[PATCH] bind: Update to 9.20.27

[Matthias Fischer <matthias.fischer@ipfire.org>]

For details see:

https://downloads.isc.org/isc/bind9/9.20.27/doc/arm/html/notes.html#notes-for-bind-9-20-27

"Notes for BIND 9.20.27
New Features

    Disclose active Negative Trust Anchors with Extended DNS Error 33.

    A Negative Trust Anchor (RFC 7646) turns off DNSSEC validation for a
    domain, so a name that would normally fail validation resolves instead.
    named now marks such answers with Extended DNS Error code 33, "Negative
    Trust Anchor", so operators can see at a glance when a response came
    back only because an NTA was in effect. [GL #6268]

Feature Changes

    Speed up RPZ policy zone updates.

    RPZ updates used to be applied one small step at a time, adding
    overhead on large policy zones. Updates are now applied as a single
    batch, improving update performance for large RPZ zones, at the cost of
    no longer overlapping with concurrent updates. [GL #5787] [GL #6270]

Bug Fixes

    Ensure NSEC authority does not cross zonecut boundary.

    When using a cached NSEC record to prove that a delegation is insecure,
    named now checks that the signer name in the corresponding RRSIG is not
    above a known secure delegation point. This prevents a signed namespace
    from being downgraded to insecure using an NSEC record from the
    grandparent zone. [GL #5967]

    Treat an unusable NSEC3 chain as a verification failure.

    When transferring in a mirror zone, DNSSEC verification could
    incorrectly succeed when the zone had an invalid NSEC3PARAM record,
    leading to subsequent validation failures. This has been fixed. [GL
    #6136]

    Treat non-canonical RPZ prefixes as any other failure.

    RPZ prefixes that were not encoded in canonical form did not work. They
    are now handled in the same way as any other encoding error. [GL #6043]

    Negative caching stopped working with stale-answer-client-timeout set
    to 0.

    Negative answers were re-fetched on every query instead of once they
    actually expired, effectively disabling negative caching. This has been
    fixed. [GL #6245]

    An unterminated OpenSSL private-key Label: field could be read past its
    parser buffer.

    The Label: field in a .private key file is now checked for length and
    NUL-termination. Malformed files are rejected. [GL #6193]

    Restore SMF support on Solaris and illumos. [GL #6096]

    Fix compilation on GNU/Hurd. [GL #6285]

    dig +yaml was producing invalid YAML when a lookup failed.

    When no server could be reached, dig printed its plain-text startup
    banner ahead of the YAML output, making the result unparsable. dig no
    longer does this and correctly reflects options such as +nocmd, +short
    and +yaml, regardless of where they appear on the command line. [GL
    #1230]

    Properly prevent TSIG generation command line injection attacks.

    When key names are generated with rndc-confgen, tsig-keygen and
    ddns-confgen, special characters must be escaped to ensure that the
    configuration is parsed correctly. [GL #6071]

    Fix a potential heap bounds overflow write in dnssec-signzone.

    It was possible for dnssec-signzone to overflow array bounds while
    signing. This has been fixed. [GL #6076]

    Fix crashes on invalid DNSTAP input in dnstap-read.

    Malformed DNSTAP files could trigger a NULL pointer dereference or an
    out-of-bounds memory read in dnstap-read. This has been fixed. [GL
    #6077] [GL #6124]"

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
---
 config/rootfiles/common/bind | 10 +++++-----
 lfs/bind                     |  4 ++--
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/config/rootfiles/common/bind b/config/rootfiles/common/bind
index 79fe4917d..e650d3ad0 100644
--- a/config/rootfiles/common/bind
+++ b/config/rootfiles/common/bind
@@ -241,18 +241,18 @@ usr/bin/nsupdate
 #usr/include/ns/types.h
 #usr/include/ns/update.h
 #usr/include/ns/xfrout.h
-usr/lib/libdns-9.20.26.so
+usr/lib/libdns-9.20.27.so
 #usr/lib/libdns.la
 #usr/lib/libdns.so
-usr/lib/libisc-9.20.26.so
+usr/lib/libisc-9.20.27.so
 #usr/lib/libisc.la
 #usr/lib/libisc.so
-usr/lib/libisccc-9.20.26.so
+usr/lib/libisccc-9.20.27.so
 #usr/lib/libisccc.la
 #usr/lib/libisccc.so
-usr/lib/libisccfg-9.20.26.so
+usr/lib/libisccfg-9.20.27.so
 #usr/lib/libisccfg.la
 #usr/lib/libisccfg.so
-usr/lib/libns-9.20.26.so
+usr/lib/libns-9.20.27.so
 #usr/lib/libns.la
 #usr/lib/libns.so
diff --git a/lfs/bind b/lfs/bind
index 29c2c7850..b5d6cdf60 100644
--- a/lfs/bind
+++ b/lfs/bind
@@ -25,7 +25,7 @@
 
 include Config
 
-VER        = 9.20.26
+VER        = 9.20.27
 
 THISAPP    = bind-$(VER)
 DL_FILE    = $(THISAPP).tar.xz
@@ -43,7 +43,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_BLAKE2 = 433d5ed7457367ce5b195a7d1a6f3fef21f929b158b14e3c86d8dc2004240119e4ec3b1d3cab1121be66ec77463fcb462e1207ec3339cf46ca4eec05f8c366ef
+$(DL_FILE)_BLAKE2 = 7f2f0f030748e722d12800bae567f9cfb1ddeba712a8f3a2a1018572ef9be2a69c072cca2139cb723b928ebe62c502a2715ae0d4afab3d0ba526b0a5eb5e215e
 
 install : $(TARGET)
 
-- 
2.53.0