From: Tinderbox User Date: Wed, 12 Feb 2020 18:11:56 +0000 (+0000) Subject: prep v9.16.0 X-Git-Tag: v9.16.0^2 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=29696e495f465608741dec6c1357dcf6d4c2fc72;p=thirdparty%2Fbind9.git prep v9.16.0 --- diff --git a/CHANGES b/CHANGES index 3ece0f1a795..899e5c1855b 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,5 @@ + --- 9.16.0 released --- + 5356. [func] Update dnssec-policy configuration statements: - Rename "zone-max-ttl" dnssec-policy option to "max-zone-ttl" for consistency with the existing @@ -40,7 +42,7 @@ 5349. [bug] Fix a race in task_pause/unpause. [GL #1571] 5348. [bug] dnssec-settime -Psync was not being honoured. - [GL !2893] + [GL !2925] --- 9.15.8 released --- diff --git a/HISTORY b/HISTORY index 1e3dc722337..18d1e641b5a 100644 --- a/HISTORY +++ b/HISTORY @@ -143,7 +143,7 @@ releases. New features include: * "rndc modzone" reconfigures a single zone, without requiring the entire server to be reconfigured. * "rndc showzone" displays the current configuration of a zone. - * "rndc managed-keys" can be used to check the status of RFC 5001 + * "rndc managed-keys" can be used to check the status of RFC 5011 managed trust anchors, or to force trust anchors to be refreshed. * "max-cache-size" can now be set to a percentage of available memory. The default is 90%. diff --git a/README b/README index ccd05565a47..3dfc9a59df1 100644 --- a/README +++ b/README @@ -111,9 +111,9 @@ format-patch. BIND 9.16 features -BIND 9.16 is the current stable branch of BIND 9. It includes all -changes from the 9.15 development branch, updating the previous stable -branch, 9.14. New features include: +BIND 9.16 is the current stable branch of BIND 9. It includes all changes +from the 9.15 development branch, updating the previous stable branch, +9.14. New features include: * New dnssec-policy statement to configure a key and signing policy for zones, enabling automatic key regeneration and rollover. @@ -237,12 +237,10 @@ github.com/farsightsec/fstrm and libprotobuf-c https:// developers.google.com/protocol-buffers, and BIND must be configured with --enable-dnstap. -Certain compiled-in constants and default settings can be increased to -values better suited to large servers with abundant memory resources (e.g, -64-bit servers with 12G or more of memory) by specifying --with-tuning= -large on the configure command line. This can improve performance on big -servers, but will consume more memory and may degrade performance on -smaller systems. +Certain compiled-in constants and default settings can be decreased to +values better suited to small machines, e.g. OpenWRT boxes, by specifying +--with-tuning=small on the configure command line. This will decrease +memory usage by using smaller structures, but will degrade performance. On Linux, process capabilities are managed in user space using the libcap library, which can be installed on most Linux systems via the libcap-dev diff --git a/README.md b/README.md index 56fd9167004..d0db168a074 100644 --- a/README.md +++ b/README.md @@ -254,7 +254,7 @@ and `libprotobuf-c` [https://developers.google.com/protocol-buffers](https://developers.google.com/protocol-buffers), and BIND must be configured with `--enable-dnstap`. -Certain compiled-in constants and default settings can be increased to +Certain compiled-in constants and default settings can be decreased to values better suited to small machines, e.g. OpenWRT boxes, by specifying `--with-tuning=small` on the `configure` command line. This will decrease memory usage by using smaller structures, but will degrade performance. diff --git a/bin/dig/nslookup.1 b/bin/dig/nslookup.1 index 752d52d98ba..84afa0758ef 100644 --- a/bin/dig/nslookup.1 +++ b/bin/dig/nslookup.1 @@ -233,7 +233,10 @@ Change the default TCP/UDP name server port to .RS 4 Change the type of the information query\&. .sp -(Default = A; abbreviations = q, ty) +(Default = A and then AAAA; abbreviations = q, ty) +.sp +\fBNote:\fR +It is only possible to specify one query type, only the default behavior looks up both when an alternative is not specified\&. .RE .PP \fB\fI[no]\fR\fR\fBrecurse\fR diff --git a/bin/dig/nslookup.html b/bin/dig/nslookup.html index dc8c5c236a2..9ec3e4bfd6c 100644 --- a/bin/dig/nslookup.html +++ b/bin/dig/nslookup.html @@ -229,17 +229,17 @@ nslookup -query=hinfo -timeout=10 The class specifies the protocol group of the information.

-

+

(Default = IN; abbreviation = cl)

[no]debug

- Turn on or off the display of the full response packet and - any intermediate response packets when searching. + Turn on or off the display of the full response packet and + any intermediate response packets when searching.

-

+

(Default = nodebug; abbreviation = [no]deb)

@@ -247,9 +247,9 @@ nslookup -query=hinfo -timeout=10

Turn debugging mode on or off. This displays more about - what nslookup is doing. + what nslookup is doing.

-

+

(Default = nod2)

@@ -267,7 +267,7 @@ nslookup -query=hinfo -timeout=10 names in the domain search list to the request until an answer is received.

-

+

(Default = search)

@@ -276,7 +276,7 @@ nslookup -query=hinfo -timeout=10

Change the default TCP/UDP name server port to value.

-

+

(Default = 53; abbreviation = po)

@@ -289,9 +289,15 @@ nslookup -query=hinfo -timeout=10

Change the type of the information query.

-

- (Default = A; abbreviations = q, ty) +

+ (Default = A and then AAAA; abbreviations = q, ty)

+

+ Note: It is + only possible to specify one query type, only + the default behavior looks up both when an + alternative is not specified. +

[no]recurse
@@ -300,16 +306,16 @@ nslookup -query=hinfo -timeout=10 have the information.

-

+

(Default = recurse; abbreviation = [no]rec)

ndots=number

- Set the number of dots (label separators) in a domain - that will disable searching. Absolute names always - stop searching. + Set the number of dots (label separators) in a domain + that will disable searching. Absolute names always + stop searching.

retry=number
@@ -331,21 +337,21 @@ nslookup -query=hinfo -timeout=10 Always use a virtual circuit when sending requests to the server.

-

+

(Default = novc)

[no]fail

- Try the next nameserver if a nameserver responds with - SERVFAIL or a referral (nofail) or terminate query - (fail) on such a response. -

-

+ Try the next nameserver if a nameserver responds with + SERVFAIL or a referral (nofail) or terminate query + (fail) on such a response. +

+

(Default = nofail)

-
+

diff --git a/bin/dnssec/dnssec-keyfromlabel.8 b/bin/dnssec/dnssec-keyfromlabel.8 index 16c5546ee30..02ce4a8e59d 100644 --- a/bin/dnssec/dnssec-keyfromlabel.8 +++ b/bin/dnssec/dnssec-keyfromlabel.8 @@ -92,7 +92,7 @@ Specifies the label for a key pair in the crypto hardware\&. .sp When BIND -9 is built with OpenSSL\-based PKCS#11 support, the label is an arbitrary string that identifies a particular key\&. It may be preceded by an optional OpenSSL engine name, followed by a colon, as in "pkcs11:\fIkeylabel\fR"\&. +9 is built with OpenSSL\-based PKCS#11 support, the label is an arbitrary string that identifies a particular key\&. .sp When BIND diff --git a/bin/dnssec/dnssec-keyfromlabel.html b/bin/dnssec/dnssec-keyfromlabel.html index ac53995ca0a..92c4e3cf4c6 100644 --- a/bin/dnssec/dnssec-keyfromlabel.html +++ b/bin/dnssec/dnssec-keyfromlabel.html @@ -146,9 +146,7 @@

When BIND 9 is built with OpenSSL-based PKCS#11 support, the label is an arbitrary string that - identifies a particular key. It may be preceded by an - optional OpenSSL engine name, followed by a colon, as in - "pkcs11:keylabel". + identifies a particular key.

When BIND 9 is built with native PKCS#11 diff --git a/bin/named/named.8 b/bin/named/named.8 index 1759e081f27..1b95cf3fae5 100644 --- a/bin/named/named.8 +++ b/bin/named/named.8 @@ -187,7 +187,7 @@ Allow \fBnamed\fR to use up to \fI#max\-socks\fR -sockets\&. The default value is 4096 on systems built with default configuration options, and 21000 on systems built with "configure \-\-with\-tuning=large"\&. +sockets\&. The default value is 21000 on systems built with default configuration options, and 4096 on systems built with "configure \-\-with\-tuning=small"\&. .if n \{\ .sp .\} diff --git a/bin/named/named.conf.5 b/bin/named/named.conf.5 index 51f7af645b1..8c9edaf70e4 100644 --- a/bin/named/named.conf.5 +++ b/bin/named/named.conf.5 @@ -10,12 +10,12 @@ .\" Title: named.conf .\" Author: .\" Generator: DocBook XSL Stylesheets v1.78.1 -.\" Date: 2019-08-12 +.\" Date: 2020-02-07 .\" Manual: BIND9 .\" Source: ISC .\" Language: English .\" -.TH "NAMED\&.CONF" "5" "2019\-08\-12" "ISC" "BIND9" +.TH "NAMED\&.CONF" "5" "2020\-02\-07" "ISC" "BIND9" .\" ----------------------------------------------------------------- .\" * Define some portability stuff .\" ----------------------------------------------------------------- @@ -97,6 +97,31 @@ dlz \fIstring\fR { .if n \{\ .RE .\} +.SH "DNSSEC-POLICY" +.sp +.if n \{\ +.RS 4 +.\} +.nf +dnssec\-policy \fIstring\fR { + dnskey\-ttl \fIduration\fR; + keys { ( csk | ksk | zsk ) [ ( key\-directory ) ] lifetime + \fIduration_or_unlimited\fR algorithm \fIstring\fR [ \fIinteger\fR ]; \&.\&.\&. }; + max\-zone\-ttl \fIduration\fR; + parent\-ds\-ttl \fIduration\fR; + parent\-propagation\-delay \fIduration\fR; + parent\-registration\-delay \fIduration\fR; + publish\-safety \fIduration\fR; + retire\-safety \fIduration\fR; + signatures\-refresh \fIduration\fR; + signatures\-validity \fIduration\fR; + signatures\-validity\-dnskey \fIduration\fR; + zone\-propagation\-delay \fIduration\fR; +}; +.fi +.if n \{\ +.RE +.\} .SH "DYNDB" .sp .if n \{\ @@ -150,7 +175,7 @@ logging { .\} .SH "MANAGED-KEYS" .PP -Deprecated \- see TRUST\-ANCHORS\&. +Deprecated \- see DNSSEC\-KEYS\&. .sp .if n \{\ .RS 4 @@ -262,6 +287,7 @@ options { dnssec\-dnskey\-kskonly \fIboolean\fR; dnssec\-loadkeys\-interval \fIinteger\fR; dnssec\-must\-be\-secure \fIstring\fR \fIboolean\fR; + dnssec\-policy \fIstring\fR; dnssec\-secure\-to\-insecure \fIboolean\fR; dnssec\-update\-mode ( maintain | no\-resign ); dnssec\-validation ( yes | no | auto ); @@ -411,8 +437,8 @@ options { \fIinteger\fR; response\-policy { zone \fIstring\fR [ add\-soa \fIboolean\fR ] [ log \fIboolean\fR ] [ max\-policy\-ttl \fIduration\fR ] [ min\-update\-interval - \fIduration\fR ] [ policy ( cname | disabled | drop | given | no\-op | - nodata | nxdomain | passthru | tcp\-only \fIquoted_string\fR ) ] [ + \fIduration\fR ] [ policy ( cname | disabled | drop | given | no\-op + | nodata | nxdomain | passthru | tcp\-only \fIquoted_string\fR ) ] [ recursive\-only \fIboolean\fR ] [ nsip\-enable \fIboolean\fR ] [ nsdname\-enable \fIboolean\fR ]; \&.\&.\&. } [ add\-soa \fIboolean\fR ] [ break\-dnssec \fIboolean\fR ] [ max\-policy\-ttl \fIduration\fR ] [ @@ -567,7 +593,7 @@ trust\-anchors { \fIstring\fR ( static\-key | .\} .SH "TRUSTED-KEYS" .PP -Deprecated \- see TRUST\-ANCHORS\&. +Deprecated \- see DNSSEC\-KEYS\&. .sp .if n \{\ .RS 4 @@ -657,6 +683,7 @@ view \fIstring\fR [ \fIclass\fR ] { dnssec\-dnskey\-kskonly \fIboolean\fR; dnssec\-loadkeys\-interval \fIinteger\fR; dnssec\-must\-be\-secure \fIstring\fR \fIboolean\fR; + dnssec\-policy \fIstring\fR; dnssec\-secure\-to\-insecure \fIboolean\fR; dnssec\-update\-mode ( maintain | no\-resign ); dnssec\-validation ( yes | no | auto ); @@ -780,8 +807,8 @@ view \fIstring\fR [ \fIclass\fR ] { \fIinteger\fR; response\-policy { zone \fIstring\fR [ add\-soa \fIboolean\fR ] [ log \fIboolean\fR ] [ max\-policy\-ttl \fIduration\fR ] [ min\-update\-interval - \fIduration\fR ] [ policy ( cname | disabled | drop | given | no\-op | - nodata | nxdomain | passthru | tcp\-only \fIquoted_string\fR ) ] [ + \fIduration\fR ] [ policy ( cname | disabled | drop | given | no\-op + | nodata | nxdomain | passthru | tcp\-only \fIquoted_string\fR ) ] [ recursive\-only \fIboolean\fR ] [ nsip\-enable \fIboolean\fR ] [ nsdname\-enable \fIboolean\fR ]; \&.\&.\&. } [ add\-soa \fIboolean\fR ] [ break\-dnssec \fIboolean\fR ] [ max\-policy\-ttl \fIduration\fR ] [ @@ -1067,30 +1094,6 @@ zone \fIstring\fR [ \fIclass\fR ] { .if n \{\ .RE .\} -.SH "DNSSEC-POLICY" -.sp -.if n \{\ -.RS 4 -.\} -.nf -dnssec\-policy \fIstring\fR { - dnskey\-ttl \fIduration\fR; - keys { ( csk | ksk | zsk ) key\-directory lifetime \fIduration\fR algorithm \fIinteger\fR [ \fIinteger\fR ] ; \&.\&.\&. }; - parent\-ds\-ttl \fIduration\fR; - parent\-propagation\-delay \fIduration\fR; - parent\-registration\-delay \fIduration\fR; - publish\-safety \fIduration\fR; - retire\-safety \fIduration\fR; - signatures\-refresh \fIduration\fR; - signatures\-validity \fIduration\fR; - signatures\-validity\-dnskey \fIduration\fR; - zone\-max\-ttl \fIduration\fR; - zone\-propagation\-delay \fIduration\fR; -}; -.fi -.if n \{\ -.RE -.\} .SH "FILES" .PP /etc/named\&.conf diff --git a/bin/named/named.conf.docbook b/bin/named/named.conf.docbook index 9aeeac10cc1..d7a80f821f8 100644 --- a/bin/named/named.conf.docbook +++ b/bin/named/named.conf.docbook @@ -13,7 +13,7 @@ - 2019-12-12 + 2020-02-07 ISC @@ -115,8 +115,8 @@ dlz string { dnssec-policy string { dnskey-ttl duration; - keys { ( csk | ksk | zsk ) ( key-directory ) lifetime ( duration | unlimited ) - algorithm integer [ integer ]; ... }; + keys { ( csk | ksk | zsk ) [ ( key-directory ) ] lifetime + duration_or_unlimited algorithm string [ integer ]; ... }; max-zone-ttl duration; parent-ds-ttl duration; parent-propagation-delay duration; diff --git a/bin/named/named.conf.html b/bin/named/named.conf.html index 69a9382b119..95a38b453d2 100644 --- a/bin/named/named.conf.html +++ b/bin/named/named.conf.html @@ -92,7 +92,28 @@ dlz

-

DYNDB

+

DNSSEC-POLICY

+


+dnssec-policy string {
+ dnskey-ttl duration;
+ keys { ( csk | ksk | zsk ) [ ( key-directory ) ] lifetime
+     duration_or_unlimited algorithm string [ integer ]; ... };
+ max-zone-ttl duration;
+ parent-ds-ttl duration;
+ parent-propagation-delay duration;
+ parent-registration-delay duration;
+ publish-safety duration;
+ retire-safety duration;
+ signatures-refresh duration;
+ signatures-validity duration;
+ signatures-validity-dnskey duration;
+ zone-propagation-delay duration;
+};
+

+
+ +
+

DYNDB


dyndb string quoted_string {
    unspecified-text };
@@ -100,7 +121,7 @@ dyndb

-

KEY

+

KEY


key string {
algorithm string;
@@ -110,7 +131,7 @@ key

-

LOGGING

+

LOGGING


logging {
category string { string; ... };
@@ -131,8 +152,8 @@ logging

-

MANAGED-KEYS

-

Deprecated - see TRUST-ANCHORS.

