Bv9ARM.ch09.html revision 1a6f02ce4ae7b42056b51cfe31920f71d44efe4b
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync - Copyright (C) 2000-2016 Internet Systems Consortium, Inc. ("ISC")
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync - This Source Code Form is subject to the terms of the Mozilla Public
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync - License, v. 2.0. If a copy of the MPL was not distributed with this
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync - file, You can obtain one at http://mozilla.org/MPL/2.0/.
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync<link rel="home" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync<link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync<link rel="prev" href="Bv9ARM.ch08.html" title="Chapter�8.�Troubleshooting">
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync<link rel="next" href="Bv9ARM.ch10.html" title="Appendix�B.�A Brief History of the DNS and BIND">
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync<tr><th colspan="3" align="center">Appendix�A.�Release Notes</th></tr>
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync<a accesskey="p" href="Bv9ARM.ch08.html">Prev</a>�</td>
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync<td width="20%" align="right">�<a accesskey="n" href="Bv9ARM.ch10.html">Next</a>
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync<a name="Bv9ARM.ch09"></a>Release Notes</h1></div></div></div>
4faf92053d9cec5599c0ab8577231df0f7d615b3vboxsync<dt><span class="section"><a href="Bv9ARM.ch09.html#id-1.10.2">Release Notes for BIND Version 9.11.1rc1</a></span></dt>
0575222e3e7455c3ea1fb8f5aa7c4b58aea40a08vboxsync<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_intro">Introduction</a></span></dt>
7870a295fdec1b57c4546425f2e591fd3091a7b3vboxsync<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_download">Download</a></span></dt>
7870a295fdec1b57c4546425f2e591fd3091a7b3vboxsync<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_license">License Change</a></span></dt>
7870a295fdec1b57c4546425f2e591fd3091a7b3vboxsync<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_security">Security Fixes</a></span></dt>
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_changes">Feature Changes</a></span></dt>
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_bugs">Bug Fixes</a></span></dt>
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_maint">Maintenance</a></span></dt>
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_misc">Miscellaneous Notes</a></span></dt>
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync<dt><span class="section"><a href="Bv9ARM.ch09.html#end_of_life">End of Life</a></span></dt>
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_thanks">Thank You</a></span></dt>
682a27d94b9116c719038882487b99053985f91avboxsync<div class="titlepage"><div><div><h2 class="title" style="clear: both">
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync<a name="id-1.10.2"></a>Release Notes for BIND Version 9.11.1rc1</h2></div></div></div>
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync<a name="relnotes_intro"></a>Introduction</h3></div></div></div>
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync This document summarizes changes since the last production
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync release on the BIND 9.11 branch.
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync Please see the <code class="filename">CHANGES</code> file for a further
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync list of bug fixes and other changes.
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync<a name="relnotes_download"></a>Download</h3></div></div></div>
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync The latest versions of BIND 9 software can always be found at
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync <a class="link" href="http://www.isc.org/downloads/" target="_top">http://www.isc.org/downloads/</a>.
324b7b7cb0e3e95595f5fb069043ff3643891ba2vboxsync There you will find additional information about each release,
324b7b7cb0e3e95595f5fb069043ff3643891ba2vboxsync source code, and pre-compiled versions for Microsoft Windows
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync operating systems.
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync<a name="relnotes_license"></a>License Change</h3></div></div></div>
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync With the release of BIND 9.11.0, ISC changed to the open
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync source license for BIND from the ISC license to the Mozilla
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync Public License (MPL 2.0).
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync The MPL-2.0 license requires that if you make changes to
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync licensed software (e.g. BIND) and distribute them outside
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync your organization, that you publish those changes under that
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync same license. It does not require that you publish or disclose
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync anything other than the changes you made to our software.
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync This new requirement will not affect anyone who is using BIND
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync without redistributing it, nor anyone redistributing it without
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync changes, therefore this change will be without consequence
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync for most individuals and organizations who are using BIND.
