Added Ed25519 support (#44696)

update copyright notice / whitespace

4654. [cleanup] Don't use C++ keywords delete, new and namespace. [RT #45538] (cherry picked from commit 4bf32aa58774452b05433716f8fa298257dd7fda)

4450. [port] Provide more nuanced HSM support which better matches the specific PKCS11 providers capabilities. [RT #42458] (cherry picked from commit 8ee6f289d87851a5b898b24a64587f0e6bc225bc)

4401. [misc] Change LICENSE to MPL 2.0.

4252. [func] Add support for automating the generation CDS and CDNSKEY rrsets to named and dnssec-signzone. [RT #40424]

added print.h includes, updated copyrights

4074. [cleanup] Cleaned up more warnings from gcc -Wshadow. [RT #38708]

update copyright notice / whitespace

[master] clean up gcc -Wshadow warnings 4039. [cleanup] Cleaned up warnings from gcc -Wshadow. [RT #37381]

3957. [bug] "dnssec-keygen -S" failed for ECCGOST, ECDSAP256SHA256 and ECDSAP384SHA384. [RT #37183]

[10686] Add version printing option to various BIND utilites Squashed commit of the following: commit 95effe9b2582a7eb878ccb8cb9ef51dfc5bbfde7 Author: Evan Hunt <each@isc.org> Date: Tue Jun 10 16:52:45 2014 -0700 [rt10686] move version() to dnssectool.c commit df205b541d1572ea5306a5f671af8b54b9c5c770 Author: Mukund Sivaraman <muks@isc.org> Date: Tue Jun 10 21:38:31 2014 +0530 Rearrange order of cases commit cfd30893f2540bf9d607e1fd37545ea7b441e0d0 Author: Mukund Sivaraman <muks@isc.org> Date: Tue Jun 10 21:38:08 2014 +0530 Add version printer to dnssec-verify commit a625ea338c74ab5e21634033ef87f170ba37fdbe Author: Mukund Sivaraman <muks@isc.org> Date: Tue Jun 10 21:32:19 2014 +0530 Add version printer to dnssec-signzone commit d91e1c0f0697b3304ffa46fccc66af65591040d9 Author: Mukund Sivaraman <muks@isc.org> Date: Tue Jun 10 21:26:01 2014 +0530 Add version printer to dnssec-settime commit 46fc8775da3e13725c31d13e090b406d69b8694f Author: Mukund Sivaraman <muks@isc.org> Date: Tue Jun 10 21:25:48 2014 +0530 Fix docbook commit 8123d2efbd84cdfcbc70403aa9bb27b96921bab2 Author: Mukund Sivaraman <muks@isc.org> Date: Tue Jun 10 21:20:17 2014 +0530 Add version printer to dnssec-revoke commit d0916420317d3e8c69cf1b37d2209ea2d072b913 Author: Mukund Sivaraman <muks@isc.org> Date: Tue Jun 10 21:17:54 2014 +0530 Add version printer to dnssec-keygen commit 93b0bd5ebc043298dc7d8f446ea543cb40eaecf8 Author: Mukund Sivaraman <muks@isc.org> Date: Tue Jun 10 21:14:11 2014 +0530 Add version printer to dnssec-keyfromlabel commit 07001bcd9ae2d7b09dd9e243b0ab35307290d05d Author: Mukund Sivaraman <muks@isc.org> Date: Tue Jun 10 21:13:39 2014 +0530 Update usage help output, docbook commit 85cdd702f41c96fbc767fc689d1ed97fe1f3a926 Author: Mukund Sivaraman <muks@isc.org> Date: Tue Jun 10 21:07:18 2014 +0530 Add version printer to dnssec-importkey commit 9274fc61e38205aad561edf445940b4e73d788dc Author: Mukund Sivaraman <muks@isc.org> Date: Tue Jun 10 21:01:53 2014 +0530 Add version printer to dnssec-dsfromkey commit bf4605ea2d7282e751fd73489627cc8a99f45a90 Author: Mukund Sivaraman <muks@isc.org> Date: Tue Jun 10 20:49:22 2014 +0530 Add -V to nsupdate usage output

