diff --git a/doc/arm/notes.rst b/doc/arm/notes.rst index 080f268e51..4676e8bb73 100644 --- a/doc/arm/notes.rst +++ b/doc/arm/notes.rst @@ -38,7 +38,7 @@ information about each release, and source code. .. include:: ../notes/notes-known-issues.rst -.. include:: ../notes/notes-current.rst +.. include:: ../notes/notes-9.19.22.rst .. include:: ../notes/notes-9.19.21.rst .. include:: ../notes/notes-9.19.20.rst .. include:: ../notes/notes-9.19.19.rst diff --git a/doc/notes/notes-current.rst b/doc/notes/notes-9.19.22.rst similarity index 75% rename from doc/notes/notes-current.rst rename to doc/notes/notes-9.19.22.rst index db94ea44fa..72c0a84254 100644 --- a/doc/notes/notes-current.rst +++ b/doc/notes/notes-9.19.22.rst @@ -12,37 +12,34 @@ Notes for BIND 9.19.22 ---------------------- -Security Fixes -~~~~~~~~~~~~~~ - -- None. - New Features ~~~~~~~~~~~~ -- The ``tls`` block was extended with a new ``cipher-suites`` option - that allows setting allowed cipher suites for TLSv1.3. Please - consult the documentation for additional details. - :gl:`#3504` +- Information on incoming zone transfers in the statistics channel now also shows + the zones' "first refresh" flag, which indicates that a zone is not fully + ready and that its first ever refresh is pending or is in progress. The number + of such zones is now also exposed by the ``rndc status`` command. :gl:`#4241` - The statistics channel now includes counters that indicate the number of currently connected TCP IPv4/IPv6 clients. :gl:`#4425` -- The statistics channel's incoming zone transfers information now also shows - the zones' "first refresh" flag, which indicates that a zone is not fully - ready yet, and its first ever refresh is pending or is in-progress. The number - of such zones is now also exposed by the ``rndc status`` command. :gl:`#4241` - -- Add HSM support to :any:`dnssec-policy`. You can now configure keys with a - ``key-store`` that allows you to set the directory to store the key files and +- HSM support was added to :any:`dnssec-policy`. Keys can now be configured with a + ``key-store`` that allows users to set the directory where key files are stored and to set a PKCS#11 URI string. The latter requires OpenSSL 3 and a valid PKCS#11 - provider to be configured for OpenSSL. :gl`#1129`. + provider to be configured for OpenSSL. :gl:`#1129` + +- The ``tls`` block was extended with a new ``cipher-suites`` option + that allows permitted cipher suites for TLSv1.3 to be set. Please + consult the documentation for additional details. + :gl:`#3504` + +- Support for the RESINFO record type was added. :gl:`#4413` Removed Features ~~~~~~~~~~~~~~~~ - BIND 9 no longer supports non-zero :any:`stale-answer-client-timeout` values, - when the feature is turned on. When using a non-zero value, ``named`` now + when the feature is turned on. When using a non-zero value, :iscman:`named` now generates a warning log message, and treats the value as ``0``. :gl:`#4447` Feature Changes @@ -68,25 +65,11 @@ Feature Changes The old RBT-based database still exists for now, and can be used by specifying ``database rbt`` in a ``zone`` statement in ``named.conf``, or by compiling with ``configure --with-zonedb=rbt --with-cachedb=rbt``. - :gl:`#4411`. + :gl:`#4411` Bug Fixes ~~~~~~~~~ -- Changes to ``listen-on`` statements were ignored on reconfiguration - unless the port or interface address was changed, making it - impossible to change a related listener transport type. That issue - has been fixed. - - ISC would like to thank Thomas Amgarten for bringing this issue to - our attention. :gl:`#4518`, :gl:`#4528` - -- A use-after-free assertion might get triggered when the overmem cache - cleaning triggers. :gl:`#4595` - - ISC would like to thank to Jinmei Tatuya from Infoblox for bringing - this issue to our attention. - - A regression in cache-cleaning code enabled memory use to grow significantly more quickly than before, until the configured :any:`max-cache-size` limit was reached. This has been fixed. @@ -97,6 +80,25 @@ Bug Fixes :any:`max-cache-size` limit being exceeded and has now been fixed. :gl:`#4621` +- The logic for cleaning up expired cached DNS records was + tweaked to be more aggressive. This change helps with enforcing + :any:`max-cache-ttl` and :any:`max-ncache-ttl` in a timely manner. + :gl:`#4591` + +- Changes to ``listen-on`` statements were ignored on reconfiguration + unless the port or interface address was changed, making it + impossible to change a related listener transport type. That issue + has been fixed. + + ISC would like to thank Thomas Amgarten for bringing this issue to + our attention. :gl:`#4518` :gl:`#4528` + +- It was possible to trigger a use-after-free assertion when the overmem cache + cleaning was initiated. This has been fixed. :gl:`#4595` + + ISC would like to thank Jinmei Tatuya of Infoblox for bringing + this issue to our attention. + Known Issues ~~~~~~~~~~~~