Bv9ARM.ch09.html revision e21a6f5ec65fad1c18f6723f5495e55bcd15a53d
306763c67bb99228487345b32ab8c5c6cd41f23cChristian Maeder<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
306763c67bb99228487345b32ab8c5c6cd41f23cChristian Maeder - Copyright (C) 2000-2015 Internet Systems Consortium, Inc. ("ISC")
306763c67bb99228487345b32ab8c5c6cd41f23cChristian Maeder - This Source Code Form is subject to the terms of the Mozilla Public
306763c67bb99228487345b32ab8c5c6cd41f23cChristian Maeder - License, v. 2.0. If a copy of the MPL was not distributed with this
306763c67bb99228487345b32ab8c5c6cd41f23cChristian Maeder - file, You can obtain one at http://mozilla.org/MPL/2.0/.
679d3f541f7a9ede4079e045f7758873bb901872Till Mossakowski<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
306763c67bb99228487345b32ab8c5c6cd41f23cChristian Maeder<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
306763c67bb99228487345b32ab8c5c6cd41f23cChristian Maeder<link rel="home" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
679d3f541f7a9ede4079e045f7758873bb901872Till Mossakowski<link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder<link rel="prev" href="Bv9ARM.ch08.html" title="Chapter�8.�Troubleshooting">
d21dd452cd68abade683103a5c0cfe6d02c5f17bTill Mossakowski<link rel="next" href="Bv9ARM.ch10.html" title="Appendix�B.�A Brief History of the DNS and BIND">
95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder<table width="100%" summary="Navigation header">
f0e85ee7e4accfc01f46aa0363acc59fcd248e8aTill Mossakowski<tr><th colspan="3" align="center">Appendix�A.�Release Notes</th></tr>
ba904a15082557e939db689fcfba0c68c9a4f740Christian Maeder<a accesskey="p" href="Bv9ARM.ch08.html">Prev</a>�</td>
ba904a15082557e939db689fcfba0c68c9a4f740Christian Maeder<td width="20%" align="right">�<a accesskey="n" href="Bv9ARM.ch10.html">Next</a>
ba904a15082557e939db689fcfba0c68c9a4f740Christian Maeder<div class="titlepage"><div><div><h1 class="title">
58b671de3fe578346fef9642ffa3c5a0a0edb3cbTill Mossakowski<a name="Bv9ARM.ch09"></a>Release Notes</h1></div></div></div>
c616e681da8c052b62e14247fea522da099ac0e4Christian Maeder<dt><span class="section"><a href="Bv9ARM.ch09.html#id-1.10.2">Release Notes for BIND Version 9.11.0rc3</a></span></dt>
1b05bdb88b90d3c947351f262d7ae7d68f0a4a6fTill Mossakowski<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_intro">Introduction</a></span></dt>
21dae7237ac384abdb94a81e00b3f099873ec623Till Mossakowski<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_download">Download</a></span></dt>
21dae7237ac384abdb94a81e00b3f099873ec623Till Mossakowski<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_license">License Change</a></span></dt>
1b05bdb88b90d3c947351f262d7ae7d68f0a4a6fTill Mossakowski<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_security">Security Fixes</a></span></dt>
a7f97f28aa8227408d4008e0b12a7bd925ef51feKlaus Luettich<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_features">New Features</a></span></dt>
b0294d73dcefc502ddaa13e18b46103a5916971fTill Mossakowski<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_changes">Feature Changes</a></span></dt>
b0294d73dcefc502ddaa13e18b46103a5916971fTill Mossakowski<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_bugs">Bug Fixes</a></span></dt>
1b05bdb88b90d3c947351f262d7ae7d68f0a4a6fTill Mossakowski<dt><span class="section"><a href="Bv9ARM.ch09.html#end_of_life">End of Life</a></span></dt>
1b05bdb88b90d3c947351f262d7ae7d68f0a4a6fTill Mossakowski<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_thanks">Thank You</a></span></dt>
a7f97f28aa8227408d4008e0b12a7bd925ef51feKlaus Luettich<div class="titlepage"><div><div><h2 class="title" style="clear: both">
21dae7237ac384abdb94a81e00b3f099873ec623Till Mossakowski<a name="id-1.10.2"></a>Release Notes for BIND Version 9.11.0rc3</h2></div></div></div>
21dae7237ac384abdb94a81e00b3f099873ec623Till Mossakowski<div class="titlepage"><div><div><h3 class="title">
21dae7237ac384abdb94a81e00b3f099873ec623Till Mossakowski<a name="relnotes_intro"></a>Introduction</h3></div></div></div>
21dae7237ac384abdb94a81e00b3f099873ec623Till Mossakowski BIND 9.11.0 is a new feature release of BIND, still under development.
