Introduction

   BIND 9.9.3b1 is the first beta release of BIND 9.9.3.

   This document summarizes changes from BIND 9.9.2 to BIND 9.9.3b1.
   Please see the CHANGES file in the source code release for a
   complete list of all changes.

Download

   The latest versions of BIND 9 software can always be found on
   our web site at http://www.isc.org/downloads/all. There you will
   find additional information about each release, source code, and
   pre-compiled versions for Microsoft Windows operating systems.

Support

   Product support information is available on
   http://www.isc.org/services/support for paid support options.
   Free support is provided by our user community via a mailing
   list. Information on all public email lists is available at
   https://lists.isc.org/mailman/listinfo.

Security Fixes

   Prevents named from aborting with a require assertion failure
   on servers with DNS64 enabled.  These crashes might occur as a
   result of specific queries that are received.  (CVE-2012-5688)
   [RT #30792 / #30996]

   Prevents a named assert (crash) when using RPZ to generate A
   records (but not AAAA records) and DNS64 to generate AAAA records
   from A records. [RT #32141]

New Features

   Add support for the RFC 6742 ILNP record types (NID, LP, L32,
   and L64). [RT #31836]

Feature Changes

   Updates the built-in root hints for D.ROOT-SERVERS.NET whose
   IPv4 address changed to 199.7.91.13 (as of 3rd January 2013).
   Note that recursive servers running with an older set of root
   hints will still operate successfully because there are 12 other
   root servers whose addresses are correct and who will respond
   during root priming with the new root nameserver RRset.  [RT
   #32164]

   Adds RFC 6598 reverse zones to the built-in empty zones list:
   64.100.IN-ADDR.ARPA ... 127.100.IN-ADDR.ARPA. [RT #31336]

   Makes available a new XML schema (version 3.0) for the statistics
   channel that adds query type statistics at the zone level,
   flattens the XML tree and uses compressed format to optimize
   parsing. It also includes new XSL that permits charting via the
   Google Charts API on browsers that support javascript in XSL.
   To enable, build BIND with "configure --enable-newstats". [RT
   #30023]

   "named -V" can now report a source ID string.  (This is will be
   of most interest to developers and troubleshooters).  The source
   ID for ISC's production versions of BIND is defined in the "srcid"
   file in the build tree and is normally set to the most recent
   git hash. [RT #31494]

Bug Fixes

   dnssec-keygen and dnssec-setttime disallow setting the delete
   date to be sooner than the inactive date. [RT #31719]

   Update HSM PKCS#11 patches to openssl to add support for openssl
   versions 0.9.8x, 1.0.0j, and 1.0.1c. [RT #29749]

   ddns-confgen now accepts all the TSIG algorithms that it is
   documented as supporting when generating keys. [RT #31927]

   Missing 'managed-keys-directory' is now handled better.  Prior
   to this change, when misconfigured, named could loop and consume
   100% CPU.  [RT #30625]

   Now only the programs that use the readline library will link
   with it (nslookup and nsupdate). [RT #29810]

   When using 'rndc addzone' of a zone with with 'inline-signing
   yes;' named will first load the unsigned version and then
   afterwards successfully create the signed version.  (Prior to
   this fix, the addzone would fail).  [RT #31960]

   dnssec-checkds now emits a clear message when records are not
   found. This change also fixes a minor reporting problem whereby
   dnssec-checkds incorrectly reported that no DS records had been
   found for a KSK, despite having found and listed one. In addition,
   errors in the man pages (referencing the wrong utility) have
   been remedied. [RT #31968]

   dnssec-dsfromkey now no longer puts legal whitespace in DS hashes
   in order to inter-operate better with some overly-strict registrars.
   [RT #31951]

   Addresses portability issues (encountered when testing on HPUX)
   and corrects "rndc signing -nsec3param" to accept the full range
   of possible values.  [RT #31938]

   Named should no longer die on shutdown if running with 128 UDP
   dispatches per interface. [RT #31743]

   Some DNSSEC-related options (update-check-ksk, dnssec-loadkeys-interval,
   dnssec-dnskey-kskonly) are now accepted in slave zone definitions
   in named.conf when inline-signing is being used. [RT #31078]

   Addresses build problems encountered on NetBSD 6.0 (renames the
   'bool' parameter to avoid a namespace clash).  [RT #31515]

