Michał Kępień
c9530390dd
Intertwining release notes from different BIND releases in a single XML file has caused confusion in the past due to different (and often arbitrary) approaches to keeping/removing release notes from older releases on different BIND branches. Divide doc/arm/notes.xml into per-version sections to simplify determining the set of changes introduced by a given release and to make adding/reviewing release notes less error-prone.
121 lines
4.6 KiB
XML
121 lines
4.6 KiB
XML
<!--
|
|
- Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
|
-
|
|
- This Source Code Form is subject to the terms of the Mozilla Public
|
|
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
- file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
|
-
|
|
- See the COPYRIGHT file distributed with this work for additional
|
|
- information regarding copyright ownership.
|
|
-->
|
|
|
|
<section xml:id="relnotes-9.11.4"><info><title>Notes for BIND 9.11.4</title></info>
|
|
|
|
<section xml:id="relnotes-9.11.4-security"><info><title>Security Fixes</title></info>
|
|
<itemizedlist>
|
|
<listitem>
|
|
<para>
|
|
When recursion is enabled but the <command>allow-recursion</command>
|
|
and <command>allow-query-cache</command> ACLs are not specified, they
|
|
should be limited to local networks, but they were inadvertently set
|
|
to match the default <command>allow-query</command>, thus allowing
|
|
remote queries. This flaw is disclosed in CVE-2018-5738. [GL #309]
|
|
</para>
|
|
</listitem>
|
|
</itemizedlist>
|
|
</section>
|
|
|
|
<section xml:id="relnotes-9.11.4-features"><info><title>New Features</title></info>
|
|
<itemizedlist>
|
|
<listitem>
|
|
<para>
|
|
<command>named</command> now supports the "root key sentinel"
|
|
mechanism. This enables validating resolvers to indicate
|
|
which trust anchors are configured for the root, so that
|
|
information about root key rollover status can be gathered.
|
|
To disable this feature, add
|
|
<command>root-key-sentinel no;</command> to
|
|
<filename>named.conf</filename>.
|
|
</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
Added the ability not to return a DNS COOKIE option when one
|
|
is present in the request. To prevent a cookie being returned,
|
|
add <command>answer-cookie no;</command> to
|
|
<filename>named.conf</filename>. [GL #173]
|
|
</para>
|
|
<para>
|
|
<command>answer-cookie no</command> is only intended as a
|
|
temporary measure, for use when <command>named</command>
|
|
shares an IP address with other servers that do not yet
|
|
support DNS COOKIE. A mismatch between servers on the
|
|
same address is not expected to cause operational problems,
|
|
but the option to disable COOKIE responses so that all
|
|
servers have the same behavior is provided out of an
|
|
abundance of caution. DNS COOKIE is an important security
|
|
mechanism, and should not be disabled unless absolutely
|
|
necessary.
|
|
</para>
|
|
</listitem>
|
|
</itemizedlist>
|
|
</section>
|
|
|
|
<section xml:id="relnotes-9.11.4-removed"><info><title>Removed Features</title></info>
|
|
<itemizedlist>
|
|
<listitem>
|
|
<para>
|
|
<command>named</command> will now log a warning if the old
|
|
BIND now can be compiled against libidn2 library to add
|
|
IDNA2008 support. Previously BIND only supported IDNA2003
|
|
using (now obsolete) idnkit-1 library.
|
|
</para>
|
|
</listitem>
|
|
</itemizedlist>
|
|
</section>
|
|
|
|
<section xml:id="relnotes-9.11.4-changes"><info><title>Feature Changes</title></info>
|
|
<itemizedlist>
|
|
<listitem>
|
|
<para>
|
|
<command>dig +noidnin</command> can be used to disable IDN
|
|
processing on the input domain name, when BIND is compiled
|
|
with IDN support.
|
|
</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
Multiple <command>cookie-secret</command> clause are now
|
|
supported. The first <command>cookie-secret</command> in
|
|
<filename>named.conf</filename> is used to generate new
|
|
server cookies. Any others are used to accept old server
|
|
cookies or those generated by other servers using the
|
|
matching <command>cookie-secret</command>.
|
|
</para>
|
|
</listitem>
|
|
</itemizedlist>
|
|
</section>
|
|
|
|
<section xml:id="relnotes-9.11.4-bugs"><info><title>Bug Fixes</title></info>
|
|
<itemizedlist>
|
|
<listitem>
|
|
<para>
|
|
<command>named</command> now rejects excessively large
|
|
incremental (IXFR) zone transfers in order to prevent
|
|
possible corruption of journal files which could cause
|
|
<command>named</command> to abort when loading zones. [GL #339]
|
|
</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
<command>rndc reload</command> could cause <command>named</command>
|
|
to leak memory if it was invoked before the zone loading actions
|
|
from a previous <command>rndc reload</command> command were
|
|
completed. [RT #47076]
|
|
</para>
|
|
</listitem>
|
|
</itemizedlist>
|
|
</section>
|
|
|
|
</section>
|