notes.html 33.5 KB
Newer Older
Tinderbox User's avatar
Tinderbox User committed
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17
<!--
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
 - file, You can obtain one at http://mozilla.org/MPL/2.0/.
-->
<!-- $Id$ -->
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
<title></title>
<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
</head>
<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="article">

  <div class="section">
<div class="titlepage"><div><div><h2 class="title" style="clear: both">
Tinderbox User's avatar
Tinderbox User committed
18
<a name="id-1.2"></a>Release Notes for BIND Version 9.12.0rc1</h2></div></div></div>
Tinderbox User's avatar
Tinderbox User committed
19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59
  
  <div class="section">
<div class="titlepage"><div><div><h3 class="title">
<a name="relnotes_intro"></a>Introduction</h3></div></div></div>
    <p>
      BIND 9.12.0 is a new feature release of BIND, still under development.
      This document summarizes new features and functional changes that
      have been introduced on this branch.  With each development
      release leading up to the final BIND 9.12.0 release, this document
      will be updated with additional features added and bugs fixed.
    </p>
  </div>

  <div class="section">
<div class="titlepage"><div><div><h3 class="title">
<a name="relnotes_download"></a>Download</h3></div></div></div>
    <p>
      The latest versions of BIND 9 software can always be found at
      <a class="link" href="http://www.isc.org/downloads/" target="_top">http://www.isc.org/downloads/</a>.
      There you will find additional information about each release,
      source code, and pre-compiled versions for Microsoft Windows
      operating systems.
    </p>
  </div>

  <div class="section">
<div class="titlepage"><div><div><h3 class="title">
<a name="relnotes_license"></a>License Change</h3></div></div></div>
    <p>
      With the release of BIND 9.11.0, ISC changed to the open
      source license for BIND from the ISC license to the Mozilla
      Public License (MPL 2.0).
    </p>
    <p>
      The MPL-2.0 license requires that if you make changes to
      licensed software (e.g. BIND) and distribute them outside
      your organization, that you publish those changes under that
      same license. It does not require that you publish or disclose
      anything other than the changes you made to our software.
    </p>
    <p>
Tinderbox User's avatar
Tinderbox User committed
60 61 62 63 64
      This requirement will not affect anyone who is using BIND, with
      or without modifications, without redistributing it, nor anyone
      redistributing it without changes. Therefore, this change will be
      without consequence for most individuals and organizations who are
      using BIND.
Tinderbox User's avatar
Tinderbox User committed
65 66 67 68 69 70 71 72 73 74 75
    </p>
    <p>
      Those unsure whether or not the license change affects their
      use of BIND, or who wish to discuss how to comply with the
      license may contact ISC at <a class="link" href="https://www.isc.org/mission/contact/" target="_top">
      https://www.isc.org/mission/contact/</a>.
    </p>
  </div>

  <div class="section">
<div class="titlepage"><div><div><h3 class="title">
Tinderbox User's avatar
Tinderbox User committed
76
<a name="win_support"></a>Legacy Windows No Longer Supported</h3></div></div></div>
Tinderbox User's avatar
Tinderbox User committed
77
    <p>
Tinderbox User's avatar
Tinderbox User committed
78 79
      As of BIND 9.11.2, Windows XP and Windows 2003 are no longer supported
      platforms for BIND; "XP" binaries are no longer available for download
Tinderbox User's avatar
Tinderbox User committed
80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107
      from ISC.
    </p>
  </div>

  <div class="section">
<div class="titlepage"><div><div><h3 class="title">
<a name="relnotes_security"></a>Security Fixes</h3></div></div></div>
    <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
	<p>
	  None.
	</p>
      </li></ul></div>
  </div>

  <div class="section">
<div class="titlepage"><div><div><h3 class="title">
<a name="relnotes_features"></a>New Features</h3></div></div></div>
    <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
<li class="listitem">
	<p>
	  Many aspects of <span class="command"><strong>named</strong></span> have been modified
	  to improve query performance, and in particular, performance
	  for delegation-heavy zones:
	</p>
	<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: circle; ">
<li class="listitem">
	    <p>
	      The additional cache ("acache") was found not to
Tinderbox User's avatar
Tinderbox User committed
108 109 110 111 112 113
	      significantly improve performance and has been removed.
	      As a result, the <span class="command"><strong>acache-enable</strong></span> and
	      <span class="command"><strong>acache-cleaning-interval</strong></span> options no longer
	      have any effect. For backwards compatibility, BIND will
	      accept their presence in a configuration file, but
	      will log a warning.
Tinderbox User's avatar
Tinderbox User committed
114 115 116 117 118 119 120 121 122 123 124 125
	    </p>
	  </li>
<li class="listitem">
	    <p>
	      In place of the acache, <span class="command"><strong>named</strong></span> can now use
	      a glue cache to speed up retrieval of glue records when sending
	      delegation responses.  Unlike acache, this feature is on by
	      default; use <span class="command"><strong>glue-cache no;</strong></span> to disable it.
