aboutsummaryrefslogtreecommitdiff
path: root/contrib/bind9/RELEASE-NOTES-BIND-9.8.1.html
diff options
context:
space:
mode:
authorDoug Barton <dougb@FreeBSD.org>2012-04-12 01:53:33 +0000
committerDoug Barton <dougb@FreeBSD.org>2012-04-12 01:53:33 +0000
commit3ad4cbcf209fbd503ddaa0aa51895e0bdb6aabe1 (patch)
treec0e039e74256b5df7614b487a257ee23f628e135 /contrib/bind9/RELEASE-NOTES-BIND-9.8.1.html
parentb517176ad9c080a4370d93b255cc3fa2d6b0504b (diff)
parentef021ab32c96f04b817db934ad74cc24cf4285ef (diff)
downloadsrc-3ad4cbcf209fbd503ddaa0aa51895e0bdb6aabe1.tar.gz
src-3ad4cbcf209fbd503ddaa0aa51895e0bdb6aabe1.zip
The BIND 9.8.2 tarball was re-rolled to remove 9.8.1 release notes.
This change was noticed by ISC at: https://lists.isc.org/pipermail/bind-users/2012-April/087345.html and verified by me both by comparing the contents of the old and new distfiles and by verifying the PGP signature on the new distfile.
Notes
Notes: svn path=/head/; revision=234165
Diffstat (limited to 'contrib/bind9/RELEASE-NOTES-BIND-9.8.1.html')
-rw-r--r--contrib/bind9/RELEASE-NOTES-BIND-9.8.1.html368
1 files changed, 0 insertions, 368 deletions
diff --git a/contrib/bind9/RELEASE-NOTES-BIND-9.8.1.html b/contrib/bind9/RELEASE-NOTES-BIND-9.8.1.html
deleted file mode 100644
index c4deae43a9cf..000000000000
--- a/contrib/bind9/RELEASE-NOTES-BIND-9.8.1.html
+++ /dev/null
@@ -1,368 +0,0 @@
-<html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title></title><link rel="stylesheet" href="release-notes.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.71.1"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="article" lang="en"><div class="titlepage"><hr></div>
-
- <div class="section" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3359008"></a>Introduction</h2></div></div></div>
-
- <p>
- BIND 9.8.1 is the current production release of BIND 9.8.
- </p>
- <p>
- This document summarizes changes from BIND 9.8.0 to BIND 9.8.1.
- Please see the CHANGES file in the source code release for a
- complete list of all changes.
- </p>
- </div>
-
- <div class="section" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3359050"></a>Download</h2></div></div></div>
-
- <p>
- The latest versions of BIND 9 software can always be found
- on our web site at
- <a href="http://www.isc.org/downloads/all" target="_top">http://www.isc.org/downloads/all</a>.
- There you will find additional information about each
- release, source code, and some pre-compiled versions for certain operating systems.
- </p>
- </div>
-
- <div class="section" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2545549"></a>Support</h2></div></div></div>
-
- <p>Product support information is available on
- <a href="http://www.isc.org/services/support" target="_top">http://www.isc.org/services/support</a>
- for paid support options. Free support is provided by our user
- community via a mailing list. Information on all public email
- lists is available at
- <a href="https://lists.isc.org/mailman/listinfo" target="_top">https://lists.isc.org/mailman/listinfo</a>.
- </p>
- </div>
-
- <div class="section" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3358108"></a>New Features</h2></div></div></div>
-
- <div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3358149"></a>9.8.1</h3></div></div></div>
-
- <div class="itemizedlist"><ul type="disc"><li>
-Added a new include file with function typedefs
-for the DLZ "dlopen" driver. [RT #23629]
-</li><li>
-Added a tool able to generate malformed packets to allow testing
-of how named handles them.
-[RT #24096]
-</li><li>
-The root key is now provided in the file bind.keys allowing DNSSEC validation to be switched on at start up by adding "dnssec-validation auto;" to named.conf. If the root key provided has expired, named will log the expiration and validation will not work. More information and the most current copy of bind.keys can be found at http://www.isc.org/bind-keys. *Please note this feature was actually added in 9.8.0 but was not included in the 9.8.0 release notes. [RT #21727]
-</li></ul></div>
- </div>
- </div>
-
- <div class="section" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3358206"></a>Security Fixes</h2></div></div></div>
-
- <div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3358226"></a>9.8.1</h3></div></div></div>
-
- <div class="itemizedlist"><ul type="disc"><li>
-If named is configured with a response policy zone (RPZ) and a query
-of type RRSIG is received for a name configured for RRset replacement
-in that RPZ, it will trigger an INSIST and crash the server.
