diff --git a/README b/README index 75ed2e9cae..de9fce81d9 100644 --- a/README +++ b/README @@ -143,6 +143,11 @@ addition to OpenSSL, BIND now requires support for IPv6, threads, and standard atomic operations provided by the C compiler. Non-threaded builds are no longer supported. +BIND 9.14.1 + +BIND 9.14.1 is a maintenance release, and addresses security +vulnerabilities disclosed in CVE-2018-5743 and CVE-2019-6467. + Building BIND Minimally, BIND requires a UNIX or Linux system with an ANSI C compiler, diff --git a/bin/dnssec/dnssec-keygen.8 b/bin/dnssec/dnssec-keygen.8 index 2cdddaebae..7758ae9d3e 100644 --- a/bin/dnssec/dnssec-keygen.8 +++ b/bin/dnssec/dnssec-keygen.8 @@ -308,17 +308,18 @@ contains the private key\&. .PP The \&.key -file contains a DNS KEY record that can be inserted into a zone file (directly or with a $INCLUDE statement)\&. +file contains a DNSKEY or KEY record\&. When a zone is being signed by +\fBnamed\fR +or +\fBdnssec\-signzone\fR\fB\-S\fR, DNSKEY records are included automatically\&. In other cases, the +\&.key +file can be inserted into a zone file manually or with a +\fB$INCLUDE\fR +statement\&. .PP The \&.private file contains algorithm\-specific fields\&. For obvious security reasons, this file does not have general read permission\&. -.PP -Both -\&.key -and -\&.private -files are generated for symmetric cryptography algorithms such as HMAC\-MD5, even though the public and private key are equivalent\&. .SH "EXAMPLE" .PP To generate an ECDSAP256SHA256 zone\-signing key for the zone diff --git a/bin/dnssec/dnssec-keygen.html b/bin/dnssec/dnssec-keygen.html index 73591c031d..b23904790a 100644 --- a/bin/dnssec/dnssec-keygen.html +++ b/bin/dnssec/dnssec-keygen.html @@ -462,10 +462,12 @@ key.

- The .key file contains a DNS KEY record - that - can be inserted into a zone file (directly or with a $INCLUDE - statement). + The .key file contains a DNSKEY or KEY record. + When a zone is being signed by named + or dnssec-signzone -S, DNSKEY + records are included automatically. In other cases, + the .key file can be inserted into a zone file + manually or with a $INCLUDE statement.

The .private file contains @@ -473,11 +475,6 @@ fields. For obvious security reasons, this file does not have general read permission.

-

- Both .key and .private - files are generated for symmetric cryptography algorithms such as - HMAC-MD5, even though the public and private key are equivalent. -

diff --git a/doc/arm/Bv9ARM.ch01.html b/doc/arm/Bv9ARM.ch01.html index 62c2ca5564..0c46be3166 100644 --- a/doc/arm/Bv9ARM.ch01.html +++ b/doc/arm/Bv9ARM.ch01.html @@ -614,6 +614,6 @@
-

BIND 9.14.0 (Stable Release)

+

BIND 9.14.1 (Stable Release)

diff --git a/doc/arm/Bv9ARM.ch02.html b/doc/arm/Bv9ARM.ch02.html index 82118c3605..b4686a097f 100644 --- a/doc/arm/Bv9ARM.ch02.html +++ b/doc/arm/Bv9ARM.ch02.html @@ -146,6 +146,6 @@ -

BIND 9.14.0 (Stable Release)

+

BIND 9.14.1 (Stable Release)

diff --git a/doc/arm/Bv9ARM.ch03.html b/doc/arm/Bv9ARM.ch03.html index 8c9b3d7303..d756e697a0 100644 --- a/doc/arm/Bv9ARM.ch03.html +++ b/doc/arm/Bv9ARM.ch03.html @@ -856,6 +856,6 @@ controls { -

BIND 9.14.0 (Stable Release)

+

BIND 9.14.1 (Stable Release)

diff --git a/doc/arm/Bv9ARM.ch04.html b/doc/arm/Bv9ARM.ch04.html index bbd8af06ef..27593a5a68 100644 --- a/doc/arm/Bv9ARM.ch04.html +++ b/doc/arm/Bv9ARM.ch04.html @@ -2863,6 +2863,6 @@ $ORIGIN 0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa. -

BIND 9.14.0 (Stable Release)

+

BIND 9.14.1 (Stable Release)

diff --git a/doc/arm/Bv9ARM.ch05.html b/doc/arm/Bv9ARM.ch05.html index aca0fd3798..d8b7bc6772 100644 --- a/doc/arm/Bv9ARM.ch05.html +++ b/doc/arm/Bv9ARM.ch05.html @@ -5192,15 +5192,21 @@ options { When set in the zone statement for a master zone, specifies which hosts are allowed to submit Dynamic DNS updates to that zone. The default - is to deny updates from all hosts. This can only - be set at the zone level, not in - options or view. + is to deny updates from all hosts.

Note that allowing updates based on the requestor's IP address is insecure; see the section called “Dynamic Update Security” for details.

+

+ In general this option should only be set at the + zone level. While a default + value can be set at the options or + view level and inherited by zones, + this could lead to some zones unintentionally allowing + updates. +

allow-update-forwarding
@@ -5210,9 +5216,7 @@ options { submit Dynamic DNS updates and have them be forwarded to the master. The default is { none; }, which means that no - update forwarding will be performed. This can only be - set at the zone level, not in - options or view. + update forwarding will be performed.

To enable update forwarding, specify @@ -5230,6 +5234,14 @@ options { on insecure IP-address-based access control; see the section called “Dynamic Update Security” for more details.

+

+ In general this option should only be set at the + zone level. While a default + value can be set at the options or + view level and inherited by zones, + this can lead to some zones unintentionally forwarding + updates. +

allow-v6-synthesis
@@ -6281,7 +6293,8 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };

The number of file descriptors reserved for TCP, stdio, etc. This needs to be big enough to cover the number of - interfaces named listens on, tcp-clients as well as + interfaces named listens on plus + tcp-clients, as well as to provide room for outgoing TCP queries and incoming zone transfers. The default is 512. The minimum value is 128 and the @@ -8045,6 +8058,14 @@ example.com CNAME rpz-tcp-only. zone. By default, all rewrites are logged.

+

+ The add-soa option controls whether the RPZ's + SOA record is added to the additional section for traceback + of changes from this zone or not. This can be set at the + individual policy zone level or at the response-policy level. + The default is yes. +

+

Updates to RPZ zones are processed asynchronously; if there is more than one update pending they are bundled together. @@ -14831,6 +14852,6 @@ HOST-127.EXAMPLE. MX 0 . -

BIND 9.14.0 (Stable Release)

+

BIND 9.14.1 (Stable Release)

diff --git a/doc/arm/Bv9ARM.ch06.html b/doc/arm/Bv9ARM.ch06.html index 4411882d87..3335aff8c1 100644 --- a/doc/arm/Bv9ARM.ch06.html +++ b/doc/arm/Bv9ARM.ch06.html @@ -361,6 +361,6 @@ allow-query { !{ !10/8; any; }; key example; }; -

BIND 9.14.0 (Stable Release)

+

BIND 9.14.1 (Stable Release)

diff --git a/doc/arm/Bv9ARM.ch07.html b/doc/arm/Bv9ARM.ch07.html index 1d2db5bed2..14c57d37c4 100644 --- a/doc/arm/Bv9ARM.ch07.html +++ b/doc/arm/Bv9ARM.ch07.html @@ -191,6 +191,6 @@ -

BIND 9.14.0 (Stable Release)

+

BIND 9.14.1 (Stable Release)

diff --git a/doc/arm/Bv9ARM.ch08.html b/doc/arm/Bv9ARM.ch08.html index 65627a3abc..44c3ab8a99 100644 --- a/doc/arm/Bv9ARM.ch08.html +++ b/doc/arm/Bv9ARM.ch08.html @@ -36,16 +36,16 @@

Table of Contents

-
Release Notes for BIND Version 9.14.0
+
Release Notes for BIND Version 9.14.1
Introduction
Note on Version Numbering
Supported Platforms
Download
-
Known Issues
+
Security Fixes
New Features
-
Removed Features
Feature Changes
+
Bug Fixes
License
End of Life
Thank You
@@ -54,16 +54,15 @@

-Release Notes for BIND Version 9.14.0

+Release Notes for BIND Version 9.14.1

Introduction

- BIND 9.14.0 is the first release of a new stable branch of BIND. - This document summarizes new features and functional changes - that have been introduced, as well as features that have been - deprecated or removed, since the last stable branch, 9.12. + BIND 9.14 is a stable branch of BIND. + This document summarizes significant changes since the last + production release on that branch.

