bind9 bind 9.20.6

[Bruce Dubbs]

New point version.

[Bruce Dubbs]

BIND 9.20.6

New Features

• Adds support for EDE code 1 and 2.

Add support for EDE codes 1 & 2 which might occurs during DNSSEC validation in case of unsupported RRSIG algorithm or DNSKEY digest.

• Add a rndc command to toggle jemalloc profiling.

The new command is rndc memprof. The memory profiling status is also reported inside rndc status. The status also shows whether named can toggle memory profiling or not and if the server is built with jemalloc.

• Add support for multiple extended DNS errors.

Extended DNS error mechanism (EDE) may have several errors raised during a DNS resolution. named is now able to add up to three EDE codes in a DNS response. In the case of duplicate error codes, only the first one will be part of the DNS response.

• Print the expiration time of the stale records.

Print the expiration time of the stale RRsets in the cache dump.

Feature Changes

• Refactor reference counting in both QPDB and RBTDB.

Clean up the pattern in the newref() and decref() functions in QP and RBTDB databases. Replace the db_nodelock_t structure with plain reference counting for every active database node in QPDB.

• Shutdown the fetch context after canceling the last fetch.

Shutdown the fetch context immediately after the last fetch has been canceled from that particular fetch context.

Bug Fixes

• Fix possible truncation in dns_keymgr_status()

If the generated status output exceeds 4096 it was silently truncated, now we output that the status was truncated.

• Recently expired records could be returned with timestamp in future.

Under rare circumstances, the RRSet that expired at the time of the query could be returned with TTL far in the future. This has been fixed.

As a side-effect, the expiration time of expired RRSets are no longer printed out in the cache dump.

• Yaml string not terminated in negative response in delv.

• Fix a bug in dnssec-signzone related to keys being offline.

In the case when dnssec-signzone is called on an already signed zone, and the private key file is unavailable, a signature that needs to be refreshed may be dropped without being able to generate a replacement. This has been fixed.

• Apply the memory limit only to ADB database items.

Resolver under heavy-load could exhaust the memory available for storing the information in the Address Database (ADB) effectively evicting already stored information in the ADB. The memory used to retrieve and provide information from the ADB is now not a subject of the same memory limits that are applied for storing the information in the Address Database.

• Avoid unnecessary locking in the zone/cache database.

Prevent lock contention among many worker threads referring to the same database node at the same time. This would improve zone and cache database performance for the heavily contended database nodes.

• Fix EDE 22 time out detection.

Extended DNS error 22 (No reachable authority) was previously detected when fctx_expired fired. It turns out this function is used as a "safety net" and the timeout detection should be caught earlier.

It was working though, because of another issue fixed by !9927. But then, the recursive request timed out detection occurs before fctx_expired making impossible to raise the EDE 22 error.

This fixes the problem by triggering the EDE 22 in the part of the code detecting the (TCP or UDP) time out and taking the decision to cancel the whole fetch (i.e. There is no other server to attempt to contact).

Note this is not targeting users (no release note) because there is no release versions of BIND between !9927 and this changes. Thus a release note would be confusing.

• Split and simplify the use of EDE list implementation.

Instead of mixing the dns_resolver and dns_validator units directly with the EDE code, split-out the dns_ede functionality into own separate compilation unit and hide the implementation details behind abstraction.

Additionally, the new dns_edelist_t doesn't have to be copied into all responses as those are attached to the fetch context, but it could be only passed by reference.

This makes the dns_ede implementation simpler to use, although sligtly more complicated on the inside. :gl:#5141

• Fix the cache findzonecut() implementation.

The search for the deepest known zone cut in the cache could improperly reject a node if it contained any stale data, regardless of whether it was the NS RRset that was stale.

• DNSSEC EDE system tests on FIPS platform.

Changes introducing the support of extended DNS error code 1 and 2 uses SHA-1 digest for some tests which break FIPS platform. The digest itself was irrelevant, another digest is used. :gl:!10031

• Reduce the false sharing the dns_qpcache and dns_qpzone.

Instead of having many node_lock_count * sizeof(<member>) arrays, pack all the members into a qpcache_bucket_t that is cacheline aligned to prevent false sharing between RWLocks.

[Bruce Dubbs]

Fixed at commits

2d5be80cc5 Update to faac-1.31.
db10d461c5 Update to gi_docgen-2025.3 (Python module).
99edc7b299 Update to sphinx-8.2.1 (Python module).
ed97668fd9 Update to fltk-1.4.2.
e41f02790a Update to bind9 and bind-utilities-9.20.6.