mirror of
https://github.com/isc-projects/bind9.git
synced 2026-06-09 07:52:15 -04:00
Rebuild output files
This commit is contained in:
Michał Kępień
parent
dfc312ac56
commit
8729c56cd8
3 changed files with 649 additions and 433 deletions
|
|
@ -79,362 +79,517 @@
|
|||
<a name="relnotes_download"></a>Download</h3></div></div></div>
|
||||
<p>
|
||||
The latest versions of BIND 9 software can always be found at
|
||||
<a class="link" href="http://www.isc.org/downloads/" target="_top">http://www.isc.org/downloads/</a>.
|
||||
<a class="link" href="https://www.isc.org/download/" target="_top">https://www.isc.org/download/</a>.
|
||||
There you will find additional information about each release,
|
||||
source code, and pre-compiled versions for Microsoft Windows
|
||||
operating systems.
|
||||
</p>
|
||||
</div>
|
||||
|
||||
<div class="section">
|
||||
<div class="titlepage"><div><div><h3 class="title">
|
||||
<a name="relnotes_security"></a>Security Fixes</h3></div></div></div>
|
||||
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
|
||||
<a name="relnotes-9.15.6"></a>Notes for BIND 9.15.6</h3></div></div></div>
|
||||
|
||||
<div class="section">
|
||||
<div class="titlepage"><div><div><h4 class="title">
|
||||
<a name="relnotes-9.15.6-new"></a>New Features</h4></div></div></div>
|
||||
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
|
||||
<li class="listitem">
|
||||
<p>
|
||||
The TCP client quota set using the <span class="command"><strong>tcp-clients</strong></span>
|
||||
option could be exceeded in some cases. This could lead to
|
||||
exhaustion of file descriptors. This flaw is disclosed in
|
||||
CVE-2018-5743. [GL #615]
|
||||
</p>
|
||||
</li>
|
||||
<p>
|
||||
A new asynchronous network communications system based on
|
||||
<span class="command"><strong>libuv</strong></span> is now used by <span class="command"><strong>named</strong></span>
|
||||
for listening for incoming requests and responding to them.
|
||||
This change will make it easier to improve performance and
|
||||
implement new protocol layers (for example, DNS over TLS) in
|
||||
the future. [GL #29]
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
In certain configurations, <span class="command"><strong>named</strong></span> could crash
|
||||
with an assertion failure if <span class="command"><strong>nxdomain-redirect</strong></span>
|
||||
was in use and a redirected query resulted in an NXDOMAIN from the
|
||||
cache. This flaw is disclosed in CVE-2019-6467. [GL #880]
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
A race condition could trigger an assertion failure when
|
||||
a large number of incoming packets were being rejected.
|
||||
This flaw is disclosed in CVE-2019-6471. [GL #942]
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
<span class="command"><strong>named</strong></span> could crash with an assertion failure
|
||||
if a forwarder returned a referral, rather than resolving the
|
||||
query, when QNAME minimization was enabled. This flaw is
|
||||
disclosed in CVE-2019-6476. [GL #1051]
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
A flaw in DNSSEC verification when transferring mirror zones
|
||||
could allow data to be incorrectly marked valid. This flaw
|
||||
is disclosed in CVE-2019-6475. [GL #1252]
|
||||
</p>
|
||||
</li>
|
||||
<p>
|
||||
The new <span class="command"><strong>dnssec-policy</strong></span> option allows the
|
||||
configuration key and signing policy (KASP) for zones. This
|
||||
option enables <span class="command"><strong>named</strong></span> to generate new keys
|
||||
as needed and automatically roll both ZSK and KSK keys.
|
||||
(Note that the syntax for this statement differs from the DNSSEC
|
||||
policy used by <span class="command"><strong>dnssec-keymgr</strong></span>.) [GL #1134]
|
||||
</p>
|
||||
</li>
|
||||
</ul></div>
|
||||
</div>
|
||||
|
||||
<div class="section">
|
||||
<div class="titlepage"><div><div><h4 class="title">
|
||||
<a name="relnotes-9.15.6-changes"></a>Feature Changes</h4></div></div></div>
|
||||
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
|
||||
<p>
|
||||
NSEC Aggressive Cache (synth-from-dnssec) has been disabled by default
|
||||
because it was found to have a significant performance impact on the
|
||||
recursive service. The NSEC Aggressive Cache will be enable by default
|
||||
in the future releases. [GL #1265]
|
||||
</p>
|
||||
</li></ul></div>
|
||||
</div>
|
||||
|
||||
</div>
|
||||
<div class="section">
|
||||
<div class="titlepage"><div><div><h3 class="title">
|
||||
<a name="relnotes_features"></a>New Features</h3></div></div></div>
|
||||
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
|
||||
<a name="relnotes-9.15.5"></a>Notes for BIND 9.15.5</h3></div></div></div>
|
||||
|
||||
<div class="section">
|
||||
<div class="titlepage"><div><div><h4 class="title">
|
||||
<a name="relnotes-9.15.5-security"></a>Security Fixes</h4></div></div></div>
|
||||
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
|
||||
<li class="listitem">
|
||||
<p>
|
||||
Added a new command line option to <span class="command"><strong>dig</strong></span>:
|
||||
<span class="command"><strong>+[no]unexpected</strong></span>. By default, <span class="command"><strong>dig</strong></span>
|
||||
won't accept a reply from a source other than the one to which
|
||||
it sent the query. Add the <span class="command"><strong>+unexpected</strong></span> argument
|
||||
to enable it to process replies from unexpected sources.
|
||||
</p>
|
||||
</li>
|
||||
<p>
|
||||
<span class="command"><strong>named</strong></span> could crash with an assertion failure
|
||||
if a forwarder returned a referral, rather than resolving the
|
||||
query, when QNAME minimization was enabled. This flaw is
|
||||
disclosed in CVE-2019-6476. [GL #1051]
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
The GeoIP2 API from MaxMind is now supported. Geolocation support
|
||||
will be compiled in by default if the <span class="command"><strong>libmaxminddb</strong></span>
|
||||
library is found at compile time, but can be turned off by using
|
||||
<span class="command"><strong>configure --disable-geoip</strong></span>.
|
||||
</p>
|
||||
<p>
|
||||
The default path to the GeoIP2 databases will be set based
|
||||
on the location of the <span class="command"><strong>libmaxminddb</strong></span> library;
|
||||
for example, if it is in <code class="filename">/usr/local/lib</code>,
|
||||
then the default path will be
|
||||
<code class="filename">/usr/local/share/GeoIP</code>.
|
||||
This value can be overridden in <code class="filename">named.conf</code>
|
||||
using the <span class="command"><strong>geoip-directory</strong></span> option.
