Bv9ARM.ch09.html revision 111d5ef471ecec90671f480afd8f93e550a80917
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
75c0816e8295e180f4bc7f10db3d0d880383bc1cMark Andrews - Copyright (C) 2000-2017 Internet Systems Consortium, Inc. ("ISC")
4a14ce5ba00ab7bc55c99ffdcf59c7a4ab902721Automatic Updater - This Source Code Form is subject to the terms of the Mozilla Public
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - License, v. 2.0. If a copy of the MPL was not distributed with this
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - file, You can obtain one at http://mozilla.org/MPL/2.0/.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<link rel="home" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<link rel="prev" href="Bv9ARM.ch08.html" title="Chapter�8.�Troubleshooting">
3cddb2c552ee6582e8db0849c28747f6b6ca57feAutomatic Updater<link rel="next" href="Bv9ARM.ch10.html" title="Appendix�B.�A Brief History of the DNS and BIND">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
e21a2904f02a03fa06b6db04d348f65fe9c67b2bMark Andrews<tr><th colspan="3" align="center">Appendix�A.�Release Notes</th></tr>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a accesskey="p" href="Bv9ARM.ch08.html">Prev</a>�</td>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<td width="20%" align="right">�<a accesskey="n" href="Bv9ARM.ch10.html">Next</a>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="titlepage"><div><div><h1 class="title">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="Bv9ARM.ch09"></a>Release Notes</h1></div></div></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="section"><a href="Bv9ARM.ch09.html#id-1.10.2">Release Notes for BIND Version 9.11.2</a></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_intro">Introduction</a></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_download">Download</a></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="section"><a href="Bv9ARM.ch09.html#root_key">New DNSSEC Root Key</a></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_license">License Change</a></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="section"><a href="Bv9ARM.ch09.html#win_support">Legacy Windows No Longer Supported</a></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_security">Security Fixes</a></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_removed">Removed Features</a></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="section"><a href="Bv9ARM.ch09.html#proto_changes">Protocol Changes</a></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_changes">Feature Changes</a></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_bugs">Bug Fixes</a></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="section"><a href="Bv9ARM.ch09.html#end_of_life">End of Life</a></span></dt>
3cddb2c552ee6582e8db0849c28747f6b6ca57feAutomatic Updater<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_thanks">Thank You</a></span></dt>
3cddb2c552ee6582e8db0849c28747f6b6ca57feAutomatic Updater<div class="titlepage"><div><div><h2 class="title" style="clear: both">
3cddb2c552ee6582e8db0849c28747f6b6ca57feAutomatic Updater<a name="id-1.10.2"></a>Release Notes for BIND Version 9.11.2</h2></div></div></div>
3cddb2c552ee6582e8db0849c28747f6b6ca57feAutomatic Updater<div class="titlepage"><div><div><h3 class="title">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="relnotes_intro"></a>Introduction</h3></div></div></div>
3cddb2c552ee6582e8db0849c28747f6b6ca57feAutomatic Updater This document summarizes changes since the last production
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein release on the BIND 9.11 branch.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Please see the <code class="filename">CHANGES</code> file for a further
3cddb2c552ee6582e8db0849c28747f6b6ca57feAutomatic Updater list of bug fixes and other changes.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="titlepage"><div><div><h3 class="title">
3cddb2c552ee6582e8db0849c28747f6b6ca57feAutomatic Updater<a name="relnotes_download"></a>Download</h3></div></div></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The latest versions of BIND 9 software can always be found at
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <a class="link" href="http://www.isc.org/downloads/" target="_top">http://www.isc.org/downloads/</a>.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein There you will find additional information about each release,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein source code, and pre-compiled versions for Microsoft Windows
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein operating systems.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<div class="titlepage"><div><div><h3 class="title">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="root_key"></a>New DNSSEC Root Key</h3></div></div></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein ICANN is in the process of introducing a new Key Signing Key (KSK) for
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the global root zone. BIND has multiple methods for managing DNSSEC
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews trust anchors, with somewhat different behaviors. If the root
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein key is configured using the <span class="command"><strong>managed-keys</strong></span>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein statement, or if the pre-configured root key is enabled by using
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="command"><strong>dnssec-validation auto</strong></span>, then BIND can keep keys up
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to date automatically. Servers configured in this way should have
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein begun the process of rolling to the new key when it was published in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the root zone in July 2017. However, keys configured using the
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <span class="command"><strong>trusted-keys</strong></span> statement are not automatically
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews maintained. If your server is performing DNSSEC validation and is
58d9e9169e7ab4355a0b0bfc13bc616bc5247dfeAutomatic Updater configured using <span class="command"><strong>trusted-keys</strong></span>, you are advised to
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews change your configuration before the root zone begins signing with
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews the new KSK. This is currently scheduled for October 11, 2017.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews This release includes an updated version of the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <code class="filename">bind.keys</code> file containing the new root
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein key. This file can also be downloaded from
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <a class="link" href="https://www.isc.org/bind-keys" target="_top">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="titlepage"><div><div><h3 class="title">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="relnotes_license"></a>License Change</h3></div></div></div>
3cddb2c552ee6582e8db0849c28747f6b6ca57feAutomatic Updater With the release of BIND 9.11.0, ISC changed to the open
3cddb2c552ee6582e8db0849c28747f6b6ca57feAutomatic Updater source license for BIND from the ISC license to the Mozilla
852ccdd42a71550c974111b49415204ffeca6573Automatic Updater Public License (MPL 2.0).
