From 3b9b6d0b8e7f798023c9d109c490449d528fde80 Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Sun, 7 Apr 2024 17:59:48 +0200 Subject: Adding upstream version 1:9.18.19. Signed-off-by: Daniel Baumann --- doc/notes/notes-9.18.0.rst | 346 +++++++++++++++++++++++++++++++++++++++ doc/notes/notes-9.18.1.rst | 107 ++++++++++++ doc/notes/notes-9.18.10.rst | 80 +++++++++ doc/notes/notes-9.18.11.rst | 112 +++++++++++++ doc/notes/notes-9.18.12.rst | 54 ++++++ doc/notes/notes-9.18.13.rst | 75 +++++++++ doc/notes/notes-9.18.14.rst | 46 ++++++ doc/notes/notes-9.18.15.rst | 57 +++++++ doc/notes/notes-9.18.16.rst | 72 ++++++++ doc/notes/notes-9.18.17.rst | 42 +++++ doc/notes/notes-9.18.18.rst | 47 ++++++ doc/notes/notes-9.18.19.rst | 96 +++++++++++ doc/notes/notes-9.18.2.rst | 53 ++++++ doc/notes/notes-9.18.3.rst | 73 +++++++++ doc/notes/notes-9.18.4.rst | 44 +++++ doc/notes/notes-9.18.5.rst | 59 +++++++ doc/notes/notes-9.18.6.rst | 62 +++++++ doc/notes/notes-9.18.7.rst | 80 +++++++++ doc/notes/notes-9.18.8.rst | 68 ++++++++ doc/notes/notes-9.18.9.rst | 61 +++++++ doc/notes/notes-known-issues.rst | 62 +++++++ 21 files changed, 1696 insertions(+) create mode 100644 doc/notes/notes-9.18.0.rst create mode 100644 doc/notes/notes-9.18.1.rst create mode 100644 doc/notes/notes-9.18.10.rst create mode 100644 doc/notes/notes-9.18.11.rst create mode 100644 doc/notes/notes-9.18.12.rst create mode 100644 doc/notes/notes-9.18.13.rst create mode 100644 doc/notes/notes-9.18.14.rst create mode 100644 doc/notes/notes-9.18.15.rst create mode 100644 doc/notes/notes-9.18.16.rst create mode 100644 doc/notes/notes-9.18.17.rst create mode 100644 doc/notes/notes-9.18.18.rst create mode 100644 doc/notes/notes-9.18.19.rst create mode 100644 doc/notes/notes-9.18.2.rst create mode 100644 doc/notes/notes-9.18.3.rst create mode 100644 doc/notes/notes-9.18.4.rst create mode 100644 doc/notes/notes-9.18.5.rst create mode 100644 doc/notes/notes-9.18.6.rst create mode 100644 doc/notes/notes-9.18.7.rst create mode 100644 doc/notes/notes-9.18.8.rst create mode 100644 doc/notes/notes-9.18.9.rst create mode 100644 doc/notes/notes-known-issues.rst (limited to 'doc/notes') diff --git a/doc/notes/notes-9.18.0.rst b/doc/notes/notes-9.18.0.rst new file mode 100644 index 0000000..68f8c9b --- /dev/null +++ b/doc/notes/notes-9.18.0.rst @@ -0,0 +1,346 @@ +.. Copyright (C) Internet Systems Consortium, Inc. ("ISC") +.. +.. SPDX-License-Identifier: MPL-2.0 +.. +.. This Source Code Form is subject to the terms of the Mozilla Public +.. License, v. 2.0. If a copy of the MPL was not distributed with this +.. file, you can obtain one at https://mozilla.org/MPL/2.0/. +.. +.. See the COPYRIGHT file distributed with this work for additional +.. information regarding copyright ownership. + +Notes for BIND 9.18.0 +--------------------- + +.. note:: This section only lists changes since BIND 9.16.25, the most + recent release on the previous stable branch of BIND before + the publication of BIND 9.18.0. + +Known Issues +~~~~~~~~~~~~ + +- ``rndc`` has been updated to use the new BIND network manager API. As + the network manager currently has no support for UNIX-domain sockets, + those cannot now be used with ``rndc``. This will be addressed in a + future release, either by restoring UNIX-domain socket support or by + formally declaring them to be obsolete in the control channel. + :gl:`#1759` + +- See :ref:`above ` for a list of all known + issues affecting this BIND 9 branch. + +New Features +~~~~~~~~~~~~ + +- ``named`` now supports securing DNS traffic using Transport Layer + Security (TLS). TLS is used by both DNS over TLS (DoT) and + DNS over HTTPS (DoH). + + ``named`` can use either a certificate provided by the user or an + ephemeral certificate generated automatically upon startup. The + :any:`tls` block allows fine-grained control over TLS + parameters. :gl:`#1840` :gl:`#2795` :gl:`#2796` + + For debugging purposes, ``named`` logs TLS pre-master secrets when the + ``SSLKEYLOGFILE`` environment variable is set. This enables + troubleshooting of issues with encrypted traffic. :gl:`#2723` + +- Support for DNS over TLS (DoT) has been added to ``named``. Network + interfaces for DoT are configured using the existing + :ref:`listen-on ` directive, while TLS parameters are + configured using the new :any:`tls` block. :gl:`#1840` + + ``named`` supports :rfc:`zone transfers over TLS <9103>` + (XFR-over-TLS, XoT) for both incoming and outgoing zone transfers. + + Incoming zone transfers over TLS are enabled by adding the :any:`tls` + keyword, followed by either the name of a previously configured + :any:`tls` block or the string ``ephemeral``, to the + addresses included in :any:`primaries` lists. + :gl:`#2392` + + Similarly, the :any:`allow-transfer` option + was extended to accept additional ``port`` and ``transport`` + parameters, to further restrict outgoing zone transfers to a + particular port and/or DNS transport protocol. :gl:`#2776` + + Note that zone transfers over TLS (XoT) require the ``dot`` + Application-Layer Protocol Negotiation (ALPN) token to be selected in + the TLS handshake, as required by :rfc:`9103` section 7.1. This might + cause issues with non-compliant XoT servers. :gl:`#2794` + + The ``dig`` tool is now able to send DoT queries (``+tls`` option). + :gl:`#1840` + + There is currently no support for forwarding DNS queries via DoT. + +- Support for DNS over HTTPS (DoH) has been added to ``named``. Both + TLS-encrypted and unencrypted connections are supported (the latter + may be used to offload encryption to other software). Network + interfaces for DoH are configured using the existing + :ref:`listen-on ` directive, while TLS parameters are + configured using the new :any:`tls` block and HTTP + parameters are configured using the new :any:`http` block. + :gl:`#1144` :gl:`#2472` + + Server-side quotas on both the number of concurrent DoH connections + and the number of active HTTP/2 streams per connection can be + configured using the global :any:`http-listener-clients` and + :any:`http-streams-per-connection` options, or the :any:`listener-clients` + and :any:`streams-per-connection` parameters in an + :any:`http block `. :gl:`#2809` + + The ``dig`` tool is now able to send DoH queries (``+https`` option). + :gl:`#1641` + + There is currently no support for forwarding DNS queries via DoH. + + DoH support can be disabled at compile time using a new build-time + option, ``--disable-doh``. This allows BIND 9 to be built without the + `libnghttp2`_ library. :gl:`#2478` + +- A new logging category, ``rpz-passthru``, was added, which allows RPZ + passthru actions to be logged into a separate channel. :gl:`#54` + +- A new option, ``nsdname-wait-recurse``, has been added to the + :any:`response-policy` clause in the configuration file. When set to + ``no``, RPZ NSDNAME rules are only applied if the authoritative + nameservers for the query name have been looked up and are present in + the cache. If this information is not present, the RPZ NSDNAME rules + are ignored, but the information is looked up in the background and + applied to subsequent queries. The default is ``yes``, meaning that + RPZ NSDNAME rules should always be applied, even if the information + needs to be looked up first. :gl:`#1138` + +- Support for HTTPS and SVCB record types now also includes ADDITIONAL + section processing for these record types. :gl:`#1132` + +- New configuration options, :any:`tcp-receive-buffer`, + :any:`tcp-send-buffer`, :any:`udp-receive-buffer`, and :any:`udp-send-buffer`, + have been added. These options allow the operator to fine-tune the + receiving and sending buffers in the operating system. On busy + servers, increasing the size of the receive buffers can prevent the + server from dropping packets during short traffic spikes, and + decreasing it can prevent the server from becoming clogged with + queries that are too old and have already timed out. :gl:`#2313` + +- New finer-grained :any:`update-policy` rule types, + ``krb5-subdomain-self-rhs`` and ``ms-subdomain-self-rhs``, were added. + These rule types restrict updates to SRV and PTR records so that their + content can only match the machine name embedded in the Kerberos + principal making the change. :gl:`#481` + +- Per-type record count limits can now be specified in :any:`update-policy` + statements, to limit the number of records of a particular type that + can be added to a domain name via dynamic update. :gl:`#1657` + +- Support for OpenSSL 3.0 APIs was added. :gl:`#2843` :gl:`#3057` + +- Extended DNS Error Code 18 - Prohibited (see :rfc:`8914` section + 4.19) is now set if query access is denied to the specific client. + :gl:`#1836` + +- ``ipv4only.arpa`` is now served when DNS64 is configured. :gl:`#385` + +- ``dig`` can now report the DNS64 prefixes in use (``+dns64prefix``). + This is useful when the host on which ``dig`` is run is behind an + IPv6-only link, using DNS64/NAT64 or 464XLAT for IPv4aaS (IPv4 as a + Service). :gl:`#1154` + +- ``dig`` output now includes the transport protocol used (UDP, TCP, + TLS, HTTPS). :gl:`#1144` :gl:`#1816` + +- ``dig +qid=`` allows the user to specify a particular query ID + for testing purposes. :gl:`#1851` + +.. _libnghttp2: https://nghttp2.org/ + +Removed Features +~~~~~~~~~~~~~~~~ + +- Support for the ``map`` zone file format (``masterfile-format map;``) + has been removed. Users relying on the ``map`` format are advised to + convert their zones to the ``raw`` format with ``named-compilezone`` + and