bind/doc/arm/notes.xml

<?xml version="1.0" encoding="utf-8"?>
<!--
 - Copyright (C) 2014  Internet Systems Consortium, Inc. ("ISC")
 -
 - Permission to use, copy, modify, and/or distribute this software for any
 - purpose with or without fee is hereby granted, provided that the above
 - copyright notice and this permission notice appear in all copies.
 -
 - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
 - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
 - AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
 - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
 - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
 - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 - PERFORMANCE OF THIS SOFTWARE.
-->

<sect1 xmlns:xi="http://www.w3.org/2001/XInclude">
  <xi:include href="noteversion.xml"/>
  <sect2 id="relnotes_intro">
    <title>Introduction</title>
    <para>
      This document summarizes changes since the last production release
      of BIND on the corresponding major release branch.
    </para>
  </sect2>
  <sect2 id="relnotes_download">
    <title>Download</title>
    <para>
      The latest versions of BIND 9 software can always be found at
      <ulink url="http://www.isc.org/downloads/"
	>http://www.isc.org/downloads/</ulink>.
      There you will find additional information about each release,
      source code, and pre-compiled versions for Microsoft Windows
      operating systems.
    </para>
  </sect2>
  <sect2 id="relnotes_security">
    <title>Security Fixes</title>
    <itemizedlist>
      <listitem>
	<para>None</para>
      </listitem>
      <listitem>
        <para>
          Errors reported when running <command>rndc addzone</command>
          (e.g., when a zone file cannot be loaded) have been clarified
          to make it easier to diagnose problems.
        </para>
      </listitem>
    </itemizedlist>
  </sect2>
  <sect2 id="relnotes_features">
    <title>New Features</title>
    <itemizedlist>
      <listitem>
	<para>
          The serial number of a dynamically updatable zone can
          now be set using
          <command>rndc signing -serial <replaceable>number</replaceable> <replaceable>zonename</replaceable></command>.
          This is particularly useful with <option>inline-signing</option>
          zones that have been reset.  Setting the serial number to a value
          larger than that on the slaves will trigger an AXFR-style
	  transfer.
	</para>
      </listitem>
      <listitem>
	<para>
          When answering recursive queries, SERVFAIL responses can now be
          cached by the server for a limited time; subsequent queries for
          the same query name and type will return another SERVFAIL until
          the cache times out.  This reduces the frequency of retries
          when a query is persistently failing, which can be a burden
          on recursive serviers.  The SERVFAIL cache timeout is controlled
          by <option>servfail-ttl</option>, which defaults to 10 seconds
          and has an upper limit of 30.
	</para>
      </listitem>
      <listitem>
	<para>
          The new <command>rndc nta</command> command can now be used to
          set a "negative trust anchor" (NTA), disabling DNSSEC validation for
          a specific domain; this can be used when responses from a domain
          are known to be failing validation due to administrative error
          rather than because of a spoofing attack. NTAs are strictly
          temporary; by default they expire after one hour, but can be
          configured to last up to one week.  The default NTA lifetime
          can be changed by setting the <option>nta-lifetime</option> in
          <filename>named.conf</filename>.
	</para>
      </listitem>
      <listitem>
	<para>
	  The EDNS Client Subnet (ECS) option is now supported for
          authoritative servers; if a query contains an ECS option then
          ACLs containing <option>geoip</option> or <option>ecs</option>
          elements can match against the the address encoded in the option.
          This can be used to select a view for a query, so that different
          answers can be provided depending on the client network.
	</para>
      </listitem>
      <listitem>
	<para>
	  The EDNS EXPIRE option has been implemented on the client
	  side, allowing a slave server to set the expiration timer
	  correctly when transferring zone data from another slave
	  server.
	</para>
      </listitem>
      <listitem>
	<para>
          A new <option>masterfile-style</option> zone option controls
          the formatting of text zone files:  When set to
          <literal>full</literal>, the zone file will dumped in
          single-line-per-record format.
	</para>
      </listitem>
      <listitem>
	<para>
          <command>dig +ednsopt</command> can now be used to set
          arbitrary EDNS options in DNS requests.
	</para>
      </listitem>
      <listitem>
	<para>
          <command>dig +ednsflags</command> can now be used to set
          yet-to-be-defined EDNS flags in DNS requests.
	</para>
      </listitem>
      <listitem>
	<para>
          <command>dig +ttlunits</command> causes <command>dig</command>
          to print TTL values with time-unit suffixes: w, d, h, m, s for
          weeks, days, hours, minutes, and seconds.
	</para>
      </listitem>
      <listitem>
	<para>
          <command>dig +dscp=<replaceable>value</replaceable></command>
          can now be used to set the DSCP code point in outgoing query
          packets.
