packages/net/bind, branch master

bind: add version check override

2026-05-29T13:25:01Z

Add version check override script. Signed-off-by: George Sapkin

bind: bump to 9.20.23

2026-05-29T13:25:01Z

Resolves several security issues: - CVE-2026-3592: Limit resolver server list size. - CVE-2026-3039: Fix GSS-API resource leak. - CVE-2026-5950: Avoid unbounded recursion loop. - CVE-2026-5947: Fix crash in resolver when SIG(0)-signed responses are received under load. - CVE-2026-3593: Add system test for HTTP/2 SETTINGS frame flood. - CVE-2026-5946: Disable recursion, UPDATE, and NOTIFY for non-IN views. Complete list of changes is available upstream at https://ftp.isc.org/isc/bind9/9.20.23/doc/arm/html/changelog.html Signed-off-by: Noah Meyerhans

bind: prevent mismatch of bind-libs version

2026-04-07T18:59:27Z

When upgrading specific packages manually, like: apk upgrade bind-dig the bind-libs package is not upgraded automatically, which results in problems when running the program, for example: root@OpenWrt:~# dig Error loading shared library libisc-9.20.10.so: No such file or directory (needed by /usr/bin/dig) Error loading shared library libdns-9.20.10.so: No such file or directory (needed by /usr/bin/dig) Error loading shared library libisccfg-9.20.10.so: No such file or directory (needed by /usr/bin/dig) Error relocating /usr/bin/dig: cfg_map_getname: symbol not found Error relocating /usr/bin/dig: irs_resconf_getndots: symbol not found Error relocating /usr/bin/dig: isc_managers_destroy: symbol not found Error relocating /usr/bin/dig: dns_fixedname_init: symbol not found Error relocating /usr/bin/dig: isc_nm_read: symbol not found Error relocating /usr/bin/dig: dns_rdata_init: symbol not found Error relocating /usr/bin/dig: isc_random_uniform: symbol not found [...] This has happened to me twice on OpenWRT 24.10. To fix this, enforce that the version of bind-libs matches the version of any dependent packages. Use the same approach as in net/knot/Makefile: make the dependency be present twice, once in the DEPENDS variable, the other one in the EXTRA_DEPENDS variable. Also, add an explicit EXTRA_DEPENDS variable to other internal dependencies. For example, versions of the bind-server-filter-aaaa and bind-server packages must match. Tested on snapshot, on x86/64. Signed-off-by: Mateusz Jończyk

bind: bump to 9.20.21

2026-03-31T11:42:09Z

Fixes several security issues: - CVE-2026-1519 Fix unbounded NSEC3 iterations when validating referrals to unsigned delegations. - CVE-2026-3104 Fix memory leaks in code preparing DNSSEC proofs of non-existence. - CVE-2026-3119 Prevent a crash in code processing queries containing a TKEY record. - CVE-2026-3591 Fix a stack use-after-return flaw in SIG(0) handling code. Signed-off-by: Noah Meyerhans

bind: backport patch replace automatic empty zones

2026-02-01T14:01:50Z

The RFC-1918 zones are automatically synthesized locally by bind to avoid forwarding queries about them to root nameservers. As a result, we can't easily replace them with rndc addzone on the fly. We need this for DHCP integration. Signed-off-by: Philip Prindeville

bind: bump to 9.20.18

2026-01-24T08:05:56Z

Fixes security issues: - CVE-2025-13878: Malformed BRID and HHIT records could trigger an assertion failure. Signed-off-by: Noah Meyerhans

bind: manual fix for IPv6 server unreachable noise

2025-12-13T01:06:44Z

Until we have a failsafe way of detecting no IPv6 internet connectivity automatically, allow the users to set it manually for now. Signed-off-by: Philip Prindeville

bind: save out served domains on service stop

2025-12-06T21:05:05Z

If named gets stopped, then started again, but isc-dhcpd isn't also restarted, then we want named to at least have the existing content. Signed-off-by: Philip Prindeville

bind: bump to 9.20.15

2025-10-22T23:12:41Z

Fixes the following security issues: - CVE-2025-8677: DNSSEC validation fails if matching but invalid DNSKEY is found. - CVE-2025-40778 Address various spoofing attacks. - CVE-2025-40780 Cache-poisoning due to weak pseudo-random number generator. The complete list of changes from version 9.20.11 is available in the upstream changelog at https://ftp.isc.org/isc/bind9/9.20.15/doc/arm/html/changelog.html Signed-off-by: Noah Meyerhans

bind: don't break IPv6 support

2025-09-19T15:35:38Z

What started in #20183 as a attempt to clean up noise in the logfiles, turned out to be causing denial-of-service for dual-stack and especially IPv6-only environments. Breaking core network functionality cannot possibly be less important than cosmetic issues, and those affected by log spam can avoid it via other means (e.g. "query-source-v6 none;" in named.conf). There's no reliable heuristic for determining whether there's IPv6 connectivity at the time bind is started which will catch any and all corner cases, as discussed in #26327. So, remove this logic for now. If a suitable heuristic can be devised, it can always be added in a subsequent patch, but I have my doubts. (Also, quote one variable to make shellcheck happy) Closes: #26327 Closes: #20468 Signed-off-by: David Härdeman