migration revision 7969572891fbaf3e6d34998b80978e6520f4f823
ad127d839d2e7aa542939a8a336691407e23397eMark AndrewsCopyright (C) 2000, 2001 Internet Software Consortium.
e20788e1216ed720aefa84f3295f7899d9f28c22Mark AndrewsSee COPYRIGHT in the source root or http://isc.org/copyright.html for terms.
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews BIND 8 to BIND 9 Migration Notes
ad127d839d2e7aa542939a8a336691407e23397eMark AndrewsBIND 9 is designed to be mostly upwards compatible with BIND 8, but
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsthere is still a number of caveats you should be aware of when
da5d53fb1401f5e17a77373af32d865489aa04a8Tinderbox Userupgrading an existing BIND 8 installation to use BIND 9.
da5d53fb1401f5e17a77373af32d865489aa04a8Tinderbox User1. Configuration File Compatibility
da5d53fb1401f5e17a77373af32d865489aa04a8Tinderbox User1.1. Unimplemented Options and Changed Defaults
ad127d839d2e7aa542939a8a336691407e23397eMark AndrewsBIND 9 supports most, but not all of the named.conf options of BIND 8.
ad127d839d2e7aa542939a8a336691407e23397eMark AndrewsFor a complete list of implemented options, see doc/misc/options.
ad127d839d2e7aa542939a8a336691407e23397eMark AndrewsIf your named.conf file uses an unimplemented option, named will log a
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewswarning message. A message is also logged about each option whose
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsdefault has changed unless the option is set explicitly in named.conf.
ad127d839d2e7aa542939a8a336691407e23397eMark AndrewsThe default of the "transfer-format" option has changed from
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews"one-answer" to "many-answers". If you have slave servers that do not
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsunderstand the many-answers zone transfer format (e.g., BIND 4.9.5 or
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsolder) you need to explicitly specify "transfer-format one-answer;" in
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewseither the options block or a server statement.
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews1.2. Handling of Configuration File Errors
ad127d839d2e7aa542939a8a336691407e23397eMark AndrewsIn BIND 9, named refuses to start if it detects an error in
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsnamed.conf. Earlier versions would start despite errors, causing the
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsserver to run with a partial configuration. Errors detected during
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewssubsequent reloads do not cause the server to exit.
ad127d839d2e7aa542939a8a336691407e23397eMark AndrewsErrors in master files do not cause the server to exit, but they
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsdo cause the zone not to load.
ad127d839d2e7aa542939a8a336691407e23397eMark AndrewsThe set of logging categories in BIND 9 is different from that
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsin BIND 8. If you have customised your logging on a per-category
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsbasis, you need to modify your logging statement to use the
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsnew categories.
ad127d839d2e7aa542939a8a336691407e23397eMark AndrewsAnother difference is that the "logging" statement only takes effect
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsafter the entire named.conf file has been read. This means that when
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsthe server starts up, any messages about errors in the configuration
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsfile are always logged to the default destination (syslog) when the
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsserver first starts up, regardless of the contents of the "logging"
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsstatement. In BIND 8, the new logging configuration took effect
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsimmediately after the "logging" statement was read.
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews1.4. Notify messages and Refresh queries
ad127d839d2e7aa542939a8a336691407e23397eMark AndrewsThe source address and port for these is now controlled by
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews"notify-source" and "transfer-source", respectively, rather that
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsquery-source as in BIND 8.
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews1.5. Multiple Classes.
ad127d839d2e7aa542939a8a336691407e23397eMark AndrewsMultiple classes have to be put into explicit views for each class.
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews2. Zone File Compatibility
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews2.1. Strict RFC1035 Interpretation of TTLs in Zone Files
ad127d839d2e7aa542939a8a336691407e23397eMark AndrewsBIND 9 strictly complies with the RFC1035 and RFC2308 rules regarding
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsomitted TTLs in zone files. Omitted TTLs are replaced by the value
acbb301e648b82fcc38b876a44403cf0fe539cc9Evan Huntspecified with the $TTL directive, or by the previous explicit TTL if
acbb301e648b82fcc38b876a44403cf0fe539cc9Evan Huntthere is no $TTL directive.
