- Restrict views to the Internet (IN) class. Views could previously be declared in classes other than Internet (IN), but that support was inconsistent - named-checkconf accepted configurations that named then refused to load. Views are now restricted to class IN, and both tools reject any other class. Configurations declaring a non-IN view must drop the class to keep working. [GL #5784]
-- Ondřej Surý (He/Him) [email protected] ADHD brain at work: I sometimes lose track of my inbox. Please feel free to send a gentle nudge if you're waiting on a reply! My working hours and your working hours may be different. Please do not feel obligated to reply outside your normal working hours. > On 23. 7. 2026, at 00:42, pgnd <[email protected]> wrote: > > hi > >> Look into the use of 'strace'. > > yep, had done that. a bit too noisy, and i missed this > > managed to get it to spit out to console > > /usr/local/bind9/bin/named -g -d 3 -u named -c > /usr/local/etc/named/named.conf; echo "exit=$?" > ... > 2026-07-22T17:54:48.919-04:00 load_configuration > 2026-07-22T17:54:48.920-04:00 parsing user configuration from > '/usr/local/etc/named/named.conf' > 2026-07-22T17:54:48.921-04:00 /usr/local/etc/named/named.conf:456: > view 'external-chaos': only Internet (IN) class is allowed > ... > 2026-07-22T17:54:48.923-04:00 loop exclusive mode: starting > 2026-07-22T17:54:48.923-04:00 loop exclusive mode: started > 2026-07-22T17:54:48.923-04:00 loading configuration: failure > 2026-07-22T17:54:48.923-04:00 exiting (due to fatal error) > exit=1 > > CHAOS *is* mentioned in release notes re: CVE-2026-5946 / GL #5752 -- > "Disable recursion, UPDATE, and NOTIFY for non-IN views." Non-IN views keep > authoritative service (version.bind etc. still answer); they lose recursion, > UPDATE, NOTIFY. > > my config includes > > @456 > view "external-chaos" chaos { > match-clients { any; }; > recursion no; > zone "." { type hint; file "/dev/null"; }; > zone "bind" { > type master; > file "namedb/primary/db.bind.zone"; > ... > }; > }; > > but that doesn't appear to _have_ recursion, UPDATE, NOTIFY ... so dunno what > the specific problem is. > > that chaos view i've had for sitting there for ages -- as best as I can > remember -- as "standard" version-disclosure hardening, blanking version.bind > and authors.bind to empty TXT records; nothing Chaosnet-specific. > > if i comment out the chaos block, i think this should now do the same > > options { > ... > version none; > hostname none; > server-id none; > ... > > those are valid. > and, in builtin.c, iiuc, a side effect of setting version to _anything_ > blanks authors.bind as well. > > > with that in place, v9.21.24 execs now. > > verifying > > dig version.bind CH TXT | grep -i status > ;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 38120 > dig hostname.bind CH TXT | grep -i status > ;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 49775 > dig id.server CH TXT | grep -i status > ;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 15665 > dig authors.bind CH TXT | grep -i status > ;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 23360 > > queries are (?) REFUSED, instead of empty replies from the prior chaos config. > > not yet clear what i _break_, if anything, by removing the chaos block. > -- > Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from > this list. -- Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list.
