mirror of
https://gitlab.isc.org/isc-projects/bind9
synced 2025-08-31 06:25:31 +00:00
Prepare release notes for BIND 9.21.4
This commit is contained in:
Andoni Duarte Pintado
@@ -47,6 +47,7 @@ The list of known issues affecting the latest version in the 9.21 branch can be
|
||||
found at
|
||||
https://gitlab.isc.org/isc-projects/bind9/-/wikis/Known-Issues-in-BIND-9.21
|
||||
|
||||
.. include:: ../notes/notes-9.21.4.rst
|
||||
.. include:: ../notes/notes-9.21.3.rst
|
||||
.. include:: ../notes/notes-9.21.2.rst
|
||||
.. include:: ../notes/notes-9.21.1.rst
|
||||
|
||||
188
doc/notes/notes-9.21.4.rst
Normal file
188
doc/notes/notes-9.21.4.rst
Normal file
@@ -0,0 +1,188 @@
|
||||
.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
||||
..
|
||||
.. SPDX-License-Identifier: MPL-2.0
|
||||
..
|
||||
.. This Source Code Form is subject to the terms of the Mozilla Public
|
||||
.. License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
..
|
||||
.. See the COPYRIGHT file distributed with this work for additional
|
||||
.. information regarding copyright ownership.
|
||||
|
||||
Notes for BIND 9.21.4
|
||||
---------------------
|
||||
|
||||
Security Fixes
|
||||
~~~~~~~~~~~~~~
|
||||
|
||||
- [CVE-2024-12705] DNS-over-HTTP(s) flooding fixes.
|
||||
|
||||
Fix DNS-over-HTTP(S) implementation issues that arise under heavy
|
||||
query load. Optimize resource usage for :iscman:`named` instances that
|
||||
accept queries over DNS-over-HTTP(S).
|
||||
|
||||
Previously, :iscman:`named` would process all incoming HTTP/2 data at
|
||||
once, which could overwhelm the server, especially when dealing with
|
||||
clients that send requests but don't wait for responses. That has been
|
||||
fixed. Now, :iscman:`named` handles HTTP/2 data in smaller chunks and
|
||||
throttles reading until the remote side reads the response data. It
|
||||
also throttles clients that send too many requests at once.
|
||||
|
||||
Additionally, :iscman:`named` now carefully processes data sent by
|
||||
some clients, which can be considered "flooding." It logs these
|
||||
clients and drops connections from them. :gl:`#4795`
|
||||
|
||||
In some cases, :iscman:`named` could leave DNS-over-HTTP(S)
|
||||
connections in the `CLOSE_WAIT` state indefinitely. That also has been
|
||||
fixed. ISC would like to thank JF Billaud for thoroughly investigating
|
||||
the issue and verifying the fix. :gl:`#5083` :gl:`#4795` :gl:`#5083`
|
||||
|
||||
- [CVE-2024-11187] Limit the additional processing for large RDATA sets.
|
||||
|
||||
When answering queries, don't add data to the additional section if
|
||||
the answer has more than 13 names in the RDATA. This limits the number
|
||||
of lookups into the database(s) during a single client query, reducing
|
||||
query processing load. :gl:`#5034`
|
||||
|
||||
New Features
|
||||
~~~~~~~~~~~~
|
||||
|
||||
- Add Extended DNS Error Code 22 - No Reachable Authority.
|
||||
|
||||
When the resolver is trying to query an authority server and
|
||||
eventually timed out, a SERVFAIL answer is given to the client. Add
|
||||
the Extended DNS Error Code 22 - No Reachable Authority to the
|
||||
response. :gl:`#2268`
|
||||
|
||||
- Add "Zone has [AAAA/A] records but is not served by IPv[6/4]"
|
||||
warnings.
|
||||
|
||||
Check that zones with AAAA records are served by IPv6 servers and that
|
||||
zones with A records are served by IPv4 servers. Sometimes, IPv6
|
||||
services are accidentally misconfigured and zones with IPv6 (AAAA)
|
||||
address records are not served by DNS servers with IPv6 addresses,
|
||||
which means they need to use translation devices to look up those IPv6
|
||||
addresses. The reverse is also sometimes true: zones with A records
|
||||
are not resolvable over IPv4 when they should be. To prevent this,
|
||||
BIND now looks for these misconfigured zones and issues a warning if
|
||||
they are found. :gl:`#4370`
|
||||
|
||||
- Add a new option to configure the maximum number of outgoing queries
|
||||
per client request.
|
||||
|
||||
The configuration option 'max-query-count' sets how many outgoing
|
||||
queries per client request is allowed. The existing
|
||||
'max-recursion-queries' is the number of permissible queries for a
|
||||
single name and is reset on every CNAME redirection. This new option
|
||||
is a global limit on the client request. The default is 200.
|
||||
|
||||
This allows us to send a bit more queries while looking up a single
|
||||
name. The default for 'max-recursion-queries' is changed from 32 to
|
||||
50. :gl:`#4980` :gl:`#4921`
|
||||
|
||||
Removed Features
|
||||
~~~~~~~~~~~~~~~~
|
||||
|
||||
- Remove dnssec-must-be-secure feature.
