2017-09-11 20:26:30 -04:00
|
|
|
|
<!--
|
|
|
|
|
|
-
|
|
|
|
|
|
- This Source Code Form is subject to the terms of the Mozilla Public
|
|
|
|
|
|
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
|
|
|
|
- file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
|
|
|
|
|
-->
|
2018-05-21 15:59:10 -04:00
|
|
|
|
<!-- $Id$ -->
|
2017-09-11 20:26:30 -04:00
|
|
|
|
<html>
|
|
|
|
|
|
<head>
|
|
|
|
|
|
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
|
|
|
|
|
|
<title></title>
|
2018-09-04 02:05:08 -04:00
|
|
|
|
<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
|
2017-09-11 20:26:30 -04:00
|
|
|
|
</head>
|
2018-09-04 02:05:08 -04:00
|
|
|
|
<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="article">
|
|
|
|
|
|
|
|
|
|
|
|
<div class="section">
|
2017-09-11 20:26:30 -04:00
|
|
|
|
<div class="titlepage"><div><div><h2 class="title" style="clear: both">
|
2019-03-20 01:57:47 -04:00
|
|
|
|
<a name="id-1.2"></a>Release Notes for BIND Version 9.14.0</h2></div></div></div>
|
2018-09-04 02:05:08 -04:00
|
|
|
|
|
|
|
|
|
|
<div class="section">
|
2017-09-11 20:26:30 -04:00
|
|
|
|
<div class="titlepage"><div><div><h3 class="title">
|
|
|
|
|
|
<a name="relnotes_intro"></a>Introduction</h3></div></div></div>
|
2018-09-04 02:05:08 -04:00
|
|
|
|
<p>
|
2019-02-27 19:05:06 -05:00
|
|
|
|
BIND 9.14.0 is the first release of a new stable branch of BIND.
|
|
|
|
|
|
This document summarizes new features and functional changes
|
|
|
|
|
|
that have been introduced, as well as features that have been
|
|
|
|
|
|
deprecated or removed, since the last stable branch, 9.12.
|
|
|
|
|
|
</p>
|
|
|
|
|
|
<p>
|
|
|
|
|
|
</p>
|
|
|
|
|
|
<p>
|
|
|
|
|
|
Please see the file <code class="filename">CHANGES</code> for a more
|
|
|
|
|
|
detailed list of changes and bug fixes.
|
2018-05-21 15:59:10 -04:00
|
|
|
|
</p>
|
2018-09-04 02:05:08 -04:00
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
|
|
<div class="section">
|
2018-05-21 15:59:10 -04:00
|
|
|
|
<div class="titlepage"><div><div><h3 class="title">
|
|
|
|
|
|
<a name="relnotes_versions"></a>Note on Version Numbering</h3></div></div></div>
|
2018-09-04 02:05:08 -04:00
|
|
|
|
<p>
|
2019-02-27 19:05:06 -05:00
|
|
|
|
As of BIND 9.13/9.14, BIND has adopted the "odd-unstable/even-stable"
|
|
|
|
|
|
release numbering convention. BIND 9.14 contains new features added
|
|
|
|
|
|
during the BIND 9.13 development process. Henceforth, the 9.14 branch
|
|
|
|
|
|
will be limited to bug fixes and new feature development will proceed
|
|
|
|
|
|
in the unstable 9.15 branch, and so forth.
|
2017-09-11 20:26:30 -04:00
|
|
|
|
</p>
|
2018-09-04 02:05:08 -04:00
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
|
|
<div class="section">
|
|
|
|
|
|
<div class="titlepage"><div><div><h3 class="title">
|
|
|
|
|
|
<a name="relnotes_platforms"></a>Supported Platforms</h3></div></div></div>
|
|
|
|
|
|
<p>
|
2019-02-27 19:05:06 -05:00
|
|
|
|
Since 9.12, BIND has undergone substantial code refactoring and
|
|
|
|
|
|
cleanup, and some very old code has been removed that was needed
|
|
|
|
|
|
to support legacy platforms which are no longer supported by their
|
|
|
|
|
|
vendors and for which ISC is no longer able to perform quality
|
|
|
|
|
|
assurance testing. Specifically, workarounds for old versions of
|
|
|
|
|
|
UnixWare, BSD/OS, AIX, Tru64, SunOS, TruCluster and IRIX have been
|
|
|
|
|
|
removed.
|
|
|
|
|
|
</p>
|
|
|
|
|
|
<p>
|
2018-09-04 02:05:08 -04:00
|
|
|
|
On UNIX-like systems, BIND now requires support for POSIX.1c
|
|
|
|
|
|
threads (IEEE Std 1003.1c-1995), the Advanced Sockets API for
|
|
|
|
|
|
IPv6 (RFC 3542), and standard atomic operations provided by the
|
|
|
|
|
|
C compiler.
|
|
|
|
|
|
</p>
|
|
|
|
|
|
<p>
|
|
|
|
|
|
More information can be found in the <code class="filename">PLATFORM.md</code>
|
|
|
|
|
|
file that is included in the source distribution of BIND 9. If your
|
|
|
|
|
|
platform compiler and system libraries provide the above features,
|
|
|
|
|
|
BIND 9 should compile and run. If that isn't the case, the BIND
|
|
|
|
|
|
development team will generally accept patches that add support
|
|
|
|
|
|
for systems that are still supported by their respective vendors.
|
|
|
|
|
|
</p>
|
|
|
|
|
|
<p>
|
2019-02-27 19:05:06 -05:00
|
|
|
|
As of BIND 9.14, the BIND development team has also made cryptography
|
2018-09-04 02:05:08 -04:00
|
|
|
|
(i.e., TSIG and DNSSEC) an integral part of the DNS server. The
|
|
|
|
|
|
OpenSSL cryptography library must be available for the target
|
|
|
|
|
|
platform. A PKCS#11 provider can be used instead for Public Key
|
|
|
|
|
|
cryptography (i.e., DNSSEC signing and validation), but OpenSSL is
|
|
|
|
|
|
still required for general cryptography operations such as hashing
|
|
|
|
|
|
and random number generation.
