From: Tinderbox User Date: Mon, 21 May 2018 19:59:10 +0000 (+0000) Subject: regenerate doc X-Git-Tag: v9.13.0~5^2 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=9536688b371cb394e5af52ea4fcedc2d5728e484;p=thirdparty%2Fbind9.git regenerate doc --- diff --git a/HISTORY b/HISTORY index 238e2634155..e56a44d4436 100644 --- a/HISTORY +++ b/HISTORY @@ -522,4 +522,3 @@ BIND 9.2.0 DNSSEC implementation is still considered experimental. For detailed information about the state of the DNSSEC implementation, see the file doc/misc/dnssec. - diff --git a/OPTIONS b/OPTIONS index 21e74d4264a..340b53db672 100644 --- a/OPTIONS +++ b/OPTIONS @@ -24,4 +24,3 @@ Setting Description may be useful when debugging -DISC_HEAP_CHECK Test heap consistency after every heap operation; used when debugging - diff --git a/bin/check/named-checkconf.8 b/bin/check/named-checkconf.8 index 03f2b9c7cc7..364548887e1 100644 --- a/bin/check/named-checkconf.8 +++ b/bin/check/named-checkconf.8 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2000-2002, 2004, 2005, 2007, 2009, 2014-2016 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2000-2002, 2004, 2005, 2007, 2009, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC") .\" .\" This Source Code Form is subject to the terms of the Mozilla Public .\" License, v. 2.0. If a copy of the MPL was not distributed with this @@ -136,5 +136,5 @@ BIND 9 Administrator Reference Manual\&. \fBInternet Systems Consortium, Inc\&.\fR .SH "COPYRIGHT" .br -Copyright \(co 2000-2002, 2004, 2005, 2007, 2009, 2014-2016 Internet Systems Consortium, Inc. ("ISC") +Copyright \(co 2000-2002, 2004, 2005, 2007, 2009, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC") .br diff --git a/bin/check/named-checkconf.html b/bin/check/named-checkconf.html index 42e99b42a4f..8862b74580e 100644 --- a/bin/check/named-checkconf.html +++ b/bin/check/named-checkconf.html @@ -1,6 +1,6 @@ + @@ -14,17 +15,41 @@

-Release Notes for BIND Version 9.13.0-dev

+Release Notes for BIND Version 9.13.0

Introduction

- BIND 9.13 is unstable development release of BIND. + BIND 9.13 is an unstable development release of BIND. This document summarizes new features and functional changes that - have been introduced on this branch. With each development - release leading up to the stable BIND 9.14 release, this document - will be updated with additional features added and bugs fixed. + have been introduced on this branch. With each development release + leading up to the stable BIND 9.14 release, this document will be + updated with additional features added and bugs fixed. +

+
+ +
+

+Note on Version Numbering

+

+ Prior to BIND 9.13, new feature development releases were tagged + as "alpha" and "beta", leading up to the first stable release + for a given development branch, which always ended in ".0". +

+

+ Now, however, BIND has adopted the "odd-unstable/even-stable" + release numbering convention. There will be no "alpha" or "beta" + releases in the 9.13 branch, only increasing version numbers. + So, for example, what would previously have been called 9.13.0a1, + 9.13.0a2, 9.13.0b1, and so on, will instead be called 9.13.0, + 9.13.1, 9.13.2, etc. +

+

+ The first stable release from this development branch will be + renamed as 9.14.0. Thereafter, maintenance releases will continue + on the 9.14 branch, while unstable feature development proceeds in + 9.15.

@@ -43,54 +68,129 @@

Security Fixes

+
  • +

    + None. +

    +
+
+ +
+

+New Features

  • - Addresses could be referenced after being freed during resolver - processing, causing an assertion failure. The chances of this - happening were remote, but the introduction of a delay in - resolution increased them. This bug is disclosed in - CVE-2017-3145. [RT #46839] + BIND now can be compiled against the libidn2 + library to add IDNA2008 support. Previously, BIND supported + IDNA2003 using the (now obsolete and unsupported) + idnkit-1 library.

