Merge branch 'michal/split-release-notes-into-per-version-sections' into 'master'
Split release notes into per-version sections See merge request isc-projects/bind9!2524
This commit is contained in:
Michał Kępień
@@ -19,10 +19,14 @@ TXTOBJS = notes.txt
|
||||
|
||||
PDFOBJS = Bv9ARM.pdf notes.pdf
|
||||
|
||||
NOTESXML = notes-bug-fixes.xml notes-download.xml notes-eol.xml \
|
||||
notes-feature-changes.xml notes-intro.xml notes-license.xml \
|
||||
notes-new-features.xml notes-numbering.xml notes-platforms.xml \
|
||||
notes-removed.xml notes-sec-fixes.xml notes-thankyou.xml \
|
||||
NOTESXML = notes-download.xml notes-eol.xml notes-intro.xml notes-license.xml \
|
||||
notes-numbering.xml notes-platforms.xml notes-thankyou.xml \
|
||||
notes-9.15.0.xml \
|
||||
notes-9.15.1.xml \
|
||||
notes-9.15.2.xml \
|
||||
notes-9.15.3.xml \
|
||||
notes-9.15.4.xml \
|
||||
notes-9.15.5.xml \
|
||||
notes.xml
|
||||
|
||||
doc man:: ${MANOBJS} ${TXTOBJS} ${PDFOBJS}
|
||||
|
||||
108
doc/arm/notes-9.15.0.xml
Normal file
108
doc/arm/notes-9.15.0.xml
Normal file
@@ -0,0 +1,108 @@
|
||||
<!--
|
||||
- Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
- file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
-
|
||||
- See the COPYRIGHT file distributed with this work for additional
|
||||
- information regarding copyright ownership.
|
||||
-->
|
||||
|
||||
<section xml:id="relnotes-9.15.0"><info><title>Notes for BIND 9.15.0</title></info>
|
||||
|
||||
<section xml:id="relnotes-9.15.0-security"><info><title>Security Fixes</title></info>
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>
|
||||
In certain configurations, <command>named</command> could crash
|
||||
with an assertion failure if <command>nxdomain-redirect</command>
|
||||
was in use and a redirected query resulted in an NXDOMAIN from the
|
||||
cache. This flaw is disclosed in CVE-2019-6467. [GL #880]
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
The TCP client quota set using the <command>tcp-clients</command>
|
||||
option could be exceeded in some cases. This could lead to
|
||||
exhaustion of file descriptors. This flaw is disclosed in
|
||||
CVE-2018-5743. [GL #615]
|
||||
</para>
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
</section>
|
||||
|
||||
<section xml:id="relnotes-9.15.0-new"><info><title>New Features</title></info>
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>
|
||||
The new <command>add-soa</command> option specifies whether
|
||||
or not the <command>response-policy</command> zone's SOA record
|
||||
should be included in the additional section of RPZ responses.
|
||||
[GL #865]
|
||||
</para>
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
</section>
|
||||
|
||||
<section xml:id="relnotes-9.15.0-removed"><info><title>Removed Features</title></info>
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>
|
||||
The <command>dnssec-enable</command> option has been obsoleted and
|
||||
no longer has any effect. DNSSEC responses are always enabled
|
||||
if signatures and other DNSSEC data are present. [GL #866]
|
||||
</para>
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
</section>
|
||||
|
||||
<section xml:id="relnotes-9.15.0-changes"><info><title>Feature Changes</title></info>
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>
|
||||
When static and managed DNSSEC keys were both configured for the
|
||||
same name, or when a static key was used to
|
||||
configure a trust anchor for the root zone and
|
||||
<command>dnssec-validation</command> was set to the default
|
||||
value of <literal>auto</literal>, automatic RFC 5011 key
|
||||
rollovers would be disabled. This combination of settings was
|
||||
never intended to work, but there was no check for it in the
|
||||
parser. This has been corrected, and it is now a fatal
|
||||
configuration error. [GL #868]
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
DS and CDS records are now generated with SHA-256 digests
|
||||
only, instead of both SHA-1 and SHA-256. This affects the
|
||||
default output of <command>dnssec-dsfromkey</command>, the
|
||||
<filename>dsset</filename> files generated by
|
||||
<command>dnssec-signzone</command>, the DS records added to
|
||||
a zone by <command>dnssec-signzone</command> based on
|
||||
<filename>keyset</filename> files, the CDS records added to
|
||||
a zone by <command>named</command> and
|
||||
<command>dnssec-signzone</command> based on "sync" timing
|
||||
parameters in key files, and the checks performed by
|
||||
<command>dnssec-checkds</command>.
|
||||
</para>
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
</section>
|
||||
|
||||
<section xml:id="relnotes-9.15.0-bugs"><info><title>Bug Fixes</title></info>
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>
|
||||
The <command>allow-update</command> and
|
||||
<command>allow-update-forwarding</command> options were
|
||||
inadvertently treated as configuration errors when used at the
|
||||
<command>options</command> or <command>view</command> level.
|
||||
This has now been corrected.
|
||||
[GL #913]
|
||||
</para>
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
</section>
|
||||
|
||||
</section>
|
||||
87
doc/arm/notes-9.15.1.xml
Normal file
87
doc/arm/notes-9.15.1.xml
Normal file
@@ -0,0 +1,87 @@
|
||||
<!--
|
||||
- Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
- file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
-
|
||||
- See the COPYRIGHT file distributed with this work for additional
|
||||
- information regarding copyright ownership.
|
||||
-->
|
||||
|
||||
<section xml:id="relnotes-9.15.1"><info><title>Notes for BIND 9.15.1</title></info>
|
||||
|
||||
<section xml:id="relnotes-9.15.1-security"><info><title>Security Fixes</title></info>
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>
|
||||
A race condition could trigger an assertion failure when
|
||||
a large number of incoming packets were being rejected.
|
||||
This flaw is disclosed in CVE-2019-6471. [GL #942]
|
||||
</para>
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
</section>
|
||||
|
||||
<section xml:id="relnotes-9.15.1-new"><info><title>New Features</title></info>
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>
|
||||
In order to clarify the configuration of DNSSEC keys,
|
||||
the <command>trusted-keys</command> and
|
||||
<command>managed-keys</command> statements have been
|
||||
deprecated, and the new <command>dnssec-keys</command>
|
||||
statement should now be used for both types of key.
|
||||
</para>
|
||||
<para>
|
||||
When used with the keyword <command>initial-key</command>,
|
||||
<command>dnssec-keys</command> has the same behavior as
|
||||
<command>managed-keys</command>, i.e., it configures
|
||||
a trust anchor that is to be maintained via RFC 5011.
|
||||
</para>
|
||||
<para>
|
||||
When used with the new keyword <command>static-key</command>, it
|
||||
has the same behavior as <command>trusted-keys</command>,
|
||||
configuring a permanent trust anchor that will not automatically
|
||||
be updated. (This usage is not recommended for the root key.)
|
||||
[GL #6]
|
||||
</para>
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
</section>
|
||||
|
||||
<section xml:id="relnotes-9.15.1-removed"><info><title>Removed Features</title></info>
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>
|
||||
The <command>cleaning-interval</command> option has been
|
||||
removed. [GL !1731]
|
||||
</para>
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
</section>
|
||||
|
||||
<section xml:id="relnotes-9.15.1-changes"><info><title>Feature Changes</title></info>
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>
|
||||
<command>named</command> will now log a warning if
|
||||
a static key is configured for the root zone. [GL #6]
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
JSON-C is now the only supported library for enabling JSON
|
||||
support for BIND statistics. The <command>configure</command>
|
||||
option has been renamed from <command>--with-libjson</command>
|
||||
to <command>--with-json-c</command>. Use
|
||||
<command>PKG_CONFIG_PATH</command> to specify a custom path to
|
||||
the <command>json-c</command> library as the new
|
||||
<command>configure</command> option does not take the library
|
||||
installation path as an optional argument.
|
||||
</para>
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
</section>
|
||||
|
||||
</section>
|
||||
93
doc/arm/notes-9.15.2.xml
Normal file
93
doc/arm/notes-9.15.2.xml
Normal file
@@ -0,0 +1,93 @@
|
||||
<!--
|
||||
- Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
- file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
-
|
||||
- See the COPYRIGHT file distributed with this work for additional
|
||||
- information regarding copyright ownership.
|
||||
-->
|
||||
|
||||
<section xml:id="relnotes-9.15.2"><info><title>Notes for BIND 9.15.2</title></info>
|
||||
|
||||
<section xml:id="relnotes-9.15.2-new"><info><title>New Features</title></info>
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>
|
||||
The GeoIP2 API from MaxMind is now supported. Geolocation support
|
||||
will be compiled in by default if the <command>libmaxminddb</command>
|
||||
library is found at compile time, but can be turned off by using
|
||||
<command>configure --disable-geoip</command>.
|
||||
</para>
|
||||
<para>
|
||||
The default path to the GeoIP2 databases will be set based
|
||||
on the location of the <command>libmaxminddb</command> library;
|
||||
for example, if it is in <filename>/usr/local/lib</filename>,
|
||||
then the default path will be
|
||||
<filename>/usr/local/share/GeoIP</filename>.
|
||||
This value can be overridden in <filename>named.conf</filename>
|
||||
using the <command>geoip-directory</command> option.
|
||||
</para>
|
||||
<para>
|
||||
Some <command>geoip</command> ACL settings that were available with
|
||||
legacy GeoIP, including searches for <command>netspeed</command>,
|
||||
<command>org</command>, and three-letter ISO country codes, will
|
||||
no longer work when using GeoIP2. Supported GeoIP2 database
|
||||
types are <command>country</command>, <command>city</command>,
|
||||
<command>domain</command>, <command>isp</command>, and
|
||||
<command>as</command>. All of these databases support both IPv4
|
||||
and IPv6 lookups. [GL #182] [GL #1112]
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
Two new metrics have been added to the
|
||||
<command>statistics-channel</command> to report DNSSEC
|
||||
signing operations. For each key in each zone, the
|
||||
<command>dnssec-sign</command> counter indicates the total
|
||||
number of signatures <command>named</command> has generated
|
||||
using that key since server startup, and the
|
||||
<command>dnssec-refresh</command> counter indicates how
|
||||
many of those signatures were refreshed during zone
|
||||
maintenance, as opposed to having been generated
|
||||
as a result of a zone update. [GL #513]
|
||||
</para>
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
</section>
|
||||
|
||||
<section xml:id="relnotes-9.15.2-bugs"><info><title>Bug Fixes</title></info>
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>
|
||||
When <command>qname-minimization</command> was set to
|
||||
<command>relaxed</command>, some improperly configured domains
|
||||
would fail to resolve, but would have succeeded when minimization
|
||||
was disabled. <command>named</command> will now fall back to normal
|
||||
resolution in such cases, and also uses type A rather than NS for
|
||||
minimal queries in order to reduce the likelihood of encountering
|
||||
the problem. [GL #1055]
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
<command>./configure</command> no longer sets
|
||||
<command>--sysconfdir</command> to <command>/etc</command> or
|
||||
<command>--localstatedir</command> to <command>/var</command>
|
||||
when <command>--prefix</command> is not specified and the
|
||||
aforementioned options are not specified explicitly. Instead,
|
||||
Autoconf's defaults of <command>$prefix/etc</command> and
|
||||
<command>$prefix/var</command> are respected.