	    </p>
	  </li>
<li class="listitem">
	    <p>
Tinderbox User's avatar
Tinderbox User committed
126 127
	      <span class="command"><strong>minimal-responses</strong></span> is now set
	      to <code class="literal">no-auth-recursive</code> by default.
Tinderbox User's avatar
Tinderbox User committed
128 129 130 131
	    </p>
	  </li>
<li class="listitem">
	    <p>
Tinderbox User's avatar
Tinderbox User committed
132 133 134 135
	      The <span class="command"><strong>additional-from-cache</strong></span>
	      and <span class="command"><strong>additional-from-auth</strong></span> options no longer
	      have any effect. <span class="command"><strong>named</strong></span> will log a warning
	      if they are set.
Tinderbox User's avatar
Tinderbox User committed
136 137 138 139 140 141 142 143 144
	    </p>
	  </li>
<li class="listitem">
	    <p>
	      Several functions have been refactored to improve
	      performance, including name compression, owner name
	      case restoration, hashing, and buffers.
	    </p>
	  </li>
Tinderbox User's avatar
Tinderbox User committed
145 146 147 148 149 150 151 152 153 154 155 156
<li class="listitem">
	    <p>
	      When built with default <span class="command"><strong>configure</strong></span> options,
	      <span class="command"><strong>named</strong></span> no longer fills memory with tag
	      values when allocating or freeing it. This improves performance,
	      but makes it more difficult to debug certain memory-related
	      errors. The default is reversed if building with developer
	      options. <span class="command"><strong>named -M fill</strong></span> or
	      <span class="command"><strong>named -M nofill</strong></span> will set the behavior
	      accordingly regardless of build options.
	    </p>
	  </li>
Tinderbox User's avatar
Tinderbox User committed
157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193
</ul></div>
      </li>
<li class="listitem">
	<p>
	  Several areas of code have been refactored for improved
	  readability, maintainability, and testability:
	</p>
	<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: circle; ">
<li class="listitem">
	    <p>
	      The <span class="command"><strong>named</strong></span> query logic implemented in
	      <span class="command"><strong>query_find()</strong></span> has been split into
	      smaller functions with a context structure to maintain state
	      between them, and extensive comments have been added.
	      [RT #43929]
	    </p>
	  </li>
<li class="listitem">
	    <p>
	      Similarly the iterative query logic implemented in
	      <span class="command"><strong>resquery_response()</strong></span> function has been
	      split into smaller functions and comments added. [RT #45362]
	    </p>
	  </li>
</ul></div>
      </li>
<li class="listitem">
	<p>
	  Code implementing name server query processing has been moved
	  from <span class="command"><strong>named</strong></span> to an external library,
	  <span class="command"><strong>libns</strong></span>. This will make it easier to
	  write unit tests for the code, or to link it into new tools.
	  [RT #45186]
	</p>
      </li>
<li class="listitem">
	<p>
Tinderbox User's avatar
Tinderbox User committed
194 195 196 197 198 199 200 201 202 203 204
	  <span class="command"><strong>named</strong></span> can now synthesize negative responses
	  (NXDOMAIN, NODATA, or wildcard answers) from cached DNSSEC-verified
	  records that were returned in negative or wildcard responses from
	  authoritative servers.
	</p>
	<p>
	  This will reduce query loads on authoritative servers for signed
	  domains: when existing cached records can be used by the resolver
	  to determine that a name does not exist in the authorittive domain,
	  no query needs to be sent. Reducing the number of iterative queries
	  should also improve resolver performance.
Tinderbox User's avatar
Tinderbox User committed
205 206 207 208 209 210 211
	</p>
	<p>
	  This behavior is controlled by the new
	  <code class="filename">named.conf</code> option
	  <span class="command"><strong>synth-from-dnssec</strong></span>.  It is enabled by
	  default.
	</p>
Tinderbox User's avatar
Tinderbox User committed
212 213 214 215 216
	<p>
	  Note: this currently only works for zones signed using NSEC.
	  Support for zones signed using NSEC3 (without opt-out) is
	  planned for the future.
	</p>
Tinderbox User's avatar
Tinderbox User committed
217
	<p>
Tinderbox User's avatar
Tinderbox User committed
218 219 220 221 222 223 224 225 226 227 228 229
	  Thanks to APNIC for sponsoring this work.
	</p>
      </li>
<li class="listitem">
	<p>
	  When acting as a recursive resolver, <span class="command"><strong>named</strong></span>
	  can now continue returning answers whose TTLs have expired
	  when the authoritative server is under attack and unable to
	  respond. This is controlled by the
	  <span class="command"><strong>stale-answer-enable</strong></span>,
	  <span class="command"><strong>stale-answer-ttl</strong></span> and
	  <span class="command"><strong>max-stale-ttl</strong></span> options. [RT #44790]
Tinderbox User's avatar
Tinderbox User committed
230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293
	</p>
      </li>
<li class="listitem">
	<p>
	  The DNS Response Policy Service (DNSRPS) API, a mechanism to
	  allow <span class="command"><strong>named</strong></span> to use an external response policy
	  provider, is now supported. (One example of such a provider is
	  "FastRPZ" from Farsight Security, Inc.) This allows the same
	  types of policy filtering as standard RPZ, but can reduce the
	  workload for <span class="command"><strong>named</strong></span>, particularly when using
	  large and frequently-updated policy zones. It also enables
	  <span class="command"><strong>named</strong></span> to share response policy providers
	  with other DNS implementations such as Unbound.
