MRE Updates 9.18.12 / 9.16.39

Bug #2003586 reported by Lena Voytek
20
This bug affects 2 people
Affects Status Importance Assigned to Milestone
bind-dyndb-ldap (Ubuntu)
Fix Released
Undecided
Unassigned
Jammy
Fix Released
Undecided
Lena Voytek
Kinetic
Fix Released
Undecided
Lena Voytek
bind9 (Ubuntu)
Fix Released
Undecided
Unassigned
Focal
Fix Released
Undecided
Lena Voytek
Jammy
Fix Released
Undecided
Lena Voytek
Kinetic
Fix Released
Undecided
Lena Voytek

Bug Description

This bug tracks an update for the bind9 package, moving to versions:

* Kinetic (22.10): bind9 9.18.12
* Jammy (22.04): bind9 9.18.12
* Focal (20.04): bind9 9.16.39

These updates include bug fixes following the SRU policy exception defined at https://wiki.ubuntu.com/Bind9Updates.

[Upstream changes]

For bind9 9.18.2-9.18.12, major changes include:

CVE fixes (These already existed as patches but are now included as part of upstream):
CVE-2022-1183
CVE-2022-2795
CVE-2022-2881
CVE-2022-2906
CVE-2022-3080
CVE-2022-38178
CVE-2022-3094
CVE-2022-3736
CVE-2022-3924

Features:
update-quota option
named -V shows supported cryptographic algorithms
Additional info given for recursion not available and query (cache) '...' denied outputs

Jammy only (Kinetic already has these):
Catalog Zones schema version 2 support in named
DNS error support Stale Answer and Stale NXDOMAIN Answer
remote TLS certificate verification support
reusereport option

Bug Fixes:
https://gitlab.isc.org/isc-projects/bind9/-/issues/3178
https://gitlab.isc.org/isc-projects/bind9/-/issues/3636
https://gitlab.isc.org/isc-projects/bind9/-/issues/3772
https://gitlab.isc.org/isc-projects/bind9/-/issues/3752
https://gitlab.isc.org/isc-projects/bind9/-/issues/3678
https://gitlab.isc.org/isc-projects/bind9/-/issues/3637
https://gitlab.isc.org/isc-projects/bind9/-/issues/3739
https://gitlab.isc.org/isc-projects/bind9/-/issues/3743
https://gitlab.isc.org/isc-projects/bind9/-/issues/3725
https://gitlab.isc.org/isc-projects/bind9/-/issues/3693
https://gitlab.isc.org/isc-projects/bind9/-/issues/3683
https://gitlab.isc.org/isc-projects/bind9/-/issues/3727
https://gitlab.isc.org/isc-projects/bind9/-/issues/3638
https://gitlab.isc.org/isc-projects/bind9/-/issues/3183
https://gitlab.isc.org/isc-projects/bind9/-/issues/3721
https://gitlab.isc.org/isc-projects/bind9/-/issues/3707
https://gitlab.isc.org/isc-projects/bind9/-/issues/3591
https://gitlab.isc.org/isc-projects/bind9/-/issues/3598
https://gitlab.isc.org/isc-projects/bind9/-/issues/3247
https://gitlab.isc.org/isc-projects/bind9/-/issues/2895
https://gitlab.isc.org/isc-projects/bind9/-/issues/3584
https://gitlab.isc.org/isc-projects/bind9/-/issues/3627
https://gitlab.isc.org/isc-projects/bind9/-/issues/3563
https://gitlab.isc.org/isc-projects/bind9/-/issues/3603
https://gitlab.isc.org/isc-projects/bind9/-/issues/3542
https://gitlab.isc.org/isc-projects/bind9/-/issues/3557
https://gitlab.isc.org/isc-projects/bind9/-/issues/2982
https://gitlab.isc.org/isc-projects/bind9/-/issues/3439
https://gitlab.isc.org/isc-projects/bind9/-/issues/3438
https://gitlab.isc.org/isc-projects/bind9/-/issues/2918
https://gitlab.isc.org/isc-projects/bind9/-/issues/3462
https://gitlab.isc.org/isc-projects/bind9/-/issues/3400
https://gitlab.isc.org/isc-projects/bind9/-/issues/3402
https://gitlab.isc.org/isc-projects/bind9/-/issues/3152
https://gitlab.isc.org/isc-projects/bind9/-/issues/3415
https://gitlab.isc.org/isc-projects/bind9/-/issues/2506
Jammy only:
https://gitlab.isc.org/isc-projects/bind9/-/issues/3327
https://gitlab.isc.org/isc-projects/bind9/-/issues/3380
https://gitlab.isc.org/isc-projects/bind9/-/issues/3302
https://gitlab.isc.org/isc-projects/bind9/-/issues/2931
https://gitlab.isc.org/isc-projects/bind9/-/issues/3242
https://gitlab.isc.org/isc-projects/bind9/-/issues/3020
https://gitlab.isc.org/isc-projects/bind9/-/issues/3128
https://gitlab.isc.org/isc-projects/bind9/-/issues/3145
https://gitlab.isc.org/isc-projects/bind9/-/issues/3184
https://gitlab.isc.org/isc-projects/bind9/-/issues/3205
https://gitlab.isc.org/isc-projects/bind9/-/issues/3244
https://gitlab.isc.org/isc-projects/bind9/-/issues/3248
https://gitlab.isc.org/isc-projects/bind9/-/issues/3142
https://gitlab.isc.org/isc-projects/bind9/-/issues/3200

This will also fix bugs LP: #1258003, LP: #1970252, and LP: #2006972

Full release notes for versions 9.18.2-9.18.12: https://bind9.readthedocs.io/en/v9_18_12/notes.html#notes-for-bind-9-18-12