|
|
|
|
|
|
</p>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
|
|
<div class="section">
|
2017-09-11 20:26:30 -04:00
|
|
|
|
<div class="titlepage"><div><div><h3 class="title">
|
|
|
|
|
|
<a name="relnotes_download"></a>Download</h3></div></div></div>
|
2018-09-04 02:05:08 -04:00
|
|
|
|
<p>
|
2017-09-11 20:26:30 -04:00
|
|
|
|
The latest versions of BIND 9 software can always be found at
|
|
|
|
|
|
<a class="link" href="http://www.isc.org/downloads/" target="_top">http://www.isc.org/downloads/</a>.
|
|
|
|
|
|
There you will find additional information about each release,
|
|
|
|
|
|
source code, and pre-compiled versions for Microsoft Windows
|
|
|
|
|
|
operating systems.
|
|
|
|
|
|
</p>
|
2018-09-04 02:05:08 -04:00
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
|
|
<div class="section">
|
2017-09-11 20:26:30 -04:00
|
|
|
|
<div class="titlepage"><div><div><h3 class="title">
|
2019-03-20 01:57:47 -04:00
|
|
|
|
<a name="relnotes_issues"></a>Known Issues</h3></div></div></div>
|
|
|
|
|
|
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
|
|
|
|
|
|
<p>
|
|
|
|
|
|
A recent change in the <code class="filename">named.conf</code> parser
|
|
|
|
|
|
resulted in <span class="command"><strong>allow-update</strong></span> being treated as a
|
|
|
|
|
|
configuration error when set at the <span class="command"><strong>options</strong></span> or
|
|
|
|
|
|
<span class="command"><strong>view</strong></span> level. This is not a secure configuration
|
|
|
|
|
|
and the use of the option in this manner is ill-advised. However,
|
|
|
|
|
|
in this release it should have been treated as a warning rather
|
|
|
|
|
|
than a fatal error. This flaw was discovered too late to be
|
|
|
|
|
|
fixed in 9.14.0, but it will be corrected in the 9.14.1
|
|
|
|
|
|
maintenance release: global <span class="command"><strong>allow-update</strong></span> will
|
|
|
|
|
|
again be permitted, but a warning will be logged.
|
|
|
|
|
|
</p>
|
|
|
|
|
|
</li></ul></div>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
|
|
<div class="section">
|
|
|
|
|
|
<div class="titlepage"><div><div><h3 class="title">
|
2018-05-21 15:59:10 -04:00
|
|
|
|
<a name="relnotes_features"></a>New Features</h3></div></div></div>
|
2018-09-04 02:05:08 -04:00
|
|
|
|
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
|
2018-11-21 18:58:39 -05:00
|
|
|
|
<li class="listitem">
|
|
|
|
|
|
<p>
|
|
|
|
|
|
Task manager and socket code have been substantially modified.
|
|
|
|
|
|
The manager uses per-cpu queues for tasks and network stack runs
|
|
|
|
|
|
multiple event loops in CPU-affinitive threads. This greatly
|
|
|
|
|
|
improves performance on large systems, especially when using
|
|
|
|
|
|
multi-queue NICs.
|
|
|
|
|
|
</p>
|
|
|
|
|
|
</li>
|
2018-09-04 02:05:08 -04:00
|
|
|
|
<li class="listitem">
|
|
|
|
|
|
<p>
|
2019-02-27 19:05:06 -05:00
|
|
|
|
Support for QNAME minimization was added and enabled by default
|
|
|
|
|
|
in <span class="command"><strong>relaxed</strong></span> mode, in which BIND will fall back
|
|
|
|
|
|
to normal resolution if the remote server returns something
|
|
|
|
|
|
unexpected during the query minimization process. This default
|
|
|
|
|
|
setting might change to <span class="command"><strong>strict</strong></span> in the future.
|
2018-09-04 02:05:08 -04:00
|
|
|
|
</p>
|
|
|
|
|
|
</li>
|
2018-12-06 22:11:45 -05:00
|
|
|
|
<li class="listitem">
|
|
|
|
|
|
<p>
|
|
|
|
|
|
A new <span class="command"><strong>plugin</strong></span> mechanism has been added to allow
|
|
|
|
|
|
extension of query processing functionality through the use of
|
|
|
|
|
|
external libraries. The new <code class="filename">filter-aaaa.so</code>
|
|
|
|
|
|
plugin replaces the <span class="command"><strong>filter-aaaa</strong></span> feature that
|
|
|
|
|
|
was formerly implemented as a native part of BIND.
|
|
|
|
|
|
</p>
|
|
|
|
|
|
<p>
|
|
|
|
|
|
The plugin API is a work in progress and is likely to evolve
|
|
|
|
|
|
as further plugins are implemented. [GL #15]
|
|
|
|
|
|
</p>
|
|
|
|
|
|
</li>
|
2019-02-27 19:05:06 -05:00
|
|
|
|
<li class="listitem">
|
|
|
|
|
|
<p>
|
|
|
|
|
|
A new secondary zone option, <span class="command"><strong>mirror</strong></span>,
|
|
|
|
|
|
enables <span class="command"><strong>named</strong></span> to serve a transferred copy
|
|
|
|
|
|
of a zone's contents without acting as an authority for the
|
|
|
|
|
|
zone. A zone must be fully validated against an active trust
|
|
|
|
|
|
anchor before it can be used as a mirror zone. DNS responses
|
|
|
|
|
|
from mirror zones do not set the AA bit ("authoritative answer"),
|
|
|
|
|
|
but do set the AD bit ("authenticated data"). This feature is
|
|
|
|
|
|
meant to facilitate deployment of a local copy of the root zone,
|
|
|
|
|
|
as described in RFC 7706. [GL #33]
|
|
|
|
|
|
</p>
|
|
|
|
|
|
</li>
|
2018-09-04 02:05:08 -04:00
|
|
|
|
<li class="listitem">
|
|
|
|
|
|
<p>
|
2018-05-21 15:59:10 -04:00
|
|
|
|
BIND now can be compiled against the <span class="command"><strong>libidn2</strong></span>
|
|
|
|
|
|
library to add IDNA2008 support. Previously, BIND supported
|
|
|
|
|
|
IDNA2003 using the (now obsolete and unsupported)
|
|
|
|
|
|
<span class="command"><strong>idnkit-1</strong></span> library.