	</p>
	<p>
	  This feature is avaiable if BIND is built with
	  <span class="command"><strong>configure --enable-dnsrps</strong></span>, if a DNSRPS
	  provider is installed, and if <span class="command"><strong>dnsrps-enable</strong></span>
	  is set to "yes" in <code class="filename">named.conf</code>. Standard
	  built-in RPZ is used otherwise.
	</p>
	<p>
	  Thanks to Vernon Schryver and Farsight Security for the
	  contribution. [RT #43376]
	</p>
      </li>
<li class="listitem">
	<p>
	  Setting <span class="command"><strong>max-journal-size</strong></span> to
	  <code class="literal">default</code> limits journal sizes to twice the
	  size of the zone contents.  This can be overridden by setting
	  <span class="command"><strong>max-journal-size</strong></span> to <code class="literal">unlimited</code>
	  or to an explicit value up to 2G. Thanks to Tony Finch for
	  the contribution. [RT #38324]
	</p>
      </li>
<li class="listitem">
	<p>
	  <span class="command"><strong>dnstap</strong></span> logfiles can now be configured to
	  automatically roll when they reach a specified size. If
	  <span class="command"><strong>dnstap-output</strong></span> is configured with mode
	  <code class="literal">file</code>, then it can take optional
	  <span class="command"><strong>size</strong></span> and <span class="command"><strong>versions</strong></span>
	  key-value arguments to set the logfile rolling parameters.
	  (These have the same semantics as the corresponding
	  options in a <span class="command"><strong>logging</strong></span> channel statement.)
	  [RT #44502]
	</p>
      </li>
<li class="listitem">
	<p>
	  Logging channels and <span class="command"><strong>dnstap-output</strong></span> files can
	  now be configured with a <span class="command"><strong>suffix</strong></span> option,
	  set to either <code class="literal">increment</code> or
	  <code class="literal">timestamp</code>, indicating whether log files
	  should be given incrementing suffixes when they roll
	  over (e.g., <code class="filename">logfile.0</code>,
	  <code class="filename">.1</code>, <code class="filename">.2</code>, etc)
	  or suffixes indicating the time of the roll. The default
	  is <code class="literal">increment</code>.  [RT #42838]
	</p>
      </li>
<li class="listitem">
	<p>
Tinderbox User's avatar
Tinderbox User committed
294 295
	  The <span class="command"><strong>print-time</strong></span> option in the
	  <span class="command"><strong>logging</strong></span> configuration can now take arguments
Tinderbox User's avatar
Tinderbox User committed
296 297 298 299 300 301 302
	  <strong class="userinput"><code>local</code></strong>, <strong class="userinput"><code>iso8601</code></strong> or
	  <strong class="userinput"><code>iso8601-utc</code></strong> to indicate the format in
	  which the date and time should be logged. For backward
	  compatibility, <strong class="userinput"><code>yes</code></strong> is a synonym for
	  <strong class="userinput"><code>local</code></strong>.  [RT #42585]
	</p>
      </li>
Tinderbox User's avatar
Tinderbox User committed
303 304 305 306 307 308 309
<li class="listitem">
	<p>
	  The new <span class="command"><strong>dnssec-cds</strong></span> command generates a new DS
	  set to place in a parent zone, based on the contents of a child
	  zone's validated CDS or CDNSKEY records. It can produce a
	  <code class="filename">dsset</code> file suitable for input to
	  <span class="command"><strong>dnssec-signzone</strong></span>, or a series of
Tinderbox User's avatar
Tinderbox User committed
310 311 312
	  <span class="command"><strong>nsupdate</strong></span> commands to update the parent zone
	  via dynamic DNS. Thanks to Tony Finch for the contribution.
	  [RT #46090]
Tinderbox User's avatar
Tinderbox User committed
313 314
	</p>
      </li>
Tinderbox User's avatar
Tinderbox User committed
315 316
<li class="listitem">
	<p>
Tinderbox User's avatar
Tinderbox User committed
317
	  <span class="command"><strong>nsupdate</strong></span> and <span class="command"><strong>rndc</strong></span> now accept
Tinderbox User's avatar
Tinderbox User committed
318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408
	  command line options <span class="command"><strong>-4</strong></span> and <span class="command"><strong>-6</strong></span>
	  which force using only IPv4 or only IPv6, respectively. [RT #45632]
	</p>
      </li>
<li class="listitem">
	<p>
	  <span class="command"><strong>nsec3hash -r</strong></span> ("rdata order") takes arguments
	  in the same order as they appear in NSEC3 or NSEC3PARAM records.