f0e85ee7e4accfc01f46aa0363acc59fcd248e8aTill Mossakowski This document summarizes new features and functional changes that
f0e85ee7e4accfc01f46aa0363acc59fcd248e8aTill Mossakowski have been introduced on this branch. With each development
f0e85ee7e4accfc01f46aa0363acc59fcd248e8aTill Mossakowski release leading up to the final BIND 9.11.0 release, this document
f0e85ee7e4accfc01f46aa0363acc59fcd248e8aTill Mossakowski will be updated with additional features added and bugs fixed.
f0e85ee7e4accfc01f46aa0363acc59fcd248e8aTill Mossakowski<div class="titlepage"><div><div><h3 class="title">
f0e85ee7e4accfc01f46aa0363acc59fcd248e8aTill Mossakowski<a name="relnotes_download"></a>Download</h3></div></div></div>
f0e85ee7e4accfc01f46aa0363acc59fcd248e8aTill Mossakowski The latest versions of BIND 9 software can always be found at
f0e85ee7e4accfc01f46aa0363acc59fcd248e8aTill Mossakowski <a class="link" href="http://www.isc.org/downloads/" target="_top">http://www.isc.org/downloads/</a>.
f0e85ee7e4accfc01f46aa0363acc59fcd248e8aTill Mossakowski There you will find additional information about each release,
f0e85ee7e4accfc01f46aa0363acc59fcd248e8aTill Mossakowski source code, and pre-compiled versions for Microsoft Windows
f0e85ee7e4accfc01f46aa0363acc59fcd248e8aTill Mossakowski operating systems.
f0e85ee7e4accfc01f46aa0363acc59fcd248e8aTill Mossakowski<div class="titlepage"><div><div><h3 class="title">
f0e85ee7e4accfc01f46aa0363acc59fcd248e8aTill Mossakowski<a name="relnotes_license"></a>License Change</h3></div></div></div>
21dae7237ac384abdb94a81e00b3f099873ec623Till Mossakowski With the release of BIND 9.11.0, ISC is changing the open
21dae7237ac384abdb94a81e00b3f099873ec623Till Mossakowski source license for BIND from the ISC license to the Mozilla
21dae7237ac384abdb94a81e00b3f099873ec623Till Mossakowski Public License (MPL 2.0). This change is effective from BIND
e379124f467e5d0ef7d3c0ca238bff0521f70831Till Mossakowski 9.11.0b1 onwards.
c616e681da8c052b62e14247fea522da099ac0e4Christian Maeder The MPL-2.0 license requires that if you make changes to
95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder licensed software (e.g. BIND) and distribute them outside
95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder your organization, that you publish those changes under that
21dae7237ac384abdb94a81e00b3f099873ec623Till Mossakowski same license. It does not require that you publish or disclose
21dae7237ac384abdb94a81e00b3f099873ec623Till Mossakowski anything other than the changes you made to our software.
21dae7237ac384abdb94a81e00b3f099873ec623Till Mossakowski This new requirement will not affect anyone who is using BIND
21dae7237ac384abdb94a81e00b3f099873ec623Till Mossakowski without redistributing it, nor anyone redistributing it without
21dae7237ac384abdb94a81e00b3f099873ec623Till Mossakowski changes, therefore this change will be without consequence
21dae7237ac384abdb94a81e00b3f099873ec623Till Mossakowski for most individuals and organizations who are using BIND.
