[packages/bind] - Up to 9.20.26; fixes CVE-2026-10723, CVE-2026-10822, CVE-2026-11331, CVE-2026-11605, CVE-2026-1162
arekm
arekm at pld-linux.org
Wed Jul 22 17:28:31 CEST 2026
commit 0d5211d302a785c2ee6a2096cb06c6ed039b5e29
Author: Arkadiusz Miśkiewicz <arekm at maven.pl>
Date: Wed Jul 22 17:27:28 2026 +0200
- Up to 9.20.26; fixes CVE-2026-10723, CVE-2026-10822, CVE-2026-11331, CVE-2026-11605, CVE-2026-11622, CVE-2026-11721, CVE-2026-12617, CVE-2026-13204, CVE-2026-13321
- updated named.root (root zone 2026072201)
- dropped edns-client-subnet patch, upstreamed as dig +subnet
bind-edns-client-subnet.patch | 322 ------------------------------------------
bind.spec | 9 +-
2 files changed, 3 insertions(+), 328 deletions(-)
---
diff --git a/bind.spec b/bind.spec
index d5b348b..d5fbb7c 100644
--- a/bind.spec
+++ b/bind.spec
@@ -11,7 +11,6 @@
%bcond_with static_libs # static libraries
%bcond_with system_tests # system tests (require root to configure localhost IPs)
%bcond_with tests # unit tests
-%bcond_with edns_cli # ability to use edns-client-subnet in dig
%bcond_with hip # HIP RR support
%if "%{pld_release}" == "ac"
@@ -35,13 +34,13 @@ Summary(tr.UTF-8): DNS alan adı sunucusu
Summary(uk.UTF-8): BIND - cервер системи доменних імен (DNS)
Summary(zh_CN.UTF-8): Internet 域名服务器
Name: bind
-Version: 9.20.24
+Version: 9.20.26
Release: 1
Epoch: 7
License: MPL 2.0
Group: Networking/Daemons
Source0: https://ftp.isc.org/isc/bind9/%{version}/%{name}-%{version}.tar.xz
-# Source0-md5: ba08036610502ea8abe849edd3655cdb
+# Source0-md5: 5068ac935059607d485625f80c233568
Source1: named.init
Source2: named.sysconfig
Source3: named.logrotate
@@ -50,7 +49,7 @@ Source4: http://www.mif.pg.gda.pl/homepages/ankry/man-PLD/%{name}-non-english-ma
Source6: %{name}-hip.tar.gz
# Source6-md5: 62a8a67f51ff8db9fe815205416a1f62
Source7: https://www.internic.net/domain/named.root
-# Source7-md5: db10032187979ffd546e8592aa56981f
+# Source7-md5: e42e086bf0d6a4246fb9e691a755ed2d
Source8: %{name}-127.0.0.zone
Source9: %{name}-localhost.zone
Source10: %{name}-named.conf
@@ -59,7 +58,6 @@ Source12: named.service
Patch3: jemalloc.patch
Patch4: %{name}-ac-libs.patch
-Patch5: %{name}-edns-client-subnet.patch
URL: https://www.isc.org/software/bind
BuildRequires: autoconf >= 2.60
BuildRequires: automake
@@ -379,7 +377,6 @@ BIND.
%patch -P3 -p1
%patch -P4 -p1
%{?with_hip:%{__mv} bind-hip/hip_55.[ch] lib/dns/rdata/generic}
-%{?with_edns_cli:%patch -P5 -p0}
%build
%{__libtoolize}
diff --git a/bind-edns-client-subnet.patch b/bind-edns-client-subnet.patch
deleted file mode 100644
index 7be05a6..0000000
--- a/bind-edns-client-subnet.patch
+++ /dev/null
@@ -1,322 +0,0 @@
-These patches add the ability to send and receive DNS messages with
-edns-client-subnet options to BIND's dig utility.
-
-Example:
-
-wilmer at fiona:~/src/bind-ecs$ bin/dig/dig @ns1.google.com www.google.com +client=130.89.89.130
-
-; <<>> DiG 9.7.1-P2 <<>> @ns1.google.com www.google.com +client=130.89.89.130
-;; OPT PSEUDOSECTION:
-; EDNS: version: 0, flags:; udp: 512
-; CLIENT-SUBNET: 130.89.89.130/32/21
-;; QUESTION SECTION:
-;www.google.com. IN A
-
-;; ANSWER SECTION:
-www.google.com. 604800 IN CNAME www.l.google.com.
-www.l.google.com. 300 IN A 74.125.79.104
-www.l.google.com. 300 IN A 74.125.79.99
-www.l.google.com. 300 IN A 74.125.79.147
-
-Copyright 2010 Google Inc.