|
2018-09-04 02:05:08 -04:00
|
|
|
|
</p>
|
|
|
|
|
|
</li>
|
|
|
|
|
|
<li class="listitem">
|
|
|
|
|
|
<p>
|
2018-05-21 15:59:10 -04:00
|
|
|
|
<span class="command"><strong>named</strong></span> now supports the "root key sentinel"
|
2018-06-08 15:50:21 -04:00
|
|
|
|
mechanism. This enables validating resolvers to indicate
|
2018-05-21 15:59:10 -04:00
|
|
|
|
which trust anchors are configured for the root, so that
|
|
|
|
|
|
information about root key rollover status can be gathered.
|
|
|
|
|
|
To disable this feature, add
|
|
|
|
|
|
<span class="command"><strong>root-key-sentinel no;</strong></span> to
|
2018-06-08 15:50:21 -04:00
|
|
|
|
<code class="filename">named.conf</code>. [GL #37]
|
2018-09-04 02:05:08 -04:00
|
|
|
|
</p>
|
|
|
|
|
|
</li>
|
|
|
|
|
|
<li class="listitem">
|
|
|
|
|
|
<p>
|
2018-05-21 15:59:10 -04:00
|
|
|
|
The <span class="command"><strong>dnskey-sig-validity</strong></span> option allows the
|
|
|
|
|
|
<span class="command"><strong>sig-validity-interval</strong></span> to be overriden for
|
|
|
|
|
|
signatures covering DNSKEY RRsets. [GL #145]
|
2018-09-04 02:05:08 -04:00
|
|
|
|
</p>
|
|
|
|
|
|
</li>
|
|
|
|
|
|
<li class="listitem">
|
|
|
|
|
|
<p>
|
2018-07-03 03:31:31 -04:00
|
|
|
|
When built on Linux, BIND now requires the <span class="command"><strong>libcap</strong></span>
|
|
|
|
|
|
library to set process privileges. The adds a new compile-time
|
|
|
|
|
|
dependency, which can be met on most Linux platforms by installing the
|
|
|
|
|
|
<span class="command"><strong>libcap-dev</strong></span> or <span class="command"><strong>libcap-devel</strong></span>
|
|
|
|
|
|
package. BIND can also be built without capability support by using
|
|
|
|
|
|
<span class="command"><strong>configure --disable-linux-caps</strong></span>, at the cost of some
|
|
|
|
|
|
loss of security.
|
2018-09-04 02:05:08 -04:00
|
|
|
|
</p>
|
|
|
|
|
|
</li>
|
|
|
|
|
|
<li class="listitem">
|
|
|
|
|
|
<p>
|
2018-08-31 05:06:53 -04:00
|
|
|
|
The <span class="command"><strong>validate-except</strong></span> option specifies a list of
|
|
|
|
|
|
domains beneath which DNSSEC validation should not be performed,
|
|
|
|
|
|
regardless of whether a trust anchor has been configured above
|
|
|
|
|
|
them. [GL #237]
|
2018-09-04 02:05:08 -04:00
|
|
|
|
</p>
|
|
|
|
|
|
</li>
|
2018-11-21 18:58:39 -05:00
|
|
|
|
<li class="listitem">
|
|
|
|
|
|
<p>
|
|
|
|
|
|
Two new update policy rule types have been added
|
|
|
|
|
|
<span class="command"><strong>krb5-selfsub</strong></span> and <span class="command"><strong>ms-selfsub</strong></span>
|
|
|
|
|
|
which allow machines with Kerberos principals to update
|
|
|
|
|
|
the name space at or below the machine names identified
|
|
|
|
|
|
in the respective principals.
|
|
|
|
|
|
</p>
|
|
|
|
|
|
</li>
|
|
|
|
|
|
<li class="listitem">
|
|
|
|
|
|
<p>
|
|
|
|
|
|
The new configure option <span class="command"><strong>--enable-fips-mode</strong></span>
|
|
|
|
|
|
can be used to make BIND enable and enforce FIPS mode in the
|
|
|
|
|
|
OpenSSL library. When compiled with such option the BIND will
|
|
|
|
|
|
refuse to run if FIPS mode can't be enabled, thus this option
|
|
|
|
|
|
must be only enabled for the systems where FIPS mode is available.
|
|
|
|
|
|
</p>
|
|
|
|
|
|
</li>
|
|
|
|
|
|
<li class="listitem">
|
|
|
|
|
|
<p>
|
|
|
|
|
|
Two new configuration options <span class="command"><strong>min-cache-ttl</strong></span> and
|
|
|
|
|
|
<span class="command"><strong>min-ncache-ttl</strong></span> has been added to allow the BIND 9
|
|
|
|
|
|
administrator to override the minimum TTL in the received DNS records
|
|
|
|
|
|
(positive caching) and for storing the information about non-existent
|
|
|
|
|
|
records (negative caching). The configured minimum TTL for both
|
|
|
|
|
|
configuration options cannot exceed 90 seconds.
|
|
|
|
|
|
</p>
|
|
|
|
|
|
</li>
|
2019-02-06 17:02:20 -05:00
|
|
|
|
<li class="listitem">
|
|
|
|
|
|
<p>
|
|
|
|
|
|
<span class="command"><strong>rndc status</strong></span> output now includes a
|
|
|
|
|
|
<span class="command"><strong>reconfig/reload in progress</strong></span> status line if named
|
|
|
|
|
|
configuration is being reloaded.
