Bv9ARM.ch09.html 36.7 KB
Newer Older
Tinderbox User's avatar
Tinderbox User committed
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<!--
 - Copyright (C) 2000-2017 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
 - file, You can obtain one at http://mozilla.org/MPL/2.0/.
-->
<html lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
<title>AppendixA.Release Notes</title>
<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
<link rel="home" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
<link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
<link rel="prev" href="Bv9ARM.ch08.html" title="Chapter8.Troubleshooting">
<link rel="next" href="Bv9ARM.ch10.html" title="AppendixB.A Brief History of the DNS and BIND">
</head>
<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
<div class="navheader">
<table width="100%" summary="Navigation header">
<tr><th colspan="3" align="center">AppendixA.Release Notes</th></tr>
<tr>
<td width="20%" align="left">
<a accesskey="p" href="Bv9ARM.ch08.html">Prev</a></td>
<th width="60%" align="center"></th>
<td width="20%" align="right"><a accesskey="n" href="Bv9ARM.ch10.html">Next</a>
</td>
</tr>
</table>
<hr>
</div>
<div class="appendix">
<div class="titlepage"><div><div><h1 class="title">
<a name="Bv9ARM.ch09"></a>Release Notes</h1></div></div></div>
<div class="toc">
<p><b>Table of Contents</b></p>
<dl class="toc">
Tinderbox User's avatar
Tinderbox User committed
39
<dt><span class="section"><a href="Bv9ARM.ch09.html#id-1.10.2">Release Notes for BIND Version 9.12.0rc1</a></span></dt>
Tinderbox User's avatar
Tinderbox User committed
40 41 42 43
<dd><dl>
<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_intro">Introduction</a></span></dt>
<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_download">Download</a></span></dt>
<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_license">License Change</a></span></dt>
Tinderbox User's avatar
Tinderbox User committed
44
<dt><span class="section"><a href="Bv9ARM.ch09.html#win_support">Legacy Windows No Longer Supported</a></span></dt>
Tinderbox User's avatar
Tinderbox User committed
45 46
<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_security">Security Fixes</a></span></dt>
<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_features">New Features</a></span></dt>
Tinderbox User's avatar
Tinderbox User committed
47
<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_removed">Removed Features</a></span></dt>
Tinderbox User's avatar
Tinderbox User committed
48 49 50 51 52 53 54 55 56 57
<dt><span class="section"><a href="Bv9ARM.ch09.html#proto_changes">Protocol Changes</a></span></dt>
<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_changes">Feature Changes</a></span></dt>
<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_bugs">Bug Fixes</a></span></dt>
<dt><span class="section"><a href="Bv9ARM.ch09.html#end_of_life">End of Life</a></span></dt>
<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_thanks">Thank You</a></span></dt>
</dl></dd>
</dl>
</div>
      <div class="section">
<div class="titlepage"><div><div><h2 class="title" style="clear: both">
Tinderbox User's avatar
Tinderbox User committed
58
<a name="id-1.10.2"></a>Release Notes for BIND Version 9.12.0rc1</h2></div></div></div>
Tinderbox User's avatar
Tinderbox User committed
59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99
  
  <div class="section">
<div class="titlepage"><div><div><h3 class="title">
<a name="relnotes_intro"></a>Introduction</h3></div></div></div>
    <p>
      BIND 9.12.0 is a new feature release of BIND, still under development.
      This document summarizes new features and functional changes that
      have been introduced on this branch.  With each development
      release leading up to the final BIND 9.12.0 release, this document
      will be updated with additional features added and bugs fixed.
    </p>
  </div>

  <div class="section">
<div class="titlepage"><div><div><h3 class="title">
<a name="relnotes_download"></a>Download</h3></div></div></div>
    <p>
      The latest versions of BIND 9 software can always be found at
      <a class="link" href="http://www.isc.org/downloads/" target="_top">http://www.isc.org/downloads/</a>.
      There you will find additional information about each release,
      source code, and pre-compiled versions for Microsoft Windows
      operating systems.
    </p>
  </div>

  <div class="section">
<div class="titlepage"><div><div><h3 class="title">
<a name="relnotes_license"></a>License Change</h3></div></div></div>
    <p>
      With the release of BIND 9.11.0, ISC changed to the open
      source license for BIND from the ISC license to the Mozilla
      Public License (MPL 2.0).
    </p>
    <p>
      The MPL-2.0 license requires that if you make changes to
      licensed software (e.g. BIND) and distribute them outside
      your organization, that you publish those changes under that
      same license. It does not require that you publish or disclose
      anything other than the changes you made to our software.
    </p>
    <p>
Tinderbox User's avatar
Tinderbox User committed
100 101 102 103 104
      This requirement will not affect anyone who is using BIND, with
      or without modifications, without redistributing it, nor anyone
      redistributing it without changes. Therefore, this change will be
      without consequence for most individuals and organizations who are
      using BIND.
Tinderbox User's avatar
Tinderbox User committed
105 106 107 108 109 110 111 112 113 114 115
    </p>
    <p>
      Those unsure whether or not the license change affects their
      use of BIND, or who wish to discuss how to comply with the
      license may contact ISC at <a class="link" href="https://www.isc.org/mission/contact/" target="_top">
      https://www.isc.org/mission/contact/</a>.