-Author: Wilmer van der Gaast <wilmer at google.com>
-
-
-diff -uNr bin/dig/dig.c bin/dig/dig.c
---- bin/dig/dig.c 2010-05-13 01:42:26.000000000 +0100
-+++ bin/dig/dig.c 2011-02-16 15:58:31.000000000 +0000
-@@ -188,6 +188,7 @@
- " +bufsize=### (Set EDNS0 Max UDP packet size)\n"
- " +ndots=### (Set NDOTS value)\n"
- " +edns=### (Set EDNS version)\n"
-+" +client=addr (Set edns-client-subnet option)\n"
- " +[no]search (Set whether to use searchlist)\n"
- " +[no]showsearch (Search with intermediate results)\n"
- " +[no]defname (Ditto)\n"
-@@ -804,8 +805,25 @@
- }
- break;
- case 'l': /* cl */
-- FULLCHECK("cl");
-- noclass = ISC_TF(!state);
-+ switch (cmd[2]) {
-+ case 'i':/* client */
-+ FULLCHECK("client");
-+ if (value == NULL)
-+ goto need_value;
-+ if (state && lookup->edns == -1)
-+ lookup->edns = 0;
-+ if (parse_netprefix(&lookup->ecs_addr,
-+ &lookup->ecs_len,
-+ value) != ISC_R_SUCCESS)
-+ fatal("Couldn't parse client");
-+ break;
-+ case '\0':
-+ FULLCHECK("cl");
-+ noclass = ISC_TF(!state);
-+ break;
-+ default:
-+ goto invalid_option;
-+ }
- break;
- case 'm': /* cmd */
- FULLCHECK("cmd");
-diff -uNr bin/dig/dighost.c bin/dig/dighost.c
---- bin/dig/dighost.c 2010-12-09 01:05:27.000000000 +0000
-+++ bin/dig/dighost.c 2011-02-16 15:58:31.000000000 +0000
-@@ -96,6 +96,9 @@
-
- #include <dig/dig.h>
-
-+/* parse_netprefix */
-+#include <netdb.h>
-+
- #if ! defined(NS_INADDRSZ)
- #define NS_INADDRSZ 4
- #endif
-@@ -789,6 +792,8 @@
- looknew->new_search = ISC_FALSE;
- looknew->done_as_is = ISC_FALSE;
- looknew->need_search = ISC_FALSE;
-+ looknew->ecs_addr = NULL;
-+ looknew->ecs_len = 0;
- ISC_LINK_INIT(looknew, link);
- ISC_LIST_INIT(looknew->q);
- ISC_LIST_INIT(looknew->my_server_list);
-@@ -805,6 +810,7 @@
- dig_lookup_t *
- clone_lookup(dig_lookup_t *lookold, isc_boolean_t servers) {
- dig_lookup_t *looknew;
-+ size_t len;
-
- debug("clone_lookup()");
-
-@@ -865,6 +871,19 @@
- looknew->need_search = lookold->need_search;
- looknew->done_as_is = lookold->done_as_is;
-
-+ if (lookold->ecs_addr) {
-+ if (lookold->ecs_addr->sa_family == AF_INET)
-+ len = sizeof(struct sockaddr_in);
-+ else if (lookold->ecs_addr->sa_family == AF_INET6)
-+ len = sizeof(struct sockaddr_in6);
-+ else
-+ INSIST(0);
-+
-+ looknew->ecs_addr = isc_mem_allocate(mctx, len);
-+ memcpy(looknew->ecs_addr, lookold->ecs_addr, len);
-+ looknew->ecs_len = lookold->ecs_len;
-+ }
-+
- if (servers)
- clone_server_list(lookold->my_server_list,
- &looknew->my_server_list);
-@@ -974,6 +993,48 @@
- return (tmp);
- }
-
-+isc_result_t
-+parse_netprefix(struct sockaddr **sa, isc_uint32_t *netmask,
-+ const char *value) {
-+ struct addrinfo *res, hints;
-+ char *addr, *slash;
-+ isc_uint32_t result;
-+
-+ addr = isc_mem_strdup(mctx, value);
-+ if ((slash = strchr(addr, '/'))) {
-+ *slash = '\0';
-+ result = isc_parse_uint32(netmask, slash + 1, 10);
-+ if (result != ISC_R_SUCCESS) {
-+ isc_mem_free(mctx, addr);
-+ printf("invalid %s '%s': %s\n", "prefix length",
-+ value, isc_result_totext(result));
-+ return (result);
