notes.html revision 2acf9aa8ffa476bee7003fd788539ed714733464
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock - This Source Code Form is subject to the terms of the Mozilla Public
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock - License, v. 2.0. If a copy of the MPL was not distributed with this
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock - file, You can obtain one at http://mozilla.org/MPL/2.0/.
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock<!-- $Id$ -->
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="article">
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock<div class="titlepage"><div><div><h2 class="title" style="clear: both">
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock<a name="id-1.2"></a>Release Notes for BIND Version 9.11.1b1</h2></div></div></div>
6809eb4e2a4a94bcc76229c7b5108b96134537b6Eric Schrock<a name="relnotes_intro"></a>Introduction</h3></div></div></div>
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock This document summarizes changes since the last production
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock release on the BIND 9.11 branch.
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock Please see the <code class="filename">CHANGES</code> file for a further
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock list of bug fixes and other changes.
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock<a name="relnotes_download"></a>Download</h3></div></div></div>
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock The latest versions of BIND 9 software can always be found at
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock <a class="link" href="http://www.isc.org/downloads/" target="_top">http://www.isc.org/downloads/</a>.
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock There you will find additional information about each release,
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock source code, and pre-compiled versions for Microsoft Windows
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock operating systems.
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock<a name="relnotes_license"></a>License Change</h3></div></div></div>
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock With the release of BIND 9.11.0, ISC changed to the open
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock source license for BIND from the ISC license to the Mozilla
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock Public License (MPL 2.0).
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock The MPL-2.0 license requires that if you make changes to
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock licensed software (e.g. BIND) and distribute them outside
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock your organization, that you publish those changes under that
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock same license. It does not require that you publish or disclose
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock anything other than the changes you made to our software.
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock This new requirement will not affect anyone who is using BIND
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock without redistributing it, nor anyone redistributing it without
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock changes, therefore this change will be without consequence
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock for most individuals and organizations who are using BIND.
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock Those unsure whether or not the license change affects their
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock use of BIND, or who wish to discuss how to comply with the
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock license may contact ISC at <a class="link" href="https://www.isc.org/mission/contact/" target="_top">
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock<a name="relnotes_security"></a>Security Fixes</h3></div></div></div>
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock If a server is configured with a response policy zone (RPZ)
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock that rewrites an answer with local data, and is also configured
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock for DNS64 address mapping, a NULL pointer can be read
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock triggering a server crash. This flaw is disclosed in
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock CVE-2017-3135. [RT #44434]
e14bb3258d05c1b1077e2db7cf77088924e56919Jeff Bonwick A coding error in the <code class="option">nxdomain-redirect</code>
e14bb3258d05c1b1077e2db7cf77088924e56919Jeff Bonwick feature could lead to an assertion failure if the redirection
e14bb3258d05c1b1077e2db7cf77088924e56919Jeff Bonwick namespace was served from a local authoritative data source
e14bb3258d05c1b1077e2db7cf77088924e56919Jeff Bonwick such as a local zone or a DLZ instead of via recursive
22fe2c8844be88ebae6478ca1b0b92c8ec2aef54Jonathan Adams lookup. This flaw is disclosed in CVE-2016-9778. [RT #43837]
22fe2c8844be88ebae6478ca1b0b92c8ec2aef54Jonathan Adams <span class="command"><strong>named</strong></span> could mishandle authority sections
22fe2c8844be88ebae6478ca1b0b92c8ec2aef54Jonathan Adams with missing RRSIGs, triggering an assertion failure. This
22fe2c8844be88ebae6478ca1b0b92c8ec2aef54Jonathan Adams flaw is disclosed in CVE-2016-9444. [RT #43632]
22fe2c8844be88ebae6478ca1b0b92c8ec2aef54Jonathan Adams <span class="command"><strong>named</strong></span> mishandled some responses where
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock covering RRSIG records were returned without the requested
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock data, resulting in an assertion failure. This flaw is
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock disclosed in CVE-2016-9147. [RT #43548]
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock <span class="command"><strong>named</strong></span> incorrectly tried to cache TKEY
468c413a79615e77179e8d98f22a7e513a8135bdTim Haley records which could trigger an assertion failure when there was
468c413a79615e77179e8d98f22a7e513a8135bdTim Haley a class mismatch. This flaw is disclosed in CVE-2016-9131.
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock [RT #43522]
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock It was possible to trigger assertions when processing
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock responses containing answers of type DNAME. This flaw is
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock disclosed in CVE-2016-8864. [RT #43465]
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock Added the ability to specify the maximum number of records
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock permitted in a zone (<code class="option">max-records #;</code>).
bf82a41b568b2bd31bf9814587eb25ee2e7b05ffeschrock This provides a mechanism to block overly large zone
bf82a41b568b2bd31bf9814587eb25ee2e7b05ffeschrock transfers, which is a potential risk with slave zones from
bf82a41b568b2bd31bf9814587eb25ee2e7b05ffeschrock other parties, as described in CVE-2016-6170.
bf82a41b568b2bd31bf9814587eb25ee2e7b05ffeschrock [RT #42143]
bf82a41b568b2bd31bf9814587eb25ee2e7b05ffeschrock<a name="relnotes_changes"></a>Feature Changes</h3></div></div></div>
bf82a41b568b2bd31bf9814587eb25ee2e7b05ffeschrock <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
51ece83525fa18f5e72627610f480dffc7e492fdeschrock Expanded and improved the YAML output from
8956713aded83a741173fcd4f9ef1c83521fbea9Eric Schrock <span class="command"><strong>dnstap-read -y</strong></span>: it now includes packet
8956713aded83a741173fcd4f9ef1c83521fbea9Eric Schrock size and a detailed breakdown of message contents.
