bind-9.20.11-160000.2.2

- Upgrade to release 9.20.11
  Security Fixes:
  * Fix a possible assertion failure when
    stale-answer-client-timeout is set to 0. In specific
    circumstances the named resolver process could exit with an
    assertion failure when stale answers were enabled and the
    stale-answer-client-timeout configuration option was set to 0.
    (CVE-2025-40777)
    [bsc#1246548]
  New Features:
  * Add support for the CO flag to dig.
  Bug Fixes:
  * Correct the default interface-interval from 60s to 60m.
  * Fix a purge-keys bug when using multiple views of a zone.
  * Use IPv6 queries in delv +ns.

- Upgrade to release 9.20.10
  New Features:
  * Implement a new notify-defer configuration option. This new
    option sets a delay (in seconds) to wait before sending a set
    of NOTIFY messages for a zone. Whenever a NOTIFY message is
    ready to be sent, sending is deferred for this duration. This
    option should not be confused with the notify-delay option. The
    default is 0 seconds.
  Removed Features:
  * Implement the systemd notification protocol manually to remove
    dependency on libsystemd.
  Bug Fixes:
  * A secondary zone could initiate a new zone transfer from the
    primary server after it had been already deleted from the
    secondary server, and before the internal garbage collection
    was activated to clean it up completely. This has been fixed.
  * A secondary zone could fail to further refresh with new
    versions of the zone from a primary server if named was
    reconfigured during the SOA request step of an ongoing zone
    transfer. This has been fixed.
- Clean up systemd BuildRequires

- Upgrade to release 9.20.9
  Security Fixes:
  * Prevent an assertion failure when processing TSIG algorithm.
    (CVE-2025-40775)
    [bsc#1243361]
  Feature Changes:
  * Return DNS COOKIE and NSID with BADVERS.
  * Disable separate memory context for libxml2 memory allocations
    on macOS.
  * Use Jinja2 templates in system tests.
  Bug Fixes:
  * Revert NSEC3 closest encloser lookup improvements.
  * Fix EDNS YAML output in dig.
  * Fix RDATA checks for PRIVATEOID keys.
  * Fix a serve-stale issue with a delegated zone.

- Upgrade to release 9.20.8
  New Features:
  * Add support for EDE 20 (Not Authoritative)
  * Add support for EDE 7 and EDE 8.
  * `dig` can now display the received BADVERS message during
    negotiation.
  * Add an `rndc` command to reset some statistics counters.
  Bug Fixes:
  * Restore NSEC3 closest-encloser lookup improvements.
  * Stop caching lack of EDNS support.
  * Fix resolver statistics counters for timed-out responses.
  * Nested DNS validation could cause an assertion failure.
  * Wait for memory reclamation to finish in `named-checkconf`.
  * Ensure `max-clients-per-query` is at least `clients-per-query`.
  * Fix write after free in validator code.
  * Don't enforce NOAUTH/NOCONF flags in DNSKEYs.
  * Fix several small DNSSEC timing issues.
  * Fix inconsistency in CNAME/DNAME handling during resolution.

