mirror of
https://gitlab.isc.org/isc-projects/bind9
synced 2025-09-05 09:05:40 +00:00
2fadf29e6b
Define a :gl: Sphinx role that takes a GitLab issue/MR number as an argument and creates a hyperlink to the relevant ISC GitLab URL. This makes it easy to reach ISC GitLab pages directly from the release notes. Make all GitLab references in the release notes use the new Sphinx role.
91 lines
3.9 KiB
ReStructuredText
91 lines
3.9 KiB
ReStructuredText
..
|
|
Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
|
|
|
This Source Code Form is subject to the terms of the Mozilla Public
|
|
License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
|
|
|
See the COPYRIGHT file distributed with this work for additional
|
|
information regarding copyright ownership.
|
|
|
|
Notes for BIND 9.17.11
|
|
----------------------
|
|
|
|
New Features
|
|
~~~~~~~~~~~~
|
|
|
|
- ``dig`` has been extended to support DNS-over-HTTPS (DoH) queries,
|
|
using ``dig +https`` and related options. :gl:`#1641`
|
|
|
|
- A new ``purge-keys`` option has been added to ``dnssec-policy``. It
|
|
sets the period of time that key files are retained after becoming
|
|
obsolete due to a key rollover; the default is 90 days. This feature
|
|
can be disabled by setting ``purge-keys`` to 0. :gl:`#2408`
|
|
|
|
Feature Changes
|
|
~~~~~~~~~~~~~~~
|
|
|
|
- To prevent users from inadvertently configuring unencrypted
|
|
DNS-over-HTTPS (DoH) in BIND 9, ``listen-on`` and ``listen-on-v6``
|
|
statements using the ``http`` parameter must now also specify the
|
|
``tls`` parameter. ``tls none`` can be used to explicitly allow
|
|
unencrypted HTTP connections. :gl:`#2472`
|
|
|
|
- ``http default`` can now be specified in ``listen-on`` and
|
|
``listen-on-v6`` statements to use the default HTTP endpoint of
|
|
``/dns-query``. It is no longer necessary to include an ``http``
|
|
statement in ``named.conf`` unless overriding this value. :gl:`#2472`
|
|
|
|
Bug Fixes
|
|
~~~~~~~~~
|
|
|
|
- Zone journal (``.jnl``) files created by versions of ``named`` prior
|
|
to 9.16.12 were no longer compatible; this could cause problems when
|
|
upgrading if journal files were not synchronized first. This has been
|
|
corrected: older journal files can now be read when starting up. When
|
|
an old-style journal file is detected, it is updated to the new format
|
|
immediately after loading.
|
|
|
|
Note that journals created by the current version of ``named`` are not
|
|
usable by versions prior to 9.16.12. Before downgrading to a prior
|
|
release, users are advised to ensure that all dynamic zones have been
|
|
synchronized using ``rndc sync -clean``.
|
|
|
|
A journal file's format can be changed manually by running
|
|
``named-journalprint -d`` (downgrade) or ``named-journalprint -u``
|
|
(upgrade). Note that this *must not* be done while ``named`` is
|
|
running. :gl:`#2505`
|
|
|
|
- ``named`` crashed when it was allowed to serve stale answers and
|
|
``stale-answer-client-timeout`` was triggered without any (stale) data
|
|
available in the cache to answer the query. :gl:`#2503`
|
|
|
|
- If an outgoing packet exceeded ``max-udp-size``, ``named`` dropped it
|
|
instead of sending back a proper response. To prevent this problem,
|
|
the ``IP_DONTFRAG`` option is no longer set on UDP sockets, which has
|
|
been happening since BIND 9.17.6. :gl:`#2466`
|
|
|
|
- NSEC3 records were not immediately created when signing a dynamic zone
|
|
using ``dnssec-policy`` with ``nsec3param``. This has been fixed.
|
|
:gl:`#2498`
|
|
|
|
- A memory leak occurred when ``named`` was reconfigured after adding an
|
|
inline-signed zone with ``auto-dnssec maintain`` enabled. This has
|
|
been fixed. :gl:`#2041`
|
|
|
|
- An invalid direction field (not one of ``N``, ``S``, ``E``, ``W``) in
|
|
a LOC record resulted in an INSIST failure when a zone file containing
|
|
such a record was loaded. :gl:`#2499`
|
|
|
|
- If an invalid key name (e.g. ``a..b``) was specified in a
|
|
``primaries`` list in ``named.conf``, the wrong size was passed to
|
|
``isc_mem_put()``, which resulted in the returned memory being put on
|
|
the wrong free list and prevented ``named`` from starting up. This has
|
|
been fixed. :gl:`#2460`
|
|
|
|
- ``libtool`` was inadvertently introduced as a build-time requirement
|
|
when the build system was revamped in BIND 9.17.2. This unnecessarily
|
|
prevented hosts without that tool from building BIND 9 from source
|
|
tarballs. A standalone ``libtool`` script no longer needs to be
|
|
present in ``PATH`` to build BIND 9 from a source tarball. :gl:`#2504`
|