For bind9 9.16.2-9.16.39, major changes include:

CVE fixes (These already existed as patches but are now included as part of upstream):
CVE-2020-8616
CVE-2020-8617
CVE-2020-8618
CVE-2020-8619,
CVE-2020-8620
CVE-2020-8621
CVE-2020-8622
CVE-2020-8623
CVE-2020-8624
CVE-2020-8625
CVE-2021-25214
CVE-2021-25215
CVE-2021-25219
CVE-2021-25220
CVE-2022-2795
CVE-2022-38177
CVE-2022-38178
CVE-2022-3094

Features:
update-quota option
parental-agents configuration option
stale-refresh-time configuration option
stale-cache-enable configuration option
purge-keys and nsec3param options in dnssec-policy
max-ixfr-ratio option
stale-answer-client-timeout option
rndc dnssec -rollover command
rndc dnssec -checkds command
rndc dnssec -status command
support for HTTPS and SVCB record types
support for parsing and validating the dohpath service parameter in SVCB
named -V shows supported cryptographic algorithms
documentation converted from DocBook to reStructuredText.
dig Extended DNS Error (EDE) display

Bug Fixes:
https://gitlab.isc.org/isc-projects/bind9/-/issues/3678
https://gitlab.isc.org/isc-projects/bind9/-/issues/3683
https://gitlab.isc.org/isc-projects/bind9/-/issues/3727
https://gitlab.isc.org/isc-projects/bind9/-/issues/3183
https://gitlab.isc.org/isc-projects/bind9/-/issues/3707
https://gitlab.isc.org/isc-projects/bind9/-/issues/3591
https://gitlab.isc.org/isc-projects/bind9/-/issues/3598
https://gitlab.isc.org/isc-projects/bind9/-/issues/3247
https://gitlab.isc.org/isc-projects/bind9/-/issues/2895
https://gitlab.isc.org/isc-projects/bind9/-/issues/3584
https://gitlab.isc.org/isc-projects/bind9/-/issues/3563
https://gitlab.isc.org/isc-projects/bind9/-/issues/3603
https://gitlab.isc.org/isc-projects/bind9/-/issues/3557
https://gitlab.isc.org/isc-projects/bind9/-/issues/2982
https://gitlab.isc.org/isc-projects/bind9/-/issues/3438
https://gitlab.isc.org/isc-projects/bind9/-/issues/2918
https://gitlab.isc.org/isc-projects/bind9/-/issues/3462
https://gitlab.isc.org/isc-projects/bind9/-/issues/3400
https://gitlab.isc.org/isc-projects/bind9/-/issues/3398
https://gitlab.isc.org/isc-projects/bind9/-/issues/3327
https://gitlab.isc.org/isc-projects/bind9/-/issues/3380
https://gitlab.isc.org/isc-projects/bind9/-/issues/3302
https://gitlab.isc.org/isc-projects/bind9/-/issues/2931
https://gitlab.isc.org/isc-projects/bind9/-/issues/3142
https://gitlab.isc.org/isc-projects/bind9/-/issues/3200
https://gitlab.isc.org/isc-projects/bind9/-/issues/1897
https://gitlab.isc.org/isc-projects/bind9/-/issues/3132
https://gitlab.isc.org/isc-projects/bind9/-/issues/3147
https://gitlab.isc.org/isc-projects/bind9/-/issues/3095
https://gitlab.isc.org/isc-projects/bind9/-/issues/3060
https://gitlab.isc.org/isc-projects/bind9/-/issues/3125
https://gitlab.isc.org/isc-projects/bind9/-/issues/3111
https://gitlab.isc.org/isc-projects/bind9/-/issues/3051
https://gitlab.isc.org/isc-projects/bind9/-/issues/3049
https://gitlab.isc.org/isc-projects/bind9/-/issues/3071
https://gitlab.isc.org/isc-projects/bind9/-/issues/1608
https://gitlab.isc.org/isc-projects/bind9/-/issues/2308
https://gitlab.isc.org/isc-projects/bind9/-/issues/2911
https://gitlab.isc.org/isc-projects/bind9/-/issues/2852
https://gitlab.isc.org/isc-projects/bind9/-/issues/2872
https://gitlab.isc.org/isc-projects/bind9/-/issues/2878
https://gitlab.isc.org/isc-projects/bind9/-/issues/2837
https://gitlab.isc.org/isc-projects/bind9/-/issues/2665
https://gitlab.isc.org/isc-projects/bind9/-/issues/2857
https://gitlab.isc.org/isc-projects/bind9/-/issues/2844
https://gitlab.isc.org/isc-projects/bind9/-/issues/2756
https://gitlab.isc.org/isc-projects/bind9/-/issues/2686
https://gitlab.isc.org/isc-projects/bind9/-/issues/2759
https://gitlab.isc.org/isc-projects/bind9/-/issues/2758
https://gitlab.isc.org/isc-projects/bind9/-/issues/2725
https://gitlab.isc.org/isc-projects/bind9/-/issues/2780
https://gitlab.isc.org/isc-projects/bind9/-/issues/1875
https://gitlab.isc.org/isc-projects/bind9/-/issues/2783
https://gitlab.isc.org/isc-projects/bind9/-/issues/2786
https://gitlab.isc.org/isc-projects/bind9/-/issues/2779
https://gitlab.isc.org/isc-projects/bind9/-/issues/2778
https://gitlab.isc.org/isc-projects/bind9/-/issues/2685
https://gitlab.isc.org/isc-projects/bind9/-/issues/2733
https://gitlab.isc.org/isc-projects/bind9/-/issues/2731
https://gitlab.isc.org/isc-projects/bind9/-/issues/2746
https://gitlab.isc.org/isc-projects/bind9/-/issues/2463