+

MANAGED-KEYS

+

Deprecated - see DNSSEC-KEYS.


managed-keys { string ( static-key
    | initial-key | static-ds |
@@ -142,7 +163,7 @@ managed-keys

-

MASTERS

+

MASTERS


masters string [ port integer ] [ dscp
    integer ] { ( masters | ipv4_address [
@@ -152,7 +173,7 @@ masters

-

OPTIONS

+

OPTIONS


options {
allow-new-zones boolean;
@@ -232,6 +253,7 @@ options dnssec-dnskey-kskonly boolean;
dnssec-loadkeys-interval integer;
dnssec-must-be-secure string boolean;
+ dnssec-policy string;
dnssec-secure-to-insecure boolean;
dnssec-update-mode ( maintain | no-resign );
dnssec-validation ( yes | no | auto );
@@ -381,8 +403,8 @@ options     integer;
response-policy { zone string [ add-soa boolean ] [ log
    boolean ] [ max-policy-ttl duration ] [ min-update-interval
-     duration ] [ policy ( cname | disabled | drop | given | no-op |
-     nodata | nxdomain | passthru | tcp-only quoted_string ) ] [
+     duration ] [ policy ( cname | disabled | drop | given | no-op
+     | nodata | nxdomain | passthru | tcp-only quoted_string ) ] [
    recursive-only boolean ] [ nsip-enable boolean ] [
    nsdname-enable boolean ]; ... } [ add-soa boolean ] [
    break-dnssec boolean ] [ max-policy-ttl duration ] [
@@ -451,7 +473,7 @@ options

-

PLUGIN

+

PLUGIN


plugin ( query ) string [ { unspecified-text
    } ];
@@ -459,7 +481,7 @@ plugin

-

SERVER

+

SERVER


server netprefix {
bogus boolean;
@@ -497,7 +519,7 @@ server

-

STATISTICS-CHANNELS

+

STATISTICS-CHANNELS


statistics-channels {
inet ( ipv4_address | ipv6_address |
@@ -509,7 +531,7 @@ statistics-channels

-

TRUST-ANCHORS

+

TRUST-ANCHORS


trust-anchors { string ( static-key |
    initial-key | static-ds | initial-ds )
@@ -519,8 +541,8 @@ trust-anchors

-

TRUSTED-KEYS

-

Deprecated - see TRUST-ANCHORS.

+

TRUSTED-KEYS

+

Deprecated - see DNSSEC-KEYS.


trusted-keys { string integer
    integer integer
@@ -529,7 +551,7 @@ trusted-keys

-

VIEW

+

VIEW


view string [ class ] {
allow-new-zones boolean;
@@ -602,6 +624,7 @@ view dnssec-dnskey-kskonly boolean;
dnssec-loadkeys-interval integer;
dnssec-must-be-secure string boolean;
+ dnssec-policy string;
dnssec-secure-to-insecure boolean;
dnssec-update-mode ( maintain | no-resign );
dnssec-validation ( yes | no | auto );
@@ -725,8 +748,8 @@ view     integer;
response-policy { zone string [ add-soa boolean ] [ log
    boolean ] [ max-policy-ttl duration ] [ min-update-interval
-     duration ] [ policy ( cname | disabled | drop | given | no-op |
-     nodata | nxdomain | passthru | tcp-only quoted_string ) ] [
+     duration ] [ policy ( cname | disabled | drop | given | no-op
+     | nodata | nxdomain | passthru | tcp-only quoted_string ) ] [
    recursive-only boolean ] [ nsip-enable boolean ] [
    nsdname-enable boolean ]; ... } [ add-soa boolean ] [
    break-dnssec boolean ] [ max-policy-ttl duration ] [
@@ -908,7 +931,7 @@ view

-

ZONE

+

ZONE


zone string [ class ] {
allow-notify { address_match_element; ... };
@@ -1007,27 +1030,6 @@ zone

-
-

DNSSEC-POLICY

- -


-dnssec-policy string {
- dnskey-ttl duration;
- keys { ( csk | ksk | zsk ) key-directory lifetime duration algorithm integer [ integer ] ; ... };
- parent-ds-ttl duration;
- parent-propagation-delay duration;
- parent-registration-delay duration;
- publish-safety duration;
- retire-safety duration;
- signatures-refresh duration;
- signatures-validity duration;
- signatures-validity-dnskey duration;
- zone-max-ttl duration;
- zone-propagation-delay duration;
-};
-

-
-

FILES

diff --git a/bin/named/named.html b/bin/named/named.html index 18f5d2db9ae..95a9c49ff1c 100644 --- a/bin/named/named.html +++ b/bin/named/named.html @@ -230,9 +230,9 @@

Allow named to use up to #max-socks sockets. - The default value is 4096 on systems built with default - configuration options, and 21000 on systems built with - "configure --with-tuning=large". + The default value is 21000 on systems built with default + configuration options, and 4096 on systems built with + "configure --with-tuning=small".

Warning

diff --git a/configure b/configure index 775b9ae506d..1ab3abfeb56 100755 --- a/configure +++ b/configure @@ -1,6 +1,6 @@ #! /bin/sh # Guess values for system-dependent variables and create Makefiles. -# Generated by GNU Autoconf 2.69 for BIND 9.15. +# Generated by GNU Autoconf 2.69 for BIND 9.16. # # Report bugs to . # @@ -589,10 +589,10 @@ MAKEFLAGS= # Identity of this package. PACKAGE_NAME='BIND' PACKAGE_TARNAME='bind' -PACKAGE_VERSION='9.15' -PACKAGE_STRING='BIND 9.15' +PACKAGE_VERSION='9.16' +PACKAGE_STRING='BIND 9.16' PACKAGE_BUGREPORT='info@isc.org' -PACKAGE_URL='https://www.isc.org/downloads/BIND/' +PACKAGE_URL='https://www.isc.org/downloads/' # Factoring default headers for most tests. ac_includes_default="\ @@ -852,7 +852,6 @@ infodir docdir oldincludedir includedir -runstatedir localstatedir sharedstatedir sysconfdir @@ -1026,7 +1025,6 @@ datadir='${datarootdir}' sysconfdir='${prefix}/etc' sharedstatedir='${prefix}/com' localstatedir='${prefix}/var' -runstatedir='${localstatedir}/run' includedir='${prefix}/include' oldincludedir='/usr/include' docdir='${datarootdir}/doc/${PACKAGE_TARNAME}' @@ -1279,15 +1277,6 @@ do | -silent | --silent | --silen | --sile | --sil) silent=yes ;; - -runstatedir | --runstatedir | --runstatedi | --runstated \ - | --runstate | --runstat | --runsta | --runst | --runs \ - | --run | --ru | --r) - ac_prev=runstatedir ;; - -runstatedir=* | --runstatedir=* | --runstatedi=* | --runstated=* \ - | --runstate=* | --runstat=* | --runsta=* | --runst=* | --runs=* \ - | --run=* | --ru=* | --r=*) - runstatedir=$ac_optarg ;; - -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) ac_prev=sbindir ;; -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ @@ -1425,7 +1414,7 @@ fi for ac_var in exec_prefix prefix bindir sbindir libexecdir datarootdir \ datadir sysconfdir sharedstatedir localstatedir includedir \ oldincludedir docdir infodir htmldir dvidir pdfdir psdir \ - libdir localedir mandir runstatedir + libdir localedir mandir do eval ac_val=\$$ac_var # Remove trailing slashes. @@ -1538,7 +1527,7 @@ if test "$ac_init_help" = "long"; then # Omit some internal or obsolete options to make the list less imposing. # This message is too long to be a string in the A/UX 3.1 sh. cat <<_ACEOF -\`configure' configures BIND 9.15 to adapt to many kinds of systems. +\`configure' configures BIND 9.16 to adapt to many kinds of systems. Usage: $0 [OPTION]... [VAR=VALUE]... @@ -1578,7 +1567,6 @@ Fine tuning of the installation directories: --sysconfdir=DIR read-only single-machine data [PREFIX/etc] --sharedstatedir=DIR modifiable architecture-independent data [PREFIX/com] --localstatedir=DIR modifiable single-machine data [PREFIX/var] - --runstatedir=DIR modifiable per-process data [LOCALSTATEDIR/run] --libdir=DIR object code libraries [EPREFIX/lib] --includedir=DIR C header files [PREFIX/include] --oldincludedir=DIR C header files for non-gcc [/usr/include] @@ -1604,7 +1592,7 @@ fi if test -n "$ac_init_help"; then case $ac_init_help in - short | recursive ) echo "Configuration of BIND 9.15:";; + short | recursive ) echo "Configuration of BIND 9.16:";; esac cat <<\_ACEOF @@ -1775,7 +1763,7 @@ Use these variables to override the choices made by `configure' or to help it to find libraries and programs with nonstandard names/locations. Report bugs to . -BIND home page: . +BIND home page: . _ACEOF ac_status=$? fi @@ -1838,7 +1826,7 @@ fi test -n "$ac_init_help" && exit $ac_status if $ac_init_version; then cat <<\_ACEOF -BIND configure 9.15 +BIND configure 9.16 generated by GNU Autoconf 2.69 Copyright (C) 2012 Free Software Foundation, Inc. @@ -2261,7 +2249,7 @@ cat >config.log <<_ACEOF This file contains any messages produced by compilers while running configure, to aid debugging if configure makes a mistake. -It was created by BIND $as_me 9.15, which was +It was created by BIND $as_me 9.16, which was generated by GNU Autoconf 2.69. Invocation command line was $ $0 $@ @@ -4023,7 +4011,7 @@ else We can't simply define LARGE_OFF_T to be 9223372036854775807, since some C++ compilers masquerading as C compilers incorrectly reject 9223372036854775807. */ -#define LARGE_OFF_T ((((off_t) 1 << 31) << 31) - 1 + (((off_t) 1 << 31) << 31)) +#define LARGE_OFF_T (((off_t) 1 << 62) - 1 + ((off_t) 1 << 62)) int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721 && LARGE_OFF_T % 2147483647 == 1) ? 1 : -1]; @@ -4069,7 +4057,7 @@ else We can't simply define LARGE_OFF_T to be 9223372036854775807, since some C++ compilers masquerading as C compilers incorrectly reject 9223372036854775807. */ -#define LARGE_OFF_T ((((off_t) 1 << 31) << 31) - 1 + (((off_t) 1 << 31) << 31)) +#define LARGE_OFF_T (((off_t) 1 << 62) - 1 + ((off_t) 1 << 62)) int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721 && LARGE_OFF_T % 2147483647 == 1) ? 1 : -1]; @@ -4093,7 +4081,7 @@ rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext We can't simply define LARGE_OFF_T to be 9223372036854775807, since some C++ compilers masquerading as C compilers incorrectly reject 9223372036854775807. */ -#define LARGE_OFF_T ((((off_t) 1 << 31) << 31) - 1 + (((off_t) 1 << 31) << 31)) +#define LARGE_OFF_T (((off_t) 1 << 62) - 1 + ((off_t) 1 << 62)) int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721 && LARGE_OFF_T % 2147483647 == 1) ? 1 : -1]; @@ -4138,7 +4126,7 @@ else We can't simply define LARGE_OFF_T to be 9223372036854775807, since some C++ compilers masquerading as C compilers incorrectly reject 9223372036854775807. */ -#define LARGE_OFF_T ((((off_t) 1 << 31) << 31) - 1 + (((off_t) 1 << 31) << 31)) +#define LARGE_OFF_T (((off_t) 1 << 62) - 1 + ((off_t) 1 << 62)) int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721 && LARGE_OFF_T % 2147483647 == 1) ? 1 : -1]; @@ -4162,7 +4150,7 @@ rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext We can't simply define LARGE_OFF_T to be 9223372036854775807, since some C++ compilers masquerading as C compilers incorrectly reject 9223372036854775807. */ -#define LARGE_OFF_T ((((off_t) 1 << 31) << 31) - 1 + (((off_t) 1 << 31) << 31)) +#define LARGE_OFF_T (((off_t) 1 << 62) - 1 + ((off_t) 1 << 62)) int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721 && LARGE_OFF_T % 2147483647 == 1) ? 1 : -1]; @@ -24193,7 +24181,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 # report actual input values of CONFIG_FILES etc. instead of their # values after options handling. ac_log=" -This file was extended by BIND $as_me 9.15, which was +This file was extended by BIND $as_me 9.16, which was generated by GNU Autoconf 2.69. Invocation command line was CONFIG_FILES = $CONFIG_FILES @@ -24254,13 +24242,13 @@ Configuration commands: $config_commands Report bugs to . -BIND home page: ." +BIND home page: ." _ACEOF cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`" ac_cs_version="\\ -BIND config.status 9.15 +BIND config.status 9.16 configured by $0, generated by GNU Autoconf 2.69, with options \\"\$ac_cs_config\\" diff --git a/configure.ac b/configure.ac index 4ff88ae676b..4e398f7a483 100644 --- a/configure.ac +++ b/configure.ac @@ -7,7 +7,7 @@ # See the COPYRIGHT file distributed with this work for additional # information regarding copyright ownership. -AC_INIT(BIND, [9.15], [info@isc.org], [], [https://www.isc.org/downloads/]) +AC_INIT(BIND, [9.16], [info@isc.org], [], [https://www.isc.org/downloads/]) AC_PREREQ([2.60]) # diff --git a/doc/arm/Bv9ARM.ch01.html b/doc/arm/Bv9ARM.ch01.html index bd99aed029a..da537d6e79c 100644 --- a/doc/arm/Bv9ARM.ch01.html +++ b/doc/arm/Bv9ARM.ch01.html @@ -75,7 +75,7 @@ BIND version 9 software package for system administrators.

-

This version of the manual corresponds to BIND version 9.15.

+

This version of the manual corresponds to BIND version 9.16.

@@ -614,6 +614,6 @@
-

BIND 9.15.8 (Development Release)

+

BIND 9.16.0 (Stable Release)

diff --git a/doc/arm/Bv9ARM.ch02.html b/doc/arm/Bv9ARM.ch02.html index 826f5307140..1eb29f48f3f 100644 --- a/doc/arm/Bv9ARM.ch02.html +++ b/doc/arm/Bv9ARM.ch02.html @@ -146,6 +146,6 @@
-

BIND 9.15.8 (Development Release)

+

BIND 9.16.0 (Stable Release)

diff --git a/doc/arm/Bv9ARM.ch03.html b/doc/arm/Bv9ARM.ch03.html index 5f7f547c4fa..910173dfb64 100644 --- a/doc/arm/Bv9ARM.ch03.html +++ b/doc/arm/Bv9ARM.ch03.html @@ -856,6 +856,6 @@ controls {
-

BIND 9.15.8 (Development Release)

+

BIND 9.16.0 (Stable Release)

diff --git a/doc/arm/Bv9ARM.ch04.html b/doc/arm/Bv9ARM.ch04.html index 06b8890e779..792138b1b91 100644 --- a/doc/arm/Bv9ARM.ch04.html +++ b/doc/arm/Bv9ARM.ch04.html @@ -2915,6 +2915,6 @@ $ORIGIN 0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa.
-

BIND 9.15.8 (Development Release)

+

BIND 9.16.0 (Stable Release)

diff --git a/doc/arm/Bv9ARM.ch05.html b/doc/arm/Bv9ARM.ch05.html index 6ffdef48bb2..e534a0ac99f 100644 --- a/doc/arm/Bv9ARM.ch05.html +++ b/doc/arm/Bv9ARM.ch05.html @@ -71,8 +71,7 @@
trust-anchors Statement Definition and Usage
dnssec-policy Statement Grammar
-
dnssec-policy Statement Definition - and Usage
+
dnssec-policy Statement Definition and Usage
managed-keys Statement Grammar
managed-keys Statement Definition and Usage
@@ -2142,41 +2141,40 @@ category notify { null; }; The query-errors Category

The query-errors category is - specifically intended for debugging purposes: To identify - why and how specific queries result in responses which - indicate an error. - Messages of this category are therefore only logged - with debug levels. + used to indicate why and how specific queries resulted in + responses which indicate an error. Normally, these messages + will be logged at debug logging levels; + note, however, that if query logging is active, some will be + logged at info. The logging levels are + described below:

- At the debug levels of 1 or higher, each response with the - rcode of SERVFAIL is logged as follows: + At debug level 1 or higher - or at + info, when query logging is active - each + response with response code SERVFAIL will be logged as follows:

client 127.0.0.1#61502: query failed (SERVFAIL) for www.example.com/IN/AAAA at query.c:3880

- This means an error resulting in SERVFAIL was - detected at line 3880 of source file - query.c. - Log messages of this level will particularly - help identify the cause of SERVFAIL for an - authoritative server. + This means an error resulting in SERVFAIL was detected at line + 3880 of source file query.c. Log messages + of this level will particularly help identify the cause of + SERVFAIL for an authoritative server.