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
Glue address records were not being returned in responses
|
||||
to root priming queries; this has been corrected. [GL #1092]
|
||||
</para>
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
</section>
|
||||
|
||||
</section>
|
||||
125
doc/arm/notes-9.15.3.xml
Normal file
125
doc/arm/notes-9.15.3.xml
Normal file
@@ -0,0 +1,125 @@
|
||||
<!--
|
||||
- Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
- file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
-
|
||||
- See the COPYRIGHT file distributed with this work for additional
|
||||
- information regarding copyright ownership.
|
||||
-->
|
||||
|
||||
<section xml:id="relnotes-9.15.3"><info><title>Notes for BIND 9.15.3</title></info>
|
||||
|
||||
<section xml:id="relnotes-9.15.3-new"><info><title>New Features</title></info>
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>
|
||||
Statistics channel groups are now toggleable. [GL #1030]
|
||||
</para>
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
</section>
|
||||
|
||||
<section xml:id="relnotes-9.15.3-removed"><info><title>Removed Features</title></info>
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>
|
||||
DNSSEC Lookaside Validation (DLV) is now obsolete.
|
||||
The <command>dnssec-lookaside</command> option has been
|
||||
marked as deprecated; when used in <filename>named.conf</filename>,
|
||||
it will generate a warning but will otherwise be ignored.
|
||||
All code enabling the use of lookaside validation has been removed
|
||||
from the validator, <command>delv</command>, and the DNSSEC tools.
|
||||
[GL #7]
|
||||
</para>
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
</section>
|
||||
|
||||
<section xml:id="relnotes-9.15.3-changes"><info><title>Feature Changes</title></info>
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>
|
||||
A SipHash 2-4 based DNS Cookie (RFC 7873) algorithm has been added and
|
||||
made default. Old non-default HMAC-SHA based DNS Cookie algorithms
|
||||
have been removed, and only the default AES algorithm is being kept
|
||||
for legacy reasons. This change doesn't have any operational impact
|
||||
in most common scenarios. [GL #605]
|
||||
</para>
|
||||
<para>
|
||||
If you are running multiple DNS Servers (different versions of BIND 9
|
||||
or DNS server from multiple vendors) responding from the same IP
|
||||
address (anycast or load-balancing scenarios), you'll have to make
|
||||
sure that all the servers are configured with the same DNS Cookie
|
||||
algorithm and same Server Secret for the best performance.
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
The information from the <command>dnssec-signzone</command> and
|
||||
<command>dnssec-verify</command> commands is now printed to standard
|
||||
output. The standard error output is only used to print warnings and
|
||||
errors, and in case the user requests the signed zone to be printed to
|
||||
standard output with <command>-f -</command> option. A new
|
||||
configuration option <command>-q</command> has been added to silence
|
||||
all output on standard output except for the name of the signed zone.
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
DS records included in DNS referral messages can now be validated
|
||||
and cached immediately, reducing the number of queries needed for
|
||||
a DNSSEC validation. [GL #964]
|
||||
</para>
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
</section>
|
||||
|
||||
<section xml:id="relnotes-9.15.3-bugs"><info><title>Bug Fixes</title></info>
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>
|
||||
Cache database statistics counters could report invalid values
|
||||
when stale answers were enabled, because of a bug in counter
|
||||
maintenance when cache data becomes stale. The statistics counters
|
||||
have been corrected to report the number of RRsets for each
|
||||
RR type that are active, stale but still potentially served,
|
||||
or stale and marked for deletion. [GL #602]
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
Interaction between DNS64 and RPZ No Data rule (CNAME *.) could
|
||||
cause unexpected results; this has been fixed. [GL #1106]
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
<command>named-checkconf</command> now checks DNS64 prefixes
|
||||
to ensure bits 64-71 are zero. [GL #1159]
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
<command>named-checkconf</command> now correctly reports a missing
|
||||
<command>dnstap-output</command> option when
|
||||
<command>dnstap</command> is set. [GL #1136]
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
Handle ETIMEDOUT error on connect() with a non-blocking
|
||||
socket. [GL #1133]
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
<command>dig</command> now correctly expands the IPv6 address
|
||||
when run with <command>+expandaaaa +short</command>. [GL #1152]
|
||||
</para>
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
</section>
|
||||
|
||||
</section>
|
||||
47
doc/arm/notes-9.15.4.xml
Normal file
47
doc/arm/notes-9.15.4.xml
Normal file
@@ -0,0 +1,47 @@
|
||||
<!--
|
||||
- Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
- file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
-
|
||||
- See the COPYRIGHT file distributed with this work for additional
|
||||
- information regarding copyright ownership.
|
||||
-->
|
||||
|
||||
<section xml:id="relnotes-9.15.4"><info><title>Notes for BIND 9.15.4</title></info>
|
||||
|
||||
<section xml:id="relnotes-9.15.4-new"><info><title>New Features</title></info>
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>
|
||||
Added a new command line option to <command>dig</command>:
|
||||
<command>+[no]unexpected</command>. By default, <command>dig</command>
|
||||
won't accept a reply from a source other than the one to which
|
||||
it sent the query. Add the <command>+unexpected</command> argument
|
||||
to enable it to process replies from unexpected sources.
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
<command>dig</command>, <command>mdig</command> and
|
||||
<command>delv</command> can all now take a <command>+yaml</command>
|
||||
option to print output in a a detailed YAML format. [RT #1145]
|
||||
</para>
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
</section>
|
||||
|
||||
<section xml:id="relnotes-9.15.4-bugs"><info><title>Bug Fixes</title></info>
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>
|
||||
When a <command>response-policy</command> zone expires, ensure
|
||||
that its policies are removed from the RPZ summary database.
|
||||
[GL #1146]
|
||||
</para>
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
</section>
|
||||
|
||||
</section>
|
||||
34
doc/arm/notes-9.15.5.xml
Normal file
34
doc/arm/notes-9.15.5.xml
Normal file
@@ -0,0 +1,34 @@
|
||||
<!--
|
||||
- Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
- file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
-
|
||||
- See the COPYRIGHT file distributed with this work for additional
|
||||
- information regarding copyright ownership.
|
||||
-->
|
||||
|
||||
<section xml:id="relnotes-9.15.5"><info><title>Notes for BIND 9.15.5</title></info>
|
||||
|
||||
<section xml:id="relnotes-9.15.5-security"><info><title>Security Fixes</title></info>
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>
|
||||
<command>named</command> could crash with an assertion failure
|
||||
if a forwarder returned a referral, rather than resolving the
|
||||
query, when QNAME minimization was enabled. This flaw is
|
||||
disclosed in CVE-2019-6476. [GL #1051]
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
A flaw in DNSSEC verification when transferring mirror zones
|
||||
could allow data to be incorrectly marked valid. This flaw
|
||||
is disclosed in CVE-2019-6475. [GL #1252]
|
||||
</para>
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
</section>
|
||||
|
||||
</section>
|
||||
52
doc/arm/notes-9.15.6.xml
Normal file
52
doc/arm/notes-9.15.6.xml
Normal file
@@ -0,0 +1,52 @@
|
||||
<!--
|
||||
- Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
- file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
-
|
||||
- See the COPYRIGHT file distributed with this work for additional
|
||||
- information regarding copyright ownership.
|
||||
-->
|
||||
|
||||
<section xml:id="relnotes-9.15.6"><info><title>Notes for BIND 9.15.6</title></info>
|
||||
|
||||
<section xml:id="relnotes-9.15.6-new"><info><title>New Features</title></info>
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>
|
||||
A new asynchronous network communications system based on
|
||||
<command>libuv</command> is now used by <command>named</command>
|
||||
for listening for incoming requests and responding to them.
|
||||
This change will make it easier to improve performance and
|
||||
implement new protocol layers (for example, DNS over TLS) in
|
||||
the future. [GL #29]
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
The new <command>dnssec-policy</command> option allows the
|
||||
configuration key and signing policy (KASP) for zones. This
|
||||
option enables <command>named</command> to generate new keys
|
||||
as needed and automatically roll both ZSK and KSK keys.
|
||||
(Note that the syntax for this statement differs from the DNSSEC
|
||||
policy used by <command>dnssec-keymgr</command>.) [GL #1134]
|
||||
</para>
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
</section>
|
||||
|
||||
<section xml:id="relnotes-9.15.6-changes"><info><title>Feature Changes</title></info>
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>
|
||||
NSEC Aggressive Cache (synth-from-dnssec) has been disabled by default
|
||||
because it was found to have a significant performance impact on the
|
||||
recursive service. The NSEC Aggressive Cache will be enable by default
|
||||
in the future releases. [GL #1265]
|
||||
</para>
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
</section>
|
||||
|
||||
</section>
|
||||
@@ -1,101 +0,0 @@
|
||||
<!--
|
||||
- Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
- file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
-
|
||||
- See the COPYRIGHT file distributed with this work for additional
|
||||
- information regarding copyright ownership.
|
||||
-->
|
||||
|
||||
<section xml:id="relnotes_bugs"><info><title>Bug Fixes</title></info>
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>
|
||||
The <command>allow-update</command> and
|
||||
<command>allow-update-forwarding</command> options were
|
||||
inadvertently treated as configuration errors when used at the
|
||||
<command>options</command> or <command>view</command> level.
|
||||
This has now been corrected.
|
||||
[GL #913]
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
When <command>qname-minimization</command> was set to
|
||||
<command>relaxed</command>, some improperly configured domains
|
||||
would fail to resolve, but would have succeeded when minimization
|
||||
was disabled. <command>named</command> will now fall back to normal
|
||||
resolution in such cases, and also uses type A rather than NS for
|
||||
minimal queries in order to reduce the likelihood of encountering
|
||||
the problem. [GL #1055]
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
<command>./configure</command> no longer sets
|
||||
<command>--sysconfdir</command> to <command>/etc</command> or
|
||||
<command>--localstatedir</command> to <command>/var</command>
|
||||
when <command>--prefix</command> is not specified and the
|
||||
aforementioned options are not specified explicitly. Instead,
|
||||
Autoconf's defaults of <command>$prefix/etc</command> and
|
||||
<command>$prefix/var</command> are respected.
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
Glue address records were not being returned in responses
|
||||
to root priming queries; this has been corrected. [GL #1092]
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
Interaction between DNS64 and RPZ No Data rule (CNAME *.) could
|
||||
cause unexpected results; this has been fixed. [GL #1106]
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
<command>named-checkconf</command> now checks DNS64 prefixes
|
||||
to ensure bits 64-71 are zero. [GL #1159]
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
<command>named-checkconf</command> now correctly reports a missing
|
||||
<command>dnstap-output</command> option when
|
||||
<command>dnstap</command> is set. [GL #1136]
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
Handle ETIMEDOUT error on connect() with a non-blocking
|
||||
socket. [GL #1133]
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
Cache database statistics counters could report invalid values
|
||||
when stale answers were enabled, because of a bug in counter
|
||||
maintenance when cache data becomes stale. The statistics counters
|
||||
have been corrected to report the number of RRsets for each
|
||||
RR type that are active, stale but still potentially served,
|
||||
or stale and marked for deletion. [GL #602]
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
<command>dig</command> now correctly expands the IPv6 address
|
||||
when run with <command>+expandaaaa +short</command>. [GL #1152]
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
When a <command>response-policy</command> zone expires, ensure
|
||||
that its policies are removed from the RPZ summary database.
|
||||
[GL #1146]
|
||||
</para>
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
</section>
|
||||
@@ -12,7 +12,7 @@
|
||||
<section xml:id="relnotes_download"><info><title>Download</title></info>
|
||||
<para>
|
||||
The latest versions of BIND 9 software can always be found at
|
||||
<link xmlns:xlink="http://www.w3.org/1999/xlink" xlink:href="http://www.isc.org/downloads/">http://www.isc.org/downloads/</link>.
|
||||
<link xmlns:xlink="http://www.w3.org/1999/xlink" xlink:href="https://www.isc.org/download/">https://www.isc.org/download/</link>.
|
||||
There you will find additional information about each release,
|
||||
source code, and pre-compiled versions for Microsoft Windows
|
||||
operating systems.
