CVS commit: pkgsrc/net/py-dns

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Fri Oct 30 05:46:41 UTC 2026

Modified Files:
        pkgsrc/net/py-dns: Makefile PLIST distinfo

Log Message:
py-dns: updated to 2.9.1

2.9.1
The resolver now assigns a new random query id to every query.
For transports that require a 0 query id, set it in a way that does not break TSIG.
dns.message.QueryMessage.resolve_chaining() now caps the minimum TTL of a negative response with no SOA record at 300 seconds (dns.message.NEGATIVE_TTL_WITHOUT_SOA). Previously the TTL was left at 
its initial value of 2^32 - 1, so a single NXDOMAIN or NODATA response with no SOA, e.g. a spoofed one, stayed in the resolver cache for the life of the process.
DNSSEC validation now rejects an RRSIG whose type covered or class does not match the RRset, as RFC 4035 section 5.3.1 requires. This was not checked, so a revoked DNSKEY, which may only validate the 
DNSKEY RRset, still validated any RRset signed with its private key if the RRSIG claimed to cover DNSKEY.
dns.tokenizer.Tokenizer now ends a line at a carriage return, or at a carriage return followed by a line feed, unless the carriage return is in a quoted string. The carriage return of CRLF line ends 
used to stay in the last token of each line and in the text of a comment, so e.g. dns.zone.from_text() rejected a zone with CRLF line ends.
DNSSEC validation no longer uses a DNSKEY with the REVOKE flag set to validate anything other than the DNSKEY RRset. RFC 5011 section 2.1 says a revoked key must not be used for any other purpose, 
but it was a candidate key like any other, so as long as the revoked key was still published, data signed with its private key, e.g. by whoever compromised it, validated.
dns.ttl.from_text() now rejects a BIND-style TTL that ends in a 0 without a unit, e.g. 1h0, as it already did for other numbers, e.g. 1h5, and as BIND does. The check for a trailing number tested its 
value instead of whether there was one, so 1h0 was read as one hour.
dns.dnssec.sign_zone() now adds the apex NSEC record when the origin is the only name in a relativized zone. The origin is then the empty name, which is false, so the closing NSEC was skipped and the 
signed zone had no NSEC at all, and so no authenticated denial of existence (RFC 4035 section 2.3).
TLSA and SMIMEA now reject a certificate association data field whose length does not match the matching type (RFC 6698 section 2.1.3: type 1 is SHA-256, 32 octets, and type 2 is SHA-512, 64 octets), 
and SSHFP rejects a fingerprint whose length does not match the fingerprint type (SHA-1, 20 octets, RFC 4255 section 3.1.3; SHA-256, 32 octets, RFC 6594 section 3.2). Both the wire and the text 
parser accepted any length, including empty, so they took records that conforming parsers reject. The DS family already rejects a digest of the wrong length.
A $GENERATE modifier width greater than 127 is now a syntax error, as BIND rejects a substitution that does not fit in 127 characters. The width was not limited, so a short line such as $GENERATE 1-1 
${0,100000000,d} A 10.0.0.1 built a 100 MB padded label before anything was checked, and the dns.transaction.TransactionLimiter meant for untrusted zone files never saw it.
dns.name.from_text() and the parsing of quoted strings and SVCB parameter values no longer take time quadratic in the length of the text. They appended to bytes one character at a time, so e.g. a 1 
MB label took about 7 seconds to be rejected as too long.
dns.reversename.to_address() now rejects IPv4 reverse-map names without exactly 4 labels. A label containing an escaped . was joined into the address text, so e.g. 4\.3\.2\.1.in-addr.arpa. and 
2\.1.3.4.in-addr.arpa. were both accepted as 4.3.2.1, although only 1.2.3.4.in-addr.arpa. is its reverse-map name.
NSEC3 now rejects an empty Next Hashed Owner Name, as RFC 5155 section 3.1.6 requires a hash length of 1 to 255 octets. The wire parser accepted it, next_name() returned the zone origin, and 
to_text() wrote an empty field, so reading the text back took the first type mnemonic as the hash, e.g. types NS SOA came back as next ns and type SOA.
BTree zones now keep delegation indexes and node flags consistent when a parent delegation hides or exposes nested NS records, when nodes are copied for a new version, and when CNAME replacement 
implicitly removes NS records. An origin learned from a zone file is also correctly identified as the origin rather than a delegation when names are absolute.
dns.asyncquery.quic() now verifies the server certificate against the hostname parameter. It passed the deprecated server_hostname alias to the QUIC connection instead, so a query made with hostname= 
accepted any certificate trusted by the CA set, with no check of the name or address in it. dns.query.quic() was not affected.
DNSSEC validation now rejects an ECDSA signature that is not exactly 64 (P-256) or 96 (P-384) octets long (RFC 6605 section 4), and a DSA signature that is not 41 octets long or whose T octet differs 
