75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt<?xml version="1.0" encoding="utf-8"?>

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt<sect1 xmlns:xi="http://www.w3.org/2001/XInclude">

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt <xi:include href="noteversion.xml"/>

99f6179191e583d23f3c5567d3c00b57b64eb52dEvan Hunt <sect2 id="relnotes_intro">

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt <title>Introduction</title>

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt <para>

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt This document summarizes changes since the last production release

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt of BIND on the corresponding major release branch.

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt </para>

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt </sect2>

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt <sect2 id="relnotes_download">

39f2d1a96a7c7494b1db0ea0f45e063a6a5ef9bbEvan Hunt <title>Download</title>

99f6179191e583d23f3c5567d3c00b57b64eb52dEvan Hunt <para>

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt The latest versions of BIND 9 software can always be found at

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt <ulink url="http://www.isc.org/downloads/"

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt >http://www.isc.org/downloads/</ulink>.

e11a0c114cdaf8f7e7832e9f1a011138248093a6Evan Hunt There you will find additional information about each release,

4eb998928b9aef0ceda42d7529980d658138698aEvan Hunt source code, and pre-compiled versions for Microsoft Windows

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt operating systems.

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt </para>

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt </sect2>

e11a0c114cdaf8f7e7832e9f1a011138248093a6Evan Hunt <sect2 id="relnotes_security">

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt <title>Security Fixes</title>

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt <itemizedlist>

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt <listitem>

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt <para>

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt On servers configured to perform DNSSEC validation using

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt managed trust anchors (i.e., keys configured explicitly

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt via <command>managed-keys</command>, or implicitly

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt via <command>dnssec-validation auto;</command> or

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt <command>dnssec-lookaside auto;</command>), revoking

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt a trust anchor and sending a new untrusted replacement

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt could cause <command>named</command> to crash with an

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt assertion failure. This could occur in the event of a

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt botched key rollover, or potentially as a result of a

e11a0c114cdaf8f7e7832e9f1a011138248093a6Evan Hunt deliberate attack if the attacker was in position to

e11a0c114cdaf8f7e7832e9f1a011138248093a6Evan Hunt monitor the victim's DNS traffic.

e11a0c114cdaf8f7e7832e9f1a011138248093a6Evan Hunt </para>

e11a0c114cdaf8f7e7832e9f1a011138248093a6Evan Hunt <para>

e11a0c114cdaf8f7e7832e9f1a011138248093a6Evan Hunt This flaw was discovered by Jan-Piet Mens, and is

e11a0c114cdaf8f7e7832e9f1a011138248093a6Evan Hunt disclosed in CVE-2015-1349. [RT #38344]

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt </para>

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt </listitem>

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt <listitem>

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt <para>

e11a0c114cdaf8f7e7832e9f1a011138248093a6Evan Hunt A flaw in delegation handling could be exploited to put

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt <command>named</command> into an infinite loop, in which

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt each lookup of a name server triggered additional lookups

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt of more name servers. This has been addressed by placing

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt limits on the number of levels of recursion

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt <command>named</command> will allow (default 7), and

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt on the number of queries that it will send before

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt terminating a recursive query (default 50).

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt </para>

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt <para>

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt The recursion depth limit is configured via the

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt <option>max-recursion-depth</option> option, and the query limit

e11a0c114cdaf8f7e7832e9f1a011138248093a6Evan Hunt via the <option>max-recursion-queries</option> option.

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt </para>

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt <para>

79ce3a9e82384cc31fd6b86be8f3d1474fcfd9f4Evan Hunt The flaw was discovered by Florian Maury of ANSSI, and is

79ce3a9e82384cc31fd6b86be8f3d1474fcfd9f4Evan Hunt disclosed in CVE-2014-8500. [RT #37580]

79ce3a9e82384cc31fd6b86be8f3d1474fcfd9f4Evan Hunt </para>

79ce3a9e82384cc31fd6b86be8f3d1474fcfd9f4Evan Hunt </listitem>

79ce3a9e82384cc31fd6b86be8f3d1474fcfd9f4Evan Hunt <listitem>

79ce3a9e82384cc31fd6b86be8f3d1474fcfd9f4Evan Hunt <para>

79ce3a9e82384cc31fd6b86be8f3d1474fcfd9f4Evan Hunt Two separate problems were identified in BIND's GeoIP code that