|
||||
</p>
|
||||
<p>
|
||||
Some <span class="command"><strong>geoip</strong></span> ACL settings that were available with
|
||||
legacy GeoIP, including searches for <span class="command"><strong>netspeed</strong></span>,
|
||||
<span class="command"><strong>org</strong></span>, and three-letter ISO country codes, will
|
||||
no longer work when using GeoIP2. Supported GeoIP2 database
|
||||
types are <span class="command"><strong>country</strong></span>, <span class="command"><strong>city</strong></span>,
|
||||
<span class="command"><strong>domain</strong></span>, <span class="command"><strong>isp</strong></span>, and
|
||||
<span class="command"><strong>as</strong></span>. All of these databases support both IPv4
|
||||
and IPv6 lookups. [GL #182] [GL #1112]
|
||||
</p>
|
||||
</li>
|
||||
<p>
|
||||
A flaw in DNSSEC verification when transferring mirror zones
|
||||
could allow data to be incorrectly marked valid. This flaw
|
||||
is disclosed in CVE-2019-6475. [GL #1252]
|
||||
</p>
|
||||
</li>
|
||||
</ul></div>
|
||||
</div>
|
||||
|
||||
</div>
|
||||
<div class="section">
|
||||
<div class="titlepage"><div><div><h3 class="title">
|
||||
<a name="relnotes-9.15.4"></a>Notes for BIND 9.15.4</h3></div></div></div>
|
||||
|
||||
<div class="section">
|
||||
<div class="titlepage"><div><div><h4 class="title">
|
||||
<a name="relnotes-9.15.4-new"></a>New Features</h4></div></div></div>
|
||||
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
|
||||
<li class="listitem">
|
||||
<p>
|
||||
In order to clarify the configuration of DNSSEC keys,
|
||||
the <span class="command"><strong>trusted-keys</strong></span> and
|
||||
<span class="command"><strong>managed-keys</strong></span> statements have been
|
||||
deprecated, and the new <span class="command"><strong>dnssec-keys</strong></span>
|
||||
statement should now be used for both types of key.
|
||||
</p>
|
||||
<p>
|
||||
When used with the keyword <span class="command"><strong>initial-key</strong></span>,
|
||||
<span class="command"><strong>dnssec-keys</strong></span> has the same behavior as
|
||||
<span class="command"><strong>managed-keys</strong></span>, i.e., it configures
|
||||
a trust anchor that is to be maintained via RFC 5011.
|
||||
</p>
|
||||
<p>
|
||||
When used with the new keyword <span class="command"><strong>static-key</strong></span>, it
|
||||
has the same behavior as <span class="command"><strong>trusted-keys</strong></span>,
|
||||
configuring a permanent trust anchor that will not automatically
|
||||
be updated. (This usage is not recommended for the root key.)
|
||||
[GL #6]
|
||||
</p>
|
||||
</li>
|
||||
<p>
|
||||
Added a new command line option to <span class="command"><strong>dig</strong></span>:
|
||||
<span class="command"><strong>+[no]unexpected</strong></span>. By default, <span class="command"><strong>dig</strong></span>
|
||||
won't accept a reply from a source other than the one to which
|
||||
it sent the query. Add the <span class="command"><strong>+unexpected</strong></span> argument
|
||||
to enable it to process replies from unexpected sources.
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
The new <span class="command"><strong>add-soa</strong></span> option specifies whether
|
||||
or not the <span class="command"><strong>response-policy</strong></span> zone's SOA record
|
||||
should be included in the additional section of RPZ responses.
|
||||
[GL #865]
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
Two new metrics have been added to the
|
||||
<span class="command"><strong>statistics-channel</strong></span> to report DNSSEC
|
||||
signing operations. For each key in each zone, the
|
||||
<span class="command"><strong>dnssec-sign</strong></span> counter indicates the total
|
||||
number of signatures <span class="command"><strong>named</strong></span> has generated
|
||||
using that key since server startup, and the
|
||||
<span class="command"><strong>dnssec-refresh</strong></span> counter indicates how
|
||||
many of those signatures were refreshed during zone
|
||||
maintenance, as opposed to having been generated
|
||||
as a result of a zone update. [GL #513]
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
<p>
|
||||
<span class="command"><strong>dig</strong></span>, <span class="command"><strong>mdig</strong></span> and
|
||||
<span class="command"><strong>delv</strong></span> can all now take a <span class="command"><strong>+yaml</strong></span>
|
||||
option to print output in a a detailed YAML format. [RT #1145]
|
||||
</p>
|
||||
</li>
|
||||
</ul></div>
|
||||
</div>
|
||||
|
||||
<div class="section">
|
||||
<div class="titlepage"><div><div><h4 class="title">
|
||||
<a name="relnotes-9.15.4-bugs"></a>Bug Fixes</h4></div></div></div>
|
||||
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
|
||||
<p>
|
||||
When a <span class="command"><strong>response-policy</strong></span> zone expires, ensure
|
||||
that its policies are removed from the RPZ summary database.
|
||||
[GL #1146]
|
||||
</p>
|
||||
</li></ul></div>
|
||||
</div>
|
||||
|
||||
</div>
|
||||
<div class="section">
|
||||
<div class="titlepage"><div><div><h3 class="title">
|
||||
<a name="relnotes-9.15.3"></a>Notes for BIND 9.15.3</h3></div></div></div>
|
||||
|
||||
<div class="section">
|
||||
<div class="titlepage"><div><div><h4 class="title">
|
||||
<a name="relnotes-9.15.3-new"></a>New Features</h4></div></div></div>
|
||||
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
|
||||
<p>
|
||||
Statistics channel groups are now toggleable. [GL #1030]
|
||||
</p>
|
||||
</li>
|
||||
</p>
|
||||
</li></ul></div>
|
||||
</div>
|
||||
|
||||
<div class="section">
|
||||
<div class="titlepage"><div><div><h4 class="title">
|
||||
<a name="relnotes-9.15.3-removed"></a>Removed Features</h4></div></div></div>
|
||||
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
|
||||
<p>
|
||||
DNSSEC Lookaside Validation (DLV) is now obsolete.
|
||||
The <span class="command"><strong>dnssec-lookaside</strong></span> option has been
|
||||
marked as deprecated; when used in <code class="filename">named.conf</code>,
|
||||
it will generate a warning but will otherwise be ignored.
|
||||
All code enabling the use of lookaside validation has been removed
|
||||
from the validator, <span class="command"><strong>delv</strong></span>, and the DNSSEC tools.
|
||||
[GL #7]
|
||||
</p>
|
||||
</li></ul></div>
|
||||
</div>
|
||||
|
||||
<div class="section">
|
||||
<div class="titlepage"><div><div><h4 class="title">
|
||||
<a name="relnotes-9.15.3-changes"></a>Feature Changes</h4></div></div></div>
|
||||
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
|
||||
<li class="listitem">
|
||||
<p>
|
||||
<span class="command"><strong>dig</strong></span>, <span class="command"><strong>mdig</strong></span> and
|
||||
<span class="command"><strong>delv</strong></span> can all now take a <span class="command"><strong>+yaml</strong></span>
|
||||
option to print output in a a detailed YAML format. [RT #1145]
|
||||
</p>
|
||||
</li>
|
||||
<p>
|
||||
A SipHash 2-4 based DNS Cookie (RFC 7873) algorithm has been added and
|
||||
made default. Old non-default HMAC-SHA based DNS Cookie algorithms
|
||||
have been removed, and only the default AES algorithm is being kept
|
||||
for legacy reasons. This change doesn't have any operational impact
|
||||
in most common scenarios. [GL #605]
|
||||
</p>
|
||||
<p>
|
||||
If you are running multiple DNS Servers (different versions of BIND 9
|
||||
or DNS server from multiple vendors) responding from the same IP
|
||||
address (anycast or load-balancing scenarios), you'll have to make
|
||||
sure that all the servers are configured with the same DNS Cookie
|
||||
algorithm and same Server Secret for the best performance.
