<!--
 - Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 -
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
 - file, you can obtain one at https://mozilla.org/MPL/2.0/.
 -
 - See the COPYRIGHT file distributed with this work for additional
 - information regarding copyright ownership.
-->

<section xml:id="relnotes-9.11.4"><info><title>Notes for BIND 9.11.4</title></info>

  <section xml:id="relnotes-9.11.4-security"><info><title>Security Fixes</title></info>
    <itemizedlist>
      <listitem>
        <para>
          When recursion is enabled but the <command>allow-recursion</command>
          and <command>allow-query-cache</command> ACLs are not specified, they
          should be limited to local networks, but they were inadvertently set
          to match the default <command>allow-query</command>, thus allowing
          remote queries. This flaw is disclosed in CVE-2018-5738. [GL #309]
        </para>
      </listitem>
    </itemizedlist>
  </section>

  <section xml:id="relnotes-9.11.4-features"><info><title>New Features</title></info>
    <itemizedlist>
      <listitem>
        <para>
          <command>named</command> now supports the "root key sentinel"
          mechanism. This enables validating resolvers to indicate
          which trust anchors are configured for the root, so that
          information about root key rollover status can be gathered.
          To disable this feature, add
          <command>root-key-sentinel no;</command> to
          <filename>named.conf</filename>.
        </para>
      </listitem>
      <listitem>
        <para>
          Added the ability not to return a DNS COOKIE option when one
          is present in the request.  To prevent a cookie being returned,
          add <command>answer-cookie no;</command> to
          <filename>named.conf</filename>. [GL #173]
        </para>
        <para>
          <command>answer-cookie no</command> is only intended as a
          temporary measure, for use when <command>named</command>
          shares an IP address with other servers that do not yet
          support DNS COOKIE.  A mismatch between servers on the
          same address is not expected to cause operational problems,
          but the option to disable COOKIE responses so that all
          servers have the same behavior is provided out of an
          abundance of caution. DNS COOKIE is an important security
          mechanism, and should not be disabled unless absolutely
          necessary.
        </para>
      </listitem>
    </itemizedlist>
  </section>

  <section xml:id="relnotes-9.11.4-removed"><info><title>Removed Features</title></info>
    <itemizedlist>
      <listitem>
        <para>
          <command>named</command> will now log a warning if the old
          BIND now can be compiled against libidn2 library to add
          IDNA2008 support.  Previously BIND only supported IDNA2003
          using (now obsolete) idnkit-1 library.
        </para>
      </listitem>
    </itemizedlist>
  </section>

  <section xml:id="relnotes-9.11.4-changes"><info><title>Feature Changes</title></info>
    <itemizedlist>
      <listitem>
        <para>
          <command>dig +noidnin</command> can be used to disable IDN
          processing on the input domain name, when BIND is compiled
          with IDN support.
        </para>
      </listitem>
      <listitem>
        <para>
          Multiple <command>cookie-secret</command> clause are now
          supported.  The first <command>cookie-secret</command> in
          <filename>named.conf</filename> is used to generate new
          server cookies.  Any others are used to accept old server
          cookies or those generated by other servers using the
          matching <command>cookie-secret</command>.
        </para>
      </listitem>
    </itemizedlist>
  </section>

  <section xml:id="relnotes-9.11.4-bugs"><info><title>Bug Fixes</title></info>
    <itemizedlist>
      <listitem>
        <para>
          <command>named</command> now rejects excessively large
          incremental (IXFR) zone transfers in order to prevent
          possible corruption of journal files which could cause
          <command>named</command> to abort when loading zones. [GL #339]
        </para>
      </listitem>
      <listitem>
        <para>
          <command>rndc reload</command> could cause <command>named</command>
          to leak memory if it was invoked before the zone loading actions
          from a previous <command>rndc reload</command> command were
          completed. [RT #47076]
        </para>
      </listitem>
    </itemizedlist>
  </section>

</section>
