Bv9ARM.ch09.html revision c48fdfda7a8ae8973aadfeb88cbeaab013024a6c
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
75c0816e8295e180f4bc7f10db3d0d880383bc1cMark Andrews - Copyright (C) 2000-2017 Internet Systems Consortium, Inc. ("ISC")
4a14ce5ba00ab7bc55c99ffdcf59c7a4ab902721Automatic Updater - This Source Code Form is subject to the terms of the Mozilla Public
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - License, v. 2.0. If a copy of the MPL was not distributed with this
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - file, You can obtain one at http://mozilla.org/MPL/2.0/.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<link rel="home" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<link rel="prev" href="Bv9ARM.ch08.html" title="Chapter�8.�Troubleshooting">
ea94d370123a5892f6c47a97f21d1b28d44bb168Tinderbox User<link rel="next" href="Bv9ARM.ch10.html" title="Appendix�B.�A Brief History of the DNS and BIND">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
e21a2904f02a03fa06b6db04d348f65fe9c67b2bMark Andrews<tr><th colspan="3" align="center">Appendix�A.�Release Notes</th></tr>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a accesskey="p" href="Bv9ARM.ch08.html">Prev</a>�</td>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<td width="20%" align="right">�<a accesskey="n" href="Bv9ARM.ch10.html">Next</a>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="titlepage"><div><div><h1 class="title">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="Bv9ARM.ch09"></a>Release Notes</h1></div></div></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="section"><a href="Bv9ARM.ch09.html#id-1.10.2">Release Notes for BIND Version 9.11.2rc1</a></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_intro">Introduction</a></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_download">Download</a></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="section"><a href="Bv9ARM.ch09.html#root_key">New DNSSEC Root Key</a></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_license">License Change</a></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_security">Security Fixes</a></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_changes">Feature Changes</a></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_bugs">Bug Fixes</a></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="section"><a href="Bv9ARM.ch09.html#end_of_life">End of Life</a></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_thanks">Thank You</a></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="titlepage"><div><div><h2 class="title" style="clear: both">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="id-1.10.2"></a>Release Notes for BIND Version 9.11.2rc1</h2></div></div></div>
9941177e7eb530451d5970959cc2828c53cb36c9Tinderbox User<div class="titlepage"><div><div><h3 class="title">
9941177e7eb530451d5970959cc2828c53cb36c9Tinderbox User<a name="relnotes_intro"></a>Introduction</h3></div></div></div>
9941177e7eb530451d5970959cc2828c53cb36c9Tinderbox User This document summarizes changes since the last production
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein release on the BIND 9.11 branch.
9941177e7eb530451d5970959cc2828c53cb36c9Tinderbox User Please see the <code class="filename">CHANGES</code> file for a further
9941177e7eb530451d5970959cc2828c53cb36c9Tinderbox User list of bug fixes and other changes.
9941177e7eb530451d5970959cc2828c53cb36c9Tinderbox User<div class="titlepage"><div><div><h3 class="title">
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater<a name="relnotes_download"></a>Download</h3></div></div></div>
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater The latest versions of BIND 9 software can always be found at
bcf15a19ae0efa72a22cdfb50666a3c6ce39eb9fTinderbox User <a class="link" href="http://www.isc.org/downloads/" target="_top">http://www.isc.org/downloads/</a>.
bcf15a19ae0efa72a22cdfb50666a3c6ce39eb9fTinderbox User There you will find additional information about each release,
bcf15a19ae0efa72a22cdfb50666a3c6ce39eb9fTinderbox User source code, and pre-compiled versions for Microsoft Windows
bcf15a19ae0efa72a22cdfb50666a3c6ce39eb9fTinderbox User operating systems.