21dae7237ac384abdb94a81e00b3f099873ec623Till Mossakowski Those unsure whether or not the license change affects their
21dae7237ac384abdb94a81e00b3f099873ec623Till Mossakowski use of BIND, or who wish to discuss how to comply with the
21dae7237ac384abdb94a81e00b3f099873ec623Till Mossakowski license may contact ISC at <a class="link" href="https://www.isc.org/mission/contact/" target="_top">
a7f97f28aa8227408d4008e0b12a7bd925ef51feKlaus Luettich<div class="titlepage"><div><div><h3 class="title">
a7f97f28aa8227408d4008e0b12a7bd925ef51feKlaus Luettich<a name="relnotes_security"></a>Security Fixes</h3></div></div></div>
a7f97f28aa8227408d4008e0b12a7bd925ef51feKlaus Luettich<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
d432d7594caca8c2587a3ca660c35865538464ceKlaus Luettich It was possible to trigger a assertion when rendering a
d432d7594caca8c2587a3ca660c35865538464ceKlaus Luettich message using a specially crafted request. This flaw is
d432d7594caca8c2587a3ca660c35865538464ceKlaus Luettich disclosed in CVE-2016-2776. [RT #43139]
d432d7594caca8c2587a3ca660c35865538464ceKlaus Luettich getrrsetbyname with a non absolute name could trigger an
d432d7594caca8c2587a3ca660c35865538464ceKlaus Luettich infinite recursion bug in lwresd and named with lwres
d432d7594caca8c2587a3ca660c35865538464ceKlaus Luettich configured if when combined with a search list entry the
a7f97f28aa8227408d4008e0b12a7bd925ef51feKlaus Luettich resulting name is too long. This flaw is disclosed in
f778a0725b6b62370f1ac3f683caf2a3930920d0Klaus Luettich CVE-2016-2775. [RT #42694]
f778a0725b6b62370f1ac3f683caf2a3930920d0Klaus Luettich<div class="titlepage"><div><div><h3 class="title">
f778a0725b6b62370f1ac3f683caf2a3930920d0Klaus Luettich<a name="relnotes_features"></a>New Features</h3></div></div></div>
f778a0725b6b62370f1ac3f683caf2a3930920d0Klaus Luettich<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
f778a0725b6b62370f1ac3f683caf2a3930920d0Klaus Luettich A new method of provisioning secondary servers called
f778a0725b6b62370f1ac3f683caf2a3930920d0Klaus Luettich "Catalog Zones" has been added. This is an implementation of
f778a0725b6b62370f1ac3f683caf2a3930920d0Klaus Luettich <a class="link" href="https://datatracker.ietf.org/doc/draft-muks-dnsop-dns-catalog-zones/" target="_top">
f778a0725b6b62370f1ac3f683caf2a3930920d0Klaus Luettich draft-muks-dnsop-dns-catalog-zones/
f778a0725b6b62370f1ac3f683caf2a3930920d0Klaus Luettich A catalog zone is a regular DNS zone which contains a list
f778a0725b6b62370f1ac3f683caf2a3930920d0Klaus Luettich of "member zones", along with the configuration options for
f778a0725b6b62370f1ac3f683caf2a3930920d0Klaus Luettich each of those zones. When a server is configured to use a
f778a0725b6b62370f1ac3f683caf2a3930920d0Klaus Luettich catalog zone, all the zones listed in the catalog zone are
f778a0725b6b62370f1ac3f683caf2a3930920d0Klaus Luettich added to the local server as slave zones. When the catalog
f778a0725b6b62370f1ac3f683caf2a3930920d0Klaus Luettich zone is updated (e.g., by adding or removing zones, or
f778a0725b6b62370f1ac3f683caf2a3930920d0Klaus Luettich changing configuration options for existing zones) those
f778a0725b6b62370f1ac3f683caf2a3930920d0Klaus Luettich changes will be put into effect. Since the catalog zone is
f778a0725b6b62370f1ac3f683caf2a3930920d0Klaus Luettich itself a DNS zone, this means configuration changes can be
f778a0725b6b62370f1ac3f683caf2a3930920d0Klaus Luettich propagated to slaves using the standard AXFR/IXFR update
a7f97f28aa8227408d4008e0b12a7bd925ef51feKlaus Luettich This feature should be considered experimental. It currently
a7f97f28aa8227408d4008e0b12a7bd925ef51feKlaus Luettich supports only basic features; more advanced features such as
a7f97f28aa8227408d4008e0b12a7bd925ef51feKlaus Luettich ACLs and TSIG keys are not yet supported. Example catalog
a7f97f28aa8227408d4008e0b12a7bd925ef51feKlaus Luettich zone configurations can be found in the Chapter 9 of the
a7f97f28aa8227408d4008e0b12a7bd925ef51feKlaus Luettich BIND Administrator Reference Manual.