@@ -136,498 +135,62 @@

-Known Issues

+Security Fixes
+
+ + +
+

+New Features

  • - A recent change in the named.conf parser - resulted in allow-update being treated as a - configuration error when set at the options or - view level. This is not a secure configuration - and the use of the option in this manner is ill-advised. However, - in this release it should have been treated as a warning rather - than a fatal error. This flaw was discovered too late to be - fixed in 9.14.0, but it will be corrected in the 9.14.1 - maintenance release: global allow-update will - again be permitted, but a warning will be logged. + The new add-soa option specifies whether + or not the response-policy zone's SOA record + should be included in the additional section of RPZ responses. + [GL #865] +

    +
+
+ +
+

+Feature Changes

+
  • +

    + None.

-New Features

-
    -
  • -

    - Task manager and socket code have been substantially modified. - The manager uses per-cpu queues for tasks and network stack runs - multiple event loops in CPU-affinitive threads. This greatly - improves performance on large systems, especially when using - multi-queue NICs. -

    -
    • -
  • -

    - Support for QNAME minimization was added and enabled by default - in relaxed mode, in which BIND will fall back - to normal resolution if the remote server returns something - unexpected during the query minimization process. This default - setting might change to strict in the future. -

    -
    • -
  • -

    - A new plugin mechanism has been added to allow - extension of query processing functionality through the use of - external libraries. The new filter-aaaa.so - plugin replaces the filter-aaaa feature that - was formerly implemented as a native part of BIND. -

    -

    - The plugin API is a work in progress and is likely to evolve - as further plugins are implemented. [GL #15] -

    -
    • -
  • -

    - A new secondary zone option, mirror, - enables named to serve a transferred copy - of a zone's contents without acting as an authority for the - zone. A zone must be fully validated against an active trust - anchor before it can be used as a mirror zone. DNS responses - from mirror zones do not set the AA bit ("authoritative answer"), - but do set the AD bit ("authenticated data"). This feature is - meant to facilitate deployment of a local copy of the root zone, - as described in RFC 7706. [GL #33] -

    -
    • -
  • -

    - BIND now can be compiled against the libidn2 - library to add IDNA2008 support. Previously, BIND supported - IDNA2003 using the (now obsolete and unsupported) - idnkit-1 library. -

    -
    • -
  • -

    - named now supports the "root key sentinel" - mechanism. This enables validating resolvers to indicate - which trust anchors are configured for the root, so that - information about root key rollover status can be gathered. - To disable this feature, add - root-key-sentinel no; to - named.conf. [GL #37] -

    -
    • -
  • -

    - The dnskey-sig-validity option allows the - sig-validity-interval to be overriden for - signatures covering DNSKEY RRsets. [GL #145] -

    -
    • -
  • -

    - When built on Linux, BIND now requires the libcap - library to set process privileges. The adds a new compile-time - dependency, which can be met on most Linux platforms by installing the - libcap-dev or libcap-devel - package. BIND can also be built without capability support by using - configure --disable-linux-caps, at the cost of some - loss of security. -

    -
    • -
  • -

    - The validate-except option specifies a list of - domains beneath which DNSSEC validation should not be performed, - regardless of whether a trust anchor has been configured above - them. [GL #237] -

    -
    • -
  • -

    - Two new update policy rule types have been added - krb5-selfsub and ms-selfsub - which allow machines with Kerberos principals to update - the name space at or below the machine names identified - in the respective principals. -

    -
    • -
  • -

    - The new configure option --enable-fips-mode - can be used to make BIND enable and enforce FIPS mode in the - OpenSSL library. When compiled with such option the BIND will - refuse to run if FIPS mode can't be enabled, thus this option - must be only enabled for the systems where FIPS mode is available. -

    -
    • -
  • -

    - Two new configuration options min-cache-ttl and - min-ncache-ttl has been added to allow the BIND 9 - administrator to override the minimum TTL in the received DNS records - (positive caching) and for storing the information about non-existent - records (negative caching). The configured minimum TTL for both - configuration options cannot exceed 90 seconds. -

    -
    • -
  • +Bug Fixes
+
- - -
-

-Removed Features

-
    -
  • -

    - Workarounds for servers that misbehave when queried with EDNS - have been removed, because these broken servers and the - workarounds for their noncompliance cause unnecessary delays, - increase code complexity, and prevent deployment of new DNS - features. See https://dnsflagday.net - for further details. -

    -

    - In particular, resolution will no longer fall back to - plain DNS when there was no response from an authoritative - server. This will cause some domains to become non-resolvable - without manual intervention. In these cases, resolution can - be restored by adding server clauses for the - offending servers, specifying edns no or - send-cookie no, depending on the specific - noncompliance. -

    -

    - To determine which server clause to use, run - the following commands to send queries to the authoritative - servers for the broken domain: -

    -


    -   dig soa <zone> @<server> +dnssec
    -   dig soa <zone> @<server> +dnssec +nocookie
    -   dig soa <zone> @<server> +noedns
    -

    -

    - If the first command fails but the second succeeds, the - server most likely needs send-cookie no. - If the first two fail but the third succeeds, then the server - needs EDNS to be fully disabled with edns no. -

    -

    - Please contact the administrators of noncompliant domains - and encourage them to upgrade their broken DNS servers. [GL #150] -

    -
    • -
  • -

    - Previously, it was possible to build BIND without thread support - for old architectures and systems without threads support. - BIND now requires threading support (either POSIX or Windows) from - the operating system, and it cannot be built without threads. -

    -
    • -
  • -

    - The filter-aaaa, - filter-aaaa-on-v4, and - filter-aaaa-on-v6 options have been removed - from named, and can no longer be - configured using native named.conf syntax. - However, loading the new filter-aaaa.so - plugin and setting its parameters provides identical - functionality. -

    -
    • -
  • -

    - named can no longer use the EDNS CLIENT-SUBNET - option for view selection. In its existing form, the authoritative - ECS feature was not fully RFC-compliant, and could not realistically - have been deployed in production for an authoritative server; its - only practical use was for testing and experimentation. In the - interest of code simplification, this feature has now been removed. -

    -

    - The ECS option is still supported in dig and - mdig via the +subnet argument, and can be parsed - and logged when received by named, but - it is no longer used for ACL processing. The - geoip-use-ecs option is now obsolete; - a warning will be logged if it is used in - named.conf. - ecs tags in an ACL definition are - also obsolete, and will cause the configuration to fail to - load if they are used. [GL #32] -

    -
    • -
  • -

    - dnssec-keygen can no longer generate HMAC - keys for TSIG authentication. Use tsig-keygen - to generate these keys. [RT #46404] -

    -
    • -
  • -

    - Support for OpenSSL 0.9.x has been removed. OpenSSL version - 1.0.0 or greater, or LibreSSL is now required. -

    -
    • -
  • -

    - The configure --enable-seccomp option, - which formerly turned on system-call filtering on Linux, has - been removed. [GL #93] -

    -
    • -
  • -

    - IPv4 addresses in forms other than dotted-quad are no longer - accepted in master files. [GL #13] [GL #56] -

    -
    • -
  • -

    - IDNA2003 support via (bundled) idnkit-1.0 has been removed. -

    -
    • -
  • -

    - The "rbtdb64" database implementation (a parallel - implementation of "rbt") has been removed. [GL #217] -

    -
    • -
  • -

    - The -r randomdev option to explicitly select - random device has been removed from the - ddns-confgen, - rndc-confgen, - nsupdate, - dnssec-confgen, and - dnssec-signzone commands. -

    -

    - The -p option to use pseudo-random data - has been removed from the dnssec-signzone - command. -

    -
    • -
  • -

    - Support for the RSAMD5 algorithm has been removed freom BIND as - the usage of the RSAMD5 algorithm for DNSSEC has been deprecated - in RFC6725, the security of the MD5 algorithm has been compromised, - and its usage is considered harmful. -

    -
    • -
  • -

    - Support for the ECC-GOST (GOST R 34.11-94) algorithm has been - removed from BIND, as the algorithm has been superseded by - GOST R 34.11-2012 in RFC6986 and it must not be used in new - deployments. BIND will neither create new DNSSEC keys, - signatures and digests, nor it will validate them. -