from the key’s (RFC 2536 section 3). The signature halves were read with no length check, so e.g. inserting zero octets before S gave a different RRSIG that still validated.
dns.name.Name.to_unicode() now raises dns.name.IDNAException for an ACE label that does not decode to a U-label, i.e. one whose punycode decodes to an empty or all-ASCII string, as the strict IDNA 
codecs already did. The default codec and the other non-strict codecs decoded e.g. xn--www- to www, so xn--www-.example. was shown as www.example., a different name.
dns.name.Name.to_unicode() and the UTF-8 TXT output of dns.zone.Zone.to_text() ($UNICODE ... TXT) now escape the DEL and C1 control characters U+007F through U+009F as \DDD, as to_text() and the EDNS 
option text already do. A punycode label from the wire can decode to any code point, so a name in an untrusted response could put e.g. a NEL (U+0085) line break or a C1 terminal control sequence into 
the output.
$GENERATE now substitutes the iterator the way BIND does. The nibble formats n and N produced an empty label when the width was 0 and dropped nibbles when the value needed more characters than the 
width, $$ and \$ were not treated as a literal $, and when a template contained a $ with a modifier, any other $ in it was left unsubstituted. A malformed ${...} modifier is now a syntax error 
instead of being copied into the output.
The to_text() output of the EDE, EDE-EXTRA-TEXT-LANGUAGE, FILTERING-CONTACT, FILTERING-ORGANIZATION, and FILTERING-DB EDNS options now escapes backslash and control characters as \DDD. The text in 
these options comes from the wire and was written out verbatim, so a server could put newlines or terminal escape sequences into dns.message.Message.to_text() output, e.g. adding a forged ;ANSWER 
section to what a tool prints.
dns.zone.from_xfr() now ignores records in a zone transfer response that are not at or below the zone origin, and raises dns.exception.FormError for a record of the wrong class or an SOA that is not 
at the origin. It previously stored all of them in the zone, so a primary could add data for names outside the zone being transferred.
dns.query.https(), dns.query.quic(), and their dns.asyncquery equivalents now validate the response to a TSIG-signed query against the query’s MAC. They previously passed an empty request MAC, so a 
correctly signed response failed with BadSignature and a response with no TSIG at all was accepted, as the RFC 8945 section 5.4 check for a missing TSIG was skipped.
dns.query.inbound_xfr(), dns.asyncquery.inbound_xfr(), and dns.query.xfr() now check every response message with dns.message.Message.is_response() and raise dns.query.BadResponse if it fails, e.g. if 
the ID of the request is not copied, QR is not set, or the opcode differs (RFC 5936 section 2.2.1). Nothing was checked, so a spoofed UDP IXFR response only had to match the source port to be applied 
to the zone.
dns.message.Message.is_response() has a new xfr_continuation parameter which allows an empty question section in the messages after the first one of a zone transfer response, and it now compares 
question names in absolute form, so a response read with an origin can match its query.
dns.renderer.Renderer now draws its default message id from dns.entropy, as dns.message.Message already did. The id was previously taken from the random module’s global generator, which is seedable 
and predictable from its outputs, weakening the id’s role as anti-spoofing entropy (RFC 5452 section 9.2) for messages built directly with the renderer.
The NSEC3 Next Hashed Owner Name in presentation format is now rejected when it is not canonical base32hex, i.e. when the unused low-order bits of its final character are not zero (RFC 4648 section 
3.5). Such a spelling decoded to the same hash as the canonical one, so to_text of the result did not match the input.
CAA constructors now validate the encoded tag bytes, consistently rejecting non-ASCII tags supplied as Python strings just as text and wire parsing do.
LOC wire parsing now rejects a non-canonical size, horizontal precision, or vertical precision octet whose base is zero but whose exponent is not. Such an octet means the value 0, which to_wire 
always encodes as 0x00, so the wire form did not round-trip.
Base64 fields in presentation format (the key material of DNSKEY, CDNSKEY, KEY, CERT, HIP, IPSECKEY, OPENPGPKEY, RRSIG, SIG, DHCID, TSIG, TKEY, and the SVCB/HTTPS ech value) are now rejected when 
they contain characters outside the base64 alphabet. base64.b64decode silently discarded such characters, so a record spelled with junk in it decoded to different bytes and its to_text no longer 
matched the input.
dns.name.Name.to_unicode() now escapes the Unicode full stops U+3002, U+FF0E, and U+FF61 when a punycode label decodes to one of them. dns.name.from_unicode() treats these characters as label 
separators, so the unescaped output displayed and parsed back as a name with more labels than the original, e.g. the one-label xn--wwwexamplecom-582lha. was shown as www。example。com., which parses 
back as www.example.com..