- At the debug levels of 2 or higher, detailed context - information of recursive resolutions that resulted in - SERVFAIL is logged. - The log message will look like as follows: + At debug level 2 or higher, detailed + context information about recursive resolutions that resulted in + SERVFAIL will be logged. The log message will look like this: 

 fetch completed at resolver.c:2970 for www.example.com/A
-in 30.000183: timed out/success [domain:example.com,
-referral:2,restart:7,qrysent:8,timeout:5,lame:0,neterr:0,
+in 10.000183: timed out/success [domain:example.com,
+referral:2,restart:7,qrysent:8,timeout:5,lame:0,quota:0,neterr:0,
 badresp:1,adberr:0,findfail:0,valfail:0]

@@ -2184,29 +2182,25 @@ badresp:1,adberr:0,findfail:0,valfail:0]

The first part before the colon shows that a recursive resolution for AAAA records of www.example.com completed - in 30.000183 seconds and the final result that led to the + in 10.000183 seconds and the final result that led to the SERVFAIL was determined at line 2970 of source file resolver.c.

The following part shows the detected final result and the - latest result of DNSSEC validation. - The latter is always success when no validation attempt - is made. - In this example, this query resulted in SERVFAIL probably - because all name servers are down or unreachable, leading - to a timeout in 30 seconds. - DNSSEC validation was probably not attempted. + latest result of DNSSEC validation. The latter is always + "success" when no validation attempt was made. In this example, + this query probably resulted in SERVFAIL because all name + servers are down or unreachable, leading to a timeout in 10 + seconds. DNSSEC validation was probably not attempted.

- The last part enclosed in square brackets shows statistics - information collected for this particular resolution - attempt. - The domain field shows the deepest zone - that the resolver reached; - it is the zone where the error was finally detected. - The meaning of the other fields is summarized in the - following table. + The last part, enclosed in square brackets, shows statistics + collected for this particular resolution attempt. + The domain field shows the deepest zone that + the resolver reached; it is the zone where the error was + finally detected. The meaning of the other fields is + summarized in the following table.

@@ -2283,6 +2277,18 @@ badresp:1,adberr:0,findfail:0,valfail:0] + +

quota

+ + +

+ The number of times the resolver was unable + to send a query because it had exceeded the + permissible fetch quota for a server. +

+ + +

neterr

@@ -2352,20 +2358,17 @@ badresp:1,adberr:0,findfail:0,valfail:0]

- At the debug levels of 3 or higher, the same messages - as those at the debug 1 level are logged for other errors - than SERVFAIL. - Note that negative responses such as NXDOMAIN are not - regarded as errors here. + At debug level 3 or higher, the same + messages as those at debug level 1 will be + logged for other errors than SERVFAIL. Note that negative + responses such as NXDOMAIN are not errors, and are not logged + at this debug level.

- At the debug levels of 4 or higher, the same messages - as those at the debug 2 level are logged for other errors - than SERVFAIL. - Unlike the above case of level 3, messages are logged for - negative responses. - This is because any unexpected results can be difficult to - debug in the recursion case. + At debug level 4 or higher, the + detailed context information logged at debug + level 2 will be logged for other errors than SERVFAIL and + for negative resonses such as NXDOMAIN.

@@ -2480,6 +2483,7 @@ badresp:1,adberr:0,findfail:0,valfail:0] dnssec-dnskey-kskonly boolean; dnssec-loadkeys-interval integer; dnssec-must-be-secure string boolean; + dnssec-policy string; dnssec-secure-to-insecure boolean; dnssec-update-mode ( maintain | no-resign ); dnssec-validation ( yes | no | auto ); @@ -2629,8 +2633,8 @@ badresp:1,adberr:0,findfail:0,valfail:0] integer; response-policy { zone string [ add-soa boolean ] [ log boolean ] [ max-policy-ttl duration ] [ min-update-interval - duration ] [ policy ( cname | disabled | drop | given | no-op | - nodata | nxdomain | passthru | tcp-only quoted_string ) ] [ + duration ] [ policy ( cname | disabled | drop | given | no-op + | nodata | nxdomain | passthru | tcp-only quoted_string ) ] [ recursive-only boolean ] [ nsip-enable boolean ] [ nsdname-enable boolean ]; ... } [ add-soa boolean ] [ break-dnssec boolean ] [ max-policy-ttl duration ] [ @@ -4781,11 +4785,22 @@ options {
querylog

- Specify whether query logging should be started when named - starts. - If querylog is not specified, - then the query logging - is determined by the presence of the logging category queries. + Query logging provides a complete log of all incoming + queries and all query errors. This provides more insight + into the server's activity, but with a cost to + performance which may be significant on heavily-loaded + servers. +

+

+ The querylog option specifies + whether query logging should be active when + named first starts. + If querylog is not specified, then + query logging is determined by the presence of the + logging category queries. + Query logging can also be activated at runtime using the + command rndc querylog on, or + deactivated with rndc querylog off.

check-names
@@ -5064,9 +5079,11 @@ options {
forwarders

- Specifies the IP addresses to be used - for forwarding. The default is the empty list (no - forwarding). + Specifies a list of IP addresses to which queries shall be + forwarded. The default is the empty list (no forwarding). + Each address in the list can be associated with an optional + port number and/or DSCP value, and a default port number and + DSCP value can be set for the entire list.

@@ -7286,6 +7303,11 @@ avoid-v6-udp-ports { 40000; range 50000 60000; }; Specifying version none disables processing of the queries.

+

+ Setting version to any value + (including none) will also + disable queries for authors.bind TXT CH. +

hostname
@@ -9074,7 +9096,8 @@ example.com CNAME rpz-tcp-only. 
 dnssec-policy string {
     dnskey-ttl duration;
-    keys { ( csk | ksk | zsk ) key-directory lifetime duration algorithm integer [ integer ] ; ... };
+    keys { ( csk | ksk | zsk ) key-directory lifetime ( duration | unlimited ) algorithm integer [ integer ] ; ... };
+    max-zone-ttl duration;
     parent-ds-ttl duration;
     parent-propagation-delay duration;
     parent-registration-delay duration;
@@ -9083,7 +9106,6 @@ example.com                 CNAME   rpz-tcp-only.
     signatures-refresh duration;
     signatures-validity duration;
     signatures-validity-dnskey duration;
-    zone-max-ttl duration;
     zone-propagation-delay duration;
 };
@@ -9091,136 +9113,232 @@ example.com CNAME rpz-tcp-only.

-dnssec-policy Statement Definition - and Usage

+dnssec-policy Statement Definition and Usage

The dnssec-policy statement defines a key and signing policy (KASP) for zones.

- KASP is used to determine how one or more zones need to be signed - with DNSSEC. For example, how often RRSIG records need to be - refreshed, or what cryptographic algorithms to use. + A KASP determines how one or more zones will be signed + with DNSSEC. For example, it specifies how often keys should + roll, which cryptographic algorithms to use, and how often RRSIG + records need to be refreshed. +

+

+ Multiple key and signing policies can be configured. To + attach a policy to a zone, add a dnssec-policy + option to the zone statement, specifying he + name of the policy that should be used. +

+

+ Key rollover timing is computed for each key according to + the key lifetime defined in the KASP. The lifetime may be + modified by zone TTLs and propagation delays, in order to + prevent validation failures. When a key reaches the end of its + lifetime, + named will generate and publish a new key + automatically, then deactivate the old key and activate the + new one, and finally retire the old key according to a computed + schedule.

- You can configure multiple policies. To attach a policy to a zone - simply add dnssec-policy "policy_name" - option to the zone statement with a matching - policy name. + Zone-signing key (ZSK) rollovers require no operator input. + Key-signing key (KSK) and combined signing key (CSK) rollovers + require action to be taken to submit a DS record to the parent. + Rollover timing for KSKs and CSKs is adjusted to take into account + delays in processing and propagating DS updates. +

+

+ There are two predefined dnssec-policy names: + none and default. + Setting a zone's policy to + none is the same as not setting + dnssec-policy at all; the zone will not + be signed. Policy default causes the + zone to be signed with a single combined signing key (CSK) + using algorithm ECDSAP256SHA256; this key will have an + unlimited lifetime. (A verbose copy of this policy + may be found in the source tree, in the file + doc/misc/dnssec-policy.default.conf.) +

+
+

Note

+ The default signing policy may change in future releases. + This could result in changes to your signing policy + occurring when you upgrade to a new version of BIND. Check + the release notes carefully when upgrading to be informed + of such changes. To prevent policy changes on upgrade, + use an explicitly defined dnssec-policy + rather than default. +
+

+

+

+ If a dnssec-policy statement is modified + and the server restarted or reconfigured, named + will attempt to change the policy smoothly from the old one to + the new. For example, if the key algorithm is changed, then + a new key will be generated with the new algorithm, and the old + algorithm will be retired when the existing key's lifetime ends. +

+
+

Note

+ Rolling to a new policy while another key rollover is + already in progress is not yet supported, and may result in + unexpected behavior. +
+

+

+

+ The following options can be specified in a + dnssec-policy statement:

dnskey-ttl

- The TTL of the DNSKEY resource records. - Default is 3600 seconds. + The TTL to use when generating DNSKEY resource records. + The default is 1 hour (3600 seconds).

keys

- A list of keys to use. Each line represents one key. Here is - an example (for illustration purposes only) of some possible - keys in a dnssec-policy: + A list specifying the algorithms and roles to use when + generating keys and signing the zone. + Entries in this list do not represent specific + DNSSEC keys, which may be changed on a regular basis, + but the roles that keys will play in the signing policy. + For example, configuring a KSK of algorithm RSASHA256 ensures + that the DNSKEY RRset will always include a key-signing key + for that algorithm. +

+

+ Here is an example (for illustration purposes only) of + some possible entries in a keys + list: 

keys {
-    ksk key-directory lifetime P5Y algorithm 8 2048;
-    zsk key-directory lifetime P30D algorithm 8;
-    csk key-directory lifetime P6MT12H3M15S algorithm 13;
+    ksk key-directory lifetime unlimited algorithm rsasha1 2048;
+    zsk lifetime P30D algorithm 8;
+    csk lifetime P6MT12H3M15S algorithm ecdsa256;
 };

- This example lists three keys. The first token determines - what RRsets the key will sign. If set to - ksk the key will sign the DNSKEY, CDS, - and CDNSKEY RRsets, if set to zsk the - key will sign the other RRsets, and if set to - csk the key will sign all RRsets. + This example specifies that three keys should be used + in the zone. The first token determines which role the + key will play in signing RRsets. If set to + ksk, then this will be + a key-signing key; it will have the KSK flag set and + will only be used to sign DNSKEY, CDS, and CDNSKEY RRsets. + If set to zsk, this will be + a zone-signing key; the KSK flag will be unset, and + the key will sign all RRsets except + DNSKEY, CDS, and CDNSKEY. If set to + csk the key will have the KSK + flag set and will be used to sign all RRsets.

- The following part determines where the key will be stored. - Currently keys can only be stored in the configured - key-directory. + An optional second token determines where the key will + be stored. Currently, keys can only be stored in the + configured key-directory. This token + may be used in the future to store keys in hardware + service modules or separate directories.

- The third token tells how long the key may be used. In the - example the first key has a lifetime of 5 years, the second - key may be used for 30 days and the third key has a rather - peculiar lifetime of 6 months, 12 hours, 3 minutes and 15 - seconds. + The lifetime parameter specifies how + long a key may be used before rolling over. In the + example above, the first key will have an unlimited + lifetime, the second key may be used for 30 days, and the + third key has a rather peculiar lifetime of 6 months, + 12 hours, 3 minutes and 15 seconds. A lifetime of 0 + seconds is the same as unlimited.

- The last token(s) are the key's algorithm and algorithm - length. The length may be omitted as shown in the - example for the second and third key. + Note that the lifetime of a key may be extended if + retiring it too soon would cause validation failures. + For example, if the key were configured to roll more + frequently than its own TTL, its lifetime would + automatically be extended to account for this. +

+

+ The algorithm parameter specifies + the key's algorithm, expressed either as a string + ("rsasha256", "ecdsa384", etc) or as a decimal number. + An optional second parameter specifies the key's size + in size in bits. If it is omitted, as shown in the + example for the second and third keys, an appropriate + default size for the algorithm will be used.

publish-safety

- A margin that is added to the publish interval in key - timing equations to give some extra time to cover - unforeseen events. Default is PT1H - (1 hour). + A margin that is added to the pre-publication + interval in rollover timing calcuations to give some + extra time to cover unforeseen events. This increases + the time that keys are published before becoming active. + The default is PT1H (1 hour).

retire-safety

- A margin that is added to the retire interval in key - timing equations to give some extra time to cover - unforeseen events. Default is PT1H - (1 hour). + A margin that is added to the post-publication interval + in rollover timing calculations to give some extra time + to cover unforeseen events. This increases the time a key + remains published after it is no longer active. The + default is PT1H (1 hour).

signatures-refresh

- This determines when a RRSIG record needs to be - refreshed. The signatures is renewed when the time until - the expiration time is closer than - signatures-refresh. - signatures-resign interval. Default - is P5D (5 days), meaning a signature - that will expire in 5 days or sooner will be refreshed. + This determines how frequently an RRSIG record needs to be + refreshed. The signature is renewed when the time until + the expiration time is closer than the specified interval. + The default is P5D (5 days), meaning + signatures that will expire in 5 days or sooner will be + refreshed.

signatures-validity

- The validity period of an RRSIG record (minus the - inception offset and jitter). Default is + The validity period of an RRSIG record (subject to + inception offset and jitter). The default is P2W (2 weeks).

signatures-validity-dnskey

- Like signatures-validity but for - DNSKEY records. Default is P2W (2 - weeks). + Similar to signatures-validity but for + DNSKEY records. The default is P2W + (2 weeks).

-
zone-max-ttl
+
max-zone-ttl

- Like max-zone-ttl, specifies the - maximum permissible TTL value in seconds. When loading a - zone file using a masterfile-format or + Like the max-zone-ttl zone option, + this specifies the maximum permissible TTL value in + seconds for the zone. When loading a zone file using + a masterfile-format of text or raw, any record encountered with a TTL higher than - zone-max-ttl will be capped to the + max-zone-ttl will be capped at the maximum permissible TTL value.

This is needed in DNSSEC-maintained zones because when rolling to a new DNSKEY, the old key needs to remain available until RRSIG records have expired from caches. - The zone-max-ttl option guarantees that + The max-zone-ttl option guarantees that the largest TTL in the zone will be no higher than the set value.

@@ -9231,41 +9349,41 @@ example.com CNAME rpz-tcp-only.

The default value is PT24H (24 hours). - A zone-max-ttl of zero is treated as if - the default value is in use. + A max-zone-ttl of zero is treated as if + the default value were in use.

zone-propagation-delay

- The expected propagation delay from when a zone is - updated and when the new version of the zone is served by - all its name servers. Default is - PT5M (5 minutes). + The expected propagation delay from the time when a zone + is first updated to the time when the new version of the + zone will be served by all secondary servers. The default + is PT5M (5 minutes).

parent-ds-ttl

- The TTL of the DS RRset that the parent uses. Default is - P1D (1 day). + The TTL of the DS RRset that the parent zone uses. The + default is P1D (1 day).

parent-propagation-delay

- The expected propagation delay from when the parent zone - is updated and when the new version of the parent zone is - served by all its name servers. Default is - PT1H (1 hour). + The expected propagation delay from the time when the + parent zone is updated to the time when the new version + is served by all of the parent zone's name servers. + The default is PT1H (1 hour).

parent-registration-delay

- The expected registration delay from when a DS RRset - change is requested and when the DS RRset has been - updated in the parent zone. Default is + The expected registration delay from the time when a DS + RRset change is requested to the time when the DS RRset + will be updated in the parent zone. The default is P1D (1 day).