	  This makes it easier to generate an NSEC3 hash using values cut
	  and pasted from an existing record. Thanks to Tony Finch for
	  the contribution. [RT #45183]
	</p>
      </li>
<li class="listitem">
	<p>
	  The <span class="command"><strong>new-zones-directory</strong></span> option allows
	  <span class="command"><strong>named</strong></span> to store configuration parameters
	  for zones added via <span class="command"><strong>rndc addzone</strong></span> in a
	  location other than the working directory. Thanks to Petr
	  Men&#353;ík of Red Hat for the contribution.
	  [RT #44853]
	</p>
      </li>
<li class="listitem">
	<p>
	  The <span class="command"><strong>dnstap-read -x</strong></span> option prints a hex
	  dump of the wire format DNS message encapsulated in each
	  <span class="command"><strong>dnstap</strong></span> log entry. [RT #44816]
	</p>
      </li>
<li class="listitem">
	<p>
	  The <span class="command"><strong>host -A</strong></span> option returns most
	  records for a name, but omits types RRSIG, NSEC and NSEC3.
	</p>
      </li>
<li class="listitem">
	<p>
	  <span class="command"><strong>dig +ednsopt</strong></span> now accepts the names
	  for EDNS options in addition to numeric values. For example,
	  an EDNS Client-Subnet option could be sent using
	  <span class="command"><strong>dig +ednsopt=ecs:...</strong></span>. Thanks to
	  John Worley of Secure64 for the contribution. [RT #44461]
	</p>
      </li>
<li class="listitem">
	<p>
	  Added support for the EDNS TCP Keepalive option (RFC 7828);
	  this allows negotiation of longer-lived TCP sessions
	  to reduce the overhead of setting up TCP for individual
	  queries. [RT #42126]
	</p>
      </li>
<li class="listitem">
	<p>
	  Added support for the EDNS Padding option (RFC 7830),
	  which obfuscates packet size analysis when DNS queries
	  are sent over an encrypted channel. [RT #42094]
	</p>
      </li>
<li class="listitem">
	<p>
	  <span class="command"><strong>rndc</strong></span> commands which refer to zone names
	  can now reference a zone of type <span class="command"><strong>redirect</strong></span>
	  by using the special zone name "-redirect". (Previously this
	  was not possible because <span class="command"><strong>redirect</strong></span> zones
	  always have the name ".", which can be ambiguous.)
	</p>
	<p>
	  In the event you need to manipulate a zone actually
	  called "-redirect", use a trailing dot: "-redirect."
	</p>
	<p>
	  Note: This change does not appply to the
	  <span class="command"><strong>rndc addzone</strong></span> or
	  <span class="command"><strong>rndc modzone</strong></span> commands.
	</p>
      </li>
<li class="listitem">
	<p>
	  <span class="command"><strong>named-checkconf -l</strong></span> lists the zones found
	  in <code class="filename">named.conf</code>. [RT #43154]
	</p>
      </li>
<li class="listitem">
	<p>
	  Query logging now includes the ECS option, if one was
	  present in the query, in the format
	  "[ECS <em class="replaceable"><code>address/source/scope</code></em>]".
	</p>
      </li>
Tinderbox User's avatar
Tinderbox User committed
409 410
<li class="listitem">
	<p>
Tinderbox User's avatar
Tinderbox User committed
411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432
	  By default, BIND now uses the random number generation functions
	  in the cryptographic library (i.e., OpenSSL or a PKCS#11
	  provider) as a source of high-quality randomness rather than
	  <code class="filename">/dev/random</code>.  This is suitable for virtual
	  machine environments, which may have limited entropy pools and
	  lack hardware random number generators.
	</p>
	<p>
	  This can be overridden by specifying another entropy source via
	  the <span class="command"><strong>random-device</strong></span> option in
	  <code class="filename">named.conf</code>, or via the <span class="command"><strong>-r</strong></span>
	  command line option.  However, for functions requiring full
	  cryptographic strength, such as DNSSEC key generation, this
	  <span class="emphasis"><em>cannot</em></span> be overridden. In particular, the
	  <span class="command"><strong>-r</strong></span> command line option no longer has any
	  effect on <span class="command"><strong>dnssec-keygen</strong></span>.
	</p>
	<p>
	  This can be disabled by building with
	  <span class="command"><strong>configure --disable-crypto-rand</strong></span>, in which
	  case <code class="filename">/dev/random</code> will be the default
	  entropy source.  [RT #31459] [RT #46047]
Tinderbox User's avatar
Tinderbox User committed
433 434
	</p>
      </li>
Tinderbox User's avatar
Tinderbox User committed
435 436 437 438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 453 454 455 456 457 458 459 460
<li class="listitem">
	<p>
	  <span class="command"><strong>rndc managed-keys destroy</strong></span> shuts down all
	  RFC 5011 DNSSEC trust anchor maintenance, and deletes any
	  existing managed keys database. If immediately followed by
	  <span class="command"><strong>rndc reconfig</strong></span>, this will reinitialize
	  key maintenance just as if the server was being started for
	  the first time.