-+ }
-+ } else {
-+ *netmask = 128;
-+ }
-+
-+ memset(&hints, 0, sizeof(hints));
-+ hints.ai_flags = AI_NUMERICHOST;
-+ if ((result = getaddrinfo(addr, NULL, &hints, &res)) != 0) {
-+ isc_mem_free(mctx, addr);
-+ printf("getaddrinfo() error: %s\n", gai_strerror(result));
-+ return ISC_R_FAILURE;
-+ }
-+ isc_mem_free(mctx, addr);
-+
-+ *sa = isc_mem_allocate(mctx, res->ai_addrlen);
-+ memcpy(*sa, res->ai_addr, res->ai_addrlen);
-+
-+ if (res->ai_family == AF_INET && *netmask > 32)
-+ *netmask = 32;
-+ else if (res->ai_family == AF_INET6 && *netmask > 128)
-+ *netmask = 128;
-+
-+ freeaddrinfo(res);
-+ return (ISC_R_SUCCESS);
-+}
-+
-
- /*
- * Parse HMAC algorithm specification
-@@ -1361,12 +1422,15 @@
- */
- static void
- add_opt(dns_message_t *msg, isc_uint16_t udpsize, isc_uint16_t edns,
-- isc_boolean_t dnssec, isc_boolean_t nsid)
-+ isc_boolean_t dnssec, isc_boolean_t nsid,
-+ struct sockaddr *ecs_addr, isc_uint32_t ecs_len)
- {
- dns_rdataset_t *rdataset = NULL;
- dns_rdatalist_t *rdatalist = NULL;
- dns_rdata_t *rdata = NULL;
- isc_result_t result;
-+ unsigned char data[64];
-+ isc_buffer_t buf;
-
- debug("add_opt()");
- result = dns_message_gettemprdataset(msg, &rdataset);
-@@ -1384,20 +1448,37 @@
- rdatalist->ttl = edns << 16;
- if (dnssec)
- rdatalist->ttl |= DNS_MESSAGEEXTFLAG_DO;
-- if (nsid) {
-- isc_buffer_t *b = NULL;
-
-- result = isc_buffer_allocate(mctx, &b, 4);
-- check_result(result, "isc_buffer_allocate");
-- isc_buffer_putuint16(b, DNS_OPT_NSID);
-- isc_buffer_putuint16(b, 0);
-- rdata->data = isc_buffer_base(b);
-- rdata->length = isc_buffer_usedlength(b);
-- dns_message_takebuffer(msg, &b);
-- } else {
-- rdata->data = NULL;
-- rdata->length = 0;
-+ isc_buffer_init(&buf, data, sizeof(data));
-+ if (nsid) {
-+ isc_buffer_putuint16(&buf, DNS_OPT_NSID);
-+ isc_buffer_putuint16(&buf, 0);
- }
-+ if (ecs_addr) {
-+ size_t addrl = (ecs_len + 7) / 8;
-+
-+ isc_buffer_putuint16(&buf, DNS_OPT_CLIENT_SUBNET);
-+ isc_buffer_putuint16(&buf, 4 + addrl);
-+ if (ecs_addr->sa_family == AF_INET) {
-+ struct sockaddr_in *ad = (struct sockaddr_in *) ecs_addr;
-+ isc_buffer_putuint16(&buf, 1);
-+ isc_buffer_putuint8(&buf, ecs_len);
-+ isc_buffer_putuint8(&buf, 0);
-+ isc_buffer_putmem(&buf, (isc_uint8_t*) &ad->sin_addr, addrl);
-+ }
-+ else /* if (ecs_addr->sa_family == AF_INET6) */ {
-+ struct sockaddr_in6 *ad = (struct sockaddr_in6 *) ecs_addr;
-+ isc_buffer_putuint16(&buf, 2);
-+ isc_buffer_putuint8(&buf, ecs_len);
-+ isc_buffer_putuint8(&buf, 0);
-+ isc_buffer_putmem(&buf, (isc_uint8_t*) &ad->sin6_addr, addrl);
-+ }
-+ }
-+ if ((rdata->length = isc_buffer_usedlength(&buf)) > 0)
-+ rdata->data = data;
-+ else
-+ rdata->data = NULL;
-+
- ISC_LIST_INIT(rdatalist->rdata);
- ISC_LIST_APPEND(rdatalist->rdata, rdata, link);
- dns_rdatalist_tordataset(rdatalist, rdataset);
-@@ -1546,6 +1627,9 @@
- if (lookup->tsigctx != NULL)
- dst_context_destroy(&lookup->tsigctx);
-
-+ if (lookup->ecs_addr != NULL)
-+ isc_mem_free(mctx, lookup->ecs_addr);
-+
- isc_mem_free(mctx, lookup);
- }