a7f97f28aa8227408d4008e0b12a7bd925ef51feKlaus Luettich Support for master entries with TSIG keys has been added to catalog
a7f97f28aa8227408d4008e0b12a7bd925ef51feKlaus Luettich zones, as well as support for allow-query and allow-transfer.
95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder Added an <span class="command"><strong>isc.rndc</strong></span> Python module, which allows
1b05bdb88b90d3c947351f262d7ae7d68f0a4a6fTill Mossakowski <span class="command"><strong>rndc</strong></span> commands to be sent from Python programs.
1b05bdb88b90d3c947351f262d7ae7d68f0a4a6fTill Mossakowski Added support for DynDB, a new interface for loading zone data
21dae7237ac384abdb94a81e00b3f099873ec623Till Mossakowski from an external database, developed by Red Hat for the FreeIPA
21dae7237ac384abdb94a81e00b3f099873ec623Till Mossakowski project. (Thanks in particular to Adam Tkac and Petr
e379124f467e5d0ef7d3c0ca238bff0521f70831Till Mossakowski Spacek of Red Hat for the contribution.)
56cd0da55d058b262b1626ddcd78db6bd9a90551Christian Maeder Unlike the existing DLZ and SDB interfaces, which provide a
e379124f467e5d0ef7d3c0ca238bff0521f70831Till Mossakowski limited subset of database functionality within BIND —
503e836b34d3abed34520eb4a0a345b5e13f248dTill Mossakowski translating DNS queries into real-time database lookups with
e379124f467e5d0ef7d3c0ca238bff0521f70831Till Mossakowski relatively poor performance and with no ability to handle
e379124f467e5d0ef7d3c0ca238bff0521f70831Till Mossakowski DNSSEC-signed data — DynDB is able to fully implement
e379124f467e5d0ef7d3c0ca238bff0521f70831Till Mossakowski and extend the database API used natively by BIND.
e379124f467e5d0ef7d3c0ca238bff0521f70831Till Mossakowski A DynDB module could pre-load data from an external data
e379124f467e5d0ef7d3c0ca238bff0521f70831Till Mossakowski source, then serve it with the same performance and
e379124f467e5d0ef7d3c0ca238bff0521f70831Till Mossakowski functionality as conventional BIND zones, and with the
e379124f467e5d0ef7d3c0ca238bff0521f70831Till Mossakowski ability to take advantage of database features not
95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder available in BIND, such as multi-master replication.
503e836b34d3abed34520eb4a0a345b5e13f248dTill Mossakowski Fetch quotas are now compiled in by default: they
bc2a836a3e05cbfdee8e2acd7a2b5d276d949f61Till Mossakowski no longer require BIND to be configured with
50ea34ea29d0121f3e692b7029b09d28dc7988fdTill Mossakowski <span class="command"><strong>--enable-fetchlimit</strong></span>, as was the case
50ea34ea29d0121f3e692b7029b09d28dc7988fdTill Mossakowski when the feature was introduced in BIND 9.10.3.
50ea34ea29d0121f3e692b7029b09d28dc7988fdTill Mossakowski These quotas limit the queries that are sent by recursive
50ea34ea29d0121f3e692b7029b09d28dc7988fdTill Mossakowski resolvers to authoritative servers experiencing denial-of-service
1b05bdb88b90d3c947351f262d7ae7d68f0a4a6fTill Mossakowski attacks. They can both reduce the harm done to authoritative
1b05bdb88b90d3c947351f262d7ae7d68f0a4a6fTill Mossakowski servers and also avoid the resource exhaustion that can be
21dae7237ac384abdb94a81e00b3f099873ec623Till Mossakowski experienced by recursive servers when they are being used as a
21dae7237ac384abdb94a81e00b3f099873ec623Till Mossakowski vehicle for such an attack.
