summaryrefslogtreecommitdiff
path: root/external/bsd/bind
AgeCommit message (Collapse)Author
2014-03-01fix indentationchristos
2014-03-01remove blank linechristos
2014-03-01fix indentationchristos
2014-03-01fix indentationchristos
2014-03-01remove local initchristos
2014-03-01put back init that got accidentally removed.christos
2014-03-01remove local init stuffchristos
2014-03-01Add missing #endifdsl
2014-03-01resolve conflicts; undo many local changes that have been done upstreamchristos
differently.
2014-02-28Introductionchristos
BIND 9.10.0b1 is the first beta development release of BIND 9.10, a new branch of BIND 9. This document summarizes features added or significantly changed since the previous major release, BIND 9.9. Items that were not in the previous development release, BIND 9.10.0a2, are marked with asterisks (**). Bug fixes since the previous development release are also summarized. Please see the CHANGES file in the source code release for a complete list of all changes. Download The latest versions of BIND 9 software can always be found on our web site at http://www.isc.org/downloads/. There you will find additional information about each release, source code, and pre-compiled versions for Microsoft Windows operating systems. Support Professional support is provided by Internet Systems Consortium, Inc., doing business as DNSco. Information about paid support options is available at http://www.dns-co.com/solutions/. Free support is provided by our user community via a mailing list. Information on all public email lists is available at https://www.isc.org/community/mailing-list/. New Features DNS Response-rate limiting (DNS RRL), which blunts the impact of reflection and amplification attacks, is always compiled in and no longer requires a compile-time option to enable it. An experimental "Source Identity Token" (SIT) EDNS option is now available. Similar to DNS Cookies (as invented by Donald Eastlake III and described in draft-eastlake-dnsext-cookies-04), these are designed to enable clients to detect off-path spoofed responses, and to enable servers to detect spoofed-source queries. Servers can be configured to send smaller responses to clients that have not identified themselves using a SIT option, reducing the effectiveness of amplification attacks. RRL processing has also been updated: clients proven to be legitimate via SIT are not subject to rate limiting. Use "configure --enable-sit" to enable this feature in BIND 9. [RT #35389] ** A new zone file format, "map", stores zone data in a format that can be mapped directly into memory, allowing significantly faster zone loading. [RT #25419] "delve" (domain entity lookup and validation engine) is a new tool with dig-like semantics for looking up DNS data and performing internal DNSSEC validation. This allows easy validation in environments where the resolver may not be trustworthy, and assists with troubleshooting of DNSSEC problems. (Note: not yet available on Windows.) [RT #32406] ** The new "prefetch" option can improve recursive resolver performance: when it is in use, cache records that are still being requested by clients will automatically be refreshed from the authoritative server before they expire, reducing or eliminating the time window in which no answer is available in the cache. [RT #35041] Improved EDNS processing allows better resolver performance and reliability over slow or lossy connections. [RT #30655] Substantial improvements have been made in response-policy zone (RPZ) performance. Up to 32 response-policy zones can now be configured. Performance loss due to adding additional RPZs is minimal. RPZ now allows response policies to be configured based on the IP address of the client. ACLs can now be specified based on geographic location using the MaxMind GeoIP databases. Use "configure --with-geoip" to enable this feature in BIND 9. Thanks to Ken Brownfield for the contribution. [RT #30681] The version 3 XML schema for the statistics channel, including new statistics and a flattened XML tree for faster parsing, is no longer optional. The version 2 XML schema is now deprecated. [RT #30023] Improvements have been made to the XSL stylesheet used for XML statistics: The stylesheet can now be cached by the browser; section headers are omitted when the sections have no data to display; counter readability has been improved. Also, broken-out subgroups of XML statistics (server, zones, net, tasks, mem, and status) can now be requested. Thanks to Timothe Litt for the assistance. [RT #35115] [RT #35117] The statistics channel can now provide data in JSON format as well as XML. Per-zone stats counters have been added to track TCP and UDP queries. [RT #35375] ** Server-wide stats counters have been added to track EDNS options received. [RT #35447] ** The new "in-view" zone option allows zone data to be shared between views, so that multiple