- Upgrade to release 9.20.7
  New Features:
  * Implement the min-transfer-rate-in configuration option.
    A new option min-transfer-rate-in has been added to the view
    and zone configurations. It can abort incoming zone transfers
    that run very slowly due to network-related issues, for
    example. The default value is 10240 bytes in five minutes. [GL
    [#3914]]
  * Add HTTPS record query to host command line tool.
    The host command was extended to also query for the HTTPS RR
    type by default.
  * Implement sig0key-checks-limit and sig0message-checks-limit.
    Previously, a hard-coded limitation of a maximum of two key or
    message verification checks was introduced when checking a
    message’s SIG(0) signature, to protect against possible DoS
    attacks. Two as a maximum was chosen so that more than a single
    key should only be required during key rotations, and in that
    case two keys are enough. It later became apparent that there
    are other use cases where even more keys are required; see the
    related GitLab issue for examples.
    This change introduces two new configuration options for the
    views: sig0key-checks-limit and sig0message-checks-limit. They
    define how many keys can be checked to find a matching key, and
    how many message verifications are allowed to take place once a
    matching key has been found. The former provides slightly less
    “expensive” key parsing operations and defaults to 16. The
    latter protects against expensive cryptographic operations when
    there are keys with colliding tags and algorithm numbers; the
    default is 2. [GL #5050]
  * Adds support for EDE code 1 and 2.
    Support was added for EDE codes 1 and 2, which might occur
    during DNSSEC validation in the case of an unsupported RRSIG
    algorithm or DNSKEY digest. [GL #2715]
  * Add an rndc command to toggle jemalloc profiling.
    The new command is rndc memprof; the memory profiling status is
    also reported inside rndc status. The status shows whether
    named can toggle memory profiling, and whether the server is
    built with jemalloc. [GL #4759]
  * Add support for multiple extended DNS errors.
    The Extended DNS Error (EDE) mechanism may raise errors during
    a DNS resolution. named is now able to add up to three EDE
    codes in a DNS response. If there are duplicate error codes,
    only the first one is part of the DNS response. [GL #5085]
  * Print the expiration time of stale records.
    BIND now prints the expiration time of any stale RRsets in the
    cache dump.
  Bug Fixes:
  * Fix dual-stack-servers configuration option.
    The dual-stack-servers configuration option was not working as
    expected; the specified servers were not being used when they
    should have been, leading to resolution failures. This has been
    fixed. [GL #5019]
  * Fix a data race causing a permanent active client increase.
    Previously, a data race could cause a newly created fetch
    context for a new client to be used before it had been fully
    initialized, which would cause the query to become stuck;
    queries for the same data would be either paused indefinitely
    or dropped because of the clients-per-query limit. This has
    been fixed. [GL #5053]
  * Fix deferred validation of unsigned DS and DNSKEY records.
    When processing a query with the “checking disabled” bit set
    (CD=1), named stores the invalidated result in the cache,
    marked “pending”. When the same query is sent with CD=0, the
    cached data is validated and either accepted as an answer, or
    ejected from the cache as invalid. This deferred validation was
    not attempted for DS and DNSKEY records if they had no cached
    signatures, causing spurious validation failures. The deferred
    validation is now completed in this scenario.
    Also, if deferred validation fails, the data is now re-queried
    to find out whether the zone has been corrected since the
    invalid data was cached. [GL #5066]
  * Fix RPZ race condition during a reconfiguration.
    With RPZ in use, named could terminate unexpectedly because of
    a race condition when a reconfiguration command was received
    using rndc. This has been fixed. [GL #5146]
  * “CNAME and other data check” not applied to all types.
    An incorrect optimization caused “CNAME and other data” errors
    not to be detected if certain types were at the same node as a
    CNAME. This has been fixed. [GL #5150]
  * Relax private DNSKEY and RRSIG constraints.
    DNSKEY, KEY, RRSIG, and SIG constraints have been relaxed to
    allow empty key and signature material after the algorithm
    identifier for PRIVATEOID and PRIVATEDNS. It is arguable
    whether this falls within the expected use of these types, as
    no key material is shared and the signatures are ineffective,
    but these are private algorithms and they can be totally
    insecure. [GL #5167]
  * Remove NSEC/DS/NSEC3 RRSIG check from dns_message_parse().
    Previously, when parsing responses, named incorrectly rejected
    responses without matching RRSIG records for NSEC/DS/NSEC3
    records in the authority section. This rejection, if
    appropriate, should have been left for the validator to
    determine and has been fixed. [GL #5185]
  * Fix TTL issue with ANY queries processed through RPZ
    “passthru”.
    Answers to an “ANY” query which were processed by the RPZ
    “passthru” policy had the response-policy’s max-policy-ttl
    value unexpectedly applied. This has been fixed. [GL #5187]
  * dnssec-signzone needs to check for a NULL key when setting
    offline.
    dnssec-signzone could dereference a NULL key pointer when
    resigning a zone. This has been fixed. [GL #5192]
  * Fix a bug in the statistics channel when querying zone transfer
    information.
    When querying zone transfer information from the statistics
    channel, there was a rare possibility that named could
    terminate unexpectedly if a zone transfer was in a state when
    transferring from all the available primary servers had failed
    earlier. This has been fixed. [GL #5198]
  * Fix assertion failure when dumping recursing clients.
    Previously, if a new counter was added to the hash table while
    dumping recursing clients via the rndc recursing command, and
    fetches-per-zone was enabled, an assertion failure could occur.
    This has been fixed. [GL #5200]
  * Dump the active resolver fetches from
    dns_resolver_dumpfetches()
    Previously, active resolver fetches were only dumped when the
    fetches-per-zone configuration option was enabled. Now, active
    resolver fetches are dumped along with the number of
    clients-per-query counters per resolver fetch.
  * Recently expired records could be returned with a timestamp in
    future.
    Under rare circumstances, an RRSet that expired at the time of
    the query could be returned with a TTL in the future. This has
    been fixed.
    As a side effect, the expiration time of expired RRSets is no
    longer returned in a cache dump. [GL #5094]
  * YAML string not terminated in negative response in delv.
  * Fix a bug in dnssec-signzone related to keys being offline.
    When dnssec-signzone was called on an already-signed zone and
    the private key file was unavailable, a signature that needed
    to be refreshed was dropped without being able to generate a
    replacement. This has been fixed. [GL #5126]
  * Apply the memory limit only to ADB database items.
    Under heavy load, a resolver could exhaust the memory available
    for storing the information in the Address Database (ADB),
    effectively discarding previously stored information in the
    ADB. The memory used to retrieve and provide information from
    the ADB is no longer subject to the same memory limits that are
    applied to the Address Database. [GL #5127]
  * Avoid unnecessary locking in the zone/cache database.
    Lock contention among many worker threads referring to the same
    database node at the same time is now prevented. This improves
    zone and cache database performance for any heavily contended
    database nodes. [GL #5130]
  * Fix reporting of Extended DNS Error 22 (No Reachable
    Authority).
    This error code was previously not reported in some applicable
    situations. This has been fixed. [GL #5137]