https://gitlab.isc.org/isc-projects/bind9/-/issues/1875
https://gitlab.isc.org/isc-projects/bind9/-/issues/2670
https://gitlab.isc.org/isc-projects/bind9/-/issues/389
https://gitlab.isc.org/isc-projects/bind9/-/issues/2289
https://gitlab.isc.org/isc-projects/bind9/-/issues/2626
https://gitlab.isc.org/isc-projects/bind9/-/issues/2603
https://gitlab.isc.org/isc-projects/bind9/-/issues/2596
https://gitlab.isc.org/isc-projects/bind9/-/issues/2628
https://gitlab.isc.org/isc-projects/bind9/-/issues/2583
https://gitlab.isc.org/isc-projects/bind9/-/issues/2594
https://gitlab.isc.org/isc-projects/bind9/-/issues/2623
https://gitlab.isc.org/isc-projects/bind9/-/issues/2600
https://gitlab.isc.org/isc-projects/bind9/-/issues/2490
https://gitlab.isc.org/isc-projects/bind9/-/issues/2517
https://gitlab.isc.org/isc-projects/bind9/-/issues/2523
https://gitlab.isc.org/isc-projects/bind9/-/issues/2488
https://gitlab.isc.org/isc-projects/bind9/-/issues/2575
https://gitlab.isc.org/isc-projects/bind9/-/issues/2505
https://gitlab.isc.org/isc-projects/bind9/-/issues/2503
https://gitlab.isc.org/isc-projects/bind9/-/issues/2466
https://gitlab.isc.org/isc-projects/bind9/-/issues/2498
https://gitlab.isc.org/isc-projects/bind9/-/issues/2041
https://gitlab.isc.org/isc-projects/bind9/-/issues/2499
https://gitlab.isc.org/isc-projects/bind9/-/issues/2413
https://gitlab.isc.org/isc-projects/bind9/-/issues/2178
https://gitlab.isc.org/isc-projects/bind9/-/issues/2383
https://gitlab.isc.org/isc-projects/bind9/-/issues/2406
https://gitlab.isc.org/isc-projects/bind9/-/issues/2375
https://gitlab.isc.org/isc-projects/bind9/-/issues/2073
https://gitlab.isc.org/isc-projects/bind9/-/issues/2317
https://gitlab.isc.org/isc-projects/bind9/-/issues/2245
https://gitlab.isc.org/isc-projects/bind9/-/issues/2341
https://gitlab.isc.org/isc-projects/bind9/-/issues/2091
https://gitlab.isc.org/isc-projects/bind9/-/issues/2275
https://gitlab.isc.org/isc-projects/bind9/-/issues/2280
https://gitlab.isc.org/isc-projects/bind9/-/issues/2315
https://gitlab.isc.org/isc-projects/bind9/-/issues/2227
https://gitlab.isc.org/isc-projects/bind9/-/issues/2236
https://gitlab.isc.org/isc-projects/bind9/-/issues/2244
https://gitlab.isc.org/isc-projects/bind9/-/issues/1736
https://gitlab.isc.org/isc-projects/bind9/-/issues/2208
https://gitlab.isc.org/isc-projects/bind9/-/issues/2166
https://gitlab.isc.org/isc-projects/bind9/-/issues/2124
https://gitlab.isc.org/isc-projects/bind9/-/issues/2171
https://gitlab.isc.org/isc-projects/bind9/-/issues/2169
https://gitlab.isc.org/isc-projects/bind9/-/issues/2104
https://gitlab.isc.org/isc-projects/bind9/-/issues/1928
https://gitlab.isc.org/isc-projects/bind9/-/issues/1847
https://gitlab.isc.org/isc-projects/bind9/-/issues/2074
https://gitlab.isc.org/isc-projects/bind9/-/issues/1619
https://gitlab.isc.org/isc-projects/bind9/-/issues/2038
https://gitlab.isc.org/isc-projects/bind9/-/issues/1719
https://gitlab.isc.org/isc-projects/bind9/-/issues/1976
https://gitlab.isc.org/isc-projects/bind9/-/issues/1937
https://gitlab.isc.org/isc-projects/bind9/-/issues/1938
https://gitlab.isc.org/isc-projects/bind9/-/issues/1862
https://gitlab.isc.org/isc-projects/bind9/-/issues/1968
https://gitlab.isc.org/isc-projects/bind9/-/issues/1747
https://gitlab.isc.org/isc-projects/bind9/-/issues/1926
https://gitlab.isc.org/isc-projects/bind9/-/issues/1950
https://gitlab.isc.org/isc-projects/bind9/-/issues/1949
https://gitlab.isc.org/isc-projects/bind9/-/issues/1689
https://gitlab.isc.org/isc-projects/bind9/-/issues/1936
https://gitlab.isc.org/isc-projects/bind9/-/issues/1834
https://gitlab.isc.org/isc-projects/bind9/-/issues/1857
https://gitlab.isc.org/isc-projects/bind9/-/issues/1859
https://gitlab.isc.org/isc-projects/bind9/-/issues/1893
https://gitlab.isc.org/isc-projects/bind9/-/issues/1808
https://gitlab.isc.org/isc-projects/bind9/-/issues/1714
https://gitlab.isc.org/isc-projects/bind9/-/issues/1845
https://gitlab.isc.org/isc-projects/bind9/-/issues/1846
https://gitlab.isc.org/isc-projects/bind9/-/issues/1812
https://gitlab.isc.org/isc-projects/bind9/-/issues/1842
https://gitlab.isc.org/isc-projects/bind9/-/issues/1795
https://gitlab.isc.org/isc-projects/bind9/-/issues/1042
https://gitlab.isc.org/isc-projects/bind9/-/issues/1090
https://gitlab.isc.org/isc-projects/bind9/-/issues/1807
https://gitlab.isc.org/isc-projects/bind9/-/issues/1447
https://gitlab.isc.org/isc-projects/bind9/-/issues/1706