	</p>
	<p>
	  This is intended for testing purposes, but can be used -- with
	  extreme caution -- as a brute-force repair for unrecoverable
	  problems with a managed keys database, to jumpstart the key
	  acquisition process if <code class="filename">bind.keys</code> is updated,
	  etc. [RT #32456]
	</p>
      </li>
<li class="listitem">
	<p>
	  <span class="command"><strong>dnssec-signzone -S</strong></span> can now add or remove
	  synchronization records (CDS and CDNSKEY) based on key metadata
	  set by the <span class="command"><strong>-Psync</strong></span> and <span class="command"><strong>-Dsync</strong></span>
	  options to <span class="command"><strong>dnssec-keygen</strong></span>,
	  <span class="command"><strong>dnssec-settime</strong></span>, etc. [RT #46149]
	</p>
      </li>
Tinderbox User's avatar
Tinderbox User committed
461 462 463 464 465 466 467 468
<li class="listitem">
	<p>
	  <span class="command"><strong>dnssec-checkds -s</strong></span> specifies a file from
	  which to read a DS set rather than querying the parent zone.
	  This can be used to check zone correctness prior to
	  publication. Thanks to Niall O'Reilly [RT #44667]
	</p>
      </li>
Tinderbox User's avatar
Tinderbox User committed
469 470 471 472 473
</ul></div>
  </div>

  <div class="section">
<div class="titlepage"><div><div><h3 class="title">
Tinderbox User's avatar
Tinderbox User committed
474 475 476 477
<a name="relnotes_removed"></a>Removed Features</h3></div></div></div>
    <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
<li class="listitem">
	<p>
Tinderbox User's avatar
Tinderbox User committed
478 479 480 481 482 483 484
	  The ISC DNSSEC Lookaside Validation (DLV) service has
	  been shut down; all DLV records in the dlv.isc.org zone
	  have been removed.  References to the service have been
	  removed from BIND documentation.  Lookaside validation
	  is no longer used by default by <span class="command"><strong>delv</strong></span>.
	  The DLV key has been removed from <code class="filename">bind.keys</code>.
	  Setting <span class="command"><strong>dnssec-lookaside</strong></span> to
Tinderbox User's avatar
Tinderbox User committed
485
	  <span class="command"><strong>auto</strong></span> or to use dlv.isc.org as a trust
Tinderbox User's avatar
Tinderbox User committed
486
	  anchor results in a warning being issued.
Tinderbox User's avatar
Tinderbox User committed
487 488 489 490
	</p>
      </li>
<li class="listitem">
	<p>
Tinderbox User's avatar
Tinderbox User committed
491 492 493 494 495 496
	  As noted above, the <span class="command"><strong>acache-enable</strong></span>,
	  <span class="command"><strong>acache-cleaning-interval</strong></span>,
	  <span class="command"><strong>additional-from-cache</strong></span> and
	  <span class="command"><strong>additional-from-auth</strong></span> options are no longer
	  effective and <span class="command"><strong>named</strong></span> will log a warning if
	  they are set.
Tinderbox User's avatar
Tinderbox User committed
497 498
	</p>
      </li>
Tinderbox User's avatar
Tinderbox User committed
499 500 501 502 503 504 505 506 507 508 509 510 511 512 513
<li class="listitem">
	<p>
	  The use of <span class="command"><strong>dnssec-keygen</strong></span> to generate
	  HMAC keys for TSIG authentication has been deprecated in favor
	  of <span class="command"><strong>tsig-keygen</strong></span>. If the algorithms HMAC-MD5,
	  HMAC-SHA1, HMAC-SHA224, HMAC-SHA256, HMAC-SHA384, or
	  HMAC-SHA512 are specified, <span class="command"><strong>dnssec-keygen</strong></span>
	  will print a warning message. These algorithms will be
	  removed from <span class="command"><strong>dnssec-keygen</strong></span> entirely in
	  a future release. [RT #42272]
	</p>
      </li>
<li class="listitem">
	<p>
	  The use of HMAC-MD5 for RNDC keys is no longer recommended.