[master] better error output when initializing pkcs11 3786. [func] Provide more detailed error codes when using native PKCS#11. "pkcs11-tokens" now fails robustly rather than asserting when run against an HSM with an incomplete PCKS#11 API implementation. [RT #35479]

[master] dnssec-keygen fixes 3730. [cleanup] Added "never" as a synonym for "none" when configuring key event dates in the dnssec tools. [RT #35277] 3729. [bug] dnssec-kegeyn could set the publication date incorrectly when only the activation date was specified on the command line. [RT #35278]

[master] address several issues with native pkcs11

update copyrights

[master] native PKCS#11 support 3705. [func] "configure --enable-native-pkcs11" enables BIND to use the PKCS#11 API for all cryptographic functions, so that it can drive a hardware service module directly without the need to use a modified OpenSSL as intermediary (so long as the HSM's vendor provides a complete-enough implementation of the PKCS#11 interface). This has been tested successfully with the Thales nShield HSM and with SoftHSMv2 from the OpenDNSSEC project. [RT #29031]

3607. [bug] dnssec-keygen had broken 'Invalid keyfile' error message. [RT #34045]

[master] silence ccc-analyzer 3567. [bug] Silence clang static analyzer warnings. [RT #33365]

update copyright notice

[bug] Added checks in dnssec-keygen and dnssec-settime to check for delete date < inactive date. [RT #31719]

3339. [func] Allow the maximum supported rsa exponent size to be specified: "max-rsa-exponent-size <value>;" [RT #29228]

update copyright notice

3317. [func] Add ECDSA support (RFC 6605). [RT #21918]

3226. [bug] Address minor resource leakages. [RT #26624]

3174. [bug] Always compute to revoked key tag from scratch. [RT #24711]

3076. [func] New '-L' option in dnssec-keygen, dnsset-settime, and dnssec-keyfromlabel sets the default TTL of the key. When possible, automatic signing will use that TTL when the key is published. [RT #23304]

update copyright notice

3069. [cleanup] Silence warnings messages from clang static analysis. [RT #20256]

2999. [func] Add GOST support (RFC 5933). [RT #20639]

update copyright notice

2943. [func] Add support to load new keys into managed zones without signing immediately with "rndc loadkeys". Add support to link keys with "dnssec-keygen -S" and "dnssec-settime -S". [RT #21351]

update copyright notice

2842. [func] Prevent dnssec-keygen and dnssec-keyfromlabel from creating key files if there is a chance that the new key ID will collide with an existing one after either of the keys has been revoked. (To override this in the case of dnssec-keyfromlabel, use the -y option. dnssec-keygen will simply create a different, noncolliding key, so an override is not necessary.) [RT #20838]

update copyright notice

2833. [cleanup] Fix usage messages in dnssec-keygen and dnssec-settime. [RT #20851]

silence compiler warnings

2780. [bug] dnssec-keygen -A none didn't properly unset the activation date in all cases. [RT #20648] 2779. [bug] Dynamic key revokation could fail. [RT #20644] 2778. [bug] dnssec-signzone could fail when a key was revoked without deleting the unrevoked version. [RT #20638]

2741. [func] Allow the dnssec-keygen progress messages to be suppressed (dnssec-keygen -q). Automatically suppress the progress messages when stdin is not a tty. [RT #20474]

Minor cleanup in dnssec-* tools

keygen progress indication [RT #20284]

2728. [bug] dnssec-keygen, dnssec-keyfromlabel and dnssec-signzone now warn immediately if asked to write into a nonexistent directory. [RT #20278]

2726. [func] Added support for SHA-2 DNSSEC algorithms, RSASHA256 and RSASHA512. [RT #20023]

