hi
Look into the use of 'strace'.
yep, had done that. a bit too noisy, and i missed this
managed to get it to spit out to console
/usr/local/bind9/bin/named -g -d 3 -u named -c /usr/local/etc/named/named.conf;
echo "exit=$?"
...
2026-07-22T17:54:48.919-04:00 load_configuration
2026-07-22T17:54:48.920-04:00 parsing user configuration from
'/usr/local/etc/named/named.conf'
2026-07-22T17:54:48.921-04:00
/usr/local/etc/named/named.conf:456: view 'external-chaos': only Internet (IN)
class is allowed
...
2026-07-22T17:54:48.923-04:00 loop exclusive mode: starting
2026-07-22T17:54:48.923-04:00 loop exclusive mode: started
2026-07-22T17:54:48.923-04:00 loading configuration: failure
2026-07-22T17:54:48.923-04:00 exiting (due to fatal error)
exit=1
CHAOS *is* mentioned in release notes re: CVE-2026-5946 / GL #5752 -- "Disable
recursion, UPDATE, and NOTIFY for non-IN views." Non-IN views keep authoritative
service (version.bind etc. still answer); they lose recursion, UPDATE, NOTIFY.
my config includes
@456
view "external-chaos" chaos {
match-clients { any; };
recursion no;
zone "." { type hint; file "/dev/null"; };
zone "bind" {
type master;
file "namedb/primary/db.bind.zone";
...
};
};
but that doesn't appear to _have_ recursion, UPDATE, NOTIFY ... so dunno what
the specific problem is.
that chaos view i've had for sitting there for ages -- as best as I can remember -- as
"standard" version-disclosure hardening, blanking version.bind and authors.bind
to empty TXT records; nothing Chaosnet-specific.
if i comment out the chaos block, i think this should now do the same
options {
...
version none;
hostname none;
server-id none;
...
those are valid.
and, in builtin.c, iiuc, a side effect of setting version to _anything_ blanks
authors.bind as well.
with that in place, v9.21.24 execs now.
verifying
dig version.bind CH TXT | grep -i status
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 38120
dig hostname.bind CH TXT | grep -i status
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 49775
dig id.server CH TXT | grep -i status
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 15665
dig authors.bind CH TXT | grep -i status
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 23360
queries are (?) REFUSED, instead of empty replies from the prior chaos config.
not yet clear what i _break_, if anything, by removing the chaos block.
--
Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from
this list.