3cddb2c552ee6582e8db0849c28747f6b6ca57feAutomatic Updater The MPL-2.0 license requires that if you make changes to
3cddb2c552ee6582e8db0849c28747f6b6ca57feAutomatic Updater licensed software (e.g. BIND) and distribute them outside
ca67ebfe9eef0b8f04179f7e511a19e0337a5422Automatic Updater your organization, that you publish those changes under that
3cddb2c552ee6582e8db0849c28747f6b6ca57feAutomatic Updater same license. It does not require that you publish or disclose
852ccdd42a71550c974111b49415204ffeca6573Automatic Updater anything other than the changes you made to our software.
acb72d5e2c83b597332e3eb0c7d59e1142f1adfdMark Andrews This requirement will not affect anyone who is using BIND, with
852ccdd42a71550c974111b49415204ffeca6573Automatic Updater or without modifications, without redistributing it, nor anyone
acb72d5e2c83b597332e3eb0c7d59e1142f1adfdMark Andrews redistributing it without changes. Therefore, this change will be
acb72d5e2c83b597332e3eb0c7d59e1142f1adfdMark Andrews without consequence for most individuals and organizations who are
38417cbfb1a328c20b5b723b8584a02c57f88897Automatic Updater Those unsure whether or not the license change affects their
38417cbfb1a328c20b5b723b8584a02c57f88897Automatic Updater use of BIND, or who wish to discuss how to comply with the
38417cbfb1a328c20b5b723b8584a02c57f88897Automatic Updater license may contact ISC at <a class="link" href="https://www.isc.org/mission/contact/" target="_top">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="titlepage"><div><div><h3 class="title">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="win_support"></a>Legacy Windows No Longer Supported</h3></div></div></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein As of BIND 9.11.2, Windows XP and Windows 2003 are no longer supported
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein platforms for BIND; "XP" binaries are no longer available for download
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="titlepage"><div><div><h3 class="title">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="relnotes_security"></a>Security Fixes</h3></div></div></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein An error in TSIG handling could permit unauthorized zone
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein transfers or zone updates. These flaws are disclosed in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein CVE-2017-3142 and CVE-2017-3143. [RT #45383]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The BIND installer on Windows used an unquoted service path,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein which can enable privilege escalation. This flaw is disclosed
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in CVE-2017-3141. [RT #45229]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein With certain RPZ configurations, a response with TTL 0
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein could cause <span class="command"><strong>named</strong></span> to go into an infinite
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein query loop. This flaw is disclosed in CVE-2017-3140.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Addresses could be referenced after being freed during resolver
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein processing, causing an assertion failure. The chances of this
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein happening were remote, but the introduction of a delay in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein resolution increased them. This bug is disclosed in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein CVE-2017-3145. [RT #46839]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="titlepage"><div><div><h3 class="title">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="relnotes_removed"></a>Removed Features</h3></div></div></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The ISC DNSSEC Lookaside Validation (DLV) service has
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein been shut down; all DLV records in the dlv.isc.org zone
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein have been removed. References to the service have been
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein removed from BIND documentation. Lookaside validation
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein is no longer used by default by <span class="command"><strong>delv</strong></span>.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The DLV key has been removed from <code class="filename">bind.keys</code>.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Setting <span class="command"><strong>dnssec-lookaside</strong></span> to
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews <span class="command"><strong>auto</strong></span> or to use dlv.isc.org as a trust
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein anchor results in a warning being issued.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="titlepage"><div><div><h3 class="title">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="proto_changes"></a>Protocol Changes</h3></div></div></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein BIND can now use the Ed25519 and Ed448 Edwards Curve DNSSEC
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein signing algorithms described in RFC 8080. Note, however, that
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein these algorithms must be supported in OpenSSL;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein currently they are only available in the development branch
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein of OpenSSL at
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <a class="link" href="https://github.com/openssl/openssl" target="_top">
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews When parsing DNS messages, EDNS KEY TAG options are checked
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews for correctness. When printing messages (for example, in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="command"><strong>dig</strong></span>), EDNS KEY TAG options are printed
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in readable format.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="titlepage"><div><div><h3 class="title">
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<a name="relnotes_changes"></a>Feature Changes</h3></div></div></div>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <span class="command"><strong>named</strong></span> will no longer start or accept
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein reconfiguration if <span class="command"><strong>managed-keys</strong></span> or
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="command"><strong>dnssec-validation auto</strong></span> are in use and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the managed-keys directory (specified by
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="command"><strong>managed-keys-directory</strong></span>, and defaulting
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to the working directory if not specified),
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein is not writable by the effective user ID. [RT #46077]
3cddb2c552ee6582e8db0849c28747f6b6ca57feAutomatic Updater Previously, <span class="command"><strong>update-policy local;</strong></span> accepted
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein updates from any source so long as they were signed by the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein locally-generated session key. This has been further restricted;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein updates are now only accepted from locally configured addresses.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="command"><strong>dig +ednsopt</strong></span> now accepts the names
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein for EDNS options in addition to numeric values. For example,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein an EDNS Client-Subnet option could be sent using