|
||||
|
||||
@@ -20,7 +20,7 @@
|
||||
For those needing long term support, the current Extended Support
|
||||
Version (ESV) is BIND 9.11, which will be supported until at
|
||||
least December 2021. See
|
||||
<link xmlns:xlink="http://www.w3.org/1999/xlink" xlink:href="https://www.isc.org/downloads/software-support-policy/">https://www.isc.org/downloads/software-support-policy/</link>
|
||||
<link xmlns:xlink="http://www.w3.org/1999/xlink" xlink:href="https://kb.isc.org/docs/aa-00896">https://kb.isc.org/docs/aa-00896</link>
|
||||
for details of ISC's software support policy.
|
||||
</para>
|
||||
</section>
|
||||
|
||||
@@ -1,113 +0,0 @@
|
||||
<!--
|
||||
- Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
- file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
-
|
||||
- See the COPYRIGHT file distributed with this work for additional
|
||||
- information regarding copyright ownership.
|
||||
-->
|
||||
|
||||
<section xml:id="relnotes_changes"><info><title>Feature Changes</title></info>
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>
|
||||
A new asynchronous network communications system based on
|
||||
<command>libuv</command> is now used by <command>named</command>
|
||||
for listening for incoming requests and responding to them.
|
||||
This change will make it easier to improve performance and
|
||||
implement new protocol layers (for example, DNS over TLS) in
|
||||
the future. [GL #29]
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
<command>named</command> will now log a warning if
|
||||
a static key is configured for the root zone. [GL #6]
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
When static and managed DNSSEC keys were both configured for the
|
||||
same name, or when a static key was used to
|
||||
configure a trust anchor for the root zone and
|
||||
<command>dnssec-validation</command> was set to the default
|
||||
value of <literal>auto</literal>, automatic RFC 5011 key
|
||||
rollovers would be disabled. This combination of settings was
|
||||
never intended to work, but there was no check for it in the
|
||||
parser. This has been corrected, and it is now a fatal
|
||||
configuration error. [GL #868]
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
DS and CDS records are now generated with SHA-256 digests
|
||||
only, instead of both SHA-1 and SHA-256. This affects the
|
||||
default output of <command>dnssec-dsfromkey</command>, the
|
||||
<filename>dsset</filename> files generated by
|
||||
<command>dnssec-signzone</command>, the DS records added to
|
||||
a zone by <command>dnssec-signzone</command> based on
|
||||
<filename>keyset</filename> files, the CDS records added to
|
||||
a zone by <command>named</command> and
|
||||
<command>dnssec-signzone</command> based on "sync" timing
|
||||
parameters in key files, and the checks performed by
|
||||
<command>dnssec-checkds</command>.
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
JSON-C is now the only supported library for enabling JSON
|
||||
support for BIND statistics. The <command>configure</command>
|
||||
option has been renamed from <command>--with-libjson</command>
|
||||
to <command>--with-json-c</command>. Use
|
||||
<command>PKG_CONFIG_PATH</command> to specify a custom path to
|
||||
the <command>json-c</command> library as the new
|
||||
<command>configure</command> option does not take the library
|
||||
installation path as an optional argument.
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
A SipHash 2-4 based DNS Cookie (RFC 7873) algorithm has been added and
|
||||
made default. Old non-default HMAC-SHA based DNS Cookie algorithms
|
||||
have been removed, and only the default AES algorithm is being kept
|
||||
for legacy reasons. This change doesn't have any operational impact
|
||||
in most common scenarios. [GL #605]
|
||||
</para>
|
||||
<para>
|
||||
If you are running multiple DNS Servers (different versions of BIND 9
|
||||
or DNS server from multiple vendors) responding from the same IP
|
||||
address (anycast or load-balancing scenarios), you'll have to make
|
||||
sure that all the servers are configured with the same DNS Cookie
|
||||
algorithm and same Server Secret for the best performance.
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
The information from the <command>dnssec-signzone</command> and
|
||||
<command>dnssec-verify</command> commands is now printed to standard
|
||||
output. The standard error output is only used to print warnings and
|
||||
errors, and in case the user requests the signed zone to be printed to
|
||||
standard output with <command>-f -</command> option. A new
|
||||
configuration option <command>-q</command> has been added to silence
|
||||
all output on standard output except for the name of the signed zone.
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
DS records included in DNS referral messages can now be validated
|
||||
and cached immediately, reducing the number of queries needed for
|
||||
a DNSSEC validation. [GL #964]
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
NSEC Aggressive Cache (synth-from-dnssec) has been disabled by default
|
||||
because it was found to have a significant performance impact on the
|
||||
recursive service. The NSEC Aggressive Cache will be enable by default
|
||||
in the future releases. [GL #1265]
|
||||
</para>
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
</section>
|
||||
@@ -1,124 +0,0 @@
|
||||
<!--
|
||||
- Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
- file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
-
|
||||
- See the COPYRIGHT file distributed with this work for additional
|
||||
- information regarding copyright ownership.
|
||||
-->
|
||||
|
||||
<section xml:id="relnotes_features"><info><title>New Features</title></info>
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>
|
||||
The new <command>dnssec-policy</command> option allows the
|
||||
configuration key and signing policy (KASP) for zones. This
|
||||
option enables <command>named</command> to generate new keys
|
||||
as needed and automatically roll both ZSK and KSK keys.
|
||||
(Note that the syntax for this statement differs from the dnssec
|
||||
policy used by <command>dnssec-keymgr</command>.) [GL #1134]
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
Added a new statistics variable <command>tcp-highwater</command>
|
||||
that reports the maximum number of simultaneous TCP clients BIND
|
||||
has handled while running. [GL #1206]
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
Added a new command line option to <command>dig</command>:
|
||||
<command>+[no]unexpected</command>. By default, <command>dig</command>
|
||||
won't accept a reply from a source other than the one to which
|
||||
it sent the query. Add the <command>+unexpected</command> argument
|
||||
to enable it to process replies from unexpected sources.
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
The GeoIP2 API from MaxMind is now supported. Geolocation support
|
||||
will be compiled in by default if the <command>libmaxminddb</command>
|
||||
library is found at compile time, but can be turned off by using
|
||||
<command>configure --disable-geoip</command>.
|
||||
</para>
|
||||
<para>
|
||||
The default path to the GeoIP2 databases will be set based
|
||||
on the location of the <command>libmaxminddb</command> library;
|
||||
for example, if it is in <filename>/usr/local/lib</filename>,
|
||||
then the default path will be
|
||||
<filename>/usr/local/share/GeoIP</filename>.
|
||||
This value can be overridden in <filename>named.conf</filename>
|
||||
using the <command>geoip-directory</command> option.
|
||||
</para>
|
||||
<para>
|
||||
Some <command>geoip</command> ACL settings that were available with
|
||||
legacy GeoIP, including searches for <command>netspeed</command>,
|
||||
<command>org</command>, and three-letter ISO country codes, will
|
||||
no longer work when using GeoIP2. Supported GeoIP2 database
|
||||
types are <command>country</command>, <command>city</command>,
|
||||
<command>domain</command>, <command>isp</command>, and
|
||||
<command>as</command>. All of these databases support both IPv4
|
||||
and IPv6 lookups. [GL #182] [GL #1112]
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
In order to clarify the configuration of DNSSEC keys,
|
||||
the <command>trusted-keys</command> and
|
||||
<command>managed-keys</command> statements have been
|
||||
deprecated, and the new <command>dnssec-keys</command>
|
||||
statement should now be used for both types of key.
|
||||
</para>
|
||||
<para>
|
||||
When used with the keyword <command>initial-key</command>,
|
||||
<command>dnssec-keys</command> has the same behavior as
|
||||
<command>managed-keys</command>, i.e., it configures
|
||||
a trust anchor that is to be maintained via RFC 5011.
|
||||
</para>
|
||||
<para>
|
||||
When used with the new keyword <command>static-key</command>, it
|
||||
has the same behavior as <command>trusted-keys</command>,
|
||||
configuring a permanent trust anchor that will not automatically
|
||||
be updated. (This usage is not recommended for the root key.)
|
||||
[GL #6]
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
The new <command>add-soa</command> option specifies whether
|
||||
or not the <command>response-policy</command> zone's SOA record
|
||||
should be included in the additional section of RPZ responses.
|
||||
[GL #865]
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
Two new metrics have been added to the
|
||||
<command>statistics-channel</command> to report DNSSEC
|
||||
signing operations. For each key in each zone, the
|
||||
<command>dnssec-sign</command> counter indicates the total
|
||||
number of signatures <command>named</command> has generated
|
||||
using that key since server startup, and the
|
||||
<command>dnssec-refresh</command> counter indicates how
|
||||
many of those signatures were refreshed during zone
|
||||
maintenance, as opposed to having been generated
|
||||
as a result of a zone update. [GL #513]
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
Statistics channel groups are now toggleable. [GL #1030]
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
<command>dig</command>, <command>mdig</command> and
|
||||
<command>delv</command> can all now take a <command>+yaml</command>
|
||||
option to print output in a a detailed YAML format. [RT #1145]
|
||||
</para>
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
</section>
|
||||
@@ -1,39 +0,0 @@
|
||||
<!--
|
||||
- Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
- file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
-
|
||||
- See the COPYRIGHT file distributed with this work for additional
|
||||
- information regarding copyright ownership.
|
||||
-->
|
||||
|
||||
<section xml:id="relnotes_removed"><info><title>Removed Features</title></info>
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>
|
||||
The <command>dnssec-enable</command> option has been obsoleted and
|
||||
no longer has any effect. DNSSEC responses are always enabled
|
||||
if signatures and other DNSSEC data are present. [GL #866]
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
The <command>cleaning-interval</command> option has been
|
||||
removed. [GL !1731]
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
DNSSEC Lookaside Validation (DLV) is now obsolete.
|
||||
The <command>dnssec-lookaside</command> option has been
|
||||
marked as deprecated; when used in <filename>named.conf</filename>,
|
||||
it will generate a warning but will otherwise be ignored.
|
||||
All code enabling the use of lookaside validation has been removed
|
||||
from the validator, <command>delv</command>, and the DNSSEC tools.
|
||||
[GL #7]
|
||||
</para>
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
</section>
|
||||
@@ -1,53 +0,0 @@
|
||||
<!--
|
||||
- Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
- file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
-
|
||||
- See the COPYRIGHT file distributed with this work for additional
|
||||
- information regarding copyright ownership.
|
||||
-->
|
||||
|
||||
<section xml:id="relnotes_security"><info><title>Security Fixes</title></info>
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>
|
||||
The TCP client quota set using the <command>tcp-clients</command>
|
||||
option could be exceeded in some cases. This could lead to
|
||||
exhaustion of file descriptors. This flaw is disclosed in
|
||||
CVE-2018-5743. [GL #615]
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
In certain configurations, <command>named</command> could crash
|
||||
with an assertion failure if <command>nxdomain-redirect</command>
|
||||
was in use and a redirected query resulted in an NXDOMAIN from the
|
||||
cache. This flaw is disclosed in CVE-2019-6467. [GL #880]
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
A race condition could trigger an assertion failure when
|
||||
a large number of incoming packets were being rejected.
|
||||
This flaw is disclosed in CVE-2019-6471. [GL #942]
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
<command>named</command> could crash with an assertion failure
|
||||
if a forwarder returned a referral, rather than resolving the
|
||||
query, when QNAME minimization was enabled. This flaw is
|
||||
disclosed in CVE-2019-6476. [GL #1051]
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
A flaw in DNSSEC verification when transferring mirror zones
|
||||
could allow data to be incorrectly marked valid. This flaw
|
||||
is disclosed in CVE-2019-6475. [GL #1252]
|
||||
</para>
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
</section>
|
||||
@@ -14,6 +14,6 @@
|
||||
Thank you to everyone who assisted us in making this release possible.
|
||||
If you would like to contribute to ISC to assist us in continuing to
|
||||
make quality open source software, please visit our donations page at
|
||||
<link xmlns:xlink="http://www.w3.org/1999/xlink" xlink:href="http://www.isc.org/donate/">http://www.isc.org/donate/</link>.