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
The information from the <span class="command"><strong>dnssec-signzone</strong></span> and
|
||||
<span class="command"><strong>dnssec-verify</strong></span> commands is now printed to standard
|
||||
output. The standard error output is only used to print warnings and
|
||||
errors, and in case the user requests the signed zone to be printed to
|
||||
standard output with <span class="command"><strong>-f -</strong></span> option. A new
|
||||
configuration option <span class="command"><strong>-q</strong></span> has been added to silence
|
||||
all output on standard output except for the name of the signed zone.
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
DS records included in DNS referral messages can now be validated
|
||||
and cached immediately, reducing the number of queries needed for
|
||||
a DNSSEC validation. [GL #964]
|
||||
</p>
|
||||
</li>
|
||||
</ul></div>
|
||||
</div>
|
||||
|
||||
<div class="section">
|
||||
<div class="titlepage"><div><div><h4 class="title">
|
||||
<a name="relnotes-9.15.3-bugs"></a>Bug Fixes</h4></div></div></div>
|
||||
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
|
||||
<li class="listitem">
|
||||
<p>
|
||||
Cache database statistics counters could report invalid values
|
||||
when stale answers were enabled, because of a bug in counter
|
||||
maintenance when cache data becomes stale. The statistics counters
|
||||
have been corrected to report the number of RRsets for each
|
||||
RR type that are active, stale but still potentially served,
|
||||
or stale and marked for deletion. [GL #602]
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
Interaction between DNS64 and RPZ No Data rule (CNAME *.) could
|
||||
cause unexpected results; this has been fixed. [GL #1106]
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
<span class="command"><strong>named-checkconf</strong></span> now checks DNS64 prefixes
|
||||
to ensure bits 64-71 are zero. [GL #1159]
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
<span class="command"><strong>named-checkconf</strong></span> now correctly reports a missing
|
||||
<span class="command"><strong>dnstap-output</strong></span> option when
|
||||
<span class="command"><strong>dnstap</strong></span> is set. [GL #1136]
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
Handle ETIMEDOUT error on connect() with a non-blocking
|
||||
socket. [GL #1133]
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
<span class="command"><strong>dig</strong></span> now correctly expands the IPv6 address
|
||||
when run with <span class="command"><strong>+expandaaaa +short</strong></span>. [GL #1152]
|
||||
</p>
|
||||
</li>
|
||||
</ul></div>
|
||||
</div>
|
||||
|
||||
</div>
|
||||
<div class="section">
|
||||
<div class="titlepage"><div><div><h3 class="title">
|
||||
<a name="relnotes_removed"></a>Removed Features</h3></div></div></div>
|
||||
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
|
||||
<a name="relnotes-9.15.2"></a>Notes for BIND 9.15.2</h3></div></div></div>
|
||||
|
||||
<div class="section">
|
||||
<div class="titlepage"><div><div><h4 class="title">
|
||||
<a name="relnotes-9.15.2-new"></a>New Features</h4></div></div></div>
|
||||
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
|
||||
<li class="listitem">
|
||||
<p>
|
||||
The <span class="command"><strong>dnssec-enable</strong></span> option has been obsoleted and
|
||||
no longer has any effect. DNSSEC responses are always enabled
|
||||
if signatures and other DNSSEC data are present. [GL #866]
|
||||
</p>
|
||||
</li>
|
||||
<p>
|
||||
The GeoIP2 API from MaxMind is now supported. Geolocation support
|
||||
will be compiled in by default if the <span class="command"><strong>libmaxminddb</strong></span>
|
||||
library is found at compile time, but can be turned off by using
|
||||
<span class="command"><strong>configure --disable-geoip</strong></span>.
|
||||
</p>
|
||||
<p>
|
||||
The default path to the GeoIP2 databases will be set based
|
||||
on the location of the <span class="command"><strong>libmaxminddb</strong></span> library;
|
||||
for example, if it is in <code class="filename">/usr/local/lib</code>,
|
||||
then the default path will be
|
||||
<code class="filename">/usr/local/share/GeoIP</code>.
|
||||
This value can be overridden in <code class="filename">named.conf</code>
|
||||
using the <span class="command"><strong>geoip-directory</strong></span> option.
|
||||
</p>
|
||||
<p>
|
||||
Some <span class="command"><strong>geoip</strong></span> ACL settings that were available with
|
||||
legacy GeoIP, including searches for <span class="command"><strong>netspeed</strong></span>,
|
||||
<span class="command"><strong>org</strong></span>, and three-letter ISO country codes, will
|
||||
no longer work when using GeoIP2. Supported GeoIP2 database
|
||||
types are <span class="command"><strong>country</strong></span>, <span class="command"><strong>city</strong></span>,
|
||||
<span class="command"><strong>domain</strong></span>, <span class="command"><strong>isp</strong></span>, and
|
||||
<span class="command"><strong>as</strong></span>. All of these databases support both IPv4
|
||||
and IPv6 lookups. [GL #182] [GL #1112]
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
The <span class="command"><strong>cleaning-interval</strong></span> option has been
|
||||
removed. [GL !1731]
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
DNSSEC Lookaside Validation (DLV) is now obsolete.
|
||||
The <span class="command"><strong>dnssec-lookaside</strong></span> option has been
|
||||
marked as deprecated; when used in <code class="filename">named.conf</code>,
|
||||
it will generate a warning but will otherwise be ignored.
|
||||
All code enabling the use of lookaside validation has been removed
|
||||
from the validator, <span class="command"><strong>delv</strong></span>, and the DNSSEC tools.
|
||||
[GL #7]
|
||||
</p>
|
||||
</li>
|
||||
<p>
|
||||
Two new metrics have been added to the
|
||||
<span class="command"><strong>statistics-channel</strong></span> to report DNSSEC
|
||||
signing operations. For each key in each zone, the
|
||||
<span class="command"><strong>dnssec-sign</strong></span> counter indicates the total
|
||||
number of signatures <span class="command"><strong>named</strong></span> has generated
|
||||
using that key since server startup, and the
|
||||
<span class="command"><strong>dnssec-refresh</strong></span> counter indicates how
|
||||
many of those signatures were refreshed during zone
|
||||
maintenance, as opposed to having been generated
|
||||
as a result of a zone update. [GL #513]
|
||||
</p>
|
||||
</li>
|
||||
</ul></div>
|
||||
</div>
|
||||
|
||||
<div class="section">
|
||||
<div class="titlepage"><div><div><h4 class="title">
|
||||
<a name="relnotes-9.15.2-bugs"></a>Bug Fixes</h4></div></div></div>
|
||||
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
|
||||
<li class="listitem">
|
||||
<p>
|
||||
When <span class="command"><strong>qname-minimization</strong></span> was set to
|
||||
<span class="command"><strong>relaxed</strong></span>, some improperly configured domains
|
||||
would fail to resolve, but would have succeeded when minimization
|
||||
was disabled. <span class="command"><strong>named</strong></span> will now fall back to normal
|
||||
resolution in such cases, and also uses type A rather than NS for
|
||||
minimal queries in order to reduce the likelihood of encountering
|
||||
the problem. [GL #1055]
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
<span class="command"><strong>./configure</strong></span> no longer sets
|
||||
<span class="command"><strong>--sysconfdir</strong></span> to <span class="command"><strong>/etc</strong></span> or
|
||||
<span class="command"><strong>--localstatedir</strong></span> to <span class="command"><strong>/var</strong></span>
|
||||
when <span class="command"><strong>--prefix</strong></span> is not specified and the
|
||||
aforementioned options are not specified explicitly. Instead,
|
||||
Autoconf's defaults of <span class="command"><strong>$prefix/etc</strong></span> and
|
||||
<span class="command"><strong>$prefix/var</strong></span> are respected.
