From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4hRsTc0Npsz2xbb for ; Sat, 22 Aug 2026 09:35:00 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1 raw public key) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "YR2" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4hRsTc00Csz2xM3 for ; Sat, 22 Aug 2026 09:34:59 +0000 (UTC) Received: from people01.haj.ipfire.org (people01.haj.ipfire.org [172.28.1.161]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bit raw public key) server-digest SHA256 client-signature ECDSA (secp384r1) client-digest SHA384) (Client CN "people01.haj.ipfire.org", Issuer "YE2" (not verified)) by mail01.ipfire.org (Postfix) with ESMTPS id 4hRsTR39Rqz1WC for ; Sat, 22 Aug 2026 09:34:51 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1787391291; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc; bh=XOpKdLIs6/c2OJCw3YxkYs/G99KNRSSGABa1nMlIhVE=; b=0x1Pqmq4mhk0YZA8RErK2Tb3wLRuGY5m89LbeMxchkobeyMXwLtDnrvRQopz/gdpVmS99k 8+CZ+U5NCY2wX+DA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1787391291; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc; bh=XOpKdLIs6/c2OJCw3YxkYs/G99KNRSSGABa1nMlIhVE=; b=rq0ZLVIiCY+QYwm9p401QT56tGxcH/Uv6l5JApqP+Zvc+NssP2BEtZFg8nQ9c31ABEWS0p fagVcEAM5yQLPTLJsmbuT2MzKpnJ7DhWWngyFUliNr5ukDb5xtvlXen4N7viBLrYH7X4Mp RUcO8pLXVnLxtEQxvmE2uKZzxBSIGtPo5GWt/8fjzpAXDiYbZyIgG0qQ0OVBTL6mwVR6Yc tM6gqxQ/kjK96kjPKMpsoQjYNhBo6xFRhO1Oj900kxXSpNY5gPfuZp4OiDrCLTRiNa5vXw 1oO883EVFBYTPcdnsrOVuXodE+BLRiLaqUNwMmo7mA1skCPv9I+LzQxpUijSQw== Received: by people01.haj.ipfire.org (Postfix, from userid 1000) id 4hRsTR21Cgz2xYf; Sat, 22 Aug 2026 09:34:51 +0000 (UTC) To: ipfire-scm@lists.ipfire.org Subject: [git.ipfire.org] IPFire 2.x development tree branch, next, updated. 31ddf1b10640bfcc871e290e0535ed0e77c5541f X-Git-Refname: refs/heads/next X-Git-Reftype: branch X-Git-Oldrev: 8943f46d387b7b53df264a20637fa2581e5479d7 X-Git-Newrev: 31ddf1b10640bfcc871e290e0535ed0e77c5541f Message-Id: <4hRsTR21Cgz2xYf@people01.haj.ipfire.org> Date: Sat, 22 Aug 2026 09:34:51 +0000 (UTC) From: Michael Tremer Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 31ddf1b10640bfcc871e290e0535ed0e77c5541f (commit) via 03f27c3f00a71be9a414ba4272b6726c201abc2f (commit) from 8943f46d387b7b53df264a20637fa2581e5479d7 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 31ddf1b10640bfcc871e290e0535ed0e77c5541f Author: Matthias Fischer Date: Wed Aug 19 19:34:23 2026 +0200 bind: Update to 9.20.27 For details see: https://downloads.isc.org/isc/bind9/9.20.27/doc/arm/html/notes.html#notes-for-bind-9-20-27 "Notes for BIND 9.20.27 New Features Disclose active Negative Trust Anchors with Extended DNS Error 33. A Negative Trust Anchor (RFC 7646) turns off DNSSEC validation for a domain, so a name that would normally fail validation resolves instead. named now marks such answers with Extended DNS Error code 33, "Negative Trust Anchor", so operators can see at a glance when a response came back only because an NTA was in effect. [GL #6268] Feature Changes Speed up RPZ policy zone updates. RPZ updates used to be applied one small step at a time, adding overhead on large policy zones. Updates are now applied as a single batch, improving update performance for large RPZ zones, at the cost of no longer overlapping with concurrent updates. [GL #5787] [GL #6270] Bug Fixes Ensure NSEC authority does not cross zonecut boundary. When using