After 11 months of development, the ISC consortium has released the first stable version of the new significant branch of the BIND 9.16 DNS server. Support for the 9.16 branch will be provided for three years until the second quarter of 2023 as part of the extended support cycle. Updates for the previous LTS branch 9.11 will continue to be released until December 2021. Support for the 9.14 branch will cease in three months.
Key :
- KASP (Key and Signing Policy) has been added, providing a simplified way to manage DNSSEC keys and digital signatures based on rules defined using the 'dnssec-policy' directive. This directive allows for the generation of necessary new keys for DNS zones and the automatic application of ZSK and KSK keys.
- The network subsystem has been significantly revamped, transitioning to an asynchronous request processing mechanism implemented based on the library .
The overhaul has not yet resulted in visible changes, but future releases will allow for significant performance optimizations and add support for new protocols such as DNS over TLS. - The process of managing DNSSEC trust anchors (trust anchor, the public key bound to the zone for authenticating that zone) has been improved. Instead of the deprecated trusted-keys and managed-keys settings, a new trust-anchors directive has been introduced, allowing management of both types of keys.
When using trust-anchors with the initial-key keyword, the behavior of this directive is identical to managed-keys, i.e., it sets the trust anchor according to RFC 5011. When using trust-anchors with the static-key keyword, the behavior corresponds to the trusted-keys directive, i.e., it defines a permanent key that is not automatically updated. Additionally, two more keywords initial-ds and static-ds are offered in trust-anchors, allowing the use of trust anchors in the format (Delegation Signer) instead of DNSKEY, which enables the setup of anchors for unpublished keys (in the future, the IANA organization plans to use the DS format for root zone keys).
- The dig, mdig, and delv utilities have been enhanced with the '+yaml' option for output in YAML format.
- The dig utility has added the '+[no]unexpected' option, allowing the acceptance of responses from hosts that differ from the server to which the request was sent.
- The dig utility has added the option "+[no]expandaaaa", which when specified shows IPv6 addresses in AAAA records in full 128-bit representation instead of RFC 5952 format.
- Added the ability to switch channel groups for statistics.
- DS and CDS records are now generated based solely on SHA-256 hashes (generation based on SHA-1 has been discontinued).
- For DNS Cookie (RFC 7873), the SipHash 2-4 algorithm is now used by default, and support for HMAC-SHA has been discontinued (AES remains).
- Output from the dnssec-signzone and dnssec-verify commands is now routed to the standard output stream (STDOUT), while only error and warning messages are output to STDERR (when the "-f" option is specified, the signed zone is also displayed). An option "-q" has been added to suppress output.
- The DNSSEC validation code has been redesigned to eliminate code duplication with other subsystems.
- For outputting statistics in JSON format, only the JSON-C library can now be used. The configure option "—with-libjson" has been renamed to "—with-json-c".
- In the configure script, the parameter "—sysconfdir" is no longer set by default to /etc, and "—localstatedir" to /var if the parameter "—prefix" is not specified. By default, the paths $prefix/etc and $prefix/var, used in Autoconf, are now applied.
- The code implementing the DLV service (Domain Look-aside Verification, dnssec-lookaside option), which was deprecated in BIND 9.12, has been removed, and the associated handler dlv.isc.org was disabled in 2017. The removal of DLV has allowed the BIND code to eliminate unnecessary complications.
Source: opennet.ru
