head	1.2;
access;
symbols
	perseant-exfatfs-base-20261102:1.2
	perseant-exfatfs-base-20250801:1.2
	perseant-exfatfs-base-20240630:1.2
	perseant-exfatfs:1.2.0.2
	perseant-exfatfs-base:1.2
	bind-9-16-20:1.1.1.3
	cjep_sun2x-base1:1.1.1.2
	cjep_sun2x:1.1.1.2.0.4
	cjep_sun2x-base:1.1.1.2
	cjep_staticlib_x-base1:1.1.1.2
	cjep_staticlib_x:1.1.1.2.0.2
	cjep_staticlib_x-base:1.1.1.2
	bind-9-16-15:1.1.1.2
	bind-9-16-12:1.1.1.2
	bind-9-16-5:1.1.1.1
	ISC:1.1.1;
locks; strict;
comment	@# @;


1.2
date	2022.09.23.12.15.28;	author christos;	state dead;
branches;
next	1.1;
commitid	Nr90z7GSfZTM2ZUD;

1.1
date	2020.08.03.17.07.08;	author christos;	state Exp;
branches
	1.1.1.1;
next	;
commitid	KnuW8jfKvKqpLDiC;

1.1.1.1
date	2020.08.03.17.07.08;	author christos;	state Exp;
branches;
next	1.1.1.2;
commitid	KnuW8jfKvKqpLDiC;

1.1.1.2
date	2021.02.19.16.37.09;	author christos;	state Exp;
branches;
next	1.1.1.3;
commitid	4Ti8ZbBo8W7walIC;

1.1.1.3
date	2021.08.19.11.45.20;	author christos;	state Exp;
branches;
next	;
commitid	rd9GxKxylonAJz5D;


desc
@@


1.2
log
@Merge conflicts between 9.16.20 and 9.16.33
@
text
@.. 
   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
   
   This Source Code Form is subject to the terms of the Mozilla Public
   License, v. 2.0. If a copy of the MPL was not distributed with this
   file, You can obtain one at http://mozilla.org/MPL/2.0/.
   
   See the COPYRIGHT file distributed with this work for additional
   information regarding copyright ownership.

..
   Copyright (C) Internet Systems Consortium, Inc. ("ISC")

   This Source Code Form is subject to the terms of the Mozilla Public
   License, v. 2.0. If a copy of the MPL was not distributed with this
   file, You can obtain one at http://mozilla.org/MPL/2.0/.

   See the COPYRIGHT file distributed with this work for additional
   information regarding copyright ownership.

.. _dnssec.dynamic.zones:

DNSSEC, Dynamic Zones, and Automatic Signing
--------------------------------------------

Converting From Insecure to Secure
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Changing a zone from insecure to secure can be done in two ways: using a
dynamic DNS update, or via the ``auto-dnssec`` zone option.

For either method, ``named`` must be configured so that it can see
the ``K*`` files which contain the public and private parts of the keys
that are used to sign the zone. These files are generated
by ``dnssec-keygen``, and they should be placed in the
key-directory, as specified in ``named.conf``:

::

       zone example.net {
           type master;
           update-policy local;
           file "dynamic/example.net/example.net";
           key-directory "dynamic/example.net";
       };

If one KSK and one ZSK DNSKEY key have been generated, this
configuration causes all records in the zone to be signed with the
ZSK, and the DNSKEY RRset to be signed with the KSK. An NSEC
chain is generated as part of the initial signing process.

Dynamic DNS Update Method
~~~~~~~~~~~~~~~~~~~~~~~~~

To insert the keys via dynamic update:

::

       % nsupdate
       > ttl 3600
       > update add example.net DNSKEY 256 3 7 AwEAAZn17pUF0KpbPA2c7Gz76Vb18v0teKT3EyAGfBfL8eQ8al35zz3Y I1m/SAQBxIqMfLtIwqWPdgthsu36azGQAX8=
       > update add example.net DNSKEY 257 3 7 AwEAAd/7odU/64o2LGsifbLtQmtO8dFDtTAZXSX2+X3e/UNlq9IHq3Y0 XtC0Iuawl/qkaKVxXe2lo8Ct+dM6UehyCqk=
       > send

While the update request completes almost immediately, the zone is
not completely signed until ``named`` has had time to walk the zone
and generate the NSEC and RRSIG records. The NSEC record at the apex
is added last, to signal that there is a complete NSEC chain.

To sign using NSEC3 instead of NSEC, add an
NSEC3PARAM record to the initial update request. The OPTOUT bit in the NSEC3
chain can be set in the flags field of the
NSEC3PARAM record.

::

       % nsupdate
       > ttl 3600
       > update add example.net DNSKEY 256 3 7 AwEAAZn17pUF0KpbPA2c7Gz76Vb18v0teKT3EyAGfBfL8eQ8al35zz3Y I1m/SAQBxIqMfLtIwqWPdgthsu36azGQAX8=
       > update add example.net DNSKEY 257 3 7 AwEAAd/7odU/64o2LGsifbLtQmtO8dFDtTAZXSX2+X3e/UNlq9IHq3Y0 XtC0Iuawl/qkaKVxXe2lo8Ct+dM6UehyCqk=
       > update add example.net NSEC3PARAM 1 1 100 1234567890
       > send

Again, this update request completes almost immediately; however,
the record does not show up until ``named`` has had a chance to
build/remove the relevant chain. A private type record is created
to record the state of the operation (see below for more details), and
is removed once the operation completes.

While the initial signing and NSEC/NSEC3 chain generation is happening,
other updates are possible as well.

Fully Automatic Zone Signing
~~~~~~~~~~~~~~~~~~~~~~~~~~~~

To enable automatic signing, add the ``auto-dnssec`` option to the zone
statement in ``named.conf``. ``auto-dnssec`` has two possible arguments:
``allow`` or ``maintain``.