21dae7237ac384abdb94a81e00b3f099873ec623Till Mossakowski<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: circle; ">
e379124f467e5d0ef7d3c0ca238bff0521f70831Till Mossakowski <code class="option">fetches-per-server</code> limits the number of
95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder simultaneous queries that can be sent to any single
21dae7237ac384abdb94a81e00b3f099873ec623Till Mossakowski authoritative server. The configured value is a starting
e379124f467e5d0ef7d3c0ca238bff0521f70831Till Mossakowski point; it is automatically adjusted downward if the server is
90ac4d9f9cde1e45015fd7eb7111315184f4eda7Till Mossakowski partially or completely non-responsive. The algorithm used to
16f97ebf071c023e0f3148c9b65a0ebf0c4eefceKlaus Luettich adjust the quota can be configured via the
16f97ebf071c023e0f3148c9b65a0ebf0c4eefceKlaus Luettich <code class="option">fetch-quota-params</code> option.
b10d6cef708b7a659f2d3b367e8e0db0d03ae3f5Till Mossakowski <code class="option">fetches-per-zone</code> limits the number of
b10d6cef708b7a659f2d3b367e8e0db0d03ae3f5Till Mossakowski simultaneous queries that can be sent for names within a
b10d6cef708b7a659f2d3b367e8e0db0d03ae3f5Till Mossakowski single domain. (Note: Unlike "fetches-per-server", this
16f97ebf071c023e0f3148c9b65a0ebf0c4eefceKlaus Luettich value is not self-tuning.)
74e82e43f5787027c5d4e523397525a259d6d001Christian Maeder Statistics counters have also been added to track the number
1b05bdb88b90d3c947351f262d7ae7d68f0a4a6fTill Mossakowski of queries affected by these quotas.
1b05bdb88b90d3c947351f262d7ae7d68f0a4a6fTill Mossakowski Added support for <span class="command"><strong>dnstap</strong></span>, a fast,
1b05bdb88b90d3c947351f262d7ae7d68f0a4a6fTill Mossakowski flexible method for capturing and logging DNS traffic,
1b05bdb88b90d3c947351f262d7ae7d68f0a4a6fTill Mossakowski developed by Robert Edmonds at Farsight Security, Inc.,
e182d0ec56025d97d74829cac75ee31eec12b093Maciek Makowski whose assistance is gratefully acknowledged.
90ac4d9f9cde1e45015fd7eb7111315184f4eda7Till Mossakowski To enable <span class="command"><strong>dnstap</strong></span> at compile time,
74e82e43f5787027c5d4e523397525a259d6d001Christian Maeder the <span class="command"><strong>fstrm</strong></span> and <span class="command"><strong>protobuf-c</strong></span>
1b05bdb88b90d3c947351f262d7ae7d68f0a4a6fTill Mossakowski libraries must be available, and BIND must be configured with
1b05bdb88b90d3c947351f262d7ae7d68f0a4a6fTill Mossakowski <code class="option">--enable-dnstap</code>.
320198216ed3bde106b509c4024b857ce4345880Maciek Makowski A new utility <span class="command"><strong>dnstap-read</strong></span> has been added
503e836b34d3abed34520eb4a0a345b5e13f248dTill Mossakowski to allow <span class="command"><strong>dnstap</strong></span> data to be presented in
e182d0ec56025d97d74829cac75ee31eec12b093Maciek Makowski a human-readable format.
320198216ed3bde106b509c4024b857ce4345880Maciek Makowski <span class="command"><strong>rndc dnstap -roll</strong></span> causes <span class="command"><strong>dnstap</strong></span>
320198216ed3bde106b509c4024b857ce4345880Maciek Makowski output files to be rolled like log files -- the most recent output
e182d0ec56025d97d74829cac75ee31eec12b093Maciek Makowski file is renamed with a <code class="filename">.0</code> suffix, the next
e182d0ec56025d97d74829cac75ee31eec12b093Maciek Makowski most recent with <code class="filename">.1</code>, etc. (Note that this
320198216ed3bde106b509c4024b857ce4345880Maciek Makowski only works when <span class="command"><strong>dnstap</strong></span> output is being written
e182d0ec56025d97d74829cac75ee31eec12b093Maciek Makowski to a file, not to a UNIX domain socket.) An optional numerical
e182d0ec56025d97d74829cac75ee31eec12b093Maciek Makowski argument specifies how many backup log files to retain; if not
e182d0ec56025d97d74829cac75ee31eec12b093Maciek Makowski specified or set to 0, there is no limit.