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt could lead to an assertion failure. One was triggered by use of

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt both IPv4 and IPv6 address families, the other by referencing

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt a GeoIP database in <filename>named.conf</filename> which was

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt not installed. Both are covered by CVE-2014-8680. [RT #37672]

e11a0c114cdaf8f7e7832e9f1a011138248093a6Evan Hunt [RT #37679]

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt </para>

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt <para>

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt A less serious security flaw was also found in GeoIP: changes

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt to the <command>geoip-directory</command> option in

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt <filename>named.conf</filename> were ignored when running

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt <command>rndc reconfig</command>. In theory, this could allow

e11a0c114cdaf8f7e7832e9f1a011138248093a6Evan Hunt <command>named</command> to allow access to unintended clients.

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt </para>

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt </listitem>

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt </itemizedlist>

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt </sect2>

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt <sect2 id="relnotes_features">

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt <title>New Features</title>

e11a0c114cdaf8f7e7832e9f1a011138248093a6Evan Hunt <itemizedlist>

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt <listitem>

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt <para>

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt The serial number of a dynamically updatable zone can

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt now be set using

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt <command>rndc signing -serial <replaceable>number</replaceable> <replaceable>zonename</replaceable></command>.

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt This is particularly useful with <option>inline-signing</option>

e11a0c114cdaf8f7e7832e9f1a011138248093a6Evan Hunt zones that have been reset. Setting the serial number to a value

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt larger than that on the slaves will trigger an AXFR-style

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt transfer.

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt </para>

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt </listitem>

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt <listitem>

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt <para>

e11a0c114cdaf8f7e7832e9f1a011138248093a6Evan Hunt When answering recursive queries, SERVFAIL responses can now be

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt cached by the server for a limited time; subsequent queries for

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt the same query name and type will return another SERVFAIL until

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt the cache times out. This reduces the frequency of retries

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt when a query is persistently failing, which can be a burden

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt on recursive serviers. The SERVFAIL cache timeout is controlled

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt by <option>servfail-ttl</option>, which defaults to 10 seconds

e11a0c114cdaf8f7e7832e9f1a011138248093a6Evan Hunt and has an upper limit of 30.

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt </para>

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt </listitem>

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt <listitem>

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt <para>

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt The new <command>rndc nta</command> command can now be used to

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt set a "negative trust anchor" (NTA), disabling DNSSEC validation for

e11a0c114cdaf8f7e7832e9f1a011138248093a6Evan Hunt a specific domain; this can be used when responses from a domain

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt are known to be failing validation due to administrative error

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt rather than because of a spoofing attack. NTAs are strictly

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt temporary; by default they expire after one hour, but can be

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt configured to last up to one week. The default NTA lifetime

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt can be changed by setting the <option>nta-lifetime</option> in

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt <filename>named.conf</filename>. When added, NTAs are stored in a

e11a0c114cdaf8f7e7832e9f1a011138248093a6Evan Hunt file (<filename><replaceable>viewname</replaceable>.nta</filename>)

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt in order to persist across restarts of the named server.

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt </para>

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt </listitem>

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt <listitem>

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt <para>

e11a0c114cdaf8f7e7832e9f1a011138248093a6Evan Hunt The EDNS Client Subnet (ECS) option is now supported for

e11a0c114cdaf8f7e7832e9f1a011138248093a6Evan Hunt authoritative servers; if a query contains an ECS option then

e11a0c114cdaf8f7e7832e9f1a011138248093a6Evan Hunt ACLs containing <option>geoip</option> or <option>ecs</option>

e11a0c114cdaf8f7e7832e9f1a011138248093a6Evan Hunt elements can match against the the address encoded in the option.

e11a0c114cdaf8f7e7832e9f1a011138248093a6Evan Hunt This can be used to select a view for a query, so that different

e11a0c114cdaf8f7e7832e9f1a011138248093a6Evan Hunt answers can be provided depending on the client network.