   When using the zone reload method of importing changes to named
   with in-line signing, changes to SOA record parameters (other
   than the serial number alone) in the un-signed zone will now
   trigger named to update the signed version of the zone.  Prior
   to this fix, if SOA parameters were updated while the server was
   offline but without any changes also being made to other records
   in the zone, then those changes would not be picked up when the
   server was restarted/reloaded. [RT #29272]

   named-checkconf now detects missing master lists in also-notify
   clauses. [RT #30810]

   Improves locking performance when recursing. (This change
   implements several different strategies for reducing lock
   contention, specifically relating to the internal structures
   that are used when handling upstream queries). [RT #28836]

   When recursing, named now uses multiple dispatch objects for
   sending upstream queries; this can improve performance on busy
   multiprocessor systems by reducing lock contention, particularly
   when the cache hit rate is low. [RT #28605]

   Handle cases where a port is reserved and cannot be used as the
   source for a query. [RT #31778]

   Correct a case where a negative response could incorrectly be
   flagged as being DNSSEC authenticated when it was not actually
   authenticated. [RT #32237]

   Fix missing includes in testing support library that caused it
   to fail to build on some platforms. [RT #32012]

   Return correct error code (FORMERR) when presented with malformed
   requests containing overly long domain names. [RT #29682]

   Instead of rejecting and logging a FORMERR, named now accepts
   duplicate singleton records in a DNS query response.  (In some
   situations, query responses may contain duplicates - and whilst
   this is not technically correct, BIND has been updated to be
   more tolerant).  [RT #32329]

   When named allocates an initial per-thread stack size, it first
   checks the operating system's default value, and if specified,
   uses that.  In the situation where it appears that none is
   provided, it uses an internal default.  This default has been
   increased from 64K to 1M to accommodate operating systems that
   require a larger initial stack.  [RT #32230]

   The allow-query-on ACL is now processed correctly in all situations.
   [RT #29486]

   The configure script now supports and detects libxml2-2.9.x
   correctly. [RT #32231]

   When loading a zone file, named now emits a warning if it
   encounters a non-blank owner name following $ORIGIN.  The reason
   for this is that when parsing a zone file, the blank owner name
   indicates that the current name (i.e. the name from the previous
   record that named loaded) should be used, even though $ORIGIN
   has changed.  Particularly when handling subdomains, this can
   result in those records being unexpectedly loaded with different
   labels than intended.   [RT #31848]

   Resolves a problem that when answering queries for nonexistent
   names via wildcard CNAME records, DNSSEC responses could fail
   to include the NSEC/NSEC3 records proving the lack of a better
   answer.  [RT #21409]

   Prevents a named abort  (assertion fail) during recovery from
   an out of memory condition.  This crash would be encountered in
   module general: dst_api.c and logged as REQUIRE((&key->refs)->refs
   == 0).  [RT #32131]

   A new configure option --with-ecdsa has been added to force
   building with ECDSA, bypassing the script-based checks that this
   functionality is available in the build environment. The converse,
   --without-ecdsa, explicitly disables ECDSA support during the
   BIND build.  Both of these options have been added to assist
   cross-compilation to environments that do (or don't) support
   ECDSA, overriding the default build behaviour.   [RT #32078]

   XML statistics generated by Windows builds contained incorrectly
   formatted "boot-time" and "current-time" values.  [RT #32044]

   dig now prints the timezone as part of the timestamp in the
   "WHEN" line of the output.  [RT #2269]

   Fixes a race condition in acache.c that could cause named to
   crash if the acache feature was enabled.  [RT #31908]

   Prevents named from consuming high CPU resources when re-signing
   if all keys are offline.  [RT #31916]

   Addresses compilation issues when using the GNU build VPATH
   feature.  [RT #31879]

   Fixes a race condition when DNSSEC validation is canceled (e.g.
   by server shutdown).  [RT #31804]

   Prevents crashes on startup of named, dig and other utilities
   from 64-bit builds of BIND in the Solaris 11 environment.
   Compilers inadvertently created a 64-bit-aligned
   instruction/32-bit-aligned pointer issue in an area of code that
   is shared between many of the BIND binaries.   Copying the timeval
   structure from control message data before using it prevents
   this from happening.  [RT #31548]

   Uses IPV6_USE_MIN_MTU (or equivalent) with TCP in addition to
   UDP.   This change addresses TCP query failures that are due to
   delays in learning the working PMTU when communicating via
   tunneled IPv6. [RT #31690]

