upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-06-13 14:39:59 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

[v9_9] clean up relnotes to include only things added since 9.9.8

Browse source
This commit is contained in:
Evan Hunt 2016-01-04 16:05:44 -08:00
parent 9afd579edd
commit 7128c44787
1 changed files with 5 additions and 186 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

191
doc/arm/notes.xml
View file

@ -56,44 +56,6 @@
lookup. This flaw is disclosed in CVE-2015-8461. [RT#40945]
</para>
</listitem>
<listitem>
<para>
An incorrect boundary check in the OPENPGPKEY rdatatype
could trigger an assertion failure. This flaw is disclosed
in CVE-2015-5986. [RT #40286]
</para>
</listitem>
<listitem>
<para>
A buffer accounting error could trigger an assertion failure
when parsing certain malformed DNSSEC keys.
</para>
<para>
This flaw was discovered by Hanno B&ouml;ck of the Fuzzing
Project, and is disclosed in CVE-2015-5722. [RT #40212]
</para>
</listitem>
<listitem>
<para>
A specially crafted query could trigger an assertion failure
in message.c.
</para>
<para>
This flaw was discovered by Jonathan Foote, and is disclosed
in CVE-2015-5477. [RT #40046]
</para>
</listitem>
<listitem>
<para>
On servers configured to perform DNSSEC validation, an
assertion failure could be triggered on answers from
a specially configured server.
</para>
<para>
This flaw was discovered by Breno Silveira Soares, and is
disclosed in CVE-2015-4620. [RT #39795]
</para>
</listitem>
<listitem>
<para>
Specific APL data could trigger an INSIST. This flaw
@ -106,68 +68,12 @@
<section xml:id="relnotes_features"><info><title>New Features</title></info>
<itemizedlist>
<listitem>
<para>
New quotas have been added to limit the queries that are
sent by recursive resolvers to authoritative servers
experiencing denial-of-service attacks. When configured,
these options can both reduce the harm done to authoritative
servers and also avoid the resource exhaustion that can be
experienced by recursives when they are being used as a
vehicle for such an attack.
</para>
<para>
NOTE: These options are not available by default; use
<command>configure --enable-fetchlimit</command> to include
them in the build.
</para>
<itemizedlist>
<listitem>
<para>
<option>fetches-per-server</option> limits the number of
simultaneous queries that can be sent to any single
authoritative server. The configured value is a starting
point; it is automatically adjusted downward if the server is
partially or completely non-responsive. The algorithm used to
adjust the quota can be configured via the
<option>fetch-quota-params</option> option.
</para>
</listitem>
<listitem>
<para>
<option>fetches-per-zone</option> limits the number of
simultaneous queries that can be sent for names within a
single domain. (Note: Unlike "fetches-per-server", this
value is not self-tuning.)
</para>
</listitem>
</itemizedlist>
<para>
Statistics counters have also been added to track the number
of queries affected by these quotas.
</para>
</listitem>
<listitem>
<para>
An <command>--enable-querytrace</command> configure switch is
now available to enable very verbose query tracelogging. This
option can only be set at compile time. This option has a
negative performance impact and should be used only for
debugging. [RT #37520]
</para>
</listitem>
<listitem>
<para>
The following types have been implemented: CSYNC, NINFO, RKEY,
SINK, TA, TALINK.
</para>
</listitem>
<listitem>
<para>
EDNS COOKIE options content is now displayed as
"COOKIE: &lt;hexvalue&gt;".
</para>
</listitem>
</para>
</listitem>
</itemizedlist>
</section>
<section xml:id="relnotes_changes"><info><title>Feature Changes</title></info>
@ -178,40 +84,10 @@
Updated the compiled in addresses for H.ROOT-SERVERS.NET.
</para>
</listitem>
<listitem>
<para>
Large inline-signing changes should be less disruptive.
Signature generation is now done incrementally; the number
of signatures to be generated in each quantum is controlled
by "sig-signing-signatures <replaceable>number</replaceable>;".
[RT #37927]
</para>
</listitem>
<listitem>
<para>
Retrieving the local port range from net.ipv4.ip_local_port_range
on Linux is now supported.
</para>
</listitem>
<listitem>
<para>
Active Directory names of the form gc._msdcs.&lt;forest&gt; are
now accepted as valid hostnames when using the
<option>check-names</option> option. &lt;forest&gt; is still
restricted to letters, digits and hyphens.
</para>
</listitem>
<listitem>
<para>
Names containing rich text are now accepted as valid
hostnames in PTR records in DNS-SD reverse lookup zones,
as specified in RFC 6763. [RT #37889]
</para>
</listitem>
<listitem>
<para>
The default preferred glue is now the address type of the
transport the query was received over.
transport the query was received over.
</para>
</listitem>
<listitem>
@ -229,71 +105,14 @@
</listitem>
</itemizedlist>
</section>
<section xml:id="relnotes_port"><info><title>Porting Changes</title></info>
<itemizedlist>
<listitem>
<para>
The Microsoft Windows install tool
<command>BINDInstall.exe</command> which requires a
non-free version of Visual Studio to be built, now uses two
files (lists of flags and files) created by the Configure
perl script with all the needed information which were
previously compiled in the binary. Read
<filename>win32utils/build.txt</filename> for more details.
[RT #38915]
</para>
</listitem>
</itemizedlist>
</section>
<section xml:id="relnotes_bugs"><info><title>Bug Fixes</title></info>
<itemizedlist>
<listitem>
<para>
Asynchronous zone loads were not handled correctly when the
zone load was already in progress; this could trigger a crash
in zt.c. [RT #37573]
<para>
None.
</para>
</listitem>
<listitem>
<para>
A race during shutdown or reconfiguration could
cause an assertion failure in mem.c. [RT #38979]
</para>
</listitem>
<listitem>
<para>
Some answer formatting options didn't work correctly with
<command>dig +short</command>. [RT #39291]
</para>
</listitem>
<listitem>
<para>
Malformed records of some types, including NSAP and UNSPEC,
could trigger assertion failures when loading text zone files.
[RT #40274] [RT #40285]
</para>
</listitem>
<listitem>
<para>
Fixed a possible crash in ratelimiter.c caused by NOTIFY
messages being removed from the wrong rate limiter queue.
[RT #40350]
</para>
</listitem>
<listitem>
<para>
The default <option>rrset-order</option> of <literal>random</literal>
was inconsistently applied. [RT #40456]
</para>
</listitem>
<listitem>
<para>
BADVERS responses from broken authoritative name servers were
not handled correctly. [RT #40427]
</para>
</listitem>
</itemizedlist>
</section>
<section xml:id="end_of_life"><info><title>End of Life</title></info>