upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-05-27 12:13:20 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

Tweak and reword release notes

Browse source 
Two inconsequential bug fixes are not release note worthy.
Use more user-centric terminology about dnssec-policy manual-mode.
Add links, shorten notes.
This commit is contained in:
Petr Špaček 2025-09-04 08:26:57 +02:00
parent 8a542e3a37
commit 7177e4bc3f
1 changed files with 18 additions and 27 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

45
doc/notes/notes-9.20.13.rst
View file

@ -15,21 +15,20 @@ Notes for BIND 9.20.13
New Features
~~~~~~~~~~~~
- Add manual mode configuration option to dnsec-policy.
- Add a new option ``manual-mode`` to :any:`dnssec-policy`.
Add a new option ``manual-mode`` to :any:`dnssec-policy`. The intended
use is that if it is enabled, it will not automatically move to the
next state transition, but instead the transition is logged. Only
after manual confirmation with ``rndc dnssec -step`` the transition is
made. :gl:`#4606`
When enabled, :iscman:`named` will not modify DNSSEC keys or key states
automatically. The proposed change will be logged and only after manual
confirmation with ``rndc dnssec -step`` will the modification be made.
:gl:`#4606`
- Add a new 'servfail-until-ready' configuration option for RPZ.
- Add a new option ``servfail-until-ready`` to :namedconf:ref:`response-policy`
zones.
By default, when :iscman:`named` is started it may start answering to
queries before the response policy zones are completely loaded and
processed. This new feature gives an option to the users to tell
:iscman:`named` that incoming requests should result in SERVFAIL
answer until all the response policy zones are processed and ready.
By default, when :iscman:`named` is started, it starts answering
queries before all response policy zones are completely loaded and
processed. This new option instructs :iscman:`named` to respond with
SERVFAIL until all the response policy zones are processed and ready.
Note that if one or more response policy zones fail to load,
:iscman:`named` starts responding to queries according to those zones
that did load.
@ -44,7 +43,7 @@ New Features
Removed Features
~~~~~~~~~~~~~~~~
- Deprecate the "tkey-gssapi-credential" statement.
- Deprecate the :namedconf:ref:`tkey-gssapi-credential` statement.
The :any:`tkey-gssapi-keytab` statement allows GSS-TSIG to be set up
in a simpler and more reliable way than using the
@ -61,7 +60,7 @@ Removed Features
- Obsolete the "tkey-domain" statement.
Mark the ``tkey-domain`` statement as obsolete, since it has not had
Mark the ``tkey-domain`` statement as obsolete because it has not had
any effect on server behavior since support for TKEY Mode 2
(Diffie-Hellman) was removed (in BIND 9.20.0). :gl:`#4204`
@ -71,21 +70,13 @@ Bug Fixes
- Prevent spurious SERVFAILs for certain 0-TTL resource records.
Under certain circumstances, BIND 9 can return SERVFAIL when updating
existing entries in the cache with new NS, A, AAAA, or DS records with
0-TTL. :gl:`#5294`
existing entries in the cache with new NS, A, AAAA, or DS records that have a
TTL of zero. :gl:`#5294`
- RPZ canonical warning displays zone entry incorrectly.
- Fix unexpected termination if :namedconf:ref:`catalog-zones` had undefined
``default-primaries``.
When an IPv6 rpz prefix entry is entered incorrectly the log message
was just displaying the prefix rather than the full entry. This has
been corrected. :gl:`#5491`
- Fix a catalog zone issue when having an unset 'default-primaries'
configuration clause.
A catalog zone with an unset ``default-primaries`` clause could cause
an unexpected termination of the :iscman:`named` process after two
reloading or reconfiguration commands. This has been fixed.
The issue manifested only if the server was reloaded or reconfigured twice.
:gl:`#5494`