diff options
Diffstat (limited to 'contrib/bind9/RELEASE-NOTES-BIND-9.8.1.html')
| -rw-r--r-- | contrib/bind9/RELEASE-NOTES-BIND-9.8.1.html | 368 |
1 files changed, 368 insertions, 0 deletions
diff --git a/contrib/bind9/RELEASE-NOTES-BIND-9.8.1.html b/contrib/bind9/RELEASE-NOTES-BIND-9.8.1.html new file mode 100644 index 0000000000000..c4deae43a9cf6 --- /dev/null +++ b/contrib/bind9/RELEASE-NOTES-BIND-9.8.1.html @@ -0,0 +1,368 @@ +<html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title></title><link rel="stylesheet" href="release-notes.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.71.1"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="article" lang="en"><div class="titlepage"><hr></div> + + <div class="section" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3359008"></a>Introduction</h2></div></div></div> + + <p> + BIND 9.8.1 is the current production release of BIND 9.8. + </p> + <p> + This document summarizes changes from BIND 9.8.0 to BIND 9.8.1. + Please see the CHANGES file in the source code release for a + complete list of all changes. + </p> + </div> + + <div class="section" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3359050"></a>Download</h2></div></div></div> + + <p> + The latest versions of BIND 9 software can always be found + on our web site at + <a href="http://www.isc.org/downloads/all" target="_top">http://www.isc.org/downloads/all</a>. + There you will find additional information about each + release, source code, and some pre-compiled versions for certain operating systems. + </p> + </div> + + <div class="section" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2545549"></a>Support</h2></div></div></div> + + <p>Product support information is available on + <a href="http://www.isc.org/services/support" target="_top">http://www.isc.org/services/support</a> + for paid support options. Free support is provided by our user + community via a mailing list. Information on all public email + lists is available at + <a href="https://lists.isc.org/mailman/listinfo" target="_top">https://lists.isc.org/mailman/listinfo</a>. + </p> + </div> + + <div class="section" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3358108"></a>New Features</h2></div></div></div> + + <div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3358149"></a>9.8.1</h3></div></div></div> + + <div class="itemizedlist"><ul type="disc"><li> +Added a new include file with function typedefs +for the DLZ "dlopen" driver. [RT #23629] +</li><li> +Added a tool able to generate malformed packets to allow testing +of how named handles them. +[RT #24096] +</li><li> +The root key is now provided in the file bind.keys allowing DNSSEC validation to be switched on at start up by adding "dnssec-validation auto;" to named.conf. If the root key provided has expired, named will log the expiration and validation will not work. More information and the most current copy of bind.keys can be found at http://www.isc.org/bind-keys. *Please note this feature was actually added in 9.8.0 but was not included in the 9.8.0 release notes. [RT #21727] +</li></ul></div> + </div> + </div> + + <div class="section" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3358206"></a>Security Fixes</h2></div></div></div> + + <div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3358226"></a>9.8.1</h3></div></div></div> + + <div class="itemizedlist"><ul type="disc"><li> +If named is configured with a response policy zone (RPZ) and a query +of type RRSIG is received for a name configured for RRset replacement +in that RPZ, it will trigger an INSIST and crash the server. +RRSIG. [RT #24280] +</li><li> +named, set up to be a caching resolver, is vulnerable to a +user querying a domain with very large resource record sets (RRSets) +when trying to negatively cache the response. Due to an off-by-one +error, caching the response could cause named to crash. [RT #24650] +[CVE-2011-1910] +</li><li> +Using Response Policy Zone (RPZ) to query a wildcard CNAME label with +QUERY type SIG/RRSIG, it can cause named to crash. Fix is query type +independant. +[RT #24715] +</li><li> +Using Response Policy Zone (RPZ) with DNAME records and querying the +subdomain of that label can cause named to crash. Now logs that DNAME +is not supported. +[RT #24766] +</li><li> +Change #2912 populated the message section in replies to UPDATE requests, +which some Windows clients wanted. This exposed a latent bug that allowed +the response message to crash named. With this fix, change 2912 has been +reduced to copy only the zone section to the reply. A more complete fix +for the latent bug will be released later. +[RT #24777] +</li></ul></div> + </div> + </div> + + + <div class="section" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3358283"></a>Feature Changes</h2></div></div></div> + + <div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3358291"></a>9.8.1</h3></div></div></div> + + <div class="itemizedlist"><ul type="disc"><li> +Merged in the NetBSD ATF test framework (currently +version 0.12) for development of future unit tests. +Use configure --with-atf to build ATF internally +or configure --with-atf=prefix to use an external +copy. [RT #23209] +</li><li> +Added more verbose error reporting from DLZ LDAP. [RT #23402] +</li><li> +The DLZ "dlopen" driver is now built by default, +no longer requiring a configure option. To +disable it, use "configure --without-dlopen". +(Note: driver not supported on win32.) [RT #23467] +</li><li> +Replaced compile time constant with STDTIME_ON_32BITS. +[RT #23587] +</li><li> +Make --with-gssapi default for ./configure. [RT #23738] +</li><li> +Improved the startup time for an authoritative server with a large +number of zones by making the zone task table of variable size +rather than fixed size. This means that authoritative servers with +lots of zones will be serving that zone data much sooner. [RT #24406] +</li><li> +Per RFC 6303, RFC 1918 reverse zones are now part of the built-in list of empty zones. [RT #24990] +</li></ul></div> + </div> + </div> + <div class="section" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3358460"></a>Bug Fixes</h2></div></div></div> + + <div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3358468"></a>9.8.1</h3></div></div></div> + + <div class="itemizedlist"><ul type="disc"><li> +During RFC5011 processing some journal write errors were not detected. +This could lead to managed-keys changes being committed but not +recorded in the journal files, causing potential inconsistencies +during later processing. [RT #20256] +</li><li> +A potential NULL pointer deference in the DNS64 code could cause +named to terminate unexpectedly. [RT #20256] +</li><li> +A state variable relating to DNSSEC could fail to be set during +some infrequently-executed code paths, allowing it to be used whilst +in an unitialized state during cache updates, with unpredictable results. +[RT #20256] +</li><li> +A potential NULL pointer deference in DNSSEC signing code could +cause named to terminate unexpectedly [RT #20256] +</li><li> +Several cosmetic code changes were made to silence warnings +generated by a static code analysis tool. [RT #20256] +</li><li> +When using the -x (sign with only KSK) option on dnssec-signzone, +it could incorrectly count the number of ZSKs in the zone. (And in 9.9.0, +some code cleanup and improved warning messages). [RT #20852] +</li><li> +When using _builtin in named.conf, named.conf changes were not found +when reloading the config file. Now checks _builtin zone arguments +to see if the zone is re-usable or not. [RT #21914] +</li><li> +Running dnssec-settime -f on an old-style key will +now force the key to be rewritten to the new key format even if no +other change has been specified, using "-P now -A now" +as default values. [RT #22474] +</li><li> +After an external code review, a code cleanup was done. [RT #22521] +</li><li> +Cause named to terminate at startup or rndc reconfig +reload to fail, if a log file specified in the +conf file isn't a plain file. (RT #22771] +</li><li> +named now forces the ADB cache time for glue related data to zero +instead of relying on TTL. This corrects problematic behavior in cases +where a server was authoritative for the A record of a nameserver for a +delegated zone and was queried to recursively resolve records within +that zone. [RT #22842] +</li><li> +When a validating resolver got a NODATA response for DNSKEY, it was +not caching the NODATA. Fixed and test added. [RT #22908] +</li><li> +Fixed a bug in which zone keys that were published +and but not immediately activated, automatic signing could fail to trigger. +[RT #22911] +</li><li> +Fixed precedence order bug with NS and DNAME records if both are present. +(Also fixed timing of autosign test in 9.7+) [RT #23035] +</li><li> +When a DNSSEC signed dynamic zone's signatures need to be refreshed, +named would first delete the old signatures in the zone. If a private +key of the same algorithm isn't available to named, the signing would +fail but the old signatures would already be deleted. named now checks +if it can access the private key before deleting the old signatures and +leaves the old signature if no private key is found. [RT #23136] +</li><li> +When using "auto-dnssec maintain" and rolling to a new key, a +private-type record (only used internally by named) could be created +and not marked as complete. [RT #23253] +</li><li> +Fixed last autosign test report. [RT #23256] +</li><li> +named didn't save gid at startup and later assumed gid 0. +named now saves/restores the gid when creating creating +named.pid at startup. [RT #23290] +</li><li> +If the server has an IPv6 address but does not have IPv6 connectivity +to the internet, dig +trace could fail attempting to use IPv6 +addresses. [RT #23297] +</li><li> +If named is configured with managed zones, the managed key maint timer +can exercise a race condition that can crash the server. +[RT #23303] +</li><li> +Changing TTL did not cause dnssec-signzone to generate new signatures. +[RT #23330] +</li><li> +Have the validating resolver use RRSIG original TTL to compute +validated RRset and RRSIG TTL. [RT #23332] +</li><li> +In "make test" bin/tests/resolver, hold the socket manager lock +while freeing the socket. +[RT #23333] +</li><li> +If named encountered a CNAME instead of a DS record when walking +the chain of trust down from the trust anchor, it incorrectly stopped +validating. [RT #23338] +</li><li> +dns/view.h needed dns/rpz.h but it wasn't in the Makfile.in +HEADERS variable. [RT #23342] +</li><li> +RRSIG records could have time stamps too far in the future. +[RT #23356] +</li><li> +named stores cached data in an in-memory database and keeps track of +how recently the data is used with a heap. The heap is stored within the +cache's memory space. Under a sustained high query load and with a small +cache size, this could lead to the heap exhausting the cache space. This +would result in cache misses and SERVFAILs, with named never releasing +the cache memory the heap used up and never recovering. + +This fix removes the heap into its