views can serve the same zones authoritatively without storing multiple copies in memory. [RT #32968] A new compile-time option, "configure --enable-native-pkcs11", allows the BIND 9 cryptography functions to use the PKCS#11 API natively, so that BIND can drive a cryptographic hardware service module (HSM) directly instead of using a modified OpenSSL as an intermediary. This has been tested with the Thales nShield HSM and with SoftHSMv2 from the OpenDNSSEC project. [RT #29031] When re-signing a zone, the new "dnssec-signzone -Q" option drops signatures from keys that are still published but are no longer active. Thanks to Pierre Beyssac for the contribution. [RT #34990] New options have been added to "dnssec-coverage": -z and -k indicate whether to limit coverage checks to ZSK's or KSK's, and -l limits coverage checking to a specified duration. Thanks to Peter Palfrader for the contribution. [RT #35168] "named-checkconf -px" will print the contents of configuration files with the shared secrets obscured, making it easier to share configuration (e.g. when submitting a bug report) without revealing private information. [RT #34465] Added a "no-case-compress" ACL, which causes "named" to use case-insensitive compression for specified clients. This is useful when dealing with broken client implementations that use case-sensitive name comparisons, rejecting responses that fail to match the capitalization of the query that was sent. "named" now preserves the capitalization of names when responding to queries: for instance, a query for "example.com" may be answered with "example.COM" if the name was configured that way in the zone file. Some clients have a bug causing them to depend on the older behavior, in which the case of the answer always matched the case of the query, rather than the case of the name configured in the DNS. Such clients can now be specified in the new "no-case-compress" ACL; this will restore the older behavior of "named" for those clients only. [RT #35300] ** On operating systems that support routing sockets, including Mac OSX, *BSD and Linux, network interfaces are re-scanned automatically whenever they change. Use "automatic-interface-scan no;" to disable this feature. [RT #23027] ** Added "rndc scan" to trigger an interface scan manually. [RT #23027] ** A new compile-time option, "configure --with-tuning=3Dlarge", tunes various compiled-in constants and default settings to values suited to large servers with abundant memory. This can improve performance on such servers, but will consume more memory and may degrade performance on smaller systems. [RT #29538] ** The new "max-zone-ttl" option enforces maximum TTLs for zones. If loading a zone containing a higher TTL, the load fails. DDNS updates with higher TTLs are accepted but the TTL is truncated. (Note: Currently supported for master zones only; inline-signing slaves will be added.) [RT #38405] ** Added a new "dig +subnet" option to send an EDNS CLIENT-SUBNET option (as described in draft-vandergaast-edns-client-subnet-02) containing the specified address/prefix when querying. Thanks to Wilmer van der Gaast for the contribution. [RT #35415] ** Partially implemented the EDNS EXPIRE option (as described in draft-andrews-dnsext-expire-00). "dig +expire" sends an EXPIRE option when querying. When this option is sent with an SOA query to a slave zone running on a server that supports the option, the response will report the time until the slave zone expires. EXPIRE uses an experimental option code (65002), which is subject to change when a permanent code is assigned by IANA. [RT #35416] ** Multiple DLZ databases can now be configured, and are searched in order to find one that can answer an incoming query. Individual zones can now be configured to be served from a specific DLZ database. DLZ databases can serve zones of type "master" and "redirect". "named-checkzone" and "named-compilezone" can now read journal files, allowing them to process dynamic zones without the zones needing to be frozen first. The "rndc" command now supports new key algorithms in addition to HMAC-MD5, including HMAC-SHA1, -SHA224, -SHA256, -SHA384, and -SHA512. The -A option to rndc-confgen can be used to select the algorithm for the generated key. (The default is still HMAC-MD5; this may change in a future release.) [RT #20363] The internal and export versions of the BIND libraries (libisc, libdns, etc) have been unified so that external library clients can use the same libraries as BIND itself. [RT #33131] Added a "Configure" script for Windows to simplify enabling or disabling optional features. All versions of Visual Studio up to 2013 are now supported, and support has been added for 64-bit builds. Zip files containing pre-compiled 64-bit versions of BIND 9 are now included with releases. [RT #34160] ** "rndc zonestatus" reports information about a specified zone. "named" now