Tinderbox User's avatar
Tinderbox User committed
514
	  The default algorithm generated by <span class="command"><strong>rndc-confgen</strong></span>
Tinderbox User's avatar
Tinderbox User committed
515
	  is now HMAC-SHA256. [RT #42272]
Tinderbox User's avatar
Tinderbox User committed
516 517 518 519 520 521 522 523
	</p>
      </li>
<li class="listitem">
	<p>
	  The <span class="command"><strong>isc-hmac-fixup</strong></span> command, which was created
	  to address an interoperability problem in TSIG keys between
	  early versions of BIND and other DNS implmentations, is now
	  obsolete and has been removed. [RT #46411]
Tinderbox User's avatar
Tinderbox User committed
524 525
	</p>
      </li>
Tinderbox User's avatar
Tinderbox User committed
526 527 528 529 530
</ul></div>
  </div>

  <div class="section">
<div class="titlepage"><div><div><h3 class="title">
Tinderbox User's avatar
Tinderbox User committed
531 532 533 534 535 536 537 538 539
<a name="proto_changes"></a>Protocol Changes</h3></div></div></div>
    <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
<li class="listitem">
	<p>
	  BIND can now use the Ed25519 and Ed448 Edwards Curve DNSSEC
	  signing algorithms described in RFC 8080. Note, however, that
	  these algorithms must be supported in OpenSSL;
	  currently they are only available in the development branch
	  of OpenSSL at
Tinderbox User's avatar
Tinderbox User committed
540 541
	  <a class="link" href="https://github.com/openssl/openssl" target="_top">
	    https://github.com/openssl/openssl</a>.
Tinderbox User's avatar
Tinderbox User committed
542 543 544 545 546
	  [RT #44696]
	</p>
      </li>
<li class="listitem">
	<p>
Tinderbox User's avatar
Tinderbox User committed
547 548 549 550
	  When parsing DNS messages, EDNS KEY TAG options are checked
	  for correctness. When printing messages (for example, in
	  <span class="command"><strong>dig</strong></span>), EDNS KEY TAG options are printed
	  in readable format.
Tinderbox User's avatar
Tinderbox User committed
551 552 553 554 555 556 557 558 559
	</p>
      </li>
</ul></div>
  </div>

  <div class="section">
<div class="titlepage"><div><div><h3 class="title">
<a name="relnotes_changes"></a>Feature Changes</h3></div></div></div>
    <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
Tinderbox User's avatar
Tinderbox User committed
560 561 562 563 564 565 566 567
<li class="listitem">
	<p>
	  The ISC DNSSEC Lookaside Validation (DLV) service has been shut
	  down; all DLV records in the dlv.isc.org zone have been removed.
	  References to the service have been removed from BIND documentation.
	  Lookaside validation is no longer used by default by
	  <span class="command"><strong>delv</strong></span>. The DLV key has been removed from
	  <code class="filename">bind.keys</code>. Setting
Tinderbox User's avatar
Tinderbox User committed
568
	  <span class="command"><strong>dnssec-lookaside</strong></span> to
Tinderbox User's avatar
Tinderbox User committed
569 570 571 572
	  <span class="command"><strong>auto</strong></span> or to use dlv.isc.org as a trust
	  anchor is now a fatal configuration error. [RT #46155]
	</p>
      </li>
Tinderbox User's avatar
Tinderbox User committed
573 574 575 576 577 578 579 580 581
<li class="listitem">
	<p>
	  <span class="command"><strong>named</strong></span> will no longer start or accept
	  reconfiguration if the working directory (specified by the
	  <span class="command"><strong>directory</strong></span> option) or the managed-keys
	  directory (specified by <span class="command"><strong>managed-keys-directory</strong></span>
	  are not writable by the effective user ID. [RT #46077]
	</p>
      </li>
Tinderbox User's avatar
Tinderbox User committed
582 583 584 585 586 587 588 589 590 591
<li class="listitem">
	<p>
	  Initializing keys specified in a <span class="command"><strong>managed-keys</strong></span>
	  statement or by <span class="command"><strong>dnssec-validation auto;</strong></span> are
	  now tagged as "initializing", until they have been updated by a
	  key refresh query. If key maintenance fails to initialize,
	  this will be visible when running <span class="command"><strong>rndc secroots</strong></span>.
	  [RT #46267]
	</p>
      </li>
Tinderbox User's avatar
Tinderbox User committed
592 593 594 595 596 597 598 599 600
<li class="listitem">
	<p>
	  Previously, <span class="command"><strong>update-policy local;</strong></span> accepted
	  updates from any source so long as they were signed by the
	  locally-generated session key. This has been further restricted;
	  updates are now only accepted from locally configured addresses.
	  [RT #45492]
	</p>
      </li>
Tinderbox User's avatar
Tinderbox User committed
601 602 603 604 605 606 607 608 609 610
<li class="listitem">
	<p>
	  The lightweight resolver daemon and library (<span class="command"><strong>lwresd</strong></span>
	  and <span class="command"><strong>liblwres</strong></span>) have been removed. [RT #45186]
	</p>
      </li>
<li class="listitem">
	<p>
	  <span class="command"><strong>dnssec-keygen</strong></span> no longer has default
	  algorithm settings. It is necessary to explicitly specify the
Tinderbox User's avatar
Tinderbox User committed
611
	  algorithm on the command line with the <span class="command"><strong>-a</strong></span> option
Tinderbox User's avatar
Tinderbox User committed
612 613 614 615 616 617 618 619 620 621 622 623 624 625 626 627 628 629 630 631 632 633 634 635 636 637 638 639 640 641 642 643 644 645 646
	  when generating keys. This may cause errors with existing signing
	  scripts if they rely on current defaults. The intent is to
	  reduce the long-term cost of transitioning to newer algorithms in
	  the event of RSASHA1 being deprecated. [RT #44755]
	</p>
      </li>
<li class="listitem">
	<p>
	  <span class="command"><strong>dig +sigchase</strong></span> and related options
	  <span class="command"><strong>+trusted-keys</strong></span> and <span class="command"><strong>+topdown</strong></span>
	  have been removed. <span class="command"><strong>delv</strong></span> is now the recommended
	  command for looking up records with DNSSEC validation.