With ``auto-dnssec allow``, ``named`` can search the key directory for
keys matching the zone, insert them into the zone, and use them to sign
the zone. It does so only when it receives an
``rndc sign <zonename>``.

``auto-dnssec maintain`` includes the above functionality, but also
automatically adjusts the zone's DNSKEY records on a schedule according to
the keys' timing metadata. (See :ref:`man_dnssec-keygen` and
:ref:`man_dnssec-settime` for more information.)

``named`` periodically searches the key directory for keys matching
the zone; if the keys' metadata indicates that any change should be
made to the zone, such as adding, removing, or revoking a key, then that
action is carried out. By default, the key directory is checked for
changes every 60 minutes; this period can be adjusted with the
``dnssec-loadkeys-interval``, up to a maximum of 24 hours. The
``rndc loadkeys`` command forces ``named`` to check for key updates immediately.

If keys are present in the key directory the first time the zone is
loaded, the zone is signed immediately, without waiting for an
``rndc sign`` or ``rndc loadkeys`` command. Those commands can still be
used when there are unscheduled key changes.

When new keys are added to a zone, the TTL is set to match that of any
existing DNSKEY RRset. If there is no existing DNSKEY RRset, the
TTL is set to the TTL specified when the key was created (using the
``dnssec-keygen -L`` option), if any, or to the SOA TTL.

To sign the zone using NSEC3 instead of NSEC, submit an
NSEC3PARAM record via dynamic update prior to the scheduled publication
and activation of the keys. The OPTOUT bit for the NSEC3 chain can be set
in the flags field of the NSEC3PARAM record. The
NSEC3PARAM record does not appear in the zone immediately, but it is
stored for later reference. When the zone is signed and the NSEC3
chain is completed, the NSEC3PARAM record appears in the zone.

Using the ``auto-dnssec`` option requires the zone to be configured to
allow dynamic updates, by adding an ``allow-update`` or
``update-policy`` statement to the zone configuration. If this has not
been done, the configuration fails.

Private-type Records
~~~~~~~~~~~~~~~~~~~~

The state of the signing process is signaled by private-type records
(with a default type value of 65534). When signing is complete, those
records with a nonzero initial octet have a nonzero value for the final octet.

If the first octet of a private-type record is non-zero, the
record indicates either that the zone needs to be signed with the key matching
the record, or that all signatures that match the record should be
removed.

   algorithm (octet 1)

   key id in network order (octet 2 and 3)

   removal flag (octet 4)
   
   complete flag (octet 5)

Only records flagged as "complete" can be removed via dynamic update.
Attempts to remove other private type records are silently ignored.

If the first octet is zero (this is a reserved algorithm number that
should never appear in a DNSKEY record), the record indicates
changes to the NSEC3 chains are in progress. The rest of the record
contains an NSEC3PARAM record, while the flag field tells what operation to
perform based on the flag bits.

   0x01 OPTOUT

   0x80 CREATE

   0x40 REMOVE

   0x20 NONSEC

DNSKEY Rollovers
~~~~~~~~~~~~~~~~

As with insecure-to-secure conversions, DNSSEC keyrolls can be done
in two ways: using a dynamic DNS update, or via the ``auto-dnssec`` zone
option.

Dynamic DNS Update Method
~~~~~~~~~~~~~~~~~~~~~~~~~

To perform key rollovers via dynamic update, the ``K*``
files for the new keys must be added so that ``named`` can find them.
The new DNSKEY RRs can then be added via dynamic update. ``named`` then causes the
zone to be signed with the new keys; when the signing is complete, the
private-type records are updated so that the last octet is non-zero.

If this is for a KSK, the parent and any trust anchor
repositories of the new KSK must be informed.

The maximum TTL in the zone must expire before removing the
old DNSKEY. If it is a KSK that is being updated,
the DS RRset in the parent must also be updated and its TTL allowed to expire. This
ensures that all clients are able to verify at least one signature
when the old DNSKEY is removed.

The old DNSKEY can be removed via UPDATE, taking care to specify the
correct key. ``named`` cleans out any signatures generated by the
old key after the update completes.

Automatic Key Rollovers
~~~~~~~~~~~~~~~~~~~~~~~

When a new key reaches its activation date (as set by ``dnssec-keygen``
or ``dnssec-settime``), if the ``auto-dnssec`` zone option is set to
``maintain``, ``named`` automatically carries out the key rollover.
If the key's algorithm has not previously been used to sign the zone,
then the zone is fully signed as quickly as possible. However, if
the new key replaces an existing key of the same algorithm, the
zone is re-signed incrementally, with signatures from the old key
replaced with signatures from the new key as their signature
validity periods expire. By default, this rollover completes in 30 days,
after which it is safe to remove the old key from the DNSKEY RRset.

NSEC3PARAM Rollovers via UPDATE
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

The new NSEC3PARAM record can be added via dynamic update. When the new NSEC3
chain has been generated, the NSEC3PARAM flag field is set to zero. At
that point, the old NSEC3PARAM record can be removed. The old chain is
removed after the update request completes.

Converting From NSEC to NSEC3
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

To do this, an NSEC3PARAM record must be added. When the
conversion is complete, the NSEC chain is removed and the
NSEC3PARAM record has a zero flag field. The NSEC3 chain is
generated before the NSEC chain is destroyed.

Converting From NSEC3 to NSEC
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

To do this, use ``nsupdate`` to remove all NSEC3PARAM records with a
zero flag field. The NSEC chain is generated before the NSEC3 chain
is removed.