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
Glue address records were not being returned in responses
|
||||
to root priming queries; this has been corrected. [GL #1092]
|
||||
</p>
|
||||
</li>
|
||||
</ul></div>
|
||||
</div>
|
||||
|
||||
</div>
|
||||
<div class="section">
|
||||
<div class="titlepage"><div><div><h3 class="title">
|
||||
<a name="relnotes_changes"></a>Feature Changes</h3></div></div></div>
|
||||
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
|
||||
<a name="relnotes-9.15.1"></a>Notes for BIND 9.15.1</h3></div></div></div>
|
||||
|
||||
<div class="section">
|
||||
<div class="titlepage"><div><div><h4 class="title">
|
||||
<a name="relnotes-9.15.1-security"></a>Security Fixes</h4></div></div></div>
|
||||
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
|
||||
<p>
|
||||
A race condition could trigger an assertion failure when
|
||||
a large number of incoming packets were being rejected.
|
||||
This flaw is disclosed in CVE-2019-6471. [GL #942]
|
||||
</p>
|
||||
</li></ul></div>
|
||||
</div>
|
||||
|
||||
<div class="section">
|
||||
<div class="titlepage"><div><div><h4 class="title">
|
||||
<a name="relnotes-9.15.1-new"></a>New Features</h4></div></div></div>
|
||||
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
|
||||
<p>
|
||||
In order to clarify the configuration of DNSSEC keys,
|
||||
the <span class="command"><strong>trusted-keys</strong></span> and
|
||||
<span class="command"><strong>managed-keys</strong></span> statements have been
|
||||
deprecated, and the new <span class="command"><strong>dnssec-keys</strong></span>
|
||||
statement should now be used for both types of key.
|
||||
</p>
|
||||
<p>
|
||||
When used with the keyword <span class="command"><strong>initial-key</strong></span>,
|
||||
<span class="command"><strong>dnssec-keys</strong></span> has the same behavior as
|
||||
<span class="command"><strong>managed-keys</strong></span>, i.e., it configures
|
||||
a trust anchor that is to be maintained via RFC 5011.
|
||||
</p>
|
||||
<p>
|
||||
When used with the new keyword <span class="command"><strong>static-key</strong></span>, it
|
||||
has the same behavior as <span class="command"><strong>trusted-keys</strong></span>,
|
||||
configuring a permanent trust anchor that will not automatically
|
||||
be updated. (This usage is not recommended for the root key.)
|
||||
[GL #6]
|
||||
</p>
|
||||
</li></ul></div>
|
||||
</div>
|
||||
|
||||
<div class="section">
|
||||
<div class="titlepage"><div><div><h4 class="title">
|
||||
<a name="relnotes-9.15.1-removed"></a>Removed Features</h4></div></div></div>
|
||||
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
|
||||
<p>
|
||||
The <span class="command"><strong>cleaning-interval</strong></span> option has been
|
||||
removed. [GL !1731]
|
||||
</p>
|
||||
</li></ul></div>
|
||||
</div>
|
||||
|
||||
<div class="section">
|
||||
<div class="titlepage"><div><div><h4 class="title">
|
||||
<a name="relnotes-9.15.1-changes"></a>Feature Changes</h4></div></div></div>
|
||||
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
|
||||
<li class="listitem">
|
||||
<p>
|
||||
<span class="command"><strong>named</strong></span> will now log a warning if
|
||||
a static key is configured for the root zone. [GL #6]
|
||||
</p>
|
||||
</li>
|
||||
<p>
|
||||
<span class="command"><strong>named</strong></span> will now log a warning if
|
||||
a static key is configured for the root zone. [GL #6]
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
When static and managed DNSSEC keys were both configured for the
|
||||
same name, or when a static key was used to
|
||||
configure a trust anchor for the root zone and
|
||||
<span class="command"><strong>dnssec-validation</strong></span> was set to the default
|
||||
value of <code class="literal">auto</code>, automatic RFC 5011 key
|
||||
rollovers would be disabled. This combination of settings was
|
||||
never intended to work, but there was no check for it in the
|
||||
parser. This has been corrected, and it is now a fatal
|
||||
configuration error. [GL #868]
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
DS and CDS records are now generated with SHA-256 digests
|
||||
only, instead of both SHA-1 and SHA-256. This affects the
|
||||
default output of <span class="command"><strong>dnssec-dsfromkey</strong></span>, the
|
||||
<code class="filename">dsset</code> files generated by
|
||||
<span class="command"><strong>dnssec-signzone</strong></span>, the DS records added to
|
||||
a zone by <span class="command"><strong>dnssec-signzone</strong></span> based on
|
||||
<code class="filename">keyset</code> files, the CDS records added to
|
||||
a zone by <span class="command"><strong>named</strong></span> and
|
||||
<span class="command"><strong>dnssec-signzone</strong></span> based on "sync" timing
|
||||
parameters in key files, and the checks performed by
|
||||
<span class="command"><strong>dnssec-checkds</strong></span>.
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
JSON-C is now the only supported library for enabling JSON
|
||||
support for BIND statistics. The <span class="command"><strong>configure</strong></span>
|
||||
option has been renamed from <span class="command"><strong>--with-libjson</strong></span>
|
||||
to <span class="command"><strong>--with-json-c</strong></span>. Use
|
||||
<span class="command"><strong>PKG_CONFIG_PATH</strong></span> to specify a custom path to
|
||||
the <span class="command"><strong>json-c</strong></span> library as the new
|
||||
<span class="command"><strong>configure</strong></span> option does not take the library
|
||||
installation path as an optional argument.
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
A SipHash 2-4 based DNS Cookie (RFC 7873) algorithm has been added and
|
||||
made default. Old non-default HMAC-SHA based DNS Cookie algorithms
|
||||
have been removed, and only the default AES algorithm is being kept
|
||||
for legacy reasons. This change doesn't have any operational impact
|
||||
in most common scenarios. [GL #605]
|
||||
</p>
|
||||
<p>
|
||||
If you are running multiple DNS Servers (different versions of BIND 9
|
||||
or DNS server from multiple vendors) responding from the same IP
|
||||
address (anycast or load-balancing scenarios), you'll have to make
|
||||
sure that all the servers are configured with the same DNS Cookie
|
||||
algorithm and same Server Secret for the best performance.