    </p>
  </div>

  <div class="section">
<div class="titlepage"><div><div><h3 class="title">
Tinderbox User's avatar
Tinderbox User committed
116
<a name="win_support"></a>Legacy Windows No Longer Supported</h3></div></div></div>
Tinderbox User's avatar
Tinderbox User committed
117
    <p>
Tinderbox User's avatar
Tinderbox User committed
118 119
      As of BIND 9.11.2, Windows XP and Windows 2003 are no longer supported
      platforms for BIND; "XP" binaries are no longer available for download
Tinderbox User's avatar
Tinderbox User committed
120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147
      from ISC.
    </p>
  </div>

  <div class="section">
<div class="titlepage"><div><div><h3 class="title">
<a name="relnotes_security"></a>Security Fixes</h3></div></div></div>
    <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
	<p>
	  None.
	</p>
      </li></ul></div>
  </div>

  <div class="section">
<div class="titlepage"><div><div><h3 class="title">
<a name="relnotes_features"></a>New Features</h3></div></div></div>
    <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
<li class="listitem">
	<p>
	  Many aspects of <span class="command"><strong>named</strong></span> have been modified
	  to improve query performance, and in particular, performance
	  for delegation-heavy zones:
	</p>
	<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: circle; ">
<li class="listitem">
	    <p>
	      The additional cache ("acache") was found not to
Tinderbox User's avatar
Tinderbox User committed
148 149 150 151 152 153
	      significantly improve performance and has been removed.
	      As a result, the <span class="command"><strong>acache-enable</strong></span> and
	      <span class="command"><strong>acache-cleaning-interval</strong></span> options no longer
	      have any effect. For backwards compatibility, BIND will
	      accept their presence in a configuration file, but
	      will log a warning.
Tinderbox User's avatar
Tinderbox User committed
154 155 156 157 158 159 160 161 162 163 164 165
	    </p>
	  </li>
<li class="listitem">
	    <p>
	      In place of the acache, <span class="command"><strong>named</strong></span> can now use
	      a glue cache to speed up retrieval of glue records when sending
	      delegation responses.  Unlike acache, this feature is on by
	      default; use <span class="command"><strong>glue-cache no;</strong></span> to disable it.
	    </p>
	  </li>
<li class="listitem">
	    <p>
Tinderbox User's avatar
Tinderbox User committed
166 167
	      <span class="command"><strong>minimal-responses</strong></span> is now set
	      to <code class="literal">no-auth-recursive</code> by default.
Tinderbox User's avatar
Tinderbox User committed
168 169 170 171
	    </p>
	  </li>
<li class="listitem">
	    <p>
Tinderbox User's avatar
Tinderbox User committed
172 173 174 175
	      The <span class="command"><strong>additional-from-cache</strong></span>
	      and <span class="command"><strong>additional-from-auth</strong></span> options no longer
	      have any effect. <span class="command"><strong>named</strong></span> will log a warning
	      if they are set.
Tinderbox User's avatar
Tinderbox User committed
176 177 178 179 180 181 182 183 184
	    </p>
	  </li>
<li class="listitem">
	    <p>
	      Several functions have been refactored to improve
	      performance, including name compression, owner name
	      case restoration, hashing, and buffers.
	    </p>
	  </li>
Tinderbox User's avatar
Tinderbox User committed
185 186 187 188 189 190 191 192 193 194 195 196
<li class="listitem">
	    <p>
	      When built with default <span class="command"><strong>configure</strong></span> options,
	      <span class="command"><strong>named</strong></span> no longer fills memory with tag
	      values when allocating or freeing it. This improves performance,
	      but makes it more difficult to debug certain memory-related
	      errors. The default is reversed if building with developer
	      options. <span class="command"><strong>named -M fill</strong></span> or
	      <span class="command"><strong>named -M nofill</strong></span> will set the behavior
	      accordingly regardless of build options.
	    </p>
	  </li>
Tinderbox User's avatar
Tinderbox User committed
197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233
</ul></div>
      </li>
<li class="listitem">
	<p>
	  Several areas of code have been refactored for improved
	  readability, maintainability, and testability:
	</p>
	<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: circle; ">
<li class="listitem">
	    <p>
	      The <span class="command"><strong>named</strong></span> query logic implemented in
	      <span class="command"><strong>query_find()</strong></span> has been split into
	      smaller functions with a context structure to maintain state
	      between them, and extensive comments have been added.
	      [RT #43929]
	    </p>
	  </li>
<li class="listitem">
	    <p>
	      Similarly the iterative query logic implemented in
	      <span class="command"><strong>resquery_response()</strong></span> function has been
	      split into smaller functions and comments added. [RT #45362]
	    </p>
	  </li>
</ul></div>
      </li>
<li class="listitem">
	<p>
	  Code implementing name server query processing has been moved
	  from <span class="command"><strong>named</strong></span> to an external library,
	  <span class="command"><strong>libns</strong></span>. This will make it easier to
	  write unit tests for the code, or to link it into new tools.
	  [RT #45186]
	</p>
      </li>
<li class="listitem">
	<p>
Tinderbox User's avatar
Tinderbox User committed
234 235 236 237 238 239 240 241 242 243 244
	  <span class="command"><strong>named</strong></span> can now synthesize negative responses
	  (NXDOMAIN, NODATA, or wildcard answers) from cached DNSSEC-verified
	  records that were returned in negative or wildcard responses from
	  authoritative servers.