   Fixes compilation errors when building with ISC_MEM_TRACKLINES
   or ISC_MEMPOOL_NAMES disabled and also makes ISC_MEM_DEBUG
   non-optional. [RT #31559]

   Prevents named from terminating unexpectedly during on very busy
   high-end servers that are using the additional section cache
   ("acache-enable yes;"). [RT #31253]

   When re-signing a zone, dnssec-signzone now removes RRSIG and
   NSEC records from nodes that used to be in-zone but are now below
   a zone cut. This situation is most likely to arise following the
   delegation of a subdomain where the glue (A and AAAA) records
   for the nameservers used to be included in the parent zone, but
   other scenarios are also possible. [RT #31556]

   Silences unnecessarily noisy OpenSSL logging by suppressing some
   warning messages and moving others to the "dnssec" logging
   category.  Note that the increased logging was introduced by
   change 3354 (RT #29932).  [RT #31497]

   Implements a collection of minor changes in response to warnings
   generated by several source code validation utilities. No instances
   of problems have been reported, but these code changes improve
   the future reliability and resilience of BIND9. [RT #31484, RT
   #31626]

   dig no longer crashes when using +nssearch with +tcp. [RT #25298]

   OPT records are no longer removed from signed truncated query
   responses.  Receipt of these responses might cause recursive
   servers to incorrectly identify the sending servers as unable
   to support EDNS0.  [RT #31439]

   Message 'sucessfully validated after lower casing signer' is now
   logged at debug level 1 and has been moved to category "dnssec".
   (The misspelling is also corrected).   RT #31414]

   "host -C" should no longer crash with a core dump if REFUSED is
   received.  This behaviour was an underlying cause of intermittent
   and often unreproducible crashes which have been experienced by
   users of the host command.  [RT #31381]

   A DNSKEY lookup that encounters a CNAME will now no longer return
   SERVFAIL.  This failure mode might have been observed in named's
   logfiles as a resolver format error "CNAME response for DNSKEY
   RR". [RT #31262]

   dig now consistently returns NOERROR in TSIG; prior to this
   change it would occasionally display '0' instead. [RT #31275]

   Prevents a named hang (due to a violation of lock ordering that
   can lead to a deadlock between threads) that may occur in some
   situations when generating new NSEC / NSEC3 chains. [RT #31224]

   Slave SOA queries now observe "use-v4-udp-ports" and "use-v6-udp-ports"
   ranges appropriately.  Prior to this change the IPv6 port range
   was applied to all SOA refresh queries.  Most of the time this
   behaviour would be unnoticed because the IPv6 port range is
   seldom configured separately and defaults to the IPv4 port range.
   But if an administrator chose to specify a null IPv6 port range
   ("use-v6-udp-ports { };") on a slave server, SOA refresh queries
   would be completely disabled.  [RT #24173]

   named could die if a non-existant master list was referenced in
   an "also-notify" statement. [RT #31004]

   In some cases, servers were being marked as not supporting EDNS
   despite not receiving a successful response [RT #30811]

   Parsing tests for 32 bit integers will now return a range error
   on systems that support 64-bit longs. This change may impact
   administrators who have mistakenly been using serial numbers
   greater than 2**32 in their zone files (for example, using format
   YYYYMMDDXXXX) and whose zones loaded, but should have been
   rejected. The loaded zones would have appeared to be functioning
   correctly, but in some instances could suffer from operational
   problems (for example, when enabling IXFR).  [RT #30232]

   Silences spurious "deleted from unreachable cache" messages. [RT
   #30501]

   When receiving a query with AD=1 named will now behave in the
   same way as when DO=1 is set when deciding whether to add NS
   RRsets to the additional section or not.  Prior to this change,
   when a reply was constructed to a query with DO=1 and if  the
   answer section was signed and valid then named wouldn't add
   untrusted NS RRsets to the additional section.  But if with AD=1
   (and DO=0) in the query, then it might have added available but
   untrusted RRsets to the response, at the same time setting AD=0.
   [RT #30479]

Thank You

   Thank you to everyone who assisted us in making this release
   possible. If you would like to contribute to ISC to assist us
   in continuing to make quality open source software, please visit
   our donations page at http://www.isc.org/supportisc.

(c) 2001-2013 Internet Systems Consortium