@@ -10366,13 +10484,16 @@ view "external" {
dnssec-policy

- The key and signing policy for this zone. This is a string - referring to a dnssec-policy statement. + Specifies which key and signing policy (KASP) should + be used for this zone. This is a string referring to + a dnssec-policy statement. There are two built-in policies: - "default" allows you to use the - default policy, and "none" means + default allows you to use the + default policy, and none means not to use any DNSSEC policy, keeping the zone unsigned. - The default is "none". + The default is none. + See the section called “dnssec-policy Statement Grammar” for + more details.

dnssec-update-mode
@@ -15220,6 +15341,6 @@ HOST-127.EXAMPLE. MX 0 .
-

BIND 9.15.8 (Development Release)

+

BIND 9.16.0 (Stable Release)

diff --git a/doc/arm/Bv9ARM.ch06.html b/doc/arm/Bv9ARM.ch06.html index 03bdafe232a..9b6b72c9bc8 100644 --- a/doc/arm/Bv9ARM.ch06.html +++ b/doc/arm/Bv9ARM.ch06.html @@ -360,6 +360,6 @@ allow-query { !{ !10/8; any; }; key example; };
-

BIND 9.15.8 (Development Release)

+

BIND 9.16.0 (Stable Release)

diff --git a/doc/arm/Bv9ARM.ch07.html b/doc/arm/Bv9ARM.ch07.html index 90fb52191de..58a055ed777 100644 --- a/doc/arm/Bv9ARM.ch07.html +++ b/doc/arm/Bv9ARM.ch07.html @@ -191,6 +191,6 @@
-

BIND 9.15.8 (Development Release)

+

BIND 9.16.0 (Stable Release)

diff --git a/doc/arm/Bv9ARM.ch08.html b/doc/arm/Bv9ARM.ch08.html index cc04c6d8ddd..9bcb4e9db2d 100644 --- a/doc/arm/Bv9ARM.ch08.html +++ b/doc/arm/Bv9ARM.ch08.html @@ -36,21 +36,13 @@

Table of Contents

-
Release Notes for BIND Version 9.15.8
+
Release Notes for BIND Version 9.16.0
Introduction
Note on Version Numbering
Supported Platforms
Download
-
Notes for BIND 9.15.8
-
Notes for BIND 9.15.7
-
Notes for BIND 9.15.6
-
Notes for BIND 9.15.5
-
Notes for BIND 9.15.4
-
Notes for BIND 9.15.3
-
Notes for BIND 9.15.2
-
Notes for BIND 9.15.1
-
Notes for BIND 9.15.0
+
Notes for BIND 9.16.0
License
End of Life
Thank You
@@ -59,38 +51,30 @@

-Release Notes for BIND Version 9.15.8

+Release Notes for BIND Version 9.16.0

Introduction

- BIND 9.15 is an unstable development release of BIND. - This document summarizes new features and functional changes that - have been introduced on this branch. With each development release - leading up to the stable BIND 9.16 release, this document will be - updated with additional features added and bugs fixed. + BIND 9.16 is a stable branch of BIND. + This document summarizes significant changes since the last + production release on that branch. +

+

+ Please see the file CHANGES for a more + detailed list of changes and bug fixes.

Note on Version Numbering

- Until BIND 9.12, new feature development releases were tagged - as "alpha" and "beta", leading up to the first stable release - for a given development branch, which always ended in ".0". - More recently, BIND adopted the "odd-unstable/even-stable" - release numbering convention. There will be no "alpha" or "beta" - releases in the 9.15 branch, only increasing version numbers. - So, for example, what would previously have been called 9.15.0a1, - 9.15.0a2, 9.15.0b1, and so on, will instead be called 9.15.0, - 9.15.1, 9.15.2, etc. -

-

- The first stable release from this development branch will be - renamed as 9.16.0. Thereafter, maintenance releases will continue - on the 9.16 branch, while unstable feature development proceeds in - 9.17. + As of BIND 9.13/9.14, BIND has adopted the "odd-unstable/even-stable" + release numbering convention. BIND 9.16 contains new features added + during the BIND 9.15 development process. Henceforth, the 9.16 branch + will be limited to bug fixes and new feature development will proceed + in the unstable 9.17 branch.

@@ -133,116 +117,16 @@

-Notes for BIND 9.15.8

- -
-

-Feature Changes

-
  • -

    - The trust-anchors statement no longer rejects - a mix of both key-style and DS-style trust anchor entries for the - same name. [GL #1237] -

    -
-
- -
-

-Bug Fixes

-
    -
  • -

    - Fixed an intermittent crash in the validator that could occur - when validating negative answers from the cache. [GL #1561] -

    -
    • -
  • -

    - Fixed a bug that could cause named to crash on - machines with more than 40 CPUs. [GL #1493] -

    -
    • -
  • -

    - Socket-related statistics counters were not being updated by - network manager sockets, but are now fully functional. [GL #1311] -

    -
    • -
-
- -
-
-

-Notes for BIND 9.15.7

- -
-

-Feature Changes

-
    -
  • -

    - The dnssec-keys configuration statement, - which was introduced in 9.15.1 and revised in 9.15.6, has now - been renamed to the more descriptive - trust-anchors. [GL !2702] -

    -

    - (See release notes for - BIND 9.15.1 - and - BIND 9.15.6 - for prior discussion of this feature.) -

    -
    • -
  • -

    - Added support for multithreaded listening for TCP connections - in the network manager. [GL !2659] -

    -
    • -
-
- -
-

-Bug Fixes

-
    -
  • -

    - Fixed a bug that caused named to leak memory - on reconfiguration when any GeoIP2 database was in use. [GL #1445] -

    -
    • -
  • -

    - Fixed several possible race conditions discovered by - ThreadSanitizer. -

    -
    • -
-
- -
-
-

-Notes for BIND 9.15.6

+Notes for BIND 9.16.0
-
-

-Security Fixes

-
  • -

    - Set a limit on the number of concurrently served pipelined TCP - queries. This flaw is disclosed in CVE-2019-6477. [GL #1264] -

    -
-
+

+ Note: this section only lists changes from BIND 9.14 (the + previous stable branch of BIND). +

-New Features

+New Features
- - -
-

-Feature Changes

-
    -
  • -

    - NSEC Aggressive Cache (synth-from-dnssec) has been disabled by default - because it was found to have a significant performance impact on the - recursive service. The NSEC Aggressive Cache will be enable by default - in the future releases. [GL #1265] + dig, mdig and + delv can all now take a +yaml + option to print output in a detailed YAML format. [GL #1145]

  • - The DNSSEC validation code has been refactored for clarity and to - reduce code duplication. [GL #622] + dig now has a new command line option: + +[no]unexpected. By default, dig + won't accept a reply from a source other than the one to which + it sent the query. Add the +unexpected argument + to enable it to process replies from unexpected sources. [RT #44978]

    • -
-
- - -
-

-Notes for BIND 9.15.5

- -
-

-Security Fixes

-

  • - named could crash with an assertion failure - if a forwarder returned a referral, rather than resolving the - query, when QNAME minimization was enabled. This flaw is - disclosed in CVE-2019-6476. [GL #1051] + dig now accepts a new command line option, + +[no]expandaaaa, which causes the IPv6 + addresses in AAAA records to be printed in full 128-bit + notation rather than the default RFC 5952 format. [GL #765]

  • - A flaw in DNSSEC verification when transferring mirror zones - could allow data to be incorrectly marked valid. This flaw - is disclosed in CVE-2019-6475. [GL #1252] + Statistics channel groups can now be toggled. [GL #1030]

-
-
-

-Notes for BIND 9.15.4

-

-New Features

+Feature Changes
- - -
-

-Bug Fixes

-
  • -

    - When a response-policy zone expires, ensure - that its policies are removed from the RPZ summary database. - [GL #1146] -

    -
-
- - -
-

-Notes for BIND 9.15.3

- -
-

-New Features

-
  • -

    - Statistics channel groups are now toggleable. [GL #1030] -

    -
-
- -
-

-Removed Features

-
  • +

  • - DNSSEC Lookaside Validation (DLV) is now obsolete. - The dnssec-lookaside option has been - marked as deprecated; when used in named.conf, - it will generate a warning but will otherwise be ignored. - All code enabling the use of lookaside validation has been removed - from the validator, delv, and the DNSSEC tools. - [GL #7] + named will now log a warning if + a static key is configured for the root zone. [GL #6]

    -
-
- -
-

-Feature Changes

-
    +

  • A SipHash 2-4 based DNS Cookie (RFC 7873) algorithm has been added and made default. Old non-default HMAC-SHA based DNS Cookie algorithms have been removed, and only the default AES algorithm is being kept - for legacy reasons. This change doesn't have any operational impact - in most common scenarios. [GL #605] + for legacy reasons. This change has no operational impact in most + common scenarios. [GL #605]

    - If you are running multiple DNS Servers (different versions of BIND 9 - or DNS server from multiple vendors) responding from the same IP - address (anycast or load-balancing scenarios), you'll have to make - sure that all the servers are configured with the same DNS Cookie - algorithm and same Server Secret for the best performance. + If you are running multiple DNS servers (different versions of BIND 9 + or DNS servers from multiple vendors) responding from the same IP + address (anycast or load-balancing scenarios), make sure that all the + servers are configured with the same DNS Cookie algorithm and same + Server Secret for the best performance.

  • @@ -440,135 +280,39 @@ dnssec-verify commands is now printed to standard output. The standard error output is only used to print warnings and errors, and in case the user requests the signed zone to be printed to - standard output with -f - option. A new + standard output with the -f - option. A new configuration option -q has been added to silence all output on standard output except for the name of the signed zone. + [GL #1151]

  • - DS records included in DNS referral messages can now be validated - and cached immediately, reducing the number of queries needed for - a DNSSEC validation. [GL #964] -

    -
    • -
-
- -
-

-Bug Fixes

-
    -
  • -

    - Cache database statistics counters could report invalid values - when stale answers were enabled, because of a bug in counter - maintenance when cache data becomes stale. The statistics counters - have been corrected to report the number of RRsets for each - RR type that are active, stale but still potentially served, - or stale and marked for deletion. [GL #602] -

    -
    • -
  • -

    - Interaction between DNS64 and RPZ No Data rule (CNAME *.) could - cause unexpected results; this has been fixed. [GL #1106] -

    -
    • -
  • -

    - named-checkconf now checks DNS64 prefixes - to ensure bits 64-71 are zero. [GL #1159] -

    -
    • -
  • -

    - named-checkconf now correctly reports a missing - dnstap-output option when - dnstap is set. [GL #1136] -

    -
    • -
  • -

    - Handle ETIMEDOUT error on connect() with a non-blocking - socket. [GL #1133] -

    -
    • -
  • -

    - dig now correctly expands the IPv6 address - when run with +expandaaaa +short. [GL #1152] -

    -
    • -
-
- -
-
-

-Notes for BIND 9.15.2

- -
-

-New Features

-
    -
  • -

    - The GeoIP2 API from MaxMind is now supported. Geolocation support - will be compiled in by default if the libmaxminddb - library is found at compile time, but can be turned off by using - configure --disable-geoip. -

    -

    - The default path to the GeoIP2 databases will be set based - on the location of the libmaxminddb library; - for example, if it is in /usr/local/lib, - then the default path will be - /usr/local/share/GeoIP. - This value can be overridden in named.conf - using the geoip-directory option. -

    -

    - Some geoip ACL settings that were available with - legacy GeoIP, including searches for netspeed, - org, and three-letter ISO country codes, will - no longer work when using GeoIP2. Supported GeoIP2 database - types are country, city, - domain, isp, and - as. All of these databases support both IPv4 - and IPv6 lookups. [GL #182] [GL #1112] + The DNSSEC validation code has been refactored for clarity and to + reduce code duplication. [GL #622]

  • - Two new metrics have been added to the - statistics-channel to report DNSSEC - signing operations. For each key in each zone, the - dnssec-sign counter indicates the total - number of signatures named has generated - using that key since server startup, and the - dnssec-refresh counter indicates how - many of those signatures were refreshed during zone - maintenance, as opposed to having been generated - as a result of a zone update. [GL #513] + Compile-time settings enabled by the + --with-tuning=large option for + configure are now in effect by default. + Previously used default compile-time settings can be enabled + by passing --with-tuning=small to + configure. [GL !2989]

    • -
-
- -
-

-Bug Fixes

-

  • - When qname-minimization was set to - relaxed, some improperly configured domains - would fail to resolve, but would have succeeded when minimization - was disabled. named will now fall back to normal - resolution in such cases, and also uses type A rather than NS for - minimal queries in order to reduce the likelihood of encountering - the problem. [GL #1055] + JSON-C is now the only supported library for enabling JSON + support for BIND statistics. The configure + option has been renamed from --with-libjson + to --with-json-c. Set the + PKG_CONFIG_PATH environment variable + accordingly to specify a custom path to the + json-c library, as the new + configure option does not take the library + installation path as an optional argument. [GL #855]

  • @@ -579,208 +323,50 @@ when --prefix is not specified and the aforementioned options are not specified explicitly. Instead, Autoconf's defaults of $prefix/etc and - $prefix/var are respected. -

    -
    • -
  • -

    - Glue address records were not being returned in responses - to root priming queries; this has been corrected. [GL #1092] -

    -
    • -
-
- -
-
-

-Notes for BIND 9.15.1

- -
-

-Security Fixes

-
  • -

    - A race condition could trigger an assertion failure when - a large number of incoming packets were being rejected. - This flaw is disclosed in CVE-2019-6471. [GL #942] -

    -
-
- -
-

-New Features

-
  • -

    - In order to clarify the configuration of DNSSEC keys, - the trusted-keys and - managed-keys statements have been - deprecated, and the new dnssec-keys - statement should now be used for both types of key. -

    -

    - When used with the keyword initial-key, - dnssec-keys has the same behavior as - managed-keys, i.e., it configures - a trust anchor that is to be maintained via RFC 5011. -

    -

    - When used with the new keyword static-key, it - has the same behavior as trusted-keys, - configuring a permanent trust anchor that will not automatically - be updated. (This usage is not recommended for the root key.) - [GL #6] -

    -
-
- -
-

-Removed Features

-
  • -

    - The cleaning-interval option has been - removed. [GL !1731] -

    -
-
- -
-

-Feature Changes

-
    -
  • -

    - named will now log a warning if - a static key is configured for the root zone. [GL #6] -

    -
    • -
  • -

    - JSON-C is now the only supported library for enabling JSON - support for BIND statistics. The configure - option has been renamed from --with-libjson - to --with-json-c. Use - PKG_CONFIG_PATH to specify a custom path to - the json-c library as the new - configure option does not take the library - installation path as an optional argument. + $prefix/var are respected. [GL #658]

-
-
-

-Notes for BIND 9.15.0

-

-Security Fixes

+Removed Features
- - -
-

-New Features

-
  • -

    - The new add-soa option specifies whether - or not the response-policy zone's SOA record - should be included in the additional section of RPZ responses. - [GL #865] -

    -
-
- -
-

-Removed Features

-

  • The dnssec-enable option has been obsoleted and no longer has any effect. DNSSEC responses are always enabled if signatures and other DNSSEC data are present. [GL #866]

    -
-
- -
-

-Feature Changes

-
    +

  • - When static and managed DNSSEC keys were both configured for the - same name, or when a static key was used to - configure a trust anchor for the root zone and - dnssec-validation was set to the default - value of auto, automatic RFC 5011 key - rollovers would be disabled. This combination of settings was - never intended to work, but there was no check for it in the - parser. This has been corrected, and it is now a fatal - configuration error. [GL #868] + DNSSEC Lookaside Validation (DLV) is now obsolete. + The dnssec-lookaside option has been + marked as deprecated; when used in named.conf, + it will generate a warning but will otherwise be ignored. + All code enabling the use of lookaside validation has been removed + from the validator, delv, and the DNSSEC tools. + [GL #7]

  • - DS and CDS records are now generated with SHA-256 digests - only, instead of both SHA-1 and SHA-256. This affects the - default output of dnssec-dsfromkey, the - dsset files generated by - dnssec-signzone, the DS records added to - a zone by dnssec-signzone based on - keyset files, the CDS records added to - a zone by named and - dnssec-signzone based on "sync" timing - parameters in key files, and the checks performed by - dnssec-checkds. + The cleaning-interval option has been + removed. [GL !1731]

-
-

-Bug Fixes

-
  • -

    - The allow-update and - allow-update-forwarding options were - inadvertently treated as configuration errors when used at the - options or view level. - This has now been corrected. - [GL #913] -

    -
-
-

License

- BIND is open source software licensed under the terms of the Mozilla + BIND 9 is open source software licensed under the terms of the Mozilla Public License, version 2.0 (see the LICENSE file for the full text).

@@ -795,23 +381,21 @@

Those wishing to discuss license compliance may contact ISC at - - https://www.isc.org/mission/contact/. + + https://www.isc.org/contact/.

End of Life

- BIND 9.15 is an unstable development branch. When its development - is complete, it will be renamed to BIND 9.16, which will be a - stable branch. + The end of life date for BIND 9.16 has not yet been determined. + At some point in the future BIND 9.16 will be designated as an + Extended Support Version (ESV). Until then, the current ESV is + BIND 9.11, which will be supported until at least December 2021.

- The end of life date for BIND 9.16 has not yet been determined. - For those needing long term support, the current Extended Support - Version (ESV) is BIND 9.11, which will be supported until at - least December 2021. See + See https://kb.isc.org/docs/aa-00896 for details of ISC's software support policy.