	</p>
	<p>
	  This will reduce query loads on authoritative servers for signed
	  domains: when existing cached records can be used by the resolver
	  to determine that a name does not exist in the authorittive domain,
	  no query needs to be sent. Reducing the number of iterative queries
	  should also improve resolver performance.
Tinderbox User's avatar
Tinderbox User committed
245 246 247 248 249 250 251
	</p>
	<p>
	  This behavior is controlled by the new
	  <code class="filename">named.conf</code> option
	  <span class="command"><strong>synth-from-dnssec</strong></span>.  It is enabled by
	  default.
	</p>
Tinderbox User's avatar
Tinderbox User committed
252 253 254 255 256
	<p>
	  Note: this currently only works for zones signed using NSEC.
	  Support for zones signed using NSEC3 (without opt-out) is
	  planned for the future.
	</p>
Tinderbox User's avatar
Tinderbox User committed
257
	<p>
Tinderbox User's avatar
Tinderbox User committed
258 259 260 261 262 263 264 265 266 267 268 269
	  Thanks to APNIC for sponsoring this work.
	</p>
      </li>
<li class="listitem">
	<p>
	  When acting as a recursive resolver, <span class="command"><strong>named</strong></span>
	  can now continue returning answers whose TTLs have expired
	  when the authoritative server is under attack and unable to
	  respond. This is controlled by the
	  <span class="command"><strong>stale-answer-enable</strong></span>,
	  <span class="command"><strong>stale-answer-ttl</strong></span> and
	  <span class="command"><strong>max-stale-ttl</strong></span> options. [RT #44790]
Tinderbox User's avatar
Tinderbox User committed
270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333
	</p>
      </li>
<li class="listitem">
	<p>
	  The DNS Response Policy Service (DNSRPS) API, a mechanism to
	  allow <span class="command"><strong>named</strong></span> to use an external response policy
	  provider, is now supported. (One example of such a provider is
	  "FastRPZ" from Farsight Security, Inc.) This allows the same
	  types of policy filtering as standard RPZ, but can reduce the
	  workload for <span class="command"><strong>named</strong></span>, particularly when using
	  large and frequently-updated policy zones. It also enables
	  <span class="command"><strong>named</strong></span> to share response policy providers
	  with other DNS implementations such as Unbound.
	</p>
	<p>
	  This feature is avaiable if BIND is built with
	  <span class="command"><strong>configure --enable-dnsrps</strong></span>, if a DNSRPS
	  provider is installed, and if <span class="command"><strong>dnsrps-enable</strong></span>
	  is set to "yes" in <code class="filename">named.conf</code>. Standard
	  built-in RPZ is used otherwise.
	</p>
	<p>
	  Thanks to Vernon Schryver and Farsight Security for the
	  contribution. [RT #43376]
	</p>
      </li>
<li class="listitem">
	<p>
	  Setting <span class="command"><strong>max-journal-size</strong></span> to
	  <code class="literal">default</code> limits journal sizes to twice the
	  size of the zone contents.  This can be overridden by setting
	  <span class="command"><strong>max-journal-size</strong></span> to <code class="literal">unlimited</code>
	  or to an explicit value up to 2G. Thanks to Tony Finch for
	  the contribution. [RT #38324]
	</p>
      </li>
<li class="listitem">
	<p>
	  <span class="command"><strong>dnstap</strong></span> logfiles can now be configured to
	  automatically roll when they reach a specified size. If
	  <span class="command"><strong>dnstap-output</strong></span> is configured with mode
	  <code class="literal">file</code>, then it can take optional
	  <span class="command"><strong>size</strong></span> and <span class="command"><strong>versions</strong></span>
	  key-value arguments to set the logfile rolling parameters.
	  (These have the same semantics as the corresponding
	  options in a <span class="command"><strong>logging</strong></span> channel statement.)
	  [RT #44502]
	</p>
      </li>
<li class="listitem">
	<p>
	  Logging channels and <span class="command"><strong>dnstap-output</strong></span> files can
	  now be configured with a <span class="command"><strong>suffix</strong></span> option,
	  set to either <code class="literal">increment</code> or
	  <code class="literal">timestamp</code>, indicating whether log files
	  should be given incrementing suffixes when they roll
	  over (e.g., <code class="filename">logfile.0</code>,
	  <code class="filename">.1</code>, <code class="filename">.2</code>, etc)
	  or suffixes indicating the time of the roll. The default
	  is <code class="literal">increment</code>.  [RT #42838]
	</p>
      </li>
<li class="listitem">
	<p>
Tinderbox User's avatar
Tinderbox User committed
334 335
	  The <span class="command"><strong>print-time</strong></span> option in the
	  <span class="command"><strong>logging</strong></span> configuration can now take arguments
Tinderbox User's avatar
Tinderbox User committed
336 337 338 339 340 341 342
	  <strong class="userinput"><code>local</code></strong>, <strong class="userinput"><code>iso8601</code></strong> or
	  <strong class="userinput"><code>iso8601-utc</code></strong> to indicate the format in
	  which the date and time should be logged. For backward
	  compatibility, <strong class="userinput"><code>yes</code></strong> is a synonym for
	  <strong class="userinput"><code>local</code></strong>.  [RT #42585]
	</p>
      </li>
Tinderbox User's avatar
Tinderbox User committed
343 344 345 346 347 348 349
<li class="listitem">
	<p>
	  The new <span class="command"><strong>dnssec-cds</strong></span> command generates a new DS
	  set to place in a parent zone, based on the contents of a child
	  zone's validated CDS or CDNSKEY records. It can produce a
	  <code class="filename">dsset</code> file suitable for input to
	  <span class="command"><strong>dnssec-signzone</strong></span>, or a series of
Tinderbox User's avatar
Tinderbox User committed
350 351 352
	  <span class="command"><strong>nsupdate</strong></span> commands to update the parent zone
	  via dynamic DNS. Thanks to Tony Finch for the contribution.