    -
    • -
  • -

    - Support for DSA and DSA-NSEC3-SHA1 algorithms has been - removed from BIND as the DSA key length is limited to 1024 - bits and this is not considered secure enough. -

    -
    • -
  • -

    - named will no longer ignore "no-change" deltas - when processing an IXFR stream. This had previously been - permitted for compatibility with BIND 8, but now "no-change" - deltas will trigger a fallback to AXFR as the recovery mechanism. -

    -
    • -
  • -

    - BIND 9 will no longer build on platforms that don't have - proper IPv6 support. BIND 9 now also requires POSIX-compatible - pthread support. Most of the platforms that lack these featuers - are long past their end-of-lifew dates, and they are neither - developed nor supported by their respective vendors. -

    -
    • -
  • -

    - The incomplete support for internationalization message catalogs has - been removed from BIND. Since the internationalization was never - completed, and no localized message catalogs were ever made available - for the portions of BIND in which they could have been used, this - change will have no effect except to simplify the source code. BIND's - log messages and other output were already only available in English. -

    -
    • -
-
- -
-

-Feature Changes

-
    -
  • -

    - BIND will now always use the best CSPRNG (cryptographically-secure - pseudo-random number generator) available on the platform where - it is compiled. It will use the arc4random() - family of functions on BSD operating systems, - getrandom() on Linux and Solaris, - CryptGenRandom on Windows, and the selected - cryptography provider library (OpenSSL or PKCS#11) as the last - resort. [GL #221] -

    -
    • -
  • -

    - The default setting for dnssec-validation is - now auto, which activates DNSSEC - validation using the IANA root key. (The default can be changed - back to yes, which activates DNSSEC - validation only when keys are explicitly configured in - named.conf, by building BIND with - configure --disable-auto-validation.) [GL #30] -

    -
    • -
  • -

    - BIND can no longer be built without DNSSEC support. A cryptography - provider (i.e., OpenSSL or a hardware service module with - PKCS#11 support) must be available. [GL #244] -

    -
    • -
  • -

    - Zone types primary and - secondary are now available as synonyms for - master and slave, - respectively, in named.conf. -

    -
    • -
  • -

    - named will now log a warning if the old - root DNSSEC key is explicitly configured and has not been updated. - [RT #43670] -

    -
    • -
  • -

    - dig +nssearch will now list name servers - that have timed out, in addition to those that respond. [GL #64] -

    -
    • -
  • -

    - Up to 64 response-policy zones are now - supported by default; previously the limit was 32. [GL #123] -

    -
    • -
  • -

    - Several configuration options for time periods can now use - TTL value suffixes (for example, 2h or - 1d) in addition to an integer number of - seconds. These include - fstrm-set-reopen-interval, - interface-interval, - max-cache-ttl, - max-ncache-ttl, - max-policy-ttl, and - min-update-interval. - [GL #203] -

    -
    • -
  • -

    - NSID logging (enabled by the request-nsid - option) now has its own nsid category, - instead of using the resolver category. -

    -
    • -
  • -

    - The rndc nta command could not differentiate - between views of the same name but different class; this - has been corrected with the addition of a -class - option. [GL #105] -

    -
    • -
  • -

    - allow-recursion-on and - allow-query-cache-on each now default to - the other if only one of them is set, in order to be consistent - with the way allow-recursion and - allow-query-cache work. [GL #319] -

    -
    • -
  • -

    - When compiled with IDN support, the dig and - nslookup commands now disable IDN processing - when the standard output is not a TTY (i.e., when the output - is not being read by a human). When running from a shell - script, the command line options +idnin and - +idnout may be used to enable IDN - processing of input and output domain names, respectively. - When running on a TTY, the +noidnin and - +noidnout options may be used to disable - IDN processing of input and output domain names. -

    -
    • -
  • -

    - The configuration option max-ncache-ttl cannot - exceed seven days. Previously, larger values than this were silently - lowered; now, they trigger a configuration error. -

    -
    • -
  • -

    - The new dig -r command line option - disables reading of the file $HOME/.digrc. -

    -
    • -
  • -

    - Zone signing and key maintenance events are now logged to the - dnssec category rather than - zone. -

    -
    • -
+
@@ -697,6 +260,6 @@
-

BIND 9.14.0 (Stable Release)

+

BIND 9.14.1 (Stable Release)

diff --git a/doc/arm/Bv9ARM.ch09.html b/doc/arm/Bv9ARM.ch09.html index 2551f20361..c00001e551 100644 --- a/doc/arm/Bv9ARM.ch09.html +++ b/doc/arm/Bv9ARM.ch09.html @@ -148,6 +148,6 @@ -

BIND 9.14.0 (Stable Release)

+

BIND 9.14.1 (Stable Release)

diff --git a/doc/arm/Bv9ARM.ch10.html b/doc/arm/Bv9ARM.ch10.html index 7645f9bc93..6b8d0d7f41 100644 --- a/doc/arm/Bv9ARM.ch10.html +++ b/doc/arm/Bv9ARM.ch10.html @@ -914,6 +914,6 @@ -

BIND 9.14.0 (Stable Release)

+

BIND 9.14.1 (Stable Release)

diff --git a/doc/arm/Bv9ARM.ch11.html b/doc/arm/Bv9ARM.ch11.html index 678926eed9..ccda1adeca 100644 --- a/doc/arm/Bv9ARM.ch11.html +++ b/doc/arm/Bv9ARM.ch11.html @@ -533,6 +533,6 @@ $ sample-update -a sample-update -k Kxxx.+nnn+mm -

BIND 9.14.0 (Stable Release)

+

BIND 9.14.1 (Stable Release)

diff --git a/doc/arm/Bv9ARM.ch12.html b/doc/arm/Bv9ARM.ch12.html index c1929904e5..cb2eda01dd 100644 --- a/doc/arm/Bv9ARM.ch12.html +++ b/doc/arm/Bv9ARM.ch12.html @@ -210,6 +210,6 @@ -

BIND 9.14.0 (Stable Release)

+

BIND 9.14.1 (Stable Release)

diff --git a/doc/arm/Bv9ARM.html b/doc/arm/Bv9ARM.html index 7d1f8c7f23..bbcd3bb868 100644 --- a/doc/arm/Bv9ARM.html +++ b/doc/arm/Bv9ARM.html @@ -32,7 +32,7 @@

BIND 9 Administrator Reference Manual

-

BIND Version 9.14.0

+

BIND Version 9.14.1

Copyright © 2000-2019 Internet Systems Consortium, Inc. ("ISC")

@@ -242,16 +242,16 @@
A. Release Notes
-
Release Notes for BIND Version 9.14.0
+
Release Notes for BIND Version 9.14.1
Introduction
Note on Version Numbering
Supported Platforms
Download
-
Known Issues
+
Security Fixes
New Features
-
Removed Features
Feature Changes
+
Bug Fixes
License
End of Life
Thank You
@@ -439,6 +439,6 @@ -

BIND 9.14.0 (Stable Release)

+

BIND 9.14.1 (Stable Release)

diff --git a/doc/arm/Bv9ARM.pdf b/doc/arm/Bv9ARM.pdf index e9e4feaa65..224cbbe2f6 100644 Binary files a/doc/arm/Bv9ARM.pdf and b/doc/arm/Bv9ARM.pdf differ diff --git a/doc/arm/man.arpaname.html b/doc/arm/man.arpaname.html index 3c67361e99..030a48be2e 100644 --- a/doc/arm/man.arpaname.html +++ b/doc/arm/man.arpaname.html @@ -90,6 +90,6 @@ -

BIND 9.14.0 (Stable Release)

+

BIND 9.14.1 (Stable Release)

diff --git a/doc/arm/man.ddns-confgen.html b/doc/arm/man.ddns-confgen.html index 6e95e7dbf9..7841b203d2 100644 --- a/doc/arm/man.ddns-confgen.html +++ b/doc/arm/man.ddns-confgen.html @@ -220,6 +220,6 @@ -

BIND 9.14.0 (Stable Release)

+

BIND 9.14.1 (Stable Release)

diff --git a/doc/arm/man.delv.html b/doc/arm/man.delv.html index 3be434a003..0bd73d93f9 100644 --- a/doc/arm/man.delv.html +++ b/doc/arm/man.delv.html @@ -625,6 +625,6 @@ -

BIND 9.14.0 (Stable Release)