- Upgrade to release 9.20.5
  Security Fixes:
  * DNS-over-HTTPS flooding fixes.
    Fix DNS-over-HTTPS implementation issues that arise under heavy
    query load. Optimize resource usage for named instances that
    accept queries over DNS-over-HTTPS.
    Previously, named processed all incoming HTTP/2 data at once,
    which could overwhelm the server, especially when dealing with
    clients that sent requests but did not wait for responses. That
    has been fixed. Now, named handles HTTP/2 data in smaller
    chunks and throttles reading until the remote side reads the
    response data. It also throttles clients that send too many
    requests at once.
    In addition, named now evaluates excessive streams opened by
    clients that include no DNS data, which is considered
    “flooding.” It logs these clients and drops connections from
    them.
    In some cases, named could leave DNS-over-HTTPS connections in
    the CLOSE_WAIT state indefinitely. That has also been fixed.
    (CVE-2024-12705)
    [bsc#1236597]
  * Limit additional section processing for large RDATA sets.
    When answering queries, don’t add data to the additional
    section if the answer has more than 13 names in the RDATA. This
    limits the number of lookups into the database(s) during a
    single client query, reducing the query-processing load.
    (CVE-2024-11187)
    [bsc#1236596]
  New Features:
  * Add Extended DNS Error Code 22 - No Reachable Authority.
    When the resolver is trying to query an authoritative server
    and eventually times out, a SERVFAIL answer is given to the
    client. Add the Extended DNS Error Code 22 - No Reachable
    Authority to the response.
  * Add a new option to configure the maximum number of outgoing
    queries per client request.
    The configuration option max-query-count sets how many outgoing
    queries per client request are allowed. The existing
    max-recursion-queries value is the number of permissible
    queries for a single name and is reset on every CNAME
    redirection. This new option is a global limit on the client
    request. The default is 200.
    The default for max-recursion-queries is changed from 32 to 50.
    This allows named to send a few more queries while looking up a
    single name.
  * Use the Server Name Indication (SNI) extension for all outgoing
    TLS connections.
    This improves compatibility with other DNS server software.
  Feature Changes:
  * Performance optimization for NSEC3 lookups introduced in BIND
    9.20.2 was reverted to avoid risks associated with a complex
    code change.
  * The configuration clauses parental-agents and primaries are
    renamed to remote-servers.
    The top blocks primaries and parental-agents are no longer
    preferred and should be renamed to remote-servers. The zone
    statements parental-agents and primaries are still used, and
    may refer to any remote-servers top block.
  * Add none parameter to query-source and query-source-v6 to
    disable IPv4 or IPv6 upstream queries but allow listening to
    queries from clients on IPv4 or IPv6.
  Bug Fixes:
  * Fix nsupdate hang when processing a large update.
    To mitigate DNS flood attacks over a single TCP connection,
    throttle the connection when the other side does not read the
    data. Throttling should only occur on server-side sockets, but
    erroneously also happened for nsupdate, which acts as a client.
    When nsupdate started throttling the connection, it never
    attempted to read again. This has been fixed.
  * Fix possible assertion failure when reloading server while
    processing update policy rules.
  * Preserve cache across reconfig when using attach-cache.
    When the attach-cache option is used in the options block with
    an arbitrary name, it causes all views to use the same cache.
    Previously, this configuration caused the cache to be deleted
    and a new cache to be created every time the server was
    reconfigured. This has been fixed.
  * Resolve the spurious drops in performance due to glue cache.
    For performance reasons, the returned glue records are cached
    on the first use. The current implementation could randomly
    cause a performance drop and increased memory use. This has
    been fixed.
  * Fix dnssec-signzone signing non-DNSKEY RRsets with revoked
    keys.
    dnssec-signzone was using revoked keys for signing RRsets other
    than DNSKEY. This has been corrected.
  * Fix improper handling of unknown directives in resolv.conf.
    The line after an unknown directive in resolv.conf could
    accidentally be skipped, potentially affecting dig, host,
    nslookup, nsupdate, or delv. This has been fixed.
  * Fix response policy zones and catalog zones with an $INCLUDE
    statement defined.
    Response policy zones (RPZ) and catalog zones were not working
    correctly if they had an $INCLUDE statement defined. This has
    been fixed
- Remove desktop file and BuildRequires: update-desktop-files