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync Those unsure whether or not the license change affects their
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync use of BIND, or who wish to discuss how to comply with the
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync license may contact ISC at <a class="link" href="https://www.isc.org/mission/contact/" target="_top">
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync<a name="relnotes_security"></a>Security Fixes</h3></div></div></div>
f44b6583d60e03aa9366a491b16071532cf92357vboxsync <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync If a server is configured with a response policy zone (RPZ)
f65e6cba3e74ffd3dc9e6053828dcc82b367e8devboxsync that rewrites an answer with local data, and is also configured
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync for DNS64 address mapping, a NULL pointer can be read
0575222e3e7455c3ea1fb8f5aa7c4b58aea40a08vboxsync triggering a server crash. This flaw is disclosed in
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync CVE-2017-3135. [RT #44434]
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync A coding error in the <code class="option">nxdomain-redirect</code>
f44b6583d60e03aa9366a491b16071532cf92357vboxsync feature could lead to an assertion failure if the redirection
f44b6583d60e03aa9366a491b16071532cf92357vboxsync namespace was served from a local authoritative data source
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync such as a local zone or a DLZ instead of via recursive
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync lookup. This flaw is disclosed in CVE-2016-9778. [RT #43837]
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync <span class="command"><strong>named</strong></span> could mishandle authority sections
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync with missing RRSIGs, triggering an assertion failure. This
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync flaw is disclosed in CVE-2016-9444. [RT #43632]
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync <span class="command"><strong>named</strong></span> mishandled some responses where
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync covering RRSIG records were returned without the requested
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync data, resulting in an assertion failure. This flaw is
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync disclosed in CVE-2016-9147. [RT #43548]
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync <span class="command"><strong>named</strong></span> incorrectly tried to cache TKEY
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync records which could trigger an assertion failure when there was
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync a class mismatch. This flaw is disclosed in CVE-2016-9131.
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync [RT #43522]
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync It was possible to trigger assertions when processing
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync responses containing answers of type DNAME. This flaw is
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync disclosed in CVE-2016-8864. [RT #43465]
019f39cc548f50d58cfdf91965f58eab1ded841bvboxsync Added the ability to specify the maximum number of records
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync permitted in a zone (<code class="option">max-records #;</code>).
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync This provides a mechanism to block overly large zone
019f39cc548f50d58cfdf91965f58eab1ded841bvboxsync transfers, which is a potential risk with slave zones from
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync other parties, as described in CVE-2016-6170.
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync [RT #42143]
324b7b7cb0e3e95595f5fb069043ff3643891ba2vboxsync<a name="relnotes_changes"></a>Feature Changes</h3></div></div></div>
019f39cc548f50d58cfdf91965f58eab1ded841bvboxsync <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
741a0ea8ed7567b7784172852371782a5562c5a5vboxsync <span class="command"><strong>dnstap</strong></span> now stores both the local and remote
019f39cc548f50d58cfdf91965f58eab1ded841bvboxsync addresses for all messages, instead of only the remote address.
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync The default output format for <span class="command"><strong>dnstap-read</strong></span> has
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync been updated to include these addresses, with the initiating
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync address first and the responding address second, separated by
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync "-%gt;" or "%lt;-" to indicate in which direction the message
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync was sent. [RT #43595]
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync The built in mangaged keys for the global root zone have been
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync updated to include the upcoming key signing key (keyid 20326).
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync Expanded and improved the YAML output from
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync <span class="command"><strong>dnstap-read -y</strong></span>: it now includes packet
0575222e3e7455c3ea1fb8f5aa7c4b58aea40a08vboxsync size and a detailed breakdown of message contents.
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync [RT #43622] [RT #43642]
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync If an ACL is specified with an address prefix in which the
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync prefix length is longer than the address portion (for example,
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync 192.0.2.1/8), <span class="command"><strong>named</strong></span> will now log a warning.
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync In future releases this will be a fatal configuration error.
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync [RT #43367]
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync<a name="relnotes_bugs"></a>Bug Fixes</h3></div></div></div>
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync A synthesized CNAME record appearing in a response before the
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync associated DNAME could be cached, when it should not have been.
0575222e3e7455c3ea1fb8f5aa7c4b58aea40a08vboxsync This was a regression introduced while addressing CVE-2016-8864.
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync [RT #44318]
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync Named could deadlock there were multiple changes to
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync NSEC/NSEC3 parameters for a zone being processed at the
0575222e3e7455c3ea1fb8f5aa7c4b58aea40a08vboxsync same time. [RT #42770]
366bfe2e04063776613f5e68fcc7fa1faa0c7650vboxsync Named could trigger a assertion when sending notify
4faf92053d9cec5599c0ab8577231df0f7d615b3vboxsync messages. [RT #44019]
0575222e3e7455c3ea1fb8f5aa7c4b58aea40a08vboxsync Referencing a nonexistent zone in a <span class="command"><strong>response-policy</strong></span>
adf5f1f964bb309d1306e270ed8679d02bf14c23vboxsync statement could cause an assertion failure during configuration.
