Merge branch 'v9_16_19-release' into 'v9_16'
Merge 9.16.19 release branch See merge request isc-projects/bind9!5299
This commit is contained in:
Michal Nowak
72
CHANGES
72
CHANGES
@@ -31,51 +31,55 @@
|
||||
"controls" statement was configured with multiple
|
||||
key algorithms in the same listener. [GL #2756]
|
||||
|
||||
5671. [bug] Fix a race condition where two threads are competing for
|
||||
the same set of key file locks, that could lead to a
|
||||
deadlock. This has been fixed. [GL #2786]
|
||||
--- 9.16.19 released ---
|
||||
|
||||
5670. [bug] Handle place holder KEYDATA records. [GL #2769]
|
||||
5671. [bug] A race condition could occur where two threads were
|
||||
competing for the same set of key file locks, leading to
|
||||
a deadlock. This has been fixed. [GL #2786]
|
||||
|
||||
5669. [func] Add 'checkds' feature. Zones with "dnssec-policy" and
|
||||
"parental-agents" configured will check for DS presence
|
||||
and are able to perform automatic KSK rollover.
|
||||
[GL #1126]
|
||||
5670. [bug] create_keydata() created an invalid placeholder keydata
|
||||
record upon a refresh failure, which prevented the
|
||||
database of managed keys from subsequently being read
|
||||
back. This has been fixed. [GL #2686]
|
||||
|
||||
5668. [bug] When a zone fails to load on startup, the setnsec3param
|
||||
task is rescheduled. This caused a hang on shutdown, and
|
||||
is now fixed. [GL #2791]
|
||||
5669. [func] KASP support was extended with the "check DS" feature.
|
||||
Zones with "dnssec-policy" and "parental-agents"
|
||||
configured now check for DS presence and can perform
|
||||
automatic KSK rollovers. [GL #1126]
|
||||
|
||||
5668. [bug] Rescheduling a setnsec3param() task when a zone failed
|
||||
to load on startup caused a hang on shutdown. This has
|
||||
been fixed. [GL #2791]
|
||||
|
||||
5667. [bug] The configuration-checking code failed to account for
|
||||
the inheritance rules of the "dnssec-policy" option.
|
||||
[GL #2780]
|
||||
This has been fixed. [GL #2780]
|
||||
|
||||
5666. [func] Tweak the safe "edns-udp-size" to match the probing
|
||||
value from BIND 9.16 for better compatibility. Also
|
||||
``named`` now sets the DON'T FRAGMENT flag on outgoing
|
||||
UDP packets. [GL #2183]
|
||||
5666. [doc] The safe "edns-udp-size" value was tweaked to match the
|
||||
probing value from BIND 9.16 for better compatibility.
|
||||
[GL #2183]
|
||||
|
||||
5665. [bug] 'nsupdate' did not retry with another server if
|
||||
it received a REFUSED response. [GL #2758]
|
||||
5665. [bug] If nsupdate sends an SOA request and receives a REFUSED
|
||||
response, it now fails over to the next available
|
||||
server. [GL #2758]
|
||||
|
||||
5664. [func] Handle a UDP sending error on UDP messages larger
|
||||
than the path MTU; in such a case an empty response is
|
||||
sent back with the TC (TrunCated) bit set. Re-enable
|
||||
setting the DF (Don't Fragment) flag on outgoing
|
||||
UDP sockets. [GL #2790]
|
||||
5664. [func] For UDP messages larger than the path MTU, named now
|
||||
sends an empty response with the TC (TrunCated) bit set.
|
||||
In addition, setting the DF (Don't Fragment) flag on
|
||||
outgoing UDP sockets was re-enabled. [GL #2790]
|
||||
|
||||
5662. [bug] Views with recursion disabled are now configured with a
|
||||
default cache size of 2 MB, unless "max-cache-size" is
|
||||
default cache size of 2 MB unless "max-cache-size" is
|
||||
explicitly set. This prevents cache RBT hash tables from
|
||||
being needlessly preallocated for such views. [GL #2777]
|
||||
|
||||
5661. [bug] A deadlock was introduced when fixing [GL #1875] because
|
||||
when locking the key file mutex for each zone structure
|
||||
that is in a different view, "in-view" logic was not
|
||||
taken into account. This has been fixed. [GL #2783]
|
||||
5661. [bug] Change 5644 inadvertently introduced a deadlock: when
|
||||
locking the key file mutex for each zone structure in a
|
||||
different view, the "in-view" logic was not considered.