+

BIND 9.14.1 (Stable Release)

diff --git a/doc/arm/man.dig.html b/doc/arm/man.dig.html index 56ee2e1e47..68ed22a650 100644 --- a/doc/arm/man.dig.html +++ b/doc/arm/man.dig.html @@ -1151,6 +1151,6 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr -

BIND 9.14.0 (Stable Release)

+

BIND 9.14.1 (Stable Release)

diff --git a/doc/arm/man.dnssec-cds.html b/doc/arm/man.dnssec-cds.html index b39165c51b..c7fbc43df0 100644 --- a/doc/arm/man.dnssec-cds.html +++ b/doc/arm/man.dnssec-cds.html @@ -376,6 +376,6 @@ nsupdate -l -

BIND 9.14.0 (Stable Release)

+

BIND 9.14.1 (Stable Release)

diff --git a/doc/arm/man.dnssec-checkds.html b/doc/arm/man.dnssec-checkds.html index 9ab34907de..e2fff9485f 100644 --- a/doc/arm/man.dnssec-checkds.html +++ b/doc/arm/man.dnssec-checkds.html @@ -150,6 +150,6 @@ -

BIND 9.14.0 (Stable Release)

+

BIND 9.14.1 (Stable Release)

diff --git a/doc/arm/man.dnssec-coverage.html b/doc/arm/man.dnssec-coverage.html index a003d91449..d428cbf206 100644 --- a/doc/arm/man.dnssec-coverage.html +++ b/doc/arm/man.dnssec-coverage.html @@ -270,6 +270,6 @@ -

BIND 9.14.0 (Stable Release)

+

BIND 9.14.1 (Stable Release)

diff --git a/doc/arm/man.dnssec-dsfromkey.html b/doc/arm/man.dnssec-dsfromkey.html index 92493c3615..72182827f0 100644 --- a/doc/arm/man.dnssec-dsfromkey.html +++ b/doc/arm/man.dnssec-dsfromkey.html @@ -352,6 +352,6 @@ -

BIND 9.14.0 (Stable Release)

+

BIND 9.14.1 (Stable Release)

diff --git a/doc/arm/man.dnssec-importkey.html b/doc/arm/man.dnssec-importkey.html index e72cb7f5cc..b20b439ba8 100644 --- a/doc/arm/man.dnssec-importkey.html +++ b/doc/arm/man.dnssec-importkey.html @@ -250,6 +250,6 @@ -

BIND 9.14.0 (Stable Release)

+

BIND 9.14.1 (Stable Release)

diff --git a/doc/arm/man.dnssec-keyfromlabel.html b/doc/arm/man.dnssec-keyfromlabel.html index c22c9faf85..495123cb0d 100644 --- a/doc/arm/man.dnssec-keyfromlabel.html +++ b/doc/arm/man.dnssec-keyfromlabel.html @@ -498,6 +498,6 @@ -

BIND 9.14.0 (Stable Release)

+

BIND 9.14.1 (Stable Release)

diff --git a/doc/arm/man.dnssec-keygen.html b/doc/arm/man.dnssec-keygen.html index 2c932802c7..c1e5cef9b3 100644 --- a/doc/arm/man.dnssec-keygen.html +++ b/doc/arm/man.dnssec-keygen.html @@ -480,10 +480,12 @@ key.

- The .key file contains a DNS KEY record - that - can be inserted into a zone file (directly or with a $INCLUDE - statement). + The .key file contains a DNSKEY or KEY record. + When a zone is being signed by named + or dnssec-signzone -S, DNSKEY + records are included automatically. In other cases, + the .key file can be inserted into a zone file + manually or with a $INCLUDE statement.

The .private file contains @@ -491,11 +493,6 @@ fields. For obvious security reasons, this file does not have general read permission.

-

- Both .key and .private - files are generated for symmetric cryptography algorithms such as - HMAC-MD5, even though the public and private key are equivalent. -

@@ -560,6 +557,6 @@
-

BIND 9.14.0 (Stable Release)

+

BIND 9.14.1 (Stable Release)

diff --git a/doc/arm/man.dnssec-keymgr.html b/doc/arm/man.dnssec-keymgr.html index 6c89c7683d..3c1944770b 100644 --- a/doc/arm/man.dnssec-keymgr.html +++ b/doc/arm/man.dnssec-keymgr.html @@ -405,6 +405,6 @@ -

BIND 9.14.0 (Stable Release)

+

BIND 9.14.1 (Stable Release)

diff --git a/doc/arm/man.dnssec-revoke.html b/doc/arm/man.dnssec-revoke.html index eafc8efa0a..ab6128e1f8 100644 --- a/doc/arm/man.dnssec-revoke.html +++ b/doc/arm/man.dnssec-revoke.html @@ -171,6 +171,6 @@ -

BIND 9.14.0 (Stable Release)

+

BIND 9.14.1 (Stable Release)

diff --git a/doc/arm/man.dnssec-settime.html b/doc/arm/man.dnssec-settime.html index a6117fcbe5..3b9518d545 100644 --- a/doc/arm/man.dnssec-settime.html +++ b/doc/arm/man.dnssec-settime.html @@ -349,6 +349,6 @@ -

BIND 9.14.0 (Stable Release)

+

BIND 9.14.1 (Stable Release)

diff --git a/doc/arm/man.dnssec-signzone.html b/doc/arm/man.dnssec-signzone.html index 0640031bf2..3afaba7a53 100644 --- a/doc/arm/man.dnssec-signzone.html +++ b/doc/arm/man.dnssec-signzone.html @@ -701,6 +701,6 @@ db.example.com.signed -

BIND 9.14.0 (Stable Release)

+

BIND 9.14.1 (Stable Release)

diff --git a/doc/arm/man.dnssec-verify.html b/doc/arm/man.dnssec-verify.html index 53d3286018..dc58c02dac 100644 --- a/doc/arm/man.dnssec-verify.html +++ b/doc/arm/man.dnssec-verify.html @@ -202,6 +202,6 @@ -

BIND 9.14.0 (Stable Release)

+

BIND 9.14.1 (Stable Release)

diff --git a/doc/arm/man.dnstap-read.html b/doc/arm/man.dnstap-read.html index 412ea9eccd..0d7103b04c 100644 --- a/doc/arm/man.dnstap-read.html +++ b/doc/arm/man.dnstap-read.html @@ -143,6 +143,6 @@ -

BIND 9.14.0 (Stable Release)

+

BIND 9.14.1 (Stable Release)

diff --git a/doc/arm/man.filter-aaaa.html b/doc/arm/man.filter-aaaa.html index 672c33c26b..c5c9f3b143 100644 --- a/doc/arm/man.filter-aaaa.html +++ b/doc/arm/man.filter-aaaa.html @@ -168,6 +168,6 @@ plugin query "/usr/local/lib/filter-aaaa.so" { -

BIND 9.14.0 (Stable Release)

+

BIND 9.14.1 (Stable Release)

diff --git a/doc/arm/man.host.html b/doc/arm/man.host.html index 0f430bdfaa..a2b995cd30 100644 --- a/doc/arm/man.host.html +++ b/doc/arm/man.host.html @@ -366,6 +366,6 @@ -

BIND 9.14.0 (Stable Release)

+

BIND 9.14.1 (Stable Release)

diff --git a/doc/arm/man.mdig.html b/doc/arm/man.mdig.html index 21ff3b3097..0316dd4c2d 100644 --- a/doc/arm/man.mdig.html +++ b/doc/arm/man.mdig.html @@ -604,6 +604,6 @@ -

BIND 9.14.0 (Stable Release)

+

BIND 9.14.1 (Stable Release)

diff --git a/doc/arm/man.named-checkconf.html b/doc/arm/man.named-checkconf.html index 153de63610..2eda42ffe2 100644 --- a/doc/arm/man.named-checkconf.html +++ b/doc/arm/man.named-checkconf.html @@ -208,6 +208,6 @@ -

BIND 9.14.0 (Stable Release)

+

BIND 9.14.1 (Stable Release)

diff --git a/doc/arm/man.named-checkzone.html b/doc/arm/man.named-checkzone.html index 510b14ffed..8c9f39c0ef 100644 --- a/doc/arm/man.named-checkzone.html +++ b/doc/arm/man.named-checkzone.html @@ -463,6 +463,6 @@ -

BIND 9.14.0 (Stable Release)

