Release Notes for BIND Version 9.12.0-pre-alpha

Introduction

BIND 9.12.0 is a new feature release of BIND, still under development. This document summarizes new features and functional changes that have been introduced on this branch. With each development release leading up to the final BIND 9.12.0 release, this document will be updated with additional features added and bugs fixed.

Download

The latest versions of BIND 9 software can always be found at http://www.isc.org/downloads/. There you will find additional information about each release, source code, and pre-compiled versions for Microsoft Windows operating systems.

License Change

With the release of BIND 9.11.0, ISC changed to the open source license for BIND from the ISC license to the Mozilla Public License (MPL 2.0).

The MPL-2.0 license requires that if you make changes to licensed software (e.g. BIND) and distribute them outside your organization, that you publish those changes under that same license. It does not require that you publish or disclose anything other than the changes you made to our software.

This new requirement will not affect anyone who is using BIND without redistributing it, nor anyone redistributing it without changes, therefore this change will be without consequence for most individuals and organizations who are using BIND.

Those unsure whether or not the license change affects their use of BIND, or who wish to discuss how to comply with the license may contact ISC at https://www.isc.org/mission/contact/.

Security Fixes

  • rndc "" could trigger an assertion failure in named. This flaw is disclosed in (CVE-2017-3138). [RT #44924]

  • Some chaining (i.e., type CNAME or DNAME) responses to upstream queries could trigger assertion failures. This flaw is disclosed in CVE-2017-3137. [RT #44734]

  • dns64 with break-dnssec yes; can result in an assertion failure. This flaw is disclosed in CVE-2017-3136. [RT #44653]

  • If a server is configured with a response policy zone (RPZ) that rewrites an answer with local data, and is also configured for DNS64 address mapping, a NULL pointer can be read triggering a server crash. This flaw is disclosed in CVE-2017-3135. [RT #44434]

  • A coding error in the nxdomain-redirect feature could lead to an assertion failure if the redirection namespace was served from a local authoritative data source such as a local zone or a DLZ instead of via recursive lookup. This flaw is disclosed in CVE-2016-9778. [RT #43837]

  • named could mishandle authority sections with missing RRSIGs, triggering an assertion failure. This flaw is disclosed in CVE-2016-9444. [RT #43632]

  • named mishandled some responses where covering RRSIG records were returned without the requested data, resulting in an assertion failure. This flaw is disclosed in CVE-2016-9147. [RT #43548]

  • named incorrectly tried to cache TKEY records which could trigger an assertion failure when there was a class mismatch. This flaw is disclosed in CVE-2016-9131. [RT #43522]

  • It was possible to trigger assertions when processing responses containing answers of type DNAME. This flaw is disclosed in CVE-2016-8864. [RT #43465]

  • Added the ability to specify the maximum number of records permitted in a zone (max-records #;). This provides a mechanism to block overly large zone transfers, which is a potential risk with slave zones from other parties, as described in CVE-2016-6170. [RT #42143]

New Features

  • Many aspects of named have been modified to improve query performance, and in particular, performance for delegation-heavy zones:

    • The additional cache ("acache") was found not to significantly improve performance and has been removed; the acache-enable and acache-cleaning-interval options are now deprecated.

    • In place of the acache, named now uses a glue cache to speed up retrieval of glue records when sending delegation responses.

    • The additional-from-cache and additional-from-auth options have been deprecated.

    • minimal-responses is now set to yes by default.

    • Several functions have been refactored to improve performance, including name compression, owner name case restoration, hashing, and buffers.

  • The dnstap-read -x option prints a hex dump of the wire format DNS message encapsulated in each dnstap log entry. [RT #44816]

  • The host -A option returns most records for a name, but omits types RRSIG, NSEC and NSEC3.

  • Query logic has been substantially refactored (e.g. query_find function has been split into smaller functions) for improved readability, maintainability and testability. [RT #43929]

  • dnstap logfiles can now be configured to automatically roll when they reach a specified size. If dnstap-output is configured with mode file, then it can take optional size and versions key-value arguments to set the logfile rolling parameters. (These have the same semantics as the corresponding options in a logging channel statement.) [RT #44502]

  • Logging channels and dnstap-output files can now be configured with a suffix option, set to either increment or timestamp, indicating whether log files should be given incrementing suffixes when they roll over (e.g., logfile.0, .1, .2, etc) or suffixes indicating the time of the roll. The default is increment. [RT #42838]

  • dig +ednsopt now accepts the names for EDNS options in addition to numeric values. For example, an EDNS Client-Subnet option could be sent using dig +ednsopt=ecs:.... Thanks to John Worley of Secure64 for the contribution. [RT #44461]

  • Added support for the EDNS TCP Keepalive option (RFC 7828); this allows negotiation of longer-lived TCP sessions to reduce the overhead of setting up TCP for individual queries. [RT #42126]

  • Added support for the EDNS Padding option (RFC 7830), which obfuscates packet size analysis when DNS queries are sent over an encrypted channel. [RT #42094]

  • The print-time option in the logging configuration can now take arguments local, iso8601 or iso8601-utc to indicate the format in which the date and time should be logged. For backward compatibility, yes is a synonym for local. [RT #42585]

  • rndc commands which refer to zone names can now reference a zone of type redirect by using the special zone name "-redirect". (Previously this was not possible because redirect zones always have the name ".", which can be ambiguous.)

    In the event you need to manipulate a zone actually called "-redirect", use a trailing dot: "-redirect."

    Note: This change does not appply to the rndc addzone or rndc modzone commands.

  • named-checkconf -l lists the zones found in named.conf. [RT #43154]

  • Query logging now includes the ECS option, if one was present in the query, in the format "[ECS address/source/scope]".

Feature Changes

  • Threads in named are now set to human-readable names to assist debugging on operating systems that support that. Threads will have names such as "isc-timer", "isc-sockmgr", "isc-worker0001", and so on. This will affect the reporting of subsidiary thread names in ps and top, but not the main thread. [RT #43234]

  • The Response Policy Zone (RPZ) implementation has been substantially refactored: updates to the RPZ summary database are no longer directly performed by the zone database but by a separate function that is called when a policy zone is updated. This improves both performance and reliability when policy zones receive frequent updates. Summary database updates can be rate-limited by using the min-update-interval option in a response-policy statement. [RT #43449]

  • dnstap now stores both the local and remote addresses for all messages, instead of only the remote address. The default output format for dnstap-read has been updated to include these addresses, with the initiating address first and the responding address second, separated by "-%gt;" or "%lt;-" to indicate in which direction the message was sent. [RT #43595]

  • Expanded and improved the YAML output from dnstap-read -y: it now includes packet size and a detailed breakdown of message contents. [RT #43622] [RT #43642]

  • If an ACL is specified with an address prefix in which the prefix length is longer than the address portion (for example, 192.0.2.1/8), it will now be treated as a fatal error during configuration. [RT #43367]

Bug Fixes

  • None.

End of Life

The end of life for BIND 9.12 is yet to be determined but will not be before BIND 9.14.0 has been released for 6 months. https://www.isc.org/downloads/software-support-policy/

Thank You

Thank you to everyone who assisted us in making this release possible. If you would like to contribute to ISC to assist us in continuing to make quality open source software, please visit our donations page at http://www.isc.org/donate/.