8956713aded83a741173fcd4f9ef1c83521fbea9Eric Schrock [RT #43622] [RT #43642]
8956713aded83a741173fcd4f9ef1c83521fbea9Eric Schrock If an ACL is specified with an address prefix in which the
8956713aded83a741173fcd4f9ef1c83521fbea9Eric Schrock prefix length is longer than the address portion (for example,
6809eb4e2a4a94bcc76229c7b5108b96134537b6Eric Schrock 192.0.2.1/8), <span class="command"><strong>named</strong></span> will now log a warning.
6809eb4e2a4a94bcc76229c7b5108b96134537b6Eric Schrock In future releases this will be a fatal configuration error.
6809eb4e2a4a94bcc76229c7b5108b96134537b6Eric Schrock<div class="titlepage"><div><div><h3 class="title">
1d7132005da8d75994a6ad204e6ec05ef5ffaa4bEric Schrock<a name="relnotes_bugs"></a>Bug Fixes</h3></div></div></div>
6809eb4e2a4a94bcc76229c7b5108b96134537b6Eric Schrock <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
6809eb4e2a4a94bcc76229c7b5108b96134537b6Eric Schrock A synthesized CNAME record appearing in a response before the
6809eb4e2a4a94bcc76229c7b5108b96134537b6Eric Schrock associated DNAME could be cached, when it should not have been.
6809eb4e2a4a94bcc76229c7b5108b96134537b6Eric Schrock This was a regression introduced while addressing CVE-2016-8864.
6809eb4e2a4a94bcc76229c7b5108b96134537b6Eric Schrock Named could deadlock there were multiple changes to
bf82a41b568b2bd31bf9814587eb25ee2e7b05ffeschrock NSEC/NSEC3 parameters for a zone being processed at the
b468a217b67dc26ce21da5d5a2ca09bb6249e4faeschrock same time. [RT #42770]
1d7132005da8d75994a6ad204e6ec05ef5ffaa4bEric Schrock Named could trigger a assertion when sending notify
1d7132005da8d75994a6ad204e6ec05ef5ffaa4bEric Schrock messages. [RT #44019]
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock Referencing a nonexistent zone in a <span class="command"><strong>response-policy</strong></span>
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock statement could cause an assertion failure during configuration.
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock [RT #43787]
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock <span class="command"><strong>rndc addzone</strong></span> could cause a crash
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock when attempting to add a zone with a type other than
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock <span class="command"><strong>master</strong></span> or <span class="command"><strong>slave</strong></span>.
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock Such zones are now rejected. [RT #43665]
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock <span class="command"><strong>named</strong></span> could hang when encountering log
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock file names with large apparent gaps in version number (for
b16da2e29e074fb6eaeadc4fd7d17ae7340ba240George Wilson example, when files exist called "logfile.0", "logfile.1",
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock and "logfile.1482954169"). This is now handled correctly.
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock [RT #38688]
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock If a zone was updated while <span class="command"><strong>named</strong></span> was
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock processing a query for nonexistent data, it could return
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock out-of-sync NSEC3 records causing potential DNSSEC validation
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock failure. [RT #43247]
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock<a name="relnotes_maint"></a>Maintenance</h3></div></div></div>
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock The built-in root hints have been updated to include an
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock IPv6 address (2001:500:12::d0d) for G.ROOT-SERVERS.NET.
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock<a name="relnotes_misc"></a>Miscellaneous Notes</h3></div></div></div>
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock Authoritative server support for the EDNS Client Subnet option
e14bb3258d05c1b1077e2db7cf77088924e56919Jeff Bonwick (ECS), introduced in BIND 9.11.0, was based on an early version
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock of the specification, and is now known to have incompatibilities
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock with other ECS implementations. It is also inefficient, requiring
b16da2e29e074fb6eaeadc4fd7d17ae7340ba240George Wilson a separate view for each answer, and is unable to correct for
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock overlapping subnets in the configuration. It is intended for
32b87932f3ef0887d873b7f6d2d1943799b2afc0ek testing purposes but is not recommended for for production use.
32b87932f3ef0887d873b7f6d2d1943799b2afc0ek This was not made sufficiently clear in the documentation at
32b87932f3ef0887d873b7f6d2d1943799b2afc0ek the time of release.
32b87932f3ef0887d873b7f6d2d1943799b2afc0ek<a name="end_of_life"></a>End of Life</h3></div></div></div>
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock The end of life for BIND 9.11 is yet to be determined but
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock will not be before BIND 9.13.0 has been released for 6 months.
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock <a class="link" href="https://www.isc.org/downloads/software-support-policy/" target="_top">https://www.isc.org/downloads/software-support-policy/</a>
6809eb4e2a4a94bcc76229c7b5108b96134537b6Eric Schrock<div class="titlepage"><div><div><h3 class="title">
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock<a name="relnotes_thanks"></a>Thank You</h3></div></div></div>
6809eb4e2a4a94bcc76229c7b5108b96134537b6Eric Schrock Thank you to everyone who assisted us in making this release possible.
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock If you would like to contribute to ISC to assist us in continuing to
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock make quality open source software, please visit our donations page at
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock <a class="link" href="http://www.isc.org/donate/" target="_top">http://www.isc.org/donate/</a>.