+

BIND 9.14.1 (Stable Release)

diff --git a/doc/arm/man.named-journalprint.html b/doc/arm/man.named-journalprint.html index 3861227930..60a5b6835c 100644 --- a/doc/arm/man.named-journalprint.html +++ b/doc/arm/man.named-journalprint.html @@ -117,6 +117,6 @@ -

BIND 9.14.0 (Stable Release)

+

BIND 9.14.1 (Stable Release)

diff --git a/doc/arm/man.named-nzd2nzf.html b/doc/arm/man.named-nzd2nzf.html index 17cd3665cd..aaf573c3ed 100644 --- a/doc/arm/man.named-nzd2nzf.html +++ b/doc/arm/man.named-nzd2nzf.html @@ -119,6 +119,6 @@ -

BIND 9.14.0 (Stable Release)

+

BIND 9.14.1 (Stable Release)

diff --git a/doc/arm/man.named-rrchecker.html b/doc/arm/man.named-rrchecker.html index b9dc946d4e..b134d8b96c 100644 --- a/doc/arm/man.named-rrchecker.html +++ b/doc/arm/man.named-rrchecker.html @@ -121,6 +121,6 @@ -

BIND 9.14.0 (Stable Release)

+

BIND 9.14.1 (Stable Release)

diff --git a/doc/arm/man.named.conf.html b/doc/arm/man.named.conf.html index 2c66529d14..d7bc85447c 100644 --- a/doc/arm/man.named.conf.html +++ b/doc/arm/man.named.conf.html @@ -1073,6 +1073,6 @@ zone -

BIND 9.14.0 (Stable Release)

+

BIND 9.14.1 (Stable Release)

diff --git a/doc/arm/man.named.html b/doc/arm/man.named.html index 17b5721e75..2c9794e219 100644 --- a/doc/arm/man.named.html +++ b/doc/arm/man.named.html @@ -492,6 +492,6 @@ -

BIND 9.14.0 (Stable Release)

+

BIND 9.14.1 (Stable Release)

diff --git a/doc/arm/man.nsec3hash.html b/doc/arm/man.nsec3hash.html index 95be712a1f..a8cd038c88 100644 --- a/doc/arm/man.nsec3hash.html +++ b/doc/arm/man.nsec3hash.html @@ -155,6 +155,6 @@ -

BIND 9.14.0 (Stable Release)

+

BIND 9.14.1 (Stable Release)

diff --git a/doc/arm/man.nslookup.html b/doc/arm/man.nslookup.html index ac05e66a92..88f04dce98 100644 --- a/doc/arm/man.nslookup.html +++ b/doc/arm/man.nslookup.html @@ -437,6 +437,6 @@ nslookup -query=hinfo -timeout=10 -

BIND 9.14.0 (Stable Release)

+

BIND 9.14.1 (Stable Release)

diff --git a/doc/arm/man.nsupdate.html b/doc/arm/man.nsupdate.html index ad194707df..2d65371ef6 100644 --- a/doc/arm/man.nsupdate.html +++ b/doc/arm/man.nsupdate.html @@ -818,6 +818,6 @@ -

BIND 9.14.0 (Stable Release)

+

BIND 9.14.1 (Stable Release)

diff --git a/doc/arm/man.pkcs11-destroy.html b/doc/arm/man.pkcs11-destroy.html index a353cb7bae..07e2b40d03 100644 --- a/doc/arm/man.pkcs11-destroy.html +++ b/doc/arm/man.pkcs11-destroy.html @@ -162,6 +162,6 @@ -

BIND 9.14.0 (Stable Release)

+

BIND 9.14.1 (Stable Release)

diff --git a/doc/arm/man.pkcs11-keygen.html b/doc/arm/man.pkcs11-keygen.html index 83e6131c1c..c06b2ab262 100644 --- a/doc/arm/man.pkcs11-keygen.html +++ b/doc/arm/man.pkcs11-keygen.html @@ -200,6 +200,6 @@ -

BIND 9.14.0 (Stable Release)

+

BIND 9.14.1 (Stable Release)

diff --git a/doc/arm/man.pkcs11-list.html b/doc/arm/man.pkcs11-list.html index 22386c4485..a9356ffc5c 100644 --- a/doc/arm/man.pkcs11-list.html +++ b/doc/arm/man.pkcs11-list.html @@ -158,6 +158,6 @@ -

BIND 9.14.0 (Stable Release)

+

BIND 9.14.1 (Stable Release)

diff --git a/doc/arm/man.pkcs11-tokens.html b/doc/arm/man.pkcs11-tokens.html index 1563a18113..af9fc1031c 100644 --- a/doc/arm/man.pkcs11-tokens.html +++ b/doc/arm/man.pkcs11-tokens.html @@ -123,6 +123,6 @@ -

BIND 9.14.0 (Stable Release)

+

BIND 9.14.1 (Stable Release)

diff --git a/doc/arm/man.rndc-confgen.html b/doc/arm/man.rndc-confgen.html index c10baf59b8..30c50e197f 100644 --- a/doc/arm/man.rndc-confgen.html +++ b/doc/arm/man.rndc-confgen.html @@ -260,6 +260,6 @@ -

BIND 9.14.0 (Stable Release)

+

BIND 9.14.1 (Stable Release)

diff --git a/doc/arm/man.rndc.conf.html b/doc/arm/man.rndc.conf.html index 5813511234..5767862b44 100644 --- a/doc/arm/man.rndc.conf.html +++ b/doc/arm/man.rndc.conf.html @@ -268,6 +268,6 @@ -

BIND 9.14.0 (Stable Release)

+

BIND 9.14.1 (Stable Release)

diff --git a/doc/arm/man.rndc.html b/doc/arm/man.rndc.html index beb2dae5db..1adfa69ea7 100644 --- a/doc/arm/man.rndc.html +++ b/doc/arm/man.rndc.html @@ -1024,6 +1024,6 @@ -

BIND 9.14.0 (Stable Release)

+

BIND 9.14.1 (Stable Release)

diff --git a/doc/arm/notes.html b/doc/arm/notes.html index 85a42769e9..730829900d 100644 --- a/doc/arm/notes.html +++ b/doc/arm/notes.html @@ -15,16 +15,15 @@

-Release Notes for BIND Version 9.14.0

+Release Notes for BIND Version 9.14.1

Introduction

- BIND 9.14.0 is the first release of a new stable branch of BIND. - This document summarizes new features and functional changes - that have been introduced, as well as features that have been - deprecated or removed, since the last stable branch, 9.12. + BIND 9.14 is a stable branch of BIND. + This document summarizes significant changes since the last + production release on that branch.

@@ -97,498 +96,62 @@

-Known Issues

+Security Fixes
+
    +
  • +

    + In certain configurations, named could crash + with an assertion failure if nxdomain-redirect + was in use and a redirected query resulted in an NXDOMAIN from the + cache. This flaw is disclosed in CVE-2019-6467. [GL #880] +

    +
    • +
  • +

    + The TCP client quota set using the tcp-clients + option could be exceeded in some cases. This could lead to + exhaustion of file descriptors. (CVE-2018-5743) [GL #615] +

    +
    • +
+ + +
+

+New Features

  • - A recent change in the named.conf parser - resulted in allow-update being treated as a - configuration error when set at the options or - view level. This is not a secure configuration - and the use of the option in this manner is ill-advised. However, - in this release it should have been treated as a warning rather - than a fatal error. This flaw was discovered too late to be - fixed in 9.14.0, but it will be corrected in the 9.14.1 - maintenance release: global allow-update will - again be permitted, but a warning will be logged. + The new add-soa option specifies whether + or not the response-policy zone's SOA record + should be included in the additional section of RPZ responses. + [GL #865] +

    +
+
+ +
+

+Feature Changes

+
  • +

    + None.

