1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
|
.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
..
.. SPDX-License-Identifier: MPL-2.0
..
.. This Source Code Form is subject to the terms of the Mozilla Public
.. License, v. 2.0. If a copy of the MPL was not distributed with this
.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
..
.. See the COPYRIGHT file distributed with this work for additional
.. information regarding copyright ownership.
Notes for BIND 9.18.3
---------------------
Security Fixes
~~~~~~~~~~~~~~
- Previously, TLS socket objects could be destroyed prematurely, which
triggered assertion failures in :iscman:`named` instances serving
DNS-over-HTTPS (DoH) clients. This has been fixed.
ISC would like to thank Thomas Amgarten from arcade solutions ag for
bringing this vulnerability to our attention. (CVE-2022-1183)
:gl:`#3216`
Known Issues
~~~~~~~~~~~~
- According to :rfc:`8310`, Section 8.1, the ``Subject`` field MUST NOT
be inspected when verifying a remote certificate while establishing a
DNS-over-TLS connection. Only ``subjectAltName`` must be checked
instead. Unfortunately, some quite old versions of cryptographic
libraries might lack the ability to ignore the ``Subject`` field. This
should have minimal production-use consequences, as most of the
production-ready certificates issued by certificate authorities will
have ``subjectAltName`` set. In such cases, the ``Subject`` field is
ignored. Only old platforms are affected by this, e.g. those supplied
with OpenSSL versions older than 1.1.1. :gl:`#3163`
- See :ref:`above <relnotes_known_issues>` for a list of all known
issues affecting this BIND 9 branch.
New Features
~~~~~~~~~~~~
- Catalog Zones schema version 2, as described in the
"DNS Catalog Zones" IETF draft version 5 document, is now supported by
:iscman:`named`. All of the previously supported BIND-specific catalog
zone custom properties (:any:`primaries`, :any:`allow-query`, and
:any:`allow-transfer`), as well as the new Change of Ownership (``coo``)
property, are now implemented. Schema version 1 is still supported,
with some additional validation rules applied from schema version 2:
for example, the :any:`version` property is mandatory, and a member zone
PTR RRset must not contain more than one record. In the event of a
validation error, a corresponding error message is logged to help with
diagnosing the problem. :gl:`#3221` :gl:`#3222` :gl:`#3223`
:gl:`#3224` :gl:`#3225`
- Support DNS Extended Errors (:rfc:`8914`) ``Stale Answer`` and
``Stale NXDOMAIN Answer`` when stale answers are returned from cache.
:gl:`#2267`
- Add support for remote TLS certificate verification, both to
:iscman:`named` and :iscman:`dig`, making it possible to implement
Strict and Mutual TLS authentication, as described in :rfc:`9103`,
Section 9.3. :gl:`#3163`
Bug Fixes
~~~~~~~~~
- Previously, CDS and CDNSKEY DELETE records were removed from the zone
when configured with the ``auto-dnssec maintain;`` option. This has
been fixed. :gl:`#2931`
|