Converting From Secure to Insecure
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

To convert a signed zone to unsigned using dynamic DNS, delete all the
DNSKEY records from the zone apex using ``nsupdate``. All signatures,
NSEC or NSEC3 chains, and associated NSEC3PARAM records are removed
automatically. This takes place after the update request completes.

This requires the ``dnssec-secure-to-insecure`` option to be set to
``yes`` in ``named.conf``.

In addition, if the ``auto-dnssec maintain`` zone statement is used, it
should be removed or changed to ``allow`` instead; otherwise it will re-sign.

Periodic Re-signing
~~~~~~~~~~~~~~~~~~~

In any secure zone which supports dynamic updates, ``named``
periodically re-signs RRsets which have not been re-signed as a result of
some update action. The signature lifetimes are adjusted to
spread the re-sign load over time rather than all at once.

NSEC3 and OPTOUT
~~~~~~~~~~~~~~~~

``named`` only supports creating new NSEC3 chains where all the NSEC3
records in the zone have the same OPTOUT state. ``named`` supports
UPDATES to zones where the NSEC3 records in the chain have mixed OPTOUT
state. ``named`` does not support changing the OPTOUT state of an
individual NSEC3 record; if the
OPTOUT state of an individual NSEC3 needs to be changed, the entire chain must be changed.
@


1.1
log
@Initial revision
@
text
@@


1.1.1.1
log
@	--- 9.16.5 released ---

5458.	[bug]		Prevent a theoretically possible NULL dereference caused
			by a data race between zone_maintenance() and
			dns_zone_setview_helper(). [GL #1627]

5455.	[bug]		named could crash when cleaning dead nodes in
			lib/dns/rbtdb.c that were being reused. [GL #1968]

5454.	[bug]		Address a startup crash that occurred when the server
			was under load and the root zone had not yet been
			loaded. [GL #1862]

5453.	[bug]		named crashed on shutdown when a new rndc connection was
			received during shutdown. [GL #1747]

5452.	[bug]		The "blackhole" ACL was accidentally disabled for client
			queries. [GL #1936]

5451.	[func]		Add 'rndc dnssec -status' command. [GL #1612]

5449.	[bug]		Fix a socket shutdown race in netmgr udp. [GL #1938]

5448.	[bug]		Fix a race condition in isc__nm_tcpdns_send().
			[GL #1937]

5447.	[bug]		IPv6 addresses ending in "::" could break YAML
			parsing. A "0" is now appended to such addresses
			in YAML output from dig, mdig, delv, and dnstap-read.
			[GL #1952]

5446.	[bug]		The validator could fail to accept a properly signed
			RRset if an unsupported algorithm appeared earlier in
			the DNSKEY RRset than a supported algorithm. It could
			also stop if it detected a malformed public key.
			[GL #1689]

5444.	[bug]		'rndc dnstap -roll <value>' did not limit the number of
			saved files to <value>. [GL !3728]

5443.	[bug]		The "primary" and "secondary" keywords, when used
			as parameters for "check-names", were not
			processed correctly and were being ignored. [GL #1949]

5441.	[bug]		${LMDB_CFLAGS} was missing from make/includes.in.
			[GL #1955]

5440.	[test]		Properly handle missing kyua. [GL #1950]

5439.	[bug]		The DS RRset returned by dns_keynode_dsset() was used in
			a non-thread-safe manner. [GL #1926]

	--- 9.16.4 released ---

5438.	[bug]		Fix a race in TCP accepting code. [GL #1930]

5437.	[bug]		Fix a data race in lib/dns/resolver.c:log_formerr().
			[GL #1808]

5436.	[security]	It was possible to trigger an INSIST when determining
			whether a record would fit into a TCP message buffer.
			(CVE-2020-8618) [GL #1850]

5435.	[tests]		Add RFC 4592 responses examples to the wildcard system
			test. [GL #1718]

5434.	[security]	It was possible to trigger an INSIST in
			lib/dns/rbtdb.c:new_reference() with a particular zone
			content and query patterns. (CVE-2020-8619) [GL #1111]
			[GL #1718]

5431.	[func]		Reject DS records at the zone apex when loading
			master files. Log but otherwise ignore attempts to
			add DS records at the zone apex via UPDATE. [GL #1798]

5430.	[doc]		Update docs - with netmgr, a separate listening socket
			is created for each IPv6 interface (just as with IPv4).
			[GL #1782]

5428.	[bug]		Clean up GSSAPI resources in nsupdate only after taskmgr
			has been destroyed. Thanks to Petr Menšík. [GL !3316]

5426.	[bug]		Don't abort() when setting SO_INCOMING_CPU on the socket
			fails. [GL #1911]

5425.	[func]		The default value of "max-stale-ttl" has been changed
			from 1 week to 12 hours. [GL #1877]

5424.	[bug]		With KASP, when creating a successor key, the "goal"
			state of the current active key (predecessor) was not
			changed and thus never removed from the zone. [GL #1846]

5423.	[bug]		Fix a bug in keymgr_key_has_successor(): it incorrectly
			returned true if any other key in the keyring had a
			successor. [GL #1845]

5422.	[bug]		When using dnssec-policy, print correct key timing
			metadata. [GL #1843]

5421.	[bug]		Fix a race that could cause named to crash when looking
			up the nodename of an RBT node if the tree was modified.
			[GL #1857]

5420.	[bug]		Add missing isc_{mutex,conditional}_destroy() calls
			that caused a memory leak on FreeBSD. [GL #1893]

5418.	[bug]		delv failed to parse deprecated trusted-keys-style
			trust anchors. [GL #1860]