listens on IPv6 as well as IPv4 interfaces by default. Feature Changes The default setting for the -U option (setting the number of UDP listeners per interface) has been adjusted to improve performance. [RT #35417] ** Updated zkt and nslint in the contrib directory to the newest versions: zkt 1.1.2 and nslint-3.0a2. ** The isc_bitstring API is no longer used and has been removed from the libisc library. [RT #35284] ** The word "never" can now be used as a synonym for "none" when configuring key event dates in the dnssec tools. [RT #35277] ** The new libiscpk11 library, introduced in the previous development release to support native PKCS#11, has been merged into libisc to simplify dependencies. [RT #35205] ** Documentation of native PKCS#11 has been expanded, specifically to describe the new pkcs11: URI format used in key labels. [RT #35287] *= * The Windows installer now places files in the Program Files area rather than system services. [RT #35361] ** The timestamps included in RRSIG records can now be read as integers indicating the number of seconds since the UNIX epoch, in addition to being read as formatted dates in YYYYMMDDHHMMSS format. [RT #35185] The irs_resconf_load() function, used for reading /etc/resolv.conf, now returns ISC_R_FILENOTFOUND when the file is missing or unreadable. However, it will still initialize an irs_resconf structure as if the file had been configured with nameservers at the IPv4 and IPv6 localhost addresses. Existing code that uses irs_resconf_load() will need to be updated to treat ISC_R_FILENOTFOUND as a qualified success, or it may leak memory due to treating the result as a failure even though an irs_resconf structure was allocated; see CHANGES for sample C code that implements the correct behavior [RT #35194] Bug Fixes "dnssec-keygen" could set the publication date incorrectly when only the activation date was specified on the command line. [RT #35278] Fixed a type mismatch causing the ODBC DLZ driver to dump core on 64-bit systems. [RT #35324] Improved building with libtool. [RT #35314] When a server is specified by name in "nsupdate", all addresses for that name will be tried before giving up. Previously, if the first address for the server name was not reachable the update would fail. [RT #25784] Fixed an assertion failure caused by using "rndc retransfer" with inline-signing zones. [RT #35353] Fixed a build failure from using "./configure --enable-openssl-hash". [RT #35343] The "delegation-only" flag now works in zones of type "forward". (This had previously been documented to work, but this was actually rejected by the configuration parser.) [RT #35392] Fixed a race condition which could lead to a core dump when destroying a resolver fetch object. [RT #35385] Addressed a potential REQUIRE failure that could occur when printing out an rdataset using a format that includes comment data. The "allow-notify" ACL formerly ignored TSIG keys; this has been corrected. [RT #35425] Fixed an uninitialized pointer in log.c that could potentially have caused a core dump on some platforms. [RT #35260] Thank You Thank you to everyone who assisted us in making this release possible. If you would like to contribute to ISC to assist us in continuing to make quality open source software, please visit our donations page at http://www.isc.org/donate/. (c) 2001-2014 Internet Systems Consortium
2014-01-14a fix by ISC for CVE-2014-0591:spz
3693. [security] memcpy was incorrectly called with overlapping ranges resulting in malformed names being generated on some platforms. This could cause INSIST failures when serving NSEC3 signed zones. [RT #35120]
2014-01-02rename libtool.m4 m4christos
2013-12-31merge conflictschristos
2013-12-31changes for 9.9.5b1christos
2013-12-31Import bind 9.9.5b1christos
2013-12-25Resort libraries:joerg
- libdns is a dependency of libisccfg - libkrb5 is required by libheimntlm
2013-12-20make the non-threaded case work again.christos
2013-11-02mark unused function as used.christos
2013-11-02these can never be null.christos
2013-10-20avoid pointer gymnasticschristos
2013-10-03simplify.christos
2013-10-03use LIBDPLIBS instead of LDADD/DPADD to link against the heimdalmrg
libraries. fixes build issues.
2013-09-11If a library needs a symbol from another library, pull that library injoerg
explicitly, even if the DT_NEEDED closure would normally already ensure the presence.
2013-08-11List all required libraries by libgssapi and libkrb5 for NOPIC builds.tsutsui
2013-07-29Fix MKKERBEROS=no build.dholland
2013-07-27merge conflicts for bind-9.9.3-P2christos
2013-07-27Import bind 9.9.3-P2christos
2013-07-01Fix option parsing on unsigned char platforms.joerg
2013-04-14The common fields of the socket should be initialized in one place sincechristos
we are the socket provider. Fixes crash with "rndc status", where accepted sockets did not have their method fields initialized!