change the configuration appropriately prior to upgrading BIND 9. + :gl:`#2882` + +- Old-style Dynamically Loadable Zones (DLZ) drivers that had to be + enabled in ``named`` at build time have been removed. New-style DLZ + modules should be used as a replacement. :gl:`#2814` + +- Support for compiling and running BIND 9 natively on Windows has been + completely removed. The last stable release branch that has working + Windows support is BIND 9.16. :gl:`#2690` + +- Native PKCS#11 support has been removed. :gl:`#2691` + + When built against OpenSSL 1.x, BIND 9 now + :ref:`uses engine_pkcs11 for PKCS#11 `. engine_pkcs11 is an + OpenSSL engine which is part of the `OpenSC`_ project. + + As support for so-called "engines" was deprecated in OpenSSL 3.x, + compiling BIND 9 against an OpenSSL 3.x build which does not retain + support for deprecated APIs makes it impossible to use PKCS#11 in BIND + 9. A replacement for engine_pkcs11 which employs the new "provider" + approach introduced in OpenSSL 3.x is in the making. :gl:`#2843` + +- The utilities ``dnssec-checkds``, ``dnssec-coverage``, and + ``dnssec-keymgr`` have been removed from the BIND distribution, as well + as the ``isc`` Python package. DNSSEC features formerly provided + by these utilities are now integrated into ``named``. + See the :any:`dnssec-policy` configuration option + for more details. + + An archival version of the Python utilities has been moved to + the repository https://gitlab.isc.org/isc-projects/dnssec-keymgr/. + Please note these tools are no longer supported by ISC. + +- Since the old socket manager API has been removed, "socketmgr" + statistics are no longer reported by the + :any:`statistics-channels`. :gl:`#2926` + +- The :any:`glue-cache` *option* has been marked as deprecated. The glue + cache *feature* still works and will be permanently *enabled* in a + future release. :gl:`#2146` + +- A number of non-working configuration options that had been marked as + obsolete in previous releases have now been removed completely. Using + any of the following options is now considered a configuration + failure: ``acache-cleaning-interval``, ``acache-enable``, + ``additional-from-auth``, ``additional-from-cache``, + ``allow-v6-synthesis``, ``cleaning-interval``, ``dnssec-enable``, + ``dnssec-lookaside``, ``filter-aaaa``, ``filter-aaaa-on-v4``, + ``filter-aaaa-on-v6``, ``geoip-use-ecs``, ``lwres``, + ``max-acache-size``, ``nosit-udp-size``, ``queryport-pool-ports``, + ``queryport-pool-updateinterval``, ``request-sit``, ``sit-secret``, + ``support-ixfr``, ``use-queryport-pool``, ``use-ixfr``. :gl:`#1086` + +- The ``dig`` option ``+unexpected`` has been removed. :gl:`#2140` + +- IPv6 sockets are now explicitly restricted to sending and receiving + IPv6 packets only. As this breaks the ``+mapped`` option for ``dig``, + the option has been removed. :gl:`#3093` + +- Disable and disallow static linking of BIND 9 binaries and libraries + as BIND 9 modules require ``dlopen()`` support and static linking also + prevents using security features like read-only relocations (RELRO) or + address space layout randomization (ASLR) which are important for + programs that interact with the network and process arbitrary user + input. :gl:`#1933` + +- The ``--with-gperftools-profiler`` ``configure`` option was removed. + To use the gperftools profiler, the ``HAVE_GPERFTOOLS_PROFILER`` macro + now needs to be manually set in ``CFLAGS`` and ``-lprofiler`` needs to + be present in ``LDFLAGS``. :gl:`!4045` + +.. _OpenSC: https://github.com/OpenSC/libp11 + +Feature Changes +~~~~~~~~~~~~~~~ + +- Aggressive Use of DNSSEC-Validated Cache (:any:`synth-from-dnssec`, see + :rfc:`8198`) is now enabled by default again, after having been + disabled in BIND 9.14.8. The implementation of this feature was + reworked to achieve better efficiency and tuned to ignore certain + types of broken NSEC records. Negative answer synthesis is currently + only supported for zones using NSEC. :gl:`#1265` + +- The default NSEC3 parameters for :any:`dnssec-policy` were updated to no + extra SHA-1 iterations and no salt (``NSEC3PARAM 1 0 0 -``). This + change is in line with the `latest NSEC3 recommendations`_. + :gl:`#2956` + +- The default for :any:`dnssec-dnskey-kskonly` was changed to ``yes``. This + means that DNSKEY, CDNSKEY, and CDS RRsets are now only signed with + the KSK by default. The additional signatures prepared using the ZSK + when the option is set to ``no`` add to the DNS response payload + without offering added value. :gl:`#1316` + +- ``dnssec-cds`` now only generates SHA-2 DS records by default and + avoids copying deprecated SHA-1 records from a child zone to its + delegation in the parent. If the child zone does not publish SHA-2 CDS + records, ``dnssec-cds`` will generate them from the CDNSKEY records. + The ``-a algorithm`` option now affects the process of generating DS + digest records from both CDS and CDNSKEY records. Thanks to Tony + Finch. :gl:`#2871` + +- Previously, ``named`` accepted FORMERR responses both with and without + an OPT record, as an indication that a given server did not support + EDNS. To implement full compliance with :rfc:`6891`, only FORMERR + responses without an OPT record are now accepted. This intentionally + breaks communication with servers that do not support EDNS and that + incorrectly echo back the query message with the RCODE field set to + FORMERR and the QR bit set to 1. :gl:`#2249` + +- The question section is now checked when processing AXFR, IXFR, and + SOA replies while transferring a zone in. :gl:`#1683` + +- DNS Flag Day 2020: the EDNS buffer size probing code, which made the + resolver adjust the EDNS buffer size used for outgoing queries based + on the successful query responses and timeouts observed, was removed. + The resolver now always uses the EDNS buffer size set in + :any:`edns-udp-size` for all outgoing queries. :gl:`#2183` + +- Keeping stale answers in cache (:any:`stale-cache-enable`) has been + disabled by default. :gl:`#1712` + +- Overall memory use by ``named`` has been optimized and significantly + reduced, especially for resolver workloads. :gl:`#2398` :gl:`#3048` + +- Memory allocation is now based on the memory allocation API provided + by the `jemalloc`_ library, on platforms where it is available. Use of + this library is now recommended when building BIND 9; although it is + optional, it is enabled by default. :gl:`#2433` + +- Internal data structures maintained for each cache database are now + grown incrementally when they need to be expanded. This helps maintain + a steady response rate on a loaded resolver while these internal data + structures are resized. :gl:`#2941` + +- The interface handling code has been refactored to use fewer + resources, which should lead to less memory fragmentation and better + startup performance. :gl:`#2433` + +- When reporting zone types in the statistics channel, the terms + :any:`primary ` and :any:`secondary ` are now used instead of ``master`` and + ``slave``, respectively. :gl:`#1944` + +- The ``rndc nta -dump`` and ``rndc secroots`` commands now both include + :any:`validate-except` entries when listing negative trust anchors. These + are indicated by the keyword ``permanent`` in place of the expiry + date. :gl:`#1532` + +- The output of ``rndc serve-stale status`` has been clarified. It now + explicitly reports whether retention of stale data in the cache is + enabled (:any:`stale-cache-enable`), and whether returning such data in + responses is enabled (:any:`stale-answer-enable`). :gl:`#2742` + +- Previously, using ``dig +bufsize=0`` had the side effect of disabling + EDNS, and there was no way to test the remote server's behavior when + it had received a packet with EDNS0 buffer size set to 0. This is no + longer the case; ``dig +bufsize=0`` now sends a DNS message with EDNS + version 0 and buffer size set to 0. To disable EDNS, use ``dig + +noedns``. :gl:`#2054` + +- BIND 9 binaries which are neither daemons nor administrative programs + were moved to ``$bindir``. Only ``ddns-confgen``, ``named``, ``rndc``, + ``rndc-confgen``, and ``tsig-confgen`` were left in ``$sbindir``. + :gl:`#1724` + +- The BIND 9 build system has been changed to use a typical + autoconf+automake+libtool stack. This should not make any difference + for people building BIND 9 from release tarballs, but when building + BIND 9 from the Git repository, ``autoreconf -fi`` needs to be run + first. Extra attention is also needed when using non-standard + ``configure`` options. :gl:`#4` + +.. _latest NSEC3 recommendations: https://datatracker.ietf.org/doc/html/draft-ietf-dnsop-nsec3-guidance-02 + +.. _jemalloc: http://jemalloc.net/ + +Bug Fixes +~~~~~~~~~ + +- Log files using ``timestamp``-style suffixes were not always correctly + removed when the number of files exceeded the limit set by + ``versions``. This has been fixed. :gl:`#828` diff --git a/doc/notes/notes-9.18.1.rst b/doc/notes/notes-9.18.1.rst new file mode 100644 index 0000000..f76369b --- /dev/null +++ b/doc/notes/notes-9.18.1.rst @@ -0,0 +1,107 @@ +.. Copyright (C) Internet Systems Consortium, Inc. ("ISC") +.. +.. SPDX-License-Identifier: MPL-2.0 +.. +.. This Source Code Form is subject to the terms of the Mozilla Public +.. License, v. 2.0. If a copy of the MPL was not distributed with this +.. file, you can obtain one at https://mozilla.org/MPL/2.0/. +.. +.. See the COPYRIGHT file distributed with this work for additional +.. information regarding copyright