5416.	[bug]		Fix a lock order inversion in lib/isc/unix/socket.c.
			[GL #1859]

5415.	[test]		Address race in dnssec system test that led to
			test failures. [GL #1852]

5414.	[test]		Adjust time allowed for journal truncation to occur
			in nsupdate system test to avoid test failure.
			[GL #1855]

5413.	[test]		Address race in autosign system test that led to
			test failures. [GL #1852]

5412.	[bug]		'provide-ixfr no;' failed to return up-to-date responses
			when the serial was greater than or equal to the
			current serial. [GL #1714]

5411.	[cleanup]	TCP accept code has been refactored to use a single
			accept() and pass the accepted socket to child threads
			for processing. [GL !3320]

5409.	[performance]	When looking up NSEC3 data in a zone database, skip the
			check for empty non-terminal nodes; the NSEC3 tree does
			not have any. [GL #1834]

5408.	[protocol]	Print Extended DNS Errors if present in OPT record.
			[GL #1835]

5407.	[func]		Zone timers are now exported via statistics channel.
			Thanks to Paul Frieden, Verizon Media. [GL #1232]

5405.	[bug]		'named-checkconf -p' could include spurious text in
			server-addresses statements due to an uninitialized DSCP
			value. [GL #1812]
@
text
@@


1.1.1.2
log
@	--- 9.16.12 released ---

5578.	[protocol]	Make "check-names" accept A records below "_spf",
			"_spf_rate", and "_spf_verify" labels in order to cater
			for the "exists" SPF mechanism specified in RFC 7208
			section 5.7 and appendix D.1. [GL #2377]

5577.	[bug]		Fix the "three is a crowd" key rollover bug in KASP by
			correctly implementing Equation (2) of the "Flexible and
			Robust Key Rollover" paper. [GL #2375]

5575.	[bug]		When migrating to KASP, BIND 9 considered keys with the
			"Inactive" and/or "Delete" timing metadata to be
			possible active keys. This has been fixed. [GL #2406]

5572.	[bug]		Address potential double free in generatexml().
			[GL #2420]

5571.	[bug]		named failed to start when its configuration included a
			zone with a non-builtin "allow-update" ACL attached.
			[GL #2413]

5570.	[bug]		Improve performance of the DNSSEC verification code by
			reducing the number of repeated calls to
			dns_dnssec_keyfromrdata(). [GL #2073]

5569.	[bug]		Emit useful error message when "rndc retransfer" is
			applied to a zone of inappropriate type. [GL #2342]

5568.	[bug]		Fixed a crash in "dnssec-keyfromlabel" when using ECDSA
			keys. [GL #2178]

5567.	[bug]		Dig now reports unknown dash options while pre-parsing
			the options. This prevents "-multi" instead of "+multi"
			from reporting memory usage before ending option parsing
			with "Invalid option: -lti". [GL #2403]

5566.	[func]		Add "stale-answer-client-timeout" option, which is the
			amount of time a recursive resolver waits before
			attempting to answer the query using stale data from
			cache. [GL #2247]

5565.	[func]		The SONAMEs for BIND 9 libraries now include the current
			BIND 9 version number, in an effort to tightly couple
			internal libraries with a specific release. [GL #2387]

5562.	[security]	Fix off-by-one bug in ISC SPNEGO implementation.
			(CVE-2020-8625) [GL #2354]

5561.	[bug]		KASP incorrectly set signature validity to the value of
			the DNSKEY signature validity. This is now fixed.
			[GL #2383]

5560.	[func]		The default value of "max-stale-ttl" has been changed
			from 12 hours to 1 day and the default value of
			"stale-answer-ttl" has been changed from 1 second to 30
			seconds, following RFC 8767 recommendations. [GL #2248]

5456.	[func]		Added "primaries" as a synonym for "masters" in
			named.conf, and "primary-only" as a synonym for
			"master-only" in the parameters to "notify", to bring
			terminology up-to-date with RFC 8499. [GL #1948]

5362.	[func]		Limit the size of IXFR responses so that AXFR will
			be used instead if it would be smaller. This is
			controlled by the "max-ixfr-ratio" option, which
			is a percentage representing the ratio of IXFR size
			to the size of the entire zone. This value cannot
			exceed 100%, which is the default. [GL #1515]

	--- 9.16.11 released ---

5559.	[bug]		The --with-maxminddb=PATH form of the build-time option
			enabling support for libmaxminddb was not working
			correctly. This has been fixed. [GL #2366]

5557.	[bug]		Prevent RBTDB instances from being destroyed by multiple
			threads at the same time. [GL #2317]

5556.	[bug]		Further tweak newline printing in dnssec-signzone and
			dnssec-verify. [GL #2359]

5555.	[bug]		server->reload_status was not properly initialized.
			[GL #2361]

5554.	[bug]		dnssec-signzone and dnssec-verify were missing newlines
			between log messages. [GL #2359]

5553.	[bug]		When reconfiguring named, removing "auto-dnssec" did not
			turn off DNSSEC maintenance. [GL #2341]

5552.	[func]		When switching to "dnssec-policy none;", named now
			permits a safe transition to insecure mode and publishes
			the CDS and CDNSKEY DELETE records, as described in RFC
			8078. [GL #1750]

5551.	[bug]		named no longer attempts to assign threads to CPUs
			outside the CPU affinity set. Thanks to Ole Bjørn
			Hessen. [GL #2245]

5550.	[func]		dnssec-signzone and named now log a warning when falling
			back to the "increment" SOA serial method. [GL #2058]

5545.	[func]		OS support for load-balanced sockets is no longer
			required to receive incoming queries in multiple netmgr
			threads. [GL #2137]