e11a0c114cdaf8f7e7832e9f1a011138248093a6Evan Hunt </para>

e11a0c114cdaf8f7e7832e9f1a011138248093a6Evan Hunt </listitem>

e11a0c114cdaf8f7e7832e9f1a011138248093a6Evan Hunt <listitem>

e11a0c114cdaf8f7e7832e9f1a011138248093a6Evan Hunt <para>

e11a0c114cdaf8f7e7832e9f1a011138248093a6Evan Hunt The EDNS EXPIRE option has been implemented on the client

e11a0c114cdaf8f7e7832e9f1a011138248093a6Evan Hunt side, allowing a slave server to set the expiration timer

e11a0c114cdaf8f7e7832e9f1a011138248093a6Evan Hunt correctly when transferring zone data from another slave

e11a0c114cdaf8f7e7832e9f1a011138248093a6Evan Hunt server.

e11a0c114cdaf8f7e7832e9f1a011138248093a6Evan Hunt </para>

e11a0c114cdaf8f7e7832e9f1a011138248093a6Evan Hunt </listitem>

e11a0c114cdaf8f7e7832e9f1a011138248093a6Evan Hunt <listitem>

e11a0c114cdaf8f7e7832e9f1a011138248093a6Evan Hunt <para>

e11a0c114cdaf8f7e7832e9f1a011138248093a6Evan Hunt A new <option>masterfile-style</option> zone option controls

e11a0c114cdaf8f7e7832e9f1a011138248093a6Evan Hunt the formatting of text zone files: When set to

e11a0c114cdaf8f7e7832e9f1a011138248093a6Evan Hunt <literal>full</literal>, the zone file will dumped in

e11a0c114cdaf8f7e7832e9f1a011138248093a6Evan Hunt single-line-per-record format.

e11a0c114cdaf8f7e7832e9f1a011138248093a6Evan Hunt </para>

e11a0c114cdaf8f7e7832e9f1a011138248093a6Evan Hunt </listitem>

e11a0c114cdaf8f7e7832e9f1a011138248093a6Evan Hunt <listitem>

5ae2eac4c16bdbbef032544bd9fc86f47e7bdc2cMark Andrews <para>

5ae2eac4c16bdbbef032544bd9fc86f47e7bdc2cMark Andrews <command>dig +ednsopt</command> can now be used to set

5ae2eac4c16bdbbef032544bd9fc86f47e7bdc2cMark Andrews arbitrary EDNS options in DNS requests.

5ae2eac4c16bdbbef032544bd9fc86f47e7bdc2cMark Andrews </para>

2c089bf6d24936de631a57b4958ba6b8b5e3b23dMark Andrews </listitem>

5ae2eac4c16bdbbef032544bd9fc86f47e7bdc2cMark Andrews <listitem>

5ae2eac4c16bdbbef032544bd9fc86f47e7bdc2cMark Andrews <para>

5ae2eac4c16bdbbef032544bd9fc86f47e7bdc2cMark Andrews <command>dig +ednsflags</command> can now be used to set

e11a0c114cdaf8f7e7832e9f1a011138248093a6Evan Hunt yet-to-be-defined EDNS flags in DNS requests.

e11a0c114cdaf8f7e7832e9f1a011138248093a6Evan Hunt </para>

e11a0c114cdaf8f7e7832e9f1a011138248093a6Evan Hunt </listitem>

e11a0c114cdaf8f7e7832e9f1a011138248093a6Evan Hunt <listitem>

e11a0c114cdaf8f7e7832e9f1a011138248093a6Evan Hunt <para>

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt <command>dig +[no]ednsnegotiation</command> can now be used enable /

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt disable EDNS version negotiation.

bbedadf76ab670b01887fb9b41097120ea4fdf14Evan Hunt </para>

bbedadf76ab670b01887fb9b41097120ea4fdf14Evan Hunt </listitem>

bbedadf76ab670b01887fb9b41097120ea4fdf14Evan Hunt <listitem>

bbedadf76ab670b01887fb9b41097120ea4fdf14Evan Hunt <para>

bbedadf76ab670b01887fb9b41097120ea4fdf14Evan Hunt <command>dig +header-only</command> can now be used to send

bbedadf76ab670b01887fb9b41097120ea4fdf14Evan Hunt queries without a question section.