ownership. + +Notes for BIND 9.18.1 +--------------------- + +Security Fixes +~~~~~~~~~~~~~~ + +- The rules for acceptance of records into the cache have been tightened + to prevent the possibility of poisoning if forwarders send records + outside the configured bailiwick. (CVE-2021-25220) + + ISC would like to thank Xiang Li, Baojun Liu, and Chaoyi Lu from + Network and Information Security Lab, Tsinghua University, and + Changgen Zou from Qi An Xin Group Corp. for bringing this + vulnerability to our attention. :gl:`#2950` + +- TCP connections with :any:`keep-response-order` enabled could leave the + TCP sockets in the ``CLOSE_WAIT`` state when the client did not + properly shut down the connection. (CVE-2022-0396) :gl:`#3112` + +- Lookups involving a DNAME could trigger an assertion failure when + :any:`synth-from-dnssec` was enabled (which is the default). + (CVE-2022-0635) + + ISC would like to thank Vincent Levigneron from AFNIC for bringing + this vulnerability to our attention. :gl:`#3158` + +- When chasing DS records, a timed-out or artificially delayed fetch + could cause ``named`` to crash while resuming a DS lookup. + (CVE-2022-0667) :gl:`#3129` + +Feature Changes +~~~~~~~~~~~~~~~ + +- The DLZ API has been updated: EDNS Client-Subnet (ECS) options sent + by a client are now included in the client information sent to DLZ + modules when processing queries. :gl:`#3082` + +- DEBUG(1)-level messages were added when starting and ending the BIND 9 + task-exclusive mode that stops normal DNS operation (e.g. for + reconfiguration, interface scans, and other events that require + exclusive access to a shared resource). :gl:`#3137` + +- The limit on the number of simultaneously processed pipelined DNS + queries received over TCP has been removed. Previously, it was capped + at 23 queries processed at the same time. :gl:`#3141` + +Bug Fixes +~~~~~~~~~ + +- A failed view configuration during a ``named`` reconfiguration + procedure could cause inconsistencies in BIND internal structures, + causing a crash or other unexpected errors. This has been fixed. + :gl:`#3060` + +- Previously, ``named`` logged a "quota reached" message when it hit its + hard quota on the number of connections. That message was accidentally + removed but has now been restored. :gl:`#3125` + +- The :any:`max-transfer-time-out` and :any:`max-transfer-idle-out` options + were not implemented when the BIND 9 networking stack was refactored + in 9.16. The missing functionality has been re-implemented and + outgoing zone transfers now time out properly when not progressing. + :gl:`#1897` + +- TCP connections could hang indefinitely if the other party did not + read sent data, causing the TCP write buffers to fill. This has been + fixed by adding a "write" timer. Connections that are hung while + writing now time out after the :any:`tcp-idle-timeout` period has + elapsed. :gl:`#3132` + +- Client TCP connections are now closed immediately when data received + cannot be parsed as a valid DNS request. :gl:`#3149` + +- The statistics counter representing the current number of clients + awaiting recursive resolution results (``RecursClients``) could be + miscalculated in certain resolution scenarios, potentially causing the + value of the counter to drop below zero. This has been fixed. + :gl:`#3147` + +- An error in the processing of the :any:`blackhole` ACL could cause some + DNS requests sent by :iscman:`named` to fail - for example, zone + transfer requests and SOA refresh queries - if the destination address + or prefix was specifically excluded from the ACL using ``!``, or if + the ACL was set to ``none``. This has now been fixed. :any:`blackhole` + worked correctly when it was left unset, or if only positive-match + elements were included. :gl:`#3157` + +- Build errors were introduced in some DLZ modules due to an incomplete + change in the previous release. This has been fixed. :gl:`#3111` + +Known Issues +~~~~~~~~~~~~ + +- There are no new known issues with this release. See :ref:`above + ` for a list of all known issues affecting this + BIND 9 branch. diff --git a/doc/notes/notes-9.18.10.rst b/doc/notes/notes-9.18.10.rst new file mode 100644 index 0000000..2fb54f3 --- /dev/null +++ b/doc/notes/notes-9.18.10.rst @@ -0,0 +1,80 @@ +.. Copyright (C) Internet Systems Consortium, Inc. ("ISC") +.. +.. SPDX-License-Identifier: MPL-2.0 +.. +.. This Source Code Form is subject to the terms of the Mozilla Public +.. License, v. 2.0. If a copy of the MPL was not distributed with this +.. file, you can obtain one at https://mozilla.org/MPL/2.0/. +.. +.. See the COPYRIGHT file distributed with this work for additional +.. information regarding copyright ownership. + +Notes for BIND 9.18.10 +---------------------- + +Feature Changes +~~~~~~~~~~~~~~~ + +- To reduce unnecessary memory consumption in the cache, NXDOMAIN + records are no longer retained past the normal negative cache TTL, + even if :any:`stale-cache-enable` is set to ``yes``. :gl:`#3386` + +- The :any:`auto-dnssec` option has been deprecated and will be removed + in a future BIND 9.19.x release. Please migrate to + :any:`dnssec-policy`. :gl:`#3667` + +- The :any:`coresize`, :any:`datasize`, :any:`files`, and + :any:`stacksize` options have been deprecated. The limits these + options set should be enforced externally, either by manual + configuration (e.g. using ``ulimit``) or via the process supervisor + (e.g. ``systemd``). :gl:`#3676` + +- Setting alternate local addresses for inbound zone transfers has been + deprecated. The relevant options (:any:`alt-transfer-source`, + :any:`alt-transfer-source-v6`, and :any:`use-alt-transfer-source`) + will be removed in a future BIND 9.19.x release. :gl:`#3694` + +- The number of HTTP headers allowed in requests sent to + :iscman:`named`'s statistics channel has been increased from 10 to + 100, to accommodate some browsers that send more than 10 headers + by default. :gl:`#3670` + +Bug Fixes +~~~~~~~~~ + +- :iscman:`named` could crash due to an assertion failure when an HTTP + connection to the statistics channel was closed prematurely (due to a + connection error, shutdown, etc.). This has been fixed. :gl:`#3693` + +- When a catalog zone was removed from the configuration, in some cases + a dangling pointer could cause the :iscman:`named` process to crash. + This has been fixed. :gl:`#3683` + +- When a zone was deleted from a server, a key management object related + to that zone was inadvertently kept in memory and only released upon + shutdown. This could lead to constantly increasing memory use on + servers with a high rate of changes affecting the set of zones being + served. This has been fixed. :gl:`#3727` + +- TLS configuration for primary servers was not applied for zones that + were members of a catalog zone. This has been fixed. :gl:`#3638` + +- In certain cases, :iscman:`named` waited for the resolution of + outstanding recursive queries to finish before shutting down. This was + unintended and has been fixed. :gl:`#3183` + +- :iscman:`host` and :iscman:`nslookup` command-line options setting the + custom TCP/UDP port to use were ignored for ANY queries (which are + sent over TCP). This has been fixed. :gl:`#3721` + +- The ``zone /: final reference detached`` log message was + moved from the INFO log level to the DEBUG(1) log level to prevent the + :iscman:`named-checkzone` tool from superfluously logging this message + in non-debug mode. :gl:`#3707` + +Known Issues +~~~~~~~~~~~~ + +- There are no new known issues with this release. See :ref:`above + ` for a list of all known issues affecting this + BIND 9 branch. diff --git a/doc/notes/notes-9.18.11.rst b/doc/notes/notes-9.18.11.rst new file mode 100644 index 0000000..3e44dc2 --- /dev/null +++ b/doc/notes/notes-9.18.11.rst @@ -0,0 +1,112 @@ +.. Copyright (C) Internet Systems Consortium, Inc. ("ISC") +.. +.. SPDX-License-Identifier: MPL-2.0 +.. +.. This Source Code Form is subject to the terms of the Mozilla Public +.. License, v. 2.0. If a copy of the MPL was not distributed with this +.. file, you can obtain one at https://mozilla.org/MPL/2.0/. +.. +.. See the COPYRIGHT file distributed with this work for additional +.. information regarding copyright ownership. + +Notes for BIND 9.18.11 +---------------------- + +Security Fixes +~~~~~~~~~~~~~~ + +- An UPDATE message flood could cause :iscman:`named` to exhaust all + available memory. This flaw was addressed by adding a new + :any:`update-quota` option that controls the maximum number of + outstanding DNS UPDATE messages that :iscman:`named` can hold in a + queue at any given time (default: 100). (CVE-2022-3094) + + ISC would like to thank Rob Schulhof from Infoblox for bringing this + vulnerability to our attention. :gl:`#3523` + +- :iscman:`named` could crash with an assertion failure when an RRSIG + query was received and :any:`stale-answer-client-timeout` was set to a + non-zero value. This has been fixed. (CVE-2022-3736) + + ISC would like to thank Borja Marcos from Sarenet (with assistance by + Iratxe Niño from Fundación Sarenet) for bringing this vulnerability to + our attention. :gl:`#3622` + +- :iscman:`named` running as a resolver with the + :any:`stale-answer-client-timeout` option set to any value greater + than ``0`` could crash with an assertion failure, when the + :any:`recursive-clients` soft quota was reached. This has been fixed. + (CVE-2022-3924) + + ISC would like to thank Maksym Odinintsev from AWS for bringing this + vulnerability to our