notes.html revision 0da02c26a6631c25f075a8e4ac6de9e58f49a0c2
5347c0fcb04eaea19d9f39795646239f487c6207Tinderbox User - This Source Code Form is subject to the terms of the Mozilla Public
5347c0fcb04eaea19d9f39795646239f487c6207Tinderbox User - License, v. 2.0. If a copy of the MPL was not distributed with this
5347c0fcb04eaea19d9f39795646239f487c6207Tinderbox User - file, You can obtain one at http://mozilla.org/MPL/2.0/.
1c57c3f79db0bf0358bbe6d7b5ad650c0c852f4bTinderbox User<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="article">
f9ce6280cec79deb16ff6d9807aa493ff23e10d9Tinderbox User<div class="titlepage"><div><div><h2 class="title" style="clear: both">
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User<a name="id-1.2"></a>Release Notes for BIND Version 9.11.1b1</h2></div></div></div>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<div class="titlepage"><div><div><h3 class="title">
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<a name="relnotes_intro"></a>Introduction</h3></div></div></div>
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User This document summarizes changes since the last production
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User release on the BIND 9.11 branch.
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User Please see the <code class="filename">CHANGES</code> file for a further
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User list of bug fixes and other changes.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<div class="titlepage"><div><div><h3 class="title">
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<a name="relnotes_download"></a>Download</h3></div></div></div>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt The latest versions of BIND 9 software can always be found at
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User <a class="link" href="http://www.isc.org/downloads/" target="_top">http://www.isc.org/downloads/</a>.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt There you will find additional information about each release,
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt source code, and pre-compiled versions for Microsoft Windows
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt operating systems.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<div class="titlepage"><div><div><h3 class="title">
a1ff871f78b7d907d6fc3a382beea2a640fe8423Tinderbox User<a name="relnotes_license"></a>License Change</h3></div></div></div>
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User With the release of BIND 9.11.0, ISC changed to the open
8a48b6b9b6fa8486f24b22d1972b2b6ebb36a4a4Tinderbox User source license for BIND from the ISC license to the Mozilla
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User Public License (MPL 2.0).
8a48b6b9b6fa8486f24b22d1972b2b6ebb36a4a4Tinderbox User The MPL-2.0 license requires that if you make changes to
8a48b6b9b6fa8486f24b22d1972b2b6ebb36a4a4Tinderbox User licensed software (e.g. BIND) and distribute them outside
8a48b6b9b6fa8486f24b22d1972b2b6ebb36a4a4Tinderbox User your organization, that you publish those changes under that
8a48b6b9b6fa8486f24b22d1972b2b6ebb36a4a4Tinderbox User same license. It does not require that you publish or disclose
8a48b6b9b6fa8486f24b22d1972b2b6ebb36a4a4Tinderbox User anything other than the changes you made to our software.
8a48b6b9b6fa8486f24b22d1972b2b6ebb36a4a4Tinderbox User This new requirement will not affect anyone who is using BIND
8a48b6b9b6fa8486f24b22d1972b2b6ebb36a4a4Tinderbox User without redistributing it, nor anyone redistributing it without
8a48b6b9b6fa8486f24b22d1972b2b6ebb36a4a4Tinderbox User changes, therefore this change will be without consequence
8a48b6b9b6fa8486f24b22d1972b2b6ebb36a4a4Tinderbox User for most individuals and organizations who are using BIND.
8a48b6b9b6fa8486f24b22d1972b2b6ebb36a4a4Tinderbox User Those unsure whether or not the license change affects their
8a48b6b9b6fa8486f24b22d1972b2b6ebb36a4a4Tinderbox User use of BIND, or who wish to discuss how to comply with the
8a48b6b9b6fa8486f24b22d1972b2b6ebb36a4a4Tinderbox User license may contact ISC at <a class="link" href="https://www.isc.org/mission/contact/" target="_top">
a1ff871f78b7d907d6fc3a382beea2a640fe8423Tinderbox User<div class="titlepage"><div><div><h3 class="title">
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<a name="relnotes_security"></a>Security Fixes</h3></div></div></div>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User A coding error in the <code class="option">nxdomain-redirect</code>
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User feature could lead to an assertion failure if the redirection
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User namespace was served from a local authoritative data source
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User such as a local zone or a DLZ instead of via recursive
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User lookup. This flaw is disclosed in CVE-2016-9778. [RT #43837]
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User <span class="command"><strong>named</strong></span> could mishandle authority sections
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User with missing RRSIGs, triggering an assertion failure. This
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User flaw is disclosed in CVE-2016-9444. [RT #43632]
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User <span class="command"><strong>named</strong></span> mishandled some responses where
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User covering RRSIG records were returned without the requested
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User data, resulting in an assertion failure. This flaw is
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User disclosed in CVE-2016-9147. [RT #43548]
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User <span class="command"><strong>named</strong></span> incorrectly tried to cache TKEY
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User records which could trigger an assertion failure when there was
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User a class mismatch. This flaw is disclosed in CVE-2016-9131.