|
|
|
|
|
|
</p>
|
|
|
|
|
|
</li>
|
2019-02-27 19:05:06 -05:00
|
|
|
|
<li class="listitem">
|
|
|
|
|
|
<p>
|
|
|
|
|
|
The new <span class="command"><strong>answer-cookie</strong></span> option, if set to
|
|
|
|
|
|
<code class="literal">no</code>, prevents <span class="command"><strong>named</strong></span> from
|
|
|
|
|
|
returning a DNS COOKIE option to a client, even if such an
|
|
|
|
|
|
option was present in the request. This is only intended as
|
|
|
|
|
|
a temporary measure, for use when <span class="command"><strong>named</strong></span>
|
|
|
|
|
|
shares an IP address with other servers that do not yet
|
|
|
|
|
|
support DNS COOKIE. A mismatch between servers on the same
|
|
|
|
|
|
address is not expected to cause operational problems, but the
|
|
|
|
|
|
option to disable COOKIE responses so that all servers have the
|
|
|
|
|
|
same behavior is provided out of an abundance of caution.
|
|
|
|
|
|
DNS COOKIE is an important security mechanism, and this option
|
|
|
|
|
|
should not be used to disable it unless absolutely necessary.
|
|
|
|
|
|
</p>
|
|
|
|
|
|
</li>
|
2018-05-21 15:59:10 -04:00
|
|
|
|
</ul></div>
|
2018-09-04 02:05:08 -04:00
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
|
|
<div class="section">
|
2017-10-16 21:08:55 -04:00
|
|
|
|
<div class="titlepage"><div><div><h3 class="title">
|
2018-01-19 20:10:44 -05:00
|
|
|
|
<a name="relnotes_removed"></a>Removed Features</h3></div></div></div>
|
2018-09-04 02:05:08 -04:00
|
|
|
|
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
|
2018-06-08 15:50:21 -04:00
|
|
|
|
<li class="listitem">
|
2018-09-04 02:05:08 -04:00
|
|
|
|
<p>
|
2018-08-31 05:06:53 -04:00
|
|
|
|
Workarounds for servers that misbehave when queried with EDNS
|
|
|
|
|
|
have been removed, because these broken servers and the
|
|
|
|
|
|
workarounds for their noncompliance cause unnecessary delays,
|
|
|
|
|
|
increase code complexity, and prevent deployment of new DNS
|
|
|
|
|
|
features. See <a class="link" href="https://dnsflagday.net" target="_top">https://dnsflagday.net</a>
|
|
|
|
|
|
for further details.
|
|
|
|
|
|
</p>
|
2018-09-04 02:05:08 -04:00
|
|
|
|
<p>
|
2018-08-31 05:06:53 -04:00
|
|
|
|
In particular, resolution will no longer fall back to
|
|
|
|
|
|
plain DNS when there was no response from an authoritative
|
|
|
|
|
|
server. This will cause some domains to become non-resolvable
|
|
|
|
|
|
without manual intervention. In these cases, resolution can
|
|
|
|
|
|
be restored by adding <span class="command"><strong>server</strong></span> clauses for the
|
|
|
|
|
|
offending servers, specifying <span class="command"><strong>edns no</strong></span> or
|
|
|
|
|
|
<span class="command"><strong>send-cookie no</strong></span>, depending on the specific
|
|
|
|
|
|
noncompliance.
|
|
|
|
|
|
</p>
|
2018-09-04 02:05:08 -04:00
|
|
|
|
<p>
|
2018-08-31 05:06:53 -04:00
|
|
|
|
To determine which <span class="command"><strong>server</strong></span> clause to use, run
|
|
|
|
|
|
the following commands to send queries to the authoritative
|
|
|
|
|
|
servers for the broken domain:
|
|
|
|
|
|
</p>
|
|
|
|
|
|
<div class="literallayout"><p><br>
|
|
|
|
|
|
<09><>dig<69>soa<6F><zone><EFBFBD>@<server><EFBFBD>+dnssec<br>
|
|
|
|
|
|
<09><>dig<69>soa<6F><zone><EFBFBD>@<server><EFBFBD>+dnssec<65>+nocookie<br>
|
|
|
|
|
|
<09><>dig<69>soa<6F><zone><EFBFBD>@<server><EFBFBD>+noedns<br>
|
|
|
|
|
|
</p></div>
|
2018-09-04 02:05:08 -04:00
|
|
|
|
<p>
|
2018-08-31 05:06:53 -04:00
|
|
|
|
If the first command fails but the second succeeds, the
|
|
|
|
|
|
server most likely needs <span class="command"><strong>send-cookie no</strong></span>.
|
|
|
|
|
|
If the first two fail but the third succeeds, then the server
|
|
|
|
|
|
needs EDNS to be fully disabled with <span class="command"><strong>edns no</strong></span>.
|
|
|
|
|
|
</p>
|
2018-09-04 02:05:08 -04:00
|
|
|
|
<p>
|
2018-08-31 05:06:53 -04:00
|
|
|
|
Please contact the administrators of noncompliant domains
|
|
|
|
|
|
and encourage them to upgrade their broken DNS servers. [GL #150]
|
|
|
|
|
|
</p>
|
2018-09-04 02:05:08 -04:00
|
|
|
|
</li>
|
|
|
|
|
|
<li class="listitem">
|
|
|
|
|
|
<p>
|
2018-08-31 05:06:53 -04:00
|
|
|
|
Previously, it was possible to build BIND without thread support
|
|
|
|
|
|
for old architectures and systems without threads support.
|
|
|
|
|
|
BIND now requires threading support (either POSIX or Windows) from
|
|
|
|
|
|
the operating system, and it cannot be built without threads.
|
2018-09-04 02:05:08 -04:00
|
|
|
|
</p>
|
|
|
|
|
|
</li>
|
2018-12-06 22:11:45 -05:00
|
|
|
|
<li class="listitem">
|
|
|
|
|
|
<p>
|
|
|
|
|
|
The <span class="command"><strong>filter-aaaa</strong></span>,
|
|
|
|
|
|
<span class="command"><strong>filter-aaaa-on-v4</strong></span>, and
|
|
|
|
|
|
<span class="command"><strong>filter-aaaa-on-v6</strong></span> options have been removed
|
|
|
|
|
|
from <span class="command"><strong>named</strong></span>, and can no longer be
|
|
|
|
|
|
configured using native <code class="filename">named.conf</code> syntax.
|
|
|
|
|
|
However, loading the new <code class="filename">filter-aaaa.so</code>
|
|
|
|
|
|
plugin and setting its parameters provides identical
|
|
|
|
|
|
functionality.