bbedadf76ab670b01887fb9b41097120ea4fdf14Evan Hunt </para>

61bcc232038f0a2cb77ed6269675fdc288f5ec98Evan Hunt </listitem>

61bcc232038f0a2cb77ed6269675fdc288f5ec98Evan Hunt <listitem>

61bcc232038f0a2cb77ed6269675fdc288f5ec98Evan Hunt <para>

61bcc232038f0a2cb77ed6269675fdc288f5ec98Evan Hunt <command>dig +ttlunits</command> causes <command>dig</command>

61bcc232038f0a2cb77ed6269675fdc288f5ec98Evan Hunt to print TTL values with time-unit suffixes: w, d, h, m, s for

61bcc232038f0a2cb77ed6269675fdc288f5ec98Evan Hunt weeks, days, hours, minutes, and seconds.

61bcc232038f0a2cb77ed6269675fdc288f5ec98Evan Hunt </para>

61bcc232038f0a2cb77ed6269675fdc288f5ec98Evan Hunt </listitem>

61bcc232038f0a2cb77ed6269675fdc288f5ec98Evan Hunt <listitem>

61bcc232038f0a2cb77ed6269675fdc288f5ec98Evan Hunt <para>

61bcc232038f0a2cb77ed6269675fdc288f5ec98Evan Hunt <command>dig +zflag</command> can be used to set the last

61bcc232038f0a2cb77ed6269675fdc288f5ec98Evan Hunt unassigned DNS header flag bit. This bit in normally zero.

61bcc232038f0a2cb77ed6269675fdc288f5ec98Evan Hunt </para>

61bcc232038f0a2cb77ed6269675fdc288f5ec98Evan Hunt </listitem>

61bcc232038f0a2cb77ed6269675fdc288f5ec98Evan Hunt <listitem>

61bcc232038f0a2cb77ed6269675fdc288f5ec98Evan Hunt <para>

61bcc232038f0a2cb77ed6269675fdc288f5ec98Evan Hunt <command>dig +dscp=<replaceable>value</replaceable></command>

61bcc232038f0a2cb77ed6269675fdc288f5ec98Evan Hunt can now be used to set the DSCP code point in outgoing query

61bcc232038f0a2cb77ed6269675fdc288f5ec98Evan Hunt packets.

61bcc232038f0a2cb77ed6269675fdc288f5ec98Evan Hunt </para>

61bcc232038f0a2cb77ed6269675fdc288f5ec98Evan Hunt </listitem>

61bcc232038f0a2cb77ed6269675fdc288f5ec98Evan Hunt <listitem>

61bcc232038f0a2cb77ed6269675fdc288f5ec98Evan Hunt <para>

61bcc232038f0a2cb77ed6269675fdc288f5ec98Evan Hunt <option>serial-update-method</option> can now be set to

61bcc232038f0a2cb77ed6269675fdc288f5ec98Evan Hunt <literal>date</literal>. On update, the serial number will

61bcc232038f0a2cb77ed6269675fdc288f5ec98Evan Hunt be set to the current date in YYYYMMDDNN format.

61bcc232038f0a2cb77ed6269675fdc288f5ec98Evan Hunt </para>

61bcc232038f0a2cb77ed6269675fdc288f5ec98Evan Hunt </listitem>

319b8a14881a95996af3a9ba4a20f144eb766b31Evan Hunt <listitem>

319b8a14881a95996af3a9ba4a20f144eb766b31Evan Hunt <para>

319b8a14881a95996af3a9ba4a20f144eb766b31Evan Hunt <command>dnssec-signzone -N date</command> also sets the serial

319b8a14881a95996af3a9ba4a20f144eb766b31Evan Hunt number to YYYYMMDDNN.