	  [RT #42793]
	</p>
      </li>
<li class="listitem">
	<p>
	  The Response Policy Zone (RPZ) implementation has been
	  substantially refactored: updates to the RPZ summary
	  database are no longer directly performed by the zone
	  database but by a separate function that is called when
	  a policy zone is updated.  This improves both performance
	  and reliability when policy zones receive frequent updates.
	  Summary database updates can be rate-limited by using the
	  <span class="command"><strong>min-update-interval</strong></span> option in a
	  <span class="command"><strong>response-policy</strong></span> statement. [RT #43449]
	</p>
      </li>
<li class="listitem">
	<p>
	  <span class="command"><strong>dnstap</strong></span> now stores both the local and remote
	  addresses for all messages, instead of only the remote address.
	  The default output format for <span class="command"><strong>dnstap-read</strong></span> has
	  been updated to include these addresses, with the initiating
	  address first and the responding address second, separated by
Tinderbox User's avatar
Tinderbox User committed
647
	  "-&gt;" or "&lt;-" to indicate in which direction the message
Tinderbox User's avatar
Tinderbox User committed
648 649 650 651 652 653 654 655 656 657 658 659 660 661 662 663 664 665 666 667 668 669 670 671 672 673 674 675 676 677 678 679 680 681 682 683 684 685 686 687 688 689
	  was sent. [RT #43595]
	</p>
      </li>
<li class="listitem">
	<p>
	  Expanded and improved the YAML output from
	  <span class="command"><strong>dnstap-read -y</strong></span>: it now includes packet
	  size and a detailed breakdown of message contents.
	  [RT #43622] [RT #43642]
	</p>
      </li>
<li class="listitem">
	<p>
	  Threads in <span class="command"><strong>named</strong></span> are now set to human-readable
	  names to assist debugging on operating systems that support that.
	  Threads will have names such as "isc-timer", "isc-sockmgr",
	  "isc-worker0001", and so on. This will affect the reporting of
	  subsidiary thread names in <span class="command"><strong>ps</strong></span> and
	  <span class="command"><strong>top</strong></span>, but not the main thread. [RT #43234]
	</p>
      </li>
<li class="listitem">
	<p>
	  If an ACL is specified with an address prefix in which the
	  prefix length is longer than the address portion (for example,
	  192.0.2.1/8), it will now be treated as a fatal error during
	  configuration. [RT #43367]
	</p>
      </li>
<li class="listitem">
	<p>
	  <span class="command"><strong>dig</strong></span> now warns about .local queries which are
	  reserved for Multicast DNS. [RT #44783]
	</p>
      </li>
<li class="listitem">
	<p>
	  The view associated with the query is now logged unless it
	  it is "_default/IN" or "_dnsclient/IN" when logging DNSSEC
	  validator messages.
	</p>
      </li>
Tinderbox User's avatar
Tinderbox User committed
690 691 692 693 694 695 696 697 698
<li class="listitem">
	<p>
	  When <span class="command"><strong>named</strong></span> was reconfigured, failure of some
	  zones to load correctly could leave the system in an inconsistent
	  state; while generally harmless, this could lead to a crash later
	  when using <span class="command"><strong>rndc addzone</strong></span>.  Reconfiguration changes
	  are now fully rolled back in the event of failure. [RT #45841]
	</p>
      </li>
Tinderbox User's avatar
Tinderbox User committed
699 700 701 702 703 704 705 706 707 708
<li class="listitem">
	<p>
	  Multiple <span class="command"><strong>cookie-secret</strong></span> clauses are now
	  supported.  The first <span class="command"><strong>cookie-secret</strong></span> in
	  <code class="filename">named.conf</code> is used to generate new
	  server cookies.  Any others are used to accept old server
	  cookies or those generated by other servers using the
	  matching <span class="command"><strong>cookie-secret</strong></span>.