bcf15a19ae0efa72a22cdfb50666a3c6ce39eb9fTinderbox User<div class="titlepage"><div><div><h3 class="title">
bcf15a19ae0efa72a22cdfb50666a3c6ce39eb9fTinderbox User<a name="root_key"></a>New DNSSEC Root Key</h3></div></div></div>
bcf15a19ae0efa72a22cdfb50666a3c6ce39eb9fTinderbox User ICANN is in the process of introducing a new Key Signing Key (KSK) for
bcf15a19ae0efa72a22cdfb50666a3c6ce39eb9fTinderbox User the global root zone. BIND has multiple methods for managing DNSSEC
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater trust anchors, with somewhat different behaviors. If the root
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater key is configured using the <span class="command"><strong>managed-keys</strong></span>
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater statement, or if the pre-configured root key is enabled by using
bcf15a19ae0efa72a22cdfb50666a3c6ce39eb9fTinderbox User <span class="command"><strong>dnssec-validation auto</strong></span>, then BIND can keep
bcf15a19ae0efa72a22cdfb50666a3c6ce39eb9fTinderbox User keys up to date automatically. Servers configured in this way
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater will roll seamlessly to the new key when it is published in
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater the root zone. However, keys configured using the
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater <span class="command"><strong>trusted-keys</strong></span> statement are not automatically
bcf15a19ae0efa72a22cdfb50666a3c6ce39eb9fTinderbox User maintained. If your server is performing DNSSEC validation
bcf15a19ae0efa72a22cdfb50666a3c6ce39eb9fTinderbox User and is configured using <span class="command"><strong>trusted-keys</strong></span>, you are
bcf15a19ae0efa72a22cdfb50666a3c6ce39eb9fTinderbox User advised to change your configuration before the root zone begins
bcf15a19ae0efa72a22cdfb50666a3c6ce39eb9fTinderbox User signing with the new KSK. This is currently scheduled for
bcf15a19ae0efa72a22cdfb50666a3c6ce39eb9fTinderbox User October 11, 2017.
bcf15a19ae0efa72a22cdfb50666a3c6ce39eb9fTinderbox User This release includes an updated version of the
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater <code class="filename">bind.keys</code> file containing the new root
bcf15a19ae0efa72a22cdfb50666a3c6ce39eb9fTinderbox User key. This file can also be downloaded from
bcf15a19ae0efa72a22cdfb50666a3c6ce39eb9fTinderbox User <a class="link" href="https://www.isc.org/bind-keys" target="_top">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="titlepage"><div><div><h3 class="title">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="relnotes_license"></a>License Change</h3></div></div></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein With the release of BIND 9.11.0, ISC changed to the open
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein source license for BIND from the ISC license to the Mozilla
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Public License (MPL 2.0).
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews The MPL-2.0 license requires that if you make changes to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein licensed software (e.g. BIND) and distribute them outside
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein your organization, that you publish those changes under that
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein same license. It does not require that you publish or disclose
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein anything other than the changes you made to our software.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein This new requirement will not affect anyone who is using BIND
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein without redistributing it, nor anyone redistributing it without
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein changes, therefore this change will be without consequence
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein for most individuals and organizations who are using BIND.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews Those unsure whether or not the license change affects their
58d9e9169e7ab4355a0b0bfc13bc616bc5247dfeAutomatic Updater use of BIND, or who wish to discuss how to comply with the
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews license may contact ISC at <a class="link" href="https://www.isc.org/mission/contact/" target="_top">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="titlepage"><div><div><h3 class="title">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="relnotes_security"></a>Security Fixes</h3></div></div></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein An error in TSIG handling could permit unauthorized zone
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein transfers or zone updates. These flaws are disclosed in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein CVE-2017-3142 and CVE-2017-3143. [RT #45383]
3cddb2c552ee6582e8db0849c28747f6b6ca57feAutomatic Updater The BIND installer on Windows used an unquoted service path,
852ccdd42a71550c974111b49415204ffeca6573Automatic Updater which can enable privilege escalation. This flaw is disclosed
852ccdd42a71550c974111b49415204ffeca6573Automatic Updater in CVE-2017-3141. [RT #45229]
3cddb2c552ee6582e8db0849c28747f6b6ca57feAutomatic Updater With certain RPZ configurations, a response with TTL 0
852ccdd42a71550c974111b49415204ffeca6573Automatic Updater could cause <span class="command"><strong>named</strong></span> to go into an infinite
852ccdd42a71550c974111b49415204ffeca6573Automatic Updater query loop. This flaw is disclosed in CVE-2017-3140.
