ComputerSurge/bind9
3
0
Fork 0
Code Pull Requests 1 Activity

Tweak and reword release notes

Browse Source
This commit is contained in:
Petr Špaček
2024-12-03 12:38:50 +01:00
parent 26d1bd7c4e
commit e7af24214b
1 changed files with 42 additions and 69 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/notes/notes-9.20.4.rst
+42 -69
View File
@@ -15,21 +15,21 @@ Notes for BIND 9.20.4
New Features
~~~~~~~~~~~~
- Update bind.keys with the new 2025 IANA root key.
- Update built-in :file:`bind.keys` file with the new 2025 `IANA root key
<https://www.iana.org/dnssec/files>`_.
Add an 'initial-ds' entry to bind.keys for the new root key, ID 38696,
which is scheduled for publication in January 2025. :gl:`#4896`
Add an `initial-ds` entry to :file:`bind.keys` for the new root key, ID
38696, which is scheduled for publication in January 2025. :gl:`#4896`
Removed Features
~~~~~~~~~~~~~~~~
- Move contributed DLZ modules into a separate repository.
- Move contributed DLZ modules into a separate repository. DLZ modules should
not be used except in testing.
The DLZ modules are poorly maintained as we only ensure they can still
be compiled, the DLZ interface is blocking, so anything that blocks
the query to the database blocks the whole server and they should not
be used except in testing. The DLZ interface itself is going to be
scheduled for removal.
The DLZ modules were not maintained, the DLZ interface itself is going to be
scheduled for removal, and the DLZ interface is blocking. Any module that
blocks the query to the :namedconf:ref:`database` blocks the whole server.
The DLZ modules now live in
https://gitlab.isc.org/isc-projects/dlz-modules repository.
@@ -38,33 +38,30 @@ Removed Features
Feature Changes
~~~~~~~~~~~~~~~
- Dnssec-ksr now supports KSK rollovers.
- :iscman:`dnssec-ksr` now supports KSK rollovers.
The tool 'dnssec-ksr' now allows for KSK generation, as well as
planned KSK rollovers. When signing a bundle from a Key Signing
Request (KSR), only the key that is active in that time frame is being
The tool now allows for KSK generation, as well as planned KSK rollovers.
When signing a bundle from a Key Signing Request (KSR), only the
key that is active in that time frame is
used for signing. Also, the CDS and CDNSKEY records are now added and
removed at the correct time. :gl:`#4697` :gl:`#4705`
- Print expire option in transfer summary.
- Print :rfc:`7314`: EXPIRE option in transfer summary. :gl:`#5013`
The zone transfer summary will now print the expire option value in
the zone transfer summary. :gl:`#5013`
- Emit more helpful log for exceeding max-records-per-type.
- Emit more helpful log messages for exceeding :namedconf:ref:`max-records-per-type`.
The new log message is emitted when adding or updating an RRset fails
due to exceeding the max-records-per-type limit. The log includes the
due to exceeding the :namedconf:ref:`max-records-per-type` limit. The log includes the
owner name and type, corresponding zone name, and the limit value. It
will be emitted on loading a zone file, inbound zone transfer (both
AXFR and IXFR), handling a DDNS update, or updating a cache DB. It's
especially helpful in the case of zone transfer, since the secondary
side doesn't have direct access to the offending zone data.
It could also be used for max-types-per-name, but this change doesn't
It could also be used for :namedconf:ref:`max-types-per-name`, but this change doesn't
implement it yet as it's much less likely to happen in practice.
- Harden key management when key files have become unavailabe.
- Harden key management when key files have become unavailable.
Prior to doing key management, BIND 9 will check if the key files on
disk match the expected keys. If key files for previously observed
@@ -77,74 +74,50 @@ Bug Fixes
- Use TLS for notifies if configured to do so.
Notifies configured to use TLS will now be sent over TLS, instead of
plaintext UDP or TCP. Also, failing to load the TLS configuration for
notify now also results in an error. :gl:`#4821`
plain text UDP or TCP. Also, failing to load the TLS configuration for
:namedconf:ref:`notify` now results in an error. :gl:`#4821`
- '{&dns}' is as valid as '{?dns}' in a SVCB's dohpath.
