6fae67da24
https://deepthought.isc.org/article/AA-00446/81/ or /usr/src/contrib/bind9/ Approved by: re (kib)
369 lines
16 KiB
HTML
369 lines
16 KiB
HTML
<html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title></title><link rel="stylesheet" href="release-notes.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.71.1"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="article" lang="en"><div class="titlepage"><hr></div>
|
|
|
|
<div class="section" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3359008"></a>Introduction</h2></div></div></div>
|
|
|
|
<p>
|
|
BIND 9.8.1 is the current production release of BIND 9.8.
|
|
</p>
|
|
<p>
|
|
This document summarizes changes from BIND 9.8.0 to BIND 9.8.1.
|
|
Please see the CHANGES file in the source code release for a
|
|
complete list of all changes.
|
|
</p>
|
|
</div>
|
|
|
|
<div class="section" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3359050"></a>Download</h2></div></div></div>
|
|
|
|
<p>
|
|
The latest versions of BIND 9 software can always be found
|
|
on our web site at
|
|
<a href="http://www.isc.org/downloads/all" target="_top">http://www.isc.org/downloads/all</a>.
|
|
There you will find additional information about each
|
|
release, source code, and some pre-compiled versions for certain operating systems.
|
|
</p>
|
|
</div>
|
|
|
|
<div class="section" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2545549"></a>Support</h2></div></div></div>
|
|
|
|
<p>Product support information is available on
|
|
<a href="http://www.isc.org/services/support" target="_top">http://www.isc.org/services/support</a>
|
|
for paid support options. Free support is provided by our user
|
|
community via a mailing list. Information on all public email
|
|
lists is available at
|
|
<a href="https://lists.isc.org/mailman/listinfo" target="_top">https://lists.isc.org/mailman/listinfo</a>.
|
|
</p>
|
|
</div>
|
|
|
|
<div class="section" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3358108"></a>New Features</h2></div></div></div>
|
|
|
|
<div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3358149"></a>9.8.1</h3></div></div></div>
|
|
|
|
<div class="itemizedlist"><ul type="disc"><li>
|
|
Added a new include file with function typedefs
|
|
for the DLZ "dlopen" driver. [RT #23629]
|
|
</li><li>
|
|
Added a tool able to generate malformed packets to allow testing
|
|
of how named handles them.
|
|
[RT #24096]
|
|
</li><li>
|
|
The root key is now provided in the file bind.keys allowing DNSSEC validation to be switched on at start up by adding "dnssec-validation auto;" to named.conf. If the root key provided has expired, named will log the expiration and validation will not work. More information and the most current copy of bind.keys can be found at http://www.isc.org/bind-keys. *Please note this feature was actually added in 9.8.0 but was not included in the 9.8.0 release notes. [RT #21727]
|
|
</li></ul></div>
|
|
</div>
|
|
</div>
|
|
|
|
<div class="section" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3358206"></a>Security Fixes</h2></div></div></div>
|
|
|
|
<div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3358226"></a>9.8.1</h3></div></div></div>
|
|
|
|
<div class="itemizedlist"><ul type="disc"><li>
|
|
If named is configured with a response policy zone (RPZ) and a query
|
|
of type RRSIG is received for a name configured for RRset replacement
|
|
in that RPZ, it will trigger an INSIST and crash the server.
|
|
RRSIG. [RT #24280]
|
|
</li><li>
|
|
named, set up to be a caching resolver, is vulnerable to a
|
|
user querying a domain with very large resource record sets (RRSets)
|
|
when trying to negatively cache the response. Due to an off-by-one
|
|
error, caching the response could cause named to crash. [RT #24650]
|
|
[CVE-2011-1910]
|
|
</li><li>
|
|
Using Response Policy Zone (RPZ) to query a wildcard CNAME label with
|
|
QUERY type SIG/RRSIG, it can cause named to crash. Fix is query type
|
|
independant.
|
|
[RT #24715]
|
|
</li><li>
|
|
Using Response Policy Zone (RPZ) with DNAME records and querying the
|
|
subdomain of that label can cause named to crash. Now logs that DNAME
|
|
is not supported.
|
|
[RT #24766]
|
|
</li><li>
|
|
Change #2912 populated the message section in replies to UPDATE requests,
|
|
which some Windows clients wanted. This exposed a latent bug that allowed
|
|
the response message to crash named. With this fix, change 2912 has been
|
|
reduced to copy only the zone section to the reply. A more complete fix
|
|
for the latent bug will be released later.