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
The information from the <span class="command"><strong>dnssec-signzone</strong></span> and
|
||||
<span class="command"><strong>dnssec-verify</strong></span> commands is now printed to standard
|
||||
output. The standard error output is only used to print warnings and
|
||||
errors, and in case the user requests the signed zone to be printed to
|
||||
standard output with <span class="command"><strong>-f -</strong></span> option. A new
|
||||
configuration option <span class="command"><strong>-q</strong></span> has been added to silence
|
||||
all output on standard output except for the name of the signed zone.
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
DS records included in DNS referral messages can now be validated
|
||||
and cached immediately, reducing the number of queries needed for
|
||||
a DNSSEC validation. [GL #964]
|
||||
</p>
|
||||
</li>
|
||||
<p>
|
||||
JSON-C is now the only supported library for enabling JSON
|
||||
support for BIND statistics. The <span class="command"><strong>configure</strong></span>
|
||||
option has been renamed from <span class="command"><strong>--with-libjson</strong></span>
|
||||
to <span class="command"><strong>--with-json-c</strong></span>. Use
|
||||
<span class="command"><strong>PKG_CONFIG_PATH</strong></span> to specify a custom path to
|
||||
the <span class="command"><strong>json-c</strong></span> library as the new
|
||||
<span class="command"><strong>configure</strong></span> option does not take the library
|
||||
installation path as an optional argument.
|
||||
</p>
|
||||
</li>
|
||||
</ul></div>
|
||||
</div>
|
||||
|
||||
</div>
|
||||
<div class="section">
|
||||
<div class="titlepage"><div><div><h3 class="title">
|
||||
<a name="relnotes_bugs"></a>Bug Fixes</h3></div></div></div>
|
||||
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
|
||||
<a name="relnotes-9.15.0"></a>Notes for BIND 9.15.0</h3></div></div></div>
|
||||
|
||||
<div class="section">
|
||||
<div class="titlepage"><div><div><h4 class="title">
|
||||
<a name="relnotes-9.15.0-security"></a>Security Fixes</h4></div></div></div>
|
||||
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
|
||||
<li class="listitem">
|
||||
<p>
|
||||
The <span class="command"><strong>allow-update</strong></span> and
|
||||
<span class="command"><strong>allow-update-forwarding</strong></span> options were
|
||||
inadvertently treated as configuration errors when used at the
|
||||
<span class="command"><strong>options</strong></span> or <span class="command"><strong>view</strong></span> level.
|
||||
This has now been corrected.
|
||||
[GL #913]
|
||||
</p>
|
||||
</li>
|
||||
<p>
|
||||
In certain configurations, <span class="command"><strong>named</strong></span> could crash
|
||||
with an assertion failure if <span class="command"><strong>nxdomain-redirect</strong></span>
|
||||
was in use and a redirected query resulted in an NXDOMAIN from the
|
||||
cache. This flaw is disclosed in CVE-2019-6467. [GL #880]
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
When <span class="command"><strong>qname-minimization</strong></span> was set to
|
||||
<span class="command"><strong>relaxed</strong></span>, some improperly configured domains
|
||||
would fail to resolve, but would have succeeded when minimization
|
||||
was disabled. <span class="command"><strong>named</strong></span> will now fall back to normal
|
||||
resolution in such cases, and also uses type A rather than NS for
|
||||
minimal queries in order to reduce the likelihood of encountering
|
||||
the problem. [GL #1055]
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
<span class="command"><strong>./configure</strong></span> no longer sets
|
||||
<span class="command"><strong>--sysconfdir</strong></span> to <span class="command"><strong>/etc</strong></span> or
|
||||
<span class="command"><strong>--localstatedir</strong></span> to <span class="command"><strong>/var</strong></span>
|
||||
when <span class="command"><strong>--prefix</strong></span> is not specified and the
|
||||
aforementioned options are not specified explicitly. Instead,
|
||||
Autoconf's defaults of <span class="command"><strong>$prefix/etc</strong></span> and
|
||||
<span class="command"><strong>$prefix/var</strong></span> are respected.
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
Glue address records were not being returned in responses
|
||||
to root priming queries; this has been corrected. [GL #1092]
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
Interaction between DNS64 and RPZ No Data rule (CNAME *.) could
|
||||
cause unexpected results; this has been fixed. [GL #1106]
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
<span class="command"><strong>named-checkconf</strong></span> now checks DNS64 prefixes
|
||||
to ensure bits 64-71 are zero. [GL #1159]
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
<span class="command"><strong>named-checkconf</strong></span> now correctly reports a missing
|
||||
<span class="command"><strong>dnstap-output</strong></span> option when
|
||||
<span class="command"><strong>dnstap</strong></span> is set. [GL #1136]
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
Handle ETIMEDOUT error on connect() with a non-blocking
|
||||
socket. [GL #1133]
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
Cache database statistics counters could report invalid values
|
||||
when stale answers were enabled, because of a bug in counter
|
||||
maintenance when cache data becomes stale. The statistics counters
|
||||
have been corrected to report the number of RRsets for each
|
||||
RR type that are active, stale but still potentially served,
|
||||
or stale and marked for deletion. [GL #602]
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
<span class="command"><strong>dig</strong></span> now correctly expands the IPv6 address
|
||||
when run with <span class="command"><strong>+expandaaaa +short</strong></span>. [GL #1152]
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
When a <span class="command"><strong>response-policy</strong></span> zone expires, ensure
|
||||
that its policies are removed from the RPZ summary database.
|
||||
[GL #1146]
|
||||
</p>
|
||||
</li>
|
||||
<p>
|
||||
The TCP client quota set using the <span class="command"><strong>tcp-clients</strong></span>
|
||||
option could be exceeded in some cases. This could lead to
|
||||
exhaustion of file descriptors. This flaw is disclosed in
|
||||
CVE-2018-5743. [GL #615]
|
||||
</p>
|
||||
</li>
|
||||
</ul></div>
|
||||
</div>
|
||||
|
||||
<div class="section">
|
||||
<div class="titlepage"><div><div><h4 class="title">
|
||||
<a name="relnotes-9.15.0-new"></a>New Features</h4></div></div></div>
|
||||
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
|
||||
<p>
|
||||
The new <span class="command"><strong>add-soa</strong></span> option specifies whether
|
||||
or not the <span class="command"><strong>response-policy</strong></span> zone's SOA record
|
||||
should be included in the additional section of RPZ responses.