|
||||
|
||||
:gl:`#4482`
|
||||
|
||||
- Remove 'sortlist' option.
|
||||
|
||||
The `sortlist` option, which was deprecated in BIND 9.20, has now been
|
||||
removed. :gl:`#4665`
|
||||
|
||||
- Remove fixed value for the rrset-order option.
|
||||
|
||||
Remove the "fixed" value from the "rrset-order" option and from the
|
||||
autoconf script. :gl:`#4666`
|
||||
|
||||
- Remove trusted-keys and managed-keys options.
|
||||
|
||||
These options have been deprecated in 9.19 in favor of the
|
||||
'trust-anchors' option and are now being removed. :gl:`#5080`
|
||||
|
||||
Feature Changes
|
||||
~~~~~~~~~~~~~~~
|
||||
|
||||
- The configuration clauses parental-agents and primaries are renamed to
|
||||
remote-servers.
|
||||
|
||||
The top blocks 'primaries' and 'parental-agents' are no longer
|
||||
preferred and should be renamed to 'remote-servers'. The zone
|
||||
statements 'parental-agents' and 'primaries' are still used, and may
|
||||
refer to any 'remote-servers' top block. :gl:`#4544`
|
||||
|
||||
Bug Fixes
|
||||
~~~~~~~~~
|
||||
|
||||
- Fix nsupdate hang when processing a large update.
|
||||
|
||||
To mitigate DNS flood attacks over a single TCP connection, we
|
||||
throttle the connection when the other side does not read the data.
|
||||
Throttling should only occur on server-side sockets, but erroneously
|
||||
also happened for nsupdate, which acts as a client. When nsupdate
|
||||
started throttling the connection, it never attempts to read again.
|
||||
This has been fixed. :gl:`#4910`
|
||||
|
||||
- Fix possible assertion failure when reloading server while processing
|
||||
updates.
|
||||
|
||||
:gl:`#5006`
|
||||
|
||||
- Preserve cache across reconfig when using attach-cache.
|
||||
|
||||
When the `attach-cache` option is used in the `options` block with an
|
||||
arbitrary name, it causes all views to use the same cache. Previously,
|
||||
this configuration caused the cache to be deleted and a new cache
|
||||
created every time the server was reconfigured. This has been fixed.
|
||||
:gl:`#5061`
|
||||
|
||||
- Resolve the spurious drops in performance due GLUE cache.
|
||||
|
||||
For performance reasons, the returned GLUE records are cached on the
|
||||
first use. The current implementation could randomly cause a
|
||||
performance drop and increased memory use. This has been fixed.
|
||||
:gl:`#5064`
|
||||
|
||||
- Fix dnssec-signzone signing non-DNSKEY RRsets with revoked keys.
|
||||
|
||||
`dnssec-signzone` was using revoked keys for signing RRsets other than
|
||||
DNSKEY. This has been corrected. :gl:`#5070`
|
||||
|
||||
- Disable deterministic ecdsa for fips builds.
|
||||
|
||||
FIPS 186-5 [1] allows the usage deterministic ECDSA (Section 6.3)
|
||||
which is compabile with RFC 6979 [2] but OpenSSL seems to follow FIPS
|
||||
186-4 (Section 6.3) [3] which only allows for random k values, failing
|
||||
k value generation for OpenSSL >=3.2. [4]
|
||||
|
||||
Fix signing by not using deterministic ECDSA when FIPS mode is active.
|
||||
|
||||
[1]: https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-5.pdf [2]:
|
||||
https://datatracker.ietf.org/doc/html/rfc6979 [3]:
|
||||
https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-4.pdf [4]: https:
|
||||
//github.com/openssl/openssl/blob/85f17585b0d8b55b335f561e2862db14a20b
|
||||
1e64/crypto/ec/ecdsa_ossl.c#L201-L207 :gl:`#5072`
|
||||
|
||||
- Unknown directive in resolv.conf not handled properly.
|
||||
|
||||
The line after an unknown directive in resolv.conf could accidentally
|
||||
be skipped, potentially affecting dig, host, nslookup, nsupdate, or
|
||||
delv. This has been fixed. :gl:`#5084`
|
||||
|
||||
- Querying an NSEC3-signed zone for an empty record could trigger an
|
||||
assertion.
|
||||
|
||||
A bug in the qpzone database could trigger a crash when querying for a
|
||||
deleted name, or a newly-added empty non-terminal name, in an
|
||||
NSEC3-signed zone. This has been fixed. :gl:`#5108`
|
||||
|
||||
- Fix response policy zones and catalog zones with an $INCLUDE statement
|
||||
defined.
|
||||
|
||||
Response policy zones (RPZ) and catalog zones were not working
|
||||
correctly if they had an $INCLUDE statement defined. This has been
|
||||
fixed. :gl:`#5111`
|
||||
|
||||
|
||||
Reference in New Issue
Block a user