|
||||
<link xmlns:xlink="http://www.w3.org/1999/xlink" xlink:href="https://www.isc.org/donate/">https://www.isc.org/donate/</link>.
|
||||
</para>
|
||||
</section>
|
||||
|
||||
@@ -79,362 +79,517 @@
|
||||
<a name="relnotes_download"></a>Download</h3></div></div></div>
|
||||
<p>
|
||||
The latest versions of BIND 9 software can always be found at
|
||||
<a class="link" href="http://www.isc.org/downloads/" target="_top">http://www.isc.org/downloads/</a>.
|
||||
<a class="link" href="https://www.isc.org/download/" target="_top">https://www.isc.org/download/</a>.
|
||||
There you will find additional information about each release,
|
||||
source code, and pre-compiled versions for Microsoft Windows
|
||||
operating systems.
|
||||
</p>
|
||||
</div>
|
||||
|
||||
<div class="section">
|
||||
<div class="titlepage"><div><div><h3 class="title">
|
||||
<a name="relnotes_security"></a>Security Fixes</h3></div></div></div>
|
||||
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
|
||||
<a name="relnotes-9.15.6"></a>Notes for BIND 9.15.6</h3></div></div></div>
|
||||
|
||||
<div class="section">
|
||||
<div class="titlepage"><div><div><h4 class="title">
|
||||
<a name="relnotes-9.15.6-new"></a>New Features</h4></div></div></div>
|
||||
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
|
||||
<li class="listitem">
|
||||
<p>
|
||||
The TCP client quota set using the <span class="command"><strong>tcp-clients</strong></span>
|
||||
option could be exceeded in some cases. This could lead to
|
||||
exhaustion of file descriptors. This flaw is disclosed in
|
||||
CVE-2018-5743. [GL #615]
|
||||
</p>
|
||||
</li>
|
||||
<p>
|
||||
A new asynchronous network communications system based on
|
||||
<span class="command"><strong>libuv</strong></span> is now used by <span class="command"><strong>named</strong></span>
|
||||
for listening for incoming requests and responding to them.
|
||||
This change will make it easier to improve performance and
|
||||
implement new protocol layers (for example, DNS over TLS) in
|
||||
the future. [GL #29]
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
In certain configurations, <span class="command"><strong>named</strong></span> could crash
|
||||
with an assertion failure if <span class="command"><strong>nxdomain-redirect</strong></span>
|
||||
was in use and a redirected query resulted in an NXDOMAIN from the
|
||||
cache. This flaw is disclosed in CVE-2019-6467. [GL #880]
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
A race condition could trigger an assertion failure when
|
||||
a large number of incoming packets were being rejected.
|
||||
This flaw is disclosed in CVE-2019-6471. [GL #942]
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
<span class="command"><strong>named</strong></span> could crash with an assertion failure
|
||||
if a forwarder returned a referral, rather than resolving the
|
||||
query, when QNAME minimization was enabled. This flaw is
|
||||
disclosed in CVE-2019-6476. [GL #1051]
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
A flaw in DNSSEC verification when transferring mirror zones
|
||||
could allow data to be incorrectly marked valid. This flaw
|
||||
is disclosed in CVE-2019-6475. [GL #1252]
|
||||
</p>
|
||||
</li>
|
||||
<p>
|
||||
The new <span class="command"><strong>dnssec-policy</strong></span> option allows the
|
||||
configuration key and signing policy (KASP) for zones. This
|
||||
option enables <span class="command"><strong>named</strong></span> to generate new keys
|
||||
as needed and automatically roll both ZSK and KSK keys.
|
||||
(Note that the syntax for this statement differs from the DNSSEC
|
||||
policy used by <span class="command"><strong>dnssec-keymgr</strong></span>.) [GL #1134]
|
||||
</p>
|
||||
</li>
|
||||
</ul></div>
|
||||
</div>
|
||||
|
||||
<div class="section">
|
||||
<div class="titlepage"><div><div><h4 class="title">
|
||||
<a name="relnotes-9.15.6-changes"></a>Feature Changes</h4></div></div></div>
|
||||
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
|
||||
<p>
|
||||
NSEC Aggressive Cache (synth-from-dnssec) has been disabled by default
|
||||
because it was found to have a significant performance impact on the
|
||||
recursive service. The NSEC Aggressive Cache will be enable by default
|
||||
in the future releases. [GL #1265]
|
||||
</p>
|
||||
</li></ul></div>
|
||||
</div>
|
||||
|
||||
</div>
|
||||
<div class="section">
|
||||
<div class="titlepage"><div><div><h3 class="title">
|
||||
<a name="relnotes_features"></a>New Features</h3></div></div></div>
|
||||
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
|
||||
<a name="relnotes-9.15.5"></a>Notes for BIND 9.15.5</h3></div></div></div>
|
||||
|
||||
<div class="section">
|
||||
<div class="titlepage"><div><div><h4 class="title">
|
||||
<a name="relnotes-9.15.5-security"></a>Security Fixes</h4></div></div></div>
|
||||
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
|
||||
<li class="listitem">
|
||||
<p>
|
||||
Added a new command line option to <span class="command"><strong>dig</strong></span>:
|
||||
<span class="command"><strong>+[no]unexpected</strong></span>. By default, <span class="command"><strong>dig</strong></span>
|
||||
won't accept a reply from a source other than the one to which
|
||||
it sent the query. Add the <span class="command"><strong>+unexpected</strong></span> argument
|
||||
to enable it to process replies from unexpected sources.
|
||||
</p>
|
||||
</li>
|
||||
<p>
|
||||
<span class="command"><strong>named</strong></span> could crash with an assertion failure
|
||||
if a forwarder returned a referral, rather than resolving the
|
||||
query, when QNAME minimization was enabled. This flaw is
|
||||
disclosed in CVE-2019-6476. [GL #1051]
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
The GeoIP2 API from MaxMind is now supported. Geolocation support
|
||||
will be compiled in by default if the <span class="command"><strong>libmaxminddb</strong></span>
|
||||
library is found at compile time, but can be turned off by using
|
||||
<span class="command"><strong>configure --disable-geoip</strong></span>.
|
||||
</p>
|
||||
<p>
|
||||
The default path to the GeoIP2 databases will be set based
|
||||
on the location of the <span class="command"><strong>libmaxminddb</strong></span> library;
|
||||
for example, if it is in <code class="filename">/usr/local/lib</code>,
|
||||
then the default path will be
|
||||
<code class="filename">/usr/local/share/GeoIP</code>.
|
||||
This value can be overridden in <code class="filename">named.conf</code>
|
||||
using the <span class="command"><strong>geoip-directory</strong></span> option.
|
||||
</p>
|
||||
<p>
|
||||
Some <span class="command"><strong>geoip</strong></span> ACL settings that were available with
|
||||
legacy GeoIP, including searches for <span class="command"><strong>netspeed</strong></span>,
|
||||
<span class="command"><strong>org</strong></span>, and three-letter ISO country codes, will
|
||||
no longer work when using GeoIP2. Supported GeoIP2 database
|
||||
types are <span class="command"><strong>country</strong></span>, <span class="command"><strong>city</strong></span>,
|
||||
<span class="command"><strong>domain</strong></span>, <span class="command"><strong>isp</strong></span>, and
|
||||
<span class="command"><strong>as</strong></span>. All of these databases support both IPv4
|
||||
and IPv6 lookups. [GL #182] [GL #1112]
|
||||
</p>
|
||||
</li>
|
||||
<p>
|
||||
A flaw in DNSSEC verification when transferring mirror zones
|
||||
could allow data to be incorrectly marked valid. This flaw
|
||||
is disclosed in CVE-2019-6475. [GL #1252]
|
||||
</p>
|
||||
</li>
|
||||
</ul></div>
|
||||
</div>
|
||||
|
||||
</div>
|
||||
<div class="section">
|
||||
<div class="titlepage"><div><div><h3 class="title">
|
||||
<a name="relnotes-9.15.4"></a>Notes for BIND 9.15.4</h3></div></div></div>
|
||||
|
||||
<div class="section">
|
||||
<div class="titlepage"><div><div><h4 class="title">
|
||||
<a name="relnotes-9.15.4-new"></a>New Features</h4></div></div></div>
|
||||
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
|
||||
<li class="listitem">
|
||||
<p>
|
||||
In order to clarify the configuration of DNSSEC keys,
|
||||
the <span class="command"><strong>trusted-keys</strong></span> and
|
||||
<span class="command"><strong>managed-keys</strong></span> statements have been
|
||||
deprecated, and the new <span class="command"><strong>dnssec-keys</strong></span>
|
||||
statement should now be used for both types of key.
|
||||
</p>
|
||||
<p>
|
||||
When used with the keyword <span class="command"><strong>initial-key</strong></span>,
|
||||
<span class="command"><strong>dnssec-keys</strong></span> has the same behavior as
|
||||
<span class="command"><strong>managed-keys</strong></span>, i.e., it configures
|
||||
a trust anchor that is to be maintained via RFC 5011.
|
||||
</p>
|
||||
<p>
|
||||
When used with the new keyword <span class="command"><strong>static-key</strong></span>, it
|
||||
has the same behavior as <span class="command"><strong>trusted-keys</strong></span>,
|
||||
configuring a permanent trust anchor that will not automatically
|
||||
be updated. (This usage is not recommended for the root key.)
|
||||
[GL #6]
|
||||
</p>
|
||||
</li>
|
||||
<p>
|
||||
Added a new command line option to <span class="command"><strong>dig</strong></span>:
|
||||
<span class="command"><strong>+[no]unexpected</strong></span>. By default, <span class="command"><strong>dig</strong></span>
|
||||
won't accept a reply from a source other than the one to which
|
||||
it sent the query. Add the <span class="command"><strong>+unexpected</strong></span> argument
|
||||
to enable it to process replies from unexpected sources.
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
The new <span class="command"><strong>add-soa</strong></span> option specifies whether
|
||||
or not the <span class="command"><strong>response-policy</strong></span> zone's SOA record
|
||||
should be included in the additional section of RPZ responses.
|
||||
[GL #865]
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
Two new metrics have been added to the
|
||||
<span class="command"><strong>statistics-channel</strong></span> to report DNSSEC
|
||||
signing operations. For each key in each zone, the
|
||||
<span class="command"><strong>dnssec-sign</strong></span> counter indicates the total
|
||||
number of signatures <span class="command"><strong>named</strong></span> has generated
|
||||
using that key since server startup, and the
|
||||
<span class="command"><strong>dnssec-refresh</strong></span> counter indicates how
|
||||
many of those signatures were refreshed during zone
|
||||
maintenance, as opposed to having been generated
|
||||
as a result of a zone update. [GL #513]
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
<p>
|
||||
<span class="command"><strong>dig</strong></span>, <span class="command"><strong>mdig</strong></span> and
|
||||
<span class="command"><strong>delv</strong></span> can all now take a <span class="command"><strong>+yaml</strong></span>
|
||||
option to print output in a a detailed YAML format. [RT #1145]
|
||||
</p>
|
||||
</li>
|
||||
</ul></div>
|
||||
</div>
|
||||
|
||||
<div class="section">
|
||||
<div class="titlepage"><div><div><h4 class="title">
|
||||
<a name="relnotes-9.15.4-bugs"></a>Bug Fixes</h4></div></div></div>
|
||||
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
|
||||
<p>
|
||||
When a <span class="command"><strong>response-policy</strong></span> zone expires, ensure
|
||||
that its policies are removed from the RPZ summary database.