	  [RT #46090]
Tinderbox User's avatar
Tinderbox User committed
353 354
	</p>
      </li>
Tinderbox User's avatar
Tinderbox User committed
355 356
<li class="listitem">
	<p>
Tinderbox User's avatar
Tinderbox User committed
357
	  <span class="command"><strong>nsupdate</strong></span> and <span class="command"><strong>rndc</strong></span> now accept
Tinderbox User's avatar
Tinderbox User committed
358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448
	  command line options <span class="command"><strong>-4</strong></span> and <span class="command"><strong>-6</strong></span>
	  which force using only IPv4 or only IPv6, respectively. [RT #45632]
	</p>
      </li>
<li class="listitem">
	<p>
	  <span class="command"><strong>nsec3hash -r</strong></span> ("rdata order") takes arguments
	  in the same order as they appear in NSEC3 or NSEC3PARAM records.
	  This makes it easier to generate an NSEC3 hash using values cut
	  and pasted from an existing record. Thanks to Tony Finch for
	  the contribution. [RT #45183]
	</p>
      </li>
<li class="listitem">
	<p>
	  The <span class="command"><strong>new-zones-directory</strong></span> option allows
	  <span class="command"><strong>named</strong></span> to store configuration parameters
	  for zones added via <span class="command"><strong>rndc addzone</strong></span> in a
	  location other than the working directory. Thanks to Petr
	  Men&#353;k of Red Hat for the contribution.
	  [RT #44853]
	</p>
      </li>
<li class="listitem">
	<p>
	  The <span class="command"><strong>dnstap-read -x</strong></span> option prints a hex
	  dump of the wire format DNS message encapsulated in each
	  <span class="command"><strong>dnstap</strong></span> log entry. [RT #44816]
	</p>
      </li>
<li class="listitem">
	<p>
	  The <span class="command"><strong>host -A</strong></span> option returns most
	  records for a name, but omits types RRSIG, NSEC and NSEC3.
	</p>
      </li>
<li class="listitem">
	<p>
	  <span class="command"><strong>dig +ednsopt</strong></span> now accepts the names
	  for EDNS options in addition to numeric values. For example,
	  an EDNS Client-Subnet option could be sent using
	  <span class="command"><strong>dig +ednsopt=ecs:...</strong></span>. Thanks to
	  John Worley of Secure64 for the contribution. [RT #44461]
	</p>
      </li>
<li class="listitem">
	<p>
	  Added support for the EDNS TCP Keepalive option (RFC 7828);
	  this allows negotiation of longer-lived TCP sessions
	  to reduce the overhead of setting up TCP for individual
	  queries. [RT #42126]
	</p>
      </li>
<li class="listitem">
	<p>
	  Added support for the EDNS Padding option (RFC 7830),
	  which obfuscates packet size analysis when DNS queries
	  are sent over an encrypted channel. [RT #42094]
	</p>
      </li>
<li class="listitem">
	<p>
	  <span class="command"><strong>rndc</strong></span> commands which refer to zone names
	  can now reference a zone of type <span class="command"><strong>redirect</strong></span>
	  by using the special zone name "-redirect". (Previously this
	  was not possible because <span class="command"><strong>redirect</strong></span> zones
	  always have the name ".", which can be ambiguous.)
	</p>
	<p>
	  In the event you need to manipulate a zone actually
	  called "-redirect", use a trailing dot: "-redirect."
	</p>
	<p>
	  Note: This change does not appply to the
	  <span class="command"><strong>rndc addzone</strong></span> or
	  <span class="command"><strong>rndc modzone</strong></span> commands.
	</p>
      </li>
<li class="listitem">
	<p>
	  <span class="command"><strong>named-checkconf -l</strong></span> lists the zones found
	  in <code class="filename">named.conf</code>. [RT #43154]
	</p>
      </li>
<li class="listitem">
	<p>
	  Query logging now includes the ECS option, if one was
	  present in the query, in the format
	  "[ECS <em class="replaceable"><code>address/source/scope</code></em>]".
	</p>
      </li>
Tinderbox User's avatar
Tinderbox User committed
449 450
<li class="listitem">
	<p>
Tinderbox User's avatar
Tinderbox User committed
451 452 453 454 455 456 457 458 459 460 461 462 463 464 465 466 467 468 469 470 471 472
	  By default, BIND now uses the random number generation functions
	  in the cryptographic library (i.e., OpenSSL or a PKCS#11
	  provider) as a source of high-quality randomness rather than
	  <code class="filename">/dev/random</code>.  This is suitable for virtual
	  machine environments, which may have limited entropy pools and
	  lack hardware random number generators.
	</p>
	<p>
	  This can be overridden by specifying another entropy source via
	  the <span class="command"><strong>random-device</strong></span> option in
	  <code class="filename">named.conf</code>, or via the <span class="command"><strong>-r</strong></span>
	  command line option.  However, for functions requiring full
	  cryptographic strength, such as DNSSEC key generation, this
	  <span class="emphasis"><em>cannot</em></span> be overridden. In particular, the
	  <span class="command"><strong>-r</strong></span> command line option no longer has any
	  effect on <span class="command"><strong>dnssec-keygen</strong></span>.