- Explicitly BuildRequire sphinx_rtd_theme.

- Add new dlz-modules source
- Update to release 9.20.4
  New Features:
  * Update built-in bind.keys file with the new 2025 IANA root key.
  * Add an initial-ds entry to bind.keys for the new root key, ID
    38696, which is scheduled for publication in January 2025.
  Removed Features:
  * Move contributed DLZ modules into a separate repository. DLZ
    modules should not be used except in testing.
  * The DLZ modules were not maintained, the DLZ interface itself
    is going to be scheduled for removal, and the DLZ interface is
    blocking. Any module that blocks the query to the database
    blocks the whole server.
  * The DLZ modules now live in
    https://gitlab.isc.org/isc-projects/dlz-modules repository.
  Feature Changes:
  * dnssec-ksr now supports KSK rollovers.
  * The tool now allows for KSK generation, as well as planned KSK
    rollovers. When signing a bundle from a Key Signing Request
    (KSR), only the key that is active in that time frame is used
    for signing. Also, the CDS and CDNSKEY records are now added
    and removed at the correct time.
  * Print RFC 7314: EXPIRE option in transfer summary.
  * Emit more helpful log messages for exceeding
    max-records-per-type.
  * The new log message is emitted when adding or updating an RRset
    fails due to exceeding the max-records-per-type limit. The log
    includes the owner name and type, corresponding zone name, and
    the limit value. It will be emitted on loading a zone file,
    inbound zone transfer (both AXFR and IXFR), handling a DDNS
    update, or updating a cache DB. It’s especially helpful in the
    case of zone transfer, since the secondary side doesn’t have
    direct access to the offending zone data.
  * It could also be used for max-types-per-name, but this change
    doesn’t implement it yet as it’s much less likely to happen in
    practice.
  * Harden key management when key files have become unavailable.
  * Prior to doing key management, BIND 9 will check if the key
    files on disk match the expected keys. If key files for
    previously observed keys have become unavailable, this will
    prevent the internal key manager from running.
  Bug Fixes:
  * Use TLS for notifies if configured to do so.
  * Notifies configured to use TLS will now be sent over TLS,
    instead of plain text UDP or TCP. Also, failing to load the TLS
    configuration for notify now results in an error.
  * {&dns} is as valid as {?dns} in a SVCB’s dohpath.
  * dig failed to parse a valid SVCB record with a dohpath URI
    template containing a {&dns}, like
    dohpath=/some/path?key=value{&dns}”.
  * Fix NSEC3 closest encloser lookup for names with empty
    non-terminals.
  * A previous performance optimization for finding the NSEC3
    closest encloser when generating authoritative responses could
    cause servers to return incorrect NSEC3 records in some cases.
    This has been fixed.
  * recursive-clients statement with value 0 triggered an assertion
    failure.
  * BIND 9.20.0 broke recursive-clients 0;. This has now been
    fixed.
  * Parsing of hostnames in rndc.conf was broken.
  * When DSCP support was removed, parsing of hostnames in
    rndc.conf was accidentally broken, resulting in an assertion
    failure. This has been fixed.
  * dig options of the form [+-]option=<value> failed to display
    the value on the printed command line. This has been fixed.
  * Provide more visibility into TLS configuration errors by
    logging SSL_CTX_use_certificate_chain_file() and
    SSL_CTX_use_PrivateKey_file() errors individually.
  * Fix a race condition when canceling ADB find which could cause
    an assertion failure.
  * SERVFAIL cache memory cleaning is now more aggressive; it no
    longer consumes a lot of memory if the server encounters many
    SERVFAILs at once.
  * Fix trying the next primary XoT server when the previous one
    was marked as unreachable.
  * In some cases named failed to try the next primary server in
    the primaries list when the previous one was marked as
    unreachable. This has been fixed.