|
||||
This has been fixed. [GL #2783]
|
||||
|
||||
5658. [bug] Increasing "max-cache-size" for a running named instance
|
||||
(using "rndc reconfig") was not causing the hash tables
|
||||
(using "rndc reconfig") did not cause the hash tables
|
||||
used by cache databases to be grown accordingly. This
|
||||
has been fixed. [GL #2770]
|
||||
|
||||
@@ -85,9 +89,8 @@
|
||||
CNAME chaining were required to prepare the response.
|
||||
This has been fixed. [GL #2759]
|
||||
|
||||
5653. [bug] Fixed a bug that caused the NSEC3 salt to be changed
|
||||
for KASP zones on restart.
|
||||
[GL #2725]
|
||||
5653. [bug] A bug that caused the NSEC3 salt to be changed on every
|
||||
restart for zones using KASP has been fixed. [GL #2725]
|
||||
|
||||
--- 9.16.18 released ---
|
||||
|
||||
@@ -158,6 +161,11 @@
|
||||
incorrectly accepted at those levels without effect.
|
||||
This has been fixed. [GL #2536]
|
||||
|
||||
5624. [func] Task manager events are now processed inside network
|
||||
manager loops. The task manager no longer needs its own
|
||||
set of worker threads, which improves resolver
|
||||
performance. [GL #2638]
|
||||
|
||||
--- 9.16.16 released ---
|
||||
|
||||
5637. [func] Change the default value of the "max-ixfr-ratio" option
|
||||
|
||||
29
bin/tests/system/checkds/prereq.sh
Normal file
29
bin/tests/system/checkds/prereq.sh
Normal file
@@ -0,0 +1,29 @@
|
||||
#!/bin/sh
|
||||
#
|
||||
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
||||
#
|
||||
# This Source Code Form is subject to the terms of the Mozilla Public
|
||||
# License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
# file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
#
|
||||
# See the COPYRIGHT file distributed with this work for additional
|
||||
# information regarding copyright ownership.
|
||||
|
||||
SYSTEMTESTTOP=..
|
||||
. $SYSTEMTESTTOP/conf.sh
|
||||
|
||||
if test -n "$PYTHON"
|
||||
then
|
||||
if $PYTHON -c "from dns.query import send_tcp" 2> /dev/null
|
||||
then
|
||||
:
|
||||
else
|
||||
echo_i "This test requires the dnspython >= 2.0.0 module." >&2
|
||||
exit 1
|
||||
fi
|
||||
else
|
||||
echo_i "This test requires Python and the dnspython module." >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
exit 0
|
||||
@@ -60,6 +60,7 @@ information about each release, source code, and pre-compiled versions
|
||||
for Microsoft Windows operating systems.
|
||||
|
||||
.. include:: ../notes/notes-current.rst
|
||||
.. include:: ../notes/notes-9.16.19.rst
|
||||
.. include:: ../notes/notes-9.16.18.rst
|
||||
.. include:: ../notes/notes-9.16.17.rst
|
||||
.. include:: ../notes/notes-9.16.16.rst
|
||||
|
||||
@@ -24,7 +24,7 @@ Feature Changes
|
||||
incoming queries among multiple threads). However, the only operating
|
||||
systems currently known to support load-balanced sockets are Linux and
|
||||
FreeBSD 12, which means both UDP and TCP performance were limited to a
|
||||
single thread on other systems. As of BIND 9.17.8, ``named`` attempts
|
||||
single thread on other systems. As of BIND 9.16.11, ``named`` attempts
|
||||
to distribute incoming queries among multiple threads on systems which
|
||||
lack support for load-balanced sockets (except Windows). :gl:`#2137`
|
||||
|
||||
|
||||
60
doc/notes/notes-9.16.19.rst
Normal file
60
doc/notes/notes-9.16.19.rst
Normal file
@@ -0,0 +1,60 @@
|
||||
..