5543.	[bug]		Fix UDP performance issues caused by making netmgr
			callbacks asynchronous-only. [GL #2320]

5542.	[bug]		Refactor netmgr. [GL #1920] [GL #2034] [GL #2061]
			[GL #2194] [GL #2221] [GL #2266] [GL #2283] [GL #2318]
			[GL #2321]

	--- 9.16.10 released ---

5544.	[func]		Restore the default value of "nocookie-udp-size" to 4096
			bytes. [GL #2250]

5541.	[func]		Adjust the "max-recursion-queries" default from 75 to
			100. [GL #2305]

5540.	[port]		Fix building with native PKCS#11 support for AEP Keyper.
			[GL #2315]

5539.	[bug]		Tighten handling of missing DNS COOKIE responses over
			UDP by falling back to TCP. [GL #2275]

5538.	[func]		Add NSEC3 support to KASP. A new option for
			"dnssec-policy", "nsec3param", can be used to set the
			desired NSEC3 parameters. NSEC3 salt collisions are
			automatically prevented during resalting. Salt
			generation is now logged with zone context. [GL #1620]

5534.	[bug]		The CNAME synthesized from a DNAME was incorrectly
			followed when the QTYPE was CNAME or ANY. [GL #2280]

	--- 9.16.9 released ---

5533.	[func]		Add the "stale-refresh-time" option, a time window that
			starts after a failed lookup, during which a stale RRset
			is served directly from cache before a new attempt to
			refresh it is made. [GL #2066]

5530.	[bug]		dnstap did not capture responses to forwarded UPDATE
			requests. [GL #2252]

5527.	[bug]		A NULL pointer dereference occurred when creating an NTA
			recheck query failed. [GL #2244]

5525.	[bug]		Change 5503 inadvertently broke cross-compilation by
			replacing a call to AC_LINK_IFELSE() with a call to
			AC_RUN_IFELSE() in configure.ac.  This has been fixed,
			making cross-compilation possible again. [GL #2237]

5523.	[bug]		The initial lookup in a zone transitioning to/from a
			signed state could fail if the DNSKEY RRset was not
			found. [GL #2236]

5522.	[bug]		Fixed a race/NULL dereference in TCPDNS send. [GL #2227]

5520.	[bug]		Fixed a number of shutdown races, reference counting
			errors, and spurious log messages that could occur
			in the network manager. [GL #2221]

5518.	[bug]		Stub zones now work correctly with primary servers using
			"minimal-responses yes". [GL #1736]

5517.	[bug]		Do not treat UV_EOF as a TCP4RecvErr or a TCP6RecvErr.
			[GL #2208]

	--- 9.16.8 released ---

5516.	[func]		The default EDNS buffer size has been changed from 4096
			to 1232 bytes. [GL #2183]

5515.	[func]		Add 'rndc dnssec -rollover' command to trigger a manual
			rollover for a specific key. [GL #1749]

5514.	[bug]		Fix KASP expected key size for Ed25519 and Ed448.
			[GL #2171]

5513.	[doc]		The ARM section describing the "rrset-order" statement
			was rewritten to make it unambiguous and up-to-date with
			the source code. [GL #2139]

5512.	[bug]		"rrset-order" rules using "order none" were causing
			named to crash despite named-checkconf treating them as
			valid. [GL #2139]

5511.	[bug]		'dig -u +yaml' failed to display timestamps to the
			microsecond. [GL #2190]

5510.	[bug]		Implement the attach/detach semantics for dns_message_t
			to fix a data race in accessing an already-destroyed
			fctx->rmessage. [GL #2124]

5509.	[bug]		filter-aaaa: named crashed upon shutdown if it was in
			the process of recursing for A RRsets. [GL #1040]

5508.	[func]		Added new parameter "-expired" for "rndc dumpdb" that
			also prints expired RRsets (awaiting cleanup) to the
			dump file. [GL #1870]

5507.	[bug]		Named could compute incorrect SIG(0) responses.
			[GL #2109]

5506.	[bug]		Properly handle failed sysconf() calls, so we don't
			report invalid memory size. [GL #2166]

5505.	[bug]		Updating contents of a mixed-case RPZ could cause some
			rules to be ignored. [GL #2169]

5503.	[bug]		Cleaned up reference counting of network manager
			handles, now using isc_nmhandle_attach() and _detach()
			instead of _ref() and _unref(). [GL #2122]

	--- 9.16.7 released ---

5501.	[func]		Log CDS/CDNSKEY publication. [GL #1748]

5500.	[bug]		Fix (non-)publication of CDS and CDNSKEY records.
			[GL #2103]

5499.	[func]		Add '-P ds' and '-D ds' arguments to dnssec-settime.
			[GL #1748]

5497.	[bug]		'dig +bufsize=0' failed to disable EDNS. [GL #2054]

5496.	[bug]		Address a TSAN report by ensuring each rate limiter
			object holds a reference to its task. [GL #2081]

5495.	[bug]		With query minimization enabled, named failed to
			resolve ip6.arpa. names that had extra labels to the
			left of the IPv6 part. [GL #1847]

5494.	[bug]		Silence the EPROTO syslog message on older systems.
			[GL #1928]

5493.	[bug]		Fix off-by-one error when calculating new hash table
			size. [GL #2104]

5492.	[bug]		Tighten LOC parsing to reject a period (".") and/or "m"
			as a value. Fix handling of negative altitudes which are
			not whole meters. [GL #2074]

5491.	[bug]		rbtversion->glue_table_size could be read without the
			appropriate lock being held. [GL #2080]

5489.	[bug]		Named erroneously accepted certain invalid resource
			records that were incorrectly processed after
			subsequently being written to disk and loaded back, as
			the wire format differed. Such records include: CERT,
			IPSECKEY, NSEC3, NSEC3PARAM, NXT, SIG, TLSA, WKS, and
			X25. [GL !3953]