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="command"><strong>dig +ednsopt=ecs:...</strong></span>. Thanks to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein John Worley of Secure64 for the contribution. [RT #44461]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Threads in <span class="command"><strong>named</strong></span> are now set to human-readable
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein names to assist debugging on operating systems that support that.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Threads will have names such as "isc-timer", "isc-sockmgr",
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein "isc-worker0001", and so on. This will affect the reporting of
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein subsidiary thread names in <span class="command"><strong>ps</strong></span> and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="command"><strong>top</strong></span>, but not the main thread. [RT #43234]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein DiG now warns about .local queries which are reserved for
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Multicast DNS. [RT #44783]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="titlepage"><div><div><h3 class="title">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="relnotes_bugs"></a>Bug Fixes</h3></div></div></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Attempting to validate improperly unsigned CNAME responses
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein from secure zones could cause a validator loop. This caused
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein a delay in returning SERVFAIL and also increased the chances
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein of encountering the crash bug described in CVE-2017-3145.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein When <span class="command"><strong>named</strong></span> was reconfigured, failure of some
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein zones to load correctly could leave the system in an inconsistent
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein state; while generally harmless, this could lead to a crash later
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein when using <span class="command"><strong>rndc addzone</strong></span>. Reconfiguration changes
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein are now fully rolled back in the event of failure. [RT #45841]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Fixed a bug that was introduced in an earlier development
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein release which caused multi-packet AXFR and IXFR messages to fail
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein validation if not all packets contained TSIG records; this
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein caused interoperability problems with some other DNS
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein implementations. [RT #45509]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Reloading or reconfiguring <span class="command"><strong>named</strong></span> could
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein fail on some platforms when LMDB was in use. [RT #45203]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Due to some incorrectly deleted code, when BIND was
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein built with LMDB, zones that were deleted via
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="command"><strong>rndc delzone</strong></span> were removed from the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein running server but were not removed from the new zone
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein database, so that deletion did not persist after a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein server restart. This has been corrected. [RT #45185]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Semicolons are no longer escaped when printing CAA and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein URI records. This may break applications that depend on the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein presence of the backslash before the semicolon. [RT #45216]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein AD could be set on truncated answer with no records present
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in the answer and authority sections. [RT #45140]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Some header files included <isc/util.h> incorrectly as
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein it pollutes with namespace with non ISC_ macros and this should
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein only be done by explicitly including <isc/util.h>. This
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein has been corrected. Some code may depend on <isc/util.h>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein being implicitly included via other header files. Such
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein code should explicitly include <isc/util.h>.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Zones created with <span class="command"><strong>rndc addzone</strong></span> could
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein temporarily fail to inherit the <span class="command"><strong>allow-transfer</strong></span>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein ACL set in the <span class="command"><strong>options</strong></span> section of
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <code class="filename">named.conf</code>. [RT #46603]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="command"><strong>named</strong></span> failed to properly determine whether
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein there were active KSK and ZSK keys for an algorithm when
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="command"><strong>update-check-ksk</strong></span> was true (which is the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein default setting). This could leave records unsigned
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein when rolling keys. [RT #46743] [RT #46754] [RT #46774]
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce<div class="titlepage"><div><div><h3 class="title">
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce<a name="end_of_life"></a>End of Life</h3></div></div></div>
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater The end of life for BIND 9.11 is yet to be determined but
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews will not be before BIND 9.13.0 has been released for 6 months.
c71787bd6356c92e9c7d0a174cd63ab17fcf34c6Eric Luce <a class="link" href="https://www.isc.org/downloads/software-support-policy/" target="_top">https://www.isc.org/downloads/software-support-policy/</a>
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater<div class="titlepage"><div><div><h3 class="title">
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater<a name="relnotes_thanks"></a>Thank You</h3></div></div></div>
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce Thank you to everyone who assisted us in making this release possible.
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce If you would like to contribute to ISC to assist us in continuing to
c71787bd6356c92e9c7d0a174cd63ab17fcf34c6Eric Luce make quality open source software, please visit our donations page at
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater <a class="link" href="http://www.isc.org/donate/" target="_top">http://www.isc.org/donate/</a>.
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater<a accesskey="p" href="Bv9ARM.ch08.html">Prev</a>�</td>
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce<td width="40%" align="right">�<a accesskey="n" href="Bv9ARM.ch10.html">Next</a>
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce<td width="40%" align="left" valign="top">Chapter�8.�Troubleshooting�</td>
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce<td width="40%" align="right" valign="top">�Appendix�B.�A Brief History of the <acronym class="acronym">DNS</acronym> and <acronym class="acronym">BIND</acronym>
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.2 (Extended Support Version)</p>