e182d0ec56025d97d74829cac75ee31eec12b093Maciek Makowski <span class="command"><strong>rndc dnstap -reopen</strong></span> simply closes and reopens
320198216ed3bde106b509c4024b857ce4345880Maciek Makowski the <span class="command"><strong>dnstap</strong></span> output channel without renaming
e182d0ec56025d97d74829cac75ee31eec12b093Maciek Makowski the output file.
e182d0ec56025d97d74829cac75ee31eec12b093Maciek Makowski For more information on <span class="command"><strong>dnstap</strong></span>, see
e182d0ec56025d97d74829cac75ee31eec12b093Maciek Makowski <a class="link" href="http://dnstap.info" target="_top">http://dnstap.info</a>.
e182d0ec56025d97d74829cac75ee31eec12b093Maciek Makowski New statistics counters have been added to track traffic
e182d0ec56025d97d74829cac75ee31eec12b093Maciek Makowski sizes, as specified in RSSAC002. Query and response
e182d0ec56025d97d74829cac75ee31eec12b093Maciek Makowski message sizes are broken up into ranges of histogram buckets:
e182d0ec56025d97d74829cac75ee31eec12b093Maciek Makowski TCP and UDP queries of size 0-15, 16-31, ..., 272-288, and 288+,
e182d0ec56025d97d74829cac75ee31eec12b093Maciek Makowski and TCP and UDP responses of size 0-15, 16-31, ..., 4080-4095,
e182d0ec56025d97d74829cac75ee31eec12b093Maciek Makowski and 4096+. These values can be accessed via the XML and JSON
e182d0ec56025d97d74829cac75ee31eec12b093Maciek Makowski statistics channels at, for example,
e182d0ec56025d97d74829cac75ee31eec12b093Maciek Makowski <a class="link" href="http://localhost:8888/xml/v3/traffic" target="_top">http://localhost:8888/xml/v3/traffic</a>
e182d0ec56025d97d74829cac75ee31eec12b093Maciek Makowski <a class="link" href="http://localhost:8888/json/v1/traffic" target="_top">http://localhost:8888/json/v1/traffic</a>.
e182d0ec56025d97d74829cac75ee31eec12b093Maciek Makowski Statistics for RSSAC02v3 traffic-volume, traffic-sizes and
1b05bdb88b90d3c947351f262d7ae7d68f0a4a6fTill Mossakowski rcode-volume reporting are now collected.
e379124f467e5d0ef7d3c0ca238bff0521f70831Till Mossakowski A new DNSSEC key management utility,
1b05bdb88b90d3c947351f262d7ae7d68f0a4a6fTill Mossakowski <span class="command"><strong>dnssec-keymgr</strong></span>, has been added. This tool
21dae7237ac384abdb94a81e00b3f099873ec623Till Mossakowski is meant to run unattended (e.g., under <span class="command"><strong>cron</strong></span>).
e379124f467e5d0ef7d3c0ca238bff0521f70831Till Mossakowski It reads a policy definition file
95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder (default <code class="filename">/etc/dnssec-policy.conf</code>)
95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder and creates or updates DNSSEC keys as necessary to ensure that a
74e82e43f5787027c5d4e523397525a259d6d001Christian Maeder zone's keys match the defined policy for that zone. New keys are
95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder created whenever necessary to ensure rollovers occur correctly.
21dae7237ac384abdb94a81e00b3f099873ec623Till Mossakowski Existing keys' timing metadata is adjusted as needed to set the
c616e681da8c052b62e14247fea522da099ac0e4Christian Maeder correct rollover period, prepublication interval, etc. If
95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder the configured policy changes, keys are corrected automatically.
21dae7237ac384abdb94a81e00b3f099873ec623Till Mossakowski See the <span class="command"><strong>dnssec-keymgr</strong></span> man page for full details.