@@ -843,6 +427,6 @@
-

BIND 9.15.8 (Development Release)

+

BIND 9.16.0 (Stable Release)

diff --git a/doc/arm/Bv9ARM.ch09.html b/doc/arm/Bv9ARM.ch09.html index fae76fda897..990d3c7be01 100644 --- a/doc/arm/Bv9ARM.ch09.html +++ b/doc/arm/Bv9ARM.ch09.html @@ -148,6 +148,6 @@ -

BIND 9.15.8 (Development Release)

+

BIND 9.16.0 (Stable Release)

diff --git a/doc/arm/Bv9ARM.ch10.html b/doc/arm/Bv9ARM.ch10.html index f051b77ef7f..1668189b522 100644 --- a/doc/arm/Bv9ARM.ch10.html +++ b/doc/arm/Bv9ARM.ch10.html @@ -914,6 +914,6 @@ -

BIND 9.15.8 (Development Release)

+

BIND 9.16.0 (Stable Release)

diff --git a/doc/arm/Bv9ARM.ch11.html b/doc/arm/Bv9ARM.ch11.html index 246d2802546..26352568f39 100644 --- a/doc/arm/Bv9ARM.ch11.html +++ b/doc/arm/Bv9ARM.ch11.html @@ -538,6 +538,6 @@ $ sample-update -a sample-update -k Kxxx.+nnn+mm -

BIND 9.15.8 (Development Release)

+

BIND 9.16.0 (Stable Release)

diff --git a/doc/arm/Bv9ARM.ch12.html b/doc/arm/Bv9ARM.ch12.html index 9f149be6f39..ae3c55e11e5 100644 --- a/doc/arm/Bv9ARM.ch12.html +++ b/doc/arm/Bv9ARM.ch12.html @@ -210,6 +210,6 @@ -

BIND 9.15.8 (Development Release)

+

BIND 9.16.0 (Stable Release)

diff --git a/doc/arm/Bv9ARM.html b/doc/arm/Bv9ARM.html index 0e711a009d6..3e73af1c308 100644 --- a/doc/arm/Bv9ARM.html +++ b/doc/arm/Bv9ARM.html @@ -32,7 +32,7 @@

BIND 9 Administrator Reference Manual

-

BIND Version 9.15.8

+

BIND Version 9.16.0

Copyright © 2000-2020 Internet Systems Consortium, Inc. ("ISC")

@@ -196,8 +196,7 @@
trust-anchors Statement Definition and Usage
dnssec-policy Statement Grammar
-
dnssec-policy Statement Definition - and Usage
+
dnssec-policy Statement Definition and Usage
managed-keys Statement Grammar
managed-keys Statement Definition and Usage
@@ -248,21 +247,13 @@
A. Release Notes
-
Release Notes for BIND Version 9.15.8
+
Release Notes for BIND Version 9.16.0
Introduction
Note on Version Numbering
Supported Platforms
Download
-
Notes for BIND 9.15.8
-
Notes for BIND 9.15.7
-
Notes for BIND 9.15.6
-
Notes for BIND 9.15.5
-
Notes for BIND 9.15.4
-
Notes for BIND 9.15.3
-
Notes for BIND 9.15.2
-
Notes for BIND 9.15.1
-
Notes for BIND 9.15.0
+
Notes for BIND 9.16.0
License
End of Life
Thank You
@@ -450,6 +441,6 @@ -

BIND 9.15.8 (Development Release)

+

BIND 9.16.0 (Stable Release)

diff --git a/doc/arm/Bv9ARM.pdf b/doc/arm/Bv9ARM.pdf index 3b4696b46b7..9b353eab21a 100644 Binary files a/doc/arm/Bv9ARM.pdf and b/doc/arm/Bv9ARM.pdf differ diff --git a/doc/arm/man.arpaname.html b/doc/arm/man.arpaname.html index e1a7686eda8..d765e4a111d 100644 --- a/doc/arm/man.arpaname.html +++ b/doc/arm/man.arpaname.html @@ -90,6 +90,6 @@ -

BIND 9.15.8 (Development Release)

+

BIND 9.16.0 (Stable Release)

diff --git a/doc/arm/man.ddns-confgen.html b/doc/arm/man.ddns-confgen.html index 8107b2278d4..c46e6463801 100644 --- a/doc/arm/man.ddns-confgen.html +++ b/doc/arm/man.ddns-confgen.html @@ -220,6 +220,6 @@ -

BIND 9.15.8 (Development Release)

+

BIND 9.16.0 (Stable Release)

diff --git a/doc/arm/man.delv.html b/doc/arm/man.delv.html index fc64e3bfc77..3ad885bdeda 100644 --- a/doc/arm/man.delv.html +++ b/doc/arm/man.delv.html @@ -621,6 +621,6 @@ -

BIND 9.15.8 (Development Release)

+

BIND 9.16.0 (Stable Release)

diff --git a/doc/arm/man.dig.html b/doc/arm/man.dig.html index 818eb2cd25f..7deac065308 100644 --- a/doc/arm/man.dig.html +++ b/doc/arm/man.dig.html @@ -1188,6 +1188,6 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr -

BIND 9.15.8 (Development Release)

+

BIND 9.16.0 (Stable Release)

diff --git a/doc/arm/man.dnssec-cds.html b/doc/arm/man.dnssec-cds.html index a3102d46415..6f37b0e0415 100644 --- a/doc/arm/man.dnssec-cds.html +++ b/doc/arm/man.dnssec-cds.html @@ -376,6 +376,6 @@ nsupdate -l -

BIND 9.15.8 (Development Release)

+

BIND 9.16.0 (Stable Release)

diff --git a/doc/arm/man.dnssec-checkds.html b/doc/arm/man.dnssec-checkds.html index 790a8358f45..eff2e103d19 100644 --- a/doc/arm/man.dnssec-checkds.html +++ b/doc/arm/man.dnssec-checkds.html @@ -156,6 +156,6 @@ -

BIND 9.15.8 (Development Release)

+

BIND 9.16.0 (Stable Release)

diff --git a/doc/arm/man.dnssec-coverage.html b/doc/arm/man.dnssec-coverage.html index c3630df0c25..91d1d9bd317 100644 --- a/doc/arm/man.dnssec-coverage.html +++ b/doc/arm/man.dnssec-coverage.html @@ -270,6 +270,6 @@ -

BIND 9.15.8 (Development Release)

+

BIND 9.16.0 (Stable Release)

diff --git a/doc/arm/man.dnssec-dsfromkey.html b/doc/arm/man.dnssec-dsfromkey.html index 9bc4e682753..5f67328c1d7 100644 --- a/doc/arm/man.dnssec-dsfromkey.html +++ b/doc/arm/man.dnssec-dsfromkey.html @@ -341,6 +341,6 @@ -

BIND 9.15.8 (Development Release)

+

BIND 9.16.0 (Stable Release)

diff --git a/doc/arm/man.dnssec-importkey.html b/doc/arm/man.dnssec-importkey.html index 8032a5b947e..733e6211d3b 100644 --- a/doc/arm/man.dnssec-importkey.html +++ b/doc/arm/man.dnssec-importkey.html @@ -250,6 +250,6 @@ -

BIND 9.15.8 (Development Release)

+

BIND 9.16.0 (Stable Release)

diff --git a/doc/arm/man.dnssec-keyfromlabel.html b/doc/arm/man.dnssec-keyfromlabel.html index d91360639d4..c1ad7fdd998 100644 --- a/doc/arm/man.dnssec-keyfromlabel.html +++ b/doc/arm/man.dnssec-keyfromlabel.html @@ -164,9 +164,7 @@

When BIND 9 is built with OpenSSL-based PKCS#11 support, the label is an arbitrary string that - identifies a particular key. It may be preceded by an - optional OpenSSL engine name, followed by a colon, as in - "pkcs11:keylabel". + identifies a particular key.

When BIND 9 is built with native PKCS#11 @@ -498,6 +496,6 @@ -

BIND 9.15.8 (Development Release)

+

BIND 9.16.0 (Stable Release)

diff --git a/doc/arm/man.dnssec-keygen.html b/doc/arm/man.dnssec-keygen.html index ff37d79b2eb..169daf28cac 100644 --- a/doc/arm/man.dnssec-keygen.html +++ b/doc/arm/man.dnssec-keygen.html @@ -589,6 +589,6 @@ -

BIND 9.15.8 (Development Release)

+

BIND 9.16.0 (Stable Release)

diff --git a/doc/arm/man.dnssec-keymgr.html b/doc/arm/man.dnssec-keymgr.html index 7de50ebeca3..53c6f7ac53e 100644 --- a/doc/arm/man.dnssec-keymgr.html +++ b/doc/arm/man.dnssec-keymgr.html @@ -405,6 +405,6 @@ -

BIND 9.15.8 (Development Release)

+

BIND 9.16.0 (Stable Release)

diff --git a/doc/arm/man.dnssec-revoke.html b/doc/arm/man.dnssec-revoke.html index 50c42c13124..fdff4104d79 100644 --- a/doc/arm/man.dnssec-revoke.html +++ b/doc/arm/man.dnssec-revoke.html @@ -171,6 +171,6 @@ -

BIND 9.15.8 (Development Release)

+

BIND 9.16.0 (Stable Release)

diff --git a/doc/arm/man.dnssec-settime.html b/doc/arm/man.dnssec-settime.html index bf59816825e..624a1521d3a 100644 --- a/doc/arm/man.dnssec-settime.html +++ b/doc/arm/man.dnssec-settime.html @@ -424,6 +424,6 @@ -

BIND 9.15.8 (Development Release)

+

BIND 9.16.0 (Stable Release)

diff --git a/doc/arm/man.dnssec-signzone.html b/doc/arm/man.dnssec-signzone.html index de98d1c014a..e7f160f96fb 100644 --- a/doc/arm/man.dnssec-signzone.html +++ b/doc/arm/man.dnssec-signzone.html @@ -707,6 +707,6 @@ db.example.com.signed -

BIND 9.15.8 (Development Release)

+

BIND 9.16.0 (Stable Release)

diff --git a/doc/arm/man.dnssec-verify.html b/doc/arm/man.dnssec-verify.html index 94b14c5b0d9..a7650185c80 100644 --- a/doc/arm/man.dnssec-verify.html +++ b/doc/arm/man.dnssec-verify.html @@ -214,6 +214,6 @@ -

BIND 9.15.8 (Development Release)

+

BIND 9.16.0 (Stable Release)

diff --git a/doc/arm/man.dnstap-read.html b/doc/arm/man.dnstap-read.html index ea8ef602e86..979af409def 100644 --- a/doc/arm/man.dnstap-read.html +++ b/doc/arm/man.dnstap-read.html @@ -143,6 +143,6 @@ -

BIND 9.15.8 (Development Release)

+

BIND 9.16.0 (Stable Release)

diff --git a/doc/arm/man.filter-aaaa.html b/doc/arm/man.filter-aaaa.html index 7f45d696944..26e8b32c6e6 100644 --- a/doc/arm/man.filter-aaaa.html +++ b/doc/arm/man.filter-aaaa.html @@ -168,6 +168,6 @@ plugin query "/usr/local/lib/filter-aaaa.so" { -

BIND 9.15.8 (Development Release)

+

BIND 9.16.0 (Stable Release)

diff --git a/doc/arm/man.host.html b/doc/arm/man.host.html index 73491b8b20b..4613b4d0897 100644 --- a/doc/arm/man.host.html +++ b/doc/arm/man.host.html @@ -366,6 +366,6 @@ -

BIND 9.15.8 (Development Release)

+

BIND 9.16.0 (Stable Release)

diff --git a/doc/arm/man.mdig.html b/doc/arm/man.mdig.html index 1040938b77e..9f65af11422 100644 --- a/doc/arm/man.mdig.html +++ b/doc/arm/man.mdig.html @@ -610,6 +610,6 @@ -

BIND 9.15.8 (Development Release)

+

BIND 9.16.0 (Stable Release)

diff --git a/doc/arm/man.named-checkconf.html b/doc/arm/man.named-checkconf.html index 7509dafab0d..1ffbbbee3be 100644 --- a/doc/arm/man.named-checkconf.html +++ b/doc/arm/man.named-checkconf.html @@ -214,6 +214,6 @@ -

BIND 9.15.8 (Development Release)

+

BIND 9.16.0 (Stable Release)

diff --git a/doc/arm/man.named-checkzone.html b/doc/arm/man.named-checkzone.html index 2cf902c2584..4a89ef75675 100644 --- a/doc/arm/man.named-checkzone.html +++ b/doc/arm/man.named-checkzone.html @@ -463,6 +463,6 @@ -

BIND 9.15.8 (Development Release)

+

BIND 9.16.0 (Stable Release)

diff --git a/doc/arm/man.named-journalprint.html b/doc/arm/man.named-journalprint.html index 872bfec4bf9..1c07af9a0d1 100644 --- a/doc/arm/man.named-journalprint.html +++ b/doc/arm/man.named-journalprint.html @@ -117,6 +117,6 @@ -

BIND 9.15.8 (Development Release)

+

BIND 9.16.0 (Stable Release)

diff --git a/doc/arm/man.named-nzd2nzf.html b/doc/arm/man.named-nzd2nzf.html index 4df0cede03a..817d76587f6 100644 --- a/doc/arm/man.named-nzd2nzf.html +++ b/doc/arm/man.named-nzd2nzf.html @@ -119,6 +119,6 @@ -

BIND 9.15.8 (Development Release)

+

BIND 9.16.0 (Stable Release)

diff --git a/doc/arm/man.named-rrchecker.html b/doc/arm/man.named-rrchecker.html index ff81eeb398e..6e39091c2ae 100644 --- a/doc/arm/man.named-rrchecker.html +++ b/doc/arm/man.named-rrchecker.html @@ -121,6 +121,6 @@ -

BIND 9.15.8 (Development Release)

+

BIND 9.16.0 (Stable Release)

diff --git a/doc/arm/man.named.conf.html b/doc/arm/man.named.conf.html index 87d8545cfc6..18a20ed5bc4 100644 --- a/doc/arm/man.named.conf.html +++ b/doc/arm/man.named.conf.html @@ -110,7 +110,28 @@ dlz
-

DYNDB

+

DNSSEC-POLICY

+


+dnssec-policy string {
+ dnskey-ttl duration;
+ keys { ( csk | ksk | zsk ) [ ( key-directory ) ] lifetime
+     duration_or_unlimited algorithm string [ integer ]; ... };
+ max-zone-ttl duration;
+ parent-ds-ttl duration;
+ parent-propagation-delay duration;
+ parent-registration-delay duration;
+ publish-safety duration;
+ retire-safety duration;
+ signatures-refresh duration;
+ signatures-validity duration;
+ signatures-validity-dnskey duration;
+ zone-propagation-delay duration;
+};
+

+
+ +
+

DYNDB


dyndb string quoted_string {
    unspecified-text };
@@ -118,7 +139,7 @@ dyndb

-

KEY

+

KEY


key string {
algorithm string;
@@ -128,7 +149,7 @@ key

-

LOGGING

+

LOGGING


logging {
category string { string; ... };
@@ -149,8 +170,8 @@ logging

-

MANAGED-KEYS

-

Deprecated - see TRUST-ANCHORS.

+

MANAGED-KEYS

+

Deprecated - see DNSSEC-KEYS.


managed-keys { string ( static-key
    | initial-key | static-ds |
@@ -160,7 +181,7 @@ managed-keys

-

MASTERS

+

MASTERS


masters string [ port integer ] [ dscp
    integer ] { ( masters | ipv4_address [
@@ -170,7 +191,7 @@ masters

-

OPTIONS

+

OPTIONS


options {
allow-new-zones boolean;
@@ -250,6 +271,7 @@ options dnssec-dnskey-kskonly boolean;
dnssec-loadkeys-interval integer;
dnssec-must-be-secure string boolean;
+ dnssec-policy string;
dnssec-secure-to-insecure boolean;
dnssec-update-mode ( maintain | no-resign );
dnssec-validation ( yes | no | auto );
@@ -399,8 +421,8 @@ options     integer;
response-policy { zone string [ add-soa boolean ] [ log
    boolean ] [ max-policy-ttl duration ] [ min-update-interval
-     duration ] [ policy ( cname | disabled | drop | given | no-op |
-     nodata | nxdomain | passthru | tcp-only quoted_string ) ] [
+     duration ] [ policy ( cname | disabled | drop | given | no-op
+     | nodata | nxdomain | passthru | tcp-only quoted_string ) ] [
    recursive-only boolean ] [ nsip-enable boolean ] [
    nsdname-enable boolean ]; ... } [ add-soa boolean ] [
    break-dnssec boolean ] [ max-policy-ttl duration ] [
@@ -469,7 +491,7 @@ options

-

PLUGIN

+

PLUGIN


plugin ( query ) string [ { unspecified-text
    } ];
@@ -477,7 +499,7 @@ plugin

-

SERVER

+

SERVER


server netprefix {
bogus boolean;
@@ -515,7 +537,7 @@ server

-

STATISTICS-CHANNELS

+

STATISTICS-CHANNELS


statistics-channels {
inet ( ipv4_address | ipv6_address |
@@ -527,7 +549,7 @@ statistics-channels

-

TRUST-ANCHORS

+

TRUST-ANCHORS


trust-anchors { string ( static-key |
    initial-key | static-ds | initial-ds )
@@ -537,8 +559,8 @@ trust-anchors

-

TRUSTED-KEYS

-

Deprecated - see TRUST-ANCHORS.