	</para>
      </listitem>
      <listitem>
	<para>
          <option>serial-update-method</option> can now be set to
          <literal>date</literal>. On update, the serial number will
          be set to the current date in YYYYMMDDNN format.
	</para>
      </listitem>
      <listitem>
	<para>
          <command>dnssec-signzone -N date</command> also sets the serial
          number to YYYYMMDDNN.
	</para>
      </listitem>
      <listitem>
	<para>
          <command>named -L <replaceable>filename</replaceable></command>
          causes named to send log messages to the specified file by
          default instead of to the system log.
	</para>
      </listitem>
      <listitem>
	<para>
          The rate limiter configured by the
          <option>serial-query-rate</option> option no longer covers
          NOTIFY messages; those are now separately controlled by
          <option>notify-rate</option> and
          <option>startup-notify-rate</option> (the latter of which
          controls the rate of NOTIFY messages sent when the server
          is first started up or reconfigured).
	</para>
      </listitem>
    </itemizedlist>
  </sect2>
  <sect2 id="relnotes_changes">
    <title>Feature Changes</title>
    <itemizedlist>
      <listitem>
        <para>
          When using native PKCS#11 cryptography (i.e.,
          <command>configure --enable-native-pkcs11</command>) HSM PINs
          of up to 256 characters can now be used.
        </para>
      </listitem>
      <listitem>
	<para>
          NXDOMAIN responses to queries of type DS are now cached separately
          from those for other types. This helps when using "grafted" zones
          of type forward, for which the parent zone does not contain a
          delegation, such as local top-level domains.  Previously a query
          of type DS for such a zone could cause the zone apex to be cached
          as NXDOMAIN, blocking all subsequent queries.  (Note: This
          change is only helpful when DNSSEC validation is not enabled.
          "Grafted" zones without a delegation in the parent are not a
          recommended configuration.)
        </para>
      </listitem>
      <listitem>
	<para>
	  Update forwarding performance has been improved by allowing
	  a single TCP connection to be shared between multiple updates.
	</para>
      </listitem>
      <listitem>
	<para>
          By default, <command>nsupdate</command> will now check
          the correctness of hostnames when adding records of type
          A, AAAA, MX, SOA, NS, SRV or PTR.  This behavior can be
          disabled with <command>check-names no</command>.
	</para>
      </listitem>
    </itemizedlist>
  </sect2>
  <sect2 id="relnotes_bugs">
    <title>Bug Fixes</title>
    <itemizedlist>
      <listitem>
        <para>
	  <command>dig</command>, <command>host</command> and
	  <command>nslookup</command> aborted when encountering
	  a name which, after appending search list elements,
	  exceeded 255 bytes. Such names are now skipped, but
	  processing of other names will continue. [RT #36892]
        </para>
      </listitem>
      <listitem>
        <para>
	  The error message generated when
	  <command>named-checkzone</command> or
	  <command>named-checkconf -z</command> encounters a
	  <option>$TTL</option> directive without a value has
	  been clarified. [RT #37138]
        </para>
      </listitem>
      <listitem>
        <para>
	  Semicolon characters (;) included in TXT records were
	  incorrectly escaped with a backslash when the record was
	  displayed as text. This is actually only necessary when there
	  are no quotation marks. [RT #37159]
        </para>
      </listitem>
      <listitem>
        <para>
	  When files opened for writing by <command>named</command>,
	  such as zone journal files, were referenced more than once
	  in <filename>named.conf</filename>, it could lead to file
	  corruption as multiple threads wrote to the same file. This
	  is now detected when loading <filename>named.conf</filename>
	  and reported as an error. [RT #37172]
        </para>
      </listitem>
      <listitem>
        <para>
          When checking for updates to trust anchors listed in
          <option>managed-keys</option>, <command>named</command>
          now revalidates keys based on the current set of
          active trust anchors, without relying on any cached
          record of previous validation. [RT #37506]
        </para>
      </listitem>
      <listitem>
        <para>
	  Large-system tuning
	  (<command>configure --with-tuning=large</command>) caused
	  problems on some platforms by setting a socket receive
	  buffer size that was too large.  This is now detected and
	  corrected at run time.
        </para>
      </listitem>
    </itemizedlist>
  </sect2>
  <sect2 id="relnotes_thanks">
    <title>Thank You</title>
    <para>
      Thank you to everyone who assisted us in making this release possible.
      If you would like to contribute to ISC to assist us in continuing to
      make quality open source software, please visit our donations page at
      <ulink url="http://www.isc.org/donate/"
	>http://www.isc.org/donate/</ulink>.
    </para>
  </sect2>
</sect1>