66f25f2ceeb589e67efe7af2413baaa3426b0042Automatic Updater<div class="titlepage"><div><div><h3 class="title">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="relnotes_changes"></a>Feature Changes</h3></div></div></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
38417cbfb1a328c20b5b723b8584a02c57f88897Automatic Updater <span class="command"><strong>dig +ednsopt</strong></span> now accepts the names
38417cbfb1a328c20b5b723b8584a02c57f88897Automatic Updater for EDNS options in addition to numeric values. For example,
38417cbfb1a328c20b5b723b8584a02c57f88897Automatic Updater an EDNS Client-Subnet option could be sent using
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="command"><strong>dig +ednsopt=ecs:...</strong></span>. Thanks to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein John Worley of Secure64 for the contribution. [RT #44461]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Threads in <span class="command"><strong>named</strong></span> are now set to human-readable
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein names to assist debugging on operating systems that support that.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Threads will have names such as "isc-timer", "isc-sockmgr",
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein "isc-worker0001", and so on. This will affect the reporting of
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein subsidiary thread names in <span class="command"><strong>ps</strong></span> and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="command"><strong>top</strong></span>, but not the main thread. [RT #43234]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein DiG now warns about .local queries which are reserved for
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Multicast DNS. [RT #44783]
3a5fe5abf08f16b8d31ab8ee9a788063110ef000Automatic Updater<div class="titlepage"><div><div><h3 class="title">
3a5fe5abf08f16b8d31ab8ee9a788063110ef000Automatic Updater<a name="relnotes_bugs"></a>Bug Fixes</h3></div></div></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Reloading or reconfiguring <span class="command"><strong>named</strong></span> could
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein fail on some platforms when LMDB was in use. [RT #45203]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Due to some incorrectly deleted code, when BIND was
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein built with LMDB, zones that were deleted via
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="command"><strong>rndc delzone</strong></span> were removed from the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein running server but were not removed from the new zone
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein database, so that deletion did not persist after a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein server restart. This has been corrected. [RT #45185]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Semicolons are no longer escaped when printing CAA and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein URI records. This may break applications that depend on the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein presence of the backslash before the semicolon. [RT #45216]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews AD could be set on truncated answer with no records present
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in the answer and authority sections. [RT #45140]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="titlepage"><div><div><h3 class="title">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="end_of_life"></a>End of Life</h3></div></div></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The end of life for BIND 9.11 is yet to be determined but
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein will not be before BIND 9.13.0 has been released for 6 months.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <a class="link" href="https://www.isc.org/downloads/software-support-policy/" target="_top">https://www.isc.org/downloads/software-support-policy/</a>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="titlepage"><div><div><h3 class="title">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="relnotes_thanks"></a>Thank You</h3></div></div></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Thank you to everyone who assisted us in making this release possible.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein If you would like to contribute to ISC to assist us in continuing to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein make quality open source software, please visit our donations page at
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <a class="link" href="http://www.isc.org/donate/" target="_top">http://www.isc.org/donate/</a>.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a accesskey="p" href="Bv9ARM.ch08.html">Prev</a>�</td>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<td width="40%" align="right">�<a accesskey="n" href="Bv9ARM.ch10.html">Next</a>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<td width="40%" align="left" valign="top">Chapter�8.�Troubleshooting�</td>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<td width="40%" align="right" valign="top">�Appendix�B.�A Brief History of the <acronym class="acronym">DNS</acronym> and <acronym class="acronym">BIND</acronym>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.2rc1</p>