2712. [func] New 'auto-dnssec' zone option allows zone signing to be fully automated in zones configured for dynamic DNS. 'auto-dnssec allow;' permits a zone to be signed by creating keys for it in the key-directory and using 'rndc sign <zone>'. 'auto-dnssec maintain;' allows that too, plus it also keeps the zone's DNSSEC keys up to date according to their timing metadata. [RT #19943]

2707. [func] dnssec-keyfromlabel no longer require engine name to be specified in the label if there is a default engine or the -E option has been used. Also, it now uses default algorithms as dnssec-keygen does (i.e., RSASHA1, or NSEC3RSASHA1 if -3 is used). [RT #20371]

explicit engine rt20230a

Add /* NOTREACHED */ comments

noreturn RT #20257

2685. [bug] Fixed dnssec-signzone -S handling of revoked keys. Also, added warnings when revoking a ZSK, as this is not defined by protocol (but is legal). [RT #19943]

2677. [func] Changes to key metadata behavior: - Keys without "publish" or "active" dates set will no longer be used for smart signing. However, those dates will be set to "now" by default when a key is created; to generate a key but not use it yet, use dnssec-keygen -G. - New "inactive" date (dnssec-keygen/settime -I) sets the time when a key is no longer used for signing but is still published. - The "unpublished" date (-U) is deprecated in favor of "deleted" (-D). [rt20247]

merge rt19294

RT #20213: - correctly use -K option in dnssec-keygen - fix an improper free() in dnssec-revoke - fix grammar in dnssec-settime

update copyright notice

2668. [func] Several improvements to dnssec-* tools, including: - dnssec-keygen and dnssec-settime can now set key metadata fields 0 (to unset a value, use "none") - dnssec-revoke sets the revocation date in addition to the revoke bit - dnssec-settime can now print individual metadata fields instead of always printing all of them, and can print them in unix epoch time format for use by scripts [RT #19942]

2660. [func] Add a new set of DNS libraries for non-BIND9 applications. See README.libdns. [RT #19369]

update copyright notice

2636. [func] Simplify zone signing and key maintenance with the dnssec-* tools. Major changes: - all dnssec-* tools now take a -K option to specify a directory in which key files will be stored - DNSSEC can now store metadata indicating when they are scheduled to be published, acttivated, revoked or removed; these values can be set by dnssec-keygen or overwritten by the new dnssec-settime command - dnssec-signzone -S (for "smart") option reads key metadata and uses it to determine automatically which keys to publish to the zone, use for signing, revoke, or remove from the zone [RT #19816]

update copyright notice

2619. [func] Add support for RFC 5011, automatic trust anchor maintenance. The new "managed-keys" statement can be used in place of "trusted-keys" for zones which support this protocol. (Note: this syntax is expected to change prior to 9.7.0 final.) [RT #19248]

update copyright notice

2612. [func] Add default values for the arguments to dnssec-keygen. Without arguments, it will now generate a 1024-bit RSASHA1 zone-signing key, or with the -f KSK option, a 2048-bit RSASHA1 key-signing key. [RT #19300] 2611. [func] Add -l option to dnssec-dsfromkey to generate DLV records instead of DS records. [RT #19300]

update copyright notice

reserve -F

update copyright notice

2448. [func] Add NSEC3 support. [RT #15452]

update copyright notice

update copyright notice

2195. [func] dnssec-keygen now defaults to nametype "ZONE" when generating DNSKEYs. [RT #16954]

2191. [func] named-checkzone now allows dumping to stdout (-). named-checkconf now has -h for help. named-checkzone now has -h for help. Better handling of '-?' for usage summaries. [RT #16707]

update copyright notice

update copyright notice

1973. [func] TSIG HMACSHA1, HMACSHA224, HMACSHA256, HMACSHA384 and HMACSHA512 support. [RT #13606]

update copyright notice

1945. [cleanup] dnssec-keygen: RSA (RSAMD5) is nolonger recommended. To generate a RSAMD5 key you must explictly request RSAMD5. [RT #13780]

finetune isc_thread_key implementation [RT #15408]

update copyright notice

1851. [doc] Doxygen comment markup. [RT #11398]