|
||||
[GL #1146]
|
||||
</p>
|
||||
</li></ul></div>
|
||||
</div>
|
||||
|
||||
</div>
|
||||
<div class="section">
|
||||
<div class="titlepage"><div><div><h3 class="title">
|
||||
<a name="relnotes-9.15.3"></a>Notes for BIND 9.15.3</h3></div></div></div>
|
||||
|
||||
<div class="section">
|
||||
<div class="titlepage"><div><div><h4 class="title">
|
||||
<a name="relnotes-9.15.3-new"></a>New Features</h4></div></div></div>
|
||||
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
|
||||
<p>
|
||||
Statistics channel groups are now toggleable. [GL #1030]
|
||||
</p>
|
||||
</li>
|
||||
</p>
|
||||
</li></ul></div>
|
||||
</div>
|
||||
|
||||
<div class="section">
|
||||
<div class="titlepage"><div><div><h4 class="title">
|
||||
<a name="relnotes-9.15.3-removed"></a>Removed Features</h4></div></div></div>
|
||||
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
|
||||
<p>
|
||||
DNSSEC Lookaside Validation (DLV) is now obsolete.
|
||||
The <span class="command"><strong>dnssec-lookaside</strong></span> option has been
|
||||
marked as deprecated; when used in <code class="filename">named.conf</code>,
|
||||
it will generate a warning but will otherwise be ignored.
|
||||
All code enabling the use of lookaside validation has been removed
|
||||
from the validator, <span class="command"><strong>delv</strong></span>, and the DNSSEC tools.
|
||||
[GL #7]
|
||||
</p>
|
||||
</li></ul></div>
|
||||
</div>
|
||||
|
||||
<div class="section">
|
||||
<div class="titlepage"><div><div><h4 class="title">
|
||||
<a name="relnotes-9.15.3-changes"></a>Feature Changes</h4></div></div></div>
|
||||
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
|
||||
<li class="listitem">
|
||||
<p>
|
||||
<span class="command"><strong>dig</strong></span>, <span class="command"><strong>mdig</strong></span> and
|
||||
<span class="command"><strong>delv</strong></span> can all now take a <span class="command"><strong>+yaml</strong></span>
|
||||
option to print output in a a detailed YAML format. [RT #1145]
|
||||
</p>
|
||||
</li>
|
||||
<p>
|
||||
A SipHash 2-4 based DNS Cookie (RFC 7873) algorithm has been added and
|
||||
made default. Old non-default HMAC-SHA based DNS Cookie algorithms
|
||||
have been removed, and only the default AES algorithm is being kept
|
||||
for legacy reasons. This change doesn't have any operational impact
|
||||
in most common scenarios. [GL #605]
|
||||
</p>
|
||||
<p>
|
||||
If you are running multiple DNS Servers (different versions of BIND 9
|
||||
or DNS server from multiple vendors) responding from the same IP
|
||||
address (anycast or load-balancing scenarios), you'll have to make
|
||||
sure that all the servers are configured with the same DNS Cookie
|
||||
algorithm and same Server Secret for the best performance.
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
The information from the <span class="command"><strong>dnssec-signzone</strong></span> and
|
||||
<span class="command"><strong>dnssec-verify</strong></span> commands is now printed to standard
|
||||
output. The standard error output is only used to print warnings and
|
||||
errors, and in case the user requests the signed zone to be printed to
|
||||
standard output with <span class="command"><strong>-f -</strong></span> option. A new
|
||||
configuration option <span class="command"><strong>-q</strong></span> has been added to silence
|
||||
all output on standard output except for the name of the signed zone.
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
DS records included in DNS referral messages can now be validated
|
||||
and cached immediately, reducing the number of queries needed for
|
||||
a DNSSEC validation. [GL #964]
|
||||
</p>
|
||||
</li>
|
||||
</ul></div>
|
||||
</div>
|
||||
|
||||
<div class="section">
|
||||
<div class="titlepage"><div><div><h4 class="title">
|
||||
<a name="relnotes-9.15.3-bugs"></a>Bug Fixes</h4></div></div></div>
|
||||
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
|
||||
<li class="listitem">
|
||||
<p>
|
||||
Cache database statistics counters could report invalid values
|
||||
when stale answers were enabled, because of a bug in counter
|
||||
maintenance when cache data becomes stale. The statistics counters
|
||||
have been corrected to report the number of RRsets for each
|
||||
RR type that are active, stale but still potentially served,
|
||||
or stale and marked for deletion. [GL #602]
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
Interaction between DNS64 and RPZ No Data rule (CNAME *.) could
|
||||
cause unexpected results; this has been fixed. [GL #1106]
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
<span class="command"><strong>named-checkconf</strong></span> now checks DNS64 prefixes
|
||||
to ensure bits 64-71 are zero. [GL #1159]
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
<span class="command"><strong>named-checkconf</strong></span> now correctly reports a missing
|
||||
<span class="command"><strong>dnstap-output</strong></span> option when
|
||||
<span class="command"><strong>dnstap</strong></span> is set. [GL #1136]
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
Handle ETIMEDOUT error on connect() with a non-blocking
|
||||
socket. [GL #1133]
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
<span class="command"><strong>dig</strong></span> now correctly expands the IPv6 address
|
||||
when run with <span class="command"><strong>+expandaaaa +short</strong></span>. [GL #1152]
|
||||
</p>
|
||||
</li>
|
||||
</ul></div>
|
||||
</div>
|
||||
|
||||
</div>
|
||||
<div class="section">
|
||||
<div class="titlepage"><div><div><h3 class="title">
|
||||
<a name="relnotes_removed"></a>Removed Features</h3></div></div></div>
|
||||
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
|
||||
<a name="relnotes-9.15.2"></a>Notes for BIND 9.15.2</h3></div></div></div>
|
||||
|
||||
<div class="section">
|
||||
<div class="titlepage"><div><div><h4 class="title">
|
||||
<a name="relnotes-9.15.2-new"></a>New Features</h4></div></div></div>
|
||||
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
|
||||
<li class="listitem">
|
||||
<p>
|
||||
The <span class="command"><strong>dnssec-enable</strong></span> option has been obsoleted and
|
||||
no longer has any effect. DNSSEC responses are always enabled
|
||||
if signatures and other DNSSEC data are present. [GL #866]
|
||||
</p>
|
||||
</li>
|
||||
<p>
|
||||
The GeoIP2 API from MaxMind is now supported. Geolocation support
|
||||
will be compiled in by default if the <span class="command"><strong>libmaxminddb</strong></span>
|
||||
library is found at compile time, but can be turned off by using
|
||||
<span class="command"><strong>configure --disable-geoip</strong></span>.
|
||||
</p>
|
||||
<p>
|
||||
The default path to the GeoIP2 databases will be set based
|
||||
on the location of the <span class="command"><strong>libmaxminddb</strong></span> library;
|
||||
for example, if it is in <code class="filename">/usr/local/lib</code>,
|
||||
then the default path will be
|
||||
<code class="filename">/usr/local/share/GeoIP</code>.
|
||||
This value can be overridden in <code class="filename">named.conf</code>
|
||||
using the <span class="command"><strong>geoip-directory</strong></span> option.
|
||||
</p>
|
||||
<p>
|
||||
Some <span class="command"><strong>geoip</strong></span> ACL settings that were available with
|
||||
legacy GeoIP, including searches for <span class="command"><strong>netspeed</strong></span>,
|
||||
<span class="command"><strong>org</strong></span>, and three-letter ISO country codes, will
|
||||
no longer work when using GeoIP2. Supported GeoIP2 database
|
||||
types are <span class="command"><strong>country</strong></span>, <span class="command"><strong>city</strong></span>,
|
||||
<span class="command"><strong>domain</strong></span>, <span class="command"><strong>isp</strong></span>, and
|
||||
<span class="command"><strong>as</strong></span>. All of these databases support both IPv4
|
||||
and IPv6 lookups. [GL #182] [GL #1112]
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
The <span class="command"><strong>cleaning-interval</strong></span> option has been
|
||||
removed. [GL !1731]
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
DNSSEC Lookaside Validation (DLV) is now obsolete.
|
||||
The <span class="command"><strong>dnssec-lookaside</strong></span> option has been
|
||||
marked as deprecated; when used in <code class="filename">named.conf</code>,
|
||||
it will generate a warning but will otherwise be ignored.
|
||||
All code enabling the use of lookaside validation has been removed
|
||||
from the validator, <span class="command"><strong>delv</strong></span>, and the DNSSEC tools.
|
||||
[GL #7]
|
||||
</p>
|
||||
</li>
|
||||
<p>
|
||||
Two new metrics have been added to the
|
||||
<span class="command"><strong>statistics-channel</strong></span> to report DNSSEC
|
||||
signing operations. For each key in each zone, the
|
||||
<span class="command"><strong>dnssec-sign</strong></span> counter indicates the total
|
||||
number of signatures <span class="command"><strong>named</strong></span> has generated
|
||||
using that key since server startup, and the
|
||||
<span class="command"><strong>dnssec-refresh</strong></span> counter indicates how
|
||||
many of those signatures were refreshed during zone
|
||||
maintenance, as opposed to having been generated
|
||||
as a result of a zone update. [GL #513]
|
||||
</p>
|
||||
</li>
|
||||
</ul></div>
|
||||
</div>
|
||||
|
||||
<div class="section">
|
||||
<div class="titlepage"><div><div><h4 class="title">
|
||||
<a name="relnotes-9.15.2-bugs"></a>Bug Fixes</h4></div></div></div>
|
||||
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
|
||||
<li class="listitem">
|
||||
<p>
|
||||
When <span class="command"><strong>qname-minimization</strong></span> was set to
|
||||
<span class="command"><strong>relaxed</strong></span>, some improperly configured domains
|
||||
would fail to resolve, but would have succeeded when minimization
|
||||
was disabled. <span class="command"><strong>named</strong></span> will now fall back to normal
|
||||
resolution in such cases, and also uses type A rather than NS for
|
||||
minimal queries in order to reduce the likelihood of encountering
|
||||
the problem. [GL #1055]
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
<span class="command"><strong>./configure</strong></span> no longer sets
|
||||
<span class="command"><strong>--sysconfdir</strong></span> to <span class="command"><strong>/etc</strong></span> or
|
||||
<span class="command"><strong>--localstatedir</strong></span> to <span class="command"><strong>/var</strong></span>
|
||||
when <span class="command"><strong>--prefix</strong></span> is not specified and the
|
||||
aforementioned options are not specified explicitly. Instead,
|
||||
Autoconf's defaults of <span class="command"><strong>$prefix/etc</strong></span> and
|
||||
<span class="command"><strong>$prefix/var</strong></span> are respected.