-New Features

-
    -
  • -

    - Task manager and socket code have been substantially modified. - The manager uses per-cpu queues for tasks and network stack runs - multiple event loops in CPU-affinitive threads. This greatly - improves performance on large systems, especially when using - multi-queue NICs. -

    -
    • -
  • -

    - Support for QNAME minimization was added and enabled by default - in relaxed mode, in which BIND will fall back - to normal resolution if the remote server returns something - unexpected during the query minimization process. This default - setting might change to strict in the future. -

    -
    • -
  • -

    - A new plugin mechanism has been added to allow - extension of query processing functionality through the use of - external libraries. The new filter-aaaa.so - plugin replaces the filter-aaaa feature that - was formerly implemented as a native part of BIND. -

    -

    - The plugin API is a work in progress and is likely to evolve - as further plugins are implemented. [GL #15] -

    -
    • -
  • -

    - A new secondary zone option, mirror, - enables named to serve a transferred copy - of a zone's contents without acting as an authority for the - zone. A zone must be fully validated against an active trust - anchor before it can be used as a mirror zone. DNS responses - from mirror zones do not set the AA bit ("authoritative answer"), - but do set the AD bit ("authenticated data"). This feature is - meant to facilitate deployment of a local copy of the root zone, - as described in RFC 7706. [GL #33] -

    -
    • -
  • -

    - BIND now can be compiled against the libidn2 - library to add IDNA2008 support. Previously, BIND supported - IDNA2003 using the (now obsolete and unsupported) - idnkit-1 library. -

    -
    • -
  • -

    - named now supports the "root key sentinel" - mechanism. This enables validating resolvers to indicate - which trust anchors are configured for the root, so that - information about root key rollover status can be gathered. - To disable this feature, add - root-key-sentinel no; to - named.conf. [GL #37] -

    -
    • -
  • -

    - The dnskey-sig-validity option allows the - sig-validity-interval to be overriden for - signatures covering DNSKEY RRsets. [GL #145] -

    -
    • -
  • -

    - When built on Linux, BIND now requires the libcap - library to set process privileges. The adds a new compile-time - dependency, which can be met on most Linux platforms by installing the - libcap-dev or libcap-devel - package. BIND can also be built without capability support by using - configure --disable-linux-caps, at the cost of some - loss of security. -

    -
    • -
  • -

    - The validate-except option specifies a list of - domains beneath which DNSSEC validation should not be performed, - regardless of whether a trust anchor has been configured above - them. [GL #237] -

    -
    • -
  • -

    - Two new update policy rule types have been added - krb5-selfsub and ms-selfsub - which allow machines with Kerberos principals to update - the name space at or below the machine names identified - in the respective principals. -

    -
    • -
  • -

    - The new configure option --enable-fips-mode - can be used to make BIND enable and enforce FIPS mode in the - OpenSSL library. When compiled with such option the BIND will - refuse to run if FIPS mode can't be enabled, thus this option - must be only enabled for the systems where FIPS mode is available. -

    -
    • -
  • -

    - Two new configuration options min-cache-ttl and - min-ncache-ttl has been added to allow the BIND 9 - administrator to override the minimum TTL in the received DNS records - (positive caching) and for storing the information about non-existent - records (negative caching). The configured minimum TTL for both - configuration options cannot exceed 90 seconds. -

    -
    • -
  • +Bug Fixes
+

  • - rndc status output now includes a - reconfig/reload in progress status line if named - configuration is being reloaded. -

    -
    • -
  • -

    - The new answer-cookie option, if set to - no, prevents named from - returning a DNS COOKIE option to a client, even if such an - option was present in the request. This is only intended as - a temporary measure, for use when named - shares an IP address with other servers that do not yet - support DNS COOKIE. A mismatch between servers on the same - address is not expected to cause operational problems, but the - option to disable COOKIE responses so that all servers have the - same behavior is provided out of an abundance of caution. - DNS COOKIE is an important security mechanism, and this option - should not be used to disable it unless absolutely necessary. + The allow-update and + allow-update-forwarding options were + inadvertently treated as configuration errors when used at the + options or view level. + This has now been corrected. + [GL #913]

    -
    • -
- - -
-

-Removed Features

-
    -
  • -

    - Workarounds for servers that misbehave when queried with EDNS - have been removed, because these broken servers and the - workarounds for their noncompliance cause unnecessary delays, - increase code complexity, and prevent deployment of new DNS - features. See https://dnsflagday.net - for further details. -

    -

    - In particular, resolution will no longer fall back to - plain DNS when there was no response from an authoritative - server. This will cause some domains to become non-resolvable - without manual intervention. In these cases, resolution can - be restored by adding server clauses for the - offending servers, specifying edns no or - send-cookie no, depending on the specific - noncompliance. -

    -

    - To determine which server clause to use, run - the following commands to send queries to the authoritative - servers for the broken domain: -

    -


    -   dig soa <zone> @<server> +dnssec
    -   dig soa <zone> @<server> +dnssec +nocookie
    -   dig soa <zone> @<server> +noedns
    -

    -

    - If the first command fails but the second succeeds, the - server most likely needs send-cookie no. - If the first two fail but the third succeeds, then the server - needs EDNS to be fully disabled with edns no. -

    -

    - Please contact the administrators of noncompliant domains - and encourage them to upgrade their broken DNS servers. [GL #150] -

    -
    • -
  • -

    - Previously, it was possible to build BIND without thread support - for old architectures and systems without threads support. - BIND now requires threading support (either POSIX or Windows) from - the operating system, and it cannot be built without threads. -

    -
    • -
  • -

    - The filter-aaaa, - filter-aaaa-on-v4, and - filter-aaaa-on-v6 options have been removed - from named, and can no longer be - configured using native named.conf syntax. - However, loading the new filter-aaaa.so - plugin and setting its parameters provides identical - functionality. -

    -
    • -
  • -

    - named can no longer use the EDNS CLIENT-SUBNET - option for view selection. In its existing form, the authoritative - ECS feature was not fully RFC-compliant, and could not realistically - have been deployed in production for an authoritative server; its - only practical use was for testing and experimentation. In the - interest of code simplification, this feature has now been removed. -

    -

    - The ECS option is still supported in dig and - mdig via the +subnet argument, and can be parsed - and logged when received by named, but - it is no longer used for ACL processing. The - geoip-use-ecs option is now obsolete; - a warning will be logged if it is used in - named.conf. - ecs tags in an ACL definition are - also obsolete, and will cause the configuration to fail to - load if they are used. [GL #32] -

    -
    • -
  • -

    - dnssec-keygen can no longer generate HMAC - keys for TSIG authentication. Use tsig-keygen - to generate these keys. [RT #46404] -

    -
    • -
  • -

    - Support for OpenSSL 0.9.x has been removed. OpenSSL version - 1.0.0 or greater, or LibreSSL is now required. -

    -
    • -
  • -

    - The configure --enable-seccomp option, - which formerly turned on system-call filtering on Linux, has - been removed. [GL #93] -

    -
    • -
  • -

    - IPv4 addresses in forms other than dotted-quad are no longer - accepted in master files. [GL #13] [GL #56] -

    -
    • -
  • -

    - IDNA2003 support via (bundled) idnkit-1.0 has been removed. -

    -
    • -
  • -

    - The "rbtdb64" database implementation (a parallel - implementation of "rbt") has been removed. [GL #217] -

    -
    • -
  • -

    - The -r randomdev option to explicitly select - random device has been removed from the - ddns-confgen, - rndc-confgen, - nsupdate, - dnssec-confgen, and - dnssec-signzone commands. -

    -

    - The -p option to use pseudo-random data - has been removed from the dnssec-signzone - command. -

    -
    • -
  • -

    - Support for the RSAMD5 algorithm has been removed freom BIND as - the usage of the RSAMD5 algorithm for DNSSEC has been deprecated - in RFC6725, the security of the MD5 algorithm has been compromised, - and its usage is considered harmful. -

    -
    • -
  • -

    - Support for the ECC-GOST (GOST R 34.11-94) algorithm has been - removed from BIND, as the algorithm has been superseded by - GOST R 34.11-2012 in RFC6986 and it must not be used in new - deployments. BIND will neither create new DNSSEC keys, - signatures and digests, nor it will validate them. -

    -
    • -
  • -

    - Support for DSA and DSA-NSEC3-SHA1 algorithms has been - removed from BIND as the DSA key length is limited to 1024 - bits and this is not considered secure enough. -

    -
    • -
  • -

    - named will no longer ignore "no-change" deltas - when processing an IXFR stream. This had previously been - permitted for compatibility with BIND 8, but now "no-change" - deltas will trigger a fallback to AXFR as the recovery mechanism. -

    -
    • -
  • -

    - BIND 9 will no longer build on platforms that don't have - proper IPv6 support. BIND 9 now also requires POSIX-compatible - pthread support. Most of the platforms that lack these featuers - are long past their end-of-lifew dates, and they are neither - developed nor supported by their respective vendors. -

    -
    • -
  • -

    - The incomplete support for internationalization message catalogs has - been removed from BIND. Since the internationalization was never - completed, and no localized message catalogs were ever made available - for the portions of BIND in which they could have been used, this - change will have no effect except to simplify the source code. BIND's - log messages and other output were already only available in English. -

