notes.xml revision 9e4e871392b39cbeff443c58fbd96f1690b618a4
3fd910dec5c3fd5586003fffd03ecf2f92aae53fTinderbox User<!ENTITY Scaron "Š">
40f53fa8d9c6a4fc38c0014495e7a42b08f52481David Lawrence - Copyright (C) 2014-2016 Internet Systems Consortium, Inc. ("ISC")
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews - This Source Code Form is subject to the terms of the Mozilla Public
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews - License, v. 2.0. If a copy of the MPL was not distributed with this
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews - file, You can obtain one at http://mozilla.org/MPL/2.0/.
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews<section xmlns:db="http://docbook.org/ns/docbook" version="5.0"><info/>
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="noteversion.xml"/>
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley <section xml:id="relnotes_intro"><info><title>Introduction</title></info>
9c3531d72aeaad6c5f01efe6a1c82023e1379e4dDavid Lawrence This document summarizes changes since the last production
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley release on the BIND 9.11 branch.
a3a11c4f3fc9ba972802b811c4d95a9884d6ff4aMichael Sawyer Please see the <filename>CHANGES</filename> file for a further
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley list of bug fixes and other changes.
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley <section xml:id="relnotes_download"><info><title>Download</title></info>
2aa67e804d85f4d88153368ce65ce4df7b5390e6Bob Halley The latest versions of BIND 9 software can always be found at
de8661e517ed679cfaa12e47eb9a8e23829ed320David Lawrence <link xmlns:xlink="http://www.w3.org/1999/xlink" xlink:href="http://www.isc.org/downloads/">http://www.isc.org/downloads/</link>.
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley There you will find additional information about each release,
de8661e517ed679cfaa12e47eb9a8e23829ed320David Lawrence source code, and pre-compiled versions for Microsoft Windows
de8661e517ed679cfaa12e47eb9a8e23829ed320David Lawrence operating systems.
764808211e952f1617aaa609281da66d80120c0dMark Andrews <section xml:id="relnotes_license"><info><title>License Change</title></info>
de8661e517ed679cfaa12e47eb9a8e23829ed320David Lawrence With the release of BIND 9.11.0, ISC changed to the open
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley source license for BIND from the ISC license to the Mozilla
cf300e03de3df3ff422db922520bf07c686c86daMark Andrews Public License (MPL 2.0).
6d54a6fc180acaf8772c9447cb925b31f39c7158Mark Andrews The MPL-2.0 license requires that if you make changes to
a3a11c4f3fc9ba972802b811c4d95a9884d6ff4aMichael Sawyer licensed software (e.g. BIND) and distribute them outside
4b87939256ede703385e9cab92d3c58d03c31098Mark Andrews your organization, that you publish those changes under that
108490a7f8529aff50a0ac7897580b59a73d9845David Lawrence same license. It does not require that you publish or disclose
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley anything other than the changes you made to our software.
f754fa97bc698cc251d227173a95e4d39a88ac01Mark Andrews This new requirement will not affect anyone who is using BIND
f754fa97bc698cc251d227173a95e4d39a88ac01Mark Andrews without redistributing it, nor anyone redistributing it without
f754fa97bc698cc251d227173a95e4d39a88ac01Mark Andrews changes, therefore this change will be without consequence
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley for most individuals and organizations who are using BIND.
