2022-01-20 11:20:03 +01:00
|
|
|
.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
|
|
|
|
..
|
|
|
|
|
.. SPDX-License-Identifier: MPL-2.0
|
|
|
|
|
..
|
|
|
|
|
.. This Source Code Form is subject to the terms of the Mozilla Public
|
|
|
|
|
.. License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
|
|
|
.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
|
|
|
|
..
|
|
|
|
|
.. See the COPYRIGHT file distributed with this work for additional
|
|
|
|
|
.. information regarding copyright ownership.
|
|
|
|
|
|
|
|
|
|
Notes for BIND 9.17.23
|
|
|
|
|
----------------------
|
|
|
|
|
|
|
|
|
|
Security Fixes
|
|
|
|
|
~~~~~~~~~~~~~~
|
|
|
|
|
|
2022-04-11 10:05:50 +02:00
|
|
|
- None.
|
2022-02-10 20:40:29 +00:00
|
|
|
|
2022-01-20 11:20:03 +01:00
|
|
|
Known Issues
|
|
|
|
|
~~~~~~~~~~~~
|
|
|
|
|
|
2022-02-21 10:25:41 +02:00
|
|
|
- According to RFC 8310, Section 8.1, the Subject field MUST NOT be
|
|
|
|
|
inspected when verifying a remote certificate while establishing a
|
|
|
|
|
DNS-over-TLS connection. Only SubjectAltName must be checked
|
|
|
|
|
instead. Unfortunately, some quite old versions of cryptographic
|
|
|
|
|
libraries might lack the functionality to ignore the Subject
|
|
|
|
|
field. It should have minimal production use consequences, as most
|
|
|
|
|
of the production-ready certificates issued by certificate
|
|
|
|
|
authorities will have SubjectAltNames set. In such a case, the
|
|
|
|
|
Subject field is ignored. Only old platforms are affected by this,
|
|
|
|
|
e.g., those supplied with OpenSSL versions older than 1.1.1.
|
2022-01-20 11:20:03 +01:00
|
|
|
|
|
|
|
|
New Features
|
|
|
|
|
~~~~~~~~~~~~
|
|
|
|
|
|
2022-03-03 22:17:04 +01:00
|
|
|
- :iscman:`dnssec-verify` and :iscman:`dnssec-signzone` now accept a ``-J`` option to
|
2022-02-04 23:51:39 -08:00
|
|
|
specify a journal file to read when loading the zone to be verified or
|
|
|
|
|
signed. :gl:`#2486`
|
2022-01-20 11:20:03 +01:00
|
|
|
|
2022-02-21 16:02:32 +02:00
|
|
|
- Add support for remote TLS certificates verification, both to BIND
|
|
|
|
|
and ``dig``, making it possible to implement Strict and Mutual TLS
|
|
|
|
|
authentication, as described in RFC 9103, Section 9.3. :gl:`#3163`
|
|
|
|
|
|
2022-03-08 18:36:08 +01:00
|
|
|
- Run RPZ updates on the specialized "offload" threads to reduce the amount
|
|
|
|
|
of time they block query processing on the main networking threads. This
|
|
|
|
|
should increase the responsiveness of ``named`` when RPZ updates are being
|
|
|
|
|
applied after an RPZ zone has been successfully transfered. :gl:`#3190`
|
|
|
|
|
|
2022-01-20 11:20:03 +01:00
|
|
|
Removed Features
|
|
|
|
|
~~~~~~~~~~~~~~~~
|
|
|
|
|
|
2022-02-10 11:44:42 +01:00
|
|
|
- The ``keep-order-response`` option has been declared obsolete and the
|
2022-03-03 22:17:04 +01:00
|
|
|
functionality has been removed. :iscman:`named` expects DNS clients to be
|
2022-02-10 11:44:42 +01:00
|
|
|
fully compliant with :rfc:`7766`. :gl:`#3140`
|
|
|
|
|
|
2022-01-20 11:20:03 +01:00
|
|
|
Feature Changes
|
|
|
|
|
~~~~~~~~~~~~~~~
|
|
|
|
|
|
2022-04-11 10:05:50 +02:00
|
|
|
- None.
|
2022-04-01 14:51:42 +02:00
|
|
|
|
2022-01-20 11:20:03 +01:00
|
|
|
Bug Fixes
|
|
|
|
|
~~~~~~~~~
|
|
|
|
|
|
2022-04-11 10:05:50 +02:00
|
|
|
- None.
|