- update root hints file to 2024-11-20 version (boo#1234406)

- Update to release 9.20.3
  New Features:
  * Log query response status to the query log.
  * Log a query response summary using the new responses category.
    Logging can be controlled via the responselog option and via
    rndc responselog.
  * Added WALLET type.
  * Add the new record type WALLET (262). This provides a mapping
    from a domain name to a cryptographic currency wallet. Multiple
    mappings can exist if multiple records exist.
  Feature Changes:
  * Set logging category for notify/xfer-in-related messages.
  * Some notify and xfer-in-related log messages were logged at the
    “general” category level instead of their own category. This
    has been fixed.
  * Allow IXFR-to-AXFR fallback on DNS_R_TOOMANYRECORDS.
  * This change allows fallback from an IXFR failure to AXFR when
    the reason is DNS_R_TOOMANYRECORDS.
  Bug Fixes:
  * Fix a statistics channel counter bug when “forward only” zones
    are used.
  * When resolving a zone with a “forward only” policy, and finding
    out that all the forwarders were marked as “bad”, the
    “ServerQuota” counter of the statistics channel was incorrectly
    increased. This has been fixed.
  * Fix a bug in the static-stub implementation.
  * Static-stub addresses and addresses from other sources were
    being mixed together, resulting in static-stub queries going to
    addresses not specified in the configuration, or alternatively,
    static-stub addresses being used instead of the correct server
    addresses.
  * Don’t allow statistics-channels if libxml2 and libjson-c are
    not configured.
  * When BIND 9 is not configured with the libxml2 and libjson-c
    libraries, the use of the statistics-channels option is a fatal
    error.
  * Separate DNSSEC validation from long-running tasks.
  * Split CPU-intensive and long-running tasks into separate
    threadpools in a way that the long-running tasks - like RPZ,
    catalog zone processing, or zone file operations - don’t block
    CPU-intensive operations like DNSSEC validations.
  * Fix an assertion failure when processing access control lists.
  * The named process could terminate unexpectedly when processing
    ACLs. This has been fixed.
  * Fix a bug in Offline KSK using a ZSK with an unlimited
    lifetime.
  * If the ZSK had an unlimited lifetime, the timing metadata
    Inactive and Delete could not be found and were treated as an
    error, preventing the zone from being signed. This has been
    fixed.
  * Limit the outgoing UDP send queue size.
  * If the operating system UDP queue got full and the outgoing UDP
    sending started to be delayed, BIND 9 could exhibit memory
    spikes as it tried to enqueue all the outgoing UDP messages. It
    now tries to deliver the outgoing UDP messages synchronously;
    if that fails, it drops the outgoing DNS message that would get
    queued up and then timeout on the client side.
  * Do not set SO_INCOMING_CPU.
  * Remove the SO_INCOMING_CPU setting as kernel scheduling
    performs better without constraints.
  * Fix the rndc dumpdb command’s error reporting.
  * The rndc dumpdb command was not reporting errors that occurred
    when named started up the database dump process. This has been
    fixed.
  * Fix long-running incoming transfers.
  * Incoming transfers that took longer than 30 seconds would stop
    reading from the TCP stream and the incoming transfer would be
    indefinitely stuck, causing BIND 9 to hang during shutdown.
  * This has been fixed, and the max-transfer-time-in and
    max-transfer-idle-in timeouts are now honored.
  * Fix an assertion failure when receiving DNS responses over TCP.
  * When matching the received Query ID in the TCP connection, an
    invalid Query ID could cause an assertion failure. This has
    been fixed.