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
Glue address records were not being returned in responses
|
||||
to root priming queries; this has been corrected. [GL #1092]
|
||||
</p>
|
||||
</li>
|
||||
</ul></div>
|
||||
</div>
|
||||
|
||||
</div>
|
||||
<div class="section">
|
||||
<div class="titlepage"><div><div><h3 class="title">
|
||||
<a name="relnotes_changes"></a>Feature Changes</h3></div></div></div>
|
||||
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
|
||||
<a name="relnotes-9.15.1"></a>Notes for BIND 9.15.1</h3></div></div></div>
|
||||
|
||||
<div class="section">
|
||||
<div class="titlepage"><div><div><h4 class="title">
|
||||
<a name="relnotes-9.15.1-security"></a>Security Fixes</h4></div></div></div>
|
||||
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
|
||||
<p>
|
||||
A race condition could trigger an assertion failure when
|
||||
a large number of incoming packets were being rejected.
|
||||
This flaw is disclosed in CVE-2019-6471. [GL #942]
|
||||
</p>
|
||||
</li></ul></div>
|
||||
</div>
|
||||
|
||||
<div class="section">
|
||||
<div class="titlepage"><div><div><h4 class="title">
|
||||
<a name="relnotes-9.15.1-new"></a>New Features</h4></div></div></div>
|
||||
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
|
||||
<p>
|
||||
In order to clarify the configuration of DNSSEC keys,
|
||||
the <span class="command"><strong>trusted-keys</strong></span> and
|
||||
<span class="command"><strong>managed-keys</strong></span> statements have been
|
||||
deprecated, and the new <span class="command"><strong>dnssec-keys</strong></span>
|
||||
statement should now be used for both types of key.
|
||||
</p>
|
||||
<p>
|
||||
When used with the keyword <span class="command"><strong>initial-key</strong></span>,
|
||||
<span class="command"><strong>dnssec-keys</strong></span> has the same behavior as
|
||||
<span class="command"><strong>managed-keys</strong></span>, i.e., it configures
|
||||
a trust anchor that is to be maintained via RFC 5011.
|
||||
</p>
|
||||
<p>
|
||||
When used with the new keyword <span class="command"><strong>static-key</strong></span>, it
|
||||
has the same behavior as <span class="command"><strong>trusted-keys</strong></span>,
|
||||
configuring a permanent trust anchor that will not automatically
|
||||
be updated. (This usage is not recommended for the root key.)
|
||||
[GL #6]
|
||||
</p>
|
||||
</li></ul></div>
|
||||
</div>
|
||||
|
||||
<div class="section">
|
||||
<div class="titlepage"><div><div><h4 class="title">
|
||||
<a name="relnotes-9.15.1-removed"></a>Removed Features</h4></div></div></div>
|
||||
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
|
||||
<p>
|
||||
The <span class="command"><strong>cleaning-interval</strong></span> option has been
|
||||
removed. [GL !1731]
|
||||
</p>
|
||||
</li></ul></div>
|
||||
</div>
|
||||
|
||||
<div class="section">
|
||||
<div class="titlepage"><div><div><h4 class="title">
|
||||
<a name="relnotes-9.15.1-changes"></a>Feature Changes</h4></div></div></div>
|
||||
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
|
||||
<li class="listitem">
|
||||
<p>
|
||||
<span class="command"><strong>named</strong></span> will now log a warning if
|
||||
a static key is configured for the root zone. [GL #6]
|
||||
</p>
|
||||
</li>
|
||||
<p>
|
||||
<span class="command"><strong>named</strong></span> will now log a warning if
|
||||
a static key is configured for the root zone. [GL #6]
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
When static and managed DNSSEC keys were both configured for the
|
||||
same name, or when a static key was used to
|
||||
configure a trust anchor for the root zone and
|
||||
<span class="command"><strong>dnssec-validation</strong></span> was set to the default
|
||||
value of <code class="literal">auto</code>, automatic RFC 5011 key
|
||||
rollovers would be disabled. This combination of settings was
|
||||
never intended to work, but there was no check for it in the
|
||||
parser. This has been corrected, and it is now a fatal
|
||||
configuration error. [GL #868]
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
DS and CDS records are now generated with SHA-256 digests
|
||||
only, instead of both SHA-1 and SHA-256. This affects the
|
||||
default output of <span class="command"><strong>dnssec-dsfromkey</strong></span>, the
|
||||
<code class="filename">dsset</code> files generated by
|
||||
<span class="command"><strong>dnssec-signzone</strong></span>, the DS records added to
|
||||
a zone by <span class="command"><strong>dnssec-signzone</strong></span> based on
|
||||
<code class="filename">keyset</code> files, the CDS records added to
|
||||
a zone by <span class="command"><strong>named</strong></span> and
|
||||
<span class="command"><strong>dnssec-signzone</strong></span> based on "sync" timing
|
||||
parameters in key files, and the checks performed by
|
||||
<span class="command"><strong>dnssec-checkds</strong></span>.
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
JSON-C is now the only supported library for enabling JSON
|
||||
support for BIND statistics. The <span class="command"><strong>configure</strong></span>
|
||||
option has been renamed from <span class="command"><strong>--with-libjson</strong></span>
|
||||
to <span class="command"><strong>--with-json-c</strong></span>. Use
|
||||
<span class="command"><strong>PKG_CONFIG_PATH</strong></span> to specify a custom path to
|
||||
the <span class="command"><strong>json-c</strong></span> library as the new
|
||||
<span class="command"><strong>configure</strong></span> option does not take the library
|
||||
installation path as an optional argument.
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
A SipHash 2-4 based DNS Cookie (RFC 7873) algorithm has been added and
|
||||
made default. Old non-default HMAC-SHA based DNS Cookie algorithms
|
||||
have been removed, and only the default AES algorithm is being kept
|
||||
for legacy reasons. This change doesn't have any operational impact
|
||||
in most common scenarios. [GL #605]
|
||||
</p>
|
||||
<p>
|
||||
If you are running multiple DNS Servers (different versions of BIND 9
|
||||
or DNS server from multiple vendors) responding from the same IP
|
||||
address (anycast or load-balancing scenarios), you'll have to make
|
||||
sure that all the servers are configured with the same DNS Cookie
|
||||
algorithm and same Server Secret for the best performance.
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
The information from the <span class="command"><strong>dnssec-signzone</strong></span> and
|
||||
<span class="command"><strong>dnssec-verify</strong></span> commands is now printed to standard
|
||||
output. The standard error output is only used to print warnings and
|
||||
errors, and in case the user requests the signed zone to be printed to
|
||||
standard output with <span class="command"><strong>-f -</strong></span> option. A new
|
||||
configuration option <span class="command"><strong>-q</strong></span> has been added to silence
|
||||
all output on standard output except for the name of the signed zone.
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
DS records included in DNS referral messages can now be validated
|
||||
and cached immediately, reducing the number of queries needed for
|
||||
a DNSSEC validation. [GL #964]
|
||||
</p>
|
||||
</li>
|
||||
<p>
|
||||
JSON-C is now the only supported library for enabling JSON
|
||||
support for BIND statistics. The <span class="command"><strong>configure</strong></span>
|
||||
option has been renamed from <span class="command"><strong>--with-libjson</strong></span>
|
||||
to <span class="command"><strong>--with-json-c</strong></span>. Use
|
||||
<span class="command"><strong>PKG_CONFIG_PATH</strong></span> to specify a custom path to
|
||||
the <span class="command"><strong>json-c</strong></span> library as the new
|
||||
<span class="command"><strong>configure</strong></span> option does not take the library
|
||||
installation path as an optional argument.
|
||||
</p>
|
||||
</li>
|
||||
</ul></div>
|
||||
</div>
|
||||
|
||||
</div>
|
||||
<div class="section">
|
||||
<div class="titlepage"><div><div><h3 class="title">
|
||||
<a name="relnotes_bugs"></a>Bug Fixes</h3></div></div></div>
|
||||
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
|
||||
<a name="relnotes-9.15.0"></a>Notes for BIND 9.15.0</h3></div></div></div>
|
||||
|
||||
<div class="section">
|
||||
<div class="titlepage"><div><div><h4 class="title">
|
||||
<a name="relnotes-9.15.0-security"></a>Security Fixes</h4></div></div></div>
|
||||
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
|
||||
<li class="listitem">
|
||||
<p>
|
||||
The <span class="command"><strong>allow-update</strong></span> and
|
||||
<span class="command"><strong>allow-update-forwarding</strong></span> options were
|
||||
inadvertently treated as configuration errors when used at the
|
||||
<span class="command"><strong>options</strong></span> or <span class="command"><strong>view</strong></span> level.
|
||||
This has now been corrected.
|
||||
[GL #913]
|
||||
</p>
|
||||
</li>
|
||||
<p>
|
||||
In certain configurations, <span class="command"><strong>named</strong></span> could crash
|
||||
with an assertion failure if <span class="command"><strong>nxdomain-redirect</strong></span>
|
||||
was in use and a redirected query resulted in an NXDOMAIN from the
|
||||
cache. This flaw is disclosed in CVE-2019-6467. [GL #880]
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
When <span class="command"><strong>qname-minimization</strong></span> was set to
|
||||
<span class="command"><strong>relaxed</strong></span>, some improperly configured domains
|
||||
would fail to resolve, but would have succeeded when minimization
|
||||
was disabled. <span class="command"><strong>named</strong></span> will now fall back to normal
|
||||
resolution in such cases, and also uses type A rather than NS for
|
||||
minimal queries in order to reduce the likelihood of encountering
|
||||
the problem. [GL #1055]
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
<span class="command"><strong>./configure</strong></span> no longer sets
|
||||
<span class="command"><strong>--sysconfdir</strong></span> to <span class="command"><strong>/etc</strong></span> or
|
||||
<span class="command"><strong>--localstatedir</strong></span> to <span class="command"><strong>/var</strong></span>
|
||||
when <span class="command"><strong>--prefix</strong></span> is not specified and the
|
||||
aforementioned options are not specified explicitly. Instead,
|
||||
Autoconf's defaults of <span class="command"><strong>$prefix/etc</strong></span> and
|
||||
<span class="command"><strong>$prefix/var</strong></span> are respected.
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
Glue address records were not being returned in responses
|
||||
to root priming queries; this has been corrected. [GL #1092]
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
Interaction between DNS64 and RPZ No Data rule (CNAME *.) could
|
||||
cause unexpected results; this has been fixed. [GL #1106]
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
<span class="command"><strong>named-checkconf</strong></span> now checks DNS64 prefixes
|
||||
to ensure bits 64-71 are zero. [GL #1159]
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
<span class="command"><strong>named-checkconf</strong></span> now correctly reports a missing
|
||||
<span class="command"><strong>dnstap-output</strong></span> option when
|
||||
<span class="command"><strong>dnstap</strong></span> is set. [GL #1136]
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
Handle ETIMEDOUT error on connect() with a non-blocking
|
||||
socket. [GL #1133]
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
Cache database statistics counters could report invalid values
|
||||
when stale answers were enabled, because of a bug in counter
|
||||
maintenance when cache data becomes stale. The statistics counters
|
||||
have been corrected to report the number of RRsets for each
|
||||
RR type that are active, stale but still potentially served,
|
||||
or stale and marked for deletion. [GL #602]
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
<span class="command"><strong>dig</strong></span> now correctly expands the IPv6 address
|
||||
when run with <span class="command"><strong>+expandaaaa +short</strong></span>. [GL #1152]
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
When a <span class="command"><strong>response-policy</strong></span> zone expires, ensure
|
||||
that its policies are removed from the RPZ summary database.
|
||||
[GL #1146]
|
||||
</p>
|
||||
</li>
|
||||
<p>
|
||||
The TCP client quota set using the <span class="command"><strong>tcp-clients</strong></span>
|
||||
option could be exceeded in some cases. This could lead to
|
||||
exhaustion of file descriptors. This flaw is disclosed in
|
||||
CVE-2018-5743. [GL #615]
|
||||
</p>
|
||||
</li>
|
||||
</ul></div>
|
||||
</div>
|
||||
|
||||
<div class="section">
|
||||
<div class="titlepage"><div><div><h4 class="title">
|
||||
<a name="relnotes-9.15.0-new"></a>New Features</h4></div></div></div>
|
||||
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
|
||||
<p>
|
||||
The new <span class="command"><strong>add-soa</strong></span> option specifies whether
|
||||
or not the <span class="command"><strong>response-policy</strong></span> zone's SOA record
|
||||
should be included in the additional section of RPZ responses.