    -
    • -
-
- -
-

-Feature Changes

-
    -
  • -

    - BIND will now always use the best CSPRNG (cryptographically-secure - pseudo-random number generator) available on the platform where - it is compiled. It will use the arc4random() - family of functions on BSD operating systems, - getrandom() on Linux and Solaris, - CryptGenRandom on Windows, and the selected - cryptography provider library (OpenSSL or PKCS#11) as the last - resort. [GL #221] -

    -
    • -
  • -

    - The default setting for dnssec-validation is - now auto, which activates DNSSEC - validation using the IANA root key. (The default can be changed - back to yes, which activates DNSSEC - validation only when keys are explicitly configured in - named.conf, by building BIND with - configure --disable-auto-validation.) [GL #30] -

    -
    • -
  • -

    - BIND can no longer be built without DNSSEC support. A cryptography - provider (i.e., OpenSSL or a hardware service module with - PKCS#11 support) must be available. [GL #244] -

    -
    • -
  • -

    - Zone types primary and - secondary are now available as synonyms for - master and slave, - respectively, in named.conf. -

    -
    • -
  • -

    - named will now log a warning if the old - root DNSSEC key is explicitly configured and has not been updated. - [RT #43670] -

    -
    • -
  • -

    - dig +nssearch will now list name servers - that have timed out, in addition to those that respond. [GL #64] -

    -
    • -
  • -

    - Up to 64 response-policy zones are now - supported by default; previously the limit was 32. [GL #123] -

    -
    • -
  • -

    - Several configuration options for time periods can now use - TTL value suffixes (for example, 2h or - 1d) in addition to an integer number of - seconds. These include - fstrm-set-reopen-interval, - interface-interval, - max-cache-ttl, - max-ncache-ttl, - max-policy-ttl, and - min-update-interval. - [GL #203] -

    -
    • -
  • -

    - NSID logging (enabled by the request-nsid - option) now has its own nsid category, - instead of using the resolver category. -

    -
    • -
  • -

    - The rndc nta command could not differentiate - between views of the same name but different class; this - has been corrected with the addition of a -class - option. [GL #105] -

    -
    • -
  • -

    - allow-recursion-on and - allow-query-cache-on each now default to - the other if only one of them is set, in order to be consistent - with the way allow-recursion and - allow-query-cache work. [GL #319] -

    -
    • -
  • -

    - When compiled with IDN support, the dig and - nslookup commands now disable IDN processing - when the standard output is not a TTY (i.e., when the output - is not being read by a human). When running from a shell - script, the command line options +idnin and - +idnout may be used to enable IDN - processing of input and output domain names, respectively. - When running on a TTY, the +noidnin and - +noidnout options may be used to disable - IDN processing of input and output domain names. -

    -
    • -
  • -

    - The configuration option max-ncache-ttl cannot - exceed seven days. Previously, larger values than this were silently - lowered; now, they trigger a configuration error. -

    -
    • -
  • -

    - The new dig -r command line option - disables reading of the file $HOME/.digrc. -

    -
    • -
  • -

    - Zone signing and key maintenance events are now logged to the - dnssec category rather than - zone. -