	</p>
	<p>
	  This can be disabled by building with
	  <span class="command"><strong>configure --disable-crypto-rand</strong></span>, in which
	  case <code class="filename">/dev/random</code> will be the default
	  entropy source.  [RT #31459] [RT #46047]
Tinderbox User's avatar
Tinderbox User committed
473 474
	</p>
      </li>
Tinderbox User's avatar
Tinderbox User committed
475 476 477 478 479 480 481 482 483 484 485 486 487 488 489 490 491 492 493 494 495 496 497 498 499 500
<li class="listitem">
	<p>
	  <span class="command"><strong>rndc managed-keys destroy</strong></span> shuts down all
	  RFC 5011 DNSSEC trust anchor maintenance, and deletes any
	  existing managed keys database. If immediately followed by
	  <span class="command"><strong>rndc reconfig</strong></span>, this will reinitialize
	  key maintenance just as if the server was being started for
	  the first time.
	</p>
	<p>
	  This is intended for testing purposes, but can be used -- with
	  extreme caution -- as a brute-force repair for unrecoverable
	  problems with a managed keys database, to jumpstart the key
	  acquisition process if <code class="filename">bind.keys</code> is updated,
	  etc. [RT #32456]
	</p>
      </li>
<li class="listitem">
	<p>
	  <span class="command"><strong>dnssec-signzone -S</strong></span> can now add or remove
	  synchronization records (CDS and CDNSKEY) based on key metadata
	  set by the <span class="command"><strong>-Psync</strong></span> and <span class="command"><strong>-Dsync</strong></span>
	  options to <span class="command"><strong>dnssec-keygen</strong></span>,
	  <span class="command"><strong>dnssec-settime</strong></span>, etc. [RT #46149]
	</p>
      </li>
Tinderbox User's avatar
Tinderbox User committed
501 502 503 504 505 506 507 508
<li class="listitem">
	<p>
	  <span class="command"><strong>dnssec-checkds -s</strong></span> specifies a file from
	  which to read a DS set rather than querying the parent zone.
	  This can be used to check zone correctness prior to
	  publication. Thanks to Niall O'Reilly [RT #44667]
	</p>
      </li>
Tinderbox User's avatar
Tinderbox User committed
509 510 511 512 513
</ul></div>
  </div>

  <div class="section">
<div class="titlepage"><div><div><h3 class="title">
Tinderbox User's avatar
Tinderbox User committed
514 515 516 517
<a name="relnotes_removed"></a>Removed Features</h3></div></div></div>
    <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
<li class="listitem">
	<p>
Tinderbox User's avatar
Tinderbox User committed
518 519 520 521 522 523 524
	  The ISC DNSSEC Lookaside Validation (DLV) service has
	  been shut down; all DLV records in the dlv.isc.org zone
	  have been removed.  References to the service have been
	  removed from BIND documentation.  Lookaside validation
	  is no longer used by default by <span class="command"><strong>delv</strong></span>.
	  The DLV key has been removed from <code class="filename">bind.keys</code>.
	  Setting <span class="command"><strong>dnssec-lookaside</strong></span> to
Tinderbox User's avatar
Tinderbox User committed
525
	  <span class="command"><strong>auto</strong></span> or to use dlv.isc.org as a trust
Tinderbox User's avatar
Tinderbox User committed
526
	  anchor results in a warning being issued.
Tinderbox User's avatar
Tinderbox User committed
527 528 529 530
	</p>
      </li>
<li class="listitem">
	<p>
Tinderbox User's avatar
Tinderbox User committed
531 532 533 534 535 536
	  As noted above, the <span class="command"><strong>acache-enable</strong></span>,
	  <span class="command"><strong>acache-cleaning-interval</strong></span>,
	  <span class="command"><strong>additional-from-cache</strong></span> and
	  <span class="command"><strong>additional-from-auth</strong></span> options are no longer
	  effective and <span class="command"><strong>named</strong></span> will log a warning if
	  they are set.
Tinderbox User's avatar
Tinderbox User committed
537 538
	</p>
      </li>
Tinderbox User's avatar
Tinderbox User committed
539 540 541 542 543 544 545 546 547 548 549 550 551 552 553
<li class="listitem">
	<p>
	  The use of <span class="command"><strong>dnssec-keygen</strong></span> to generate
	  HMAC keys for TSIG authentication has been deprecated in favor
	  of <span class="command"><strong>tsig-keygen</strong></span>. If the algorithms HMAC-MD5,
	  HMAC-SHA1, HMAC-SHA224, HMAC-SHA256, HMAC-SHA384, or
	  HMAC-SHA512 are specified, <span class="command"><strong>dnssec-keygen</strong></span>
	  will print a warning message. These algorithms will be
	  removed from <span class="command"><strong>dnssec-keygen</strong></span> entirely in
	  a future release. [RT #42272]
	</p>
      </li>
<li class="listitem">
	<p>
	  The use of HMAC-MD5 for RNDC keys is no longer recommended.
