notes.html revision a4240242cd6514aa04fae0d53fea7c983b4134d9
d6fa26d0adaec6c910115be34fe7a5a5f402c14fMark Andrews<!--
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews -
71cef386fae61275b03e203825680b39fedaa8c6Tinderbox User - This Source Code Form is subject to the terms of the Mozilla Public
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews - License, v. 2.0. If a copy of the MPL was not distributed with this
5347c0fcb04eaea19d9f39795646239f487c6207Tinderbox User - file, You can obtain one at http://mozilla.org/MPL/2.0/.
5347c0fcb04eaea19d9f39795646239f487c6207Tinderbox User-->
5347c0fcb04eaea19d9f39795646239f487c6207Tinderbox User<html>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<head>
d6fa26d0adaec6c910115be34fe7a5a5f402c14fMark Andrews<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<title></title>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
cd32f419a8a5432fbb139f56ee73cbf68b9350ccTinderbox User</head>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="article">
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <div class="section">
cd32f419a8a5432fbb139f56ee73cbf68b9350ccTinderbox User<div class="titlepage"><div><div><h2 class="title" style="clear: both">
cd32f419a8a5432fbb139f56ee73cbf68b9350ccTinderbox User<a name="id-1.2"></a>Release Notes for BIND Version 9.11.1rc1</h2></div></div></div>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <div class="section">
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<div class="titlepage"><div><div><h3 class="title">
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<a name="relnotes_intro"></a>Introduction</h3></div></div></div>
cd32f419a8a5432fbb139f56ee73cbf68b9350ccTinderbox User <p>
cd32f419a8a5432fbb139f56ee73cbf68b9350ccTinderbox User This document summarizes changes since the last production
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews release on the BIND 9.11 branch.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews Please see the <code class="filename">CHANGES</code> file for a further
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews list of bug fixes and other changes.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </p>
cd32f419a8a5432fbb139f56ee73cbf68b9350ccTinderbox User </div>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <div class="section">
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<div class="titlepage"><div><div><h3 class="title">
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<a name="relnotes_download"></a>Download</h3></div></div></div>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <p>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User The latest versions of BIND 9 software can always be found at
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User <a class="link" href="http://www.isc.org/downloads/" target="_top">http://www.isc.org/downloads/</a>.
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User There you will find additional information about each release,
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User source code, and pre-compiled versions for Microsoft Windows
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User operating systems.
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User </p>
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User </div>
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User <div class="section">
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User<div class="titlepage"><div><div><h3 class="title">
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User<a name="relnotes_license"></a>License Change</h3></div></div></div>
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User <p>
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User With the release of BIND 9.11.0, ISC changed to the open
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User source license for BIND from the ISC license to the Mozilla
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User Public License (MPL 2.0).
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User </p>
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User <p>
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User The MPL-2.0 license requires that if you make changes to
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User licensed software (e.g. BIND) and distribute them outside
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User your organization, that you publish those changes under that
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User same license. It does not require that you publish or disclose
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User anything other than the changes you made to our software.
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User </p>
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User <p>
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User This new requirement will not affect anyone who is using BIND
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User without redistributing it, nor anyone redistributing it without
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User changes, therefore this change will be without consequence
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User for most individuals and organizations who are using BIND.
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User </p>
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User <p>
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User Those unsure whether or not the license change affects their
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User use of BIND, or who wish to discuss how to comply with the
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User license may contact ISC at <a class="link" href="https://www.isc.org/mission/contact/" target="_top">
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User https://www.isc.org/mission/contact/</a>.
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User </p>
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User </div>
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User <div class="section">
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<div class="titlepage"><div><div><h3 class="title">
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User<a name="relnotes_security"></a>Security Fixes</h3></div></div></div>
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User<li class="listitem">
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User <p>
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User If a server is configured with a response policy zone (RPZ)
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User that rewrites an answer with local data, and is also configured
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User for DNS64 address mapping, a NULL pointer can be read
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User triggering a server crash. This flaw is disclosed in
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User CVE-2017-3135. [RT #44434]
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User </p>
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User </li>
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User<li class="listitem">
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User <p>
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User A coding error in the <code class="option">nxdomain-redirect</code>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User feature could lead to an assertion failure if the redirection
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User namespace was served from a local authoritative data source
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User such as a local zone or a DLZ instead of via recursive
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User lookup. This flaw is disclosed in CVE-2016-9778. [RT #43837]
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User </p>
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User </li>
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User<li class="listitem">
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User <p>
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User <span class="command"><strong>named</strong></span> could mishandle authority sections
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User with missing RRSIGs, triggering an assertion failure. This
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User flaw is disclosed in CVE-2016-9444. [RT #43632]
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User </p>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User </li>
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User<li class="listitem">
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User <p>
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User <span class="command"><strong>named</strong></span> mishandled some responses where
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User covering RRSIG records were returned without the requested
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User data, resulting in an assertion failure. This flaw is
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User disclosed in CVE-2016-9147. [RT #43548]
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User </p>
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User </li>
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User<li class="listitem">
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User <p>
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User <span class="command"><strong>named</strong></span> incorrectly tried to cache TKEY
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User records which could trigger an assertion failure when there was
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User a class mismatch. This flaw is disclosed in CVE-2016-9131.