|
|
|
|
|
|
</p>
|
|
|
|
|
|
</li>
|
2018-08-31 05:06:53 -04:00
|
|
|
|
<li class="listitem">
|
2018-09-04 02:05:08 -04:00
|
|
|
|
<p>
|
2018-06-08 15:50:21 -04:00
|
|
|
|
<span class="command"><strong>named</strong></span> can no longer use the EDNS CLIENT-SUBNET
|
|
|
|
|
|
option for view selection. In its existing form, the authoritative
|
|
|
|
|
|
ECS feature was not fully RFC-compliant, and could not realistically
|
|
|
|
|
|
have been deployed in production for an authoritative server; its
|
|
|
|
|
|
only practical use was for testing and experimentation. In the
|
|
|
|
|
|
interest of code simplification, this feature has now been removed.
|
|
|
|
|
|
</p>
|
2018-09-04 02:05:08 -04:00
|
|
|
|
<p>
|
2018-06-08 15:50:21 -04:00
|
|
|
|
The ECS option is still supported in <span class="command"><strong>dig</strong></span> and
|
|
|
|
|
|
<span class="command"><strong>mdig</strong></span> via the +subnet argument, and can be parsed
|
|
|
|
|
|
and logged when received by <span class="command"><strong>named</strong></span>, but
|
|
|
|
|
|
it is no longer used for ACL processing. The
|
|
|
|
|
|
<span class="command"><strong>geoip-use-ecs</strong></span> option is now obsolete;
|
|
|
|
|
|
a warning will be logged if it is used in
|
|
|
|
|
|
<code class="filename">named.conf</code>.
|
|
|
|
|
|
<span class="command"><strong>ecs</strong></span> tags in an ACL definition are
|
|
|
|
|
|
also obsolete, and will cause the configuration to fail to
|
|
|
|
|
|
load if they are used. [GL #32]
|
|
|
|
|
|
</p>
|
2018-09-04 02:05:08 -04:00
|
|
|
|
</li>
|
|
|
|
|
|
<li class="listitem">
|
|
|
|
|
|
<p>
|
2018-01-19 20:10:44 -05:00
|
|
|
|
<span class="command"><strong>dnssec-keygen</strong></span> can no longer generate HMAC
|
|
|
|
|
|
keys for TSIG authentication. Use <span class="command"><strong>tsig-keygen</strong></span>
|
|
|
|
|
|
to generate these keys. [RT #46404]
|
2018-09-04 02:05:08 -04:00
|
|
|
|
</p>
|
|
|
|
|
|
</li>
|
|
|
|
|
|
<li class="listitem">
|
|
|
|
|
|
<p>
|
2018-05-21 15:59:10 -04:00
|
|
|
|
Support for OpenSSL 0.9.x has been removed. OpenSSL version
|
|
|
|
|
|
1.0.0 or greater, or LibreSSL is now required.
|
2018-09-04 02:05:08 -04:00
|
|
|
|
</p>
|
|
|
|
|
|
</li>
|
|
|
|
|
|
<li class="listitem">
|
|
|
|
|
|
<p>
|
2018-05-21 15:59:10 -04:00
|
|
|
|
The <span class="command"><strong>configure --enable-seccomp</strong></span> option,
|
|
|
|
|
|
which formerly turned on system-call filtering on Linux, has
|
|
|
|
|
|
been removed. [GL #93]
|
2018-09-04 02:05:08 -04:00
|
|
|
|
</p>
|
|
|
|
|
|
</li>
|
|
|
|
|
|
<li class="listitem">
|
|
|
|
|
|
<p>
|
2018-05-21 15:59:10 -04:00
|
|
|
|
IPv4 addresses in forms other than dotted-quad are no longer
|
|
|
|
|
|
accepted in master files. [GL #13] [GL #56]
|
2018-09-04 02:05:08 -04:00
|
|
|
|
</p>
|
|
|
|
|
|
</li>
|
|
|
|
|
|
<li class="listitem">
|
|
|
|
|
|
<p>
|
2018-05-21 15:59:10 -04:00
|
|
|
|
IDNA2003 support via (bundled) idnkit-1.0 has been removed.
|
2018-09-04 02:05:08 -04:00
|
|
|
|
</p>
|
|
|
|
|
|
</li>
|
|
|
|
|
|
<li class="listitem">
|
|
|
|
|
|
<p>
|
2018-05-21 15:59:10 -04:00
|
|
|
|
The "rbtdb64" database implementation (a parallel
|
|
|
|
|
|
implementation of "rbt") has been removed. [GL #217]
|
2018-09-04 02:05:08 -04:00
|
|
|
|
</p>
|
|
|
|
|
|
</li>
|
2018-05-21 15:59:10 -04:00
|
|
|
|
<li class="listitem">
|
2018-09-04 02:05:08 -04:00
|
|
|
|
<p>
|
2018-05-21 15:59:10 -04:00
|
|
|
|
The <span class="command"><strong>-r randomdev</strong></span> option to explicitly select
|
|
|
|
|
|
random device has been removed from the
|
|
|
|
|
|
<span class="command"><strong>ddns-confgen</strong></span>,
|
|
|
|
|
|
<span class="command"><strong>rndc-confgen</strong></span>,
|
|
|
|
|
|
<span class="command"><strong>nsupdate</strong></span>,
|
|
|
|
|
|
<span class="command"><strong>dnssec-confgen</strong></span>, and
|
|
|
|
|
|
<span class="command"><strong>dnssec-signzone</strong></span> commands.
|
|
|
|
|
|
</p>
|
2018-09-04 02:05:08 -04:00
|
|
|
|
<p>
|
2018-05-21 15:59:10 -04:00
|
|
|
|
The <span class="command"><strong>-p</strong></span> option to use pseudo-random data
|
|
|
|
|
|
has been removed from the <span class="command"><strong>dnssec-signzone</strong></span>
|
|
|
|
|
|
command.