	</p>
      </li>
Tinderbox User's avatar
Tinderbox User committed
709 710 711 712 713 714
<li class="listitem">
	<p>
	  A new statistics counter has been added to track prefetch
	  queries. [RT #45847]
	</p>
      </li>
Tinderbox User's avatar
Tinderbox User committed
715 716 717 718 719 720
<li class="listitem">
	<p>
	  A new statistics counter has been added to track priming
	  queries. [RT #46313]
	</p>
      </li>
Tinderbox User's avatar
Tinderbox User committed
721 722 723 724 725 726 727 728 729 730
<li class="listitem">
	<p>
	  The <span class="command"><strong>dnssec-signzone -x</strong></span> flag and the
	  <span class="command"><strong>dnssec-dnskey-kskonly</strong></span> option in
	  <span class="command"><strong>named.conf</strong></span>, which suppress the use of
	  the ZSK when signing DNSKEY records, now also apply to
	  CDNSKEY and CDS records. Thanks to Tony Finch for the
	  contribution. [RT #45689]
	</p>
      </li>
Tinderbox User's avatar
Tinderbox User committed
731 732 733 734 735 736 737 738
<li class="listitem">
	<p>
	  Trust anchor telemetry messages, as specified by
	  RFC 8145, are now logged to the
	  <span class="command"><strong>trust-anchor-telemetry</strong></span> logging
	  catagory.
	</p>
      </li>
Tinderbox User's avatar
Tinderbox User committed
739 740 741 742 743 744 745
<li class="listitem">
	<p>
	  The <span class="command"><strong>filter-aaaa-on-v4</strong></span> and
	  <span class="command"><strong>filter-aaaa-on-v6</strong></span> options are no longer
	  conditionally compiled in <span class="command"><strong>named</strong></span>. [RT #46340]
	</p>
      </li>
Tinderbox User's avatar
Tinderbox User committed
746 747 748 749 750 751
</ul></div>
  </div>

  <div class="section">
<div class="titlepage"><div><div><h3 class="title">
<a name="relnotes_bugs"></a>Bug Fixes</h3></div></div></div>
Tinderbox User's avatar
Tinderbox User committed
752
    <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
Tinderbox User's avatar
Tinderbox User committed
753 754 755 756 757 758 759 760
<li class="listitem">
	<p>
	  Zones created with <span class="command"><strong>rndc addzone</strong></span> could
	  temporarily fail to inherit the <span class="command"><strong>allow-transfer</strong></span>
	  ACL set in the <span class="command"><strong>options</strong></span> section of
	  <code class="filename">named.conf</code>. [RT #46603]
	</p>
      </li>
Tinderbox User's avatar
Tinderbox User committed
761 762 763 764 765 766 767 768
<li class="listitem">
	<p>
	  The introduction of <span class="command"><strong>libns</strong></span> caused a bug
	  in which TCP client objects were not recycled after use,
	  leading to unconstrained memory growth. [RT #46029]
	</p>
      </li>
<li class="listitem">
Tinderbox User's avatar
Tinderbox User committed
769 770 771 772 773 774 775 776
	<p>
	  Some header files included &lt;isc/util.h&gt; incorrectly as
	  it pollutes with namespace with non ISC_ macros and this should
	  only be done by explicitly including &lt;isc/util.h&gt;.  This
	  has been corrected.  Some code may depend on &lt;isc/util.h&gt;
	  being implicitly included via other header files.  Such
	  code should explicitly include &lt;isc/util.h&gt;.
	</p>
Tinderbox User's avatar
Tinderbox User committed
777
      </li>
Tinderbox User's avatar
Tinderbox User committed
778 779 780 781 782 783
<li class="listitem">
	<p>
	  <span class="command"><strong>named</strong></span> failed to properly determine whether
	  there were active KSK and ZSK keys for an algorithm when
	  <span class="command"><strong>update-check-ksk</strong></span> was true (which is the
	  default setting). This could leave records unsigned
Tinderbox User's avatar
Tinderbox User committed
784
	  when rolling keys. [RT #46743] [RT #46754] [RT #46774]
Tinderbox User's avatar
Tinderbox User committed
785 786
	</p>
      </li>
Tinderbox User's avatar
Tinderbox User committed
787
</ul></div>
Tinderbox User's avatar
Tinderbox User committed
788 789 790 791 792 793 794 795 796 797 798 799 800 801 802 803 804 805 806 807 808 809 810 811 812
  </div>

  <div class="section">
<div class="titlepage"><div><div><h3 class="title">
<a name="end_of_life"></a>End of Life</h3></div></div></div>
    <p>
      The end of life for BIND 9.12 is yet to be determined but
      will not be before BIND 9.14.0 has been released for 6 months.
      <a class="link" href="https://www.isc.org/downloads/software-support-policy/" target="_top">https://www.isc.org/downloads/software-support-policy/</a>
    </p>
  </div>
  <div class="section">
<div class="titlepage"><div><div><h3 class="title">
<a name="relnotes_thanks"></a>Thank You</h3></div></div></div>

    <p>
      Thank you to everyone who assisted us in making this release possible.
      If you would like to contribute to ISC to assist us in continuing to
      make quality open source software, please visit our donations page at
      <a class="link" href="http://www.isc.org/donate/" target="_top">http://www.isc.org/donate/</a>.
    </p>
  </div>
</div>
</div></body>
</html>