319b8a14881a95996af3a9ba4a20f144eb766b31Evan Hunt </para>

319b8a14881a95996af3a9ba4a20f144eb766b31Evan Hunt </listitem>

b47c020d5c635b662ac57e5485d266fd62c796c0Evan Hunt <listitem>

b47c020d5c635b662ac57e5485d266fd62c796c0Evan Hunt <para>

b47c020d5c635b662ac57e5485d266fd62c796c0Evan Hunt <command>named -L <replaceable>filename</replaceable></command>

b47c020d5c635b662ac57e5485d266fd62c796c0Evan Hunt causes named to send log messages to the specified file by

b47c020d5c635b662ac57e5485d266fd62c796c0Evan Hunt default instead of to the system log.

b47c020d5c635b662ac57e5485d266fd62c796c0Evan Hunt </para>

b47c020d5c635b662ac57e5485d266fd62c796c0Evan Hunt </listitem>

b47c020d5c635b662ac57e5485d266fd62c796c0Evan Hunt <listitem>

b47c020d5c635b662ac57e5485d266fd62c796c0Evan Hunt <para>

b47c020d5c635b662ac57e5485d266fd62c796c0Evan Hunt The rate limiter configured by the

b47c020d5c635b662ac57e5485d266fd62c796c0Evan Hunt <option>serial-query-rate</option> option no longer covers

b47c020d5c635b662ac57e5485d266fd62c796c0Evan Hunt NOTIFY messages; those are now separately controlled by

b47c020d5c635b662ac57e5485d266fd62c796c0Evan Hunt <option>notify-rate</option> and

b47c020d5c635b662ac57e5485d266fd62c796c0Evan Hunt <option>startup-notify-rate</option> (the latter of which

e939674d53a127ddeeaf4b41fd72933f0b493308Mark Andrews controls the rate of NOTIFY messages sent when the server

e939674d53a127ddeeaf4b41fd72933f0b493308Mark Andrews is first started up or reconfigured).

e939674d53a127ddeeaf4b41fd72933f0b493308Mark Andrews </para>

e939674d53a127ddeeaf4b41fd72933f0b493308Mark Andrews </listitem>

e939674d53a127ddeeaf4b41fd72933f0b493308Mark Andrews <listitem>

e939674d53a127ddeeaf4b41fd72933f0b493308Mark Andrews <para>

e939674d53a127ddeeaf4b41fd72933f0b493308Mark Andrews The default number of tasks and client objects available

e939674d53a127ddeeaf4b41fd72933f0b493308Mark Andrews for serving lightweight resolver queries have been increased,

677f507de7c546c187c1505c48bc7b440545485cMark Andrews and are now configurable via the new <option>lwres-tasks</option>

677f507de7c546c187c1505c48bc7b440545485cMark Andrews and <option>lwres-clients</option> options in

677f507de7c546c187c1505c48bc7b440545485cMark Andrews <filename>named.conf</filename>. [RT #35857]

677f507de7c546c187c1505c48bc7b440545485cMark Andrews </para>

677f507de7c546c187c1505c48bc7b440545485cMark Andrews </listitem>

677f507de7c546c187c1505c48bc7b440545485cMark Andrews <listitem>

677f507de7c546c187c1505c48bc7b440545485cMark Andrews <para>

75b8de87879ad017c9cd2ffc328e5d2391d16e99Evan Hunt Log output to files can now be buffered by specifying

<command>buffered yes;</command> when creating a channel.

</para>

</listitem>

<listitem>

<para>

<command>delv +tcp</command> will exclusively use TCP when

sending queries.

</para>

</listitem>

<listitem>

<para>

<command>named</command> will now check to see whether

other name server processes are running before starting up.

This is implemented in two ways: 1) by refusing to start

if the configured network interfaces all return "address

in use", and 2) by acquiring a file lock on

<filename>/var/run/named/named.lock</filename>, or on a different

file specified via the <command>named -X</command> command

line option.

</para>

</listitem>

<listitem>

<para>

<command>rndc delzone</command> can now be applied to zones

which were configured in <filename>named.conf</filename>;

it is no longer restricted to zones which were added by

<command>rndc addzone</command>. (Note, however, that

this does not edit <filename>named.conf</filename>; the zone

must be removed from the configuration or it will return

when <command>named</command> is restarted or reloaded.)

</para>

</listitem>

<listitem>

<para>

<command>rndc modzone</command> can be used to reconfigure

a zone, using similar syntax to <command>rndc addzone</command>.

</para>

</listitem>

<listitem>

<para>

<command>rndc showzone</command> displays the current

configuration for a specified zone.

