* [git.ipfire.org] IPFire 2.x development tree branch, next, updated. 31ddf1b10640bfcc871e290e0535ed0e77c5541f
@ 2026-08-22 9:34 Michael Tremer
0 siblings, 0 replies; only message in thread
From: Michael Tremer @ 2026-08-22 9:34 UTC (permalink / raw)
To: ipfire-scm
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".
The branch, next has been updated
via 31ddf1b10640bfcc871e290e0535ed0e77c5541f (commit)
via 03f27c3f00a71be9a414ba4272b6726c201abc2f (commit)
from 8943f46d387b7b53df264a20637fa2581e5479d7 (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
commit 31ddf1b10640bfcc871e290e0535ed0e77c5541f
Author: Matthias Fischer <matthias.fischer@ipfire.org>
Date: Wed Aug 19 19:34:23 2026 +0200
bind: Update to 9.20.27
For details see:
https://downloads.isc.org/isc/bind9/9.20.27/doc/arm/html/notes.html#notes-for-bind-9-20-27
"Notes for BIND 9.20.27
New Features
Disclose active Negative Trust Anchors with Extended DNS Error 33.
A Negative Trust Anchor (RFC 7646) turns off DNSSEC validation for a
domain, so a name that would normally fail validation resolves instead.
named now marks such answers with Extended DNS Error code 33, "Negative
Trust Anchor", so operators can see at a glance when a response came
back only because an NTA was in effect. [GL #6268]
Feature Changes
Speed up RPZ policy zone updates.
RPZ updates used to be applied one small step at a time, adding
overhead on large policy zones. Updates are now applied as a single
batch, improving update performance for large RPZ zones, at the cost of
no longer overlapping with concurrent updates. [GL #5787] [GL #6270]
Bug Fixes
Ensure NSEC authority does not cross zonecut boundary.
When using a cached NSEC record to prove that a delegation is insecure,
named now checks that the signer name in the corresponding RRSIG is not
above a known secure delegation point. This prevents a signed namespace
from being downgraded to insecure using an NSEC record from the
grandparent zone. [GL #5967]
Treat an unusable NSEC3 chain as a verification failure.
When transferring in a mirror zone, DNSSEC verification could
incorrectly succeed when the zone had an invalid NSEC3PARAM record,
leading to subsequent validation failures. This has been fixed. [GL
#6136]
Treat non-canonical RPZ prefixes as any other failure.
RPZ prefixes that were not encoded in canonical form did not work. They
are now handled in the same way as any other encoding error. [GL #6043]
Negative caching stopped working with stale-answer-client-timeout set
to 0.
Negative answers were re-fetched on every query instead of once they
actually expired, effectively disabling negative caching. This has been
fixed. [GL #6245]
An unterminated OpenSSL private-key Label: field could be read past its
parser buffer.
The Label: field in a .private key file is now checked for length and
NUL-termination. Malformed files are rejected. [GL #6193]
Restore SMF support on Solaris and illumos. [GL #6096]
Fix compilation on GNU/Hurd. [GL #6285]
dig +yaml was producing invalid YAML when a lookup failed.
When no server could be reached, dig printed its plain-text startup
banner ahead of the YAML output, making the result unparsable. dig no
longer does this and correctly reflects options such as +nocmd, +short
and +yaml, regardless of where they appear on the command line. [GL
#1230]
Properly prevent TSIG generation command line injection attacks.
When key names are generated with rndc-confgen, tsig-keygen and
ddns-confgen, special characters must be escaped to ensure that the
configuration is parsed correctly. [GL #6071]
Fix a potential heap bounds overflow write in dnssec-signzone.
It was possible for dnssec-signzone to overflow array bounds while
signing. This has been fixed. [GL #6076]
Fix crashes on invalid DNSTAP input in dnstap-read.