|
||||
[GL #865]
|
||||
</p>
|
||||
</li></ul></div>
|
||||
</div>
|
||||
|
||||
<div class="section">
|
||||
<div class="titlepage"><div><div><h4 class="title">
|
||||
<a name="relnotes-9.15.0-removed"></a>Removed Features</h4></div></div></div>
|
||||
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
|
||||
<p>
|
||||
The <span class="command"><strong>dnssec-enable</strong></span> option has been obsoleted and
|
||||
no longer has any effect. DNSSEC responses are always enabled
|
||||
if signatures and other DNSSEC data are present. [GL #866]
|
||||
</p>
|
||||
</li></ul></div>
|
||||
</div>
|
||||
|
||||
<div class="section">
|
||||
<div class="titlepage"><div><div><h4 class="title">
|
||||
<a name="relnotes-9.15.0-changes"></a>Feature Changes</h4></div></div></div>
|
||||
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
|
||||
<li class="listitem">
|
||||
<p>
|
||||
When static and managed DNSSEC keys were both configured for the
|
||||
same name, or when a static key was used to
|
||||
configure a trust anchor for the root zone and
|
||||
<span class="command"><strong>dnssec-validation</strong></span> was set to the default
|
||||
value of <code class="literal">auto</code>, automatic RFC 5011 key
|
||||
rollovers would be disabled. This combination of settings was
|
||||
never intended to work, but there was no check for it in the
|
||||
parser. This has been corrected, and it is now a fatal
|
||||
configuration error. [GL #868]
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
DS and CDS records are now generated with SHA-256 digests
|
||||
only, instead of both SHA-1 and SHA-256. This affects the
|
||||
default output of <span class="command"><strong>dnssec-dsfromkey</strong></span>, the
|
||||
<code class="filename">dsset</code> files generated by
|
||||
<span class="command"><strong>dnssec-signzone</strong></span>, the DS records added to
|
||||
a zone by <span class="command"><strong>dnssec-signzone</strong></span> based on
|
||||
<code class="filename">keyset</code> files, the CDS records added to
|
||||
a zone by <span class="command"><strong>named</strong></span> and
|
||||
<span class="command"><strong>dnssec-signzone</strong></span> based on "sync" timing
|
||||
parameters in key files, and the checks performed by
|
||||
<span class="command"><strong>dnssec-checkds</strong></span>.
|
||||
</p>
|
||||
</li>
|
||||
</ul></div>
|
||||
</div>
|
||||
|
||||
<div class="section">
|
||||
<div class="titlepage"><div><div><h4 class="title">
|
||||
<a name="relnotes-9.15.0-bugs"></a>Bug Fixes</h4></div></div></div>
|
||||
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
|
||||
<p>
|
||||
The <span class="command"><strong>allow-update</strong></span> and
|
||||
<span class="command"><strong>allow-update-forwarding</strong></span> options were
|
||||
inadvertently treated as configuration errors when used at the
|
||||
<span class="command"><strong>options</strong></span> or <span class="command"><strong>view</strong></span> level.
|
||||
This has now been corrected.
|
||||
[GL #913]
|
||||
</p>
|
||||
</li></ul></div>
|
||||
</div>
|
||||
|
||||
</div>
|
||||
|
||||
<div class="section">
|
||||
<div class="titlepage"><div><div><h3 class="title">
|
||||
<a name="relnotes_license"></a>License</h3></div></div></div>
|
||||
@@ -471,7 +626,7 @@
|
||||
For those needing long term support, the current Extended Support
|
||||
Version (ESV) is BIND 9.11, which will be supported until at
|
||||
least December 2021. See
|
||||
<a class="link" href="https://www.isc.org/downloads/software-support-policy/" target="_top">https://www.isc.org/downloads/software-support-policy/</a>
|
||||
<a class="link" href="https://kb.isc.org/docs/aa-00896" target="_top">https://kb.isc.org/docs/aa-00896</a>
|
||||
for details of ISC's software support policy.
|
||||
</p>
|
||||
</div>
|
||||
@@ -482,7 +637,7 @@
|
||||
Thank you to everyone who assisted us in making this release possible.
|
||||
If you would like to contribute to ISC to assist us in continuing to
|
||||
make quality open source software, please visit our donations page at
|
||||
<a class="link" href="http://www.isc.org/donate/" target="_top">http://www.isc.org/donate/</a>.
|
||||
<a class="link" href="https://www.isc.org/donate/" target="_top">https://www.isc.org/donate/</a>.
|
||||
</p>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
Binary file not shown.
@@ -43,26 +43,38 @@ support for systems that are still supported by their respective vendors.
|
||||
|
||||
Download
|
||||
|
||||
The latest versions of BIND 9 software can always be found at http://
|
||||
www.isc.org/downloads/. There you will find additional information about
|
||||
The latest versions of BIND 9 software can always be found at https://
|
||||
www.isc.org/download/. There you will find additional information about
|
||||
each release, source code, and pre-compiled versions for Microsoft Windows
|
||||
operating systems.
|
||||
|
||||
Notes for BIND 9.15.6
|
||||
|
||||
New Features
|
||||
|
||||
* A new asynchronous network communications system based on libuv is now
|
||||
used by named for listening for incoming requests and responding to
|
||||
them. This change will make it easier to improve performance and
|
||||
implement new protocol layers (for example, DNS over TLS) in the
|
||||
future. [GL #29]
|
||||
|
||||
* The new dnssec-policy option allows the configuration key and signing
|
||||
policy (KASP) for zones. This option enables named to generate new
|
||||
keys as needed and automatically roll both ZSK and KSK keys. (Note
|
||||
that the syntax for this statement differs from the DNSSEC policy used
|
||||
by dnssec-keymgr.) [GL #1134]
|
||||
|
||||
Feature Changes
|
||||
|
||||
* NSEC Aggressive Cache (synth-from-dnssec) has been disabled by default
|
||||
because it was found to have a significant performance impact on the
|
||||
recursive service. The NSEC Aggressive Cache will be enable by default
|
||||
in the future releases. [GL #1265]
|
||||
|
||||
Notes for BIND 9.15.5
|
||||
|
||||
Security Fixes
|
||||
|
||||
* The TCP client quota set using the tcp-clients option could be
|
||||
exceeded in some cases. This could lead to exhaustion of file
|
||||
descriptors. This flaw is disclosed in CVE-2018-5743. [GL #615]
|
||||
|
||||
* In certain configurations, named could crash with an assertion failure
|
||||
if nxdomain-redirect was in use and a redirected query resulted in an
|
||||
NXDOMAIN from the cache. This flaw is disclosed in CVE-2019-6467. [GL
|
||||
#880]
|
||||
|
||||
* A race condition could trigger an assertion failure when a large
|
||||
number of incoming packets were being rejected. This flaw is disclosed
|
||||
in CVE-2019-6471. [GL #942]
|
||||
|
||||
* named could crash with an assertion failure if a forwarder returned a
|
||||
referral, rather than resolving the query, when QNAME minimization was
|
||||
enabled. This flaw is disclosed in CVE-2019-6476. [GL #1051]
|
||||
@@ -71,6 +83,8 @@ Security Fixes
|
||||
allow data to be incorrectly marked valid. This flaw is disclosed in
|
||||
CVE-2019-6475. [GL #1252]
|
||||
|
||||
Notes for BIND 9.15.4
|
||||
|
||||
New Features
|
||||
|
||||
* Added a new command line option to dig: +[no]unexpected. By default,
|
||||
@@ -78,61 +92,22 @@ New Features
|
||||
sent the query. Add the +unexpected argument to enable it to process
|
||||
replies from unexpected sources.
|
||||
|
||||
* The GeoIP2 API from MaxMind is now supported. Geolocation support will
|
||||
be compiled in by default if the libmaxminddb library is found at
|
||||
compile time, but can be turned off by using configure --disable-geoip
|
||||
.
|
||||
|
||||
The default path to the GeoIP2 databases will be set based on the
|
||||
location of the libmaxminddb library; for example, if it is in /usr/
|
||||
local/lib, then the default path will be /usr/local/share/GeoIP. This
|
||||
value can be overridden in named.conf using the geoip-directory
|
||||
option.
|
||||
|
||||
Some geoip ACL settings that were available with legacy GeoIP,
|
||||
including searches for netspeed, org, and three-letter ISO country
|
||||
codes, will no longer work when using GeoIP2. Supported GeoIP2
|
||||
database types are country, city, domain, isp, and as. All of these
|
||||
databases support both IPv4 and IPv6 lookups. [GL #182] [GL #1112]
|
||||
|
||||
* In order to clarify the configuration of DNSSEC keys, the trusted-keys
|
||||
and managed-keys statements have been deprecated, and the new
|
||||
dnssec-keys statement should now be used for both types of key.
|
||||
|
||||
When used with the keyword initial-key, dnssec-keys has the same
|
||||
behavior as managed-keys, i.e., it configures a trust anchor that is
|
||||
to be maintained via RFC 5011.
|
||||
|
||||
When used with the new keyword static-key, it has the same behavior as
|
||||
trusted-keys, configuring a permanent trust anchor that will not
|
||||
automatically be updated. (This usage is not recommended for the root
|
||||
key.) [GL #6]
|
||||
|
||||
* The new add-soa option specifies whether or not the response-policy
|
||||
zone's SOA record should be included in the additional section of RPZ
|
||||
responses. [GL #865]
|
||||
|
||||
* Two new metrics have been added to the statistics-channel to report
|
||||
DNSSEC signing operations. For each key in each zone, the dnssec-sign
|
||||
counter indicates the total number of signatures named has generated
|
||||
using that key since server startup, and the dnssec-refresh counter
|
||||
indicates how many of those signatures were refreshed during zone
|
||||
maintenance, as opposed to having been generated as a result of a zone
|
||||
update. [GL #513]
|
||||
|
||||
* Statistics channel groups are now toggleable. [GL #1030]
|
||||
|
||||
* dig, mdig and delv can all now take a +yaml option to print output in
|
||||
a a detailed YAML format. [RT #1145]
|
||||
|
||||
Bug Fixes
|
||||
|
||||
* When a response-policy zone expires, ensure that its policies are
|
||||
removed from the RPZ summary database. [GL #1146]
|
||||
|
||||
Notes for BIND 9.15.3
|
||||
|
||||
New Features
|
||||
|
||||
* Statistics channel groups are now toggleable. [GL #1030]
|
||||
|
||||
Removed Features
|
||||
|
||||
* The dnssec-enable option has been obsoleted and no longer has any
|
||||
effect. DNSSEC responses are always enabled if signatures and other
|
||||
DNSSEC data are present. [GL #866]
|
||||
|
||||
* The cleaning-interval option has been removed. [GL !1731]
|
||||
|
||||
* DNSSEC Lookaside Validation (DLV) is now obsolete. The
|
||||
dnssec-lookaside option has been marked as deprecated; when used in
|
||||
named.conf, it will generate a warning but will otherwise be ignored.
|
||||
@@ -141,31 +116,6 @@ Removed Features
|
||||
|
||||
Feature Changes
|
||||
|
||||
* named will now log a warning if a static key is configured for the
|
||||
root zone. [GL #6]
|
||||
|
||||
* When static and managed DNSSEC keys were both configured for the same
|
||||
name, or when a static key was used to configure a trust anchor for
|
||||
the root zone and dnssec-validation was set to the default value of
|
||||
auto, automatic RFC 5011 key rollovers would be disabled. This
|
||||
combination of settings was never intended to work, but there was no
|
||||
check for it in the parser. This has been corrected, and it is now a
|
||||
fatal configuration error. [GL #868]
|
||||
|
||||
* DS and CDS records are now generated with SHA-256 digests only,
|
||||
instead of both SHA-1 and SHA-256. This affects the default output of
|
||||
dnssec-dsfromkey, the dsset files generated by dnssec-signzone, the DS
|
||||
records added to a zone by dnssec-signzone based on keyset files, the
|
||||
CDS records added to a zone by named and dnssec-signzone based on
|
||||
"sync" timing parameters in key files, and the checks performed by
|
||||
dnssec-checkds.
|
||||
|
||||
* JSON-C is now the only supported library for enabling JSON support for
|
||||
BIND statistics. The configure option has been renamed from
|
||||
--with-libjson to --with-json-c. Use PKG_CONFIG_PATH to specify a
|
||||
custom path to the json-c library as the new configure option does not
|
||||
take the library installation path as an optional argument.