Tinderbox User's avatar
Tinderbox User committed
554
	  The default algorithm generated by <span class="command"><strong>rndc-confgen</strong></span>
Tinderbox User's avatar
Tinderbox User committed
555
	  is now HMAC-SHA256. [RT #42272]
Tinderbox User's avatar
Tinderbox User committed
556 557 558 559 560 561 562 563
	</p>
      </li>
<li class="listitem">
	<p>
	  The <span class="command"><strong>isc-hmac-fixup</strong></span> command, which was created
	  to address an interoperability problem in TSIG keys between
	  early versions of BIND and other DNS implmentations, is now
	  obsolete and has been removed. [RT #46411]
Tinderbox User's avatar
Tinderbox User committed
564 565
	</p>
      </li>
Tinderbox User's avatar
Tinderbox User committed
566 567 568 569 570
</ul></div>
  </div>

  <div class="section">
<div class="titlepage"><div><div><h3 class="title">
Tinderbox User's avatar
Tinderbox User committed
571 572 573 574 575 576 577 578 579
<a name="proto_changes"></a>Protocol Changes</h3></div></div></div>
    <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
<li class="listitem">
	<p>
	  BIND can now use the Ed25519 and Ed448 Edwards Curve DNSSEC
	  signing algorithms described in RFC 8080. Note, however, that
	  these algorithms must be supported in OpenSSL;
	  currently they are only available in the development branch
	  of OpenSSL at
Tinderbox User's avatar
Tinderbox User committed
580 581
	  <a class="link" href="https://github.com/openssl/openssl" target="_top">
	    https://github.com/openssl/openssl</a>.
Tinderbox User's avatar
Tinderbox User committed
582 583 584 585 586
	  [RT #44696]
	</p>
      </li>
<li class="listitem">
	<p>
Tinderbox User's avatar
Tinderbox User committed
587 588 589 590
	  When parsing DNS messages, EDNS KEY TAG options are checked
	  for correctness. When printing messages (for example, in
	  <span class="command"><strong>dig</strong></span>), EDNS KEY TAG options are printed
	  in readable format.
Tinderbox User's avatar
Tinderbox User committed
591 592 593 594 595 596 597 598 599
	</p>
      </li>
</ul></div>
  </div>

  <div class="section">
<div class="titlepage"><div><div><h3 class="title">
<a name="relnotes_changes"></a>Feature Changes</h3></div></div></div>
    <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
Tinderbox User's avatar
Tinderbox User committed
600 601 602 603 604 605 606 607
<li class="listitem">
	<p>
	  The ISC DNSSEC Lookaside Validation (DLV) service has been shut
	  down; all DLV records in the dlv.isc.org zone have been removed.
	  References to the service have been removed from BIND documentation.
	  Lookaside validation is no longer used by default by
	  <span class="command"><strong>delv</strong></span>. The DLV key has been removed from
	  <code class="filename">bind.keys</code>. Setting
Tinderbox User's avatar
Tinderbox User committed
608
	  <span class="command"><strong>dnssec-lookaside</strong></span> to
Tinderbox User's avatar
Tinderbox User committed
609 610 611
	  <span class="command"><strong>auto</strong></span> or to use dlv.isc.org as a trust
	  anchor is now a fatal configuration error. [RT #46155]
	</p>
Tinderbox User's avatar
Tinderbox User committed
612 613 614 615 616 617 618 619 620
      </li>
<li class="listitem">
	<p>
	  <span class="command"><strong>named</strong></span> will no longer start or accept
	  reconfiguration if the working directory (specified by the
	  <span class="command"><strong>directory</strong></span> option) or the managed-keys
	  directory (specified by <span class="command"><strong>managed-keys-directory</strong></span>
	  are not writable by the effective user ID. [RT #46077]
	</p>
Tinderbox User's avatar
Tinderbox User committed
621
      </li>
Tinderbox User's avatar
Tinderbox User committed
622 623 624 625 626 627 628 629 630 631
<li class="listitem">
	<p>
	  Initializing keys specified in a <span class="command"><strong>managed-keys</strong></span>
	  statement or by <span class="command"><strong>dnssec-validation auto;</strong></span> are
	  now tagged as "initializing", until they have been updated by a
	  key refresh query. If key maintenance fails to initialize,
	  this will be visible when running <span class="command"><strong>rndc secroots</strong></span>.
	  [RT #46267]
	</p>
      </li>
Tinderbox User's avatar
Tinderbox User committed
632 633 634 635 636 637 638 639 640
<li class="listitem">
	<p>
	  Previously, <span class="command"><strong>update-policy local;</strong></span> accepted
	  updates from any source so long as they were signed by the
	  locally-generated session key. This has been further restricted;
	  updates are now only accepted from locally configured addresses.
	  [RT #45492]
	</p>
      </li>
Tinderbox User's avatar
Tinderbox User committed
641 642 643 644 645 646 647 648 649 650
<li class="listitem">
	<p>
	  The lightweight resolver daemon and library (<span class="command"><strong>lwresd</strong></span>
	  and <span class="command"><strong>liblwres</strong></span>) have been removed. [RT #45186]
	</p>
      </li>
<li class="listitem">
	<p>
	  <span class="command"><strong>dnssec-keygen</strong></span> no longer has default
	  algorithm settings. It is necessary to explicitly specify the
Tinderbox User's avatar
Tinderbox User committed
651
	  algorithm on the command line with the <span class="command"><strong>-a</strong></span> option
Tinderbox User's avatar
Tinderbox User committed
652 653 654 655 656 657 658 659 660 661 662 663 664 665 666 667 668 669 670 671 672 673 674 675 676 677 678 679 680 681 682 683 684 685 686
	  when generating keys. This may cause errors with existing signing
	  scripts if they rely on current defaults. The intent is to
	  reduce the long-term cost of transitioning to newer algorithms in
	  the event of RSASHA1 being deprecated. [RT #44755]
	</p>
      </li>
<li class="listitem">
	<p>
	  <span class="command"><strong>dig +sigchase</strong></span> and related options
	  <span class="command"><strong>+trusted-keys</strong></span> and <span class="command"><strong>+topdown</strong></span>
	  have been removed. <span class="command"><strong>delv</strong></span> is now the recommended
	  command for looking up records with DNSSEC validation.
