ComputerSurge/bind9
3
0
Fork 0
Code Pull Requests 1 Activity

Merge branch 'michal/prepare-release-notes-for-bind-9.11.26' into 'v9_11_26-release'

Browse Source 
Prepare release notes for BIND 9.11.26

See merge request isc-private/bind9!226
This commit is contained in:
Michał Kępień
2020-12-07 09:09:02 +00:00
parent 171e3ac2c9 0c00a528ef
commit da5f476c28
4 changed files with 40 additions and 85 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CHANGES
+3 -3
View File
@@ -1,5 +1,5 @@
5544. [func] Restore the default value of nocookie-udp-size to 4096.
[GL #2250]
5544. [func] Restore the default value of "nocookie-udp-size" to 4096
bytes. [GL #2250]
5541. [func] Adjust the "max-recursion-queries" default from 75 to
100. [GL #2305]
@@ -10,7 +10,7 @@
5539. [bug] Tighten handling of missing DNS COOKIE responses over
UDP by falling back to TCP. [GL #2275]
5534. [bug] The synthesised CNAME from a DNAME was incorrectly
5534. [bug] The CNAME synthesized from a DNAME was incorrectly
followed when the QTYPE was CNAME or ANY. [GL #2280]
--- 9.11.25 released ---
CONTRIBUTING
+7 -9
View File
@@ -31,20 +31,18 @@ BIND is maintained by the Internet Systems Consortium, a public-benefit
see the source, but only ISC employees have commit access. Until recently,
the source could only be seen once ISC had published a release: read
access to the source repository was restricted just as commit access was.
That's now changing, with the opening of a public git mirror to the BIND
source tree (see below).
That's now changing, with the opening of a public git repository of the
BIND source tree (see below).
Access to source code
Public BIND releases are always available from the ISC FTP site.
A public-access GIT repository is also available at https://gitlab.isc.org
. This repository is a mirror, updated several times per day, of the
source repository maintained by ISC. It contains all the public release
branches; upcoming releases can be viewed in their current state at any
time. It does not contain development branches or unreviewed work in
progress. Commits which address security vulnerablilities are withheld
until after public disclosure.
A public-access git repository is also available at https://gitlab.isc.org
. This repository contains all public release branches. Upcoming releases
can be viewed in their current state at any time. Short-lived development
branches contain unreviewed work in progress. Commits which address
security vulnerablilities are withheld until after public disclosure.
You can browse the source online via https://gitlab.isc.org/isc-projects/
bind9
CONTRIBUTING.md
+7 -9
View File
@@ -39,21 +39,19 @@ anyone can see the source, but only ISC employees have commit access.
Until recently, the source could only be seen once ISC had published
a release: read access to the source repository was restricted just
as commit access was. That's now changing, with the opening of a
public git mirror to the BIND source tree (see below).
public git repository of the BIND source tree (see below).
### <a name="access"></a>Access to source code
Public BIND releases are always available from the
[ISC FTP site](ftp://ftp.isc.org/isc/bind9).
A public-access GIT repository is also available at
[https://gitlab.isc.org](https://gitlab.isc.org).
This repository is a mirror, updated several times per day, of the
source repository maintained by ISC. It contains all the public release
branches; upcoming releases can be viewed in their current state at any
time. It does *not* contain development branches or unreviewed work in
progress. Commits which address security vulnerablilities are withheld
until after public disclosure.
A public-access git repository is also available at
[https://gitlab.isc.org](https://gitlab.isc.org). This repository
contains all public release branches. Upcoming releases can be viewed in
their current state at any time. Short-lived development branches
contain unreviewed work in progress. Commits which address security
vulnerablilities are withheld until after public disclosure.
You can browse the source online via
[https://gitlab.isc.org/isc-projects/bind9](https://gitlab.isc.org/isc-projects/bind9)
doc/arm/notes-9.11.26.xml
+23 -64
View File
@@ -11,71 +11,30 @@
<section xml:id="relnotes-9.11.26"><info><title>Notes for BIND 9.11.26</title></info>
<section xml:id="relnotes-9.11.26-security"><info><title>Security Fixes</title></info>
<itemizedlist>
<listitem>
<para>
None.
</para>
</listitem>
</itemizedlist>
</section>
<section xml:id="relnotes-9.11.26-known"><info><title>Known Issues</title></info>
<itemizedlist>
<listitem>
<para>
None.
</para>
</listitem>
</itemizedlist>
</section>
<section xml:id="relnotes-9.11.26-new"><info><title>New Features</title></info>
<itemizedlist>
<listitem>
<para>
None.
</para>
</listitem>
</itemizedlist>
</section>
<section xml:id="relnotes-9.11.26-removed"><info><title>Removed Features</title></info>
<itemizedlist>
<listitem>
<para>
None.
</para>
</listitem>
</itemizedlist>
</section>
<section xml:id="relnotes-9.11.26-changes"><info><title>Feature Changes</title></info>
<itemizedlist>
<listitem>
<para>
Adjust the <command>max-recursion-queries</command> default
from 75 to 100. Since the queries sent towards root and
TLD servers are now included in the count (as a result
of the fix for CVE-2020-8616),
<command>max-recursion-queries</command> has a higher
chance of being exceeded by non-attack queries, which is
the main reason for increasing its default value. [GL
#2305]
The default value of <command>max-recursion-queries</command> was
increased from 75 to 100. Since the queries sent towards root and TLD
servers are now included in the count (as a result of the fix for
CVE-2020-8616), <command>max-recursion-queries</command> has a higher
chance of being exceeded by non-attack queries, which is the main
reason for increasing its default value. [GL #2305]
</para>
</listitem>
<listitem>
<para>
Restore the <command>nocookie-udp-size</command> default from 1232 to
4096. Normally the EDNS buffer size is configured by
<command>max-udp-size</command>, but this configuration option
overrides the value, but most people don't and won't realize there's
an extra configuration option that needs to be tweaked. By changing
the default here, we allow the the <command>max-udp-size</command> to
be the sole option that needs to be changed when operator wants to
change the default EDNS buffer size. [GL #2250]
</para>
<para>
The default value of <command>nocookie-udp-size</command> was restored
back to 4096 bytes. Since <command>max-udp-size</command> is the upper
bound for <command>nocookie-udp-size</command>, this change relieves
the operator from having to change
<command>nocookie-udp-size</command> together with
<command>max-udp-size</command> in order to increase the default EDNS
buffer size limit. <command>nocookie-udp-size</command> can still be
set to a value lower than <command>max-udp-size</command>, if desired.
[GL #2250]
</para>
</listitem>
</itemizedlist>
</section>
@@ -84,21 +43,21 @@
<itemizedlist>
<listitem>
<para>
Tighten handling of missing DNS COOKIE responses over UDP by
Handling of missing DNS COOKIE responses over UDP was tightened by
falling back to TCP. [GL #2275]
</para>
</listitem>
<listitem>
<para>
Building with native PKCS#11 support for AEP Keyper has
been broken since BIND 9.11.22. This has been fixed. [GL
#2315]
The CNAME synthesized from a DNAME was incorrectly followed when the
QTYPE was CNAME or ANY. [GL #2280]
</para>
</listitem>
<listitem>
<para>
The synthesised CNAME from a DNAME was incorrectly followed
when the QTYPE was CNAME or ANY. [GL #2280]
Building with native PKCS#11 support for AEP Keyper has been broken
since BIND 9.11.22. This has been fixed. [GL #2315]
#2315]
</para>
</listitem>
</itemizedlist>