|
||||
|
||||
* A SipHash 2-4 based DNS Cookie (RFC 7873) algorithm has been added and
|
||||
made default. Old non-default HMAC-SHA based DNS Cookie algorithms
|
||||
have been removed, and only the default AES algorithm is being kept
|
||||
@@ -191,9 +141,58 @@ Feature Changes
|
||||
|
||||
Bug Fixes
|
||||
|
||||
* The allow-update and allow-update-forwarding options were
|
||||
inadvertently treated as configuration errors when used at the options
|
||||
or view level. This has now been corrected. [GL #913]
|
||||
* Cache database statistics counters could report invalid values when
|
||||
stale answers were enabled, because of a bug in counter maintenance
|
||||
when cache data becomes stale. The statistics counters have been
|
||||
corrected to report the number of RRsets for each RR type that are
|
||||
active, stale but still potentially served, or stale and marked for
|
||||
deletion. [GL #602]
|
||||
|
||||
* Interaction between DNS64 and RPZ No Data rule (CNAME *.) could cause
|
||||
unexpected results; this has been fixed. [GL #1106]
|
||||
|
||||
* named-checkconf now checks DNS64 prefixes to ensure bits 64-71 are
|
||||
zero. [GL #1159]
|
||||
|
||||
* named-checkconf now correctly reports a missing dnstap-output option
|
||||
when dnstap is set. [GL #1136]
|
||||
|
||||
* Handle ETIMEDOUT error on connect() with a non-blocking socket. [GL #
|
||||
1133]
|
||||
|
||||
* dig now correctly expands the IPv6 address when run with +expandaaaa
|
||||
+short. [GL #1152]
|
||||
|
||||
Notes for BIND 9.15.2
|
||||
|
||||
New Features
|
||||
|
||||
* The GeoIP2 API from MaxMind is now supported. Geolocation support will
|
||||
be compiled in by default if the libmaxminddb library is found at
|
||||
compile time, but can be turned off by using configure --disable-geoip
|
||||
.
|
||||
|
||||
The default path to the GeoIP2 databases will be set based on the
|
||||
location of the libmaxminddb library; for example, if it is in /usr/
|
||||
local/lib, then the default path will be /usr/local/share/GeoIP. This
|
||||
value can be overridden in named.conf using the geoip-directory
|
||||
option.
|
||||
|
||||
Some geoip ACL settings that were available with legacy GeoIP,
|
||||
including searches for netspeed, org, and three-letter ISO country
|
||||
codes, will no longer work when using GeoIP2. Supported GeoIP2
|
||||
database types are country, city, domain, isp, and as. All of these
|
||||
databases support both IPv4 and IPv6 lookups. [GL #182] [GL #1112]
|
||||
|
||||
* Two new metrics have been added to the statistics-channel to report
|
||||
DNSSEC signing operations. For each key in each zone, the dnssec-sign
|
||||
counter indicates the total number of signatures named has generated
|
||||
using that key since server startup, and the dnssec-refresh counter
|
||||
indicates how many of those signatures were refreshed during zone
|
||||
maintenance, as opposed to having been generated as a result of a zone
|
||||
update. [GL #513]
|
||||
|
||||
Bug Fixes
|
||||
|
||||
* When qname-minimization was set to relaxed, some improperly configured
|
||||
domains would fail to resolve, but would have succeeded when
|
||||
@@ -210,30 +209,92 @@ Bug Fixes
|
||||
* Glue address records were not being returned in responses to root
|
||||
priming queries; this has been corrected. [GL #1092]
|
||||
|
||||
* Interaction between DNS64 and RPZ No Data rule (CNAME *.) could cause
|
||||
unexpected results; this has been fixed. [GL #1106]
|
||||
Notes for BIND 9.15.1
|
||||
|
||||
* named-checkconf now checks DNS64 prefixes to ensure bits 64-71 are
|
||||
zero. [GL #1159]
|
||||
Security Fixes
|
||||
|
||||
* named-checkconf now correctly reports a missing dnstap-output option
|
||||
when dnstap is set. [GL #1136]
|
||||
* A race condition could trigger an assertion failure when a large
|
||||
number of incoming packets were being rejected. This flaw is disclosed
|
||||
in CVE-2019-6471. [GL #942]
|
||||
|
||||
* Handle ETIMEDOUT error on connect() with a non-blocking socket. [GL #
|
||||
1133]
|
||||
New Features
|
||||
|
||||
* Cache database statistics counters could report invalid values when
|
||||
stale answers were enabled, because of a bug in counter maintenance
|
||||
when cache data becomes stale. The statistics counters have been
|
||||
corrected to report the number of RRsets for each RR type that are
|
||||
active, stale but still potentially served, or stale and marked for
|
||||
deletion. [GL #602]
|
||||
* In order to clarify the configuration of DNSSEC keys, the trusted-keys
|
||||
and managed-keys statements have been deprecated, and the new
|
||||
dnssec-keys statement should now be used for both types of key.
|
||||
|
||||
* dig now correctly expands the IPv6 address when run with +expandaaaa
|
||||
+short. [GL #1152]
|
||||
When used with the keyword initial-key, dnssec-keys has the same
|
||||
behavior as managed-keys, i.e., it configures a trust anchor that is
|
||||
to be maintained via RFC 5011.
|
||||
|
||||
* When a response-policy zone expires, ensure that its policies are
|
||||
removed from the RPZ summary database. [GL #1146]
|
||||
When used with the new keyword static-key, it has the same behavior as
|
||||
trusted-keys, configuring a permanent trust anchor that will not
|
||||
automatically be updated. (This usage is not recommended for the root
|
||||
key.) [GL #6]
|
||||
|
||||
Removed Features
|
||||
|
||||
* The cleaning-interval option has been removed. [GL !1731]
|
||||
|
||||
Feature Changes
|
||||
|
||||
* named will now log a warning if a static key is configured for the
|
||||
root zone. [GL #6]
|
||||
|
||||
* JSON-C is now the only supported library for enabling JSON support for
|
||||
BIND statistics. The configure option has been renamed from
|
||||
--with-libjson to --with-json-c. Use PKG_CONFIG_PATH to specify a
|
||||
custom path to the json-c library as the new configure option does not
|
||||
take the library installation path as an optional argument.
|
||||
|
||||
Notes for BIND 9.15.0
|
||||
|
||||
Security Fixes
|
||||
|
||||
* In certain configurations, named could crash with an assertion failure
|
||||
if nxdomain-redirect was in use and a redirected query resulted in an
|
||||
NXDOMAIN from the cache. This flaw is disclosed in CVE-2019-6467. [GL
|
||||
#880]
|
||||
|
||||
* The TCP client quota set using the tcp-clients option could be
|
||||
exceeded in some cases. This could lead to exhaustion of file
|
||||
descriptors. This flaw is disclosed in CVE-2018-5743. [GL #615]
|
||||
|
||||
New Features
|
||||
|
||||
* The new add-soa option specifies whether or not the response-policy
|
||||
zone's SOA record should be included in the additional section of RPZ
|
||||
responses. [GL #865]
|
||||
|
||||
Removed Features
|
||||
|
||||
* The dnssec-enable option has been obsoleted and no longer has any
|
||||
effect. DNSSEC responses are always enabled if signatures and other
|
||||
DNSSEC data are present. [GL #866]
|
||||
|
||||
Feature Changes
|
||||
|
||||
* When static and managed DNSSEC keys were both configured for the same
|
||||
name, or when a static key was used to configure a trust anchor for
|
||||
the root zone and dnssec-validation was set to the default value of
|
||||
auto, automatic RFC 5011 key rollovers would be disabled. This
|
||||
combination of settings was never intended to work, but there was no
|
||||
check for it in the parser. This has been corrected, and it is now a
|
||||
fatal configuration error. [GL #868]
|
||||
|
||||
* DS and CDS records are now generated with SHA-256 digests only,
|
||||
instead of both SHA-1 and SHA-256. This affects the default output of
|
||||
dnssec-dsfromkey, the dsset files generated by dnssec-signzone, the DS
|
||||
records added to a zone by dnssec-signzone based on keyset files, the
|
||||
CDS records added to a zone by named and dnssec-signzone based on
|
||||
"sync" timing parameters in key files, and the checks performed by
|
||||
dnssec-checkds.
|
||||
|
||||
Bug Fixes
|
||||
|
||||
* The allow-update and allow-update-forwarding options were
|
||||
inadvertently treated as configuration errors when used at the options
|
||||
or view level. This has now been corrected. [GL #913]
|
||||
|
||||
License
|
||||
|
||||
@@ -258,12 +319,12 @@ complete, it will be renamed to BIND 9.16, which will be a stable branch.
|
||||
The end of life date for BIND 9.16 has not yet been determined. For those
|
||||
needing long term support, the current Extended Support Version (ESV) is
|
||||
BIND 9.11, which will be supported until at least December 2021. See
|
||||
https://www.isc.org/downloads/software-support-policy/ for details of
|
||||
ISC's software support policy.
|
||||
https://kb.isc.org/docs/aa-00896 for details of ISC's software support
|
||||
policy.
|
||||
|
||||
Thank You
|
||||
|
||||
Thank you to everyone who assisted us in making this release possible. If
|
||||
you would like to contribute to ISC to assist us in continuing to make
|
||||
quality open source software, please visit our donations page at http://
|
||||
quality open source software, please visit our donations page at https://
|
||||
www.isc.org/donate/.
|
||||
|
||||
@@ -23,11 +23,15 @@
|
||||
<xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-numbering.xml"/>
|
||||
<xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-platforms.xml"/>
|
||||
<xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-download.xml"/>
|
||||
<xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-sec-fixes.xml"/>
|
||||
<xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-new-features.xml"/>
|
||||
<xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-removed.xml"/>
|
||||
<xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-feature-changes.xml"/>
|
||||
<xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-bug-fixes.xml"/>
|
||||
|
||||
<xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-9.15.6.xml"/>
|
||||
<xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-9.15.5.xml"/>
|
||||
<xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-9.15.4.xml"/>
|
||||
<xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-9.15.3.xml"/>
|
||||
<xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-9.15.2.xml"/>
|
||||
<xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-9.15.1.xml"/>
|
||||
<xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-9.15.0.xml"/>
|
||||
|
||||
<xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-license.xml"/>
|
||||
<xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-eol.xml"/>
|
||||
<xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-thankyou.xml"/>
|
||||
|
||||
@@ -1469,17 +1469,19 @@
|
||||
./doc/arm/master.zoneopt.xml SGML 2018,2019
|
||||
./doc/arm/masters.grammar.xml SGML 2018,2019
|
||||
./doc/arm/mirror.zoneopt.xml SGML 2018,2019
|
||||
./doc/arm/notes-bug-fixes.xml SGML 2019
|
||||
./doc/arm/notes-9.15.0.xml SGML 2019
|
||||
./doc/arm/notes-9.15.1.xml SGML 2019
|
||||
./doc/arm/notes-9.15.2.xml SGML 2019
|
||||
./doc/arm/notes-9.15.3.xml SGML 2019
|
||||
./doc/arm/notes-9.15.4.xml SGML 2019
|
||||
./doc/arm/notes-9.15.5.xml SGML 2019
|
||||
./doc/arm/notes-9.15.6.xml SGML 2019
|
||||
./doc/arm/notes-download.xml SGML 2019
|
||||
./doc/arm/notes-eol.xml SGML 2019
|
||||
./doc/arm/notes-feature-changes.xml SGML 2019
|
||||
./doc/arm/notes-intro.xml SGML 2019
|
||||
./doc/arm/notes-license.xml SGML 2019
|
||||
./doc/arm/notes-new-features.xml SGML 2019
|
||||
./doc/arm/notes-numbering.xml SGML 2019
|
||||
./doc/arm/notes-platforms.xml SGML 2019
|
||||
./doc/arm/notes-removed.xml SGML 2019
|
||||
./doc/arm/notes-sec-fixes.xml SGML 2019
|
||||
./doc/arm/notes-thankyou.xml SGML 2019
|
||||
./doc/arm/notes-wrapper.xml SGML 2014,2015,2016,2018,2019
|
||||
./doc/arm/notes.conf X 2015,2018,2019
|
||||
|
||||
Reference in New Issue
Block a user