News

Please pay attention to #426 - Dropping support for legacy Java versions

Changes

• GHSA-m23c-5x5g-5ff6: Missing response validation in DoH Resolver
• GHSA-rwxq-7vpj-2rm5: Unbounded Pre-allocation via DNS Header Count Fields Leads to Amplified Memory Allocation (DoS)
• GHSA-hg22-jxmg-ppq9: Message normalization fails on invalid CNAME entries
• GHSA-whp4-9hfm-h8xr: X25Record accepts Unicode digits and silently converts them into non-digit DNS wire bytes
• GHSA-m779-jq28-q7v7: TSIG: MAC comparison is not constant-time
• TSIG: BADTIME responses fail verification because the MAC does not cover the Other Data
  (@kakooch, #424)
• Extend unit test coverage
  (@sean-g-rae, #412)
• New config option dnsjava.secure_random_algorithm property to select SecureRandom algorithm
  (@ChrisJr404, #368, #419)
• Validate SSHFP fingerprint lengths
  (@andrew-boutin and @Mahmoodifar, #414, #415)
• Handle canceled keys in TCP client
  (@techee, #411)
• hosts: resolve PTR queries from the local hosts database
  (@ChrisJr404, #350, #413)
• TSIG verification fails if id of message is not identical to originalId in TSIG record
  (@sfeigl, #409)
• TSIG record does not parse after Message.toWire(maxLength) truncates records owned by the key name (#417)
• Full support for GOST R 34.11-2012
  (@alexmit, #422, #423)
• nio: fix selector thread from self-joining (#180)
• New flags and codes registered at IANA
• Various issues as part of an automated search with Hegel (#417)
  • LOC prints a negative altitude with a fraction as -99999.-99m
  • WKS with no services, or unsorted ports in text, throws ArrayIndexOutOfBounds
  • A6 with an IPv4-mapped suffix throws in toWire; its text cannot be re-read
  • base64.fromString accepts characters outside the alphabet and decodes garbage
  • DNSOutput.writeU8/U16/U32 accept 2^8/2^16/2^32 and write zero
  • AAAARecord(Name, int, long, InetAddress) accepts an IPv4 address (4-byte rdata)
  • type bitmaps with out-of-order window blocks are accepted and re-sorted
  • LOC seconds lose their milliseconds in text parsing
  • absent base64 fields (empty OPENPGPKEY, RRSIG without signature) NPE in toString/toWire
  • NSAP text 0 throws StringIndexOutOfBounds
  • SVCB port= is not range-checked (65536 becomes 0, -1 accepted)
  • HIP rvservers ignore the origin; relative names stay relative and toWire fails
  • RRSIG/SIG times before 1970 are accepted in text and fail in toWire
  • CAA tags are printed unquoted/unescaped
  • LOC sizes beyond 9e9 m overflow the exponent nibble into unreadable wire data
  • OPTRecord.equals throws ClassCastException for an EmptyRecord of type OPT
  • CERT certificate-type mnemonics are shifted
  • SVCB alpn values are unescaped once instead of twice
  • SVCB values with spaces are printed unescaped; empty alpn ids are accepted
  • SVCB rdata from the wire is not validated (key order, duplicates, mandatory)
  • empty hex/base32 fields print as nothing and cannot be re-read
  • IPv4-mapped IPv6 addresses print as dotted quads in IPv6 fields
  • URI/CAA values over 255 octets read from the wire cannot be re-read from text
  • Record.fromString UTF-8-encodes non-ASCII text twice
  • TTL.parse drops trailing digits without a unit (1h30 is 3600)
  • Generator.expand() yields one record too few and repeats the first value
  • Message.toWire(max) exceeds max when the OPT record does not fit; strict mode does not throw
  • Message.getTSIG() throws IndexOutOfBounds on a truncated message with ARCOUNT > records
  • Zone.removeRecord of a non-member removes a single-record RRset
  • Update(zone, dclass) hardcodes class IN in the zone section
  • truncation leaves stale compression entries; the TSIG owner is written as a dangling pointer
  • Cache.addMessage uses the header rcode only (a BADVERS response is cached as NXRRSET)
  • ExtendedFlags.CO is 0x8001 instead of 0x4000
  • wildcards synthesize below an existing closer encloser
  • a query at an empty non-terminal answers NXDOMAIN instead of NODATA
  • a wildcard match without the type answers NXDOMAIN instead of NODATA
  • Cache.addRecord cannot replace a negative entry of equal credibility
  • RRset.equals/hashCode depend on insertion order
  • $GENERATE widths beyond int range are truncated instead of refused
  • ReverseMap.fromName wraps octets above 255
  • Message.addRecord with a bad section throws ArrayIndexOutOfBounds
  • wire TTLs with the high bit set are kept although text and constructors refuse them
  • $GENERATE ${offset} and ${offset,width} modifiers are rejected as invalid
  • toWire(max, false) throws for any message whose TC flag is preset
  • Header IDs are never 65535