attention. :gl:`#3619` + +New Features +~~~~~~~~~~~~ + +- The new :any:`update-quota` option can be used to control the number + of simultaneous DNS UPDATE messages that can be processed to update an + authoritative zone on a primary server, or forwarded to the primary + server by a secondary server. The default is 100. A new statistics + counter has also been added to record events when this quota is + exceeded, and the version numbers for the XML and JSON statistics + schemas have been updated. :gl:`#3523` + +Removed Features +~~~~~~~~~~~~~~~~ + +- The Differentiated Services Code Point (DSCP) feature in BIND has been + non-operational since the new Network Manager was introduced in BIND + 9.16. It is now marked as obsolete, and vestigial code implementing it + has been removed. Configuring DSCP values in ``named.conf`` now causes + a warning to be logged. :gl:`#3773` + +Feature Changes +~~~~~~~~~~~~~~~ + +- The catalog zone implementation has been optimized to work with + hundreds of thousands of member zones. :gl:`#3212` :gl:`#3744` + +Bug Fixes +~~~~~~~~~ + +- A rare assertion failure was fixed in outgoing TCP DNS connection + handling. :gl:`#3178` :gl:`#3636` + +- Large zone transfers over TLS (XoT) could fail. This has been fixed. + :gl:`#3772` + +- In addition to a previously fixed bug, another similar issue was + discovered where quotas could be erroneously reached for servers, + including any configured forwarders, resulting in SERVFAIL answers + being sent to clients. This has been fixed. :gl:`#3752` + +- In certain query resolution scenarios (e.g. when following CNAME + records), :iscman:`named` configured to answer from stale cache could + return a SERVFAIL response despite a usable, non-stale answer being + present in the cache. This has been fixed. :gl:`#3678` + +- When an outgoing request timed out, :iscman:`named` would retry up to + three times with the same server instead of trying the next available + name server. This has been fixed. :gl:`#3637` + +- Recently used ADB names and ADB entries (IP addresses) could get + cleaned when ADB was under memory pressure. To mitigate this, only + actual ADB names and ADB entries are now counted (excluding internal + memory structures used for "housekeeping") and recently used (<= 10 + seconds) ADB names and entries are excluded from the overmem memory + cleaner. :gl:`#3739` + +- The "Prohibited" Extended DNS Error was inadvertently set in some + NOERROR responses. This has been fixed. :gl:`#3743` + +- Previously, TLS session resumption could have led to handshake + failures when client certificates were used for authentication (Mutual + TLS). This has been fixed. :gl:`#3725` + +Known Issues +~~~~~~~~~~~~ + +- There are no new known issues with this release. See :ref:`above + ` for a list of all known issues affecting this + BIND 9 branch. diff --git a/doc/notes/notes-9.18.12.rst b/doc/notes/notes-9.18.12.rst new file mode 100644 index 0000000..be2046a --- /dev/null +++ b/doc/notes/notes-9.18.12.rst @@ -0,0 +1,54 @@ +.. Copyright (C) Internet Systems Consortium, Inc. ("ISC") +.. +.. SPDX-License-Identifier: MPL-2.0 +.. +.. This Source Code Form is subject to the terms of the Mozilla Public +.. License, v. 2.0. If a copy of the MPL was not distributed with this +.. file, you can obtain one at https://mozilla.org/MPL/2.0/. +.. +.. See the COPYRIGHT file distributed with this work for additional +.. information regarding copyright ownership. + +Notes for BIND 9.18.12 +---------------------- + +Removed Features +~~~~~~~~~~~~~~~~ + +- Specifying a ``port`` when configuring source addresses (i.e., as an + argument to :any:`query-source`, :any:`query-source-v6`, + :any:`transfer-source`, :any:`transfer-source-v6`, + :any:`notify-source`, :any:`notify-source-v6`, :any:`parental-source`, + or :any:`parental-source-v6`, or in the ``source`` or ``source-v6`` + arguments to :any:`primaries`, :any:`parental-agents`, + :any:`also-notify`, or :any:`catalog-zones`) has been deprecated. In + addition, the :any:`use-v4-udp-ports`, :any:`use-v6-udp-ports`, + :any:`avoid-v4-udp-ports`, and :any:`avoid-v6-udp-ports` options have + also been deprecated. + + Warnings are now logged when any of these options are encountered in + ``named.conf``. In a future release, they will be made nonfunctional. + :gl:`#3781` + +Bug Fixes +~~~~~~~~~ + +- A constant stream of zone additions and deletions via ``rndc + reconfig`` could cause increased memory consumption due to delayed + cleaning of view memory. This has been fixed. :gl:`#3801` + +- The speed of the message digest algorithms (MD5, SHA-1, SHA-2), and of + NSEC3 hashing, has been improved. :gl:`#3795` + +- Pointing :any:`parental-agents` to a resolver did not work because the + RD bit was not set on DS requests. This has been fixed. :gl:`#3783` + +- Building BIND 9 failed when the ``--enable-dnsrps`` switch for + ``./configure`` was used. This has been fixed. :gl:`#3827` + +Known Issues +~~~~~~~~~~~~ + +- There are no new known issues with this release. See :ref:`above + ` for a list of all known issues affecting this + BIND 9 branch. diff --git a/doc/notes/notes-9.18.13.rst b/doc/notes/notes-9.18.13.rst new file mode 100644 index 0000000..90b374a --- /dev/null +++ b/doc/notes/notes-9.18.13.rst @@ -0,0 +1,75 @@ +.. Copyright (C) Internet Systems Consortium, Inc. ("ISC") +.. +.. SPDX-License-Identifier: MPL-2.0 +.. +.. This Source Code Form is subject to the terms of the Mozilla Public +.. License, v. 2.0. If a copy of the MPL was not distributed with this +.. file, you can obtain one at https://mozilla.org/MPL/2.0/. +.. +.. See the COPYRIGHT file distributed with this work for additional +.. information regarding copyright ownership. + +Notes for BIND 9.18.13 +---------------------- + +New Features +~~~~~~~~~~~~ + +- RPZ updates are now run on specialized "offload" threads to reduce the + amount of time they block query processing on the main networking + threads. This increases the responsiveness of :iscman:`named` when RPZ + updates are being applied after an RPZ zone has been successfully + transferred. :gl:`#3190` + +Feature Changes +~~~~~~~~~~~~~~~ + +- Catalog zone updates are now run on specialized "offload" threads to + reduce the amount of time they block query processing on the main + networking threads. This increases the responsiveness of + :iscman:`named` when catalog zone updates are being applied after a + catalog zone has been successfully transferred. :gl:`#3881` + +- libuv support for receiving multiple UDP messages in a single + ``recvmmsg()`` system call has been tweaked several times between + libuv versions 1.35.0 and 1.40.0; the current recommended libuv + version is 1.40.0 or higher. New rules are now in effect for running + with a different version of libuv than the one used at compilation + time. These rules may trigger a fatal error at startup: + + - Building against or running with libuv versions 1.35.0 and 1.36.0 is + now a fatal error. + + - Running with libuv version higher than 1.34.2 is now a fatal error + when :iscman:`named` is built against libuv version 1.34.2 or lower. + + - Running with libuv version higher than 1.39.0 is now a fatal error + when :iscman:`named` is built against libuv version 1.37.0, 1.38.0, + 1.38.1, or 1.39.0. + + This prevents the use of libuv versions that may trigger an assertion + failure when receiving multiple UDP messages in a single system call. + :gl:`#3840` + +Bug Fixes +~~~~~~~~~ + +- :iscman:`named` could crash with an assertion failure when adding a + new zone into the configuration file for a name which was already + configured as a member zone for a catalog zone. This has been fixed. + :gl:`#3911` + +- When :iscman:`named` starts up, it sends a query for the DNSSEC key + for each configured trust anchor to determine whether the key has + changed. In some unusual cases, the query might depend on a zone for + which the server is itself authoritative, and would have failed if it + were sent before the zone was fully loaded. This has now been fixed by + delaying the key queries until all zones have finished loading. + :gl:`#3673` + +Known Issues +~~~~~~~~~~~~ + +- There are no new known issues with this release. See :ref:`above + ` for a list of all known issues affecting this + BIND 9 branch. diff --git a/doc/notes/notes-9.18.14.rst b/doc/notes/notes-9.18.14.rst new file mode 100644 index 0000000..38e0256 --- /dev/null +++ b/doc/notes/notes-9.18.14.rst @@ -0,0 +1,46 @@ +.. Copyright (C) Internet Systems Consortium, Inc. ("ISC") +.. +.. SPDX-License-Identifier: MPL-2.0 +.. +.. This Source Code Form is subject to the terms of the Mozilla Public +.. License, v. 2.0. If a copy of the MPL was not distributed with this +.. file, you can obtain one at https://mozilla.org/MPL/2.0/. +.. +.. See the COPYRIGHT file distributed with this work for additional +.. information regarding copyright ownership. + +Notes for BIND 9.18.14 +---------------------- + +Removed Features +~~~~~~~~~~~~~~~~ + +- Zone type ``delegation-only``, and the ``delegation-only`` and + ``root-delegation-only`` statements, have been deprecated. + A warning is now logged when they are used. + + These statements were created to address the SiteFinder controversy, + in which certain top-level domains redirected misspelled queries to + other sites instead of returning NXDOMAIN responses. Since top-level + domains are now DNSSEC-signed, and DNSSEC validation is active by + default, the statements are no longer needed. :gl:`#3953` + +Bug Fixes +~~~~~~~~~ + +- Several bugs which could cause :iscman:`named` to crash during catalog + zone processing have been fixed. :gl:`#3955` :gl:`#3968` :gl:`#3997` + +- Previously, downloading large zones over TLS (XoT) from a primary + could hang the transfer on the secondary, especially when the + connection was unstable. This has been fixed. :gl:`#3867` + +- Performance of DNSSEC validation in zones with many DNSKEY records has + been improved. :gl:`#3981` + +Known Issues +~~~~~~~~~~~~ + +- There are no new known issues with this release. See :ref:`above + ` for a list of all known issues affecting this + BIND 9 branch. diff --git a/doc/notes/notes-9.18.15.rst b/doc/notes/notes-9.18.15.rst new file mode 100644 index 0000000..7642ab2 --- /dev/null +++ b/doc/notes/notes-9.18.15.rst @@ -0,0 +1,57 @@ +.. Copyright (C) Internet Systems Consortium, Inc. ("ISC") +.. +.. SPDX-License-Identifier: MPL-2.0 +.. +.. This Source Code Form is subject to the terms of the Mozilla Public +.. License, v. 2.0. If a copy of the MPL was not distributed with this +.. file, you can obtain one at https://mozilla.org/MPL/2.0/. +.. +.. See the COPYRIGHT file distributed with this work for additional +.. information regarding copyright ownership. + +Notes for BIND 9.18.15 +---------------------- + +Bug Fixes +~~~~~~~~~ + +- The :any:`max-transfer-time-in` and :any:`max-transfer-idle-in` + statements have not had any effect since the BIND 9 networking stack + was refactored in version 9.16. The missing functionality has been + re-implemented and incoming zone transfers now time out properly when + not progressing. :gl:`#4004` + +- The read timeout in :iscman:`rndc` is now 60 seconds, matching the + behavior in BIND 9.16 and earlier. It had previously been lowered to + 30 seconds by mistake. :gl:`#4046` + +- When the ``ISC_R_INVALIDPROTO`` (``ENOPROTOOPT``, ``EPROTONOSUPPORT``) + error code is returned by libuv, it is now treated as a network + failure: the server for which that error code is returned gets marked + as broken and is not contacted again during a given resolution + process. :gl:`#4005` + +- When removing delegations from an opt-out range, empty-non-terminal + NSEC3 records generated by those delegations were not cleaned up. This + has been fixed. :gl:`#4027` + +- Log file rotation code did not clean up older versions of log files + when the logging :any:`channel` had an absolute path configured as a + ``file`` destination. This has been fixed. :gl:`#3991` + +Known Issues +~~~~~~~~~~~~ + +- Sending NOTIFY messages silently fails when the source port specified + in the :any:`notify-source` statement is already in use. This can + happen e.g. when multiple servers are configured as NOTIFY targets for + a zone and some of them are unresponsive. This issue can be worked + around by not specifying the source port for NOTIFY messages in the + :any:`notify-source` statement; note that source port configuration is + already `deprecated`_ and will be removed altogether in a future + release. :gl:`#4002` + +- See :ref:`above ` for a list of all known + issues affecting this BIND 9 branch. + +.. _deprecated: https://gitlab.isc.org/isc-projects/bind9/-/issues/3781 diff --git a/doc/notes/notes-9.18.16.rst b/doc/notes/notes-9.18.16.rst new file mode 100644 index 0000000..9ed090c --- /dev/null +++ b/doc/notes/notes-9.18.16.rst @@ -0,0 +1,72 @@ +.. Copyright (C) Internet Systems Consortium, Inc. ("ISC") +.. +.. SPDX-License-Identifier: MPL-2.0 +.. +.. This Source Code Form is subject to the terms of the Mozilla Public +.. License, v. 2.0. If a copy of the MPL was not distributed with this +.. file, you can obtain one at https://mozilla.org/MPL/2.0/. +.. +.. See the COPYRIGHT file distributed with this work for additional +.. information regarding copyright ownership. + +Notes for BIND 9.18.16 +---------------------- + +Security Fixes +~~~~~~~~~~~~~~ + +- The overmem cleaning process has been improved, to prevent the cache from + significantly exceeding the configured :any:`max-cache-size` limit. + (CVE-2023-2828) + + ISC would like to thank Shoham Danino from Reichman University, Anat + Bremler-Barr from Tel-Aviv University, Yehuda Afek from Tel-Aviv University, + and Yuval Shavitt from Tel-Aviv University for bringing this vulnerability to + our attention. :gl:`#4055` + +- A query that prioritizes stale data over lookup triggers a fetch to refresh + the stale data in cache. If the fetch is aborted for exceeding the recursion + quota, it was possible for :iscman:`named` to enter an infinite callback + loop and crash due to stack overflow. This has been fixed. (CVE-2023-2911) + :gl:`#4089` + +New Features +~~~~~~~~~~~~ + +- The system test suite can now be executed with pytest (along with + pytest-xdist for parallel execution). :gl:`#3978` + +Removed Features +~~~~~~~~~~~~~~~~ + +- TKEY mode 2 (Diffie-Hellman Exchanged Keying) is now deprecated, and + will be removed in a future release. A warning will be logged when + the :any:`tkey-dhkey` option is used in ``named.conf``. :gl:`#3905` + +Bug Fixes +~~~~~~~~~ + +- BIND could get stuck on reconfiguration when a :any:`listen-on` + statement for HTTP is removed from the configuration. That has been + fixed. :gl:`#4071` + +- Previously, it was possible for a delegation from cache to be returned + to the client after the :any:`stale-answer-client-timeout` duration. + This has been fixed. :gl:`#3950` + +- BIND could allocate too big buffers when sending data via + stream-based DNS transports, leading to increased memory usage. + This has been fixed. :gl:`#4038` + +- When the :any:`stale-answer-enable` option was enabled and the + :any:`stale-answer-client-timeout` option was enabled and larger than + 0, :iscman:`named` previously allocated two slots from the + :any:`clients-per-query` limit for each client and failed to gradually + auto-tune its value, as configured. This has been fixed. :gl:`#4074` + +Known Issues +~~~~~~~~~~~~ + +- There are no new known issues with this release. See :ref:`above + ` for a list of all known issues affecting this + BIND 9 branch. diff --git a/doc/notes/notes-9.18.17.rst b/doc/notes/notes-9.18.17.rst new file mode 100644 index 0000000..87dbca3 --- /dev/null +++ b/doc/notes/notes-9.18.17.rst @@ -0,0 +1,42 @@ +.. Copyright (C) Internet Systems Consortium, Inc. ("ISC") +.. +.. SPDX-License-Identifier: MPL-2.0 +.. +.. This Source Code Form is subject to the terms of the Mozilla Public +.. License, v. 2.0. If a copy of the MPL was not distributed with this +.. file, you can obtain one at https://mozilla.org/MPL/2.0/. +.. +.. See the COPYRIGHT file distributed with this work for additional +.. information regarding copyright ownership. + +Notes for BIND 9.18.17 +---------------------- + +Feature Changes +~~~~~~~~~~~~~~~ + +- If a response from an authoritative server has its RCODE set to + FORMERR and contains an echoed EDNS COOKIE option that was present in + the query, :iscman:`named` now retries sending the query to the + same server without an EDNS COOKIE option. :gl:`#4049` + +- The ``relaxed`` QNAME minimization mode now uses NS records. This + reduces the number of queries :iscman:`named` makes when resolving, as + it allows the non-existence of NS RRsets at non-referral nodes to be + cached in addition to the normally cached referrals. :gl:`#3325` + +Bug Fixes +~~~~~~~~~ + +- The ability to read HMAC-MD5 key files, which was accidentally lost in + BIND 9.18.8, has been restored. :gl:`#3668` :gl:`#4154` + +- Several minor stability issues with the catalog zone implementation + have been fixed. :gl:`#4132` :gl:`#4136` :gl:`#4171` + +Known Issues +~~~~~~~~~~~~ + +- There are no new known issues with this release. See :ref:`above + ` for a list of all known issues affecting this + BIND 9 branch. diff --git a/doc/notes/notes-9.18.18.rst b/doc/notes/notes-9.18.18.rst new file mode 100644 index 0000000..1071967 --- /dev/null +++ b/doc/notes/notes-9.18.18.rst @@ -0,0 +1,47 @@ +.. Copyright (C) Internet Systems Consortium, Inc. ("ISC") +.. +.. SPDX-License-Identifier: MPL-2.0 +.. +.. This Source Code Form is subject to the terms of the Mozilla Public +.. License, v. 2.0. If a copy of the MPL was not distributed with this +.. file, you can obtain one at https://mozilla.org/MPL/2.0/. +.. +.. See the COPYRIGHT file distributed with this work for additional +.. information regarding copyright ownership. + +Notes for BIND 9.18.18 +---------------------- + +Feature Changes +~~~~~~~~~~~~~~~ + +- When a primary server for a zone responds to an SOA query, but the + subsequent TCP connection required to transfer the zone is refused, + that server is marked as temporarily unreachable. This now also + happens if the TCP connection attempt times out, preventing too many + zones from queuing up on an unreachable server and allowing the + refresh process to move on to the next configured primary more + quickly. :gl:`#4215` + +- The :any:`dialup` and :any:`heartbeat-interval` options have been + deprecated and will be removed in a future BIND 9 release. :gl:`#3700` + +Bug Fixes +~~~~~~~~~ + +- Processing already-queued queries received over TCP could cause an + assertion failure, when the server was reconfigured at the same time + or the cache was being flushed. This has been fixed. :gl:`#4200` + +- Setting :any:`dnssec-policy` to ``insecure`` prevented zones + containing resource records with a TTL value larger than 86400 seconds + (1 day) from being loaded. This has been fixed by ignoring the TTL + values in the zone and using a