own memory space, preventing the heap +from exhausting the cache space and allowing named to recover gracefully +when the high query load abates. [RT #23371] +</li><li> +Fully separated key management on a per view basis. [RT #23419] +</li><li> +If running on a powerpc CPU and with atomic operations enabled, +named could lock up. Added sync instructions to the end of atomic +operations. [RT #23469] +</li><li> +If OpenSSL was built without engine support, named would have +compile errors and fail to build. +[RT #23473] +</li><li> +If ./configure finds GOST but not elliptic curve, named fails to +build. Added elliptic curve support check in GOST OpenSSL engine +detection. [RT #23485] +</li><li> +"rndc secroots" would abort on the first error +and so could miss remaining views. [RT #23488] +</li><li> +Handle isc_event_allocate failures in t_tasks test. +[RT #23572] +</li><li> +ixfr-from-differences {master|slave}; +failed to select the master/slave zones, resulting in on diff/journal +file being created. +[RT #23580] +</li><li> +If a DNAME substitution failed, named returned NOERROR. The correct +response should be YXDOMAIN. +[RT #23591] +</li><li> +dns_dnssec_findzonekeys{2} used a inconsistant +timestamp when determining which keys are active. This could result in +some RRsets not being signed/re-signed. +[RT #23642] +</li><li> +Remove bin/tests/system/logfileconfig/ns1/named.conf and +add setup.sh in order to resolve changing named.conf issue. [RT #23687] +</li><li> +NOTIFY messages were not being sent when generating +a NSEC3 chain incrementally. [RT #23702] +</li><li> +DDNS updates using SIG(0) with update-policy match +type "external" could cause a crash. Also fixed nsupdate core +dump on shutdown when using a SIG(0) key, due to the key +not being freed. [RT #23735] +</li><li> +Zones using automatic key maintenance could fail to check the key +repository for updates. named now checks once per hour and the +automatic check bug has been fixed. [RT #23744] +</li><li> +named now uses the correct strtok/strtok_r/strtok_s based on OS. +[RT #23747] +</li><li> +Signatures for records at the zone apex could go +stale due to an incorrect timer setting. [RT #23769] +</li><li> +The autosign tests attempted to open ports within reserved ranges. Test +now avoids those ports. +[RT #23957] +</li><li> +GSS TGIS test was failing, since log_cred() caused KRB5_KTNAME to +be cached. Now sets KRB5_KTNAME before calling log_cred() in +dst_gssapi_acceptctx(). [RT #24004] +</li><li> +named, acting as authoritative server for DLZ zones, was not correctly +setting the authoritative (AA) bit. +[RT #24146] +</li><li> +Clean up some cross-compiling issues and added two undocumented +configure options, --with-gost and --with-rlimtype, to allow over-riding +default settings (gost=no and rlimtype="long int") when cross-compiling. +[RT #24367] +</li><li> +When trying sign with NSEC3, if dnssec-signzone couldn't find the +KSK, it would give an incorrect error "NSEC3 iterations too big for +weakest DNSKEY strength" rather than the correct "failed to find +keys at the zone apex: not found" [RT #24369] +</li><li> +Configuring 'dnssec-validation auto' in a view instead of in the +options statement could trigger an assertion failure in named-checkconf. +[RT #24382] +</li><li> +Improved consistency checks for dnssec-enable and +dnssec-validation, added test cases to the +checkconf system test. [RT #24398] +</li><li> +If named is configured to be both authoritative and recursive and receives +a recursive query for a CNAME in a zone that it is authoritative for, if that +CNAME also points to a zone the server is authoritative for, the recursive part of name will not follow the CNAME change and the response will not be a +complete CNAME chain. [RT #24455] +</li><li> +nsupdate could dump core on shutdown when using SIG(0) keys. [RT #24604] +</li><li> +Named could fail to validate zones list in a DLV that validated insecure +without using DLV and had DS records in the parent zone. [RT #24631] +</li><li> +dnssec-signzone now records timestamps just before and just after signing, improving the accuracy of signing statistics. [RT #16030] +</li><li> +If allow-new-zones was set to yes and name-based ACLs were used, named could crash when "rndc reconfig" was issued. [RT #22739] +</li><li> +RT #23136 fixed a problem where named would delete old signatures even +when the private key wasn't available to re-sign the zone, resulting in +a zone with missing signatures. This fix (CHANGES 3114) did not +completely fix all issues. [RT #24577] +</li><li> +A bug in FreeBSD kernels causes IPv6 UDP responses greater than +1280 bytes to not fragment as they should. Until there is a kernel +fix, named will work around this by setting IPV6_USE_MIN_MTU on a +per packet basis. [RT #24950] +</li></ul></div> + </div> + </div> + + <div class="section" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3359134"></a>Known issues in this release</h2></div></div></div> + + <div class="itemizedlist"><ul type="disc"><li> + <p> + None. + </p> + </li></ul></div> + </div> + + <div class="section" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3359152"></a>Thank You</h2></div></div></div> + + <p> + Thank you to everyone who assisted us in making this release possible. + If you would like to contribute to ISC to assist us in continuing to make + quality open source software, please visit our donations page at + <a href="http://www.isc.org/supportisc" target="_top">http://www.isc.org/supportisc</a>. + </p> + </div> +</div></body></html> |