.. Copyright (C) Internet Systems Consortium, Inc. ("ISC") .. .. SPDX-License-Identifier: MPL-2.0 .. .. This Source Code Form is subject to the terms of the Mozilla Public .. License, v. 2.0. If a copy of the MPL was not distributed with this .. file, you can obtain one at https://mozilla.org/MPL/2.0/. .. .. See the COPYRIGHT file distributed with this work for additional .. information regarding copyright ownership. BIND 9.20.27 ------------ New Features ~~~~~~~~~~~~ - Disclose active Negative Trust Anchors with Extended DNS Error 33. ``566e7018278`` A Negative Trust Anchor (RFC 7646) turns off DNSSEC validation for a domain, so a name that would normally fail validation resolves instead. named now marks such answers with Extended DNS Error code 33, "Negative Trust Anchor", so operators can see at a glance when a response came back only because an NTA was in effect. :gl:`#6268` :gl:`!12426` - Add development guidance for AI coding agents under .agents/skills/ ``ef651c93709`` This adds a set of skill documents that give AI coding agents the project's established practices up front instead of having them rediscovered (or gotten wrong) in every session: the canonical build and test invocations, the memory-allocator contract, the disciplines for RCU mutation, per-loop sharded structures, struct-layout work, and flight-recorder debugging of concurrency bugs, plus the commit and merge-request conventions. :gl:`!12401` - Add more unit tests for isc_time API. ``9d6855ef735`` While working on internal 64-bit time for BIND 9, the unit test suite for isc_time API has been extended. Backport the unit tests from 64-bit time branch to the main branch. This should make the unit tests for isc_time API (mostly) complete. Related to #2959 :gl:`!12432` Feature Changes ~~~~~~~~~~~~~~~ - Batch qp transaction for RPZ updates. ``cb40fb91fa2`` RPZ was built around fine-grained locking, but that forces the use of many small qp transactions. With this MR, we switch qp transaction to handle the full update to the rpz summary structure. While this serializes the RPZ updates, the reduced overhead from batching qp transactions more than compensates for it and results in improvements for big RPZ zones. :gl:`#5787`, #6270 :gl:`!12493` - Pass the work callback result to the done callback. ``65cdb7c7613`` The `isc_work` callback now returns `isc_result_t` and the value is handed to the done callback, so the callers no longer need their own result-passing state. :gl:`!12391` Bug Fixes ~~~~~~~~~ - Dig +yaml producing invalid YAML when a lookup fails. ``65d1776959e`` When "dig +yaml" was run and no server could be reached, dig printed its plain-text startup banner (the "; \<\<\>\> DiG ..." and ";; global options" lines) ahead of the machine-readable output, so the result was not valid YAML and could not be parsed. dig no longer emits that banner in YAML mode. As part of the same change, the banner is now built only after the whole command line has been read, so options given after the query name (such as +nocmd, +short and +yaml) are correctly reflected in it. :gl:`#1230` :gl:`!12430` - Ensure NSEC authority does not cross zonecut boundary. ``0baaddd096a`` When using a cached NSEC record to prove that a delegation is insecure, we now check that the signer name in the corresponding RRSIG is not above a known secure delegation point. This prevents a signed namespace from being downgraded to insecure using an NSEC record from the grandparent zone. :gl:`#5967` :gl:`!12394` - Treat non canonical RPZ prefixes as any other failure. ``17f0828b460`` RPZ prefixes that were not encoded in canonical form do not work. Treat them as any other encoding error. :gl:`#6043` :gl:`!12482` - Properly prevent TSIG generation command line injection attacks. ``f777451d261`` When key names are generated with `rndc-confgen`, `tsig-keygen` and `ddns-confgen`, special characters must be escaped to ensure the configuration is parsed correctly. :gl:`#6071` :gl:`!12396` - Dig with IDN output could leak memory on ISC_R_NOSPACE retry. ``c4e53b59b2e`` The IDN to text display call back could leak the memory holding the converted name if it did not fit into the buffer. This has been fixed. :gl:`#6073` :gl:`!12483` - Dnssec-signzone had a potential heap bounds overflow write. ``994c3bd4323`` It was possible for `dnssec-signzone` to overflow array bounds while signing. This has been fixed. :gl:`#6076` :gl:`!12503` - Restore SMF support on Solaris and illumos. ``8bde9318f63`` SMF support on Solaris and illumos was silently dropped by a build system rewrite in 2018; it is now detected and enabled again. :gl:`#6096` :gl:`!12456` - Fix NULL pointer dereference in dnstap-read. ``9c459b1854d`` It was possible to dereference a NULL pointer in dnstap-read causing it to exit on a malformed DNSTAP file. This has been fixed. :gl:`#6124` :gl:`!12494` - Change catz coo locking. ``78265c8f6fc`` Catalog zones might need to inspect the change-of-ownership records of other catalog zones, which required to release the lock in the middle of certain operations, leading to possible race conditions. Since the operations on change-of-ownership records are limited, we can instead use a design with a second lock protecting the change-of-ownership records on read. We structure the API so that holding two change-of-ownership locks at the same time is impossible. :gl:`#6131` :gl:`!12410` - Treat an unusable NSEC3 chain as a verification failure. ``879a383ef16`` When transferring in a mirror zone, DNSSEC verification could incorrectly succeed when the zone had an invalid `NSEC3PARAM` record, leading to subsequent validation failures. This has been fixed. :gl:`#6136` :gl:`!12431` - Unterminated OpenSSL private-key `Label:` field can be read past its parser buffer. ``932581b74bd`` Check that the string encoded in the Label: field of the .private file of a key pair is NUL terminated and the correct length. Reject the .private file if it is not. :gl:`#6193` :gl:`!12417` - Negative caching stopped working with stale-answer-client-timeout 0. ``2687d16ed2f`` With "stale-answer-client-timeout 0" configured, every client query for a name cached as NXDOMAIN or NODATA was sent on to the authoritative servers, even while the cached negative answer was still within its TTL, so the resolver effectively lost negative caching. Negative answers are now refreshed only once they have actually gone stale. :gl:`#6245` :gl:`!12384` - MacOS byte swapping macros already defined. ``5c1d3df49c0`` Don't redefine them if the development environment already defines them. :gl:`#6250` :gl:`!12406` - Use memmove in isc_sockaddr_fromin/isc_sockaddr_fromin6. ``3f3c82292c9`` Use memmove instead of direct assignment from the source pointer because the source pointer is not guaranteed to be correctly aligned. :gl:`#6260` :gl:`!12449` - Fix compilation on GNU/Hurd. ``20f5580e017`` Fix compilation issues on GNU/Hurd. :gl:`#6285` :gl:`!12496` - Restore arc4random() detection dropped in the v9.21.14 merge. ``86ad6866eeb`` Commit 4db9e5d90e2 ("Use arc4random for CSPRNG when available", part of the CVE-2025-40780 fix) guarded the arc4random() code paths in lib/isc/random.h and lib/isc/random.c with HAVE_ARC4RANDOM and added the corresponding function check to meson.build. The manual conflict resolution in merge c2a672bbaef ("Merge tag 'v9.21.14'") kept the code changes but dropped the meson.build hunk, so HAVE_ARC4RANDOM was never defined and platforms with arc4random() (macOS and the BSDs) silently fell back to the internal ChaCha-based CSPRNG. Restore the check. Assisted-by: Claude:claude-fable-5 :gl:`!12452`