8d23754a2fcd6eed337d0bc436d47476ef746c2bvboxsync [RT #43787]
adf5f1f964bb309d1306e270ed8679d02bf14c23vboxsync <span class="command"><strong>rndc addzone</strong></span> could cause a crash
8d23754a2fcd6eed337d0bc436d47476ef746c2bvboxsync when attempting to add a zone with a type other than
adf5f1f964bb309d1306e270ed8679d02bf14c23vboxsync <span class="command"><strong>master</strong></span> or <span class="command"><strong>slave</strong></span>.
adf5f1f964bb309d1306e270ed8679d02bf14c23vboxsync Such zones are now rejected. [RT #43665]
adf5f1f964bb309d1306e270ed8679d02bf14c23vboxsync <span class="command"><strong>named</strong></span> could hang when encountering log
adf5f1f964bb309d1306e270ed8679d02bf14c23vboxsync file names with large apparent gaps in version number (for
adf5f1f964bb309d1306e270ed8679d02bf14c23vboxsync example, when files exist called "logfile.0", "logfile.1",
5ffb8839e755b3d3d6a45131c530ea13f8e9a2b9vboxsync and "logfile.1482954169"). This is now handled correctly.
adf5f1f964bb309d1306e270ed8679d02bf14c23vboxsync [RT #38688]
adf5f1f964bb309d1306e270ed8679d02bf14c23vboxsync If a zone was updated while <span class="command"><strong>named</strong></span> was
adf5f1f964bb309d1306e270ed8679d02bf14c23vboxsync processing a query for nonexistent data, it could return
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync out-of-sync NSEC3 records causing potential DNSSEC validation
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync failure. [RT #43247]
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync<a name="relnotes_maint"></a>Maintenance</h3></div></div></div>
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
366bfe2e04063776613f5e68fcc7fa1faa0c7650vboxsync The built-in root hints have been updated to include an
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync IPv6 address (2001:500:12::d0d) for G.ROOT-SERVERS.NET.
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync<a name="relnotes_misc"></a>Miscellaneous Notes</h3></div></div></div>
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync Authoritative server support for the EDNS Client Subnet option
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync (ECS), introduced in BIND 9.11.0, was based on an early version
5ffb8839e755b3d3d6a45131c530ea13f8e9a2b9vboxsync of the specification, and is now known to have incompatibilities
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync with other ECS implementations. It is also inefficient, requiring
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync a separate view for each answer, and is unable to correct for
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync overlapping subnets in the configuration. It is intended for
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync testing purposes but is not recommended for for production use.
0575222e3e7455c3ea1fb8f5aa7c4b58aea40a08vboxsync This was not made sufficiently clear in the documentation at
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync the time of release.
0575222e3e7455c3ea1fb8f5aa7c4b58aea40a08vboxsync<a name="end_of_life"></a>End of Life</h3></div></div></div>
0575222e3e7455c3ea1fb8f5aa7c4b58aea40a08vboxsync The end of life for BIND 9.11 is yet to be determined but
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync will not be before BIND 9.13.0 has been released for 6 months.
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync <a class="link" href="https://www.isc.org/downloads/software-support-policy/" target="_top">https://www.isc.org/downloads/software-support-policy/</a>
5ffb8839e755b3d3d6a45131c530ea13f8e9a2b9vboxsync<a name="relnotes_thanks"></a>Thank You</h3></div></div></div>
9b226b6591855ab66f87a885d7d1334f88cc9148vboxsync Thank you to everyone who assisted us in making this release possible.
9b226b6591855ab66f87a885d7d1334f88cc9148vboxsync If you would like to contribute to ISC to assist us in continuing to
5ffb8839e755b3d3d6a45131c530ea13f8e9a2b9vboxsync make quality open source software, please visit our donations page at
5ffb8839e755b3d3d6a45131c530ea13f8e9a2b9vboxsync <a class="link" href="http://www.isc.org/donate/" target="_top">http://www.isc.org/donate/</a>.
9b226b6591855ab66f87a885d7d1334f88cc9148vboxsync<a accesskey="p" href="Bv9ARM.ch08.html">Prev</a>�</td>
9b226b6591855ab66f87a885d7d1334f88cc9148vboxsync<td width="40%" align="right">�<a accesskey="n" href="Bv9ARM.ch10.html">Next</a>
324b7b7cb0e3e95595f5fb069043ff3643891ba2vboxsync<td width="40%" align="left" valign="top">Chapter�8.�Troubleshooting�</td>
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
0575222e3e7455c3ea1fb8f5aa7c4b58aea40a08vboxsync<td width="40%" align="right" valign="top">�Appendix�B.�A Brief History of the <acronym class="acronym">DNS</acronym> and <acronym class="acronym">BIND</acronym>
7a61a5714b9a39ac3bd59e52b0843ef498350a35vboxsync<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.1rc1</p>