-RRSIG. [RT #24280]
-</li><li>
-named, set up to be a caching resolver, is vulnerable to a
-user querying a domain with very large resource record sets (RRSets)
-when trying to negatively cache the response. Due to an off-by-one
-error, caching the response could cause named to crash. [RT #24650]
-[CVE-2011-1910]
-</li><li>
-Using Response Policy Zone (RPZ) to query a wildcard CNAME label with
-QUERY type SIG/RRSIG, it can cause named to crash. Fix is query type
-independant.
-[RT #24715]
-</li><li>
-Using Response Policy Zone (RPZ) with DNAME records and querying the
-subdomain of that label can cause named to crash. Now logs that DNAME
-is not supported.
-[RT #24766]
-</li><li>
-Change #2912 populated the message section in replies to UPDATE requests,
-which some Windows clients wanted. This exposed a latent bug that allowed
-the response message to crash named. With this fix, change 2912 has been
-reduced to copy only the zone section to the reply. A more complete fix
-for the latent bug will be released later.
-[RT #24777]
-</li></ul></div>
- </div>
- </div>
-
-
- <div class="section" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3358283"></a>Feature Changes</h2></div></div></div>
-
- <div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3358291"></a>9.8.1</h3></div></div></div>
-
- <div class="itemizedlist"><ul type="disc"><li>
-Merged in the NetBSD ATF test framework (currently
-version 0.12) for development of future unit tests.
-Use configure --with-atf to build ATF internally
-or configure --with-atf=prefix to use an external
-copy. [RT #23209]
-</li><li>
-Added more verbose error reporting from DLZ LDAP. [RT #23402]
-</li><li>
-The DLZ "dlopen" driver is now built by default,
-no longer requiring a configure option. To
-disable it, use "configure --without-dlopen".
-(Note: driver not supported on win32.) [RT #23467]
-</li><li>
-Replaced compile time constant with STDTIME_ON_32BITS.
-[RT #23587]
-</li><li>
-Make --with-gssapi default for ./configure. [RT #23738]
-</li><li>
-Improved the startup time for an authoritative server with a large
-number of zones by making the zone task table of variable size
-rather than fixed size. This means that authoritative servers with
-lots of zones will be serving that zone data much sooner. [RT #24406]
-</li><li>
-Per RFC 6303, RFC 1918 reverse zones are now part of the built-in list of empty zones. [RT #24990]
-</li></ul></div>
- </div>
- </div>
- <div class="section" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3358460"></a>Bug Fixes</h2></div></div></div>
-
- <div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3358468"></a>9.8.1</h3></div></div></div>
-
- <div class="itemizedlist"><ul type="disc"><li>
-During RFC5011 processing some journal write errors were not detected.
-This could lead to managed-keys changes being committed but not
-recorded in the journal files, causing potential inconsistencies
-during later processing. [RT #20256]
-</li><li>
-A potential NULL pointer deference in the DNS64 code could cause
-named to terminate unexpectedly. [RT #20256]
-</li><li>
-A state variable relating to DNSSEC could fail to be set during
-some infrequently-executed code paths, allowing it to be used whilst
-in an unitialized state during cache updates, with unpredictable results.
-[RT #20256]
-</li><li>
-A potential NULL pointer deference in DNSSEC signing code could
-cause named to terminate unexpectedly [RT #20256]
-</li><li>
-Several cosmetic code changes were made to silence warnings
-generated by a static code analysis tool. [RT #20256]
-</li><li>
-When using the -x (sign with only KSK) option on dnssec-signzone,
-it could incorrectly count the number of ZSKs in the zone. (And in 9.9.0,
-some code cleanup and improved warning messages). [RT #20852]
-</li><li>
-When using _builtin in named.conf, named.conf changes were not found
-when reloading the config file. Now checks _builtin zone arguments
-to see if the zone is re-usable or not. [RT #21914]
-</li><li>
-Running dnssec-settime -f on an old-style key will
-now force the key to be rewritten to the new key format even if no
-other change has been specified, using "-P now -A now"
-as default values. [RT #22474]
-</li><li>
-After an external code review, a code cleanup was done. [RT #22521]
-</li><li>
-Cause named to terminate at startup or rndc reconfig
-reload to fail, if a log file specified in the
-conf file isn't a plain file. (RT #22771]
-</li><li>
-named now forces the ADB cache time for glue related data to zero
-instead of relying on TTL. This corrects problematic behavior in cases
-where a server was authoritative for the A record of a nameserver for a
-delegated zone and was queried to recursively resolve records within
-that zone. [RT #22842]
-</li><li>
-When a validating resolver got a NODATA response for DNSKEY, it was
-not caching the NODATA. Fixed and test added. [RT #22908]
-</li><li>
-Fixed a bug in which zone keys that were published
-and but not immediately activated, automatic signing could fail to trigger.