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User It was possible to trigger assertions when processing
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User responses containing answers of type DNAME. This flaw is
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User disclosed in CVE-2016-8864. [RT #43465]
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User Added the ability to specify the maximum number of records
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User permitted in a zone (<code class="option">max-records #;</code>).
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User This provides a mechanism to block overly large zone
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User transfers, which is a potential risk with slave zones from
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User other parties, as described in CVE-2016-6170.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<div class="titlepage"><div><div><h3 class="title">
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<a name="relnotes_changes"></a>Feature Changes</h3></div></div></div>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User Expanded and improved the YAML output from
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User <span class="command"><strong>dnstap-read -y</strong></span>: it now includes packet
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User size and a detailed breakdown of message contents.
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User [RT #43622] [RT #43642]
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User If an ACL is specified with an address prefix in which the
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User prefix length is longer than the address portion (for example,
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User 192.0.2.1/8), <span class="command"><strong>named</strong></span> will now log a warning.
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User In future releases this will be a fatal configuration error.
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User<div class="titlepage"><div><div><h3 class="title">
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User<a name="relnotes_bugs"></a>Bug Fixes</h3></div></div></div>
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User Referencing a nonexistent zone in a <span class="command"><strong>response-policy</strong></span>
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User statement could cause an assertion failure during configuration.
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User <span class="command"><strong>rndc addzone</strong></span> could cause a crash
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User when attempting to add a zone with a type other than
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User <span class="command"><strong>master</strong></span> or <span class="command"><strong>slave</strong></span>.
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User Such zones are now rejected. [RT #43665]
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User <span class="command"><strong>named</strong></span> could hang when encountering log
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User file names with large apparent gaps in version number (for
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User example, when files exist called "logfile.0", "logfile.1",
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User and "logfile.1482954169"). This is now handled correctly.
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User If a zone was updated while <span class="command"><strong>named</strong></span> was
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User processing a query for nonexistent data, it could return
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User out-of-sync NSEC3 records causing potential DNSSEC validation
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User failure. [RT #43247]
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<div class="titlepage"><div><div><h3 class="title">
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User<a name="relnotes_maint"></a>Maintenance</h3></div></div></div>
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User The built-in root hints have been updated to include an
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User IPv6 address (2001:500:12::d0d) for G.ROOT-SERVERS.NET.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<div class="titlepage"><div><div><h3 class="title">
ffe29868b4bbc64953fc5d0de51f988c20158967Tinderbox User<a name="relnotes_misc"></a>Miscellaneous Notes</h3></div></div></div>
ffe29868b4bbc64953fc5d0de51f988c20158967Tinderbox User <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
ffe29868b4bbc64953fc5d0de51f988c20158967Tinderbox User Authoritative server support for the EDNS Client Subnet option
ffe29868b4bbc64953fc5d0de51f988c20158967Tinderbox User (ECS), introduced in BIND 9.11.0, was based on an early version
ffe29868b4bbc64953fc5d0de51f988c20158967Tinderbox User of the specification, and is now known to have incompatibilities
ffe29868b4bbc64953fc5d0de51f988c20158967Tinderbox User with other ECS implementations. It is also inefficient, requiring
ffe29868b4bbc64953fc5d0de51f988c20158967Tinderbox User a separate view for each answer, and is unable to correct for
ffe29868b4bbc64953fc5d0de51f988c20158967Tinderbox User overlapping subnets in the configuration. It is intended for
ffe29868b4bbc64953fc5d0de51f988c20158967Tinderbox User testing purposes but is not recommended for for production use.
ffe29868b4bbc64953fc5d0de51f988c20158967Tinderbox User This was not made sufficiently clear in the documentation at
ffe29868b4bbc64953fc5d0de51f988c20158967Tinderbox User the time of release.
ffe29868b4bbc64953fc5d0de51f988c20158967Tinderbox User<div class="titlepage"><div><div><h3 class="title">
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<a name="end_of_life"></a>End of Life</h3></div></div></div>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt The end of life for BIND 9.11 is yet to be determined but
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt will not be before BIND 9.13.0 has been released for 6 months.
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User <a class="link" href="https://www.isc.org/downloads/software-support-policy/" target="_top">https://www.isc.org/downloads/software-support-policy/</a>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<div class="titlepage"><div><div><h3 class="title">
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<a name="relnotes_thanks"></a>Thank You</h3></div></div></div>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt Thank you to everyone who assisted us in making this release possible.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt If you would like to contribute to ISC to assist us in continuing to
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt make quality open source software, please visit our donations page at
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User <a class="link" href="http://www.isc.org/donate/" target="_top">http://www.isc.org/donate/</a>.