value of 604800 seconds (1 week) as the + maximum zone TTL in key rollover timing calculations. :gl:`#4032` + +Known Issues +~~~~~~~~~~~~ + +- There are no new known issues with this release. See :ref:`above + ` for a list of all known issues affecting this + BIND 9 branch. diff --git a/doc/notes/notes-9.18.19.rst b/doc/notes/notes-9.18.19.rst new file mode 100644 index 0000000..3d3c513 --- /dev/null +++ b/doc/notes/notes-9.18.19.rst @@ -0,0 +1,96 @@ +.. Copyright (C) Internet Systems Consortium, Inc. ("ISC") +.. +.. SPDX-License-Identifier: MPL-2.0 +.. +.. This Source Code Form is subject to the terms of the Mozilla Public +.. License, v. 2.0. If a copy of the MPL was not distributed with this +.. file, you can obtain one at https://mozilla.org/MPL/2.0/. +.. +.. See the COPYRIGHT file distributed with this work for additional +.. information regarding copyright ownership. + +Notes for BIND 9.18.19 +---------------------- + +Security Fixes +~~~~~~~~~~~~~~ + +- Previously, sending a specially crafted message over the control + channel could cause the packet-parsing code to run out of available + stack memory, causing :iscman:`named` to terminate unexpectedly. + This has been fixed. (CVE-2023-3341) + + ISC would like to thank Eric Sesterhenn from X41 D-Sec GmbH for + bringing this vulnerability to our attention. :gl:`#4152` + +- A flaw in the networking code handling DNS-over-TLS queries could + cause :iscman:`named` to terminate unexpectedly due to an assertion + failure under significant DNS-over-TLS query load. This has been + fixed. (CVE-2023-4236) + + ISC would like to thank Robert Story from USC/ISI Root Server + Operations for bringing this vulnerability to our attention. + :gl:`#4242` + +Removed Features +~~~~~~~~~~~~~~~~ + +- The :any:`dnssec-must-be-secure` option has been deprecated and will + be removed in a future release. :gl:`#4263` + +Feature Changes +~~~~~~~~~~~~~~~ + +- If the ``server`` command is specified, :iscman:`nsupdate` now honors + the :option:`nsupdate -v` option for SOA queries by sending both the + UPDATE request and the initial query over TCP. :gl:`#1181` + +Bug Fixes +~~~~~~~~~ + +- The value of the If-Modified-Since header in the statistics channel + was not being correctly validated for its length, potentially allowing + an authorized user to trigger a buffer overflow. Ensuring the + statistics channel is configured correctly to grant access exclusively + to authorized users is essential (see the :any:`statistics-channels` + block definition and usage section). :gl:`#4124` + + This issue was reported independently by Eric Sesterhenn of X41 D-Sec + GmbH and Cameron Whitehead. + +- The Content-Length header in the statistics channel was lacking proper + bounds checking. A negative or excessively large value could + potentially trigger an integer overflow and result in an assertion + failure. :gl:`#4125` + + This issue was reported by Eric Sesterhenn of X41 D-Sec GmbH. + +- Several memory leaks caused by not clearing the OpenSSL error stack + were fixed. :gl:`#4159` + + This issue was reported by Eric Sesterhenn of X41 D-Sec GmbH. + +- The introduction of ``krb5-subdomain-self-rhs`` and + ``ms-subdomain-self-rhs`` UPDATE policies accidentally caused + :iscman:`named` to return SERVFAIL responses to deletion requests for + non-existent PTR and SRV records. This has been fixed. :gl:`#4280` + +- The :any:`stale-refresh-time` feature was mistakenly disabled when the + server cache was flushed by :option:`rndc flush`. This has been fixed. + :gl:`#4278` + +- BIND's memory consumption has been improved by implementing dedicated + jemalloc memory arenas for sending buffers. This optimization ensures + that memory usage is more efficient and better manages the return of + memory pages to the operating system. :gl:`#4038` + +- Previously, partial writes in the TLS DNS code were not accounted for + correctly, which could have led to DNS message corruption. This has + been fixed. :gl:`#4255` + +Known Issues +~~~~~~~~~~~~ + +- There are no new known issues with this release. See :ref:`above + ` for a list of all known issues affecting this + BIND 9 branch. diff --git a/doc/notes/notes-9.18.2.rst b/doc/notes/notes-9.18.2.rst new file mode 100644 index 0000000..0111083 --- /dev/null +++ b/doc/notes/notes-9.18.2.rst @@ -0,0 +1,53 @@ +.. Copyright (C) Internet Systems Consortium, Inc. ("ISC") +.. +.. SPDX-License-Identifier: MPL-2.0 +.. +.. This Source Code Form is subject to the terms of the Mozilla Public +.. License, v. 2.0. If a copy of the MPL was not distributed with this +.. file, you can obtain one at https://mozilla.org/MPL/2.0/. +.. +.. See the COPYRIGHT file distributed with this work for additional +.. information regarding copyright ownership. + +Notes for BIND 9.18.2 +--------------------- + +New Features +~~~~~~~~~~~~ + +- Add a new configuration option :any:`reuseport` to disable load balancing + on sockets in situations where processing of Response Policy Zones + (RPZ), Catalog Zones, or large zone transfers can cause service + disruptions. See the BIND 9 ARM for more detail. :gl:`#3249` + +Bug Fixes +~~~~~~~~~ + +- Previously, zone maintenance DNS queries retried forever if the + destination server was unreachable. These queries included outgoing + NOTIFY messages, refresh SOA queries, parental DS checks, and stub + zone NS queries. For example, if a zone had any nameservers with IPv6 + addresses and a secondary server without IPv6 connectivity, that + server would keep trying to send a growing amount of NOTIFY traffic + over IPv6. This futile traffic was not logged. This excessive retry + behavior has been fixed. :gl:`#3242` + +- A number of crashes and hangs which could be triggered in + :iscman:`dig` were identified and addressed. :gl:`#3020` :gl:`#3128` + :gl:`#3145` :gl:`#3184` :gl:`#3205` :gl:`#3244` :gl:`#3248` + +- Invalid :any:`dnssec-policy` definitions, where the defined keys did not + cover both KSK and ZSK roles for a given algorithm, were being + accepted. These are now checked, and the :any:`dnssec-policy` is rejected + if both roles are not present for all algorithms in use. :gl:`#3142` + +- Handling of TCP write timeouts has been improved to track the timeout + for each TCP write separately, leading to a faster connection teardown + in case the other party is not reading the data. :gl:`#3200` + +Known Issues +~~~~~~~~~~~~ + +- There are no new known issues with this release. See :ref:`above + ` for a list of all known issues affecting this + BIND 9 branch. diff --git a/doc/notes/notes-9.18.3.rst b/doc/notes/notes-9.18.3.rst new file mode 100644 index 0000000..09952c9 --- /dev/null +++ b/doc/notes/notes-9.18.3.rst @@ -0,0 +1,73 @@ +.. Copyright (C) Internet Systems Consortium, Inc. ("ISC") +.. +.. SPDX-License-Identifier: MPL-2.0 +.. +.. This Source Code Form is subject to the terms of the Mozilla Public +.. License, v. 2.0. If a copy of the MPL was not distributed with this +.. file, you can obtain one at https://mozilla.org/MPL/2.0/. +.. +.. See the COPYRIGHT file distributed with this work for additional +.. information regarding copyright ownership. + +Notes for BIND 9.18.3 +--------------------- + +Security Fixes +~~~~~~~~~~~~~~ + +- Previously, TLS socket objects could be destroyed prematurely, which + triggered assertion failures in :iscman:`named` instances serving + DNS-over-HTTPS (DoH) clients. This has been fixed. + + ISC would like to thank Thomas Amgarten from arcade solutions ag for + bringing this vulnerability to our attention. (CVE-2022-1183) + :gl:`#3216` + +Known Issues +~~~~~~~~~~~~ + +- According to :rfc:`8310`, Section 8.1, the ``Subject`` field MUST NOT + be inspected when verifying a remote certificate while establishing a + DNS-over-TLS connection. Only ``subjectAltName`` must be checked + instead. Unfortunately, some quite old versions of cryptographic + libraries might lack the ability to ignore the ``Subject`` field. This + should have minimal production-use consequences, as most of the + production-ready certificates issued by certificate authorities will + have ``subjectAltName`` set. In such cases, the ``Subject`` field is + ignored. Only old platforms are affected by this, e.g. those supplied + with OpenSSL versions older than 1.1.1. :gl:`#3163` + +- See :ref:`above ` for a list of all known + issues affecting this BIND 9 branch. + +New Features +~~~~~~~~~~~~ + +- Catalog Zones schema version 2, as described in the + "DNS Catalog Zones" IETF draft version 5 document, is now supported by + :iscman:`named`. All of the previously supported BIND-specific catalog + zone custom properties (:any:`primaries`, :any:`allow-query`, and + :any:`allow-transfer`), as well as the new Change of Ownership (``coo``) + property, are now implemented. Schema version 1 is still supported, + with some additional validation rules applied from schema version 2: + for example, the :any:`version` property is mandatory, and a member zone + PTR RRset must not contain more than one record. In the event of a + validation error, a corresponding error message is logged to help with + diagnosing the problem. :gl:`#3221` :gl:`#3222` :gl:`#3223` + :gl:`#3224` :gl:`#3225` + +- Support DNS Extended Errors (:rfc:`8914`) ``Stale Answer`` and + ``Stale NXDOMAIN Answer`` when stale answers are returned from cache. + :gl:`#2267` + +- Add support for remote TLS certificate verification, both to + :iscman:`named` and :iscman:`dig`, making it possible to implement + Strict and Mutual TLS authentication, as