|
|
|
|
|
|
</p>
|
2018-09-04 02:05:08 -04:00
|
|
|
|
</li>
|
|
|
|
|
|
<li class="listitem">
|
|
|
|
|
|
<p>
|
2019-02-27 19:05:06 -05:00
|
|
|
|
Support for the RSAMD5 algorithm has been removed freom BIND as
|
|
|
|
|
|
the usage of the RSAMD5 algorithm for DNSSEC has been deprecated
|
|
|
|
|
|
in RFC6725, the security of the MD5 algorithm has been compromised,
|
|
|
|
|
|
and its usage is considered harmful.
|
2018-09-04 02:05:08 -04:00
|
|
|
|
</p>
|
|
|
|
|
|
</li>
|
2018-07-03 03:31:31 -04:00
|
|
|
|
<li class="listitem">
|
2018-09-04 02:05:08 -04:00
|
|
|
|
<p>
|
2019-02-27 19:05:06 -05:00
|
|
|
|
Support for the ECC-GOST (GOST R 34.11-94) algorithm has been
|
|
|
|
|
|
removed from BIND, as the algorithm has been superseded by
|
|
|
|
|
|
GOST R 34.11-2012 in RFC6986 and it must not be used in new
|
|
|
|
|
|
deployments. BIND will neither create new DNSSEC keys,
|
|
|
|
|
|
signatures and digests, nor it will validate them.
|
2018-08-31 05:06:53 -04:00
|
|
|
|
</p>
|
2019-02-27 19:05:06 -05:00
|
|
|
|
</li>
|
|
|
|
|
|
<li class="listitem">
|
2018-11-21 18:58:39 -05:00
|
|
|
|
<p>
|
|
|
|
|
|
Support for DSA and DSA-NSEC3-SHA1 algorithms has been
|
|
|
|
|
|
removed from BIND as the DSA key length is limited to 1024
|
|
|
|
|
|
bits and this is not considered secure enough.
|
|
|
|
|
|
</p>
|
2019-02-27 19:05:06 -05:00
|
|
|
|
</li>
|
|
|
|
|
|
<li class="listitem">
|
|
|
|
|
|
<p>
|
|
|
|
|
|
<span class="command"><strong>named</strong></span> will no longer ignore "no-change" deltas
|
|
|
|
|
|
when processing an IXFR stream. This had previously been
|
|
|
|
|
|
permitted for compatibility with BIND 8, but now "no-change"
|
|
|
|
|
|
deltas will trigger a fallback to AXFR as the recovery mechanism.
|
|
|
|
|
|
</p>
|
|
|
|
|
|
</li>
|
|
|
|
|
|
<li class="listitem">
|
2019-02-06 17:02:20 -05:00
|
|
|
|
<p>
|
2019-02-27 19:05:06 -05:00
|
|
|
|
BIND 9 will no longer build on platforms that don't have
|
|
|
|
|
|
proper IPv6 support. BIND 9 now also requires POSIX-compatible
|
|
|
|
|
|
pthread support. Most of the platforms that lack these featuers
|
|
|
|
|
|
are long past their end-of-lifew dates, and they are neither
|
|
|
|
|
|
developed nor supported by their respective vendors.
|
2019-02-06 17:02:20 -05:00
|
|
|
|
</p>
|
|
|
|
|
|
</li>
|
|
|
|
|
|
<li class="listitem">
|
|
|
|
|
|
<p>
|
|
|
|
|
|
The incomplete support for internationalization message catalogs has
|
|
|
|
|
|
been removed from BIND. Since the internationalization was never
|
|
|
|
|
|
completed, and no localized message catalogs were ever made available
|
|
|
|
|
|
for the portions of BIND in which they could have been used, this
|
|
|
|
|
|
change will have no effect except to simplify the source code. BIND's
|
|
|
|
|
|
log messages and other output were already only available in English.
|
|
|
|
|
|
</p>
|
2018-09-04 02:05:08 -04:00
|
|
|
|
</li>
|
2018-05-21 15:59:10 -04:00
|
|
|
|
</ul></div>
|
2018-09-04 02:05:08 -04:00
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
|
|
<div class="section">
|
2018-01-19 20:10:44 -05:00
|
|
|
|
<div class="titlepage"><div><div><h3 class="title">
|
2017-12-15 20:09:51 -05:00
|
|
|
|
<a name="relnotes_changes"></a>Feature Changes</h3></div></div></div>
|
2018-09-04 02:05:08 -04:00
|
|
|
|
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
|
|
|
|
|
|
<li class="listitem">
|
|
|
|
|
|
<p>
|
2018-05-21 15:59:10 -04:00
|
|
|
|
BIND will now always use the best CSPRNG (cryptographically-secure
|
|
|
|
|
|
pseudo-random number generator) available on the platform where
|
2019-02-27 19:05:06 -05:00
|
|
|
|
it is compiled. It will use the <span class="command"><strong>arc4random()</strong></span>
|
2018-05-21 15:59:10 -04:00
|
|
|
|
family of functions on BSD operating systems,
|
|
|
|
|
|
<span class="command"><strong>getrandom()</strong></span> on Linux and Solaris,
|
|
|
|
|
|
<span class="command"><strong>CryptGenRandom</strong></span> on Windows, and the selected
|
|
|
|
|
|
cryptography provider library (OpenSSL or PKCS#11) as the last
|
|
|
|
|
|
resort. [GL #221]
|
2018-09-04 02:05:08 -04:00
|
|
|
|
</p>
|
|
|
|
|
|
</li>
|
|
|
|
|
|
<li class="listitem">
|
|
|
|
|
|
<p>
|
2018-06-08 15:50:21 -04:00
|
|
|
|
The default setting for <span class="command"><strong>dnssec-validation</strong></span> is
|
|
|
|
|
|
now <strong class="userinput"><code>auto</code></strong>, which activates DNSSEC
|
|
|
|
|
|
validation using the IANA root key. (The default can be changed
|
|
|
|
|
|
back to <strong class="userinput"><code>yes</code></strong>, which activates DNSSEC
|
|
|
|
|
|
validation only when keys are explicitly configured in
|
|
|
|
|
|
<code class="filename">named.conf</code>, by building BIND with
|
|
|
|
|
|
<span class="command"><strong>configure --disable-auto-validation</strong></span>.) [GL #30]
|
2018-09-04 02:05:08 -04:00
|
|
|
|
</p>
|
|
|
|
|
|
</li>
|
|
|
|
|
|
<li class="listitem">
|
|
|
|
|
|
<p>
|
2018-05-21 15:59:10 -04:00
|
|
|
|
BIND can no longer be built without DNSSEC support. A cryptography
|
2018-09-04 02:05:08 -04:00
|
|
|
|
provider (i.e., OpenSSL or a hardware service module with
|
2018-05-21 15:59:10 -04:00
|
|
|
|
PKCS#11 support) must be available. [GL #244]
|
2018-09-04 02:05:08 -04:00
|
|
|
|
</p>
|
|
|
|
|
|
</li>
|
|
|
|
|
|
<li class="listitem">
|
|
|
|
|
|
<p>
|
2017-12-15 20:09:51 -05:00
|
|
|
|
Zone types <span class="command"><strong>primary</strong></span> and
|
|
|
|
|
|
<span class="command"><strong>secondary</strong></span> are now available as synonyms for
|
|
|
|
|
|
<span class="command"><strong>master</strong></span> and <span class="command"><strong>slave</strong></span>,
|
|
|
|
|
|
respectively, in <code class="filename">named.conf</code>.