a cached NSEC record to prove that a delegation is insecure, named now checks that the signer name in the corresponding RRSIG is not above a known secure delegation point. This prevents a signed namespace from being downgraded to insecure using an NSEC record from the grandparent zone. [GL #5967] Treat an unusable NSEC3 chain as a verification failure. When transferring in a mirror zone, DNSSEC verification could incorrectly succeed when the zone had an invalid NSEC3PARAM record, leading to subsequent validation failures. This has been fixed. [GL #6136] Treat non-canonical RPZ prefixes as any other failure. RPZ prefixes that were not encoded in canonical form did not work. They are now handled in the same way as any other encoding error. [GL #6043] Negative caching stopped working with stale-answer-client-timeout set to 0. Negative answers were re-fetched on every query instead of once they actually expired, effectively disabling negative caching. This has been fixed. [GL #6245] An unterminated OpenSSL private-key Label: field could be read past its parser buffer. The Label: field in a .private key file is now checked for length and NUL-termination. Malformed files are rejected. [GL #6193] Restore SMF support on Solaris and illumos. [GL #6096] Fix compilation on GNU/Hurd. [GL #6285] dig +yaml was producing invalid YAML when a lookup failed. When no server could be reached, dig printed its plain-text startup banner ahead of the YAML output, making the result unparsable. dig no longer does this and correctly reflects options such as +nocmd, +short and +yaml, regardless of where they appear on the command line. [GL #1230] Properly prevent TSIG generation command line injection attacks. When key names are generated with rndc-confgen, tsig-keygen and ddns-confgen, special characters must be escaped to ensure that the configuration is parsed correctly. [GL #6071] Fix a potential heap bounds overflow write in dnssec-signzone. It was possible for dnssec-signzone to overflow array bounds while signing. This has been fixed. [GL #6076] Fix crashes on invalid DNSTAP input in dnstap-read. Malformed DNSTAP files could trigger a NULL pointer dereference or an out-of-bounds memory read in dnstap-read. This has been fixed. [GL #6077] [GL #6124]" Signed-off-by: Matthias Fischer Signed-off-by: Michael Tremer commit 03f27c3f00a71be9a414ba4272b6726c201abc2f Author: Matthias Fischer Date: Tue Aug 18 23:40:35 2026 +0200 knot: Update to 3.5.7 For details see: https://www.knot-dns.cz/2026-08-18-version-357.html "Version 3.5.7 Tuesday, August 18, 2026 Improvements: knotd: new debug logging for DDNS prerequisite errors knotd: support for SO_BINDTODEVICE for remotes/via #977 (Thanks to Tore Anderson) keymgr: 'keystore-bench' is slow with many threads and a high-latency HSM connection keymgr: 'keystore-bench' command accepts a filter by signing algorithm libs: upgraded embedded libngtcp2 to 1.25.0 doc: various improvements Bugfixes: knotd: server crash due to a missing check for malformed TCP packet in XDP mode (Thanks to Arthur Chan) knotd: server crash when processing XFR or NOTIFY with non-IN records (Thanks to Qifan Zhang) knotd: server crash when processing an outbound reply with non-IN records (Thanks to Qifan Zhang) knotd: server crash on zone with NSEC3PARAM but without NSEC3 records (Thanks to Qifan Zhang) knotd: incorrect ACL address range evaluation (Thanks to Qifan Zhang) knotd: assertion failure if zone expire is set to maximum (Thanks to Qifan Zhang) knotd: server crash if SOA serial is not increased during IXFR from AXFR processing (Thanks to Qifan Zhang) knotd: default 'policy.rrsig-refresh' value not considered for DNSSEC validation knotd: missing '0.1 * policy.rrsig_lifetime' part in 'rrsig-refresh' default if 'policy.zone-max-ttl' is set #978 libknot: defective QUIC stateless-reset handler vulnerable to a crash (Thanks to Arthur Chan and Kushal Das) libknot: insufficient check for oversized ECS EDNS option (Thanks to Qifan Zhang) libknot: TSIG truncation check not implemented (Thanks to Qifan Zhang) libs: inappropriate realloc failure handlings in heap structure mod-authsignal: server crash if insertion to packet fails (Thanks to Qifan Zhang) mod-authsignal: server crash if zone name contains _dsboot prefix (Thanks to Qifan Zhang) mod-dnsproxy: outbound packet insertion error not propagated to client (Thanks to Qifan Zhang) mod-onlinesign: server responds with SERVFAIL instead of NOERROR if reply is truncated man: incorrect default paths for files, databases and sockets #976" Signed-off-by: Matthias Fischer Signed-off-by: Michael Tremer ----------------------------------------------------------------------- Summary of changes: config/rootfiles/common/bind | 10 +++++----- lfs/bind | 4 ++-- lfs/knot | 4 ++-- 3 files changed, 9 insertions(+), 9 deletions(-) Difference in files: diff --git a/config/rootfiles/common/bind b/config/rootfiles/common/bind index 79fe4917d..e650d3ad0 100644 --- a/config/rootfiles/common/bind +++ b/config/rootfiles/common/bind @@ -241,18 +241,18 @@ usr/bin/nsupdate #usr/include/ns/types.h #usr/include/ns/update.h #usr/include/ns/xfrout.h -usr/lib/libdns-9.20.26.so +usr/lib/libdns-9.20.27.so #usr/lib/libdns.la #usr/lib/libdns.so -usr/lib/libisc-9.20.26.so +usr/lib/libisc-9.20.27.so #usr/lib/libisc.la #usr/lib/libisc.so -usr/lib/libisccc-9.20.26.so +usr/lib/libisccc-9.20.27.so #usr/lib/libisccc.la #usr/lib/libisccc.so -usr/lib/libisccfg-9.20.26.so +usr/lib/libisccfg-9.20.27.so #usr/lib/libisccfg.la #usr/lib/libisccfg.so -usr/lib/libns-9.20.26.so +usr/lib/libns-9.20.27.so #usr/lib/libns.la #usr/lib/libns.so diff --git a/lfs/bind b/lfs/bind index 29c2c7850..b5d6cdf60 100644 --- a/lfs/bind +++ b/lfs/bind @@ -25,7 +25,7 @@ include Config -VER = 9.20.26 +VER = 9.20.27 THISAPP = bind-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -43,7 +43,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 433d5ed7457367ce5b195a7d1a6f3fef21f929b158b14e3c86d8dc2004240119e4ec3b1d3cab1121be66ec77463fcb462e1207ec3339cf46ca4eec05f8c366ef +$(DL_FILE)_BLAKE2 = 7f2f0f030748e722d12800bae567f9cfb1ddeba712a8f3a2a1018572ef9be2a69c072cca2139cb723b928ebe62c502a2715ae0d4afab3d0ba526b0a5eb5e215e install : $(TARGET) diff --git a/lfs/knot b/lfs/knot index 24c083ea1..caa2a5e01 100644 --- a/lfs/knot +++ b/lfs/knot @@ -24,7 +24,7 @@ include Config -VER = 3.5.6 +VER = 3.5.7 THISAPP = knot-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = f03a2da9390e89bd7955505d3f59ca54689e2183b1ea0f82efbf5abedd71f16902c6d09f77adceaedd29573d52135c168441dbf46721709b370269220b68f49b +$(DL_FILE)_BLAKE2 = 820ab9dc28fda30547c3989451f44eff2953b29d746cb2460da9726a627648c1aef69adbc13e7d1d71905c229bda1f36d56cec98b9a00f2f4f3bf27549ebaa0a install : $(TARGET) hooks/post-receive -- IPFire 2.x development tree