|
||||
[GL #865]
|
||||
</p>
|
||||
</li></ul></div>
|
||||
</div>
|
||||
|
||||
<div class="section">
|
||||
<div class="titlepage"><div><div><h4 class="title">
|
||||
<a name="relnotes-9.15.0-removed"></a>Removed Features</h4></div></div></div>
|
||||
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
|
||||
<p>
|
||||
The <span class="command"><strong>dnssec-enable</strong></span> option has been obsoleted and
|
||||
no longer has any effect. DNSSEC responses are always enabled
|
||||
if signatures and other DNSSEC data are present. [GL #866]
|
||||
</p>
|
||||
</li></ul></div>
|
||||
</div>
|
||||
|
||||
<div class="section">
|
||||
<div class="titlepage"><div><div><h4 class="title">
|
||||
<a name="relnotes-9.15.0-changes"></a>Feature Changes</h4></div></div></div>
|
||||
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
|
||||
<li class="listitem">
|
||||
<p>
|
||||
When static and managed DNSSEC keys were both configured for the
|
||||
same name, or when a static key was used to
|
||||
configure a trust anchor for the root zone and
|
||||
<span class="command"><strong>dnssec-validation</strong></span> was set to the default
|
||||
value of <code class="literal">auto</code>, automatic RFC 5011 key
|
||||
rollovers would be disabled. This combination of settings was
|
||||
never intended to work, but there was no check for it in the
|
||||
parser. This has been corrected, and it is now a fatal
|
||||
configuration error. [GL #868]
|
||||
</p>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
DS and CDS records are now generated with SHA-256 digests
|
||||
only, instead of both SHA-1 and SHA-256. This affects the
|
||||
default output of <span class="command"><strong>dnssec-dsfromkey</strong></span>, the
|
||||
<code class="filename">dsset</code> files generated by
|
||||
<span class="command"><strong>dnssec-signzone</strong></span>, the DS records added to
|
||||
a zone by <span class="command"><strong>dnssec-signzone</strong></span> based on
|
||||
<code class="filename">keyset</code> files, the CDS records added to
|
||||
a zone by <span class="command"><strong>named</strong></span> and
|
||||
<span class="command"><strong>dnssec-signzone</strong></span> based on "sync" timing
|
||||
parameters in key files, and the checks performed by
|
||||
<span class="command"><strong>dnssec-checkds</strong></span>.
|
||||
</p>
|
||||
</li>
|
||||
</ul></div>
|
||||
</div>
|
||||
|
||||
<div class="section">
|
||||
<div class="titlepage"><div><div><h4 class="title">
|
||||
<a name="relnotes-9.15.0-bugs"></a>Bug Fixes</h4></div></div></div>
|
||||
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
|
||||
<p>
|
||||
The <span class="command"><strong>allow-update</strong></span> and
|
||||
<span class="command"><strong>allow-update-forwarding</strong></span> options were
|
||||
inadvertently treated as configuration errors when used at the
|
||||
<span class="command"><strong>options</strong></span> or <span class="command"><strong>view</strong></span> level.
|
||||
This has now been corrected.
|
||||
[GL #913]
|
||||
</p>
|
||||
</li></ul></div>
|
||||
</div>
|
||||
|
||||
</div>
|
||||
|
||||
<div class="section">
|
||||
<div class="titlepage"><div><div><h3 class="title">
|
||||
<a name="relnotes_license"></a>License</h3></div></div></div>
|
||||
|
|
@ -471,7 +626,7 @@
|
|||
For those needing long term support, the current Extended Support
|
||||
Version (ESV) is BIND 9.11, which will be supported until at
|
||||
least December 2021. See
|
||||
<a class="link" href="https://www.isc.org/downloads/software-support-policy/" target="_top">https://www.isc.org/downloads/software-support-policy/</a>
|
||||
<a class="link" href="https://kb.isc.org/docs/aa-00896" target="_top">https://kb.isc.org/docs/aa-00896</a>
|
||||
for details of ISC's software support policy.
|
||||
</p>
|
||||
</div>
|
||||
|
|
@ -482,7 +637,7 @@
|
|||
Thank you to everyone who assisted us in making this release possible.
|
||||
If you would like to contribute to ISC to assist us in continuing to
|
||||
make quality open source software, please visit our donations page at
|
||||
<a class="link" href="http://www.isc.org/donate/" target="_top">http://www.isc.org/donate/</a>.
|
||||
<a class="link" href="https://www.isc.org/donate/" target="_top">https://www.isc.org/donate/</a>.
|
||||
</p>
|
||||
</div>
|
||||
</div>
|
||||
|
|
|
|||
Binary file not shown.
|
|
@ -43,26 +43,38 @@ support for systems that are still supported by their respective vendors.
|
|||
|
||||
Download
|
||||
|
||||
The latest versions of BIND 9 software can always be found at http://
|
||||
www.isc.org/downloads/. There you will find additional information about
|
||||
The latest versions of BIND 9 software can always be found at https://
|
||||
www.isc.org/download/. There you will find additional information about
|
||||
each release, source code, and pre-compiled versions for Microsoft Windows
|
||||
operating systems.
|
||||
|
||||
Notes for BIND 9.15.6
|
||||
|
||||
New Features
|
||||
|
||||
* A new asynchronous network communications system based on libuv is now
|
||||
used by named for listening for incoming requests and responding to
|
||||
them. This change will make it easier to improve performance and
|
||||
implement new protocol layers (for example, DNS over TLS) in the
|
||||
future. [GL #29]
|
||||
|
||||
* The new dnssec-policy option allows the configuration key and signing
|
||||
policy (KASP) for zones. This option enables named to generate new
|
||||
keys as needed and automatically roll both ZSK and KSK keys. (Note
|
||||
that the syntax for this statement differs from the DNSSEC policy used
|
||||
by dnssec-keymgr.) [GL #1134]
|
||||
|
||||
Feature Changes
|
||||
|
||||
* NSEC Aggressive Cache (synth-from-dnssec) has been disabled by default
|
||||
because it was found to have a significant performance impact on the
|
||||
recursive service. The NSEC Aggressive Cache will be enable by default
|
||||
in the future releases. [GL #1265]
|
||||
|
||||
Notes for BIND 9.15.5
|
||||
|
||||
Security Fixes
|
||||
|
||||
* The TCP client quota set using the tcp-clients option could be
|
||||
exceeded in some cases. This could lead to exhaustion of file
|
||||
descriptors. This flaw is disclosed in CVE-2018-5743. [GL #615]
|
||||
|
||||
* In certain configurations, named could crash with an assertion failure
|
||||
if nxdomain-redirect was in use and a redirected query resulted in an
|
||||
NXDOMAIN from the cache. This flaw is disclosed in CVE-2019-6467. [GL
|
||||
#880]
|
||||
|
||||
* A race condition could trigger an assertion failure when a large
|
||||
number of incoming packets were being rejected. This flaw is disclosed
|
||||
in CVE-2019-6471. [GL #942]
|
||||
|
||||
* named could crash with an assertion failure if a forwarder returned a
|
||||
referral, rather than resolving the query, when QNAME minimization was
|
||||
enabled. This flaw is disclosed in CVE-2019-6476. [GL #1051]
|
||||
|
|
@ -71,6 +83,8 @@ Security Fixes
|
|||
allow data to be incorrectly marked valid. This flaw is disclosed in
|
||||
CVE-2019-6475. [GL #1252]
|
||||
|
||||
Notes for BIND 9.15.4
|
||||
|
||||
New Features
|
||||
|
||||
* Added a new command line option to dig: +[no]unexpected. By default,
|
||||
|
|
@ -78,61 +92,22 @@ New Features
|
|||
sent the query. Add the +unexpected argument to enable it to process
|
||||
replies from unexpected sources.
|
||||
|
||||
* The GeoIP2 API from MaxMind is now supported. Geolocation support will
|
||||
be compiled in by default if the libmaxminddb library is found at
|
||||
compile time, but can be turned off by using configure --disable-geoip
|
||||
.