Full release notes for versions 9.16.2-9.16.37 (9.16.38, 9.16.39 not added):
https://bind9.readthedocs.io/en/v9_16_37/notes.html

[Test Plan]

DEP-8 Tests:

simpletest - Confirms bind9 daemon starts successfully and dig can find 127.0.0.1 through the default setup of bind9

zonetest - Added in this update, currently in lunar. Confirms the functionality of named and bind9 by creating a local DNS zone and domain, and having dig look it up

validation - This test is provided by Debian and consistently fails both before and after the update due to several issues. It is marked as flaky, and does not block autopkgtest passing overall

[Regression Potential]

Upstream has an extensive build and integration test suite. So regressions would likely arise from a change in interaction with Ubuntu-specific integrations. Alternatively, regressions may arise for users due to behavior changes from the many bug fixes and minor feature updates.

In Focal, there were major changes in how documentation is handled too, requiring packaging updates to handle it. So regressions could arise here too.

Related branches

Lena Voytek (lvoytek)
Changed in bind9 (Ubuntu):
status: New → Fix Released
Changed in bind9 (Ubuntu Focal):
assignee: nobody → Lena Voytek (lvoytek)
Changed in bind9 (Ubuntu Jammy):
assignee: nobody → Lena Voytek (lvoytek)
Changed in bind9 (Ubuntu Kinetic):
assignee: nobody → Lena Voytek (lvoytek)
Changed in bind9 (Ubuntu Jammy):
status: New → In Progress
Changed in bind9 (Ubuntu Kinetic):
status: New → In Progress
Lena Voytek (lvoytek)
summary: - MRE Updates 9.18.10 / 9.16.36
+ MRE Updates 9.18.11 / 9.16.36
Lena Voytek (lvoytek)
description: updated
Lena Voytek (lvoytek)
description: updated
Lena Voytek (lvoytek)
description: updated
Lena Voytek (lvoytek)
description: updated
summary: - MRE Updates 9.18.11 / 9.16.36
+ MRE Updates 9.18.12 / 9.16.36
Lena Voytek (lvoytek)
description: updated
Lena Voytek (lvoytek)
Changed in bind-dyndb-ldap (Ubuntu):
status: New → Fix Released
Changed in bind-dyndb-ldap (Ubuntu Kinetic):
status: New → In Progress
Changed in bind-dyndb-ldap (Ubuntu Jammy):
status: New → In Progress
assignee: nobody → Lena Voytek (lvoytek)
Changed in bind-dyndb-ldap (Ubuntu Focal):
assignee: nobody → Lena Voytek (lvoytek)
Changed in bind-dyndb-ldap (Ubuntu Kinetic):
assignee: nobody → Lena Voytek (lvoytek)
Lena Voytek (lvoytek)
description: updated
Steve Langasek (vorlon)
description: updated
description: updated
Revision history for this message
Steve Langasek (vorlon) wrote : Please test proposed package

Hello Lena, or anyone else affected,

Accepted bind9 into kinetic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/bind9/1:9.18.12-0ubuntu0.22.10.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-kinetic to verification-done-kinetic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-kinetic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Changed in bind9 (Ubuntu Kinetic):
status: In Progress → Fix Committed
tags: added: verification-needed verification-needed-kinetic
Revision history for this message
Steve Langasek (vorlon) wrote :

Hello Lena, or anyone else affected,

Accepted bind9 into jammy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/bind9/1:9.18.12-0ubuntu0.22.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-jammy to verification-done-jammy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-jammy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Changed in bind9 (Ubuntu Jammy):
status: In Progress → Fix Committed
tags: added: verification-needed-jammy
Revision history for this message
Ubuntu SRU Bot (ubuntu-sru-bot) wrote : Autopkgtest regression report (bind9/1:9.18.12-0ubuntu0.22.10.1)

All autopkgtests for the newly accepted bind9 (1:9.18.12-0ubuntu0.22.10.1) for kinetic have finished running.
The following regressions have been reported in tests triggered by the package:

testssl.sh/3.0.7+dfsg-1 (arm64)

Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1].

https://people.canonical.com/~ubuntu-archive/proposed-migration/kinetic/update_excuses.html#bind9

[1] https://wiki.ubuntu.com/StableReleaseUpdates#Autopkgtest_Regressions

Thank you!

Revision history for this message
Timo Aaltonen (tjaalton) wrote : Re: MRE Updates 9.18.12 / 9.16.36

Lena, I can help with the bind-dyndb-ldap backports. The version in lunar has everything, it should be backportable as-is to kinetic, but I wonder if the same would be fine for jammy too.

Revision history for this message
Sergio Durigan Junior (sergiodj) wrote : Re: [Bug 2003586] Re: MRE Updates 9.18.12 / 9.16.36

On Saturday, March 18 2023, Timo Aaltonen wrote:

> Lena, I can help with the bind-dyndb-ldap backports. The version in
> lunar has everything, it should be backportable as-is to kinetic, but I
> wonder if the same would be fine for jammy too.

Timo, Lena prepared an SRU for bind-dyndb-ldap for Jammy and Kinetic:

https://code.launchpad.net/~lvoytek/ubuntu/+source/bind-dyndb-ldap/+git/bind-dyndb-ldap/+merge/438637
https://code.launchpad.net/~lvoytek/ubuntu/+source/bind-dyndb-ldap/+git/bind-dyndb-ldap/+merge/438564

Everything is looking good; I was just waiting for bind9 to be accepted
because Lena's bind-dyndb-ldap won't build with bind9 < 9.18.12. Now
that both packages are in -proposed, I'll upload her changes soon.