+

TRUSTED-KEYS

+

Deprecated - see DNSSEC-KEYS.


trusted-keys { string integer
    integer integer
@@ -547,7 +569,7 @@ trusted-keys

-

VIEW

+

VIEW


view string [ class ] {
allow-new-zones boolean;
@@ -620,6 +642,7 @@ view dnssec-dnskey-kskonly boolean;
dnssec-loadkeys-interval integer;
dnssec-must-be-secure string boolean;
+ dnssec-policy string;
dnssec-secure-to-insecure boolean;
dnssec-update-mode ( maintain | no-resign );
dnssec-validation ( yes | no | auto );
@@ -743,8 +766,8 @@ view     integer;
response-policy { zone string [ add-soa boolean ] [ log
    boolean ] [ max-policy-ttl duration ] [ min-update-interval
-     duration ] [ policy ( cname | disabled | drop | given | no-op |
-     nodata | nxdomain | passthru | tcp-only quoted_string ) ] [
+     duration ] [ policy ( cname | disabled | drop | given | no-op
+     | nodata | nxdomain | passthru | tcp-only quoted_string ) ] [
    recursive-only boolean ] [ nsip-enable boolean ] [
    nsdname-enable boolean ]; ... } [ add-soa boolean ] [
    break-dnssec boolean ] [ max-policy-ttl duration ] [
@@ -926,7 +949,7 @@ view

-

ZONE

+

ZONE


zone string [ class ] {
allow-notify { address_match_element; ... };
@@ -1025,27 +1048,6 @@ zone

-
-

DNSSEC-POLICY

- -


-dnssec-policy string {
- dnskey-ttl duration;
- keys { ( csk | ksk | zsk ) key-directory lifetime duration algorithm integer [ integer ] ; ... };
- parent-ds-ttl duration;
- parent-propagation-delay duration;
- parent-registration-delay duration;
- publish-safety duration;
- retire-safety duration;
- signatures-refresh duration;
- signatures-validity duration;
- signatures-validity-dnskey duration;
- zone-max-ttl duration;
- zone-propagation-delay duration;
-};
-

-
-

FILES

@@ -1095,6 +1097,6 @@ dnssec-policy
-

BIND 9.15.8 (Development Release)

+

BIND 9.16.0 (Stable Release)

diff --git a/doc/arm/man.named.html b/doc/arm/man.named.html index 8d93d61dbec..8695b3b1e91 100644 --- a/doc/arm/man.named.html +++ b/doc/arm/man.named.html @@ -248,9 +248,9 @@

Allow named to use up to #max-socks sockets. - The default value is 4096 on systems built with default - configuration options, and 21000 on systems built with - "configure --with-tuning=large". + The default value is 21000 on systems built with default + configuration options, and 4096 on systems built with + "configure --with-tuning=small".

Warning

@@ -492,6 +492,6 @@
-

BIND 9.15.8 (Development Release)

+

BIND 9.16.0 (Stable Release)

diff --git a/doc/arm/man.nsec3hash.html b/doc/arm/man.nsec3hash.html index 1867fa4c9b9..4942ac04ae6 100644 --- a/doc/arm/man.nsec3hash.html +++ b/doc/arm/man.nsec3hash.html @@ -155,6 +155,6 @@
-

BIND 9.15.8 (Development Release)

+

BIND 9.16.0 (Stable Release)

diff --git a/doc/arm/man.nslookup.html b/doc/arm/man.nslookup.html index 9198dc8a96e..f5c78087dfc 100644 --- a/doc/arm/man.nslookup.html +++ b/doc/arm/man.nslookup.html @@ -247,17 +247,17 @@ nslookup -query=hinfo -timeout=10 The class specifies the protocol group of the information.

-

+

(Default = IN; abbreviation = cl)

[no]debug

- Turn on or off the display of the full response packet and - any intermediate response packets when searching. + Turn on or off the display of the full response packet and + any intermediate response packets when searching.

-

+

(Default = nodebug; abbreviation = [no]deb)

@@ -265,9 +265,9 @@ nslookup -query=hinfo -timeout=10

Turn debugging mode on or off. This displays more about - what nslookup is doing. + what nslookup is doing.

-

+

(Default = nod2)

@@ -285,7 +285,7 @@ nslookup -query=hinfo -timeout=10 names in the domain search list to the request until an answer is received.

-

+

(Default = search)

@@ -294,7 +294,7 @@ nslookup -query=hinfo -timeout=10

Change the default TCP/UDP name server port to value.

-

+

(Default = 53; abbreviation = po)

@@ -307,9 +307,15 @@ nslookup -query=hinfo -timeout=10

Change the type of the information query.

-

- (Default = A; abbreviations = q, ty) +

+ (Default = A and then AAAA; abbreviations = q, ty)

+

+ Note: It is + only possible to specify one query type, only + the default behavior looks up both when an + alternative is not specified. +

[no]recurse
@@ -318,16 +324,16 @@ nslookup -query=hinfo -timeout=10 have the information.

-

+

(Default = recurse; abbreviation = [no]rec)

ndots=number

- Set the number of dots (label separators) in a domain - that will disable searching. Absolute names always - stop searching. + Set the number of dots (label separators) in a domain + that will disable searching. Absolute names always + stop searching.

retry=number
@@ -349,21 +355,21 @@ nslookup -query=hinfo -timeout=10 Always use a virtual circuit when sending requests to the server.

-

+

(Default = novc)

[no]fail

- Try the next nameserver if a nameserver responds with - SERVFAIL or a referral (nofail) or terminate query - (fail) on such a response. -

-

+ Try the next nameserver if a nameserver responds with + SERVFAIL or a referral (nofail) or terminate query + (fail) on such a response. +

+

(Default = nofail)

-
+

@@ -437,6 +443,6 @@ nslookup -query=hinfo -timeout=10 -

BIND 9.15.8 (Development Release)

+

BIND 9.16.0 (Stable Release)

diff --git a/doc/arm/man.nsupdate.html b/doc/arm/man.nsupdate.html index 47286decea5..f0086f9754b 100644 --- a/doc/arm/man.nsupdate.html +++ b/doc/arm/man.nsupdate.html @@ -818,6 +818,6 @@ -

BIND 9.15.8 (Development Release)

+

BIND 9.16.0 (Stable Release)

diff --git a/doc/arm/man.pkcs11-destroy.html b/doc/arm/man.pkcs11-destroy.html index 4692da072a9..6ef4c010dae 100644 --- a/doc/arm/man.pkcs11-destroy.html +++ b/doc/arm/man.pkcs11-destroy.html @@ -162,6 +162,6 @@ -

BIND 9.15.8 (Development Release)

+

BIND 9.16.0 (Stable Release)

diff --git a/doc/arm/man.pkcs11-keygen.html b/doc/arm/man.pkcs11-keygen.html index cf25b69a0c7..1b1f264855c 100644 --- a/doc/arm/man.pkcs11-keygen.html +++ b/doc/arm/man.pkcs11-keygen.html @@ -200,6 +200,6 @@ -

BIND 9.15.8 (Development Release)

+

BIND 9.16.0 (Stable Release)

diff --git a/doc/arm/man.pkcs11-list.html b/doc/arm/man.pkcs11-list.html index 7fe5a926d66..353bc889f5e 100644 --- a/doc/arm/man.pkcs11-list.html +++ b/doc/arm/man.pkcs11-list.html @@ -158,6 +158,6 @@ -

BIND 9.15.8 (Development Release)

+

BIND 9.16.0 (Stable Release)

diff --git a/doc/arm/man.pkcs11-tokens.html b/doc/arm/man.pkcs11-tokens.html index f93ef07dfdc..de9b044d54c 100644 --- a/doc/arm/man.pkcs11-tokens.html +++ b/doc/arm/man.pkcs11-tokens.html @@ -123,6 +123,6 @@ -

BIND 9.15.8 (Development Release)

+

BIND 9.16.0 (Stable Release)

diff --git a/doc/arm/man.rndc-confgen.html b/doc/arm/man.rndc-confgen.html index 43afde1fa50..3521e817c2c 100644 --- a/doc/arm/man.rndc-confgen.html +++ b/doc/arm/man.rndc-confgen.html @@ -260,6 +260,6 @@ -

BIND 9.15.8 (Development Release)

+

BIND 9.16.0 (Stable Release)

diff --git a/doc/arm/man.rndc.conf.html b/doc/arm/man.rndc.conf.html index 435246df02a..4b6b2b1001e 100644 --- a/doc/arm/man.rndc.conf.html +++ b/doc/arm/man.rndc.conf.html @@ -268,6 +268,6 @@ -

BIND 9.15.8 (Development Release)

+

BIND 9.16.0 (Stable Release)

diff --git a/doc/arm/man.rndc.html b/doc/arm/man.rndc.html index 843b7b7a78c..29ad733a620 100644 --- a/doc/arm/man.rndc.html +++ b/doc/arm/man.rndc.html @@ -1021,6 +1021,6 @@ -

BIND 9.15.8 (Development Release)

+

BIND 9.16.0 (Stable Release)

diff --git a/doc/arm/notes.html b/doc/arm/notes.html index e83d7b451a8..7f46f371be8 100644 --- a/doc/arm/notes.html +++ b/doc/arm/notes.html @@ -15,38 +15,30 @@

-Release Notes for BIND Version 9.15.8

+Release Notes for BIND Version 9.16.0

Introduction

- BIND 9.15 is an unstable development release of BIND. - This document summarizes new features and functional changes that - have been introduced on this branch. With each development release - leading up to the stable BIND 9.16 release, this document will be - updated with additional features added and bugs fixed. + BIND 9.16 is a stable branch of BIND. + This document summarizes significant changes since the last + production release on that branch. +

+

+ Please see the file CHANGES for a more + detailed list of changes and bug fixes.

Note on Version Numbering

- Until BIND 9.12, new feature development releases were tagged - as "alpha" and "beta", leading up to the first stable release - for a given development branch, which always ended in ".0". - More recently, BIND adopted the "odd-unstable/even-stable" - release numbering convention. There will be no "alpha" or "beta" - releases in the 9.15 branch, only increasing version numbers. - So, for example, what would previously have been called 9.15.0a1, - 9.15.0a2, 9.15.0b1, and so on, will instead be called 9.15.0, - 9.15.1, 9.15.2, etc. -

-

- The first stable release from this development branch will be - renamed as 9.16.0. Thereafter, maintenance releases will continue - on the 9.16 branch, while unstable feature development proceeds in - 9.17. + As of BIND 9.13/9.14, BIND has adopted the "odd-unstable/even-stable" + release numbering convention. BIND 9.16 contains new features added + during the BIND 9.15 development process. Henceforth, the 9.16 branch + will be limited to bug fixes and new feature development will proceed + in the unstable 9.17 branch.

@@ -89,116 +81,16 @@

-Notes for BIND 9.15.8

- -
-

-Feature Changes

-
  • -

    - The trust-anchors statement no longer rejects - a mix of both key-style and DS-style trust anchor entries for the - same name. [GL #1237] -

    -
-
- -
-

-Bug Fixes

-
    -
  • -

    - Fixed an intermittent crash in the validator that could occur - when validating negative answers from the cache. [GL #1561] -

    -
    • -
  • -

    - Fixed a bug that could cause named to crash on - machines with more than 40 CPUs. [GL #1493] -

    -
    • -
  • -

    - Socket-related statistics counters were not being updated by - network manager sockets, but are now fully functional. [GL #1311] -

    -
    • -
-
- -
-
-

-Notes for BIND 9.15.7

- -
-

-Feature Changes

-
    -
  • -

    - The dnssec-keys configuration statement, - which was introduced in 9.15.1 and revised in 9.15.6, has now - been renamed to the more descriptive - trust-anchors. [GL !2702] -

    -

    - (See release notes for - BIND 9.15.1 - and - BIND 9.15.6 - for prior discussion of this feature.) -

    -
    • -
  • -

    - Added support for multithreaded listening for TCP connections - in the network manager. [GL !2659] -

    -
    • -
-
- -
-

-Bug Fixes

-
    -
  • -

    - Fixed a bug that caused named to leak memory - on reconfiguration when any GeoIP2 database was in use. [GL #1445] -

    -
    • -
  • -

    - Fixed several possible race conditions discovered by - ThreadSanitizer. -

    -
    • -
-
- -
-
-

-Notes for BIND 9.15.6

+Notes for BIND 9.16.0
-
-

-Security Fixes

-
  • -

    - Set a limit on the number of concurrently served pipelined TCP - queries. This flaw is disclosed in CVE-2019-6477. [GL #1264] -

    -
-
+

+ Note: this section only lists changes from BIND 9.14 (the + previous stable branch of BIND). +

-New Features

+New Features

  • @@ -213,17 +105,39 @@

  • The new dnssec-policy option allows the - configuration key and signing policy (KASP) for zones. This + configuration of a key and signing policy (KASP) for zones. This option enables named to generate new keys as needed and automatically roll both ZSK and KSK keys. (Note that the syntax for this statement differs from the DNSSEC policy used by dnssec-keymgr.) [GL #1134]

    • +
  • +

    + In order to clarify the configuration of DNSSEC keys, + the trusted-keys and + managed-keys statements have been + deprecated, and the new trust-anchors + statement should now be used for both types of key. +

    +

    + When used with the keyword initial-key, + trust-anchors has the same behavior as + managed-keys, i.e., it configures + a trust anchor that is to be maintained via RFC 5011. +

    +

    + When used with the new keyword static-key, + trust-anchors has the same behavior as + trusted-keys, i.e., it configures a permanent + trust anchor that will not automatically be updated. (This usage + is not recommended for the root key.) [GL #6] +

    +

  • Two new keywords have been added to the - dnssec-keys statement: + trust-anchors statement: initial-ds and static-ds. These allow the use of trust anchors in DS format instead of DNSKEY format. DS format allows trust anchors to be configured @@ -235,159 +149,93 @@ static-key keywords, initial-ds configures a dynamic trust anchor to be maintained via RFC 5011, and static-ds configures a permanent trust anchor. -

    -

    - (Note: Currently, DNSKEY-format and DS-format trust anchors - cannot both be used for the same domain name.) [GL #6] [GL #622] + [GL #6] [GL #622]

  • - Added a new statistics variable tcp-highwater - that reports the maximum number of simultaneous TCP clients BIND - has handled while running. [GL #1206] -

    -
    • -
- - -
-

-Feature Changes

-
    -
  • -

    - NSEC Aggressive Cache (synth-from-dnssec) has been disabled by default - because it was found to have a significant performance impact on the - recursive service. The NSEC Aggressive Cache will be enable by default - in the future releases. [GL #1265] + dig, mdig and + delv can all now take a +yaml + option to print output in a detailed YAML format. [GL #1145]

  • - The DNSSEC validation code has been refactored for clarity and to - reduce code duplication. [GL #622] + dig now has a new command line option: + +[no]unexpected. By default, dig + won't accept a reply from a source other than the one to which + it sent the query. Add the +unexpected argument + to enable it to process replies from unexpected sources. [RT #44978]

    • -
-
- - -
-

-Notes for BIND 9.15.5

- -
-

-Security Fixes

-

  • - named could crash with an assertion failure - if a forwarder returned a referral, rather than resolving the - query, when QNAME minimization was enabled. This flaw is - disclosed in CVE-2019-6476. [GL #1051] + dig now accepts a new command line option, + +[no]expandaaaa, which causes the IPv6 + addresses in AAAA records to be printed in full 128-bit + notation rather than the default RFC 5952 format. [GL #765]

  • - A flaw in DNSSEC verification when transferring mirror zones - could allow data to be incorrectly marked valid. This flaw - is disclosed in CVE-2019-6475. [GL #1252] + Statistics channel groups can now be toggled. [GL #1030]

-
-
-

-Notes for BIND 9.15.4

-

-New Features

+Feature Changes

  • - Added a new command line option to dig: - +[no]unexpected. By default, dig - won't accept a reply from a source other than the one to which - it sent the query. Add the +unexpected argument - to enable it to process replies from unexpected sources. + When static and managed DNSSEC keys were both configured for the + same name, or when a static key was used to + configure a trust anchor for the root zone and + dnssec-validation was set to the default + value of auto, automatic RFC 5011 key + rollovers would be disabled. This combination of settings was + never intended to work, but there was no check for it in the + parser. This has been corrected, and it is now a fatal + configuration error. [GL #868]

  • - dig, mdig and - delv can all now take a +yaml - option to print output in a a detailed YAML format. [RT #1145] + DS and CDS records are now generated with SHA-256 digests + only, instead of both SHA-1 and SHA-256. This affects the + default output of dnssec-dsfromkey, the + dsset files generated by + dnssec-signzone, the DS records added to + a zone by dnssec-signzone based on + keyset files, the CDS records added to + a zone by named and + dnssec-signzone based on "sync" timing + parameters in key files, and the checks performed by + dnssec-checkds. [GL #1015]

    • -
- - -
-

-Bug Fixes

-
  • -

    - When a response-policy zone expires, ensure - that its policies are removed from the RPZ summary database. - [GL #1146] -

    -
-
- - -
-

-Notes for BIND 9.15.3

- -
-

-New Features

-
  • -

    - Statistics channel groups are now toggleable. [GL #1030] -

    -
-
- -
-

-Removed Features

-
  • +

  • - DNSSEC Lookaside Validation (DLV) is now obsolete. - The dnssec-lookaside option has been - marked as deprecated; when used in named.conf, - it will generate a warning but will otherwise be ignored. - All code enabling the use of lookaside validation has been removed - from the validator, delv, and the DNSSEC tools. - [GL #7] + named will now log a warning if + a static key is configured for the root zone. [GL #6]

    -
-
- -
-

-Feature Changes

-
    +

  • A SipHash 2-4 based DNS Cookie (RFC 7873) algorithm has been added and made default. Old non-default HMAC-SHA based DNS Cookie algorithms have been removed, and only the default AES algorithm is being kept - for legacy reasons. This change doesn't have any operational impact - in most common scenarios. [GL #605] + for legacy reasons. This change has no operational impact in most + common scenarios. [GL #605]

    - If you are running multiple DNS Servers (different versions of BIND 9 - or DNS server from multiple vendors) responding from the same IP - address (anycast or load-balancing scenarios), you'll have to make - sure that all the servers are configured with the same DNS Cookie - algorithm and same Server Secret for the best performance. + If you are running multiple DNS servers (different versions of BIND 9 + or DNS servers from multiple vendors) responding from the same IP + address (anycast or load-balancing scenarios), make sure that all the + servers are configured with the same DNS Cookie algorithm and same + Server Secret for the best performance.

