mirror of
https://github.com/isc-projects/bind9.git
synced 2026-02-27 20:11:12 -05:00
80 lines
3 KiB
ReStructuredText
80 lines
3 KiB
ReStructuredText
..
|
|
Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
|
|
|
This Source Code Form is subject to the terms of the Mozilla Public
|
|
License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
|
|
|
See the COPYRIGHT file distributed with this work for additional
|
|
information regarding copyright ownership.
|
|
|
|
Notes for BIND 9.17.3
|
|
---------------------
|
|
|
|
New Features
|
|
~~~~~~~~~~~~
|
|
|
|
- New ``rndc`` command ``rndc dnssec -status`` shows the current DNSSEC
|
|
policy and keys in use, the key states, and rollover status.
|
|
[GL #1612]
|
|
|
|
- Added support in the network manager for initiating outgoing TCP
|
|
connections. [GL #1958]
|
|
|
|
Feature Changes
|
|
~~~~~~~~~~~~~~~
|
|
|
|
- Disable and disallow static linking of BIND 9 binaries and libraries
|
|
as BIND 9 modules require ``dlopen()`` support and static linking also
|
|
prevents using security features like read-only relocations (RELRO) or
|
|
address space layout randomization (ASLR) which are important for
|
|
programs that interact with the network and process arbitrary user
|
|
input. [GL #1933]
|
|
|
|
- As part of an ongoing effort to use RFC 8499 terminology,
|
|
``primaries`` can now be used as a synonym for ``masters`` in
|
|
``named.conf``. Similarly, ``notify primary-only`` can now be used as
|
|
a synonym for ``notify master-only``. The output of ``rndc
|
|
zonestatus`` now uses ``primary`` and ``secondary`` terminology.
|
|
[GL #1948]
|
|
|
|
Bug Fixes
|
|
~~~~~~~~~
|
|
|
|
- A race condition could occur if a TCP socket connection was closed
|
|
while ``named`` was waiting for a recursive response. The attempt to
|
|
send a response over the closing connection triggered an assertion
|
|
failure in the function ``isc__nm_tcpdns_send()``. [GL #1937]
|
|
|
|
- A race condition could occur when ``named`` attempted to use a UDP
|
|
interface that was shutting down. This triggered an assertion failure
|
|
in ``uv__udp_finish_close()``. [GL #1938]
|
|
|
|
- Fix assertion failure when server was under load and root zone had not
|
|
yet been loaded. [GL #1862]
|
|
|
|
- ``named`` could crash when cleaning dead nodes in ``lib/dns/rbtdb.c``
|
|
that were being reused. [GL #1968]
|
|
|
|
- ``named`` crashed on shutdown when a new ``rndc`` connection was
|
|
received during shutdown. This has been fixed. [GL #1747]
|
|
|
|
- The DS RRset returned by ``dns_keynode_dsset()`` was used in a
|
|
non-thread-safe manner. This could result in an INSIST being
|
|
triggered. [GL #1926]
|
|
|
|
- The ``primary`` and ``secondary`` keywords, when used as parameters
|
|
for ``check-names``, were not processed correctly and were being
|
|
ignored. [GL #1949]
|
|
|
|
- ``rndc dnstap -roll <value>`` did not limit the number of saved files
|
|
to ``<value>``. [GL !3728]
|
|
|
|
- The validator could fail to accept a properly signed RRset if an
|
|
unsupported algorithm appeared earlier in the DNSKEY RRset than a
|
|
supported algorithm. It could also stop if it detected a malformed
|
|
public key. [GL #1689]
|
|
|
|
- The ``blackhole`` ACL was inadvertently disabled for client queries.
|
|
Blocked IP addresses were not used for upstream queries but queries
|
|
from those addresses could still be answered. [GL #1936]
|