--
Sergio
GPG key ID: E92F D0B3 6B14 F1F4 D8E0 EB2F 106D A1C8 C3CB BF14

Revision history for this message
Timo Aaltonen (tjaalton) wrote : Re: MRE Updates 9.18.12 / 9.16.36

oh cool, I missed those.. yes they look fine to me too.

Revision history for this message
Simon Déziel (sdeziel) wrote :

I've tested the Jammy -proposed package and it works well here:

The following packages will be upgraded:
   bind9 (1:9.18.1-1ubuntu1.3 => 1:9.18.12-0ubuntu0.22.04.1)
   bind9-dnsutils (1:9.18.1-1ubuntu1.3 => 1:9.18.12-0ubuntu0.22.04.1)
   bind9-host (1:9.18.1-1ubuntu1.3 => 1:9.18.12-0ubuntu0.22.04.1)
   bind9-libs (1:9.18.1-1ubuntu1.3 => 1:9.18.12-0ubuntu0.22.04.1)
   bind9-utils (1:9.18.1-1ubuntu1.3 => 1:9.18.12-0ubuntu0.22.04.1)
5 upgraded, 0 newly installed, 0 to remove and 13 not upgraded.
Need to get 1,870 kB of archives.

The journal output looks good:

Mar 20 17:31:30 bind named[1088]: all zones loaded
Mar 20 17:31:30 bind named[1088]: running

It successfully loaded my 28 zones (most of them using DNSSEC) and was able to transfer zones properly.

# rndc status
version: BIND 9.18.12-0ubuntu0.22.04.1-Ubuntu (Extended Support Version) <id:> (version.bind/txt/ch disabled)
running on bind: Linux x86_64 5.19.0-35-generic #36~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Fri Feb 17 15:17:25 UTC 2
boot time: Mon, 20 Mar 2023 17:31:30 GMT
last configured: Mon, 20 Mar 2023 17:31:30 GMT
configuration file: /etc/bind/named.conf
CPUs found: 2
worker threads: 2
UDP listeners per interface: 2
number of zones: 28 (0 automatic)
debug level: 0
xfers running: 0
xfers deferred: 0
soa queries in progress: 0
query logging is OFF
recursive clients: 0/900/1000
tcp clients: 0/150
TCP high-water: 5
server is up and running

tags: added: verification-done-jammy
removed: verification-needed-jammy
Revision history for this message
Lena Voytek (lvoytek) wrote :

Verified for Kinetic:

verified for bugs:
(LP: #2003584)
(LP: #2006972)
(LP: #1258003)
(LP: #1970252)

DEP-8 Tests work as expected:

autopkgtest [21:02:38]: @@@@@@@@@@@@@@@@@@@@ summary
simpletest PASS
validation FLAKY non-zero exit status 1
zonetest PASS

tags: added: verification-done verification-done-kinetic
removed: verification-needed verification-needed-kinetic
Revision history for this message
Timo Aaltonen (tjaalton) wrote : Please test proposed package

Hello Lena, or anyone else affected,

Accepted bind-dyndb-ldap into kinetic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/bind-dyndb-ldap/11.10-1ubuntu0.22.10.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-kinetic to verification-done-kinetic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-kinetic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Changed in bind-dyndb-ldap (Ubuntu Kinetic):
status: In Progress → Fix Committed
tags: added: verification-needed verification-needed-kinetic
removed: verification-done verification-done-kinetic
Revision history for this message
Timo Aaltonen (tjaalton) wrote :

Hello Lena, or anyone else affected,

Accepted bind-dyndb-ldap into jammy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/bind-dyndb-ldap/11.9-5ubuntu0.22.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-jammy to verification-done-jammy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-jammy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Changed in bind-dyndb-ldap (Ubuntu Jammy):
status: In Progress → Fix Committed
tags: added: verification-needed-jammy
removed: verification-done-jammy
Revision history for this message
Lena Voytek (lvoytek) wrote : Re: MRE Updates 9.18.12 / 9.16.36

Verified installation success for Jammy and kinetic:

# lxc launch images:ubuntu/jammy test-bind-dyndb-ldap
# lxc exec test-bind-dyndb-ldap bash
# apt update && apt dist-upgrade -y

# apt install -y bind9-dyndb-ldap
...
The following packages have unmet dependencies:
 bind9-dyndb-ldap : Depends: bind9-libs (= 1:9.18.1-1ubuntu1) but 1:9.18.1-1ubuntu1.3 is to be installed
E: Unable to correct problems, you have held broken packages.

# cat <<EOF >/etc/apt/sources.list.d/ubuntu-$(lsb_release -cs)-proposed.list
# Enable Ubuntu proposed archive
deb http://archive.ubuntu.com/ubuntu/ $(lsb_release -cs)-proposed restricted main multiverse universe
EOF

# apt update && apt dist-upgrade -y
# apt install -y bind9-dyndb-ldap
install succeeds

# lxc launch images:ubuntu/kinetic test-bind-dyndb-ldap
# lxc exec test-bind-dyndb-ldap bash
# apt update && apt dist-upgrade -y

# apt install -y bind9-dyndb-ldap
...
The following packages have unmet dependencies:
 bind9-dyndb-ldap : Depends: bind9-libs (= 1:9.18.4-2ubuntu2) but 1:9.18.4-2ubuntu2.1 is to be installed
E: Unable to correct problems, you have held broken packages.

