserver
|
|
addresses are looked up. :gl:`#5695` :gl:`#5745`
|
|
|
|
- Fix dnstap logging of forwarded queries. :gl:`#5724`
|
|
|
|
- A stale answer could have been served in case of multiple upstream
|
|
failures when following CNAME chains. This has been fixed. :gl:`#5751`
|
|
|
|
- Fail DNSKEY validation when supported but invalid DS is found.
|
|
|
|
A regression was introduced in BIND 9.20.6 when adding the EDE code
|
|
for unsupported DNSKEY and DS algorithms. When the parent had both
|
|
supported and unsupported algorithms in the DS record, the validator
|
|
would treat the supported DS algorithm as insecure instead of bogus
|
|
when validating DNSKEY records. This has no security impact, as the
|
|
rest of the child zone correctly ends with bogus status, but it is
|
|
incorrect and thus the regression has been fixed. :gl:`#5757`
|
|
|
|
- Importing an invalid SKR file might corrupt stack memory.
|
|
|
|
If an administrator imported an invalid SKR file, the local stack in
|
|
the import function might overflow. This could lead to a memory
|
|
corruption on the stack and ultimately a server crash. This has been
|
|
fixed. :gl:`#5758`
|
|
|
|
- Return FORMERR for queries with the EDNS Client Subnet FAMILY field
|
|
set to 0.
|
|
|
|
:rfc:`7871` only defines families 1 (IPv4) and 2 (IPv6), and requires
|
|
FORMERR to be returned for all unknown families. Queries with the EDNS
|
|
Client Subnet FAMILY field set to 0 now elicit responses with
|
|
RCODE=FORMERR. :gl:`!11565`
|