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User [RT #43522]
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User </p>
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User </li>
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User<li class="listitem">
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <p>
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User It was possible to trigger assertions when processing
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User responses containing answers of type DNAME. This flaw is
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User disclosed in CVE-2016-8864. [RT #43465]
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User </p>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User </li>
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User<li class="listitem">
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User <p>
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User Added the ability to specify the maximum number of records
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User permitted in a zone (<code class="option">max-records #;</code>).
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User This provides a mechanism to block overly large zone
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User transfers, which is a potential risk with slave zones from
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User other parties, as described in CVE-2016-6170.
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User [RT #42143]
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User </p>
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User </li>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User</ul></div>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </div>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <div class="section">
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<div class="titlepage"><div><div><h3 class="title">
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<a name="relnotes_changes"></a>Feature Changes</h3></div></div></div>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<li class="listitem">
cd32f419a8a5432fbb139f56ee73cbf68b9350ccTinderbox User <p>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews The built in mangaged keys for the global root zone have been
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews updated to include the upcoming key signing key (keyid 20326).
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </p>
cd32f419a8a5432fbb139f56ee73cbf68b9350ccTinderbox User </li>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<li class="listitem">
cd32f419a8a5432fbb139f56ee73cbf68b9350ccTinderbox User <p>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews Expanded and improved the YAML output from
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <span class="command"><strong>dnstap-read -y</strong></span>: it now includes packet
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews size and a detailed breakdown of message contents.
c313914d0e66b20969215e519bbf2ab4ecf39512Tinderbox User [RT #43622] [RT #43642]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </p>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </li>
<li class="listitem">
<p>
If an ACL is specified with an address prefix in which the
prefix length is longer than the address portion (for example,
192.0.2.1/8), <span class="command"><strong>named</strong></span> will now log a warning.
In future releases this will be a fatal configuration error.
[RT #43367]
</p>
</li>
</ul></div>
</div>
<div class="section">
<div class="titlepage"><div><div><h3 class="title">
<a name="relnotes_bugs"></a>Bug Fixes</h3></div></div></div>
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
<li class="listitem">
<p>
A synthesized CNAME record appearing in a response before the
associated DNAME could be cached, when it should not have been.
This was a regression introduced while addressing CVE-2016-8864.
[RT #44318]
</p>
</li>
<li class="listitem">
<p>
Named could deadlock there were multiple changes to
NSEC/NSEC3 parameters for a zone being processed at the
same time. [RT #42770]
</p>
</li>
<li class="listitem">
<p>
Named could trigger a assertion when sending notify
messages. [RT #44019]
</p>
</li>
<li class="listitem">
<p>
Referencing a nonexistent zone in a <span class="command"><strong>response-policy</strong></span>
statement could cause an assertion failure during configuration.
[RT #43787]
</p>
</li>
<li class="listitem">
<p>
<span class="command"><strong>rndc addzone</strong></span> could cause a crash
when attempting to add a zone with a type other than
<span class="command"><strong>master</strong></span> or <span class="command"><strong>slave</strong></span>.
Such zones are now rejected. [RT #43665]
</p>
</li>
<li class="listitem">
<p>
<span class="command"><strong>named</strong></span> could hang when encountering log
file names with large apparent gaps in version number (for
example, when files exist called "logfile.0", "logfile.1",
and "logfile.1482954169"). This is now handled correctly.
[RT #38688]
</p>
</li>
<li class="listitem">
<p>
If a zone was updated while <span class="command"><strong>named</strong></span> was
processing a query for nonexistent data, it could return
out-of-sync NSEC3 records causing potential DNSSEC validation
failure. [RT #43247]
</p>
</li>
</ul></div>
</div>
<div class="section">
<div class="titlepage"><div><div><h3 class="title">
<a name="relnotes_maint"></a>Maintenance</h3></div></div></div>
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
<p>
The built-in root hints have been updated to include an
IPv6 address (2001:500:12::d0d) for G.ROOT-SERVERS.NET.
</p>
</li></ul></div>
</div>
<div class="section">
<div class="titlepage"><div><div><h3 class="title">
<a name="relnotes_misc"></a>Miscellaneous Notes</h3></div></div></div>
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
<p>
Authoritative server support for the EDNS Client Subnet option
(ECS), introduced in BIND 9.11.0, was based on an early version
of the specification, and is now known to have incompatibilities
with other ECS implementations. It is also inefficient, requiring
a separate view for each answer, and is unable to correct for
overlapping subnets in the configuration. It is intended for
testing purposes but is not recommended for for production use.
This was not made sufficiently clear in the documentation at
the time of release.
</p>
</li></ul></div>
</div>
<div class="section">
<div class="titlepage"><div><div><h3 class="title">
<a name="end_of_life"></a>End of Life</h3></div></div></div>
<p>
The end of life for BIND 9.11 is yet to be determined but
will not be before BIND 9.13.0 has been released for 6 months.
<a class="link" href="https://www.isc.org/downloads/software-support-policy/" target="_top">https://www.isc.org/downloads/software-support-policy/</a>
</p>
</div>
<div class="section">
<div class="titlepage"><div><div><h3 class="title">
<a name="relnotes_thanks"></a>Thank You</h3></div></div></div>
<p>
Thank you to everyone who assisted us in making this release possible.
If you would like to contribute to ISC to assist us in continuing to
make quality open source software, please visit our donations page at
<a class="link" href="http://www.isc.org/donate/" target="_top">http://www.isc.org/donate/</a>.
</p>
</div>
</div>
</div></body>
</html>