|
||||
|
||||
The default path to the GeoIP2 databases will be set based on the
|
||||
location of the libmaxminddb library; for example, if it is in /usr/
|
||||
local/lib, then the default path will be /usr/local/share/GeoIP. This
|
||||
value can be overridden in named.conf using the geoip-directory
|
||||
option.
|
||||
|
||||
Some geoip ACL settings that were available with legacy GeoIP,
|
||||
including searches for netspeed, org, and three-letter ISO country
|
||||
codes, will no longer work when using GeoIP2. Supported GeoIP2
|
||||
database types are country, city, domain, isp, and as. All of these
|
||||
databases support both IPv4 and IPv6 lookups. [GL #182] [GL #1112]
|
||||
|
||||
* In order to clarify the configuration of DNSSEC keys, the trusted-keys
|
||||
and managed-keys statements have been deprecated, and the new
|
||||
dnssec-keys statement should now be used for both types of key.
|
||||
|
||||
When used with the keyword initial-key, dnssec-keys has the same
|
||||
behavior as managed-keys, i.e., it configures a trust anchor that is
|
||||
to be maintained via RFC 5011.
|
||||
|
||||
When used with the new keyword static-key, it has the same behavior as
|
||||
trusted-keys, configuring a permanent trust anchor that will not
|
||||
automatically be updated. (This usage is not recommended for the root
|
||||
key.) [GL #6]
|
||||
|
||||
* The new add-soa option specifies whether or not the response-policy
|
||||
zone's SOA record should be included in the additional section of RPZ
|
||||
responses. [GL #865]
|
||||
|
||||
* Two new metrics have been added to the statistics-channel to report
|
||||
DNSSEC signing operations. For each key in each zone, the dnssec-sign
|
||||
counter indicates the total number of signatures named has generated
|
||||
using that key since server startup, and the dnssec-refresh counter
|
||||
indicates how many of those signatures were refreshed during zone
|
||||
maintenance, as opposed to having been generated as a result of a zone
|
||||
update. [GL #513]
|
||||
|
||||
* Statistics channel groups are now toggleable. [GL #1030]
|
||||
|
||||
* dig, mdig and delv can all now take a +yaml option to print output in
|
||||
a a detailed YAML format. [RT #1145]
|
||||
|
||||
Bug Fixes
|
||||
|
||||
* When a response-policy zone expires, ensure that its policies are
|
||||
removed from the RPZ summary database. [GL #1146]
|
||||
|
||||
Notes for BIND 9.15.3
|
||||
|
||||
New Features
|
||||
|
||||
* Statistics channel groups are now toggleable. [GL #1030]
|
||||
|
||||
Removed Features
|
||||
|
||||
* The dnssec-enable option has been obsoleted and no longer has any
|
||||
effect. DNSSEC responses are always enabled if signatures and other
|
||||
DNSSEC data are present. [GL #866]
|
||||
|
||||
* The cleaning-interval option has been removed. [GL !1731]
|
||||
|
||||
* DNSSEC Lookaside Validation (DLV) is now obsolete. The
|
||||
dnssec-lookaside option has been marked as deprecated; when used in
|
||||
named.conf, it will generate a warning but will otherwise be ignored.
|
||||
|
|
@ -141,31 +116,6 @@ Removed Features
|
|||
|
||||
Feature Changes
|
||||
|
||||
* named will now log a warning if a static key is configured for the
|
||||
root zone. [GL #6]
|
||||
|
||||
* When static and managed DNSSEC keys were both configured for the same
|
||||
name, or when a static key was used to configure a trust anchor for
|
||||
the root zone and dnssec-validation was set to the default value of
|
||||
auto, automatic RFC 5011 key rollovers would be disabled. This
|
||||
combination of settings was never intended to work, but there was no
|
||||
check for it in the parser. This has been corrected, and it is now a
|
||||
fatal configuration error. [GL #868]
|
||||
|
||||
* DS and CDS records are now generated with SHA-256 digests only,
|
||||
instead of both SHA-1 and SHA-256. This affects the default output of
|
||||
dnssec-dsfromkey, the dsset files generated by dnssec-signzone, the DS
|
||||
records added to a zone by dnssec-signzone based on keyset files, the
|
||||
CDS records added to a zone by named and dnssec-signzone based on
|
||||
"sync" timing parameters in key files, and the checks performed by
|
||||
dnssec-checkds.
|
||||
|
||||
* JSON-C is now the only supported library for enabling JSON support for
|
||||
BIND statistics. The configure option has been renamed from
|
||||
--with-libjson to --with-json-c. Use PKG_CONFIG_PATH to specify a
|
||||
custom path to the json-c library as the new configure option does not
|
||||
take the library installation path as an optional argument.
|
||||
|
||||
* A SipHash 2-4 based DNS Cookie (RFC 7873) algorithm has been added and
|
||||
made default. Old non-default HMAC-SHA based DNS Cookie algorithms
|
||||
have been removed, and only the default AES algorithm is being kept
|
||||
|
|
@ -191,9 +141,58 @@ Feature Changes
|
|||
|
||||
Bug Fixes
|
||||
|
||||
* The allow-update and allow-update-forwarding options were
|
||||
inadvertently treated as configuration errors when used at the options
|
||||
or view level. This has now been corrected. [GL #913]
|
||||
* Cache database statistics counters could report invalid values when
|
||||
stale answers were enabled, because of a bug in counter maintenance
|
||||
when cache data becomes stale. The statistics counters have been
|
||||
corrected to report the number of RRsets for each RR type that are
|
||||
active, stale but still potentially served, or stale and marked for
|
||||
deletion. [GL #602]
|
||||
|
||||
* Interaction between DNS64 and RPZ No Data rule (CNAME *.) could cause
|
||||
unexpected results; this has been fixed. [GL #1106]
|
||||
|
||||
* named-checkconf now checks DNS64 prefixes to ensure bits 64-71 are
|
||||
zero. [GL #1159]
|
||||
|
||||
* named-checkconf now correctly reports a missing dnstap-output option
|
||||
when dnstap is set. [GL #1136]
|
||||
|
||||
* Handle ETIMEDOUT error on connect() with a non-blocking socket. [GL #
|
||||
1133]
|
||||
|
||||
* dig now correctly expands the IPv6 address when run with +expandaaaa
|
||||
+short. [GL #1152]
|
||||
|
||||
Notes for BIND 9.15.2
|
||||
|
||||
New Features
|
||||
|
||||
* The GeoIP2 API from MaxMind is now supported. Geolocation support will
|
||||
be compiled in by default if the libmaxminddb library is found at
|
||||
compile time, but can be turned off by using configure --disable-geoip
|
||||
.
|
||||
|
||||
The default path to the GeoIP2 databases will be set based on the
|
||||
location of the libmaxminddb library; for example, if it is in /usr/
|
||||
local/lib, then the default path will be /usr/local/share/GeoIP. This
|
||||
value can be overridden in named.conf using the geoip-directory
|
||||
option.