</para>

</listitem>

<listitem>

<para>

Added server-side support for pipelined TCP queries. Clients

may continue sending queries via TCP while previous queries are

processed in parallel. Responses are sent when they are

ready, not necessarily in the order in which the queries were

received.

</para>

<para>

To revert to the former behavior for a particular

client address or range of addresses, specify the address prefix

in the "keep-response-order" option. To revert to the former

behavior for all clients, use "keep-response-order { any; };".

</para>

</listitem>

<listitem>

<para>

The new <command>mdig</command> command is a version of

<command>dig</command> that sends multiple pipelined

queries and then waits for responses, instead of sending one

query and waiting the response before sending the next. [RT #38261]

</para>

</listitem>

<listitem>

<para>

To enable better monitoring and troubleshooting of RFC 5011

trust anchor management, the new <command>rndc managed-keys</command>

can be used to check status of trust anchors or to force keys

to be refreshed. Also, the managed-keys data file now has

easier-to-read comments. [RT #38458]

</para>

</listitem>

<listitem>

<para>

An <command>--enable-querytrace</command> configure switch is

now available to enable very verbose query tracelogging. This

option can only be set at compile time. This option has a

negative performance impact and should be used only for

debugging.

</para>

</listitem>

</itemizedlist>

</sect2>

<sect2 id="relnotes_changes">

<title>Feature Changes</title>

<itemizedlist>

<listitem>

<para>

ACLs containing <command>geoip asnum</command> elements were

not correctly matched unless the full organization name was

specified in the ACL (as in

<command>geoip asnum "AS1234 Example, Inc.";</command>).

They can now match against the AS number alone (as in

<command>geoip asnum "AS1234";</command>).

</para>

</listitem>

<listitem>

<para>

When using native PKCS#11 cryptography (i.e.,

<command>configure --enable-native-pkcs11</command>) HSM PINs

of up to 256 characters can now be used.

</para>

</listitem>

<listitem>

<para>

NXDOMAIN responses to queries of type DS are now cached separately

from those for other types. This helps when using "grafted" zones

of type forward, for which the parent zone does not contain a

delegation, such as local top-level domains. Previously a query

of type DS for such a zone could cause the zone apex to be cached

as NXDOMAIN, blocking all subsequent queries. (Note: This

change is only helpful when DNSSEC validation is not enabled.

"Grafted" zones without a delegation in the parent are not a

recommended configuration.)

</para>

</listitem>

<listitem>

<para>

Update forwarding performance has been improved by allowing

a single TCP connection to be shared between multiple updates.

</para>

</listitem>

<listitem>

<para>

By default, <command>nsupdate</command> will now check

the correctness of hostnames when adding records of type

A, AAAA, MX, SOA, NS, SRV or PTR. This behavior can be

disabled with <command>check-names no</command>.

</para>

</listitem>

<listitem>

<para>

Added support for OPENPGPKEY type.

</para>

</listitem>

<listitem>

<para>

The names of the files used to store managed keys and added

zones for each view are no longer based on the SHA256 hash

of the view name, except when this is necessary because the

view name contains characters that would be incompatible with use

as a file name. For views whose names do not contain forward

slashes ('/'), backslashes ('\'), or capital letters - which

could potentially cause namespace collision problems on

case-insensitive filesystems - files will now be named

after the view (for example, <filename>internal.mkeys</filename>

or <filename>external.nzf</filename>). However, to ensure

consistent behavior when upgrading, if a file using the old

name format is found to exist, it will continue to be used.

</para>

</listitem>

<listitem>

<para>

"rndc" can now return text output of arbitrary size to

the caller. (Prior to this, certain commands such as

"rndc tsig-list" and "rndc zonestatus" could return

truncated output.)

</para>

</listitem>

<listitem>

<para>

Errors reported when running <command>rndc addzone</command>

(e.g., when a zone file cannot be loaded) have been clarified

to make it easier to diagnose problems.

</para>

</listitem>

<listitem>

<para>

When encountering an authoritative name server whose name is

an alias pointing to another name, the resolver treats

this as an error and skips to the next server. Previously

this happened silently; now the error will be logged to

the newly-created "cname" log category.