  • @@ -396,135 +244,39 @@ dnssec-verify commands is now printed to standard output. The standard error output is only used to print warnings and errors, and in case the user requests the signed zone to be printed to - standard output with -f - option. A new + standard output with the -f - option. A new configuration option -q has been added to silence all output on standard output except for the name of the signed zone. + [GL #1151]

  • - DS records included in DNS referral messages can now be validated - and cached immediately, reducing the number of queries needed for - a DNSSEC validation. [GL #964] -

    -
    • -
-
- -
-

-Bug Fixes

-
    -
  • -

    - Cache database statistics counters could report invalid values - when stale answers were enabled, because of a bug in counter - maintenance when cache data becomes stale. The statistics counters - have been corrected to report the number of RRsets for each - RR type that are active, stale but still potentially served, - or stale and marked for deletion. [GL #602] -

    -
    • -
  • -

    - Interaction between DNS64 and RPZ No Data rule (CNAME *.) could - cause unexpected results; this has been fixed. [GL #1106] -

    -
    • -
  • -

    - named-checkconf now checks DNS64 prefixes - to ensure bits 64-71 are zero. [GL #1159] -

    -
    • -
  • -

    - named-checkconf now correctly reports a missing - dnstap-output option when - dnstap is set. [GL #1136] -

    -
    • -
  • -

    - Handle ETIMEDOUT error on connect() with a non-blocking - socket. [GL #1133] -

    -
    • -
  • -

    - dig now correctly expands the IPv6 address - when run with +expandaaaa +short. [GL #1152] -

    -
    • -
-
- -
-
-

-Notes for BIND 9.15.2

- -
-

-New Features

-
    -
  • -

    - The GeoIP2 API from MaxMind is now supported. Geolocation support - will be compiled in by default if the libmaxminddb - library is found at compile time, but can be turned off by using - configure --disable-geoip. -

    -

    - The default path to the GeoIP2 databases will be set based - on the location of the libmaxminddb library; - for example, if it is in /usr/local/lib, - then the default path will be - /usr/local/share/GeoIP. - This value can be overridden in named.conf - using the geoip-directory option. -

    -

    - Some geoip ACL settings that were available with - legacy GeoIP, including searches for netspeed, - org, and three-letter ISO country codes, will - no longer work when using GeoIP2. Supported GeoIP2 database - types are country, city, - domain, isp, and - as. All of these databases support both IPv4 - and IPv6 lookups. [GL #182] [GL #1112] + The DNSSEC validation code has been refactored for clarity and to + reduce code duplication. [GL #622]

  • - Two new metrics have been added to the - statistics-channel to report DNSSEC - signing operations. For each key in each zone, the - dnssec-sign counter indicates the total - number of signatures named has generated - using that key since server startup, and the - dnssec-refresh counter indicates how - many of those signatures were refreshed during zone - maintenance, as opposed to having been generated - as a result of a zone update. [GL #513] + Compile-time settings enabled by the + --with-tuning=large option for + configure are now in effect by default. + Previously used default compile-time settings can be enabled + by passing --with-tuning=small to + configure. [GL !2989]

    • -
-
- -
-

-Bug Fixes

-

  • - When qname-minimization was set to - relaxed, some improperly configured domains - would fail to resolve, but would have succeeded when minimization - was disabled. named will now fall back to normal - resolution in such cases, and also uses type A rather than NS for - minimal queries in order to reduce the likelihood of encountering - the problem. [GL #1055] + JSON-C is now the only supported library for enabling JSON + support for BIND statistics. The configure + option has been renamed from --with-libjson + to --with-json-c. Set the + PKG_CONFIG_PATH environment variable + accordingly to specify a custom path to the + json-c library, as the new + configure option does not take the library + installation path as an optional argument. [GL #855]

  • @@ -535,208 +287,50 @@ when --prefix is not specified and the aforementioned options are not specified explicitly. Instead, Autoconf's defaults of $prefix/etc and - $prefix/var are respected. -

    -
    • -
  • -

    - Glue address records were not being returned in responses - to root priming queries; this has been corrected. [GL #1092] -

    -
    • -
-
- -
-
-

-Notes for BIND 9.15.1

- -
-

-Security Fixes

-
  • -

    - A race condition could trigger an assertion failure when - a large number of incoming packets were being rejected. - This flaw is disclosed in CVE-2019-6471. [GL #942] -

    -
-
- -
-

-New Features

-
  • -

    - In order to clarify the configuration of DNSSEC keys, - the trusted-keys and - managed-keys statements have been - deprecated, and the new dnssec-keys - statement should now be used for both types of key. -

    -

    - When used with the keyword initial-key, - dnssec-keys has the same behavior as - managed-keys, i.e., it configures - a trust anchor that is to be maintained via RFC 5011. -

    -

    - When used with the new keyword static-key, it - has the same behavior as trusted-keys, - configuring a permanent trust anchor that will not automatically - be updated. (This usage is not recommended for the root key.) - [GL #6] -

    -
-
- -
-

-Removed Features

-
  • -

    - The cleaning-interval option has been - removed. [GL !1731] -

    -
-
- -
-

-Feature Changes

-
    -
  • -

    - named will now log a warning if - a static key is configured for the root zone. [GL #6] -

    -
    • -
  • -

    - JSON-C is now the only supported library for enabling JSON - support for BIND statistics. The configure - option has been renamed from --with-libjson - to --with-json-c. Use - PKG_CONFIG_PATH to specify a custom path to - the json-c library as the new - configure option does not take the library - installation path as an optional argument. + $prefix/var are respected. [GL #658]

-
-
-

-Notes for BIND 9.15.0

-

-Security Fixes

+Removed Features
  • -

    - In certain configurations, named could crash - with an assertion failure if nxdomain-redirect - was in use and a redirected query resulted in an NXDOMAIN from the - cache. This flaw is disclosed in CVE-2019-6467. [GL #880] -

    -
    • -
  • -

    - The TCP client quota set using the tcp-clients - option could be exceeded in some cases. This could lead to - exhaustion of file descriptors. This flaw is disclosed in - CVE-2018-5743. [GL #615] -

    -
    • -
- - -
-

-New Features

-
  • -

    - The new add-soa option specifies whether - or not the response-policy zone's SOA record - should be included in the additional section of RPZ responses. - [GL #865] -

    -
-
- -
-

-Removed Features

-

  • The dnssec-enable option has been obsoleted and no longer has any effect. DNSSEC responses are always enabled if signatures and other DNSSEC data are present. [GL #866]

    -
-
- -
-

-Feature Changes

-
    +

  • - When static and managed DNSSEC keys were both configured for the - same name, or when a static key was used to - configure a trust anchor for the root zone and - dnssec-validation was set to the default - value of auto, automatic RFC 5011 key - rollovers would be disabled. This combination of settings was - never intended to work, but there was no check for it in the - parser. This has been corrected, and it is now a fatal - configuration error. [GL #868] + DNSSEC Lookaside Validation (DLV) is now obsolete. + The dnssec-lookaside option has been + marked as deprecated; when used in named.conf, + it will generate a warning but will otherwise be ignored. + All code enabling the use of lookaside validation has been removed + from the validator, delv, and the DNSSEC tools. + [GL #7]

  • - DS and CDS records are now generated with SHA-256 digests - only, instead of both SHA-1 and SHA-256. This affects the - default output of dnssec-dsfromkey, the - dsset files generated by - dnssec-signzone, the DS records added to - a zone by dnssec-signzone based on - keyset files, the CDS records added to - a zone by named and - dnssec-signzone based on "sync" timing - parameters in key files, and the checks performed by - dnssec-checkds. + The cleaning-interval option has been + removed. [GL !1731]

-
-

-Bug Fixes

-
  • -

    - The allow-update and - allow-update-forwarding options were - inadvertently treated as configuration errors when used at the - options or view level. - This has now been corrected. - [GL #913] -

    -
-
-

License

- BIND is open source software licensed under the terms of the Mozilla + BIND 9 is open source software licensed under the terms of the Mozilla Public License, version 2.0 (see the LICENSE file for the full text).

@@ -751,23 +345,21 @@

Those wishing to discuss license compliance may contact ISC at - - https://www.isc.org/mission/contact/. + + https://www.isc.org/contact/.

End of Life

- BIND 9.15 is an unstable development branch. When its development - is complete, it will be renamed to BIND 9.16, which will be a - stable branch. + The end of life date for BIND 9.16 has not yet been determined. + At some point in the future BIND 9.16 will be designated as an + Extended Support Version (ESV). Until then, the current ESV is + BIND 9.11, which will be supported until at least December 2021.

- The end of life date for BIND 9.16 has not yet been determined. - For those needing long term support, the current Extended Support - Version (ESV) is BIND 9.11, which will be supported until at - least December 2021. See + See https://kb.isc.org/docs/aa-00896 for details of ISC's software support policy.