Full Changelog: v3.6.5-1...v3.7.0

• Handle canceled keys in UDP client (#129)
• Handle interrupts on NIO selector thread (#396, #397)
• Fix config option key names in README (@lostnet, #399)
• Handle invalid/uninitialized file times in hosts file (#400)
• Add getXxxAsByteArray() getters and overload with escape boolean (@MMauro94, #404, #405)

Note: The tag for this release is v3.6.5-1, because the v3.6.5 tag accidentally pointed to a local branch and cannot be changed anymore because of the immutable releases. The Maven artifacts from the Actions run are correct.

Full Changelog: v3.6.4...v3.6.5-1

• Fix Zone-class serialization (#391)
• Avoid Double DNS Lookup for Names with Labels >= ndots (#388)
• Prevent NPE when calling Message#getTSIG() on DNS request with bad header (#384)
• Unwrap an exception in the legacy callback-based async interface (#383)
• Prevent ConcurrentModificationException in NIO clients (#379, @bhaveshthakker)
• Handle null in all setSearchPath overloads equally (#157)
• Reduce warning level of invalid hosts file entries (#371)
• Remove a lock on the hot-path in the hosts file parser (#371)
• DoH Resolver makes use of the Multi-Release jar and tests are executed for Java 8 and 11+ implementations (#385)
• Fix DoH Resolver initial request delay (#385)

Full Changelog: v3.6.3...v3.6.4

• Support custom hosts file size (@flaming-archer, #349)
• Fix origin handling in zone loaded from file or stream (#346)
• Prevent TCP port leak when closing IO (#351)
• Fix confusing parameter name in CNAMERecord (@chkal, #354)
• Optionally disable ShutdownHook in NioClient (@SvenssonWeb, #359)
• TSIG algorithm names from RFC 8945
• Message.toWire can exceed MAXLENGTH (#355)
• TCP query might fail if the shared buffer is full (#357)
• Dynamic updates silently truncates records (#356)
• Fix DoH initial request using recommended nanoTime calculation (@LinZong, #345)

• Add new IANA Trust Anchor (@technoLord, #337)
• Fix Zone handling with signed SOA (@frankarinnet, #335)

• Properly fix LookupSession doesn't cache CNAMEs (#316)
• Move JEP-418 SPI to Java 18 to support EOL workflows (#329)

• Fix CVE-2024-25638 (GHSA-cfxw-4h78-h7fw)
  Lookup and LookupSession do not sanitize input properly, allowing to smuggle additional responses, even with DNSSEC. I would like to thank Thomas Bellebaum from Fraunhofer AISEC (@bellebaum) and Martin Schanzenbach (@schanzen) for reporting and assisting me with this issue.
• Fix CVE-2023-50387 (GHSA-crjg-w57m-rqqf)
  Denial-of-Service Algorithmic Complexity Attacks (KeyTrap)
• Fix CVE-2023-50868 (GHSA-mmwx-rj87-vfgr)
  NSEC3 closest encloser proof can exhaust CPU resources (KeyTrap)
• Fix running all DNSSEC on the specified executor
• Add new DNSSEC algorithm constants for SM2SM3 and ECC-GOST12
• Add A/AAAA record constructor with IP address byte array
• Validate DS record digest lengths (#250)
• Fix NPE in SimpleResolver on invalid responses (#277)
• Add support for JEP 418: Internet-Address Resolution SPI (#290)
• Full JPMS support (#246)
• Pluggable I/O for SimpleResolver
  (@chrisruffalo, #253)
• UDP port leak in SimpleResolver (#318)
• Fix clean shutdown in app containers when never used (#319)
• Fix concurrency issue in I/O clients (#315, #323)
• LookupSession doesn't cache CNAMEs (#316)
• SimpleResolver can fail with UPDATE response (#322)
• Replace synchronization in Zone with locks
  (#305, based on work from @srijeet0406 in #306)

• Fix CNAME in LookupSession (#279)
• Fix Name constructor failing with max length, relative name and root origin (#289, @MMauro94)
• Add config option for Resolver I/O timeout (#273, @vmarian2)
• Extend I/O logging
• Prevent exception during TCP I/O with missing or truncated length prefix
• Use internal base64 codec for Android compatibility (#271)
• Fix multi-message TSIG stream verification for pre-RFC8945 servers (#295, @frankarinnet and @nguichon)
• Add StreamGenerator for generating RFC8945 compliant multi-message streams (related to #295)

• Correctly render empty TXT records (#254)
• More validation on TLSA data input (#257)

• Fix validation of TSIG signed responses (#249)
• DS rdata digest validation hexadecimal digits (#252)