	  [RT #42793]
	</p>
      </li>
<li class="listitem">
	<p>
	  The Response Policy Zone (RPZ) implementation has been
	  substantially refactored: updates to the RPZ summary
	  database are no longer directly performed by the zone
	  database but by a separate function that is called when
	  a policy zone is updated.  This improves both performance
	  and reliability when policy zones receive frequent updates.
	  Summary database updates can be rate-limited by using the
	  <span class="command"><strong>min-update-interval</strong></span> option in a
	  <span class="command"><strong>response-policy</strong></span> statement. [RT #43449]
	</p>
      </li>
<li class="listitem">
	<p>
	  <span class="command"><strong>dnstap</strong></span> now stores both the local and remote
	  addresses for all messages, instead of only the remote address.
	  The default output format for <span class="command"><strong>dnstap-read</strong></span> has
	  been updated to include these addresses, with the initiating
	  address first and the responding address second, separated by
Tinderbox User's avatar
Tinderbox User committed
687
	  "-&gt;" or "&lt;-" to indicate in which direction the message
Tinderbox User's avatar
Tinderbox User committed
688 689 690 691 692 693 694 695 696 697 698 699 700 701 702 703 704 705 706 707 708 709 710 711 712 713 714 715 716 717 718 719 720 721 722 723 724 725 726 727 728 729
	  was sent. [RT #43595]
	</p>
      </li>
<li class="listitem">
	<p>
	  Expanded and improved the YAML output from
	  <span class="command"><strong>dnstap-read -y</strong></span>: it now includes packet
	  size and a detailed breakdown of message contents.
	  [RT #43622] [RT #43642]
	</p>
      </li>
<li class="listitem">
	<p>
	  Threads in <span class="command"><strong>named</strong></span> are now set to human-readable
	  names to assist debugging on operating systems that support that.
	  Threads will have names such as "isc-timer", "isc-sockmgr",
	  "isc-worker0001", and so on. This will affect the reporting of
	  subsidiary thread names in <span class="command"><strong>ps</strong></span> and
	  <span class="command"><strong>top</strong></span>, but not the main thread. [RT #43234]
	</p>
      </li>
<li class="listitem">
	<p>
	  If an ACL is specified with an address prefix in which the
	  prefix length is longer than the address portion (for example,
	  192.0.2.1/8), it will now be treated as a fatal error during
	  configuration. [RT #43367]
	</p>
      </li>
<li class="listitem">
	<p>
	  <span class="command"><strong>dig</strong></span> now warns about .local queries which are
	  reserved for Multicast DNS. [RT #44783]
	</p>
      </li>
<li class="listitem">
	<p>
	  The view associated with the query is now logged unless it
	  it is "_default/IN" or "_dnsclient/IN" when logging DNSSEC
	  validator messages.
	</p>
      </li>
Tinderbox User's avatar
Tinderbox User committed
730 731 732 733 734 735 736 737 738
<li class="listitem">
	<p>
	  When <span class="command"><strong>named</strong></span> was reconfigured, failure of some
	  zones to load correctly could leave the system in an inconsistent
	  state; while generally harmless, this could lead to a crash later
	  when using <span class="command"><strong>rndc addzone</strong></span>.  Reconfiguration changes
	  are now fully rolled back in the event of failure. [RT #45841]
	</p>
      </li>
Tinderbox User's avatar
Tinderbox User committed
739 740 741 742 743 744 745 746 747 748
<li class="listitem">
	<p>
	  Multiple <span class="command"><strong>cookie-secret</strong></span> clauses are now
	  supported.  The first <span class="command"><strong>cookie-secret</strong></span> in
	  <code class="filename">named.conf</code> is used to generate new
	  server cookies.  Any others are used to accept old server
	  cookies or those generated by other servers using the
	  matching <span class="command"><strong>cookie-secret</strong></span>.
	</p>
      </li>
Tinderbox User's avatar
Tinderbox User committed
749 750 751 752 753 754
<li class="listitem">
	<p>
	  A new statistics counter has been added to track prefetch
	  queries. [RT #45847]
	</p>
      </li>
Tinderbox User's avatar
Tinderbox User committed
755 756 757 758 759 760
<li class="listitem">
	<p>
	  A new statistics counter has been added to track priming
	  queries. [RT #46313]
	</p>
      </li>
Tinderbox User's avatar
Tinderbox User committed
761 762 763 764 765 766 767 768 769 770
<li class="listitem">
	<p>
	  The <span class="command"><strong>dnssec-signzone -x</strong></span> flag and the
	  <span class="command"><strong>dnssec-dnskey-kskonly</strong></span> option in
	  <span class="command"><strong>named.conf</strong></span>, which suppress the use of
	  the ZSK when signing DNSKEY records, now also apply to
	  CDNSKEY and CDS records. Thanks to Tony Finch for the
	  contribution. [RT #45689]
	</p>
      </li>
Tinderbox User's avatar
Tinderbox User committed
771 772 773 774 775 776 777 778
<li class="listitem">
	<p>
	  Trust anchor telemetry messages, as specified by
	  RFC 8145, are now logged to the
	  <span class="command"><strong>trust-anchor-telemetry</strong></span> logging
	  catagory.