# cat <<EOF >/etc/apt/sources.list.d/ubuntu-$(lsb_release -cs)-proposed.list
# Enable Ubuntu proposed archive
deb http://archive.ubuntu.com/ubuntu/ $(lsb_release -cs)-proposed restricted main multiverse universe
EOF

# apt update && apt dist-upgrade -y
# apt install -y bind9-dyndb-ldap
install succeeds

tags: added: verification-done verification-done-jammy verification-done-kinetic
removed: verification-needed verification-needed-jammy verification-needed-kinetic
Revision history for this message
Launchpad Janitor (janitor) wrote :
Download full text (3.3 KiB)

This bug was fixed in the package bind9 - 1:9.18.12-0ubuntu0.22.04.1

---------------
bind9 (1:9.18.12-0ubuntu0.22.04.1) jammy; urgency=medium

  * New upstream releases 9.18.2 - 9.18.12 (LP: #2003586)
    - Updates:
      + update-quota option
      + named -V shows supported cryptographic algorithms
      + Catalog Zones schema version 2 support in named
      + DNS error support Stale Answer and Stale NXDOMAIN Answer
      + Remote TLS certificate verification support
      + reusereport option
    - Bug Fixes Include:
      + Fix crash when using dig with +nssearch and +tcp (LP: #1258003)
      + Fix incomplete results using dig with +nssearch (LP: #1970252)
      + Fix loading of preinstalled plugins (LP: #2006972)
      + CVE-2022-2795, CVE-2022-2881, CVE-2022-2906, CVE-2022-3080,
        CVE-2022-38178, CVE-2022-3094, CVE-2022-3736, CVE-2022-3924,
        CVE-2022-1183
      + Fix thread safety in dns_dispatch
      + Fix ADB quota management in resolver
      + Fix Prohibited DNS error on allow-recursion
      + Fix crash when restarting server with active statschannel connection
      + Fix use after free for catalog zone processing
      + Fix leak of dns_keyfileio_t objects
      + Fix nslookup failure to use port option when record type ANY is used
      + Fix crash on dnssec-policy zone with NSEC3 and inline-signing turned on
      + Fix inheritance when setting remote server port
      + Fix assertion error when accessing statistics channel
      + Fix rndc dumpdb -expired for stuck cache
      + Fix check for other name servers after receiving FORMERR
      + Fix deletion of CDS after zone sign
      + Fix dighost query context management
      + Fix dig hanging due to IPv4 mapped IPv6 address
      + See https://bind9.readthedocs.io/en/v9_18_12/notes.html#notes-for-bind-9-18-12
        for additional bug fixes and information
  * Improve dep-8 test suite (LP: #2003584):
    - d/t/zonetest: Add dep8 test for checking the domain zone creation process
    - d/t/control: Add new test outline
  * d/bind9-doc.docs: Stop installing removed file doc/misc/options.active
  * Remove patches for bugs LP #1964400 and LP #1964686 fixed upstream:
    - lp1964400-lp1964686-Fix-an-issue-in-dig-when-retrying-with-the-next-serv
    - lp1964400-lp1964686-When-resending-a-UDP-request-insert-the-query-to-the
    - lp1964400-lp1964686-Add-digdelv-system-test-to-check-timed-out-result-fo
    - lp1964400-lp1964686-After-dig-request-errors-try-to-use-other-servers-wh
    - lp1964400-lp1964686-Add-digdelv-system-test-to-check-that-dig-tries-othe
    - lp1964400-lp1964686-Fix-dig-error-when-trying-the-next-server-after-a-TC
    - lp1964400-lp1964686-Add-various-dig-host-tests-for-TCP-UDP-socket-error-
  * Remove CVE patches fixed upstream:
    - debian/patches/CVE-2022-1183.patch
      [Included in upstream release 9.18.3]
    - debian/patches/CVE-2022-2795.patch
    - debian/patches/CVE-2022-2881.patch
    - debian/patches/CVE-2022-2906.patch
    - debian/patches/CVE-2022-3080.patch
    - debian/patches/CVE-2022-38178.patch
      [Included in upstream release 9.18.7]
    - debian/patches/CVE-2022-3094.patch
    - debian/patches/CVE-2022-3736.patch
    -...

Read more...

Changed in bind9 (Ubuntu Jammy):
status: Fix Committed → Fix Released
Revision history for this message
Chris Halse Rogers (raof) wrote : Update Released

The verification of the Stable Release Update for bind9 has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

Revision history for this message
Launchpad Janitor (janitor) wrote : Re: MRE Updates 9.18.12 / 9.16.36

