<!DOCTYPE book [
<!ENTITY mdash "&#8212;">
<!ENTITY ouml "&#xf6;">]>
<!--
 - Copyright (C) 2014-2016  Internet Systems Consortium, Inc. ("ISC")
 -
 - Permission to use, copy, modify, and/or distribute this software for any
 - purpose with or without fee is hereby granted, provided that the above
 - copyright notice and this permission notice appear in all copies.
 -
 - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
 - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
 - AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
 - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
 - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
 - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 - PERFORMANCE OF THIS SOFTWARE.
-->

<!-- Converted by db4-upgrade version 1.0 -->
<section xmlns="http://docbook.org/ns/docbook" version="5.0"><info/>
  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="noteversion.xml"/>
  <section xml:id="relnotes_intro"><info><title>Introduction</title></info>

    <para>
      This document summarizes changes since the last production release
      of BIND on the corresponding major release branch.
    </para>
  </section>
  <section xml:id="relnotes_download"><info><title>Download</title></info>

    <para>
      The latest versions of BIND 9 software can always be found at
      <link xmlns:xlink="http://www.w3.org/1999/xlink" xlink:href="http://www.isc.org/downloads/">http://www.isc.org/downloads/</link>.
      There you will find additional information about each release,
      source code, and pre-compiled versions for Microsoft Windows
      operating systems.
    </para>
  </section>
  <section xml:id="relnotes_security"><info><title>Security Fixes</title></info>

    <itemizedlist>
      <listitem>
	<para>
	  The resolver could abort with an assertion failure due to
	  improper DNAME handling when parsing fetch reply
	  messages. This flaw is disclosed in CVE-2016-1286. [RT #41753]
	</para>
      </listitem>
      <listitem>
	<para>
	  Malformed control messages can trigger assertions in named
	  and rndc. This flaw is disclosed in CVE-2016-1285. [RT
	  #41666]
	</para>
      </listitem>
      <listitem>
	<para>
	  Specific APL data could trigger an INSIST.  This flaw
	  is disclosed in CVE-2015-8704. [RT #41396]
	</para>
      </listitem>
      <listitem>
	<para>
	  Incorrect reference counting could result in an INSIST
	  failure if a socket error occurred while performing a
	  lookup.  This flaw is disclosed in CVE-2015-8461. [RT#40945]
	</para>
      </listitem>
      <listitem>
	<para>
	  Insufficient testing when parsing a message allowed
	  records with an incorrect class to be be accepted,
	  triggering a REQUIRE failure when those records
	  were subsequently cached.  This flaw is disclosed
	  in CVE-2015-8000. [RT #40987]
	</para>
      </listitem>
    </itemizedlist>

  </section>
  <section xml:id="relnotes_features"><info><title>New Features</title></info>

    <itemizedlist>
      <listitem>
	<para>
	  The following resource record types have been implemented:
	  AVC, CSYNC, NINFO, RKEY, SINK, SMIMEA, TA, TALINK.
 	</para>
      </listitem>
      <listitem>
        <para>
	  Added a warning for a common misconfiguration involving forwarded
	  RFC 1918 and ULA zones.
	</para>
      </listitem>
      <listitem>
        <para>
	  Contributed software from Nominum is included in the source at
	  contrib/dnsperf-2.1.0.0-1/. It includes dnsperf for measuring
	  the performance of authoritative DNS servers, resperf for
	  testing the resolution performance of a caching DNS server,
	  resperf-report for generating a resperf report in HTML with
	  gnuplot graphs, and queryparse to extract DNS queries from
	  pcap capture files. This software is not installed by default
	  with BIND.
	</para>
      </listitem>
    </itemizedlist>
  </section>
  <section xml:id="relnotes_changes"><info><title>Feature Changes</title></info>

    <itemizedlist>
      <listitem>
        <para>
	  Updated the compiled in addresses for H.ROOT-SERVERS.NET.
	</para>
      </listitem>
      <listitem>
	<para>
	  The default preferred glue is now the address type of the
	  transport the query was received over.
	</para>
      </listitem>
      <listitem>
	<para>
	  On machines with 2 or more processors (CPU), the default value
	  for the number of UDP listeners has been changed to the number
	  of detected processors minus one.
	</para>
      </listitem>
      <listitem>
	<para>
	  Zone transfers now use smaller message sizes to improve
	  message compression. This results in reduced network usage.
	</para>
      </listitem>
      <listitem>
	<para>
	  named -V output now also includes operating system details.
	</para>
      </listitem>
    </itemizedlist>
  </section>
  <section xml:id="relnotes_bugs"><info><title>Bug Fixes</title></info>

    <itemizedlist>
      <listitem>
	<para>
	  When deleting records from a zone database, interior nodes
	  could be left empty but not deleted, damaging search
	  performance afterward. [RT #40997]
	</para>
      </listitem>
      <listitem>
	<para>
	  The server could crash due to a use-after-free if a
	  zone transfer timed out. [RT #41297]
	</para>
      </listitem>
      <listitem>
	<para>
	  Authoritative servers that were marked as bogus (e.g. blackholed
	  in configuration or with invalid addresses) were being queried
	  anyway. [RT #41321]
	</para>
      </listitem>
    </itemizedlist>
  </section>
  <section xml:id="end_of_life"><info><title>End of Life</title></info>

    <para>
      BIND 9.9 (Extended Support Version) will be supported until
      December, 2017.
      <link xmlns:xlink="http://www.w3.org/1999/xlink" xlink:href="https://www.isc.org/downloads/software-support-policy/">https://www.isc.org/downloads/software-support-policy/</link>
    </para>
  </section>
  <section xml:id="relnotes_thanks"><info><title>Thank You</title></info>

    <para>
      Thank you to everyone who assisted us in making this release possible.
      If you would like to contribute to ISC to assist us in continuing to
      make quality open source software, please visit our donations page at
      <link xmlns:xlink="http://www.w3.org/1999/xlink" xlink:href="http://www.isc.org/donate/">http://www.isc.org/donate/</link>.
    </para>
  </section>
</section>