95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder Note: <span class="command"><strong>dnssec-keymgr</strong></span> depends on Python and on
95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder the Python lex/yacc module, PLY. The other Python-based tools,
95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder <span class="command"><strong>dnssec-coverage</strong></span> and
58b671de3fe578346fef9642ffa3c5a0a0edb3cbTill Mossakowski <span class="command"><strong>dnssec-checkds</strong></span>, have been
58b671de3fe578346fef9642ffa3c5a0a0edb3cbTill Mossakowski refactored and updated as part of this work.
1b05bdb88b90d3c947351f262d7ae7d68f0a4a6fTill Mossakowski <span class="command"><strong>dnssec-keymgr</strong></span> now takes a -r
1b05bdb88b90d3c947351f262d7ae7d68f0a4a6fTill Mossakowski <em class="replaceable"><code>randomfile</code></em> option.
e379124f467e5d0ef7d3c0ca238bff0521f70831Till Mossakowski (Many thanks to Sebasti�n
b10d6cef708b7a659f2d3b367e8e0db0d03ae3f5Till Mossakowski Castro for his assistance in developing this tool at the IETF
e379124f467e5d0ef7d3c0ca238bff0521f70831Till Mossakowski 95 Hackathon in Buenos Aires, April 2016.)
1b05bdb88b90d3c947351f262d7ae7d68f0a4a6fTill Mossakowski The serial number of a dynamically updatable zone can
1b05bdb88b90d3c947351f262d7ae7d68f0a4a6fTill Mossakowski now be set using
b0294d73dcefc502ddaa13e18b46103a5916971fTill Mossakowski <span class="command"><strong>rndc signing -serial <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>zonename</code></em></strong></span>.
1b05bdb88b90d3c947351f262d7ae7d68f0a4a6fTill Mossakowski This is particularly useful with <code class="option">inline-signing</code>
1b05bdb88b90d3c947351f262d7ae7d68f0a4a6fTill Mossakowski zones that have been reset. Setting the serial number to a value
1b05bdb88b90d3c947351f262d7ae7d68f0a4a6fTill Mossakowski larger than that on the slaves will trigger an AXFR-style
58b671de3fe578346fef9642ffa3c5a0a0edb3cbTill Mossakowski When answering recursive queries, SERVFAIL responses can now be
58b671de3fe578346fef9642ffa3c5a0a0edb3cbTill Mossakowski cached by the server for a limited time; subsequent queries for
1b05bdb88b90d3c947351f262d7ae7d68f0a4a6fTill Mossakowski the same query name and type will return another SERVFAIL until
58b671de3fe578346fef9642ffa3c5a0a0edb3cbTill Mossakowski the cache times out. This reduces the frequency of retries
1b05bdb88b90d3c947351f262d7ae7d68f0a4a6fTill Mossakowski when a query is persistently failing, which can be a burden
1b05bdb88b90d3c947351f262d7ae7d68f0a4a6fTill Mossakowski on recursive servers. The SERVFAIL cache timeout is controlled
1b05bdb88b90d3c947351f262d7ae7d68f0a4a6fTill Mossakowski by <code class="option">servfail-ttl</code>, which defaults to 1 second
1b05bdb88b90d3c947351f262d7ae7d68f0a4a6fTill Mossakowski and has an upper limit of 30.
1b05bdb88b90d3c947351f262d7ae7d68f0a4a6fTill Mossakowski The new <span class="command"><strong>rndc nta</strong></span> command can now be used to
1b05bdb88b90d3c947351f262d7ae7d68f0a4a6fTill Mossakowski set a "negative trust anchor" (NTA), disabling DNSSEC validation for
1b05bdb88b90d3c947351f262d7ae7d68f0a4a6fTill Mossakowski a specific domain; this can be used when responses from a domain
e379124f467e5d0ef7d3c0ca238bff0521f70831Till Mossakowski are known to be failing validation due to administrative error
74e82e43f5787027c5d4e523397525a259d6d001Christian Maeder rather than because of a spoofing attack. NTAs are strictly
1b05bdb88b90d3c947351f262d7ae7d68f0a4a6fTill Mossakowski temporary; by default they expire after one hour, but can be
e379124f467e5d0ef7d3c0ca238bff0521f70831Till Mossakowski configured to last up to one week. The default NTA lifetime
e379124f467e5d0ef7d3c0ca238bff0521f70831Till Mossakowski can be changed by setting the <code class="option">nta-lifetime</code> in
1b05bdb88b90d3c947351f262d7ae7d68f0a4a6fTill Mossakowski <code class="filename">named.conf</code>. When added, NTAs are stored in a
1b05bdb88b90d3c947351f262d7ae7d68f0a4a6fTill Mossakowski file (<code class="filename"><em class="replaceable"><code>viewname</code></em>.nta</code>)
1b05bdb88b90d3c947351f262d7ae7d68f0a4a6fTill Mossakowski in order to persist across restarts of the <span class="command"><strong>named</strong></span> server.