diff --git a/doc/arm/notes.pdf b/doc/arm/notes.pdf index 23858db15fe..3d974d46020 100644 Binary files a/doc/arm/notes.pdf and b/doc/arm/notes.pdf differ diff --git a/doc/arm/notes.txt b/doc/arm/notes.txt index f8c00f3a7e4..647f9843227 100644 --- a/doc/arm/notes.txt +++ b/doc/arm/notes.txt @@ -1,27 +1,20 @@ -Release Notes for BIND Version 9.15.8 +Release Notes for BIND Version 9.16.0 Introduction -BIND 9.15 is an unstable development release of BIND. This document -summarizes new features and functional changes that have been introduced -on this branch. With each development release leading up to the stable -BIND 9.16 release, this document will be updated with additional features -added and bugs fixed. +BIND 9.16 is a stable branch of BIND. This document summarizes significant +changes since the last production release on that branch. -Note on Version Numbering +Please see the file CHANGES for a more detailed list of changes and bug +fixes. -Until BIND 9.12, new feature development releases were tagged as "alpha" -and "beta", leading up to the first stable release for a given development -branch, which always ended in ".0". More recently, BIND adopted the -"odd-unstable/even-stable" release numbering convention. There will be no -"alpha" or "beta" releases in the 9.15 branch, only increasing version -numbers. So, for example, what would previously have been called 9.15.0a1, -9.15.0a2, 9.15.0b1, and so on, will instead be called 9.15.0, 9.15.1, -9.15.2, etc. +Note on Version Numbering -The first stable release from this development branch will be renamed as -9.16.0. Thereafter, maintenance releases will continue on the 9.16 branch, -while unstable feature development proceeds in 9.17. +As of BIND 9.13/9.14, BIND has adopted the "odd-unstable/even-stable" +release numbering convention. BIND 9.16 contains new features added during +the BIND 9.15 development process. Henceforth, the 9.16 branch will be +limited to bug fixes and new feature development will proceed in the +unstable 9.17 branch. Supported Platforms @@ -48,51 +41,10 @@ www.isc.org/download/. There you will find additional information about each release, source code, and pre-compiled versions for Microsoft Windows operating systems. -Notes for BIND 9.15.8 - -Feature Changes - - * The trust-anchors statement no longer rejects a mix of both key-style - and DS-style trust anchor entries for the same name. [GL #1237] - -Bug Fixes - - * Fixed an intermittent crash in the validator that could occur when - validating negative answers from the cache. [GL #1561] - - * Fixed a bug that could cause named to crash on machines with more than - 40 CPUs. [GL #1493] - - * Socket-related statistics counters were not being updated by network - manager sockets, but are now fully functional. [GL #1311] - -Notes for BIND 9.15.7 - -Feature Changes - - * The dnssec-keys configuration statement, which was introduced in - 9.15.1 and revised in 9.15.6, has now been renamed to the more - descriptive trust-anchors. [GL !2702] - - (See release notes for BIND 9.15.1 and BIND 9.15.6 for prior - discussion of this feature.) - - * Added support for multithreaded listening for TCP connections in the - network manager. [GL !2659] - -Bug Fixes - - * Fixed a bug that caused named to leak memory on reconfiguration when - any GeoIP2 database was in use. [GL #1445] - - * Fixed several possible race conditions discovered by ThreadSanitizer. +Notes for BIND 9.16.0 -Notes for BIND 9.15.6 - -Security Fixes - - * Set a limit on the number of concurrently served pipelined TCP - queries. This flaw is disclosed in CVE-2019-6477. [GL #1264] +Note: this section only lists changes from BIND 9.14 (the previous stable +branch of BIND). New Features @@ -102,13 +54,26 @@ New Features implement new protocol layers (for example, DNS over TLS) in the future. [GL #29] - * The new dnssec-policy option allows the configuration key and signing - policy (KASP) for zones. This option enables named to generate new - keys as needed and automatically roll both ZSK and KSK keys. (Note + * The new dnssec-policy option allows the configuration of a key and + signing policy (KASP) for zones. This option enables named to generate + new keys as needed and automatically roll both ZSK and KSK keys. (Note that the syntax for this statement differs from the DNSSEC policy used by dnssec-keymgr.) [GL #1134] - * Two new keywords have been added to the dnssec-keys statement: + * In order to clarify the configuration of DNSSEC keys, the trusted-keys + and managed-keys statements have been deprecated, and the new + trust-anchors statement should now be used for both types of key. + + When used with the keyword initial-key, trust-anchors has the same + behavior as managed-keys, i.e., it configures a trust anchor that is + to be maintained via RFC 5011. + + When used with the new keyword static-key, trust-anchors has the same + behavior as trusted-keys, i.e., it configures a permanent trust anchor + that will not automatically be updated. (This usage is not recommended + for the root key.) [GL #6] + + * Two new keywords have been added to the trust-anchors statement: initial-ds and static-ds. These allow the use of trust anchors in DS format instead of DNSKEY format. DS format allows trust anchors to be configured for keys that have not yet been published; this is the @@ -116,219 +81,81 @@ New Features As with the initial-key and static-key keywords, initial-ds configures a dynamic trust anchor to be maintained via RFC 5011, and static-ds - configures a permanent trust anchor. - - (Note: Currently, DNSKEY-format and DS-format trust anchors cannot - both be used for the same domain name.) [GL #6] [GL #622] - - * Added a new statistics variable tcp-highwater that reports the maximum - number of simultaneous TCP clients BIND has handled while running. [GL - #1206] - -Feature Changes - - * NSEC Aggressive Cache (synth-from-dnssec) has been disabled by default - because it was found to have a significant performance impact on the - recursive service. The NSEC Aggressive Cache will be enable by default - in the future releases. [GL #1265] - - * The DNSSEC validation code has been refactored for clarity and to - reduce code duplication. [GL #622] + configures a permanent trust anchor. [GL #6] [GL #622] -Notes for BIND 9.15.5 - -Security Fixes - - * named could crash with an assertion failure if a forwarder returned a - referral, rather than resolving the query, when QNAME minimization was - enabled. This flaw is disclosed in CVE-2019-6476. [GL #1051] - - * A flaw in DNSSEC verification when transferring mirror zones could - allow data to be incorrectly marked valid. This flaw is disclosed in - CVE-2019-6475. [GL #1252] - -Notes for BIND 9.15.4 - -New Features + * dig, mdig and delv can all now take a +yaml option to print output in + a detailed YAML format. [GL #1145] - * Added a new command line option to dig: +[no]unexpected. By default, + * dig now has a new command line option: +[no]unexpected. By default, dig won't accept a reply from a source other than the one to which it sent the query. Add the +unexpected argument to enable it to process - replies from unexpected sources. - - * dig, mdig and delv can all now take a +yaml option to print output in - a a detailed YAML format. [RT #1145] + replies from unexpected sources. [RT #44978] -Bug Fixes + * dig now accepts a new command line option, +[no]expandaaaa, which + causes the IPv6 addresses in AAAA records to be printed in full + 128-bit notation rather than the default RFC 5952 format. [GL #765] - * When a response-policy zone expires, ensure that its policies are - removed from the RPZ summary database. [GL #1146] + * Statistics channel groups can now be toggled. [GL #1030] -Notes for BIND 9.15.3 - -New Features - - * Statistics channel groups are now toggleable. [GL #1030] +Feature Changes -Removed Features + * When static and managed DNSSEC keys were both configured for the same + name, or when a static key was used to configure a trust anchor for + the root zone and dnssec-validation was set to the default value of + auto, automatic RFC 5011 key rollovers would be disabled. This + combination of settings was never intended to work, but there was no + check for it in the parser. This has been corrected, and it is now a + fatal configuration error. [GL #868] - * DNSSEC Lookaside Validation (DLV) is now obsolete. The - dnssec-lookaside option has been marked as deprecated; when used in - named.conf, it will generate a warning but will otherwise be ignored. - All code enabling the use of lookaside validation has been removed - from the validator, delv, and the DNSSEC tools. [GL #7] + * DS and CDS records are now generated with SHA-256 digests only, + instead of both SHA-1 and SHA-256. This affects the default output of + dnssec-dsfromkey, the dsset files generated by dnssec-signzone, the DS + records added to a zone by dnssec-signzone based on keyset files, the + CDS records added to a zone by named and dnssec-signzone based on + "sync" timing parameters in key files, and the checks performed by + dnssec-checkds. [GL #1015] -Feature Changes + * named will now log a warning if a static key is configured for the + root zone. [GL #6] * A SipHash 2-4 based DNS Cookie (RFC 7873) algorithm has been added and made default. Old non-default HMAC-SHA based DNS Cookie algorithms have been removed, and only the default AES algorithm is being kept - for legacy reasons. This change doesn't have any operational impact in - most common scenarios. [GL #605] + for legacy reasons. This change has no operational impact in most + common scenarios. [GL #605] - If you are running multiple DNS Servers (different versions of BIND 9 - or DNS server from multiple vendors) responding from the same IP - address (anycast or load-balancing scenarios), you'll have to make - sure that all the servers are configured with the same DNS Cookie - algorithm and same Server Secret for the best performance. + If you are running multiple DNS servers (different versions of BIND 9 + or DNS servers from multiple vendors) responding from the same IP + address (anycast or load-balancing scenarios), make sure that all the + servers are configured with the same DNS Cookie algorithm and same + Server Secret for the best performance. * The information from the dnssec-signzone and dnssec-verify commands is now printed to standard output. The standard error output is only used to print warnings and errors, and in case the user requests the signed - zone to be printed to standard output with -f - option. A new + zone to be printed to standard output with the -f - option. A new configuration option -q has been added to silence all output on - standard output except for the name of the signed zone. - - * DS records included in DNS referral messages can now be validated and - cached immediately, reducing the number of queries needed for a DNSSEC - validation. [GL #964] - -Bug Fixes - - * Cache database statistics counters could report invalid values when - stale answers were enabled, because of a bug in counter maintenance - when cache data becomes stale. The statistics counters have been - corrected to report the number of RRsets for each RR type that are - active, stale but still potentially served, or stale and marked for - deletion. [GL #602] - - * Interaction between DNS64 and RPZ No Data rule (CNAME *.) could cause - unexpected results; this has been fixed. [GL #1106] - - * named-checkconf now checks DNS64 prefixes to ensure bits 64-71 are - zero. [GL #1159] - - * named-checkconf now correctly reports a missing dnstap-output option - when dnstap is set. [GL #1136] - - * Handle ETIMEDOUT error on connect() with a non-blocking socket. [GL # - 1133] - - * dig now correctly expands the IPv6 address when run with +expandaaaa - +short. [GL #1152] + standard output except for the name of the signed zone. [GL #1151] -Notes for BIND 9.15.2 + * The DNSSEC validation code has been refactored for clarity and to + reduce code duplication. [GL #622] -New Features + * Compile-time settings enabled by the --with-tuning=large option for + configure are now in effect by default. Previously used default + compile-time settings can be enabled by passing --with-tuning=small to + configure. [GL !2989] - * The GeoIP2 API from MaxMind is now supported. Geolocation support will - be compiled in by default if the libmaxminddb library is found at - compile time, but can be turned off by using configure --disable-geoip - . - - The default path to the GeoIP2 databases will be set based on the - location of the libmaxminddb library; for example, if it is in /usr/ - local/lib, then the default path will be /usr/local/share/GeoIP. This - value can be overridden in named.conf using the geoip-directory - option. - - Some geoip ACL settings that were available with legacy GeoIP, - including searches for netspeed, org, and three-letter ISO country - codes, will no longer work when using GeoIP2. Supported GeoIP2 - database types are country, city, domain, isp, and as. All of these - databases support both IPv4 and IPv6 lookups. [GL #182] [GL #1112] - - * Two new metrics have been added to the statistics-channel to report - DNSSEC signing operations. For each key in each zone, the dnssec-sign - counter indicates the total number of signatures named has generated - using that key since server startup, and the dnssec-refresh counter - indicates how many of those signatures were refreshed during zone - maintenance, as opposed to having been generated as a result of a zone - update. [GL #513] - -Bug Fixes - - * When qname-minimization was set to relaxed, some improperly configured - domains would fail to resolve, but would have succeeded when - minimization was disabled. named will now fall back to normal - resolution in such cases, and also uses type A rather than NS for - minimal queries in order to reduce the likelihood of encountering the - problem. [GL #1055] + * JSON-C is now the only supported library for enabling JSON support for + BIND statistics. The configure option has been renamed from + --with-libjson to --with-json-c. Set the PKG_CONFIG_PATH environment + variable accordingly to specify a custom path to the json-c library, + as the new configure option does not take the library installation + path as an optional argument. [GL #855] * ./configure no longer sets --sysconfdir to /etc or --localstatedir to /var when --prefix is not specified and the aforementioned options are not specified explicitly. Instead, Autoconf's defaults of $prefix/etc - and $prefix/var are respected. - - * Glue address records were not being returned in responses to root - priming queries; this has been corrected. [GL #1092] - -Notes for BIND 9.15.1 - -Security Fixes - - * A race condition could trigger an assertion failure when a large - number of incoming packets were being rejected. This flaw is disclosed - in CVE-2019-6471. [GL #942] - -New Features - - * In order to clarify the configuration of DNSSEC keys, the trusted-keys - and managed-keys statements have been deprecated, and the new - dnssec-keys statement should now be used for both types of key. - - When used with the keyword initial-key, dnssec-keys has the same - behavior as managed-keys, i.e., it configures a trust anchor that is - to be maintained via RFC 5011. - - When used with the new keyword static-key, it has the same behavior as - trusted-keys, configuring a permanent trust anchor that will not - automatically be updated. (This usage is not recommended for the root - key.) [GL #6] - -Removed Features - - * The cleaning-interval option has been removed. [GL !1731] - -Feature Changes - - * named will now log a warning if a static key is configured for the - root zone. [GL #6] - - * JSON-C is now the only supported library for enabling JSON support for - BIND statistics. The configure option has been renamed from - --with-libjson to --with-json-c. Use PKG_CONFIG_PATH to specify a - custom path to the json-c library as the new configure option does not - take the library installation path as an optional argument. - -Notes for BIND 9.15.0 - -Security Fixes - - * In certain configurations, named could crash with an assertion failure - if nxdomain-redirect was in use and a redirected query resulted in an - NXDOMAIN from the cache. This flaw is disclosed in CVE-2019-6467. [GL - #880] - - * The TCP client quota set using the tcp-clients option could be - exceeded in some cases. This could lead to exhaustion of file - descriptors. This flaw is disclosed in CVE-2018-5743. [GL #615] - -New Features - - * The new add-soa option specifies whether or not the response-policy - zone's SOA record should be included in the additional section of RPZ - responses. [GL #865] + and $prefix/var are respected. [GL #658] Removed Features @@ -336,33 +163,17 @@ Removed Features effect. DNSSEC responses are always enabled if signatures and other DNSSEC data are present. [GL #866] -Feature Changes - - * When static and managed DNSSEC keys were both configured for the same - name, or when a static key was used to configure a trust anchor for - the root zone and dnssec-validation was set to the default value of - auto, automatic RFC 5011 key rollovers would be disabled. This - combination of settings was never intended to work, but there was no - check for it in the parser. This has been corrected, and it is now a - fatal configuration error. [GL #868] - - * DS and CDS records are now generated with SHA-256 digests only, - instead of both SHA-1 and SHA-256. This affects the default output of - dnssec-dsfromkey, the dsset files generated by dnssec-signzone, the DS - records added to a zone by dnssec-signzone based on keyset files, the - CDS records added to a zone by named and dnssec-signzone based on - "sync" timing parameters in key files, and the checks performed by - dnssec-checkds. - -Bug Fixes + * DNSSEC Lookaside Validation (DLV) is now obsolete. The + dnssec-lookaside option has been marked as deprecated; when used in + named.conf, it will generate a warning but will otherwise be ignored. + All code enabling the use of lookaside validation has been removed + from the validator, delv, and the DNSSEC tools. [GL #7] - * The allow-update and allow-update-forwarding options were - inadvertently treated as configuration errors when used at the options - or view level. This has now been corrected. [GL #913] + * The cleaning-interval option has been removed. [GL !1731] License -BIND is open source software licensed under the terms of the Mozilla +BIND 9 is open source software licensed under the terms of the Mozilla Public License, version 2.0 (see the LICENSE file for the full text). The license requires that if you make changes to BIND and distribute them @@ -373,17 +184,16 @@ affect anyone who is using BIND, with or without modifications, without redistributing it, nor anyone redistributing BIND without changes. Those wishing to discuss license compliance may contact ISC at https:// -www.isc.org/mission/contact/. +www.isc.org/contact/. End of Life -BIND 9.15 is an unstable development branch. When its development is -complete, it will be renamed to BIND 9.16, which will be a stable branch. +The end of life date for BIND 9.16 has not yet been determined. At some +point in the future BIND 9.16 will be designated as an Extended Support +Version (ESV). Until then, the current ESV is BIND 9.11, which will be +supported until at least December 2021. -The end of life date for BIND 9.16 has not yet been determined. For those -needing long term support, the current Extended Support Version (ESV) is -BIND 9.11, which will be supported until at least December 2021. See -https://kb.isc.org/docs/aa-00896 for details of ISC's software support +See https://kb.isc.org/docs/aa-00896 for details of ISC's software support policy. Thank You diff --git a/doc/misc/options b/doc/misc/options index cf66ac3a974..0f6a8176780 100644 --- a/doc/misc/options +++ b/doc/misc/options @@ -23,8 +23,8 @@ dlz { dnssec-policy { dnskey-ttl ; - keys { ( csk | ksk | zsk ) ( key-directory ) lifetime ( | unlimited ) - algorithm [ ]; ... }; + keys { ( csk | ksk | zsk ) [ ( key-directory ) ] lifetime + algorithm [ ]; ... }; max-zone-ttl ; parent-ds-ttl ; parent-propagation-delay ; @@ -206,7 +206,7 @@ options { fstrm-set-output-queue-model ( mpsc | spsc ); // not configured fstrm-set-output-queue-size ; // not configured fstrm-set-reopen-interval ; // not configured - geoip-directory ( | none ); + geoip-directory ( | none ); // not configured geoip-use-ecs ; // obsolete glue-cache ; has-old-clients ; // ancient @@ -227,7 +227,7 @@ options { listen-on-v6 [ port ] [ dscp ] { ; ... }; // may occur multiple times - lmdb-mapsize ; + lmdb-mapsize ; // non-operational lock-file ( | none ); maintain-ixfr-base ; // ancient managed-keys-directory ; @@ -581,7 +581,7 @@ view [ ] { }; // may occur multiple times key-directory ; lame-ttl ; - lmdb-mapsize ; + lmdb-mapsize ; // non-operational maintain-ixfr-base ; // ancient managed-keys { ( static-key | initial-key diff --git a/doc/misc/options.active b/doc/misc/options.active index 20fc8d3b371..ed797d5f5b5 100644 --- a/doc/misc/options.active +++ b/doc/misc/options.active @@ -23,8 +23,8 @@ dlz { dnssec-policy { dnskey-ttl ; - keys { ( csk | ksk | zsk ) ( key-directory ) lifetime ( | unlimited ) - algorithm [ ]; ... }; + keys { ( csk | ksk | zsk ) [ ( key-directory ) ] lifetime + algorithm [ ]; ... }; max-zone-ttl ; parent-ds-ttl ; parent-propagation-delay ; @@ -188,7 +188,7 @@ options { fstrm-set-output-queue-model ( mpsc | spsc ); // not configured fstrm-set-output-queue-size ; // not configured fstrm-set-reopen-interval ; // not configured - geoip-directory ( | none ); + geoip-directory ( | none ); // not configured glue-cache ; heartbeat-interval ; hostname ( | none ); @@ -205,7 +205,7 @@ options { listen-on-v6 [ port ] [ dscp ] { ; ... }; // may occur multiple times - lmdb-mapsize ; + lmdb-mapsize ; // non-operational lock-file ( | none ); managed-keys-directory ; masterfile-format ( map | raw | text ); @@ -522,7 +522,7 @@ view [ ] { }; // may occur multiple times key-directory ; lame-ttl ; - lmdb-mapsize ; + lmdb-mapsize ; // non-operational managed-keys { ( static-key | initial-key | static-ds | initial-ds diff --git a/lib/bind9/api b/lib/bind9/api index d1ed585b1a4..44ffa3dd0ba 100644 --- a/lib/bind9/api +++ b/lib/bind9/api @@ -10,6 +10,6 @@ # 9.12: 1200-1299 # 9.13/9.14: 1300-1499 # 9.15/9.16: 1500-1699 -LIBINTERFACE = 1502 -LIBREVISION = 1 +LIBINTERFACE = 1600 +LIBREVISION = 0 LIBAGE = 0 diff --git a/lib/dns/api b/lib/dns/api index c7560d54a5b..44ffa3dd0ba 100644 --- a/lib/dns/api +++ b/lib/dns/api @@ -10,6 +10,6 @@ # 9.12: 1200-1299 # 9.13/9.14: 1300-1499 # 9.15/9.16: 1500-1699 -LIBINTERFACE = 1506 +LIBINTERFACE = 1600 LIBREVISION = 0 LIBAGE = 0 diff --git a/lib/irs/api b/lib/irs/api index 2cca30a6562..44ffa3dd0ba 100644 --- a/lib/irs/api +++ b/lib/irs/api @@ -10,6 +10,6 @@ # 9.12: 1200-1299 # 9.13/9.14: 1300-1499 # 9.15/9.16: 1500-1699 -LIBINTERFACE = 1501 -LIBREVISION = 2 +LIBINTERFACE = 1600 +LIBREVISION = 0 LIBAGE = 0 diff --git a/lib/isc/api b/lib/isc/api index c7560d54a5b..44ffa3dd0ba 100644 --- a/lib/isc/api +++ b/lib/isc/api @@ -10,6 +10,6 @@ # 9.12: 1200-1299 # 9.13/9.14: 1300-1499 # 9.15/9.16: 1500-1699 -LIBINTERFACE = 1506 +LIBINTERFACE = 1600 LIBREVISION = 0 LIBAGE = 0 diff --git a/lib/isccc/api b/lib/isccc/api index c7836b219a0..44ffa3dd0ba 100644 --- a/lib/isccc/api +++ b/lib/isccc/api @@ -10,6 +10,6 @@ # 9.12: 1200-1299 # 9.13/9.14: 1300-1499 # 9.15/9.16: 1500-1699 -LIBINTERFACE = 1500 +LIBINTERFACE = 1600 LIBREVISION = 0 LIBAGE = 0 diff --git a/lib/isccfg/api b/lib/isccfg/api index d1ed585b1a4..44ffa3dd0ba 100644 --- a/lib/isccfg/api +++ b/lib/isccfg/api @@ -10,6 +10,6 @@ # 9.12: 1200-1299 # 9.13/9.14: 1300-1499 # 9.15/9.16: 1500-1699 -LIBINTERFACE = 1502 -LIBREVISION = 1 +LIBINTERFACE = 1600 +LIBREVISION = 0 LIBAGE = 0 diff --git a/lib/ns/api b/lib/ns/api index 5ad70109b1e..44ffa3dd0ba 100644 --- a/lib/ns/api +++ b/lib/ns/api @@ -10,6 +10,6 @@ # 9.12: 1200-1299 # 9.13/9.14: 1300-1499 # 9.15/9.16: 1500-1699 -LIBINTERFACE = 1503 -LIBREVISION = 1 +LIBINTERFACE = 1600 +LIBREVISION = 0 LIBAGE = 0 diff --git a/version b/version index ba0219c7000..b706a7f1d4a 100644 --- a/version +++ b/version @@ -2,10 +2,10 @@ # configure. # PRODUCT=BIND -DESCRIPTION="(Development Release)" +DESCRIPTION="(Stable Release)" MAJORVER=9 -MINORVER=15 -PATCHVER=8 +MINORVER=16 +PATCHVER=0 RELEASETYPE= RELEASEVER= EXTENSIONS=