</para>

</listitem>

<listitem>

<para>

If named is not configured to validate the answer then

allow fallback to plain DNS on timeout even when we know

the server supports EDNS. This will allow the server to

potentially resolve signed queries when TCP is being

blocked.

</para>

</listitem>

</itemizedlist>

</sect2>

<sect2 id="relnotes_bugs">

<title>Bug Fixes</title>

<itemizedlist>

<listitem>

<para>

<command>dig</command>, <command>host</command> and

<command>nslookup</command> aborted when encountering

a name which, after appending search list elements,

exceeded 255 bytes. Such names are now skipped, but

processing of other names will continue. [RT #36892]

</para>

</listitem>

<listitem>

<para>

The error message generated when

<command>named-checkzone</command> or

<command>named-checkconf -z</command> encounters a

<option>$TTL</option> directive without a value has

been clarified. [RT #37138]

</para>

</listitem>

<listitem>

<para>

Semicolon characters (;) included in TXT records were

incorrectly escaped with a backslash when the record was

displayed as text. This is actually only necessary when there

are no quotation marks. [RT #37159]

</para>

</listitem>

<listitem>

<para>

When files opened for writing by <command>named</command>,

such as zone journal files, were referenced more than once

in <filename>named.conf</filename>, it could lead to file

corruption as multiple threads wrote to the same file. This

is now detected when loading <filename>named.conf</filename>

and reported as an error. [RT #37172]

</para>

</listitem>

<listitem>

<para>

When checking for updates to trust anchors listed in

<option>managed-keys</option>, <command>named</command>

now revalidates keys based on the current set of

active trust anchors, without relying on any cached

record of previous validation. [RT #37506]

</para>

</listitem>

<listitem>

<para>

Large-system tuning

(<command>configure --with-tuning=large</command>) caused

problems on some platforms by setting a socket receive

buffer size that was too large. This is now detected and

corrected at run time. [RT #37187]

</para>

</listitem>

<listitem>

<para>

When NXDOMAIN redirection is in use, queries for a name

that is present in the redirection zone but a type that

is not present will now return NOERROR instead of NXDOMAIN.

</para>

</listitem>

<listitem>

<para>

Due to an inadvertent removal of code in the previous

release, when <command>named</command> encountered an

authoritative name server which dropped all EDNS queries,

it did not always try plain DNS. This has been corrected.

[RT #37965]

</para>

</listitem>

<listitem>

<para>

A regression caused nsupdate to use the default recursive servers

rather than the SOA MNAME server when sending the UPDATE.

</para>

</listitem>

<listitem>

<para>

Adjusted max-recursion-queries to accommodate the smaller

initial packet sizes used in BIND 9.10 and higher when

contacting authoritative servers for the first time.

</para>

</listitem>

<listitem>

<para>

Built-in "empty" zones did not correctly inherit the

"allow-transfer" ACL from the options or view. [RT #38310]

</para>

</listitem>

<listitem>

<para>

Two leaks were fixed that could cause <command>named</command>

processes to grow to very large sizes. [RT #38454]

</para>

</listitem>

<listitem>

<para>

Fixed some bugs in RFC 5011 trust anchor management,

including a memory leak and a possible loss of state

information. [RT #38458]

</para>

</listitem>

<listitem>

<para>

Asynchronous zone loads were not handled correctly when the

zone load was already in progress; this could trigger a crash

in zt.c. [RT #37573]

</para>

</listitem>

</itemizedlist>

</sect2>

<sect2 id="end_of_life">

<title>End of Life</title>

<para>

The end of life for BIND 9.11 is yet to be determined but

will not be before BIND 9.13.0 has been released for 6 months.

<ulink url="https://www.isc.org/downloads/software-support-policy/"

>https://www.isc.org/downloads/software-support-policy/</ulink>

</para>

</sect2>

<sect2 id="relnotes_thanks">

<title>Thank You</title>

<para>

Thank you to everyone who assisted us in making this release possible.

If you would like to contribute to ISC to assist us in continuing to

make quality open source software, please visit our donations page at

<ulink url="http://www.isc.org/donate/"

>http://www.isc.org/donate/</ulink>.

</para>

</sect2>

</sect1>