95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder The EDNS Client Subnet (ECS) option is now supported for
95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder authoritative servers; if a query contains an ECS option then
95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder ACLs containing <code class="option">geoip</code> or <code class="option">ecs</code>
95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder elements can match against the address encoded in the option.
95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder This can be used to select a view for a query, so that different
95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder answers can be provided depending on the client network.
95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder The EDNS EXPIRE option has been implemented on the client
74e82e43f5787027c5d4e523397525a259d6d001Christian Maeder side, allowing a slave server to set the expiration timer
c616e681da8c052b62e14247fea522da099ac0e4Christian Maeder correctly when transferring zone data from another slave
95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder A new <code class="option">masterfile-style</code> zone option controls
d21dd452cd68abade683103a5c0cfe6d02c5f17bTill Mossakowski the formatting of text zone files: When set to
c616e681da8c052b62e14247fea522da099ac0e4Christian Maeder <code class="literal">full</code>, the zone file will dumped in
95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder single-line-per-record format.
d21dd452cd68abade683103a5c0cfe6d02c5f17bTill Mossakowski <span class="command"><strong>dig +ednsopt</strong></span> can now be used to set
d21dd452cd68abade683103a5c0cfe6d02c5f17bTill Mossakowski arbitrary EDNS options in DNS requests.
95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder <span class="command"><strong>dig +ednsflags</strong></span> can now be used to set
95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder yet-to-be-defined EDNS flags in DNS requests.
95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder <span class="command"><strong>dig +[no]ednsnegotiation</strong></span> can now be used enable /
95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder disable EDNS version negotiation.
95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder <span class="command"><strong>dig +header-only</strong></span> can now be used to send
95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder queries without a question section.
95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder <span class="command"><strong>dig +ttlunits</strong></span> causes <span class="command"><strong>dig</strong></span>
95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder to print TTL values with time-unit suffixes: w, d, h, m, s for
95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder weeks, days, hours, minutes, and seconds.
95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder <span class="command"><strong>dig +zflag</strong></span> can be used to set the last
95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder unassigned DNS header flag bit. This bit is normally zero.
d21dd452cd68abade683103a5c0cfe6d02c5f17bTill Mossakowski <span class="command"><strong>dig +dscp=<em class="replaceable"><code>value</code></em></strong></span>
95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder can now be used to set the DSCP code point in outgoing query
f69658e57cba7ecb37c0d84181f4c563215c2534Till Mossakowski <span class="command"><strong>dig +mapped</strong></span> can now be used to determine
d21dd452cd68abade683103a5c0cfe6d02c5f17bTill Mossakowski if mapped IPv4 addresses can be used.
<span class="command"><strong>named -L <em class="replaceable"><code>filename</code></em></strong></span>
<span class="command"><strong>managed-keys</strong></span>, <span class="command"><strong>dnssec-validation
Updated the compiled-in addresses for H.ROOT-SERVERS.NET
When using native PKCS#11 cryptography (i.e.,
(e.g., when a zone file cannot be loaded) have been clarified
The SIT-related named.conf options have been marked as
Retrieving the local port range from net.ipv4.ip_local_port_range
<strong class="userinput"><code>no</code></strong>, <span class="command"><strong>named</strong></span> will only
<a class="link" href="https://www.isc.org/downloads/software-support-policy/" target="_top">https://www.isc.org/downloads/software-support-policy/</a>