Release Notes 

Contents

Release Notes

Introduction 

BIND 9.17 is an unstable development release of BIND. This document summarizes new features and functional changes that have been introduced on this branch. With each development release leading up to the stable BIND 9.18 release, this document will be updated with additional features added and bugs fixed. Please see the CHANGES file for a more detailed list of changes and bug fixes.

Supported Platforms 

To build on Unix-like systems, BIND requires support for POSIX.1c threads (IEEE Std 1003.1c-1995), the Advanced Sockets API for IPv6 (RFC 3542), and standard atomic operations provided by the C compiler.

The libuv asynchronous I/O library and the OpenSSL cryptography library must be available for the target platform. A PKCS#11 provider can be used instead of OpenSSL for Public Key cryptography (i.e., DNSSEC signing and validation), but OpenSSL is still required for general cryptography operations such as hashing and random number generation.

More information can be found in the PLATFORMS.md file that is included in the source distribution of BIND 9. If your compiler and system libraries provide the above features, BIND 9 should compile and run. If that is not the case, the BIND development team will generally accept patches that add support for systems that are still supported by their respective vendors.

Download 

The latest versions of BIND 9 software can always be found at https://www.isc.org/download/. There you will find additional information about each release, and source code.

Notes for BIND 9.17.19 

Security Fixes 

The lame-ttl option controls how long named caches certain types of broken responses from authoritative servers (see the security advisory for details). This caching mechanism could be abused by an attacker to significantly degrade resolver performance. The vulnerability has been mitigated by changing the default value of lame-ttl to 0 and overriding any explicitly set value with 0, effectively disabling this mechanism altogether. ISC’s testing has determined that doing that has a negligible impact on resolver performance while also preventing abuse. Administrators may observe more traffic towards servers issuing certain types of broken responses than in previous BIND 9 releases, depending on client query patterns. (CVE-2021-25219)

ISC would like to thank Kishore Kumar Kothapalli of Infoblox for bringing this vulnerability to our attention. [GL #2899]

New Features 

It is now possible to specify the TLS protocol versions to support for each tls configuration clause (e.g. protocols { TLSv1.2; TLSv1.3; };). [GL #2795]
New options for tls configuration clauses were implemented, namely:
- dhparam-file "<path_to_file>"; for specifying Diffie-Hellman parameters,
- ciphers "<cipher_list>"; for specifying OpenSSL ciphers to use,
- prefer-server-ciphers <yes|no>; for specifying whether server ciphers or client ciphers should be preferred (this controls OpenSSL’s SSL_OP_CIPHER_SERVER_PREFERENCE option),
- session-tickets <yes|no>; for enabling/disabling stateless TLS session tickets (see RFC 5077).
These options allow finer control over TLS protocol configuration and make achieving perfect forward secrecy (PFS) possible for DNS-over-TLS (DoT) and DNS-over-HTTPS (DoH). [GL #2796]

Removed Features 

Native PKCS#11 support has been removed; BIND 9 now uses engine_pkcs11 for PKCS#11. engine_pkcs11 is an OpenSSL engine which is part of the OpenSC project. [GL #2691]
Old-style Dynamically Loadable Zones (DLZ) drivers that had to be enabled in named at build time have been removed. New-style DLZ modules should be used as a replacement. [GL #2814]
Support for the map zone file format (masterfile-format map;) has been removed. Users relying on the map format are advised to convert their zones to the raw format with named-compilezone and change the configuration appropriately prior to upgrading BIND 9. [GL #2882]

Feature Changes 

The network manager API is now used for sending all outgoing DNS queries and requests from named and related tools, including delv, mdig, and nsupdate. [GL #2401]
named and named-checkconf now exit with an error when a single port configured for query-source, transfer-source, notify-source, parental-source, and/or their respective IPv6 counterparts clashes with a global listening port. This configuration has not been supported since BIND 9.16.0, but no error was reported until now (even though sending UDP messages such as NOTIFY failed). [GL #2888]
named and named-checkconf now issue a warning when there is a single port configured for query-source, transfer-source, notify-source, parental-source, and/or for their respective IPv6 counterparts. [GL #2888]
Zone transfers over TLS (XoT) now need the dot Application-Layer Protocol Negotiation (ALPN) token to be selected in the TLS handshake, as required by RFC 9103 section 7.1. [GL #2794]