|
||||
|
||||
Some geoip ACL settings that were available with legacy GeoIP,
|
||||
including searches for netspeed, org, and three-letter ISO country
|
||||
codes, will no longer work when using GeoIP2. Supported GeoIP2
|
||||
database types are country, city, domain, isp, and as. All of these
|
||||
databases support both IPv4 and IPv6 lookups. [GL #182] [GL #1112]
|
||||
|
||||
* Two new metrics have been added to the statistics-channel to report
|
||||
DNSSEC signing operations. For each key in each zone, the dnssec-sign
|
||||
counter indicates the total number of signatures named has generated
|
||||
using that key since server startup, and the dnssec-refresh counter
|
||||
indicates how many of those signatures were refreshed during zone
|
||||
maintenance, as opposed to having been generated as a result of a zone
|
||||
update. [GL #513]
|
||||
|
||||
Bug Fixes
|
||||
|
||||
* When qname-minimization was set to relaxed, some improperly configured
|
||||
domains would fail to resolve, but would have succeeded when
|
||||
|
|
@ -210,30 +209,92 @@ Bug Fixes
|
|||
* Glue address records were not being returned in responses to root
|
||||
priming queries; this has been corrected. [GL #1092]
|
||||
|
||||
* Interaction between DNS64 and RPZ No Data rule (CNAME *.) could cause
|
||||
unexpected results; this has been fixed. [GL #1106]
|
||||
Notes for BIND 9.15.1
|
||||
|
||||
* named-checkconf now checks DNS64 prefixes to ensure bits 64-71 are
|
||||
zero. [GL #1159]
|
||||
Security Fixes
|
||||
|
||||
* named-checkconf now correctly reports a missing dnstap-output option
|
||||
when dnstap is set. [GL #1136]
|
||||
* A race condition could trigger an assertion failure when a large
|
||||
number of incoming packets were being rejected. This flaw is disclosed
|
||||
in CVE-2019-6471. [GL #942]
|
||||
|
||||
* Handle ETIMEDOUT error on connect() with a non-blocking socket. [GL #
|
||||
1133]
|
||||
New Features
|
||||
|
||||
* Cache database statistics counters could report invalid values when
|
||||
stale answers were enabled, because of a bug in counter maintenance
|
||||
when cache data becomes stale. The statistics counters have been
|
||||
corrected to report the number of RRsets for each RR type that are
|
||||
active, stale but still potentially served, or stale and marked for
|
||||
deletion. [GL #602]
|
||||
* In order to clarify the configuration of DNSSEC keys, the trusted-keys
|
||||
and managed-keys statements have been deprecated, and the new
|
||||
dnssec-keys statement should now be used for both types of key.
|
||||
|
||||
* dig now correctly expands the IPv6 address when run with +expandaaaa
|
||||
+short. [GL #1152]
|
||||
When used with the keyword initial-key, dnssec-keys has the same
|
||||
behavior as managed-keys, i.e., it configures a trust anchor that is
|
||||
to be maintained via RFC 5011.
|
||||
|
||||
* When a response-policy zone expires, ensure that its policies are
|
||||
removed from the RPZ summary database. [GL #1146]
|
||||
When used with the new keyword static-key, it has the same behavior as
|
||||
trusted-keys, configuring a permanent trust anchor that will not
|
||||
automatically be updated. (This usage is not recommended for the root
|
||||
key.) [GL #6]
|
||||
|
||||
Removed Features
|
||||
|
||||
* The cleaning-interval option has been removed. [GL !1731]
|
||||
|
||||
Feature Changes
|
||||
|
||||
* named will now log a warning if a static key is configured for the
|
||||
root zone. [GL #6]
|
||||
|
||||
* JSON-C is now the only supported library for enabling JSON support for
|
||||
BIND statistics. The configure option has been renamed from
|
||||
--with-libjson to --with-json-c. Use PKG_CONFIG_PATH to specify a
|
||||
custom path to the json-c library as the new configure option does not
|
||||
take the library installation path as an optional argument.
|
||||
|
||||
Notes for BIND 9.15.0
|
||||
|
||||
Security Fixes
|
||||
|
||||
* In certain configurations, named could crash with an assertion failure
|
||||
if nxdomain-redirect was in use and a redirected query resulted in an
|
||||
NXDOMAIN from the cache. This flaw is disclosed in CVE-2019-6467. [GL
|
||||
#880]
|
||||
|
||||
* The TCP client quota set using the tcp-clients option could be
|
||||
exceeded in some cases. This could lead to exhaustion of file
|
||||
descriptors. This flaw is disclosed in CVE-2018-5743. [GL #615]
|
||||
|
||||
New Features
|
||||
|
||||
* The new add-soa option specifies whether or not the response-policy
|
||||
zone's SOA record should be included in the additional section of RPZ
|
||||
responses. [GL #865]
|
||||
|
||||
Removed Features
|
||||
|
||||
* The dnssec-enable option has been obsoleted and no longer has any
|
||||
effect. DNSSEC responses are always enabled if signatures and other
|
||||
DNSSEC data are present. [GL #866]
|
||||
|
||||
Feature Changes
|
||||
|
||||
* When static and managed DNSSEC keys were both configured for the same
|
||||
name, or when a static key was used to configure a trust anchor for
|
||||
the root zone and dnssec-validation was set to the default value of
|
||||
auto, automatic RFC 5011 key rollovers would be disabled. This
|
||||
combination of settings was never intended to work, but there was no
|
||||
check for it in the parser. This has been corrected, and it is now a
|
||||
fatal configuration error. [GL #868]
|
||||
|
||||
* DS and CDS records are now generated with SHA-256 digests only,
|
||||
instead of both SHA-1 and SHA-256. This affects the default output of
|
||||
dnssec-dsfromkey, the dsset files generated by dnssec-signzone, the DS
|
||||
records added to a zone by dnssec-signzone based on keyset files, the
|
||||
CDS records added to a zone by named and dnssec-signzone based on
|
||||
"sync" timing parameters in key files, and the checks performed by
|
||||
dnssec-checkds.
|
||||
|
||||
Bug Fixes
|
||||
|
||||
* The allow-update and allow-update-forwarding options were
|
||||
inadvertently treated as configuration errors when used at the options
|
||||
or view level. This has now been corrected. [GL #913]
|
||||
|
||||
License
|
||||
|
||||
|
|
@ -258,12 +319,12 @@ complete, it will be renamed to BIND 9.16, which will be a stable branch.
|
|||
The end of life date for BIND 9.16 has not yet been determined. For those
|
||||
needing long term support, the current Extended Support Version (ESV) is
|
||||
BIND 9.11, which will be supported until at least December 2021. See
|
||||
https://www.isc.org/downloads/software-support-policy/ for details of
|
||||
ISC's software support policy.
|
||||
https://kb.isc.org/docs/aa-00896 for details of ISC's software support
|
||||
policy.
|
||||
|
||||
Thank You
|
||||
|
||||
Thank you to everyone who assisted us in making this release possible. If
|
||||
you would like to contribute to ISC to assist us in continuing to make
|
||||
quality open source software, please visit our donations page at http://
|
||||
quality open source software, please visit our donations page at https://
|
||||
www.isc.org/donate/.
|
||||
|
|
|
|||
Loading…
Reference in a new issue