2013-03-24bump bind libs.christos
2013-03-24Call the isc register functions now that we are not calling the library usingchristos
the special BIND9 compilation.
2013-03-24- Relax some of the assertions to make things work outside bind.christos
- Remove #ifndef BIND9 exclusions Now a libdns that is built with BIND9 can be used by other isc programs.
2013-03-24Export all the necessary functions via the registry API instead of playingchristos
namespace games with cpp. Remove the BIND9 ifdef. Now the bind programs don't need a special build of libisc.
2012-12-04merge bind-9-9-2-P1 and adjust build as neededspz
fixes CVE-2012-5688, see: http://www.isc.org/software/bind/advisories/cve-2012-5688
2012-12-04Upstream changelog since 9.9.1:spz
--- 9.9.2-P1 released --- 3407. [security] Named could die on specific queries with dns64 enabled. [Addressed in change #3388 for BIND 9.8.5 and 9.9.3.] --- 9.9.2 released --- 3383. [security] A certain combination of records in the RBT could cause named to hang while populating the additional section of a response. [RT #31090] 3373. [bug] win32: open raw files in binary mode. [RT #30944] 3364. [security] Named could die on specially crafted record. [RT #30416] --- 9.9.2rc1 released --- 3370. [bug] Address use after free while shutting down. [RT #30241] 3369. [bug] nsupdate terminated unexpectedly in interactive mode if built with readline support. [RT #29550] 3368. [bug] <dns/iptable.h>, <dns/private.h> and <dns/zone.h> were not C++ safe. 3367. [bug] dns_dnsseckey_create() result was not being checked. [RT #30685] 3366. [bug] Fixed Read-After-Write dependency violation for IA64 atomic operations. [RT #25181] 3365. [bug] Removed spurious newlines from log messages in zone.c [RT #30675] 3363. [bug] Need to allow "forward" and "fowarders" options in static-stub zones; this had been overlooked. [RT #30482] 3362. [bug] Setting some option values to 0 in named.conf could trigger an assertion failure on startup. [RT #27730] 3361. [bug] "rndc signing -nsec3param" didn't work correctly when salt was set to '-' (no salt). [RT #30099] 3360. [bug] 'host -w' could die. [RT #18723] 3359. [bug] An improperly-formed TSIG secret could cause a memory leak. [RT #30607] 3357. [port] Add support for libxml2-2.8.x [RT #30440] 3356. [bug] Cap the TTL of signed RRsets when RRSIGs are approaching their expiry, so they don't remain in caches after expiry. [RT #26429] 3355. [port] Use more portable awk in verify system test. 3354. [func] Improve OpenSSL error logging. [RT #29932] --- 9.9.2b1 released --- 3353. [bug] Use a single task for task exclusive operations. [RT #29872] 3352. [bug] Ensure that learned server attributes timeout of the adb cache. [RT #29856] 3351. [bug] isc_mem_put and isc_mem_putanddetach didn't report caller if either ISC_MEM_DEBUGSIZE or ISC_MEM_DEBUGCTX memory debugging flags are set. [RT #30243] 3350. [bug] Memory read overrun in isc___mem_reallocate if ISC_MEM_DEBUGCTX memory debugging flag is set. [RT #30240] 3349. [bug] Change #3345 was incomplete. [RT #30233] 3348. [bug] Prevent RRSIG data from being cached if a negative record matching the covering type exists at a higher trust level. Such data already can't be retrieved from the cache since change 3218 -- this prevents it being inserted into the cache as well. [RT #26809] 3347. [bug] dnssec-settime: Issue a warning when writing a new private key file would cause a change in the permissions of the existing file. [RT #27724] 3346. [security] Bad-cache data could be used before it was initialized, causing an assert. [RT #30025] 3345. [bug] Addressed race condition when removing the last item or inserting the first item in an ISC_QUEUE. [RT #29539] 3344. [func] New "dnssec-checkds" command checks a zone to determine which DS records should be published in the parent zone, or which DLV records should be published in a DLV zone, and queries the DNS to ensure that it exists. (Note: This tool depends on python; it will not be built or installed on systems that do not have a python