  • - update-policy rules that otherwise ignore the name field now - require that it be set to "." to ensure that any type list - present is properly interpreted. If the name field was omitted - from the rule declaration and a type list was present it wouldn't - be interpreted as expected. + named now supports the "root key sentinel" + mechanism. This enables validating resolvers to indicate to + which trust anchors are configured for the root, so that + information about root key rollover status can be gathered. + To disable this feature, add + root-key-sentinel no; to + named.conf.

    • -
-
- -
-

-New Features

-
  • +

  • - None. + The dnskey-sig-validity option allows the + sig-validity-interval to be overriden for + signatures covering DNSKEY RRsets. [GL #145]

    -
+ +

Removed Features

-
  • +
      +

    • dnssec-keygen can no longer generate HMAC keys for TSIG authentication. Use tsig-keygen to generate these keys. [RT #46404]

      -
    +
    • +
  • +

    + Support for OpenSSL 0.9.x has been removed. OpenSSL version + 1.0.0 or greater, or LibreSSL is now required. +

    +
    • +
  • +

    + The configure --enable-seccomp option, + which formerly turned on system-call filtering on Linux, has + been removed. [GL #93] +

    +
    • +
  • +

    + IPv4 addresses in forms other than dotted-quad are no longer + accepted in master files. [GL #13] [GL #56] +

    +
    • +
  • +

    + IDNA2003 support via (bundled) idnkit-1.0 has been removed. +

    +
    • +
  • +

    + The "rbtdb64" database implementation (a parallel + implementation of "rbt") has been removed. [GL #217] +

    +
    • +
  • +

    + The -r randomdev option to explicitly select + random device has been removed from the + ddns-confgen, + rndc-confgen, + nsupdate, + dnssec-confgen, and + dnssec-signzone commands. +

    +

    + The -p option to use pseudo-random data + has been removed from the dnssec-signzone + command. +

    +
    • +

Feature Changes

    +
  • +

    + BIND will now always use the best CSPRNG (cryptographically-secure + pseudo-random number generator) available on the platform where + it is compiled. It will use arc4random() + family of functions on BSD operating systems, + getrandom() on Linux and Solaris, + CryptGenRandom on Windows, and the selected + cryptography provider library (OpenSSL or PKCS#11) as the last + resort. [GL #221] +

    +
    • +
  • +

    + BIND can no longer be built without DNSSEC support. A cryptography + provder (i.e., OpenSSL or a hardware service module with + PKCS#11 support) must be available. [GL #244] +

    +

  • Zone types primary and @@ -106,29 +206,38 @@ [RT #43670]

    • -
-
- -
-

-Bug Fixes

-

  • - When answering authoritative queries, named - does not return the target of a cross-zone CNAME between two - locally served zones; this prevents accidental cache poisoning. - This same restriction was incorrectly applied to recursive - queries as well; this has been fixed. [RT #47078] + dig +nssearch will now list name servers + that have timed out, in addition to those that respond. [GL #64] +

    +
    • +
  • +

    + dig +noidnin can be used to disable IDN + processing on the input domain name, when BIND is compiled + with IDN support. +

    +
    • +
  • +

    + Up to 64 response-policy zones are now + supported by default; previously the limit was 32. [GL #123]

  • - Attempting to validate improperly unsigned CNAME responses - from secure zones could cause a validator loop. This caused - a delay in returning SERVFAIL and also increased the chances - of encountering the crash bug described in CVE-2017-3145. - [RT #46839] + Several configuration options for time periods can now use + TTL value suffixes (for example, 2h or + 1d) in addition to an integer number of + seconds. These include + fstrm-set-reopen-interval, + interface-interval, + max-cache-ttl, + max-ncache-ttl, + max-policy-ttl, and + min-update-interval. + [GL #203]

@@ -136,6 +245,16 @@

+Bug Fixes

+
  • +

    + None. +

    +
+
+ +
+

License

BIND is open source software licenced under the terms of the Mozilla @@ -169,8 +288,8 @@