- `{&dns}` is as valid as `{?dns}` in a SVCB's dohpath.
`dig` fails to parse a valid (as far as I can tell, and accepted by
`kdig` and `Wireshark`) `SVCB` record with a `dohpath` URI template
containing a `{&dns}`, like `dohpath=/some/path?key=value{&dns}"`. If
the URI template contains a `{?dns}` instead `dig` is happy, but my
understanding of rfc9461 and section 1.2. "Levels and Expression
Types" of rfc6570 is that `{&dns}` is valid. See for example section
1.2. "Levels and Expression Types" of rfc6570.
Note that Peter van Dijk suggested that `{dns}` and
`{dns,someothervar}` might be valid forms as well, so my patch might
be too restrictive, although it's anyone's guess how DoH clients would
handle complex templates. :gl:`#4922`
:iscman:`dig` failed to parse a valid `SVCB` record with a `dohpath` URI
template containing a `{&dns}`, like `dohpath=/some/path?key=value{&dns}"`.
:gl:`#4922`
- Fix NSEC3 closest encloser lookup for names with empty non-terminals.
The performance improvement for finding the NSEC3 closest encloser
A previous performance optimization for finding the NSEC3 closest encloser
when generating authoritative responses could cause servers to return
incorrect NSEC3 records in some cases. This has been fixed.
:gl:`#4950`
- 'Recursive-clients 0;' triggers an assertion.
- :namedconf:ref:`recursive-clients` statement with value 0 triggered an assertion failure.
BIND 9.20.0 broke `recursive-clients 0;`. This has now been fixed.
:gl:`#4987`
- Parsing of hostnames in rndc.conf was broken.
- Parsing of hostnames in :iscman:`rndc.conf` was broken.
When DSCP support was removed, parsing of hostnames in rndc.conf was
When DSCP support was removed, parsing of hostnames in :iscman:`rndc.conf` was
accidentally broken, resulting in an assertion failure. This has been
fixed. :gl:`#4991`
- Restore values when dig prints command line.
- :iscman:`dig` options of the form `[+-]option=<value>` failed to display the
value on the printed command line. This has been fixed. :gl:`#4993`
Options of the form `[+-]option=<value>` failed to display the value
on the printed command line. This has been fixed. :gl:`#4993`
- Provide more visibility into TLS configuration errors by logging
`SSL_CTX_use_certificate_chain_file()` and `SSL_CTX_use_PrivateKey_file()`
errors individually. :gl:`#5008`
- Provide more visibility into configuration errors.
- Fix a race condition when canceling ADB find which could cause an assertion
failure. :gl:`#5024`
by logging SSL_CTX_use_certificate_chain_file and
SSL_CTX_use_PrivateKey_file errors individually. :gl:`#5008`
- SERVFAIL cache memory cleaning is now more aggressive; it no longer consumes a
lot of memory if the server encounters many SERVFAILs at once.
:gl:`#5025`
- Fix race condition when canceling ADB find.
When canceling the ADB find, the lock on the find gets released for a
brief period of time to be locked again inside adbname lock. During
the brief period that the ADB find is unlocked, it can get canceled by
other means removing it from the adbname list which in turn causes
assertion failure due to a double removal from the adbname list. This
has been fixed. :gl:`#5024`
- Improve the memory cleaning in the SERVFAIL cache.
The SERVFAIL cache doesn't have a memory bound and the cleaning of the
old SERVFAIL cache entries was implemented only in opportunistic
manner. Improve the memory cleaning of the SERVFAIL cache to be more
aggressive, so it doesn't consume a lot of memory in the case the
server encounters many SERVFAILs at once. :gl:`#5025`
- Fix trying the next primary server when the preivous one was marked as
- Fix trying the next primary XoT server when the previous one was marked as
unreachable.
In some cases (there is evidence only when XoT was used) `named`
failed to try the next primary server in the list when the previous
one was marked as unreachable. This has been fixed. :gl:`#5038`
In some cases :iscman:`named` failed to try the next primary
server in the :namedconf:ref:`primaries` list when the previous one was marked as
unreachable. This has been fixed. :gl:`#5038`