|
|
[RT #24777]
|
|
</li></ul></div>
|
|
</div>
|
|
</div>
|
|
|
|
|
|
<div class="section" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3358283"></a>Feature Changes</h2></div></div></div>
|
|
|
|
<div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3358291"></a>9.8.1</h3></div></div></div>
|
|
|
|
<div class="itemizedlist"><ul type="disc"><li>
|
|
Merged in the NetBSD ATF test framework (currently
|
|
version 0.12) for development of future unit tests.
|
|
Use configure --with-atf to build ATF internally
|
|
or configure --with-atf=prefix to use an external
|
|
copy. [RT #23209]
|
|
</li><li>
|
|
Added more verbose error reporting from DLZ LDAP. [RT #23402]
|
|
</li><li>
|
|
The DLZ "dlopen" driver is now built by default,
|
|
no longer requiring a configure option. To
|
|
disable it, use "configure --without-dlopen".
|
|
(Note: driver not supported on win32.) [RT #23467]
|
|
</li><li>
|
|
Replaced compile time constant with STDTIME_ON_32BITS.
|
|
[RT #23587]
|
|
</li><li>
|
|
Make --with-gssapi default for ./configure. [RT #23738]
|
|
</li><li>
|
|
Improved the startup time for an authoritative server with a large
|
|
number of zones by making the zone task table of variable size
|
|
rather than fixed size. This means that authoritative servers with
|
|
lots of zones will be serving that zone data much sooner. [RT #24406]
|
|
</li><li>
|
|
Per RFC 6303, RFC 1918 reverse zones are now part of the built-in list of empty zones. [RT #24990]
|
|
</li></ul></div>
|
|
</div>
|
|
</div>
|
|
<div class="section" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3358460"></a>Bug Fixes</h2></div></div></div>
|
|
|
|
<div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3358468"></a>9.8.1</h3></div></div></div>
|
|
|
|
<div class="itemizedlist"><ul type="disc"><li>
|
|
During RFC5011 processing some journal write errors were not detected.
|
|
This could lead to managed-keys changes being committed but not
|
|
recorded in the journal files, causing potential inconsistencies
|
|
during later processing. [RT #20256]
|
|
</li><li>
|
|
A potential NULL pointer deference in the DNS64 code could cause
|
|
named to terminate unexpectedly. [RT #20256]
|
|
</li><li>
|
|
A state variable relating to DNSSEC could fail to be set during
|
|
some infrequently-executed code paths, allowing it to be used whilst
|
|
in an unitialized state during cache updates, with unpredictable results.
|
|
[RT #20256]
|
|
</li><li>
|
|
A potential NULL pointer deference in DNSSEC signing code could
|
|
cause named to terminate unexpectedly [RT #20256]
|
|
</li><li>
|
|
Several cosmetic code changes were made to silence warnings
|
|
generated by a static code analysis tool. [RT #20256]
|
|
</li><li>
|
|
When using the -x (sign with only KSK) option on dnssec-signzone,
|
|
it could incorrectly count the number of ZSKs in the zone. (And in 9.9.0,
|
|
some code cleanup and improved warning messages). [RT #20852]
|
|
</li><li>
|
|
When using _builtin in named.conf, named.conf changes were not found
|
|
when reloading the config file. Now checks _builtin zone arguments
|
|
to see if the zone is re-usable or not. [RT #21914]
|
|
</li><li>
|
|
Running dnssec-settime -f on an old-style key will
|
|
now force the key to be rewritten to the new key format even if no
|
|
other change has been specified, using "-P now -A now"
|
|
as default values. [RT #22474]
|
|
</li><li>
|
|
After an external code review, a code cleanup was done. [RT #22521]
|
|
</li><li>
|
|
Cause named to terminate at startup or rndc reconfig
|
|
reload to fail, if a log file specified in the
|
|
conf file isn't a plain file. (RT #22771]
|
|
</li><li>
|
|
named now forces the ADB cache time for glue related data to zero
|
|
instead of relying on TTL. This corrects problematic behavior in cases
|
|
where a server was authoritative for the A record of a nameserver for a
|
|
delegated zone and was queried to recursively resolve records within
|
|
that zone. [RT #22842]
|
|
</li><li>
|
|
When a validating resolver got a NODATA response for DNSKEY, it was
|
|
not caching the NODATA. Fixed and test added. [RT #22908]
|
|
</li><li>
|
|
Fixed a bug in which zone keys that were published
|
|
and but not immediately activated, automatic signing could fail to trigger.
|
|
[RT #22911]
|
|
</li><li>
|
|
Fixed precedence order bug with NS and DNAME records if both are present.