The end of life date for BIND 9.14 has not yet been determined. For those needing long term support, the current Extended Support - Version (ESV) is BIND 9.11, which will be supported until December - 2021. See + Version (ESV) is BIND 9.11, which will be supported until at + least December 2021. See https://www.isc.org/downloads/software-support-policy/ for details of ISC's software support policy.

diff --git a/doc/arm/notes.pdf b/doc/arm/notes.pdf index 663abae8a02..2ffa114b9ce 100644 Binary files a/doc/arm/notes.pdf and b/doc/arm/notes.pdf differ diff --git a/doc/misc/master.zoneopt b/doc/misc/master.zoneopt index 7bec788bb65..42b794de511 100644 --- a/doc/misc/master.zoneopt +++ b/doc/misc/master.zoneopt @@ -20,6 +20,7 @@ zone [ ] { database ; dialup ( notify | notify-passive | passive | refresh | ); dlz ; + dnskey-sig-validity ; dnssec-dnskey-kskonly ; dnssec-loadkeys-interval ; dnssec-secure-to-insecure ; diff --git a/doc/misc/options b/doc/misc/options index 6606dc93e14..e2bcd1eb9e0 100644 --- a/doc/misc/options +++ b/doc/misc/options @@ -92,7 +92,7 @@ options { ] [ dscp ] { ( | [ port ] | [ port ] ) [ key ]; ... } ] [ zone-directory ] [ - in-memory ] [ min-update-interval ]; ... }; + in-memory ] [ min-update-interval ]; ... }; check-dup-records ( fail | warn | ignore ); check-integrity ; check-mx ( fail | warn | ignore ); @@ -132,6 +132,7 @@ options { }; // may occur multiple times dns64-contact ; dns64-server ; + dnskey-sig-validity ; dnsrps-enable ; // not configured dnsrps-options { }; // not configured dnssec-accept-expired ; @@ -182,7 +183,7 @@ options { fstrm-set-output-notify-threshold ; // not configured fstrm-set-output-queue-model ( mpsc | spsc ); // not configured fstrm-set-output-queue-size ; // not configured - fstrm-set-reopen-interval ; // not configured + fstrm-set-reopen-interval ; // not configured geoip-directory ( | none ); // not configured geoip-use-ecs ; // not configured glue-cache ; @@ -192,7 +193,7 @@ options { host-statistics-max ; // not implemented hostname ( | none ); inline-signing ; - interface-interval ; + interface-interval ; ixfr-from-differences ( primary | master | secondary | slave | ); keep-response-order { ; ... }; @@ -213,11 +214,11 @@ options { match-mapped-addresses ; max-acache-size ( unlimited | ); // obsolete max-cache-size ( default | unlimited | | ); - max-cache-ttl ; + max-cache-ttl ; max-clients-per-query ; max-ixfr-log-size ( default | unlimited | ); // obsolete max-journal-size ( default | unlimited | ); - max-ncache-ttl ; + max-ncache-ttl ; max-records ; max-recursion-depth ; max-recursion-queries ; @@ -305,12 +306,12 @@ options { response-padding { ; ... } block-size ; response-policy { zone [ log ] [ - max-policy-ttl ] [ min-update-interval ] [ + max-policy-ttl ] [ min-update-interval ] [ policy ( cname | disabled | drop | given | no-op | nodata | nxdomain | passthru | tcp-only ) ] [ recursive-only ] [ nsip-enable ] [ nsdname-enable ]; ... } [ break-dnssec ] [ - max-policy-ttl ] [ min-update-interval ] [ + max-policy-ttl ] [ min-update-interval ] [ min-ns-dots ] [ nsip-wait-recurse ] [ qname-wait-recurse ] [ recursive-only ] [ nsip-enable ] [ nsdname-enable ] [ @@ -459,7 +460,7 @@ view [ ] { ] [ dscp ] { ( | [ port ] | [ port ] ) [ key ]; ... } ] [ zone-directory ] [ - in-memory ] [ min-update-interval ]; ... }; + in-memory ] [ min-update-interval ]; ... }; check-dup-records ( fail | warn | ignore ); check-integrity ; check-mx ( fail | warn | ignore ); @@ -497,6 +498,7 @@ view [ ] { }; // may occur multiple times dns64-contact ; dns64-server ; + dnskey-sig-validity ; dnsrps-enable ; // not configured dnsrps-options { }; // not configured dnssec-accept-expired ; @@ -553,11 +555,11 @@ view [ ] { match-recursive-only ; max-acache-size ( unlimited | ); // obsolete max-cache-size ( default | unlimited | | ); - max-cache-ttl ; + max-cache-ttl ; max-clients-per-query ; max-ixfr-log-size ( default | unlimited | ); // obsolete max-journal-size ( default | unlimited | ); - max-ncache-ttl ; + max-ncache-ttl ; max-records ; max-recursion-depth ; max-recursion-queries ; @@ -632,20 +634,20 @@ view [ ] { response-padding { ; ... } block-size ; response-policy { zone [ log ] [ - max-policy-ttl ] [ min-update-interval ] [ + max-policy-ttl ] [ min-update-interval ] [ policy ( cname | disabled | drop | given | no-op | nodata | nxdomain | passthru | tcp-only ) ] [ recursive-only ] [ nsip-enable ] [ nsdname-enable ]; ... } [ break-dnssec ] [ - max-policy-ttl ] [ min-update-interval ] [ + max-policy-ttl ] [ min-update-interval ] [ min-ns-dots ] [ nsip-wait-recurse ] [ qname-wait-recurse ] [ recursive-only ] [ nsip-enable ] [ nsdname-enable ] [ dnsrps-enable ] [ dnsrps-options { } ]; rfc2308-type1 ; // not yet implemented - root-key-sentinel ; root-delegation-only [ exclude { ; ... } ]; + root-key-sentinel ; rrset-order { [ class ] [ type ] [ name ] ; ... }; send-cookie ; @@ -743,6 +745,7 @@ view [ ] { dialup ( notify | notify-passive | passive | refresh | ); dlz ; + dnskey-sig-validity ; dnssec-dnskey-kskonly ; dnssec-loadkeys-interval ; dnssec-secure-to-insecure ; @@ -850,6 +853,7 @@ zone [ ] { delegation-only ; dialup ( notify | notify-passive | passive | refresh | ); dlz ; + dnskey-sig-validity ; dnssec-dnskey-kskonly ; dnssec-loadkeys-interval ; dnssec-secure-to-insecure ; diff --git a/doc/misc/slave.zoneopt b/doc/misc/slave.zoneopt index a9e62a45031..248823a88bd 100644 --- a/doc/misc/slave.zoneopt +++ b/doc/misc/slave.zoneopt @@ -13,6 +13,7 @@ zone [ ] { database ; dialup ( notify | notify-passive | passive | refresh | ); dlz ; + dnskey-sig-validity ; dnssec-dnskey-kskonly ; dnssec-loadkeys-interval ; dnssec-update-mode ( maintain | no-resign ); diff --git a/isc-config.sh.1 b/isc-config.sh.1 index 869cdbe0ceb..2921c339300 100644 --- a/isc-config.sh.1 +++ b/isc-config.sh.1 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2009, 2014-2017 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2009, 2014-2018 Internet Systems Consortium, Inc. ("ISC") .\" .\" This Source Code Form is subject to the terms of the Mozilla Public .\" License, v. 2.0. If a copy of the MPL was not distributed with this @@ -90,5 +90,5 @@ returns an exit status of 1 if invoked with invalid arguments or no arguments at \fBInternet Systems Consortium, Inc\&.\fR .SH "COPYRIGHT" .br -Copyright \(co 2009, 2014-2017 Internet Systems Consortium, Inc. ("ISC") +Copyright \(co 2009, 2014-2018 Internet Systems Consortium, Inc. ("ISC") .br diff --git a/isc-config.sh.html b/isc-config.sh.html index 8022b416a9a..849b12d8d3a 100644 --- a/isc-config.sh.html +++ b/isc-config.sh.html @@ -1,6 +1,6 @@