5488.	[bug]		NTA code needed to have a weak reference on its
			associated view to prevent the latter from being deleted
			while NTA tests were being performed. [GL #2067]

5486.	[func]		Add 'rndc dnssec -checkds' command, which signals to
			named that the DS record for a given zone or key has
			been updated in the parent zone. [GL #1613]

	--- 9.16.6 released ---

5484.	[func]		Expire zero TTL records quickly rather than using them
			for stale answers. [GL #1829]

5483.	[func]		A new configuration option "stale-cache-enable" has been
			introduced to enable or disable keeping stale answers in
			cache. [GL #1712]

5482.	[bug]		If the Duplicate Address Detection (DAD) mechanism had
			not yet finished after adding a new IPv6 address to the
			system, BIND 9 would fail to bind to IPv6 addresses in a
			tentative state. [GL #2038]

5481.	[security]	"update-policy" rules of type "subdomain" were
			incorrectly treated as "zonesub" rules, which allowed
			keys used in "subdomain" rules to update names outside
			of the specified subdomains. The problem was fixed by
			making sure "subdomain" rules are again processed as
			described in the ARM. (CVE-2020-8624) [GL #2055]

5480.	[security]	When BIND 9 was compiled with native PKCS#11 support, it
			was possible to trigger an assertion failure in code
			determining the number of bits in the PKCS#11 RSA public
			key with a specially crafted packet. (CVE-2020-8623)
			[GL #2037]

5479.	[security]	named could crash in certain query resolution scenarios
			where QNAME minimization and forwarding were both
			enabled. (CVE-2020-8621) [GL #1997]

5478.	[security]	It was possible to trigger an assertion failure by
			sending a specially crafted large TCP DNS message.
			(CVE-2020-8620) [GL #1996]

5477.	[bug]		The idle timeout for connected TCP sockets, which was
			previously set to a high fixed value, is now derived
			from the client query processing timeout configured for
			a resolver. [GL #2024]

5476.	[security]	It was possible to trigger an assertion failure when
			verifying the response to a TSIG-signed request.
			(CVE-2020-8622) [GL #2028]

5475.	[bug]		Wildcard RPZ passthru rules could incorrectly be
			overridden by other rules that were loaded from RPZ
			zones which appeared later in the "response-policy"
			statement. This has been fixed. [GL #1619]

5474.	[bug]		dns_rdata_hip_next() failed to return ISC_R_NOMORE
			when it should have. [GL !3880]

5473.	[func]		The RBT hash table implementation has been changed
			to use a faster hash function (HalfSipHash2-4) and
			Fibonacci hashing for better distribution. Setting
			"max-cache-size" now preallocates a fixed-size hash
			table so that rehashing does not cause resolution
			brownouts while the hash table is grown. [GL #1775]

5471.	[bug]		The introduction of KASP support inadvertently caused
			the second field of "sig-validity-interval" to always be
			calculated in hours, even in cases when it should have
			been calculated in days. This has been fixed. (Thanks to
			Tony Finch.) [GL !3735]

5469.	[port]		On illumos, a constant called SEC is already defined in
			<sys/time.h>, which conflicts with an identically named
			constant in libbind9. This conflict has been resolved.
			[GL #1993]

5468.	[bug]		Addressed potential double unlock in process_fd().
			[GL #2005]

5466.	[bug]		Addressed an error in recursive clients stats reporting.
			[GL #1719]

5465.	[func]		Added fallback to built-in trust-anchors, managed-keys,
			or trusted-keys if the bindkeys-file (bind.keys) cannot
			be parsed. [GL #1235]

5464.	[bug]		Requesting more than 128 files to be saved when rolling
			dnstap log files caused a buffer overflow. This has been
			fixed. [GL #1989]

5462.	[bug]		Move LMDB locking from LMDB itself to named. [GL #1976]

5461.	[bug]		The STALE rdataset header attribute was updated while
			the write lock was not being held, leading to incorrect
			statistics. The header attributes are now converted to
			use atomic operations. [GL #1475]
@
text
@d6 1
a6 1
   file, you can obtain one at https://mozilla.org/MPL/2.0/.
d11 10
d29 2
a30 3
A zone can be changed from insecure to secure in three ways: using a
dynamic DNS update, via the ``auto-dnssec`` zone option, or by setting a
DNSSEC policy for the zone with ``dnssec-policy``.
d32 1
a32 1
For any method, ``named`` must be configured so that it can see
d35 1
a35 2
by ``dnssec-keygen``, or created when needed by ``named`` if
``dnssec-policy`` is used. Keys should be placed in the
d41 1
a41 1
           type primary;
a51 12
With ``dnssec-policy``, it is possible to specify which keys should be
KSK and/or ZSK. To sign all records with a key, a CSK must be specified.
For example:

::

        dnssec-policy csk {
	    keys {
                csk lifetime unlimited algorithm 13;
            };
	};

d66 1
a66 1
not completely signed until ``named`` has had time to "walk" the zone
d96 3
a98 3
To enable automatic signing, set a ``dnssec-policy`` or add the
``auto-dnssec`` option to the zone statement in ``named.conf``.
``auto-dnssec`` has two possible arguments: ``allow`` or ``maintain``.
a109 5
``dnssec-policy`` is similar to ``auto-dnssec maintain``, but
``dnssec-policy`` also automatically creates new keys when necessary. In
addition, any configuration related to DNSSEC signing is retrieved from the
policy, ignoring existing DNSSEC ``named.conf`` options.