|
|
(Also fixed timing of autosign test in 9.7+) [RT #23035]
|
|
</li><li>
|
|
When a DNSSEC signed dynamic zone's signatures need to be refreshed,
|
|
named would first delete the old signatures in the zone. If a private
|
|
key of the same algorithm isn't available to named, the signing would
|
|
fail but the old signatures would already be deleted. named now checks
|
|
if it can access the private key before deleting the old signatures and
|
|
leaves the old signature if no private key is found. [RT #23136]
|
|
</li><li>
|
|
When using "auto-dnssec maintain" and rolling to a new key, a
|
|
private-type record (only used internally by named) could be created
|
|
and not marked as complete. [RT #23253]
|
|
</li><li>
|
|
Fixed last autosign test report. [RT #23256]
|
|
</li><li>
|
|
named didn't save gid at startup and later assumed gid 0.
|
|
named now saves/restores the gid when creating creating
|
|
named.pid at startup. [RT #23290]
|
|
</li><li>
|
|
If the server has an IPv6 address but does not have IPv6 connectivity
|
|
to the internet, dig +trace could fail attempting to use IPv6
|
|
addresses. [RT #23297]
|
|
</li><li>
|
|
If named is configured with managed zones, the managed key maint timer
|
|
can exercise a race condition that can crash the server.
|
|
[RT #23303]
|
|
</li><li>
|
|
Changing TTL did not cause dnssec-signzone to generate new signatures.
|
|
[RT #23330]
|
|
</li><li>
|
|
Have the validating resolver use RRSIG original TTL to compute
|
|
validated RRset and RRSIG TTL. [RT #23332]
|
|
</li><li>
|
|
In "make test" bin/tests/resolver, hold the socket manager lock
|
|
while freeing the socket.
|
|
[RT #23333]
|
|
</li><li>
|
|
If named encountered a CNAME instead of a DS record when walking
|
|
the chain of trust down from the trust anchor, it incorrectly stopped
|
|
validating. [RT #23338]
|
|
</li><li>
|
|
dns/view.h needed dns/rpz.h but it wasn't in the Makfile.in
|
|
HEADERS variable. [RT #23342]
|
|
</li><li>
|
|
RRSIG records could have time stamps too far in the future.
|
|
[RT #23356]
|
|
</li><li>
|
|
named stores cached data in an in-memory database and keeps track of
|
|
how recently the data is used with a heap. The heap is stored within the
|
|
cache's memory space. Under a sustained high query load and with a small
|
|
cache size, this could lead to the heap exhausting the cache space. This
|
|
would result in cache misses and SERVFAILs, with named never releasing
|
|
the cache memory the heap used up and never recovering.
|
|
|
|
This fix removes the heap into its own memory space, preventing the heap
|
|
from exhausting the cache space and allowing named to recover gracefully
|
|
when the high query load abates. [RT #23371]
|
|
</li><li>
|
|
Fully separated key management on a per view basis. [RT #23419]
|
|
</li><li>
|
|
If running on a powerpc CPU and with atomic operations enabled,
|
|
named could lock up. Added sync instructions to the end of atomic
|
|
operations. [RT #23469]
|
|
</li><li>
|
|
If OpenSSL was built without engine support, named would have
|
|
compile errors and fail to build.
|
|
[RT #23473]
|
|
</li><li>
|
|
If ./configure finds GOST but not elliptic curve, named fails to
|
|
build. Added elliptic curve support check in GOST OpenSSL engine
|
|
detection. [RT #23485]
|
|
</li><li>
|
|
"rndc secroots" would abort on the first error
|
|
and so could miss remaining views. [RT #23488]
|
|
</li><li>
|
|
Handle isc_event_allocate failures in t_tasks test.
|
|
[RT #23572]
|
|
</li><li>
|
|
ixfr-from-differences {master|slave};
|
|
failed to select the master/slave zones, resulting in on diff/journal
|
|
file being created.
|
|
[RT #23580]
|
|
</li><li>
|
|
If a DNAME substitution failed, named returned NOERROR. The correct
|
|
response should be YXDOMAIN.
|
|
[RT #23591]
|
|
</li><li>
|
|
dns_dnssec_findzonekeys{2} used a inconsistant
|
|
timestamp when determining which keys are active. This could result in
|
|
some RRsets not being signed/re-signed.