c52ae25dd70636c673d4a299859137a1c8ba611aMark Andrews Those unsure whether or not the license change affects their
47d837a49967a6a1b290024f5efb0669276013b1Mukund Sivaraman use of BIND, or who wish to discuss how to comply with the
51e0ad287f1b345f0c3316f0633aab14d0e8bb65Brian Wellington license may contact ISC at <link
ee80f4506479e189ca1320eb87ac89188c5a7848Mark Andrews xlink:href="https://www.isc.org/mission/contact/">
51e0ad287f1b345f0c3316f0633aab14d0e8bb65Brian Wellington <section xml:id="relnotes_security"><info><title>Security Fixes</title></info>
51e0ad287f1b345f0c3316f0633aab14d0e8bb65Brian Wellington <itemizedlist>
51e0ad287f1b345f0c3316f0633aab14d0e8bb65Brian Wellington A coding error in the <option>nxdomain-redirect</option>
51e0ad287f1b345f0c3316f0633aab14d0e8bb65Brian Wellington feature could lead to an assertion failure if the redirection
51e0ad287f1b345f0c3316f0633aab14d0e8bb65Brian Wellington namespace was served from a local authoritative data source
5d98cf67b32d785aca1a72ea1dc4d559fab39208Mark Andrews such as a local zone or a DLZ instead of via recursive
0415ca35ada2cac6a86127eaca64f3a997aea121Evan Hunt lookup. This flaw is disclosed in CVE-2016-9778. [RT #43837]
5d98cf67b32d785aca1a72ea1dc4d559fab39208Mark Andrews <command>named</command> could mishandle authority sections
5d98cf67b32d785aca1a72ea1dc4d559fab39208Mark Andrews with missing RRSIGs, triggering an assertion failure. This
5d98cf67b32d785aca1a72ea1dc4d559fab39208Mark Andrews flaw is disclosed in CVE-2016-9444. [RT #43632]
51e0ad287f1b345f0c3316f0633aab14d0e8bb65Brian Wellington <command>named</command> mishandled some responses where
5d98cf67b32d785aca1a72ea1dc4d559fab39208Mark Andrews covering RRSIG records were returned without the requested
5d98cf67b32d785aca1a72ea1dc4d559fab39208Mark Andrews data, resulting in an assertion failure. This flaw is
5d98cf67b32d785aca1a72ea1dc4d559fab39208Mark Andrews disclosed in CVE-2016-9147. [RT #43548]
5d98cf67b32d785aca1a72ea1dc4d559fab39208Mark Andrews <command>named</command> incorrectly tried to cache TKEY
51e0ad287f1b345f0c3316f0633aab14d0e8bb65Brian Wellington records which could trigger an assertion failure when there was
5d98cf67b32d785aca1a72ea1dc4d559fab39208Mark Andrews a class mismatch. This flaw is disclosed in CVE-2016-9131.
5d98cf67b32d785aca1a72ea1dc4d559fab39208Mark Andrews It was possible to trigger assertions when processing
51e0ad287f1b345f0c3316f0633aab14d0e8bb65Brian Wellington responses containing answers of type DNAME. This flaw is
51e0ad287f1b345f0c3316f0633aab14d0e8bb65Brian Wellington disclosed in CVE-2016-8864. [RT #43465]
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley Added the ability to specify the maximum number of records
9ee5efde7df57cbe70fb9b32c9d898e8ef7eca1eBob Halley permitted in a zone (<option>max-records #;</option>).
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley This provides a mechanism to block overly large zone
4e5388b45908ce8b8b35825ca6f16c1d236643baBrian Wellington transfers, which is a potential risk with slave zones from
c336121fb5a5c1b9cb9b2cd4cea50f0788270505Brian Wellington other parties, as described in CVE-2016-6170.
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley </itemizedlist>
51e0ad287f1b345f0c3316f0633aab14d0e8bb65Brian Wellington <section xml:id="relnotes_changes"><info><title>Feature Changes</title></info>
dc2a0aa7aaa8b85398ae183c7274c0eeec5009afMark Andrews <itemizedlist>
7433a204d32673e9f6747172f202272cc5bfe27cMark Andrews Expanded and improved the YAML output from
7433a204d32673e9f6747172f202272cc5bfe27cMark Andrews <command>dnstap-read -y</command>: it now includes packet
7433a204d32673e9f6747172f202272cc5bfe27cMark Andrews size and a detailed breakdown of message contents.
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein [RT #43622] [RT #43642]
077daa21229ffaedda79588fa70fbaeae19ae998Bob Halley If an ACL is specified with an address prefix in which the
077daa21229ffaedda79588fa70fbaeae19ae998Bob Halley prefix length is longer than the address portion (for example,
0415ca35ada2cac6a86127eaca64f3a997aea121Evan Hunt 192.0.2.1/8), <command>named</command> will now log a warning.
0415ca35ada2cac6a86127eaca64f3a997aea121Evan Hunt In future releases this will be a fatal configuration error.
0415ca35ada2cac6a86127eaca64f3a997aea121Evan Hunt </itemizedlist>
0415ca35ada2cac6a86127eaca64f3a997aea121Evan Hunt <section xml:id="relnotes_bugs"><info><title>Bug Fixes</title></info>
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley <itemizedlist>
d1e4b08844175357a925ddd6dcfa750cccd2b116Brian Wellington Named could trigger a assertion when sending notify
d1e4b08844175357a925ddd6dcfa750cccd2b116Brian Wellington messages. [RT #44019]
d1e4b08844175357a925ddd6dcfa750cccd2b116Brian Wellington Referencing a nonexistent zone in a <command>response-policy</command>
da76a8046e01e1c1c2e6f75772afb2c4f202cc25Brian Wellington statement could cause an assertion failure during configuration.
0415ca35ada2cac6a86127eaca64f3a997aea121Evan Hunt <command>rndc addzone</command> could cause a crash
0415ca35ada2cac6a86127eaca64f3a997aea121Evan Hunt when attempting to add a zone with a type other than
0415ca35ada2cac6a86127eaca64f3a997aea121Evan Hunt <command>master</command> or <command>slave</command>.