d112 1
a112 1
made to the zone - such as adding, removing, or revoking a key - then that
d114 1
a114 1
changes every 60 minutes; this period can be adjusted with
d141 1
a141 1
Private Type Records
d144 1
a144 1
The state of the signing process is signaled by private type records
d146 1
a146 1
records with a non-zero initial octet have a non-zero value for the final octet.
d148 1
a148 1
If the first octet of a private type record is non-zero, the
d151 1
a151 1
removed. Here are the meanings of the different values of the first octet:
d153 1
a153 1
   - algorithm (octet 1)
d155 1
a155 1
   - key id in network order (octet 2 and 3)
d157 1
a157 1
   - removal flag (octet 4)
d159 1
a159 1
   - complete flag (octet 5)
d161 2
a162 2
Only records flagged as "complete" can be removed via dynamic update; attempts
to remove other private type records are silently ignored.
d165 1
a165 1
should never appear in a DNSKEY record), the record indicates that
d168 1
a168 1
perform based on the flag bits:
d192 1
a192 1
private type records are updated so that the last octet is non-zero.
d211 1
a211 1
or ``dnssec-settime``), and if the ``auto-dnssec`` zone option is set to
d232 4
a235 7
Add a ``nsec3param`` option to your ``dnssec-policy`` and
run ``rndc reconfig``.

Or use ``nsupdate`` to add an NSEC3PARAM record.

In both cases, the NSEC3 chain is generated and the NSEC3PARAM record is
added before the NSEC chain is destroyed.
d240 1
a240 4
To do this, remove the ``nsec3param`` option from the ``dnssec-policy`` and
run ``rndc reconfig``.

Or use ``nsupdate`` to remove all NSEC3PARAM records with a
@


1.1.1.3
log
@Import bind-9.16.20

	--- 9.16.20 released ---

5689.	[security]	An assertion failure occurred when named attempted to
			send a UDP packet that exceeded the MTU size, if
			Response Rate Limiting (RRL) was enabled.
			(CVE-2021-25218) [GL #2856]

5688.	[bug]		Zones using KASP and inline-signed zones failed to apply
			changes from the unsigned zone to the signed zone under
			certain circumstances. This has been fixed. [GL #2735]

5687.	[bug]		"rndc reload <zonename>" could trigger a redundant
			reload for an inline-signed zone whose zone file was not
			modified since the last "rndc reload". This has been
			fixed. [GL #2855]

5686.	[func]		The number of internal data structures allocated for
			each zone was reduced. [GL #2829]

5685.	[bug]		named failed to check the opcode of responses when
			performing zone refreshes, stub zone updates, and UPDATE
			forwarding. This has been fixed. [GL #2762]

5682.	[bug]		Some changes to "zone-statistics" settings were not
			properly processed by "rndc reconfig". This has been
			fixed. [GL #2820]

5681.	[func]		Relax the checks in the dns_zone_cdscheck() function to
			allow CDS and CDNSKEY records in the zone that do not
			match an existing DNSKEY record, as long as the
			algorithm matches. This allows a clean rollover from one
			provider to another in a multi-signer DNSSEC
			configuration. [GL #2710]

5679.	[func]		Thread affinity is no longer set. [GL #2822]

5678.	[bug]		The "check DS" code failed to release all resources upon
			named shutdown when a refresh was in progress. This has
			been fixed. [GL #2811]

5672.	[bug]		Authentication of rndc messages could fail if a
			"controls" statement was configured with multiple key
			algorithms for the same listener. This has been fixed.
			[GL #2756]

	--- 9.16.19 released ---

5671.	[bug]		A race condition could occur where two threads were
			competing for the same set of key file locks, leading to
			a deadlock. This has been fixed. [GL #2786]

5670.	[bug]		create_keydata() created an invalid placeholder keydata
			record upon a refresh failure, which prevented the
			database of managed keys from subsequently being read
			back. This has been fixed. [GL #2686]

5669.	[func]		KASP support was extended with the "check DS" feature.
			Zones with "dnssec-policy" and "parental-agents"
			configured now check for DS presence and can perform
			automatic KSK rollovers. [GL #1126]

5668.	[bug]		Rescheduling a setnsec3param() task when a zone failed
			to load on startup caused a hang on shutdown. This has
			been fixed. [GL #2791]

5667.	[bug]		The configuration-checking code failed to account for
			the inheritance rules of the "dnssec-policy" option.
			This has been fixed. [GL #2780]

5666.	[doc]		The safe "edns-udp-size" value was tweaked to match the
			probing value from BIND 9.16 for better compatibility.
			[GL #2183]

5665.	[bug]		If nsupdate sends an SOA request and receives a REFUSED
			response, it now fails over to the next available
			server. [GL #2758]

5664.	[func]		For UDP messages larger than the path MTU, named now
			sends an empty response with the TC (TrunCated) bit set.
			In addition, setting the DF (Don't Fragment) flag on
			outgoing UDP sockets was re-enabled. [GL #2790]

5662.	[bug]		Views with recursion disabled are now configured with a
			default cache size of 2 MB unless "max-cache-size" is
			explicitly set. This prevents cache RBT hash tables from
			being needlessly preallocated for such views. [GL #2777]

5661.	[bug]		Change 5644 inadvertently introduced a deadlock: when
			locking the key file mutex for each zone structure in a
			different view, the "in-view" logic was not considered.
			This has been fixed. [GL #2783]

5658.	[bug]		Increasing "max-cache-size" for a running named instance
			(using "rndc reconfig") did not cause the hash tables
			used by cache databases to be grown accordingly. This
			has been fixed. [GL #2770]