interpreter.) [RT #28099] 3342. [bug] Change #3314 broke saving of stub zones to disk resulting in excessive cpu usage in some cases. [RT #29952] 3341. [func] New "dnssec-verify" command checks a signed zone to ensure correctness of signatures and of NSEC/NSEC3 chains. [RT #23673] 3339. [func] Allow the maximum supported rsa exponent size to be specified: "max-rsa-exponent-size <value>;" [RT #29228] 3338. [bug] Address race condition in units tests: asyncload_zone and asyncload_zt. [RT #26100] 3337. [bug] Change #3294 broke support for the multiple keys in controls. [RT #29694] 3335. [func] nslookup: return a nonzero exit code when unable to get an answer. [RT #29492] 3334. [bug] Hold a zone table reference while performing a asyncronous load of a zone. [RT #28326] 3333. [bug] Setting resolver-query-timeout too low can cause named to not recover if it loses connectivity. [RT #29623] 3332. [bug] Re-use cached DS rrsets if possible. [RT #29446] 3331. [security] dns_rdataslab_fromrdataset could produce bad rdataslabs. [RT #29644] 3330. [func] Fix missing signatures on NOERROR results despite RPZ rewriting. Also - add optional "recursive-only yes|no" to the response-policy statement - add optional "max-policy-ttl" to the response-policy statement to limit the false data that "recursive-only no" can introduce into resolvers' caches - add a RPZ performance test to bin/tests/system/rpz when queryperf is available. - the encoding of PASSTHRU action to "rpz-passthru". (The old encoding is still accepted.) [RT #26172] 3329. [bug] Handle RRSIG signer-name case consistently: We generate RRSIG records with the signer-name in lower case. We accept them with any case, but if they fail to validate, we try again in lower case. [RT #27451] 3328. [bug] Fixed inconsistent data checking in dst_parse.c. [RT #29401] 3317. [func] Add ECDSA support (RFC 6605). [RT #21918]
2012-10-09Apply P4:christos
3383. [security] A certain combination of records in the RBT could cause named to hang while populating the additional section of a response. [RT #31090]
2012-09-23Update LLVM/Clang snapshot to r164464. This adopts the GCC options forjoerg
the SSP parameters and a not-yet-default rewrite of SROA.
2012-09-13apply fix for CVE-2012-4244 from upstreamspz
upstream changelog: --- 9.9.1-P3 released --- 3364. [security] Named could die on specially crafted record. [RT #30416]
2012-08-10Apply options for all compilers.joerg
2012-08-10Decouple Clang from HAVE_GCC.joerg
2012-07-24the patch for CVE-2012-3868 was incompletespz
2012-07-24Fixes for CVE-2012-3817 and CVE-2012-3868 from ISC:spz
--- 9.9.1-P2 released --- 3346. [security] Bad-cache data could be used before it was initialized, causing an assert. [RT #30025] 3345. [bug] Addressed race condition when removing the last item or inserting the first item in an ISC_QUEUE. [RT #29539] 3342. [bug] Change #3314 broke saving of stub zones to disk resulting in excessive cpu usage in some cases. [RT #29952]
2012-06-15Simplify ERR, so that it doesn't mess up Clang'sjoerg
-Wsometimes-uninitialized scan on the function. This is tracked in LLVM as http://llvm.org/bugs/show_bug.cgi?id=13093.
2012-06-05Merge bind-9.9.1-P1 to fix:christos
Processing of DNS resource records where the rdata field is zero length may cause various issues for the servers handling them. CVE: CVE-2012-1667
2012-06-04Import bind 9.9.1-P1christos
2012-05-09add confgen programschristos
2012-03-17Make a quick note about adding a short summary of changes to the cvs importdholland
message. Currently you can't prepare that in advance and then use cvs import -F file to supply the log message in a file. Will file a PR on cvs for this.
2011-11-16+ 3218. [security] Cache lookup could return RRSIG data associated withmrg
+ nonexistent records, leading to an assertion + failure. [RT #26590] so that someone looking can tell more easily we've applied it.
2011-11-16patch for: https://www.isc.org/software/bind/advisories/cve-2011-tbdchristos
2011-10-08use cleantags, instead of home grown copy.christos