0415ca35ada2cac6a86127eaca64f3a997aea121Evan Hunt Such zones are now rejected. [RT #43665]
0415ca35ada2cac6a86127eaca64f3a997aea121Evan Hunt <command>named</command> could hang when encountering log
0415ca35ada2cac6a86127eaca64f3a997aea121Evan Hunt file names with large apparent gaps in version number (for
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley example, when files exist called "logfile.0", "logfile.1",
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley and "logfile.1482954169"). This is now handled correctly.
0415ca35ada2cac6a86127eaca64f3a997aea121Evan Hunt If a zone was updated while <command>named</command> was
2f734e0a7e518c89c2b2b179714b8885b7626b3aAndreas Gustafsson processing a query for nonexistent data, it could return
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley out-of-sync NSEC3 records causing potential DNSSEC validation
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley failure. [RT #43247]
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley </itemizedlist>
0415ca35ada2cac6a86127eaca64f3a997aea121Evan Hunt <section xml:id="relnotes_maint"><info><title>Maintenance</title></info>
0415ca35ada2cac6a86127eaca64f3a997aea121Evan Hunt <itemizedlist>
0415ca35ada2cac6a86127eaca64f3a997aea121Evan Hunt The built-in root hints have been updated to include an
dc2a0aa7aaa8b85398ae183c7274c0eeec5009afMark Andrews IPv6 address (2001:500:12::d0d) for G.ROOT-SERVERS.NET.
dc2a0aa7aaa8b85398ae183c7274c0eeec5009afMark Andrews </itemizedlist>
9b2267b5ba9d0640512a41e139a4a36caa43730dBob Halley <section xml:id="relnotes_misc"><info><title>Miscellaneous Notes</title></info>
2dfd6bca9aa6d9279b4278d6fa18ea5f63ba0ec9Bob Halley <itemizedlist>
0415ca35ada2cac6a86127eaca64f3a997aea121Evan Hunt Authoritative server support for the EDNS Client Subnet option
88674be66567d3c7db91e717cd5972655e2e2488Mark Andrews (ECS), introduced in BIND 9.11.0, was based on an early version
51143259789034ac19e12984a8390b9f86ab368cMark Andrews of the specification, and is now known to have incompatibilities
ef4eed2a2a8897bd4e5b19dd94f638e0861ebda5Mark Andrews with other ECS implementations. It is also inefficient, requiring
88674be66567d3c7db91e717cd5972655e2e2488Mark Andrews a separate view for each answer, and is unable to correct for
88674be66567d3c7db91e717cd5972655e2e2488Mark Andrews overlapping subnets in the configuration. It is intended for
88674be66567d3c7db91e717cd5972655e2e2488Mark Andrews testing purposes but is not recommended for for production use.
88674be66567d3c7db91e717cd5972655e2e2488Mark Andrews This was not made sufficiently clear in the documentation at
88674be66567d3c7db91e717cd5972655e2e2488Mark Andrews the time of release.
88674be66567d3c7db91e717cd5972655e2e2488Mark Andrews </itemizedlist>
88674be66567d3c7db91e717cd5972655e2e2488Mark Andrews <section xml:id="end_of_life"><info><title>End of Life</title></info>
0415ca35ada2cac6a86127eaca64f3a997aea121Evan Hunt The end of life for BIND 9.11 is yet to be determined but
0415ca35ada2cac6a86127eaca64f3a997aea121Evan Hunt will not be before BIND 9.13.0 has been released for 6 months.
0415ca35ada2cac6a86127eaca64f3a997aea121Evan Hunt <link xmlns:xlink="http://www.w3.org/1999/xlink" xlink:href="https://www.isc.org/downloads/software-support-policy/">https://www.isc.org/downloads/software-support-policy/</link>
0415ca35ada2cac6a86127eaca64f3a997aea121Evan Hunt <section xml:id="relnotes_thanks"><info><title>Thank You</title></info>
0415ca35ada2cac6a86127eaca64f3a997aea121Evan Hunt Thank you to everyone who assisted us in making this release possible.
ef4eed2a2a8897bd4e5b19dd94f638e0861ebda5Mark Andrews If you would like to contribute to ISC to assist us in continuing to
ef4eed2a2a8897bd4e5b19dd94f638e0861ebda5Mark Andrews make quality open source software, please visit our donations page at
ef4eed2a2a8897bd4e5b19dd94f638e0861ebda5Mark Andrews <link xmlns:xlink="http://www.w3.org/1999/xlink" xlink:href="http://www.isc.org/donate/">http://www.isc.org/donate/</link>.