-[RT #22911]
-</li><li>
-Fixed precedence order bug with NS and DNAME records if both are present.
-(Also fixed timing of autosign test in 9.7+) [RT #23035]
-</li><li>
-When a DNSSEC signed dynamic zone's signatures need to be refreshed,
-named would first delete the old signatures in the zone. If a private
-key of the same algorithm isn't available to named, the signing would
-fail but the old signatures would already be deleted. named now checks
-if it can access the private key before deleting the old signatures and
-leaves the old signature if no private key is found. [RT #23136]
-</li><li>
-When using "auto-dnssec maintain" and rolling to a new key, a
-private-type record (only used internally by named) could be created
-and not marked as complete. [RT #23253]
-</li><li>
-Fixed last autosign test report. [RT #23256]
-</li><li>
-named didn't save gid at startup and later assumed gid 0.
-named now saves/restores the gid when creating creating
-named.pid at startup. [RT #23290]
-</li><li>
-If the server has an IPv6 address but does not have IPv6 connectivity
-to the internet, dig +trace could fail attempting to use IPv6
-addresses. [RT #23297]
-</li><li>
-If named is configured with managed zones, the managed key maint timer
-can exercise a race condition that can crash the server.
-[RT #23303]
-</li><li>
-Changing TTL did not cause dnssec-signzone to generate new signatures.
-[RT #23330]
-</li><li>
-Have the validating resolver use RRSIG original TTL to compute
-validated RRset and RRSIG TTL. [RT #23332]
-</li><li>
-In "make test" bin/tests/resolver, hold the socket manager lock
-while freeing the socket.
-[RT #23333]
-</li><li>
-If named encountered a CNAME instead of a DS record when walking
-the chain of trust down from the trust anchor, it incorrectly stopped
-validating. [RT #23338]
-</li><li>
-dns/view.h needed dns/rpz.h but it wasn't in the Makfile.in
-HEADERS variable. [RT #23342]
-</li><li>
-RRSIG records could have time stamps too far in the future.
-[RT #23356]
-</li><li>
-named stores cached data in an in-memory database and keeps track of
-how recently the data is used with a heap. The heap is stored within the
-cache's memory space. Under a sustained high query load and with a small
-cache size, this could lead to the heap exhausting the cache space. This
-would result in cache misses and SERVFAILs, with named never releasing
-the cache memory the heap used up and never recovering.
-
-This fix removes the heap into its own memory space, preventing the heap
-from exhausting the cache space and allowing named to recover gracefully
-when the high query load abates. [RT #23371]
-</li><li>
-Fully separated key management on a per view basis. [RT #23419]
-</li><li>
-If running on a powerpc CPU and with atomic operations enabled,
-named could lock up. Added sync instructions to the end of atomic
-operations. [RT #23469]
-</li><li>
-If OpenSSL was built without engine support, named would have
-compile errors and fail to build.
-[RT #23473]
-</li><li>
-If ./configure finds GOST but not elliptic curve, named fails to
-build. Added elliptic curve support check in GOST OpenSSL engine
-detection. [RT #23485]
-</li><li>
-"rndc secroots" would abort on the first error
-and so could miss remaining views. [RT #23488]
-</li><li>
-Handle isc_event_allocate failures in t_tasks test.
-[RT #23572]
-</li><li>
-ixfr-from-differences {master|slave};
-failed to select the master/slave zones, resulting in on diff/journal
-file being created.
-[RT #23580]
-</li><li>
-If a DNAME substitution failed, named returned NOERROR. The correct
-response should be YXDOMAIN.
-[RT #23591]
-</li><li>
-dns_dnssec_findzonekeys{2} used a inconsistant
-timestamp when determining which keys are active. This could result in
-some RRsets not being signed/re-signed.
