Bug 2392413 - Server does not offer addresses when more than 13 NS
Summary: Server does not offer addresses when more than 13 NS
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: bind
Version: rawhide
Hardware: Unspecified
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Petr Menšík
QA Contact: Fedora Extras Quality Assurance
URL: https://gitlab.isc.org/isc-projects/b...
Whiteboard:
Depends On: 2342891
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-09-01 15:08 UTC by Petr Menšík
Modified: 2025-09-20 00:19 UTC (History)
5 users (show)

Fixed In Version: bind-9.18.39-2.fc42 bind-9.18.39-3.fc41.1 bind-9.18.39-4.fc43
Clone Of:
Environment:
Last Closed: 2025-09-07 00:52:12 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Internet Systems Consortium (ISC) isc-projects bind9 issues 5250 0 None opened CVE-2024-11187 regression: not offering any additional records with 14+ NS in zone apex 2025-09-01 15:09:27 UTC
Internet Systems Consortium (ISC) isc-projects bind9 merge_requests 10611 0 None opened fix: usr: Limit number of additional records fetched 2025-09-01 15:09:27 UTC
Red Hat Issue Tracker RHEL-84006 0 None None None 2025-09-01 15:09:27 UTC

Description Petr Menšík 2025-09-01 15:08:33 UTC
Windows DNS Server requires for it Stub zone type answers of NS query, including at least some addresses in additional section. It seems it can cope with just partial response, but needs at least some.

Unlike bind9 itself, it cannot query addresses later. It assumes addresses are always present and done under TCP.

This is just public issue for originally RHEL internal issue:
https://issues.redhat.com/browse/RHEL-84006

Upstream issue and code proposal:
- https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/10611
- https://gitlab.isc.org/isc-projects/bind9/-/issues/5250

So far this is not yet processed upstream, but applied downstream in Fedora already.

Reproducible: Always

Steps to Reproduce:
1. have 14+ NS servers if your auth zone example.com
2. dig @localhost -t NS example.com
3.
Actual Results:
No addresses in additional section

Expected Results:
At least some addresses in additional section. Otherwise Windows DNS server cannot have Stub zone entry pointing to that server and working resolution on it.

Comment 1 Petr Menšík 2025-09-01 15:28:40 UTC
This problem were introduced by fix for CVE-2024-11187, which limits amount of work server will do for single query. Authoritative servers do not have cached addresses of their NS servers, Unlike true delegation of child zone. Therefore it has to fetch address for both A and AAAA records. To prevent this to be misused for increased load of DNS server, bind stopped fetching any NS address if more than 13 servers is present in a zone.

Problem with that is Microsoft DNS Server has no workaround now. If you want to have configured stub zone in it, it has to return also addresses in additional section. If that zone has more than 13 servers, bind would not offer additional addresses. Windows cannot handle that situation and would fail such zone.

This change allows at least some workaround. Instead of not fetching any address, limit number of fetched addresses instead. If there is more, return just first 13 addresses. Unless minimal-answers is enabled, return partial answer to workaround windows issue.

Comment 2 Fedora Update System 2025-09-03 10:20:51 UTC
FEDORA-2025-1b15972c16 (bind-9.18.39-2.fc44 and bind-dyndb-ldap-11.11-7.fc44) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2025-1b15972c16

Comment 3 Fedora Update System 2025-09-03 10:53:42 UTC
FEDORA-2025-38c04b3b25 (bind-9.18.39-2.fc43 and bind-dyndb-ldap-11.11-7.fc43) has been submitted as an update to Fedora 43.
https://bodhi.fedoraproject.org/updates/FEDORA-2025-38c04b3b25

Comment 4 Fedora Update System 2025-09-03 12:06:11 UTC
FEDORA-2025-5b1c106084 (bind-9.18.39-2.fc42 and bind-dyndb-ldap-11.11-6.fc42) has been submitted as an update to Fedora 42.
https://bodhi.fedoraproject.org/updates/FEDORA-2025-5b1c106084

Comment 5 Fedora Update System 2025-09-04 01:12:27 UTC
FEDORA-2025-38c04b3b25 has been pushed to the Fedora 43 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-38c04b3b25`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-38c04b3b25

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 6 Fedora Update System 2025-09-04 01:48:17 UTC
FEDORA-2025-5b1c106084 has been pushed to the Fedora 42 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-5b1c106084`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-5b1c106084

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 7 Fedora Update System 2025-09-07 00:52:12 UTC
FEDORA-2025-5b1c106084 (bind-9.18.39-2.fc42 and bind-dyndb-ldap-11.11-6.fc42) has been pushed to the Fedora 42 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 8 Fedora Update System 2025-09-08 14:41:02 UTC
FEDORA-2025-1b15972c16 (bind-9.18.39-2.fc44 and bind-dyndb-ldap-11.11-7.fc44) has been pushed to the Fedora 44 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 9 Fedora Update System 2025-09-10 20:55:22 UTC
FEDORA-2025-4922878d8c (bind-9.18.39-3.fc41.1 and bind-dyndb-ldap-11.10-34.fc41) has been submitted as an update to Fedora 41.
https://bodhi.fedoraproject.org/updates/FEDORA-2025-4922878d8c

Comment 10 Fedora Update System 2025-09-11 02:00:22 UTC
FEDORA-2025-4922878d8c has been pushed to the Fedora 41 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-4922878d8c`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-4922878d8c

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 11 Fedora Update System 2025-09-12 02:44:13 UTC
FEDORA-2025-38c04b3b25 has been pushed to the Fedora 43 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-38c04b3b25`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-38c04b3b25

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 12 Fedora Update System 2025-09-16 01:24:20 UTC
FEDORA-2025-4922878d8c (bind-9.18.39-3.fc41.1 and bind-dyndb-ldap-11.10-34.fc41) has been pushed to the Fedora 41 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 13 Fedora Update System 2025-09-20 00:19:13 UTC
FEDORA-2025-38c04b3b25 (bind-9.18.39-4.fc43 and bind-dyndb-ldap-11.11-7.fc43) has been pushed to the Fedora 43 stable repository.
If problem still persists, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.