To generate a diff of this commit:
cvs rdiff -u -r1.46 -r1.47 pkgsrc/net/py-dns/Makefile
cvs rdiff -u -r1.23 -r1.24 pkgsrc/net/py-dns/PLIST
cvs rdiff -u -r1.30 -r1.31 pkgsrc/net/py-dns/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/net/py-dns/Makefile
diff -u pkgsrc/net/py-dns/Makefile:1.46 pkgsrc/net/py-dns/Makefile:1.47
--- pkgsrc/net/py-dns/Makefile:1.46     Fri Oct  9 03:35:08 2026
+++ pkgsrc/net/py-dns/Makefile  Fri Oct 30 05:46:41 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.46 2026/10/09 03:35:08 adam Exp $
+# $NetBSD: Makefile,v 1.47 2026/10/30 05:46:41 adam Exp $
 
-DISTNAME=      dnspython-2.9.0
+DISTNAME=      dnspython-2.9.1
 PKGNAME=       ${PYPKGPREFIX}-${DISTNAME:S/python-/-/}
 CATEGORIES=    net python
 MASTER_SITES=  ${MASTER_SITE_PYPI:=d/dnspython/}

Index: pkgsrc/net/py-dns/PLIST
diff -u pkgsrc/net/py-dns/PLIST:1.23 pkgsrc/net/py-dns/PLIST:1.24
--- pkgsrc/net/py-dns/PLIST:1.23        Fri Oct  9 03:35:08 2026
+++ pkgsrc/net/py-dns/PLIST     Fri Oct 30 05:46:41 2026
@@ -1,7 +1,8 @@
-@comment $NetBSD: PLIST,v 1.23 2026/10/09 03:35:08 adam Exp $
+@comment $NetBSD: PLIST,v 1.24 2026/10/30 05:46:41 adam Exp $
 ${PYSITELIB}/${WHEEL_INFODIR}/METADATA
 ${PYSITELIB}/${WHEEL_INFODIR}/RECORD
 ${PYSITELIB}/${WHEEL_INFODIR}/WHEEL
+${PYSITELIB}/${WHEEL_INFODIR}/licenses/LICENSE
 ${PYSITELIB}/dns/__init__.py
 ${PYSITELIB}/dns/__init__.pyc
 ${PYSITELIB}/dns/__init__.pyo

Index: pkgsrc/net/py-dns/distinfo
diff -u pkgsrc/net/py-dns/distinfo:1.30 pkgsrc/net/py-dns/distinfo:1.31
--- pkgsrc/net/py-dns/distinfo:1.30     Fri Oct  9 03:35:08 2026
+++ pkgsrc/net/py-dns/distinfo  Fri Oct 30 05:46:41 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.30 2026/10/09 03:35:08 adam Exp $
+$NetBSD: distinfo,v 1.31 2026/10/30 05:46:41 adam Exp $
 
-BLAKE2s (dnspython-2.9.0.tar.gz) = 1ac34ac05a4b83f97a83397c4544304fa79a5a078ff2eea1d6f7ef903d6a7b2d
-SHA512 (dnspython-2.9.0.tar.gz) = 1886d47439ef6e3f66470426bff7fe3e05ad6e0e1dadaf7644cfd9e2e1120b3777c63b0e63964addc5e616bd9b6789df9d7465f6fbbbcdd3c1a0e49a22f5dfd9
-Size (dnspython-2.9.0.tar.gz) = 423560 bytes
+BLAKE2s (dnspython-2.9.1.tar.gz) = fdfe0fb02aa822d12c30adfe18c8043b93816fd27a8a4cd5a4d0a26026a28a15
+SHA512 (dnspython-2.9.1.tar.gz) = 61f891519bf78ed34fef8783bcc8fd98f67f040f31a0739f81cefa7f95ed6590c003604209179919e58942de8a08e84b499b271f5198f9196c89de91a0512800
+Size (dnspython-2.9.1.tar.gz) = 455302 bytes