	</p>
      </li>
Tinderbox User's avatar
Tinderbox User committed
779 780 781 782 783 784 785
<li class="listitem">
	<p>
	  The <span class="command"><strong>filter-aaaa-on-v4</strong></span> and
	  <span class="command"><strong>filter-aaaa-on-v6</strong></span> options are no longer
	  conditionally compiled in <span class="command"><strong>named</strong></span>. [RT #46340]
	</p>
      </li>
Tinderbox User's avatar
Tinderbox User committed
786 787 788 789 790 791
</ul></div>
  </div>

  <div class="section">
<div class="titlepage"><div><div><h3 class="title">
<a name="relnotes_bugs"></a>Bug Fixes</h3></div></div></div>
Tinderbox User's avatar
Tinderbox User committed
792
    <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
Tinderbox User's avatar
Tinderbox User committed
793 794 795 796 797 798 799 800
<li class="listitem">
	<p>
	  Zones created with <span class="command"><strong>rndc addzone</strong></span> could
	  temporarily fail to inherit the <span class="command"><strong>allow-transfer</strong></span>
	  ACL set in the <span class="command"><strong>options</strong></span> section of
	  <code class="filename">named.conf</code>. [RT #46603]
	</p>
      </li>
Tinderbox User's avatar
Tinderbox User committed
801 802 803 804 805 806 807 808
<li class="listitem">
	<p>
	  The introduction of <span class="command"><strong>libns</strong></span> caused a bug
	  in which TCP client objects were not recycled after use,
	  leading to unconstrained memory growth. [RT #46029]
	</p>
      </li>
<li class="listitem">
Tinderbox User's avatar
Tinderbox User committed
809 810 811 812 813 814 815 816
	<p>
	  Some header files included &lt;isc/util.h&gt; incorrectly as
	  it pollutes with namespace with non ISC_ macros and this should
	  only be done by explicitly including &lt;isc/util.h&gt;.  This
	  has been corrected.  Some code may depend on &lt;isc/util.h&gt;
	  being implicitly included via other header files.  Such
	  code should explicitly include &lt;isc/util.h&gt;.
	</p>
Tinderbox User's avatar
Tinderbox User committed
817
      </li>
Tinderbox User's avatar
Tinderbox User committed
818 819 820 821 822 823
<li class="listitem">
	<p>
	  <span class="command"><strong>named</strong></span> failed to properly determine whether
	  there were active KSK and ZSK keys for an algorithm when
	  <span class="command"><strong>update-check-ksk</strong></span> was true (which is the
	  default setting). This could leave records unsigned
Tinderbox User's avatar
Tinderbox User committed
824
	  when rolling keys. [RT #46743] [RT #46754] [RT #46774]
Tinderbox User's avatar
Tinderbox User committed
825 826
	</p>
      </li>
Tinderbox User's avatar
Tinderbox User committed
827
</ul></div>
Tinderbox User's avatar
Tinderbox User committed
828 829 830 831 832 833 834 835 836 837 838 839 840 841 842 843 844 845 846 847 848 849 850 851 852 853 854 855 856 857 858 859 860 861 862 863 864 865 866 867 868 869
  </div>

  <div class="section">
<div class="titlepage"><div><div><h3 class="title">
<a name="end_of_life"></a>End of Life</h3></div></div></div>
    <p>
      The end of life for BIND 9.12 is yet to be determined but
      will not be before BIND 9.14.0 has been released for 6 months.
      <a class="link" href="https://www.isc.org/downloads/software-support-policy/" target="_top">https://www.isc.org/downloads/software-support-policy/</a>
    </p>
  </div>
  <div class="section">
<div class="titlepage"><div><div><h3 class="title">
<a name="relnotes_thanks"></a>Thank You</h3></div></div></div>

    <p>
      Thank you to everyone who assisted us in making this release possible.
      If you would like to contribute to ISC to assist us in continuing to
      make quality open source software, please visit our donations page at
      <a class="link" href="http://www.isc.org/donate/" target="_top">http://www.isc.org/donate/</a>.
    </p>
  </div>
</div>
    </div>
<div class="navfooter">
<hr>
<table width="100%" summary="Navigation footer">
<tr>
<td width="40%" align="left">
<a accesskey="p" href="Bv9ARM.ch08.html">Prev</a></td>
<td width="20%" align="center"></td>
<td width="40%" align="right"><a accesskey="n" href="Bv9ARM.ch10.html">Next</a>
</td>
</tr>
<tr>
<td width="40%" align="left" valign="top">Chapter8.Troubleshooting</td>
<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
<td width="40%" align="right" valign="top">AppendixB.A Brief History of the <acronym class="acronym">DNS</acronym> and <acronym class="acronym">BIND</acronym>
</td>
</tr>
</table>
</div>
Tinderbox User's avatar
Tinderbox User committed
870
<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.0rc1</p>
Tinderbox User's avatar
Tinderbox User committed
871 872
</body>
</html>