This bug was fixed in the package bind9 - 1:9.18.12-0ubuntu0.22.10.1

---------------
bind9 (1:9.18.12-0ubuntu0.22.10.1) kinetic; urgency=medium

  * New upstream releases 9.18.5 - 9.18.12 (LP: #2003586)
    - Updates:
      + update-quota option
      + named -V shows supported cryptographic algorithms
    - Bug Fixes Include:
      + Fix crash when using dig with +nssearch and +tcp (LP: #1258003)
      + Fix incomplete results using dig with +nssearch (LP: #1970252)
      + CVE-2022-2795, CVE-2022-2881, CVE-2022-2906, CVE-2022-3080,
        CVE-2022-38178, CVE-2022-3094, CVE-2022-3736, CVE-2022-3924
      + Fix thread safety in dns_dispatch
      + Fix ADB quota management in resolver
      + Fix Prohibited DNS error on allow-recursion
      + Fix crash when restarting server with active statschannel connection
      + Fix use after free for catalog zone processing
      + Fix leak of dns_keyfileio_t objects
      + Fix nslookup failure to use port option when record type ANY is used
      + Fix crash on dnssec-policy zone with NSEC3 and inline-signing turned on
      + Fix inheritance when setting remote server port
      + Fix assertion error when accessing statistics channel
      + Fix rndc dumpdb -expired for stuck cache
      + Fix check for other name servers after receiving FORMERR
      + See https://bind9.readthedocs.io/en/v9_18_12/notes.html#notes-for-bind-9-18-12
        for additional bug fixes and information
  * Improve dep-8 test suite (LP: #2003584):
    - d/t/zonetest: Add dep8 test for checking the domain zone creation process
    - d/t/control: Add new test outline
  * d/bind9-doc.docs: Stop installing removed file doc/misc/options.active
  * d/p/0001-Disable-treat-warnings-as-errors-in-sphinx-build.patch: refresh to
    apply with version 9.18.8
  * Remove CVE patches fixed upstream:
    - debian/patches/CVE-2022-2795.patch
    - debian/patches/CVE-2022-2881.patch
    - debian/patches/CVE-2022-2906.patch
    - debian/patches/CVE-2022-3080.patch
    - debian/patches/CVE-2022-38178.patch
      [Included in upstream release 9.18.7]
    - debian/patches/CVE-2022-3094.patch
    - debian/patches/CVE-2022-3736.patch
    - debian/patches/CVE-2022-3924.patch
      [Included in upstream release 9.18.11]

 -- Lena Voytek <email address hidden> Wed, 08 Mar 2023 08:49:53 -0700

Changed in bind9 (Ubuntu Kinetic):
status: Fix Committed → Fix Released
Lena Voytek (lvoytek)
description: updated
Lena Voytek (lvoytek)
no longer affects: bind-dyndb-ldap (Ubuntu Focal)
Changed in bind9 (Ubuntu Focal):
status: New → In Progress
Lena Voytek (lvoytek)
summary: - MRE Updates 9.18.12 / 9.16.36
+ MRE Updates 9.18.12 / 9.16.39
description: updated
Revision history for this message
Andreas Hasenack (ahasenack) wrote (last edit ):

Hi all,

what's the test plan for bind-dyndb-ldap? It's not in the bug description. From a few comments, I see that it was just an install test? That's a bit superficial, specially given the amount of patches that it got. There are also no DEP8 tests, nor build-time tests.

I think we need a test run to show that bind can actually start with this plugin loaded. Not just a simple installation test, which is just about dependencies. Just installing the bind9-dyndb-ldap package doesn't cause bind9 to load the module. There could be unresolved symbols or even crashes at load time which we wouldn't know about if we just install the package.

I suggest to follow this guide: https://wiki.debian.org/LDAP/OpenLDAPSetup#DNS.2FBind9

It relies on the schema and example ldif files shipped with the package, which, incidentally, don't work out of the box with openldap. This being a Redhat project, these files are customized for their LDAP server (389, purchased years ago from Netscape). That debian wiki has some "sed"s to adjust the config for openldap.

It still needs some tiny changes for ubuntu, though:
- admin dn is cn=admin,dc=example,dc=com (and not uid=admin,...)
- the named apparmor profile needs to allow connecting to the ldapi:/// (or just switch to ldap://)
- I'd suggest to use example.fake instead of example.com, because there is a real example.com, but that's minor

This can even become a DEP8 test (hint!)

Revision history for this message
Andreas Hasenack (ahasenack) wrote :

I flipped the tags back to verification-needed, but this applies to bind-dyndb-ldap, not bind (which was already released for jammy and kinetic even).

tags: added: verification-needed-jammy verification-needed-kinetic
removed: verification-done-jammy verification-done-kinetic
Revision history for this message
Lena Voytek (lvoytek) wrote (last edit ):
Download full text (3.2 KiB)

Verified for Jammy + Kinetic based on https://wiki.debian.org/LDAP/OpenLDAPSetup#DNS.2FBind9
I've also started on a DEP-8 test based on my testing

# lxc launch images:ubuntu/{kinetic, jammy} test-bind-dyndb-ldap
# lxc exec test-bind-dyndb-ldap bash

# apt update && apt dist-upgrade -y

# cat <<EOF >/etc/apt/sources.list.d/ubuntu-$(lsb_release -cs)-proposed.list
# Enable Ubuntu proposed archive
deb http://archive.ubuntu.com/ubuntu/ $(lsb_release -cs)-proposed restricted main multiverse universe
EOF

# apt update && apt upgrade -y
# apt install bind9 bind9-dyndb-ldap bind9-dnsutils slapd ldap-utils -y

> Enter new LDAP password

> Update /etc/ldap/ldap.conf to have
BASE dc=test,dc=local
URI ldap://ldap.test.local

# zcat /usr/share/doc/bind9-dyndb-ldap/schema.ldif.gz | sed 's/^attributeTypes:/olcAttributeTypes:/;
 s/^objectClasses:/olcObjectClasses:/;
 1,/1.3.6.1.4.1.2428.20.0.0/ {/1.3.6.1.4.1.2428.20.0.0/!s/^/#/};
 1idn: cn=dns,cn=schema,cn=config\nobjectClass: olcSchemaConfig
' >> /tmp/dns.schema

# ldapadd -Q -Y EXTERNAL -H ldapi:/// -f /tmp/dns.schema

adding new entry "cn=dns,cn=schema,cn=config"

ldapmodify -Q -Y EXTERNAL -H ldapi:/// <<EOF
dn: cn=module{0},cn=config
changetype: modify
add: olcModuleLoad
olcModuleLoad: syncprov
EOF

modifying entry "cn=module{0},cn=config"

