Release Notes for BIND Version 9.9.12rc1

Introduction

   This document summarizes significant changes since the last production
   release of BIND on the corresponding major release branch. Please see
   the CHANGES file for a further list of bug fixes and other changes.

Download

   The latest versions of BIND 9 software can always be found at
   http://www.isc.org/downloads/. There you will find additional
   information about each release, source code, and pre-compiled versions
   for Microsoft Windows operating systems.

New DNSSEC Root Key

   ICANN is in the process of introducing a new Key Signing Key (KSK) for
   the global root zone. BIND has multiple methods for managing DNSSEC
   trust anchors, with somewhat different behaviors. If the root key is
   configured using the managed-keys statement, or if the pre-configured
   root key is enabled by using dnssec-validation auto, then BIND can keep
   keys up to date automatically. Servers configured in this way should
   have begun the process of rolling to the new key when it was published
   in the root zone in July 2017. However, keys configured using the
   trusted-keys statement are not automatically maintained. If your server
   is performing DNSSEC validation and is configured using trusted-keys,
   you are advised to change your configuration before the root zone
   begins signing with the new KSK. This is currently scheduled for
   October 11, 2017.

   This release includes an updated version of the bind.keys file
   containing the new root key. This file can also be downloaded from
   https://www.isc.org/bind-keys .

Legacy Windows No Longer Supported

   As of BIND 9.9.11, Windows XP and Windows 2003 are no longer supported
   platforms for BIND; "XP" binaries are no longer available for download
   from ISC.

Security Fixes

     * An error in TSIG handling could permit unauthorized zone transfers
       or zone updates. These flaws are disclosed in CVE-2017-3142 and
       CVE-2017-3143. [RT #45383]
     * The BIND installer on Windows used an unquoted service path, which
       can enable privilege escalation. This flaw is disclosed in
       CVE-2017-3141. [RT #45229]
     * With certain RPZ configurations, a response with TTL 0 could cause
       named to go into an infinite query loop. This flaw is disclosed in
       CVE-2017-3140. [RT #45181]
     * Addresses could be referenced after being freed during resolver
       processing, causing an assertion failure. The chances of this
       happening were remote, but the introduction of a delay in
       resolution increased them. This bug is disclosed in CVE-2017-3145.
       [RT #46839]
     * update-policy rules that otherwise ignore the name field now
       require that it be set to "." to ensure that any type list present
       is properly interpreted. If the name field was omitted from the
       rule declaration and a type list was present it wouldn't be
       interpreted as expected.

Removed Features

     * The ISC DNSSEC Lookaside Validation (DLV) service has been shut
       down; all DLV records in the dlv.isc.org zone have been removed.
       References to the service have been removed from BIND
       documentation. Lookaside validation is no longer used by default by
       delv. The DLV key has been removed from bind.keys. Setting
       dnssec-lookaside to auto or to use dlv.isc.org as a trust anchor
       results in a warning being issued.

Protocol Changes

     * BIND can now use the Ed25519 and Ed448 Edwards Curve DNSSEC signing
       algorithms described in RFC 8080. Note, however, that these
       algorithms must be supported in OpenSSL; currently they are only
       available in the development branch of OpenSSL at
       https://github.com/openssl/openssl. [RT #44696]
     * When parsing DNS messages, EDNS KEY TAG options are checked for
       correctness. When printing messages (for example, in dig), EDNS KEY
       TAG options are printed in readable format.

Feature Changes

     * named will no longer start or accept reconfiguration if
       managed-keys or dnssec-validation auto are in use and the
       managed-keys directory (specified by managed-keys-directory, and
       defaulting to the working directory if not specified), is not
       writable by the effective user ID. [RT #46077]
     * Previously, update-policy local; accepted updates from any source
       so long as they were signed by the locally-generated session key.
       This has been further restricted; updates are now only accepted
       from locally configured addresses. [RT #45492]
     * Threads in named are now set to human-readable names to assist
       debugging on operating systems that support that. Threads will have
       names such as "isc-timer", "isc-sockmgr", "isc-worker0001", and so
       on. This will affect the reporting of subsidiary thread names in ps
       and top, but not the main thread. [RT #43234]
     * DiG now warns about .local queries which are reserved for Multicast
       DNS. [RT #44783]

Bug Fixes

     * Attempting to validate improperly unsigned CNAME responses from
       secure zones could cause a validator loop. This caused a delay in
       returning SERVFAIL and also increased the chances of encountering
       the crash bug described in CVE-2017-3145. [RT #46839]
     * When named was reconfigured, failure of some zones to load
       correctly could leave the system in an inconsistent state; while
       generally harmless, this could lead to a crash later when using
       rndc addzone. Reconfiguration changes are now fully rolled back in
       the event of failure. [RT #45841]
     * Fixed a bug that was introduced in an earlier development release
       which caused multi-packet AXFR and IXFR messages to fail validation
       if not all packets contained TSIG records; this caused
       interoperability problems with some other DNS implementations. [RT
       #45509]
     * Semicolons are no longer escaped when printing CAA and URI records.
       This may break applications that depend on the presence of the
       backslash before the semicolon. [RT #45216]
     * AD could be set on truncated answer with no records present in the
       answer and authority sections. [RT #45140]
     * Some header files included <isc/util.h> incorrectly as it pollutes
       with namespace with non ISC_ macros and this should only be done by
       explicitly including <isc/util.h>. This has been corrected. Some
       code may depend on <isc/util.h> being implicitly included via other
       header files. Such code should explicitly include <isc/util.h>.
     * Zones created with rndc addzone could temporarily fail to inherit
       the allow-transfer ACL set in the options section of named.conf.
       [RT #46603]
     * named failed to properly determine whether there were active KSK
       and ZSK keys for an algorithm when update-check-ksk was true (which
       is the default setting). This could leave records unsigned when
       rolling keys. [RT #46743] [RT #46754] [RT #46774]

End of Life

   BIND 9.9 (Extended Support Version) will be supported until at least
   June, 2018. https://www.isc.org/downloads/software-support-policy/

Thank You

   Thank you to everyone who assisted us in making this release possible.
   If you would like to contribute to ISC to assist us in continuing to
   make quality open source software, please visit our donations page at
   http://www.isc.org/donate/.