-
-@@ -2210,7 +2294,8 @@
- if (lookup->edns < 0)
- lookup->edns = 0;
- add_opt(lookup->sendmsg, lookup->udpsize,
-- lookup->edns, lookup->dnssec, lookup->nsid);
-+ lookup->edns, lookup->dnssec, lookup->nsid,
-+ lookup->ecs_addr, lookup->ecs_len);
- }
-
- result = dns_message_rendersection(lookup->sendmsg,
-diff -uNr bin/dig/include/dig/dig.h bin/dig/include/dig/dig.h
---- bin/dig/include/dig/dig.h 2009-09-29 16:06:06.000000000 +0100
-+++ bin/dig/include/dig/dig.h 2011-02-16 15:58:31.000000000 +0000
-@@ -183,6 +183,8 @@
- isc_buffer_t *querysig;
- isc_uint32_t msgcounter;
- dns_fixedname_t fdomain;
-+ struct sockaddr *ecs_addr; /*% edns-client-subnet */
-+ isc_uint32_t ecs_len;
- };
-
- /*% The dig_query structure */
-@@ -330,6 +332,10 @@
- parse_uint(isc_uint32_t *uip, const char *value, isc_uint32_t max,
- const char *desc);
-
-+isc_result_t
-+parse_netprefix(struct sockaddr **sa, isc_uint32_t *netmask,
-+ const char *value);
-+
- void
- parse_hmac(const char *hmacstr);
-
-diff -uNr lib/dns/include/dns/message.h lib/dns/include/dns/message.h
---- lib/dns/include/dns/message.h 2009-10-26 23:47:35.000000000 +0000
-+++ lib/dns/include/dns/message.h 2011-02-16 15:58:31.000000000 +0000
-@@ -105,6 +105,7 @@
-
- /*%< EDNS0 extended OPT codes */
- #define DNS_OPT_NSID 0x0003 /*%< NSID opt code */
-+#define DNS_OPT_CLIENT_SUBNET 0x50fa /*%< client subnet opt code */
-
- #define DNS_MESSAGE_REPLYPRESERVE (DNS_MESSAGEFLAG_RD|DNS_MESSAGEFLAG_CD)
- #define DNS_MESSAGEEXTFLAG_REPLYPRESERVE (DNS_MESSAGEEXTFLAG_DO)
-diff -uNr lib/dns/message.c lib/dns/message.c
---- lib/dns/message.c 2010-06-03 06:27:59.000000000 +0100
-+++ lib/dns/message.c 2011-02-16 15:58:31.000000000 +0000
-@@ -3236,6 +3236,35 @@
-
- if (optcode == DNS_OPT_NSID) {
- ADD_STRING(target, "; NSID");
-+ } else if (optcode == DNS_OPT_CLIENT_SUBNET) {
-+ int i;
-+ char addr[16], addr_text[64];
-+ isc_uint16_t family;
-+ isc_uint8_t addrlen, addrbytes, scopelen;
-+
-+ family = isc_buffer_getuint16(&optbuf);
-+ addrlen = isc_buffer_getuint8(&optbuf);
-+ scopelen = isc_buffer_getuint8(&optbuf);
-+ addrbytes = (addrlen + 7) / 8;
-+ memset(addr, 0, sizeof(addr));
-+ for (i = 0; i < addrbytes; i ++)
-+ addr[i] = isc_buffer_getuint8(&optbuf);
-+
-+ ADD_STRING(target, "; CLIENT-SUBNET: ");
-+ if (family == 1)
-+ inet_ntop(AF_INET, addr, addr_text, sizeof(addr_text));
-+ else if (family == 2)
-+ inet_ntop(AF_INET6, addr, addr_text, sizeof(addr_text));
-+ else
-+ snprintf(addr_text, sizeof(addr_text),
-+ "Unsupported(family=%d)", family);
-+
-+ ADD_STRING(target, addr_text);
-+ sprintf(addr_text, "/%d/%d", addrlen, scopelen);
-+ ADD_STRING(target, addr_text);
-+
-+ /* Disable the dumb byte representation below. */
-+ optlen = 0;
- } else {
- ADD_STRING(target, "; OPT=");
- sprintf(buf, "%u", optcode);
================================================================
---- gitweb:
http://git.pld-linux.org/gitweb.cgi/packages/bind.git/commitdiff/0d5211d302a785c2ee6a2096cb06c6ed039b5e29
More information about the pld-cvs-commit
mailing list