From: Evan Hunt Date: Thu, 20 Aug 2020 19:05:01 +0000 (-0700) Subject: Merge tag 'v9_17_4' into main X-Git-Tag: v9.17.5~40 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=d7362ff16d3331d4b86a346dcaa9857496d39931;p=thirdparty%2Fbind9.git Merge tag 'v9_17_4' into main BIND 9.17.4 --- d7362ff16d3331d4b86a346dcaa9857496d39931 diff --cc CHANGES index 36a9eae78a6,fa60aa5516a..103a360cc5e --- a/CHANGES +++ b/CHANGES @@@ -1,29 -1,9 +1,31 @@@ +5490. [func] Refactor the readline support to use pkg-config and + add support for editline library. [GL !3942] + +5489. [bug] Named failed to reject some invalid records resulting + in records that, after being printed, could not be + loaded or would result in DNSSEC validation failures + when re-read from zone files as the wire format + differed. The covered records records are: CERT, + IPSECKEY, NSEC3, NSEC3PARAM, NXT, SIG, TLSA, WKS, and + X25. [GL !3953] + +5488. [bug] nta needed to have a weak reference on view to prevent + the view being deleted while nta tests are being + performed. [GL #2067] + +5487. [cleanup] Update managed keys log messages to be less confusing. + [GL #2027] + +5486. [func] Add 'rndc dnssec -checkds' command to tell named + that the DS record has been published in the parent. + [GL #1613] + + --- 9.17.4 released --- + 5485. [placeholder] - 5484. [func] Expire the 0 TTL RRSet quickly rather using them for - stale answers. [GL #1829] + 5484. [func] Expire zero TTL records quickly rather than using them + for stale answers. [GL #1829] 5483. [func] Keeping "stale" answers in cache has been disabled by default and can be re-enabled with a new configuration diff --cc doc/arm/notes.rst index 16a8227d758,334d0218204..681624f3f9a --- a/doc/arm/notes.rst +++ b/doc/arm/notes.rst @@@ -52,7 -52,7 +52,8 @@@ https://www.isc.org/download/. There yo information about each release, source code, and pre-compiled versions for Microsoft Windows operating systems. +.. include:: ../notes/notes-current.rst + .. include:: ../notes/notes-9.17.4.rst .. include:: ../notes/notes-9.17.3.rst .. include:: ../notes/notes-9.17.2.rst .. include:: ../notes/notes-9.17.1.rst diff --cc doc/notes/notes-current.rst index bb2edc12783,00000000000..3c367f9cdef mode 100644,000000..100644 --- a/doc/notes/notes-current.rst +++ b/doc/notes/notes-current.rst @@@ -1,84 -1,0 +1,40 @@@ +.. + Copyright (C) Internet Systems Consortium, Inc. ("ISC") + + This Source Code Form is subject to the terms of the Mozilla Public + License, v. 2.0. If a copy of the MPL was not distributed with this + file, You can obtain one at http://mozilla.org/MPL/2.0/. + + See the COPYRIGHT file distributed with this work for additional + information regarding copyright ownership. + - Notes for BIND 9.17.4 ++Notes for BIND 9.17.5 +--------------------- + +Security Fixes +~~~~~~~~~~~~~~ + +- None. + +Known Issues +~~~~~~~~~~~~ + +- None. + +New Features +~~~~~~~~~~~~ + +- New ``rndc`` command ``rndc dnssec -checkds`` to tell ``named`` + that a DS record for a given zone or key has been published or withdrawn + from the parent. Replaces the time-based ``parent-registration-delay`` + configuration option. [GL #1613] + - - ``rndc`` has been updated to use the new BIND network manager API. - This change had the side effect of altering the TCP timeout for RNDC - connections from 60 seconds to the ``tcp-idle-timeout`` value, which - defaults to 30 seconds. Also, because the network manager currently - has no support for UNIX-domain sockets, those cannot now be used - with ``rndc``. This will be addressed in a future release, either by - restoring UNIX-domain socket support or by formally declaring them - to be obsolete in the control channel. [GL #1759] - - - Statistics channels have also been updated to use the new BIND network - manager API. [GL #2022] - - - A new configuration option ``stale-cache-enable`` has been introduced to - enable or disable the keeping of stale answers in cache. [GL #1712] - +Feature Changes +~~~~~~~~~~~~~~~ + - - BIND's cache database implementation has been updated to use a faster - hash-function with better distribution. In addition, the effective - max-cache-size (configured explicitly, defaulting to a value based on system - memory or set to 'unlimited') now pre-allocates fixed size hash tables. This - prevents interruption to query resolution when the hash tables need to be - increased in size. [GL #1775] - - - Keeping stale answers in cache has been disabled by default. - - - The resource records received with 0 TTL are no longer kept in the cache - to be used for stale answers. [GL #1829] ++- None. + +Bug Fixes +~~~~~~~~~ + - - Addressed an error in recursive clients stats reporting. - There were occasions when an incoming query could trigger a prefetch for - some eligible rrset, and if the prefetch code were executed before recursion, - no increment in recursive clients stats would take place. Conversely, - when processing the answers, if the recursion code were executed before the - prefetch, the same counter would be decremented without a matching increment. - [GL #1719] - - - The introduction of KASP support broke whether the second field - of sig-validity-interval was treated as days or hours. (Thanks to - Tony Finch.) [GL !3735] - - - The IPv6 Duplicate Address Detection (DAD) mechanism could cause the operating - system to report the new IPv6 addresses to the applications via the - getifaddrs() API in a tentative (DAD not yet finished) or duplicate (DAD - failed) state. Such addresses cannot be bound by an application, and named - failed to listen on IPv6 addresses after the DAD mechanism finished. It is - possible to work around the issue by setting the IP_FREEBIND option on the - socket and trying to bind() to the IPv6 address again if the first bind() call - fails with EADDRNOTAVAIL. [GL #2038] ++- None.