After two and a half years of development, the ISC consortium has released the first stable version of the significant DNS server branch BIND 9.20, which incorporates changes that evolved in the experimental branch BIND 9.19. Support for branch 9.20 will be provided under an extended maintenance cycle until the first quarter of 2028. Support for branch 9.18 will end in the second quarter of 2025. An experimental branch BIND 9.21.0 will be created for the development of functionality for the next stable version of BIND. The project code is written in C and distributed under the MPL 2.0 license.
Key Changes:
- The core of the application, connecting all components, has been transitioned to use a non-blocking event loop implemented based on the libuv library, which is used in projects like Node.js, Knot DNS, H2O, Luvit, and MoarVM. In branch 9.16, the network connection manager in BIND was migrated to libuv, and now parts used for interacting with internal infrastructure components, as well as long-running auxiliary handlers (threadpool) used for DNSSEC verification, zone transfers, zone directory maintenance, and RPZ (Response Policy Zone) processing, are also implemented. Building BIND now requires at least libuv version 1.34.0.
- A new backend for database operations has been proposed — the "QP trie," which replaces the RBTDB (Red-Black Tree Database) and is used by default for storing the cache and DNS zone database. For multithreaded operations, the QP trie utilizes the liburcu library, implementing lock-free structures in user space by employing the RCU (read-copy-update) synchronization mechanism and the QSBR (Quiescent-State-Based Reclamation) safe memory release method.
- An updated compression mechanism has been implemented domain names, using a more compact method for encoding names with a larger number of labels.
- DNSSEC capabilities have been expanded: "dnssec-policy" is now allowed for managing signed zones (the auto-dnssec option has been removed); when using "inline-signing", support for RFC 8901 (DNSSEC multi-signer model 2) has been added; support for PKCS#11 based on OpenSSL 3.0.0 Engine API has been resumed; and support for HSM (Hardware Security Module) has been added to "dnssec-policy".
- Support has been added for the second version of the zone catalog (Catalog Zone, RFC 9432), simplifying the maintenance of secondary DNS servers by organizing the transfer of secondary zone catalogs between primary and secondary servers instead of defining individual records for each secondary zone on the secondary server. After configuring the transfer in a manner similar to transferring individual zones, zones created on the primary server marked as belonging to the catalog are automatically created on the secondary server without needing to modify configuration files.
- Support has been added for the mechanism of Extended DNS Errors (RFC 8914), which allows returning additional information regarding the cause of an error that occurred during the execution of a DNS query.
- The implementation of DNS over HTTPS (DoH) and DNS over TLS (DoT) technologies, used for encrypting client requests to the resolver and securely exchanging data between servers, has been transitioned to utilize unified transport.
- The ability to use the PROXYv2 protocol with all transports supported in BIND has been added. The PROXY protocol allows for passing connection information to retain the original IP address and port number when forwarding DNS queries through other backends, load balancers, and proxies.servers.
- Support has been added for the USDT (User Statically Defined Tracing) mode, allowing application tracing to be performed using the perf command without incurring additional overhead when tracing is turned off.
- The collected statistics now reflect information about incomplete incoming zone transfer operations.
- Efforts have been made to reduce latency, decrease memory consumption, and lower CPU load during resolution, DNS-over-TLS operations, and response formation via UDP and TCP.
Source: opennet.ru