5655.	[bug]		Signed, insecure delegation responses prepared by named
			either lacked the necessary NSEC records or contained
			duplicate NSEC records when both wildcard expansion and
			CNAME chaining were required to prepare the response.
			This has been fixed. [GL #2759]

5653.	[bug]		A bug that caused the NSEC3 salt to be changed on every
			restart for zones using KASP has been fixed. [GL #2725]

	--- 9.16.18 released ---

5660.	[bug]		The configuration-checking code failed to account for
			the inheritance rules of the "key-directory" option.
			[GL #2778]

5659.	[bug]		When preparing DNS responses, named could replace the
			letters 'W' (uppercase) and 'w' (lowercase) with '\000'.
			This has been fixed. [GL #2779]

	--- 9.16.17 released ---

5652.	[bug]		A copy-and-paste error in change 5584 caused the
			IP_DONTFRAG socket option to be enabled instead of
			disabled. This has been fixed. [GL #2746]

5651.	[func]		Refactor zone dumping to be processed asynchronously via
			the uv_work_t thread pool API. [GL #2732]

5650.	[bug]		Prevent a crash that could occur if serve-stale was
			enabled and a prefetch was triggered during a query
			restart. [GL #2733]

5649.	[bug]		If a query was answered with stale data on a server with
			DNS64 enabled, an assertion could occur if a non-stale
			answer arrived afterward. [GL #2731]

5648.	[bug]		The calculation of the estimated IXFR transaction size
			in dns_journal_iter_init() was invalid. [GL #2685]

5644.	[bug]		Fix a race condition in reading and writing key files
			for zones using KASP and configured in multiple views.
			[GL #1875]

5643.	[cleanup]	"make install" no longer creates an empty
			${localstatedir}/run directory. [GL #2709]

5642.	[bug]		Zones which are configured in multiple views with
			different values set for "dnssec-policy" and with
			identical values set for "key-directory" are now
			detected and treated as a configuration error.
			[GL #2463]

5641.	[bug]		Address a potential memory leak in
			dst_key_fromnamedfile(). [GL #2689]

5639.	[bug]		Check that the first and last SOA record of an AXFR are
			consistent. [GL #2528]

5638.	[bug]		Improvements related to network manager/task manager
			integration:
			- isc_managers_create() and isc_managers_destroy()
			  functions were added to handle setup and teardown of
			  netmgr, taskmgr, timermgr, and socketmgr, since these
			  require a precise order of operations now.
			- Event queue processing is now quantized to prevent
			  infinite looping.
			- The netmgr can now be paused from within a netmgr
			  thread.
			- Deadlocks due to a conflict between netmgr's
			  pause/resume and listen/stoplistening operations were
			  fixed.
			[GL #2654]

5633.	[doc]		The "inline-signing" option was incorrectly described as
			being inherited from the "options"/"view" levels and was
			incorrectly accepted at those levels without effect.
			This has been fixed. [GL #2536]

5624.	[func]		Task manager events are now processed inside network
			manager loops. The task manager no longer needs its own
			set of worker threads, which improves resolver
			performance. [GL #2638]

	--- 9.16.16 released ---

5637.	[func]		Change the default value of the "max-ixfr-ratio" option
			to "unlimited". [GL #2671]

5636.	[bug]		named and named-checkconf did not report an error when
			multiple zones with the "dnssec-policy" option set were
			using the same zone file. This has been fixed.
			[GL #2603]

5635.	[bug]		Journal compaction could fail when a journal with
			invalid transaction headers was not detected at startup.
			This has been fixed. [GL #2670]

5634.	[bug]		If "dnssec-policy" was active and a private key file was
			temporarily offline during a rekey event, named could
			incorrectly introduce replacement keys and break a
			signed zone. This has been fixed. [GL #2596]

5633.	[doc]		The "inline-signing" option was incorrectly described as
			being inherited from the "options"/"view" levels and was
			incorrectly accepted at those levels without effect.
			This has been fixed. [GL #2536]

5632.	[func]		Add a new built-in KASP, "insecure", which is used to
			transition a zone from a signed to an unsigned state.
			The existing built-in KASP "none" should no longer be
			used to unsign a zone. [GL #2645]

5631.	[protocol]	Update the implementation of the ZONEMD RR type to match
			RFC 8976. [GL #2658]

5630.	[func]		Treat DNSSEC responses containing NSEC3 records with
			iteration counts greater than 150 as insecure.
			[GL #2445]

5629.	[func]		Reduce the maximum supported number of NSEC3 iterations
			that can be configured for a zone to 150. [GL #2642]

5627.	[bug]		RRSIG(SOA) RRsets placed anywhere other than at the zone
			apex were triggering infinite resigning loops. This has
			been fixed. [GL #2650]

5626.	[bug]		When generating zone signing keys, KASP now also checks
			for key ID conflicts among newly created keys, rather
			than just between new and existing ones. [GL #2628]

5625.	[bug]		A deadlock could occur when multiple "rndc addzone",
			"rndc delzone", and/or "rndc modzone" commands were
			invoked simultaneously for different zones. This has
			been fixed. [GL #2626]

5622.	[cleanup]	The lib/samples/ directory has been removed, as export
			versions of libraries are no longer maintained.
			[GL !4835]

5619.	[protocol]	Implement draft-vandijk-dnsop-nsec-ttl, updating the
			protocol such that NSEC(3) TTL values are set to the
			minimum of the SOA MINIMUM value or the SOA TTL.
			[GL #2347]

5618.	[bug]		Change 5149 introduced some inconsistencies in the way
			record TTLs were presented in cache dumps. These
			inconsistencies have been eliminated. [GL #389]
			[GL #2289]
@
text
@d197 1
a197 1
To perform key rollovers via a dynamic update, the ``K*``
@