# ldapmodify -Q -Y EXTERNAL -H ldapi:/// <<EOF
dn: olcOverlay=syncprov,olcDatabase={1}mdb,cn=config
changeType: add
objectClass: olcOverlayConfig
objectClass: olcSyncProvConfig
olcOverlay: syncprov
olcSpCheckpoint: 100 10
olcSpSessionLog: 100
EOF

adding new entry "olcOverlay=syncprov,olcDatabase={1}mdb,cn=config"

ldapadd -x -D cn=admin,dc=test,dc=local -W <<EOF
# Top container
dn: cn=dns, dc=test, dc=local
objectClass: nsContainer
objectClass: top
cn: dns

# Zone test.local
dn: idnsName=test.local, cn=dns, dc=test, dc=local
objectClass: top
objectClass: idnsZone
objectClass: idnsRecord
idnsName: test.local
idnsUpdatePolicy: grant TEST.LOCAL krb5-self * A;
idnsZoneActive: TRUE
idnsSOAmName: server.test.local
idnsSOArName: root.server.test.local
idnsSOAserial: 1
idnsSOArefresh: 10800
idnsSOAretry: 900
idnsSOAexpire: 604800
idnsSOAminimum: 86400
NSRecord: test.local.
ARecord: 127.0.0.1

# DNS records for zone test.local
dn: idnsName=server, idnsName=test.local, cn=dns, dc=test, dc=local
objectClass: idnsRecord
objectClass: top
idnsName: server
CNAMERecord: test.local.

dn: idnsName=_ldap._tcp, idnsName=test.local, cn=dns, dc=test, dc=local
objectClass: idnsRecord
objectClass: top
idnsName: _ldap._tcp
SRVRecord: 0 100 389 server
EOF

adding new entry "ou=Services,dc=test,dc=local"

adding new entry "ou=dns,ou=Services,dc=test,dc=local"

adding new entry "idnsName=test.local,ou=dns,ou=Services,dc=test,dc=local"

adding new entry "idnsName=_ldap._tcp,idnsName=test.local,ou=dns,ou=Services,dc=test,dc=local"

> Add the following to /etc/bind/named.conf.local

dyndb "test_local_ldap" "/usr/lib/bind/ldap.so" {
        uri "ldapi:///";
        base "ou=dns,ou=Services,dc=test,dc=local";
        auth_method "simple";
        bind_dn "uid=admin,dc=test,dc=local";
        password "ldappassword";
        server_id "server";
};

# systemctl restart bind9

# dig test.local. ...

Read more...

tags: added: verification-done-jammy verification-done-kinetic
removed: verification-needed-jammy verification-needed-kinetic
Revision history for this message
Andreas Hasenack (ahasenack) wrote :

I verified the test results for bind-dyndb-ldap and am satisfied that they show the executed planned test case, and that the results are correct.

I noticed that this upload happens to (very probably) also fix bug #1978849, which was missed in the changelog/changes file. I added a comment to the bug asking for verification from the reporters.

The package built correctly in all architectures and Ubuntu releases it was meant for.

This package does not have DEP8 tests (yet: they are coming!)

There is no SRU freeze ongoing at the moment.

There is no halted phasing on the previous update.

Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package bind-dyndb-ldap - 11.10-1ubuntu0.22.10.1

---------------
bind-dyndb-ldap (11.10-1ubuntu0.22.10.1) kinetic; urgency=medium

  * Fix bind-dyndb-ldap build against bind9 9.18.12 (LP: #2003586):
    - d/p/hardcode-version.diff: Update defined LIBDNS version from bind9 to be
      1812, provided by bind9 9.18.12
    - d/p/fix-dns_db_allrdatasets.patch: Modify calls to dns_db_allrdatasets()
      for bind9 9.18.10+ since the function has a new parameter
    - d/p/fix-include.patch: Include isc/rwlock.h in dns/zt.h to fix build
      since isrwlock is used in this file
    - d/p/fix-isc-error.patch: Fix the use of the fatal_error macro as its
      arguments have changed
    - d/p/make-dscp-optional.patch: Do not require DSCP codes for bind9 9.18.11
      and above as their support was removed in that version
    - d/control: Require bind9 9.18.12 or above

 -- Lena Voytek <email address hidden> Wed, 08 Mar 2023 14:52:32 -0700

Changed in bind-dyndb-ldap (Ubuntu Kinetic):
status: Fix Committed → Fix Released
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package bind-dyndb-ldap - 11.9-5ubuntu0.22.04.1

---------------
bind-dyndb-ldap (11.9-5ubuntu0.22.04.1) jammy; urgency=medium

  * Fix bind-dyndb-ldap build against bind9 9.18.12 (LP: #2003586):
    - d/p/hardcode-version.diff: Update defined LIBDNS version from bind9 to be
      1812, provided by bind9 9.18.12
    - d/p/fix-dns_db_allrdatasets.patch: Modify calls to dns_db_allrdatasets()
      for bind9 9.18.10+ since the function has a new parameter
    - d/p/fix-include.patch: Include isc/rwlock.h in dns/zt.h to fix build
      since isrwlock is used in this file
    - d/p/fix-isc-error.patch: Fix the use of the fatal_error macro as its
      arguments have changed
    - d/p/make-dscp-optional.patch: Do not require DSCP codes for bind9 9.18.11
      and above as their support was removed in that version
    - d/control: Require bind9 9.18.12 or above

 -- Lena Voytek <email address hidden> Thu, 09 Mar 2023 15:06:25 -0700

Changed in bind-dyndb-ldap (Ubuntu Jammy):
status: Fix Committed → Fix Released
Revision history for this message
Lena Voytek (lvoytek) wrote :

Focal was updated to the latest 9.16.x version by security in 1:9.16.48-0ubuntu0.20.04.1, marking fix released

Changed in bind9 (Ubuntu Focal):
status: In Progress → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.