described in :rfc:`9103`, + Section 9.3. :gl:`#3163` + +Bug Fixes +~~~~~~~~~ + +- Previously, CDS and CDNSKEY DELETE records were removed from the zone + when configured with the ``auto-dnssec maintain;`` option. This has + been fixed. :gl:`#2931` diff --git a/doc/notes/notes-9.18.4.rst b/doc/notes/notes-9.18.4.rst new file mode 100644 index 0000000..1579bc4 --- /dev/null +++ b/doc/notes/notes-9.18.4.rst @@ -0,0 +1,44 @@ +.. Copyright (C) Internet Systems Consortium, Inc. ("ISC") +.. +.. SPDX-License-Identifier: MPL-2.0 +.. +.. This Source Code Form is subject to the terms of the Mozilla Public +.. License, v. 2.0. If a copy of the MPL was not distributed with this +.. file, you can obtain one at https://mozilla.org/MPL/2.0/. +.. +.. See the COPYRIGHT file distributed with this work for additional +.. information regarding copyright ownership. + +Notes for BIND 9.18.4 +--------------------- + +Feature Changes +~~~~~~~~~~~~~~~ + +- New :any:`dnssec-policy` configuration checks have been added to detect + unusual policies, such as missing KSK and/or ZSK and too-short key + lifetimes and re-sign periods. :gl:`#1611` + +Bug Fixes +~~~~~~~~~ + +- The :any:`fetches-per-server` quota is designed to adjust itself downward + automatically when an authoritative server times out too frequently. + Due to a coding error, that adjustment was applied incorrectly, so + that the quota for a congested server was always set to 1. This has + been fixed. :gl:`#3327` + +- DNSSEC-signed catalog zones were not being processed correctly. This + has been fixed. :gl:`#3380` + +- Key files were updated every time the :any:`dnssec-policy` key manager + ran, whether the metadata had changed or not. :iscman:`named` now + checks whether changes were applied before writing out the key files. + :gl:`#3302` + +Known Issues +~~~~~~~~~~~~ + +- There are no new known issues with this release. See :ref:`above + ` for a list of all known issues affecting this + BIND 9 branch. diff --git a/doc/notes/notes-9.18.5.rst b/doc/notes/notes-9.18.5.rst new file mode 100644 index 0000000..546b1b3 --- /dev/null +++ b/doc/notes/notes-9.18.5.rst @@ -0,0 +1,59 @@ +.. Copyright (C) Internet Systems Consortium, Inc. ("ISC") +.. +.. SPDX-License-Identifier: MPL-2.0 +.. +.. This Source Code Form is subject to the terms of the Mozilla Public +.. License, v. 2.0. If a copy of the MPL was not distributed with this +.. file, you can obtain one at https://mozilla.org/MPL/2.0/. +.. +.. See the COPYRIGHT file distributed with this work for additional +.. information regarding copyright ownership. + +Notes for BIND 9.18.5 +--------------------- + +Feature Changes +~~~~~~~~~~~~~~~ + +- The :option:`dnssec-signzone -H` default value has been changed to 0 + additional NSEC3 iterations. This change aligns the + :iscman:`dnssec-signzone` default with the default used by the + :any:`dnssec-policy` feature. At the same + time, documentation about NSEC3 has been aligned with the `Best + Current Practice`_. :gl:`#3395` + +.. _Best Current Practice: https://datatracker.ietf.org/doc/html/draft-ietf-dnsop-nsec3-guidance-10 + +Bug Fixes +~~~~~~~~~ + +- An assertion failure caused by a TCP connection closing between a + connect (or accept) and a read from a socket has been fixed. + :gl:`#3400` + +- When grafting non-delegated namespace onto delegated namespace, + :any:`synth-from-dnssec` could incorrectly synthesize non-existence of + records within the non-delegated namespace using NSEC records from + higher zones. :gl:`#3402` + +- Previously, :iscman:`named` immediately returned a SERVFAIL response + to the client when it received a FORMERR response from an + authoritative server during recursive resolution. This has been fixed: + :iscman:`named` acting as a resolver now attempts to contact other + authoritative servers for a given domain when it receives a FORMERR + response from one of them. :gl:`#3152` + +- Previously, :option:`rndc reconfig` did not pick up changes to + :any:`endpoints` statements in :any:`http` blocks. This has been + fixed. :gl:`#3415` + +- It was possible for a catalog zone consumer to process a catalog zone + member zone when there was a configured pre-existing forward-only + forward zone with the same name. This has been fixed. :gl:`#2506` + +Known Issues +~~~~~~~~~~~~ + +- There are no new known issues with this release. See :ref:`above + ` for a list of all known issues affecting this + BIND 9 branch. diff --git a/doc/notes/notes-9.18.6.rst b/doc/notes/notes-9.18.6.rst new file mode 100644 index 0000000..3ed788f --- /dev/null +++ b/doc/notes/notes-9.18.6.rst @@ -0,0 +1,62 @@ +.. Copyright (C) Internet Systems Consortium, Inc. ("ISC") +.. +.. SPDX-License-Identifier: MPL-2.0 +.. +.. This Source Code Form is subject to the terms of the Mozilla Public +.. License, v. 2.0. If a copy of the MPL was not distributed with this +.. file, you can obtain one at https://mozilla.org/MPL/2.0/. +.. +.. See the COPYRIGHT file distributed with this work for additional +.. information regarding copyright ownership. + +Notes for BIND 9.18.6 +--------------------- + +Feature Changes +~~~~~~~~~~~~~~~ + +- The DNSSEC algorithms RSASHA1 and NSEC3RSASHA1 are now automatically + disabled on systems where they are disallowed by the security policy + (e.g. Red Hat Enterprise Linux 9). Primary zones using those + algorithms need to be migrated to new algorithms prior to running on + these systems, as graceful migration to different DNSSEC algorithms is + not possible when RSASHA1 is disallowed by the operating system. + :gl:`#3469` + +- Log messages related to fetch limiting have been improved to provide + more complete information. Specifically, the final counts of allowed + and spilled fetches are now logged before the counter object is + destroyed. :gl:`#3461` + +Bug Fixes +~~~~~~~~~ + +- When running as a validating resolver forwarding all queries to + another resolver, :iscman:`named` could crash with an assertion + failure. These crashes occurred when the configured forwarder sent a + broken DS response and :iscman:`named` failed its attempts to find a + proper one instead. This has been fixed. :gl:`#3439` + +- Non-dynamic zones that inherit :any:`dnssec-policy` from the + :namedconf:ref:`view` or :namedconf:ref:`options` blocks were not + marked as inline-signed and therefore never scheduled to be re-signed. + This has been fixed. :gl:`#3438` + +- The old :any:`max-zone-ttl` zone option was meant to be superseded by + the :any:`max-zone-ttl` option in :any:`dnssec-policy`; however, the + latter option was not fully effective. This has been corrected: zones + no longer load if they contain TTLs greater than the limit configured + in :any:`dnssec-policy`. For zones with both the old + :any:`max-zone-ttl` option and :any:`dnssec-policy` configured, the + old option is ignored, and a warning is generated. :gl:`#2918` + +- :option:`rndc dumpdb -expired ` was fixed to include + expired RRsets, even if :any:`stale-cache-enable` is set to ``no`` and + the cache-cleaning time window has passed. :gl:`#3462` + +Known Issues +~~~~~~~~~~~~ + +- There are no new known issues with this release. See :ref:`above + ` for a list of all known issues affecting this + BIND 9 branch. diff --git a/doc/notes/notes-9.18.7.rst b/doc/notes/notes-9.18.7.rst new file mode 100644 index 0000000..dade98e --- /dev/null +++ b/doc/notes/notes-9.18.7.rst @@ -0,0 +1,80 @@ +.. Copyright (C) Internet Systems Consortium, Inc. ("ISC") +.. +.. SPDX-License-Identifier: MPL-2.0 +.. +.. This Source Code Form is subject to the terms of the Mozilla Public +.. License, v. 2.0. If a copy of the MPL was not distributed with this +.. file, you can obtain one at https://mozilla.org/MPL/2.0/. +.. +.. See the COPYRIGHT file distributed with this work for additional +.. information regarding copyright ownership. + +Notes for BIND 9.18.7 +--------------------- + +Security Fixes +~~~~~~~~~~~~~~ + +- Previously, there was no limit to the number of database lookups + performed while processing large delegations, which could be abused to + severely impact the performance of :iscman:`named` running as a + recursive resolver. This has been fixed. (CVE-2022-2795) + + ISC would like to thank Yehuda Afek from Tel-Aviv University and Anat + Bremler-Barr & Shani Stajnrod from Reichman University for bringing + this vulnerability to our attention. :gl:`#3394` + +- When an HTTP connection was reused to request statistics from the + stats channel, the content length of successive responses could grow + in size past the end of the allocated buffer. This has been fixed. + (CVE-2022-2881) :gl:`#3493` + +- Memory leaks in code handling Diffie-Hellman (DH) keys were fixed that + could be externally triggered, when using TKEY records in DH mode with + OpenSSL 3.0.0 and later versions. (CVE-2022-2906) :gl:`#3491` + +- :iscman:`named` running as a resolver with the + :any:`stale-answer-client-timeout` option set to ``0`` could crash + with an assertion failure, when there was a stale CNAME in the cache + for the incoming query. This has been fixed. (CVE-2022-3080) + :gl:`#3517` + +- Memory leaks were fixed that could be externally triggered in the + DNSSEC verification code for the EdDSA algorithm. (CVE-2022-38178) + :gl:`#3487` + +Feature Changes +~~~~~~~~~~~~~~~ + +- Response Rate Limiting (RRL) code now treats all QNAMEs that are + subject to wildcard processing within a given zone as the same name, + to prevent circumventing the limits enforced by RRL. :gl:`#3459` + +- Zones using :any:`dnssec-policy` now require dynamic DNS or + :any:`inline-signing` to be configured explicitly. :gl:`#3381` + +- When reconfiguring :any:`dnssec-policy` from using NSEC with an + NSEC-only DNSKEY algorithm (e.g. RSASHA1) to a policy that uses NSEC3, + BIND 9 no longer fails to sign the zone; instead, it keeps using NSEC + until the offending DNSKEY records have been removed from the zone, + then switches to using NSEC3. :gl:`#3486` + +- A backward-compatible approach was implemented for encoding + internationalized domain names (IDN) in :iscman:`dig` and converting + the domain to IDNA2008 form; if that fails, BIND tries an IDNA2003 + conversion. :gl:`#3485` + +Bug Fixes +~~~~~~~~~ + +- A serve-stale bug was fixed, where BIND would try to return stale data + from cache for lookups that received duplicate queries or queries that + would be dropped. This bug resulted in premature SERVFAIL responses, + and has now been resolved. :gl:`#2982` + +Known Issues +~~~~~~~~~~~~ + +- There are no new known issues with this release. See :ref:`above + ` for a list of all known issues affecting this + BIND 9 branch. diff --git a/doc/notes/notes-9.18.8.rst b/doc/notes/notes-9.18.8.rst new file mode 100644 index 0000000..457f470 --- /dev/null +++ b/doc/notes/notes-9.18.8.rst @@ -0,0 +1,68 @@ +.. Copyright (C) Internet Systems Consortium, Inc. ("ISC") +.. +.. SPDX-License-Identifier: MPL-2.0 +.. +.. This Source Code Form is subject to the terms of the Mozilla Public +.. License, v. 2.0. If a copy of the MPL was not distributed with this +.. file, you can obtain one at https://mozilla.org/MPL/2.0/. +.. +.. See the COPYRIGHT file distributed with this work for additional +.. information regarding copyright ownership. + +Notes for BIND 9.18.8 +--------------------- + +Known Issues +~~~~~~~~~~~~ + +- Upgrading from BIND 9.16.32, 9.18.6, or any older version may require + a manual configuration change. The following configurations are + affected: + + - :any:`type primary` zones configured with :any:`dnssec-policy` but + without either :any:`allow-update` or :any:`update-policy`, + - :any:`type secondary` zones configured with :any:`dnssec-policy`. + + In these cases please add :namedconf:ref:`inline-signing yes; + ` to the individual zone configuration(s). Without + applying this change, :iscman:`named` will fail to start. For more + details, see + https://kb.isc.org/docs/dnssec-policy-requires-dynamic-dns-or-inline-signing + +- BIND 9.18 does not support dynamic update forwarding (see + :any:`allow-update-forwarding`) in conjuction with zone transfers over + TLS (XoT). :gl:`#3512` + +- See :ref:`above ` for a list of all known + issues affecting this BIND 9 branch. + +New Features +~~~~~~~~~~~~ + +- Support for parsing and validating the ``dohpath`` service parameter + in SVCB records was added. :gl:`#3544` + +- :iscman:`named` now logs the supported cryptographic algorithms during + startup and in the output of :option:`named -V`. :gl:`#3541` + +- The ``recursion not available`` and ``query (cache) '...' denied`` log + messages were extended to include the name of the ACL that caused a + given query to be denied. :gl:`#3587` + +Feature Changes +~~~~~~~~~~~~~~~ + +- The ability to use PKCS#11 via engine_pkcs11 has been restored, by + using only deprecated APIs in OpenSSL 3.0.0. BIND 9 needs to be + compiled with ``-DOPENSSL_API_COMPAT=10100`` specified in the CFLAGS + environment variable at compile time. :gl:`#3578` + +Bug Fixes +~~~~~~~~~ + +- An assertion failure was fixed in :iscman:`named` that was caused by + aborting the statistics channel connection while sending statistics + data to the client. :gl:`#3542` + +- Changing just the TSIG key names for primaries in catalog zones' + member zones was not effective. This has been fixed. :gl:`#3557` diff --git a/doc/notes/notes-9.18.9.rst b/doc/notes/notes-9.18.9.rst new file mode 100644 index 0000000..828f459 --- /dev/null +++ b/doc/notes/notes-9.18.9.rst @@ -0,0 +1,61 @@ +.. Copyright (C) Internet Systems Consortium, Inc. ("ISC") +.. +.. SPDX-License-Identifier: MPL-2.0 +.. +.. This Source Code Form is subject to the terms of the Mozilla Public +.. License, v. 2.0. If a copy of the MPL was not distributed with this +.. file, you can obtain one at https://mozilla.org/MPL/2.0/. +.. +.. See the COPYRIGHT file distributed with this work for additional +.. information regarding copyright ownership. + +Notes for BIND 9.18.9 +--------------------- + +Bug Fixes +~~~~~~~~~ + +- A crash was fixed that happened when a :any:`dnssec-policy` zone that + used NSEC3 was reconfigured to enable :any:`inline-signing`. + :gl:`#3591` + +- In certain resolution scenarios, quotas could be erroneously reached + for servers, including any configured forwarders, resulting in + SERVFAIL answers being sent to clients. This has been fixed. + :gl:`#3598` + +- ``rpz-ip`` rules in :any:`response-policy` zones could be ineffective + in some cases if a query had the CD (Checking Disabled) bit set to 1. + This has been fixed. :gl:`#3247` + +- Previously, if Internet connectivity issues were experienced during + the initial startup of :iscman:`named`, a BIND resolver with + :any:`dnssec-validation` set to ``auto`` could enter into a state + where it would not recover without stopping :iscman:`named`, manually + deleting the ``managed-keys.bind`` and ``managed-keys.bind.jnl`` + files, and starting :iscman:`named` again. This has been fixed. + :gl:`#2895` + +- The statistics counter representing the current number of clients + awaiting recursive resolution results (``RecursClients``) could + overflow in certain resolution scenarios. This has been fixed. + :gl:`#3584` + +- Previously, the port in remote servers such as in :any:`primaries` and + :any:`parental-agents` could be wrongly configured because of an + inheritance bug. This has been fixed. :gl:`#3627` + +- Previously, BIND failed to start on Solaris-based systems with + hundreds of CPUs. This has been fixed. :gl:`#3563` + +- When a DNS resource record's TTL value was equal to the resolver's + configured :any:`prefetch` "eligibility" value, the record was + erroneously not treated as eligible for prefetching. This has been + fixed. :gl:`#3603` + +Known Issues +~~~~~~~~~~~~ + +- There are no new known issues with this release. See :ref:`above + ` for a list of all known issues affecting this + BIND 9 branch. diff --git a/doc/notes/notes-known-issues.rst b/doc/notes/notes-known-issues.rst new file mode 100644 index 0000000..ee0d0f0 --- /dev/null +++ b/doc/notes/notes-known-issues.rst @@ -0,0 +1,62 @@ +.. Copyright (C) Internet Systems Consortium, Inc. ("ISC") +.. +.. SPDX-License-Identifier: MPL-2.0 +.. +.. This Source Code Form is subject to the terms of the Mozilla Public +.. License, v. 2.0. If a copy of the MPL was not distributed with this +.. file, you can obtain one at https://mozilla.org/MPL/2.0/. +.. +.. See the COPYRIGHT file distributed with this work for additional +.. information regarding copyright ownership. + +.. _relnotes_known_issues: + +Known Issues +------------ + +- Upgrading from BIND 9.16.32, 9.18.6, or any older version may require + a manual configuration change. The following configurations are + affected: + + - :any:`type primary` zones configured with :any:`dnssec-policy` but + without either :any:`allow-update` or :any:`update-policy`, + - :any:`type secondary` zones configured with :any:`dnssec-policy`. + + In these cases please add :namedconf:ref:`inline-signing yes; + ` to the individual zone configuration(s). Without + applying this change, :iscman:`named` will fail to start. For more + details, see + https://kb.isc.org/docs/dnssec-policy-requires-dynamic-dns-or-inline-signing + +- BIND 9.18 does not support dynamic update forwarding (see + :any:`allow-update-forwarding`) in conjuction with zone transfers over + TLS (XoT). :gl:`#3512` + +- According to :rfc:`8310`, Section 8.1, the ``Subject`` field MUST NOT + be inspected when verifying a remote certificate while establishing a + DNS-over-TLS connection. Only ``subjectAltName`` must be checked + instead. Unfortunately, some quite old versions of cryptographic + libraries might lack the ability to ignore the ``Subject`` field. This + should have minimal production-use consequences, as most of the + production-ready certificates issued by certificate authorities will + have ``subjectAltName`` set. In such cases, the ``Subject`` field is + ignored. Only old platforms are affected by this, e.g. those supplied + with OpenSSL versions older than 1.1.1. :gl:`#3163` + +- ``rndc`` has been updated to use the new BIND network manager API. As + the network manager currently has no support for UNIX-domain sockets, + those cannot now be used with ``rndc``. This will be addressed in a + future release, either by restoring UNIX-domain socket support or by + formally declaring them to be obsolete in the control channel. + :gl:`#1759` + +- Sending NOTIFY messages silently fails when the source port specified + in the :any:`notify-source` statement is already in use. This can + happen e.g. when multiple servers are configured as NOTIFY targets for + a zone and some of them are unresponsive. This issue can be worked + around by not specifying the source port for NOTIFY messages in the + :any:`notify-source` statement; note that source port configuration is + already `deprecated`_ and will be removed altogether in a future + release. :gl:`#4002` + +.. _deprecated: https://gitlab.isc.org/isc-projects/bind9/-/issues/3781 -- cgit v1.2.3