    -
    • -
+
diff --git a/doc/arm/notes.pdf b/doc/arm/notes.pdf index a930c9679d..af19cbd388 100644 Binary files a/doc/arm/notes.pdf and b/doc/arm/notes.pdf differ diff --git a/doc/arm/notes.txt b/doc/arm/notes.txt index 02ef750ae0..99fe4873dd 100644 --- a/doc/arm/notes.txt +++ b/doc/arm/notes.txt @@ -1,11 +1,9 @@ -Release Notes for BIND Version 9.14.0 +Release Notes for BIND Version 9.14.1 Introduction -BIND 9.14.0 is the first release of a new stable branch of BIND. This -document summarizes new features and functional changes that have been -introduced, as well as features that have been deprecated or removed, -since the last stable branch, 9.12. +BIND 9.14 is a stable branch of BIND. This document summarizes significant +changes since the last production release on that branch. Please see the file CHANGES for a more detailed list of changes and bug fixes. @@ -52,281 +50,32 @@ www.isc.org/downloads/. There you will find additional information about each release, source code, and pre-compiled versions for Microsoft Windows operating systems. -Known Issues +Security Fixes - * A recent change in the named.conf parser resulted in allow-update - being treated as a configuration error when set at the options or view - level. This is not a secure configuration and the use of the option in - this manner is ill-advised. However, in this release it should have - been treated as a warning rather than a fatal error. This flaw was - discovered too late to be fixed in 9.14.0, but it will be corrected in - the 9.14.1 maintenance release: global allow-update will again be - permitted, but a warning will be logged. + * In certain configurations, named could crash with an assertion failure + if nxdomain-redirect was in use and a redirected query resulted in an + NXDOMAIN from the cache. This flaw is disclosed in CVE-2019-6467. [GL + #880] + + * The TCP client quota set using the tcp-clients option could be + exceeded in some cases. This could lead to exhaustion of file + descriptors. (CVE-2018-5743) [GL #615] New Features - * Task manager and socket code have been substantially modified. The - manager uses per-cpu queues for tasks and network stack runs multiple - event loops in CPU-affinitive threads. This greatly improves - performance on large systems, especially when using multi-queue NICs. - - * Support for QNAME minimization was added and enabled by default in - relaxed mode, in which BIND will fall back to normal resolution if the - remote server returns something unexpected during the query - minimization process. This default setting might change to strict in - the future. - - * A new plugin mechanism has been added to allow extension of query - processing functionality through the use of external libraries. The - new filter-aaaa.so plugin replaces the filter-aaaa feature that was - formerly implemented as a native part of BIND. - - The plugin API is a work in progress and is likely to evolve as - further plugins are implemented. [GL #15] - - * A new secondary zone option, mirror, enables named to serve a - transferred copy of a zone's contents without acting as an authority - for the zone. A zone must be fully validated against an active trust - anchor before it can be used as a mirror zone. DNS responses from - mirror zones do not set the AA bit ("authoritative answer"), but do - set the AD bit ("authenticated data"). This feature is meant to - facilitate deployment of a local copy of the root zone, as described - in RFC 7706. [GL #33] - - * BIND now can be compiled against the libidn2 library to add IDNA2008 - support. Previously, BIND supported IDNA2003 using the (now obsolete - and unsupported) idnkit-1 library. - - * named now supports the "root key sentinel" mechanism. This enables - validating resolvers to indicate which trust anchors are configured - for the root, so that information about root key rollover status can - be gathered. To disable this feature, add root-key-sentinel no; to - named.conf. [GL #37] - - * The dnskey-sig-validity option allows the sig-validity-interval to be - overriden for signatures covering DNSKEY RRsets. [GL #145] - - * When built on Linux, BIND now requires the libcap library to set - process privileges. The adds a new compile-time dependency, which can - be met on most Linux platforms by installing the libcap-dev or - libcap-devel package. BIND can also be built without capability - support by using configure --disable-linux-caps, at the cost of some - loss of security. - - * The validate-except option specifies a list of domains beneath which - DNSSEC validation should not be performed, regardless of whether a - trust anchor has been configured above them. [GL #237] - - * Two new update policy rule types have been added krb5-selfsub and - ms-selfsub which allow machines with Kerberos principals to update the - name space at or below the machine names identified in the respective - principals. - - * The new configure option --enable-fips-mode can be used to make BIND - enable and enforce FIPS mode in the OpenSSL library. When compiled - with such option the BIND will refuse to run if FIPS mode can't be - enabled, thus this option must be only enabled for the systems where - FIPS mode is available. - - * Two new configuration options min-cache-ttl and min-ncache-ttl has - been added to allow the BIND 9 administrator to override the minimum - TTL in the received DNS records (positive caching) and for storing the - information about non-existent records (negative caching). The - configured minimum TTL for both configuration options cannot exceed 90 - seconds. - - * rndc status output now includes a reconfig/reload in progress status - line if named configuration is being reloaded. - - * The new answer-cookie option, if set to no, prevents named from - returning a DNS COOKIE option to a client, even if such an option was - present in the request. This is only intended as a temporary measure, - for use when named shares an IP address with other servers that do not - yet support DNS COOKIE. A mismatch between servers on the same address - is not expected to cause operational problems, but the option to - disable COOKIE responses so that all servers have the same behavior is - provided out of an abundance of caution. DNS COOKIE is an important - security mechanism, and this option should not be used to disable it - unless absolutely necessary. - -Removed Features - - * Workarounds for servers that misbehave when queried with EDNS have - been removed, because these broken servers and the workarounds for - their noncompliance cause unnecessary delays, increase code - complexity, and prevent deployment of new DNS features. See https:// - dnsflagday.net for further details. - - In particular, resolution will no longer fall back to plain DNS when - there was no response from an authoritative server. This will cause - some domains to become non-resolvable without manual intervention. In - these cases, resolution can be restored by adding server clauses for - the offending servers, specifying edns no or send-cookie no, depending - on the specific noncompliance. - - To determine which server clause to use, run the following commands to - send queries to the authoritative servers for the broken domain: - - - dig soa @ +dnssec - dig soa @ +dnssec +nocookie - dig soa @ +noedns - - If the first command fails but the second succeeds, the server most - likely needs send-cookie no. If the first two fail but the third - succeeds, then the server needs EDNS to be fully disabled with edns no - . - - Please contact the administrators of noncompliant domains and - encourage them to upgrade their broken DNS servers. [GL #150] - - * Previously, it was possible to build BIND without thread support for - old architectures and systems without threads support. BIND now - requires threading support (either POSIX or Windows) from the - operating system, and it cannot be built without threads. - - * The filter-aaaa, filter-aaaa-on-v4, and filter-aaaa-on-v6 options have - been removed from named, and can no longer be configured using native - named.conf syntax. However, loading the new filter-aaaa.so plugin and - setting its parameters provides identical functionality. - - * named can no longer use the EDNS CLIENT-SUBNET option for view - selection. In its existing form, the authoritative ECS feature was not - fully RFC-compliant, and could not realistically have been deployed in - production for an authoritative server; its only practical use was for - testing and experimentation. In the interest of code simplification, - this feature has now been removed. - - The ECS option is still supported in dig and mdig via the +subnet - argument, and can be parsed and logged when received by named, but it - is no longer used for ACL processing. The geoip-use-ecs option is now - obsolete; a warning will be logged if it is used in named.conf. ecs - tags in an ACL definition are also obsolete, and will cause the - configuration to fail to load if they are used. [GL #32] - - * dnssec-keygen can no longer generate HMAC keys for TSIG - authentication. Use tsig-keygen to generate these keys. [RT #46404] - - * Support for OpenSSL 0.9.x has been removed. OpenSSL version 1.0.0 or - greater, or LibreSSL is now required. - - * The configure --enable-seccomp option, which formerly turned on - system-call filtering on Linux, has been removed. [GL #93] - - * IPv4 addresses in forms other than dotted-quad are no longer accepted - in master files. [GL #13] [GL #56] - - * IDNA2003 support via (bundled) idnkit-1.0 has been removed. - - * The "rbtdb64" database implementation (a parallel implementation of - "rbt") has been removed. [GL #217] - - * The -r randomdev option to explicitly select random device has been - removed from the ddns-confgen, rndc-confgen, nsupdate, dnssec-confgen, - and dnssec-signzone commands. - - The -p option to use pseudo-random data has been removed from the - dnssec-signzone command. - - * Support for the RSAMD5 algorithm has been removed freom BIND as the - usage of the RSAMD5 algorithm for DNSSEC has been deprecated in - RFC6725, the security of the MD5 algorithm has been compromised, and - its usage is considered harmful. - - * Support for the ECC-GOST (GOST R 34.11-94) algorithm has been removed - from BIND, as the algorithm has been superseded by GOST R 34.11-2012 - in RFC6986 and it must not be used in new deployments. BIND will - neither create new DNSSEC keys, signatures and digests, nor it will - validate them. - - * Support for DSA and DSA-NSEC3-SHA1 algorithms has been removed from - BIND as the DSA key length is limited to 1024 bits and this is not - considered secure enough. - - * named will no longer ignore "no-change" deltas when processing an IXFR - stream. This had previously been permitted for compatibility with BIND - 8, but now "no-change" deltas will trigger a fallback to AXFR as the - recovery mechanism. - - * BIND 9 will no longer build on platforms that don't have proper IPv6 - support. BIND 9 now also requires POSIX-compatible pthread support. - Most of the platforms that lack these featuers are long past their - end-of-lifew dates, and they are neither developed nor supported by - their respective vendors. - - * The incomplete support for internationalization message catalogs has - been removed from BIND. Since the internationalization was never - completed, and no localized message catalogs were ever made available - for the portions of BIND in which they could have been used, this - change will have no effect except to simplify the source code. BIND's - log messages and other output were already only available in English. + * The new add-soa option specifies whether or not the response-policy + zone's SOA record should be included in the additional section of RPZ + responses. [GL #865] Feature Changes - * BIND will now always use the best CSPRNG (cryptographically-secure - pseudo-random number generator) available on the platform where it is - compiled. It will use the arc4random() family of functions on BSD - operating systems, getrandom() on Linux and Solaris, CryptGenRandom on - Windows, and the selected cryptography provider library (OpenSSL or - PKCS#11) as the last resort. [GL #221] + * None. - * The default setting for dnssec-validation is now auto, which activates - DNSSEC validation using the IANA root key. (The default can be changed - back to yes, which activates DNSSEC validation only when keys are - explicitly configured in named.conf, by building BIND with configure - --disable-auto-validation.) [GL #30] +Bug Fixes - * BIND can no longer be built without DNSSEC support. A cryptography - provider (i.e., OpenSSL or a hardware service module with PKCS#11 - support) must be available. [GL #244] - - * Zone types primary and secondary are now available as synonyms for - master and slave, respectively, in named.conf. - - * named will now log a warning if the old root DNSSEC key is explicitly - configured and has not been updated. [RT #43670] - - * dig +nssearch will now list name servers that have timed out, in - addition to those that respond. [GL #64] - - * Up to 64 response-policy zones are now supported by default; - previously the limit was 32. [GL #123] - - * Several configuration options for time periods can now use TTL value - suffixes (for example, 2h or 1d) in addition to an integer number of - seconds. These include fstrm-set-reopen-interval, interface-interval, - max-cache-ttl, max-ncache-ttl, max-policy-ttl, and min-update-interval - . [GL #203] - - * NSID logging (enabled by the request-nsid option) now has its own nsid - category, instead of using the resolver category. - - * The rndc nta command could not differentiate between views of the same - name but different class; this has been corrected with the addition of - a -class option. [GL #105] - - * allow-recursion-on and allow-query-cache-on each now default to the - other if only one of them is set, in order to be consistent with the - way allow-recursion and allow-query-cache work. [GL #319] - - * When compiled with IDN support, the dig and nslookup commands now - disable IDN processing when the standard output is not a TTY (i.e., - when the output is not being read by a human). When running from a - shell script, the command line options +idnin and +idnout may be used - to enable IDN processing of input and output domain names, - respectively. When running on a TTY, the +noidnin and +noidnout - options may be used to disable IDN processing of input and output - domain names. - - * The configuration option max-ncache-ttl cannot exceed seven days. - Previously, larger values than this were silently lowered; now, they - trigger a configuration error. - - * The new dig -r command line option disables reading of the file $HOME - /.digrc. - - * Zone signing and key maintenance events are now logged to the dnssec - category rather than zone. + * The allow-update and allow-update-forwarding options were + inadvertently treated as configuration errors when used at the options + or view level. This has now been corrected. [GL #913] License diff --git a/doc/misc/options b/doc/misc/options index 5be0c3a722..c692ed2ec9 100644 --- a/doc/misc/options +++ b/doc/misc/options @@ -186,7 +186,7 @@ options { fstrm-set-output-queue-model ( mpsc | spsc ); // not configured fstrm-set-output-queue-size ; // not configured fstrm-set-reopen-interval ; // not configured - geoip-directory ( | none ); + geoip-directory ( | none ); // not configured geoip-use-ecs ; // obsolete glue-cache ; has-old-clients ; // ancient @@ -207,7 +207,7 @@ options { listen-on-v6 [ port ] [ dscp ] { ; ... }; // may occur multiple times - lmdb-mapsize ; + lmdb-mapsize ; // non-operational lock-file ( | none ); maintain-ixfr-base ; // ancient managed-keys-directory ; @@ -553,7 +553,7 @@ view [ ] { }; // may occur multiple times key-directory ; lame-ttl ; - lmdb-mapsize ; + lmdb-mapsize ; // non-operational maintain-ixfr-base ; // ancient managed-keys {