acbb301e648b82fcc38b876a44403cf0fe539cc9Evan HuntIf there is no $TTL directive and the first RR in the file does not
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewshave an explicit TTL field, the zone file is illegal according to
ad127d839d2e7aa542939a8a336691407e23397eMark AndrewsRFC1035 since the TTL of the first RR is undefined. Unfortunately,
ad127d839d2e7aa542939a8a336691407e23397eMark AndrewsBIND 4 and many versions of BIND 8 accept such files without warning
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsand use the value of the SOA MINTTL field as a default for missing TTL
ad127d839d2e7aa542939a8a336691407e23397eMark AndrewsBIND 9.0 and 9.1 completely refused to load such files. BIND 9.2
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsemulates the nonstandard BIND 4/8 SOA MINTTL behaviour and loads the
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsfiles anyway (provided the SOA is the first record in the file), but
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewswill issue the warning message "no TTL specified; using SOA MINTTL
ad127d839d2e7aa542939a8a336691407e23397eMark AndrewsTo avoid problems, we recommend that you use a $TTL directive in each
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews2.2. Periods in SOA Serial Numbers Deprecated
ad127d839d2e7aa542939a8a336691407e23397eMark AndrewsSome versions of BIND allow SOA serial numbers with an embedded
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsperiod, like "3.002", and convert them into integers in a rather
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsunintuitive way. This feature is not supported by BIND 9; serial
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsnumbers must be integers.
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews2.3. Handling of Unbalanced Quotes
ad127d839d2e7aa542939a8a336691407e23397eMark AndrewsTXT records with unbalanced quotes, like 'host TXT "foo', were not
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewstreated as errors in some versions of BIND. If your zone files
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewscontain such records, you will get potentially confusing error
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsmessages like "unexpected end of file" because BIND 9 will interpret
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewseverything up to the next quote character as a literal string.
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews2.4. Handling of Line Breaks
ad127d839d2e7aa542939a8a336691407e23397eMark AndrewsSome versions of BIND accept RRs containing line breaks that are not
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsproperly quoted with parentheses, like the following SOA:
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews ( 1 3600 1800 1814400 3600 )
ad127d839d2e7aa542939a8a336691407e23397eMark AndrewsThis is not legal master file syntax and will be treated as an error
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsby BIND 9. The fix is to move the opening parenthesis to the first
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews2.5. Unimplemented BIND 8 Extensions
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews$GENERATE: The "$$" construct for getting a literal $ into a domain
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsname is deprecated. Use \$ instead.
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews3. Interoperability Impact of New Protocol Features
ad127d839d2e7aa542939a8a336691407e23397eMark AndrewsBIND 9 uses EDNS0 (RFC2671) to advertise its receive buffer size. It
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsalso sets an EDNS flag bit in queries to indicate that it wishes to
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsreceive DNSSEC responses; this flag bit usage is not yet standardised,
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsbut we hope it will be.
ad127d839d2e7aa542939a8a336691407e23397eMark AndrewsMost older servers that do not support EDNS0, including prior versions
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsof BIND, will send a FORMERR or NOTIMP response to these queries.
ad127d839d2e7aa542939a8a336691407e23397eMark AndrewsWhen this happens, BIND 9 will automatically retry the query without
42782931073786f98d3d0a617351db40066949a4Mukund SivaramanUnfortunately, there exists at least one non-BIND name server
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsimplementation that silently ignores these queries instead of sending
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsan error response. Resolving names in zones where all or most
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsauthoritative servers use this server will be very slow or fail
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewscompletely. We have contacted the manufacturer of the name server in
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewscase, and they are working on a solution.
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan HuntWhen BIND 9 communicates with a server that does support EDNS0, such as
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntanother BIND 9 server, responses of up to 4096 bytes may be
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunttransmitted as a single UDP datagram which is subject to fragmentation
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntat the IP level. If a firewall incorrectly drops IP fragments, it can
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewscause resolution to slow down dramatically or fail.
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews3.2. Zone Transfers
ad127d839d2e7aa542939a8a336691407e23397eMark AndrewsOutgoing zone transfers now use the "many-answers" format by default.
ad127d839d2e7aa542939a8a336691407e23397eMark AndrewsThis format is not understood by certain old versions of BIND 4.
ad127d839d2e7aa542939a8a336691407e23397eMark AndrewsYou can work around this problem using the option "transfer-format
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsone-answer;", but since these old versions all have known security
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsproblems, the correct fix is to upgrade the slave servers.
ad127d839d2e7aa542939a8a336691407e23397eMark AndrewsZone transfers to Windows 2000 DNS servers sometimes fail due to a
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsbug in the Windows 2000 DNS server where DNS messages larger than
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews16K are not handled properly. Obtain the latest service pack for
ad127d839d2e7aa542939a8a336691407e23397eMark AndrewsWindows 2000 from Microsoft to address this issue. In the meantime,
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsthe problem can be worked around by setting "transfer-format one-answer;".