|
2018-09-04 02:05:08 -04:00
|
|
|
|
</p>
|
|
|
|
|
|
</li>
|
|
|
|
|
|
<li class="listitem">
|
|
|
|
|
|
<p>
|
2018-02-18 20:09:05 -05:00
|
|
|
|
<span class="command"><strong>named</strong></span> will now log a warning if the old
|
|
|
|
|
|
root DNSSEC key is explicitly configured and has not been updated.
|
|
|
|
|
|
[RT #43670]
|
2018-09-04 02:05:08 -04:00
|
|
|
|
</p>
|
|
|
|
|
|
</li>
|
|
|
|
|
|
<li class="listitem">
|
|
|
|
|
|
<p>
|
2018-05-21 15:59:10 -04:00
|
|
|
|
<span class="command"><strong>dig +nssearch</strong></span> will now list name servers
|
|
|
|
|
|
that have timed out, in addition to those that respond. [GL #64]
|
2018-09-04 02:05:08 -04:00
|
|
|
|
</p>
|
|
|
|
|
|
</li>
|
|
|
|
|
|
<li class="listitem">
|
|
|
|
|
|
<p>
|
2018-05-21 15:59:10 -04:00
|
|
|
|
Up to 64 <span class="command"><strong>response-policy</strong></span> zones are now
|
|
|
|
|
|
supported by default; previously the limit was 32. [GL #123]
|
2018-09-04 02:05:08 -04:00
|
|
|
|
</p>
|
|
|
|
|
|
</li>
|
|
|
|
|
|
<li class="listitem">
|
|
|
|
|
|
<p>
|
2018-05-21 15:59:10 -04:00
|
|
|
|
Several configuration options for time periods can now use
|
|
|
|
|
|
TTL value suffixes (for example, <code class="literal">2h</code> or
|
|
|
|
|
|
<code class="literal">1d</code>) in addition to an integer number of
|
|
|
|
|
|
seconds. These include
|
|
|
|
|
|
<span class="command"><strong>fstrm-set-reopen-interval</strong></span>,
|
|
|
|
|
|
<span class="command"><strong>interface-interval</strong></span>,
|
|
|
|
|
|
<span class="command"><strong>max-cache-ttl</strong></span>,
|
|
|
|
|
|
<span class="command"><strong>max-ncache-ttl</strong></span>,
|
|
|
|
|
|
<span class="command"><strong>max-policy-ttl</strong></span>, and
|
|
|
|
|
|
<span class="command"><strong>min-update-interval</strong></span>.
|
|
|
|
|
|
[GL #203]
|
2018-09-04 02:05:08 -04:00
|
|
|
|
</p>
|
|
|
|
|
|
</li>
|
|
|
|
|
|
<li class="listitem">
|
|
|
|
|
|
<p>
|
2018-06-08 15:50:21 -04:00
|
|
|
|
NSID logging (enabled by the <span class="command"><strong>request-nsid</strong></span>
|
|
|
|
|
|
option) now has its own <span class="command"><strong>nsid</strong></span> category,
|
|
|
|
|
|
instead of using the <span class="command"><strong>resolver</strong></span> category.
|
2018-09-04 02:05:08 -04:00
|
|
|
|
</p>
|
|
|
|
|
|
</li>
|
2018-11-21 18:58:39 -05:00
|
|
|
|
<li class="listitem">
|
|
|
|
|
|
<p>
|
|
|
|
|
|
The <span class="command"><strong>rndc nta</strong></span> command could not differentiate
|
|
|
|
|
|
between views of the same name but different class; this
|
|
|
|
|
|
has been corrected with the addition of a <span class="command"><strong>-class</strong></span>
|
|
|
|
|
|
option. [GL #105]
|
|
|
|
|
|
</p>
|
|
|
|
|
|
</li>
|
|
|
|
|
|
<li class="listitem">
|
|
|
|
|
|
<p>
|
|
|
|
|
|
<span class="command"><strong>allow-recursion-on</strong></span> and
|
|
|
|
|
|
<span class="command"><strong>allow-query-cache-on</strong></span> each now default to
|
|
|
|
|
|
the other if only one of them is set, in order to be consistent
|
|
|
|
|
|
with the way <span class="command"><strong>allow-recursion</strong></span> and
|
|
|
|
|
|
<span class="command"><strong>allow-query-cache</strong></span> work. [GL #319]
|
|
|
|
|
|
</p>
|
|
|
|
|
|
</li>
|
|
|
|
|
|
<li class="listitem">
|
|
|
|
|
|
<p>
|
|
|
|
|
|
When compiled with IDN support, the <span class="command"><strong>dig</strong></span> and
|
|
|
|
|
|
<span class="command"><strong>nslookup</strong></span> commands now disable IDN processing
|
|
|
|
|
|
when the standard output is not a TTY (i.e., when the output
|
|
|
|
|
|
is not being read by a human). When running from a shell
|
|
|
|
|
|
script, the command line options <span class="command"><strong>+idnin</strong></span> and
|
|
|
|
|
|
<span class="command"><strong>+idnout</strong></span> may be used to enable IDN
|
|
|
|
|
|
processing of input and output domain names, respectively.