|
||||
Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
||||
|
||||
This Source Code Form is subject to the terms of the Mozilla Public
|
||||
License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
|
||||
See the COPYRIGHT file distributed with this work for additional
|
||||
information regarding copyright ownership.
|
||||
|
||||
Notes for BIND 9.16.19
|
||||
----------------------
|
||||
|
||||
New Features
|
||||
~~~~~~~~~~~~
|
||||
|
||||
- Using a new configuration option, ``parental-agents``, each zone can
|
||||
now be associated with a list of servers that can be used to check the
|
||||
DS RRset in the parent zone. This enables automatic KSK rollovers.
|
||||
:gl:`#1126`
|
||||
|
||||
Feature Changes
|
||||
~~~~~~~~~~~~~~~
|
||||
|
||||
- IP fragmentation has been disabled for outgoing UDP sockets. Errors
|
||||
triggered by sending DNS messages larger than the specified path MTU
|
||||
are properly handled by sending empty DNS replies with the ``TC``
|
||||
(TrunCated) bit set, which forces DNS clients to fall back to TCP.
|
||||
:gl:`#2790`
|
||||
|
||||
Bug Fixes
|
||||
~~~~~~~~~
|
||||
|
||||
- The code managing :rfc:`5011` trust anchors created an invalid
|
||||
placeholder keydata record upon a refresh failure, which prevented the
|
||||
database of managed keys from subsequently being read back. This has
|
||||
been fixed. :gl:`#2686`
|
||||
|
||||
- Signed, insecure delegation responses prepared by ``named`` either
|
||||
lacked the necessary NSEC records or contained duplicate NSEC records
|
||||
when both wildcard expansion and CNAME chaining were required to
|
||||
prepare the response. This has been fixed. :gl:`#2759`
|
||||
|
||||
- If ``nsupdate`` sends an SOA request and receives a REFUSED response,
|
||||
it now fails over to the next available server. :gl:`#2758`
|
||||
|
||||
- A bug that caused the NSEC3 salt to be changed on every restart for
|
||||
zones using KASP has been fixed. :gl:`#2725`
|
||||
|
||||
- The configuration-checking code failed to account for the inheritance
|
||||
rules of the ``dnssec-policy`` option. This has been fixed.
|
||||
:gl:`#2780`
|
||||
|
||||
- The fix for :gl:`#1875` inadvertently introduced a deadlock: when
|
||||
locking key files for reading and writing, the ``in-view`` logic was
|
||||
not considered. This has been fixed. :gl:`#2783`
|
||||
|
||||
- A race condition could occur where two threads were competing for the
|
||||
same set of key file locks, leading to a deadlock. This has been
|
||||
fixed. :gl:`#2786`
|
||||
@@ -33,7 +33,7 @@ Feature Changes
|
||||
MTU minus the estimated header space. In practice, the smallest MTU
|
||||
witnessed in the operational DNS community is 1500 octets, the maximum
|
||||
Ethernet payload size, so a useful default for maximum DNS/UDP payload
|
||||
size on reliable networks would be 1400 bytes. :gl:`#2183`
|
||||
size on reliable networks would be 1432 bytes. :gl:`#2183`
|
||||
|
||||
Bug Fixes
|
||||
~~~~~~~~~
|
||||
|
||||
@@ -8,14 +8,12 @@
|
||||
See the COPYRIGHT file distributed with this work for additional
|
||||
information regarding copyright ownership.
|
||||
|
||||
Notes for BIND 9.16.19
|
||||
Notes for BIND 9.16.20
|
||||
----------------------
|
||||
|
||||
Security Fixes
|
||||
~~~~~~~~~~~~~~
|
||||
|
||||
- None.