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewshttp://support.microsoft.com/default.aspx?scid=kb;en-us;297936
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews4. Unrestricted Character Set
ad127d839d2e7aa542939a8a336691407e23397eMark AndrewsBIND 9 does not restrict the character set of domain names - it is
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsfully 8-bit clean in accordance with RFC2181 section 11.
ad127d839d2e7aa542939a8a336691407e23397eMark AndrewsIt is strongly recommended that hostnames published in the DNS follow
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsthe RFC952 rules, but BIND 9 will not enforce this restriction.
b454c0319685041db3f3e8fd7671e1b364fd20c5Evan HuntHistorically, some applications have suffered from security flaws
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewswhere data originating from the network, such as names returned by
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsgethostbyaddr(), are used with insufficient checking and may cause a
42782931073786f98d3d0a617351db40066949a4Mukund Sivaramanbreach of security when containing unexpected characters; see
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews<http://www.cert.org/advisories/CA-96.04.corrupt_info_from_servers.html>
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsfor details. Some earlier versions of BIND attempt to protect these
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsflawed applications from attack by discarding data containing
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewscharacters deemed inappropriate in host names or mail addresses, under
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsthe control of the "check-names" option in named.conf and/or "options
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsno-check-names" in resolv.conf. BIND 9 provides no such protection;
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsif applications with these flaws are still being used, they should
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews5. Server Administration Tools
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews5.1 Ndc Replaced by Rndc
ad127d839d2e7aa542939a8a336691407e23397eMark AndrewsThe "ndc" program has been replaced by "rndc", which is capable of
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsremote operation. Unlike ndc, rndc requires a configuration file.
ad127d839d2e7aa542939a8a336691407e23397eMark AndrewsThe easiest way to generate a configuration file is to run
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews"rndc-confgen -a"; see the man pages for rndc(8), rndc-confgen(8),
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsand rndc.conf(5) for details.
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews5.2. Nsupdate Differences
ad127d839d2e7aa542939a8a336691407e23397eMark AndrewsThe BIND 8 implementation of nsupdate had an undocumented feature
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewswhere an update request would be broken down into multiple requests
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsbased upon the discovered zones that contained the records. This
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsbehaviour has not been implemented in BIND 9. Each update request
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsmust pertain to a single zone, but it is still possible to do multiple
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsupdates in a single invocation of nsupdate by terminating each update
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewswith an empty line or a "send" command.
acbb301e648b82fcc38b876a44403cf0fe539cc9Evan Hunt6. No Information Leakage between Zones
ad127d839d2e7aa542939a8a336691407e23397eMark AndrewsBIND 9 stores the authoritative data for each zone in a separate data
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsstructure, as recommended in RFC1035 and as required by DNSSEC and
ad127d839d2e7aa542939a8a336691407e23397eMark AndrewsIXFR. When a BIND 9 server is authoritative for both a child zone and
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsits parent, it will have two distinct sets of NS records at the
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsdelegation point: the authoritative NS records at the child's apex,
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsand a set of glue NS records in the parent.
ad127d839d2e7aa542939a8a336691407e23397eMark AndrewsBIND 8 was unable to properly distinguish between these two sets of NS
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsrecords and would "leak" the child's NS records into the parent,
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewseffectively causing the parent zone to be silently modified: responses
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsand zone transfers from the parent contained the child's NS records
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsrather than the glue configured into the parent (if any). In the case
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsof children of type "stub", this behaviour was documented as a feature,
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsallowing the glue NS records to be omitted from the parent
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsconfiguration.
ad127d839d2e7aa542939a8a336691407e23397eMark AndrewsSites that were relying on this BIND 8 behaviour need to add any
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsomitted glue NS records, and any necessary glue A records, to the
ad127d839d2e7aa542939a8a336691407e23397eMark AndrewsAlthough stub zones can no longer be used as a mechanism for injecting
ad127d839d2e7aa542939a8a336691407e23397eMark AndrewsNS records into their parent zones, they are still useful as a way of
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsdirecting queries for a given domain to a particular set of name
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews7. Umask not Modified
ad127d839d2e7aa542939a8a336691407e23397eMark AndrewsThe BIND 8 named unconditionally sets the umask to 022. BIND 9 does
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsnot; the umask inherited from the parent process remains in effect.
ad127d839d2e7aa542939a8a336691407e23397eMark AndrewsThis may cause files created by named, such as journal files, to be
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewscreated with different file permissions than they did in BIND 8. If
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsnecessary, the umask should be set explicitly in the script used to
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsstart the named process.
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews$Id: migration,v 1.44 2003/07/18 07:44:52 marka Exp $