|
|
[RT #23642]
|
|
</li><li>
|
|
Remove bin/tests/system/logfileconfig/ns1/named.conf and
|
|
add setup.sh in order to resolve changing named.conf issue. [RT #23687]
|
|
</li><li>
|
|
NOTIFY messages were not being sent when generating
|
|
a NSEC3 chain incrementally. [RT #23702]
|
|
</li><li>
|
|
DDNS updates using SIG(0) with update-policy match
|
|
type "external" could cause a crash. Also fixed nsupdate core
|
|
dump on shutdown when using a SIG(0) key, due to the key
|
|
not being freed. [RT #23735]
|
|
</li><li>
|
|
Zones using automatic key maintenance could fail to check the key
|
|
repository for updates. named now checks once per hour and the
|
|
automatic check bug has been fixed. [RT #23744]
|
|
</li><li>
|
|
named now uses the correct strtok/strtok_r/strtok_s based on OS.
|
|
[RT #23747]
|
|
</li><li>
|
|
Signatures for records at the zone apex could go
|
|
stale due to an incorrect timer setting. [RT #23769]
|
|
</li><li>
|
|
The autosign tests attempted to open ports within reserved ranges. Test
|
|
now avoids those ports.
|
|
[RT #23957]
|
|
</li><li>
|
|
GSS TGIS test was failing, since log_cred() caused KRB5_KTNAME to
|
|
be cached. Now sets KRB5_KTNAME before calling log_cred() in
|
|
dst_gssapi_acceptctx(). [RT #24004]
|
|
</li><li>
|
|
named, acting as authoritative server for DLZ zones, was not correctly
|
|
setting the authoritative (AA) bit.
|
|
[RT #24146]
|
|
</li><li>
|
|
Clean up some cross-compiling issues and added two undocumented
|
|
configure options, --with-gost and --with-rlimtype, to allow over-riding
|
|
default settings (gost=no and rlimtype="long int") when cross-compiling.
|
|
[RT #24367]
|
|
</li><li>
|
|
When trying sign with NSEC3, if dnssec-signzone couldn't find the
|
|
KSK, it would give an incorrect error "NSEC3 iterations too big for
|
|
weakest DNSKEY strength" rather than the correct "failed to find
|
|
keys at the zone apex: not found" [RT #24369]
|
|
</li><li>
|
|
Configuring 'dnssec-validation auto' in a view instead of in the
|
|
options statement could trigger an assertion failure in named-checkconf.
|
|
[RT #24382]
|
|
</li><li>
|
|
Improved consistency checks for dnssec-enable and
|
|
dnssec-validation, added test cases to the
|
|
checkconf system test. [RT #24398]
|
|
</li><li>
|
|
If named is configured to be both authoritative and recursive and receives
|
|
a recursive query for a CNAME in a zone that it is authoritative for, if that
|
|
CNAME also points to a zone the server is authoritative for, the recursive part of name will not follow the CNAME change and the response will not be a
|
|
complete CNAME chain. [RT #24455]
|
|
</li><li>
|
|
nsupdate could dump core on shutdown when using SIG(0) keys. [RT #24604]
|
|
</li><li>
|
|
Named could fail to validate zones list in a DLV that validated insecure
|
|
without using DLV and had DS records in the parent zone. [RT #24631]
|
|
</li><li>
|
|
dnssec-signzone now records timestamps just before and just after signing, improving the accuracy of signing statistics. [RT #16030]
|
|
</li><li>
|
|
If allow-new-zones was set to yes and name-based ACLs were used, named could crash when "rndc reconfig" was issued. [RT #22739]
|
|
</li><li>
|
|
RT #23136 fixed a problem where named would delete old signatures even
|
|
when the private key wasn't available to re-sign the zone, resulting in
|
|
a zone with missing signatures. This fix (CHANGES 3114) did not
|
|
completely fix all issues. [RT #24577]
|
|
</li><li>
|
|
A bug in FreeBSD kernels causes IPv6 UDP responses greater than
|
|
1280 bytes to not fragment as they should. Until there is a kernel
|
|
fix, named will work around this by setting IPV6_USE_MIN_MTU on a
|
|
per packet basis. [RT #24950]
|
|
</li></ul></div>
|
|
</div>
|
|
</div>
|
|
|
|
<div class="section" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3359134"></a>Known issues in this release</h2></div></div></div>
|
|
|
|
<div class="itemizedlist"><ul type="disc"><li>
|
|
<p>
|
|
None.
|
|
</p>
|
|
</li></ul></div>
|
|
</div>
|
|
|
|
<div class="section" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3359152"></a>Thank You</h2></div></div></div>
|
|
|
|
<p>
|
|
Thank you to everyone who assisted us in making this release possible.
|
|
If you would like to contribute to ISC to assist us in continuing to make
|
|
quality open source software, please visit our donations page at
|
|
<a href="http://www.isc.org/supportisc" target="_top">http://www.isc.org/supportisc</a>.
|
|
</p>
|
|
</div>
|
|
</div></body></html>
|