Home | History | Annotate | Line # | Download | only in notes 
      1 .. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
      2 ..
      3 .. SPDX-License-Identifier: MPL-2.0
      4 ..
      5 .. This Source Code Form is subject to the terms of the Mozilla Public
      6 .. License, v. 2.0.  If a copy of the MPL was not distributed with this
      7 .. file, you can obtain one at https://mozilla.org/MPL/2.0/.
      8 ..
      9 .. See the COPYRIGHT file distributed with this work for additional
     10 .. information regarding copyright ownership.
     11 
     12 Notes for BIND 9.20.27
     13 ----------------------
     14 
     15 New Features
     16 ~~~~~~~~~~~~
     17 
     18 - Disclose active Negative Trust Anchors with Extended DNS Error 33.
     19 
     20   A Negative Trust Anchor (:rfc:`7646`) turns off DNSSEC validation for
     21   a domain, so a name that would normally fail validation resolves
     22   instead. :iscman:`named` now marks such answers with Extended DNS
     23   Error code 33, "Negative Trust Anchor", so operators can see at a
     24   glance when a response came back only because an NTA was in effect.
     25   :gl:`#6268`
     26 
     27 Feature Changes
     28 ~~~~~~~~~~~~~~~
     29 
     30 - Speed up RPZ policy zone updates.
     31 
     32   RPZ updates used to be applied one small step at a time, adding
     33   overhead on large policy zones. Updates are now applied as a single
     34   batch, improving update performance for large RPZ zones, at the cost
     35   of no longer overlapping with concurrent updates. :gl:`#5787`
     36   :gl:`#6270`
     37 
     38 Bug Fixes
     39 ~~~~~~~~~
     40 
     41 - Ensure NSEC authority does not cross zonecut boundary.
     42 
     43   When using a cached NSEC record to prove that a delegation is
     44   insecure, :iscman:`named` now checks that the signer name in the
     45   corresponding RRSIG is not above a known secure delegation point.
     46   This prevents a signed namespace from being downgraded to insecure
     47   using an NSEC record from the grandparent zone. :gl:`#5967`
     48 
     49 - Treat an unusable NSEC3 chain as a verification failure.
     50 
     51   When transferring in a mirror zone, DNSSEC verification could
     52   incorrectly succeed when the zone had an invalid NSEC3PARAM record,
     53   leading to subsequent validation failures. This has been fixed.
     54   :gl:`#6136`
     55 
     56 - Treat non-canonical RPZ prefixes as any other failure.
     57 
     58   RPZ prefixes that were not encoded in canonical form did not work.
     59   They are now handled in the same way as any other encoding error. :gl:`#6043`
     60 
     61 - Negative caching stopped working with stale-answer-client-timeout set
     62   to ``0``.
     63 
     64   Negative answers were re-fetched on every query instead of once they
     65   actually expired, effectively disabling negative caching. This has
     66   been fixed. :gl:`#6245`
     67 
     68 - An unterminated OpenSSL private-key ``Label:`` field could be read past
     69   its parser buffer.
     70 
     71   The ``Label:`` field in a ``.private`` key file is now checked for
     72   length and NUL-termination. Malformed files are rejected. :gl:`#6193`
     73 
     74 - Restore SMF support on Solaris and illumos. :gl:`#6096`
     75 
     76 - Fix compilation on GNU/Hurd. :gl:`#6285`
     77 
     78 - :option:`dig +yaml` was producing invalid YAML when a lookup failed.
     79 
     80   When no server could be reached, :iscman:`dig` printed its
     81   plain-text startup banner ahead of the YAML output, making the
     82   result unparsable. :iscman:`dig` no longer does this and correctly
     83   reflects options such as ``+nocmd``, ``+short`` and ``+yaml``,
     84   regardless of where they appear on the command line. :gl:`#1230`
     85 
     86 - Properly prevent TSIG generation command line injection attacks.
     87 
     88   When key names are generated with :iscman:`rndc-confgen`,
     89   :iscman:`tsig-keygen` and :iscman:`ddns-confgen`, special characters
     90   must be escaped to ensure that the configuration is parsed correctly.
     91   :gl:`#6071`
     92 
     93 - Fix a potential heap bounds overflow write in :iscman:`dnssec-signzone`.
     94 
     95   It was possible for :iscman:`dnssec-signzone` to overflow array
     96   bounds while signing. This has been fixed. :gl:`#6076`
     97 
     98 - Fix crashes on invalid DNSTAP input in :iscman:`dnstap-read`.
     99 
    100   Malformed DNSTAP files could trigger a NULL pointer dereference or an
    101   out-of-bounds memory read in :iscman:`dnstap-read`. This has been
    102   fixed. :gl:`#6077` :gl:`#6124`
    103