-[RT #23642]
-</li><li>
-Remove bin/tests/system/logfileconfig/ns1/named.conf and
-add setup.sh in order to resolve changing named.conf issue. [RT #23687]
-</li><li>
-NOTIFY messages were not being sent when generating
-a NSEC3 chain incrementally. [RT #23702]
-</li><li>
-DDNS updates using SIG(0) with update-policy match
-type "external" could cause a crash. Also fixed nsupdate core
-dump on shutdown when using a SIG(0) key, due to the key
-not being freed. [RT #23735]
-</li><li>
-Zones using automatic key maintenance could fail to check the key
-repository for updates. named now checks once per hour and the
-automatic check bug has been fixed. [RT #23744]
-</li><li>
-named now uses the correct strtok/strtok_r/strtok_s based on OS.
-[RT #23747]
-</li><li>
-Signatures for records at the zone apex could go
-stale due to an incorrect timer setting. [RT #23769]
-</li><li>
-The autosign tests attempted to open ports within reserved ranges. Test
-now avoids those ports.
-[RT #23957]
-</li><li>
-GSS TGIS test was failing, since log_cred() caused KRB5_KTNAME to
-be cached. Now sets KRB5_KTNAME before calling log_cred() in
-dst_gssapi_acceptctx(). [RT #24004]
-</li><li>
-named, acting as authoritative server for DLZ zones, was not correctly
-setting the authoritative (AA) bit.
-[RT #24146]
-</li><li>
-Clean up some cross-compiling issues and added two undocumented
-configure options, --with-gost and --with-rlimtype, to allow over-riding
-default settings (gost=no and rlimtype="long int") when cross-compiling.
-[RT #24367]
-</li><li>
-When trying sign with NSEC3, if dnssec-signzone couldn't find the
-KSK, it would give an incorrect error "NSEC3 iterations too big for
-weakest DNSKEY strength" rather than the correct "failed to find
-keys at the zone apex: not found" [RT #24369]
-</li><li>
-Configuring 'dnssec-validation auto' in a view instead of in the
-options statement could trigger an assertion failure in named-checkconf.
-[RT #24382]
-</li><li>
-Improved consistency checks for dnssec-enable and
-dnssec-validation, added test cases to the
-checkconf system test. [RT #24398]
-</li><li>
-If named is configured to be both authoritative and recursive and receives
-a recursive query for a CNAME in a zone that it is authoritative for, if that
-CNAME also points to a zone the server is authoritative for, the recursive part of name will not follow the CNAME change and the response will not be a
-complete CNAME chain. [RT #24455]
-</li><li>
-nsupdate could dump core on shutdown when using SIG(0) keys. [RT #24604]
-</li><li>
-Named could fail to validate zones list in a DLV that validated insecure
-without using DLV and had DS records in the parent zone. [RT #24631]
-</li><li>
-dnssec-signzone now records timestamps just before and just after signing, improving the accuracy of signing statistics. [RT #16030]
-</li><li>
-If allow-new-zones was set to yes and name-based ACLs were used, named could crash when "rndc reconfig" was issued. [RT #22739]
-</li><li>
-RT #23136 fixed a problem where named would delete old signatures even
-when the private key wasn't available to re-sign the zone, resulting in
-a zone with missing signatures. This fix (CHANGES 3114) did not
-completely fix all issues. [RT #24577]
-</li><li>
-A bug in FreeBSD kernels causes IPv6 UDP responses greater than
-1280 bytes to not fragment as they should. Until there is a kernel
-fix, named will work around this by setting IPV6_USE_MIN_MTU on a
-per packet basis. [RT #24950]
-</li></ul></div>
- </div>
- </div>
-
- <div class="section" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3359134"></a>Known issues in this release</h2></div></div></div>
-
- <div class="itemizedlist"><ul type="disc"><li>
- <p>
- None.
- </p>
- </li></ul></div>
- </div>
-
- <div class="section" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3359152"></a>Thank You</h2></div></div></div>
-
- <p>
- Thank you to everyone who assisted us in making this release possible.
- If you would like to contribute to ISC to assist us in continuing to make
- quality open source software, please visit our donations page at
- <a href="http://www.isc.org/supportisc" target="_top">http://www.isc.org/supportisc</a>.
- </p>
- </div>
-</div></body></html>