|
||||
|
||||
- Named failed to check the opcode of responses when performing refresh,
|
||||
stub updates, and UPDATE forwarding. This could lead to an assertion
|
||||
failure under particular conditions. This has been addressed by checking
|
||||
@@ -30,9 +28,7 @@ Known Issues
|
||||
New Features
|
||||
~~~~~~~~~~~~
|
||||
|
||||
- Automatic KSK rollover: A new configuration option ``parental-agents`` is
|
||||
added to add a list of servers to a zone that can be used for checking DS
|
||||
presence. :gl:`#1126`
|
||||
- None.
|
||||
|
||||
Removed Features
|
||||
~~~~~~~~~~~~~~~~
|
||||
@@ -42,21 +38,6 @@ Removed Features
|
||||
Feature Changes
|
||||
~~~~~~~~~~~~~~~
|
||||
|
||||
- IP fragmentation on outgoing UDP sockets has been disabled. Errors from
|
||||
sending DNS messages larger than the specified path MTU are properly handled;
|
||||
``named`` now sends back empty DNS messages with the TC (TrunCated) bit set,
|
||||
forcing the DNS client to fall back to TCP. :gl:`#2790`
|
||||
|
||||
``named`` now sets the DON'T FRAGMENT flag on outgoing UDP packets. According
|
||||
to the measurements done by multiple parties this should not be causing any
|
||||
operational problems as most of the Internet "core" is able to cope with IP
|
||||
message sizes between 1400-1500 bytes, the 1232 size was picked as a
|
||||
conservative minimal number that could be changed by the DNS operator to a
|
||||
estimated path MTU minus the estimated header space. In practice, the smallest
|
||||
MTU witnessed in the operational DNS community is 1500 octets, the Ethernet
|
||||
maximum payload size, so a a useful default for maximum DNS/UDP payload size
|
||||
on reliable networks would be 1432. [GL #2183]
|
||||
|
||||
- CDS and CDNSKEY records may now be published in a zone without the
|
||||
requirement that they exactly match an existing DNSKEY record, so long
|
||||
the zone is signed with an algorithm represented in the CDS or CDNSKEY
|
||||
@@ -66,21 +47,6 @@ Feature Changes
|
||||
Bug Fixes
|
||||
~~~~~~~~~
|
||||
|
||||
- Fixed a bug that caused the NSEC salt to be changed for KASP zones on
|
||||
every startup. :gl:`#2725`
|
||||
|
||||
- Signed, insecure delegation responses prepared by ``named`` either
|
||||
lacked the necessary NSEC records or contained duplicate NSEC records
|
||||
when both wildcard expansion and CNAME chaining were required to
|
||||
prepare the response. This has been fixed. :gl:`#2759`
|
||||
|
||||
- A deadlock at startup was introduced when fixing :gl:`#1875` because when
|
||||
locking key files for reading and writing, "in-view" logic was not taken into
|
||||
account. This has been fixed. :gl:`#2783`
|
||||
|
||||
- Fix a race condition where two threads are competing for the same set of key
|
||||
file locks, that could lead to a deadlock. This has been fixed. :gl:`#2786`
|
||||
|
||||
- Testing revealed that setting the thread affinity on both the netmgr
|
||||
and netthread threads led to inconsistent recursive performance, as
|
||||
sometimes the netmgr and netthread threads competed over a single
|
||||
|
||||
@@ -368,6 +368,7 @@
|
||||
./bin/tests/system/checkds/ns2/setup.sh SH 2021
|
||||
./bin/tests/system/checkds/ns5/setup.sh SH 2021
|
||||
./bin/tests/system/checkds/ns9/setup.sh SH 2021
|
||||
./bin/tests/system/checkds/prereq.sh SH 2021
|
||||
./bin/tests/system/checkds/setup.sh SH 2021
|
||||
./bin/tests/system/checkds/tests-checkds.py PYTHON-BIN 2021
|
||||
./bin/tests/system/checkdstool/clean.sh SH 2012,2013,2014,2016,2017,2018,2019,2020,2021
|
||||
|
||||
Reference in New Issue
Block a user