|
|
|
|
|
|
When running on a TTY, the <span class="command"><strong>+noidnin</strong></span> and
|
|
|
|
|
|
<span class="command"><strong>+noidnout</strong></span> options may be used to disable
|
|
|
|
|
|
IDN processing of input and output domain names.
|
|
|
|
|
|
</p>
|
|
|
|
|
|
</li>
|
|
|
|
|
|
<li class="listitem">
|
|
|
|
|
|
<p>
|
|
|
|
|
|
The configuration option <span class="command"><strong>max-ncache-ttl</strong></span> cannot
|
|
|
|
|
|
exceed seven days. Previously, larger values than this were silently
|
|
|
|
|
|
lowered; now, they trigger a configuration error.
|
|
|
|
|
|
</p>
|
|
|
|
|
|
</li>
|
|
|
|
|
|
<li class="listitem">
|
|
|
|
|
|
<p>
|
|
|
|
|
|
The new <span class="command"><strong>dig -r</strong></span> command line option
|
|
|
|
|
|
disables reading of the file <code class="filename">$HOME/.digrc</code>.
|
|
|
|
|
|
</p>
|
|
|
|
|
|
</li>
|
2019-02-06 17:02:20 -05:00
|
|
|
|
<li class="listitem">
|
|
|
|
|
|
<p>
|
|
|
|
|
|
Zone signing and key maintenance events are now logged to the
|
|
|
|
|
|
<span class="command"><strong>dnssec</strong></span> category rather than
|
|
|
|
|
|
<span class="command"><strong>zone</strong></span>.
|
|
|
|
|
|
</p>
|
|
|
|
|
|
</li>
|
2018-02-02 20:11:31 -05:00
|
|
|
|
</ul></div>
|
2018-09-04 02:05:08 -04:00
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
|
|
<div class="section">
|
2017-09-11 20:26:30 -04:00
|
|
|
|
<div class="titlepage"><div><div><h3 class="title">
|
2017-12-15 20:09:51 -05:00
|
|
|
|
<a name="relnotes_license"></a>License</h3></div></div></div>
|
2018-09-04 02:05:08 -04:00
|
|
|
|
<p>
|
2017-12-15 20:09:51 -05:00
|
|
|
|
BIND is open source software licenced under the terms of the Mozilla
|
|
|
|
|
|
Public License, version 2.0 (see the <code class="filename">LICENSE</code>
|
|
|
|
|
|
file for the full text).
|
|
|
|
|
|
</p>
|
2018-09-04 02:05:08 -04:00
|
|
|
|
<p>
|
2017-12-15 20:09:51 -05:00
|
|
|
|
The license requires that if you make changes to BIND and distribute
|
|
|
|
|
|
them outside your organization, those changes must be published under
|
|
|
|
|
|
the same license. It does not require that you publish or disclose
|
|
|
|
|
|
anything other than the changes you have made to our software. This
|
|
|
|
|
|
requirement does not affect anyone who is using BIND, with or without
|
|
|
|
|
|
modifications, without redistributing it, nor anyone redistributing
|
|
|
|
|
|
BIND without changes.
|
|
|
|
|
|
</p>
|
2018-09-04 02:05:08 -04:00
|
|
|
|
<p>
|
2017-12-15 20:09:51 -05:00
|
|
|
|
Those wishing to discuss license compliance may contact ISC at
|
|
|
|
|
|
<a class="link" href="https://www.isc.org/mission/contact/" target="_top">
|
|
|
|
|
|
https://www.isc.org/mission/contact/</a>.
|
|
|
|
|
|
</p>
|
2018-09-04 02:05:08 -04:00
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
|
|
<div class="section">
|
2017-09-11 20:26:30 -04:00
|
|
|
|
<div class="titlepage"><div><div><h3 class="title">
|
|
|
|
|
|
<a name="end_of_life"></a>End of Life</h3></div></div></div>
|
2018-09-04 02:05:08 -04:00
|
|
|
|
<p>
|
2017-12-15 20:09:51 -05:00
|
|
|
|
The end of life date for BIND 9.14 has not yet been determined.
|
|
|
|
|
|
For those needing long term support, the current Extended Support
|
2018-05-21 15:59:10 -04:00
|
|
|
|
Version (ESV) is BIND 9.11, which will be supported until at
|
|
|
|
|
|
least December 2021. See
|
2017-09-11 20:26:30 -04:00
|
|
|
|
<a class="link" href="https://www.isc.org/downloads/software-support-policy/" target="_top">https://www.isc.org/downloads/software-support-policy/</a>
|
2017-12-15 20:09:51 -05:00
|
|
|
|
for details of ISC's software support policy.
|
2017-09-11 20:26:30 -04:00
|
|
|
|
</p>
|
2018-09-04 02:05:08 -04:00
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
|
|
<div class="section">
|
2017-09-11 20:26:30 -04:00
|
|
|
|
<div class="titlepage"><div><div><h3 class="title">
|
|
|
|
|
|
<a name="relnotes_thanks"></a>Thank You</h3></div></div></div>
|
2018-09-04 02:05:08 -04:00
|
|
|
|
<p>
|
2017-09-11 20:26:30 -04:00
|
|
|
|
Thank you to everyone who assisted us in making this release possible.
|
|
|
|
|
|
If you would like to contribute to ISC to assist us in continuing to
|
|
|
|
|
|
make quality open source software, please visit our donations page at
|
|
|
|
|
|
<a class="link" href="http://www.isc.org/donate/" target="_top">http://www.isc.org/donate/</a>.
|
|
|
|
|
|
</p>
|
2018-09-04 02:05:08 -04:00
|
|
|
|
</div>
|
2017-09-11 20:26:30 -04:00
|
|
|
|
</div>
|
2018-09-04 02:05:08 -04:00
|
|
|
|
</div></body>
|
2017-09-11 20:26:30 -04:00
|
|
|
|
</html>
|