Malformed DNSTAP files could trigger a NULL pointer dereference or an
out-of-bounds memory read in dnstap-read. This has been fixed. [GL
#6077] [GL #6124]"
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 03f27c3f00a71be9a414ba4272b6726c201abc2f
Author: Matthias Fischer <matthias.fischer@ipfire.org>
Date: Tue Aug 18 23:40:35 2026 +0200
knot: Update to 3.5.7
For details see:
https://www.knot-dns.cz/2026-08-18-version-357.html
"Version 3.5.7
Tuesday, August 18, 2026
Improvements:
knotd: new debug logging for DDNS prerequisite errors
knotd: support for SO_BINDTODEVICE for remotes/via #977 (Thanks to Tore Anderson)
keymgr: 'keystore-bench' is slow with many threads and a high-latency HSM connection
keymgr: 'keystore-bench' command accepts a filter by signing algorithm
libs: upgraded embedded libngtcp2 to 1.25.0
doc: various improvements
Bugfixes:
knotd: server crash due to a missing check for malformed TCP packet in XDP mode (Thanks to Arthur Chan)
knotd: server crash when processing XFR or NOTIFY with non-IN records (Thanks to Qifan Zhang)
knotd: server crash when processing an outbound reply with non-IN records (Thanks to Qifan Zhang)
knotd: server crash on zone with NSEC3PARAM but without NSEC3 records (Thanks to Qifan Zhang)
knotd: incorrect ACL address range evaluation (Thanks to Qifan Zhang)
knotd: assertion failure if zone expire is set to maximum (Thanks to Qifan Zhang)
knotd: server crash if SOA serial is not increased during IXFR from AXFR processing (Thanks to Qifan Zhang)
knotd: default 'policy.rrsig-refresh' value not considered for DNSSEC validation
knotd: missing '0.1 * policy.rrsig_lifetime' part in 'rrsig-refresh' default if 'policy.zone-max-ttl' is set #978
libknot: defective QUIC stateless-reset handler vulnerable to a crash (Thanks to Arthur Chan and Kushal Das)
libknot: insufficient check for oversized ECS EDNS option (Thanks to Qifan Zhang)
libknot: TSIG truncation check not implemented (Thanks to Qifan Zhang)
libs: inappropriate realloc failure handlings in heap structure
mod-authsignal: server crash if insertion to packet fails (Thanks to Qifan Zhang)
mod-authsignal: server crash if zone name contains _dsboot prefix (Thanks to Qifan Zhang)
mod-dnsproxy: outbound packet insertion error not propagated to client (Thanks to Qifan Zhang)
mod-onlinesign: server responds with SERVFAIL instead of NOERROR if reply is truncated
man: incorrect default paths for files, databases and sockets #976"
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
-----------------------------------------------------------------------
Summary of changes:
config/rootfiles/common/bind | 10 +++++-----
lfs/bind | 4 ++--
lfs/knot | 4 ++--
3 files changed, 9 insertions(+), 9 deletions(-)
Difference in files:
diff --git a/config/rootfiles/common/bind b/config/rootfiles/common/bind
index 79fe4917d..e650d3ad0 100644
--- a/config/rootfiles/common/bind
+++ b/config/rootfiles/common/bind
@@ -241,18 +241,18 @@ usr/bin/nsupdate
#usr/include/ns/types.h
#usr/include/ns/update.h
#usr/include/ns/xfrout.h
-usr/lib/libdns-9.20.26.so
+usr/lib/libdns-9.20.27.so
#usr/lib/libdns.la
#usr/lib/libdns.so
-usr/lib/libisc-9.20.26.so
+usr/lib/libisc-9.20.27.so
#usr/lib/libisc.la
#usr/lib/libisc.so
-usr/lib/libisccc-9.20.26.so
+usr/lib/libisccc-9.20.27.so
#usr/lib/libisccc.la
#usr/lib/libisccc.so
-usr/lib/libisccfg-9.20.26.so
+usr/lib/libisccfg-9.20.27.so
#usr/lib/libisccfg.la
#usr/lib/libisccfg.so
-usr/lib/libns-9.20.26.so
+usr/lib/libns-9.20.27.so
#usr/lib/libns.la
#usr/lib/libns.so
diff --git a/lfs/bind b/lfs/bind
index 29c2c7850..b5d6cdf60 100644
--- a/lfs/bind
+++ b/lfs/bind
@@ -25,7 +25,7 @@
include Config
-VER = 9.20.26
+VER = 9.20.27
THISAPP = bind-$(VER)
DL_FILE = $(THISAPP).tar.xz
@@ -43,7 +43,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = 433d5ed7457367ce5b195a7d1a6f3fef21f929b158b14e3c86d8dc2004240119e4ec3b1d3cab1121be66ec77463fcb462e1207ec3339cf46ca4eec05f8c366ef
+$(DL_FILE)_BLAKE2 = 7f2f0f030748e722d12800bae567f9cfb1ddeba712a8f3a2a1018572ef9be2a69c072cca2139cb723b928ebe62c502a2715ae0d4afab3d0ba526b0a5eb5e215e
install : $(TARGET)
diff --git a/lfs/knot b/lfs/knot
index 24c083ea1..caa2a5e01 100644
--- a/lfs/knot
+++ b/lfs/knot
@@ -24,7 +24,7 @@
include Config
-VER = 3.5.6
+VER = 3.5.7
THISAPP = knot-$(VER)
DL_FILE = $(THISAPP).tar.xz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = f03a2da9390e89bd7955505d3f59ca54689e2183b1ea0f82efbf5abedd71f16902c6d09f77adceaedd29573d52135c168441dbf46721709b370269220b68f49b
+$(DL_FILE)_BLAKE2 = 820ab9dc28fda30547c3989451f44eff2953b29d746cb2460da9726a627648c1aef69adbc13e7d1d71905c229bda1f36d56cec98b9a00f2f4f3bf27549ebaa0a
install : $(TARGET)
hooks/post-receive
--
IPFire 2.x development tree
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2026-08-22 9:35 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-08-22 9:34 [git.ipfire.org] IPFire 2.x development tree branch, next, updated. 31ddf1b10640bfcc871e290e0535ed0e77c5541f Michael Tremer
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox