v9.21.24 -- build OK, exec fails silently ?? v9.21.23 execs OK

[Ondřej Surý]

- Restrict views to the Internet (IN) class.

Views could previously be declared in classes other than Internet (IN), but that support was inconsistent - named-checkconf accepted configurations that named then refused to load. Views are now restricted to class IN, and both tools reject any other class. Configurations declaring a non-IN view must drop the class to keep working. [GL #5784]

--
Ondřej Surý (He/Him)
ondrej at isc.org

ADHD brain at work: I sometimes lose track of my inbox. Please feel free to send a gentle nudge if you're waiting on a reply!

My working hours and your working hours may be different. Please do not feel obligated to reply outside your normal working hours.

> On 23. 7. 2026, at 00:42, pgnd <pgnd at dev-mail.net> wrote:
> 
> hi
> 
>> Look into the use of 'strace'.
> 
> yep, had done that.  a bit too noisy, and i missed this
> 
> managed to get it to spit out to console
> 
>    /usr/local/bind9/bin/named -g -d 3 -u named -c /usr/local/etc/named/named.conf; echo "exit=$?"
>        ...
>        2026-07-22T17:54:48.919-04:00 load_configuration
>        2026-07-22T17:54:48.920-04:00 parsing user configuration from '/usr/local/etc/named/named.conf'
>        2026-07-22T17:54:48.921-04:00 /usr/local/etc/named/named.conf:456: view 'external-chaos': only Internet (IN) class is allowed
>        ...
>        2026-07-22T17:54:48.923-04:00 loop exclusive mode: starting
>        2026-07-22T17:54:48.923-04:00 loop exclusive mode: started
>        2026-07-22T17:54:48.923-04:00 loading configuration: failure
>        2026-07-22T17:54:48.923-04:00 exiting (due to fatal error)
>        exit=1
> 
> CHAOS *is* mentioned in release notes re: CVE-2026-5946 / GL #5752 -- "Disable recursion, UPDATE, and NOTIFY for non-IN views." Non-IN views keep authoritative service (version.bind etc. still answer); they lose recursion, UPDATE, NOTIFY.
> 
> my config includes
> 
> @456
>    view "external-chaos" chaos {
>        match-clients { any; };
>        recursion no;
>        zone "." { type hint; file "/dev/null"; };
>        zone "bind" {
>            type master;
>            file "namedb/primary/db.bind.zone";
>            ...
>        };
>    };
> 
> but that doesn't appear to _have_ recursion, UPDATE, NOTIFY ... so dunno what the specific problem is.
> 
> that chaos view i've had for sitting there for ages --  as best as I can remember -- as "standard" version-disclosure hardening, blanking version.bind and authors.bind to empty TXT records; nothing Chaosnet-specific.
> 
> if i comment out the chaos block, i think this should now do the same
> 
> options {
>    ...
>    version none;
>    hostname none;
>    server-id none;
>    ...
> 
> those are valid.
> and, in builtin.c, iiuc, a side effect of setting version to _anything_ blanks authors.bind  as well.
> 
> 
> with that in place, v9.21.24 execs now.
> 
> verifying
> 
>    dig version.bind   CH TXT | grep -i status
>        ;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 38120
>    dig hostname.bind  CH TXT | grep -i status
>        ;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 49775
>    dig id.server      CH TXT | grep -i status
>        ;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 15665
>    dig authors.bind   CH TXT | grep -i status
>        ;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 23360
> 
> queries are (?) REFUSED, instead of empty replies from the prior chaos config.
> 
> not yet clear what i _break_, if anything, by removing the chaos block.
> --
> Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list.