[v9_11] Prevent dnssec-settime from printing a bogus warning 4686. [bug] dnssec-settime -p could print a bogus warning about key deletion scheduled before its inactivation when a key had an inactivation date set but no deletion date set. [RT #45807] (cherry picked from commit 330365566dab00a1b659dd32e90698800f13af0f)

[v9_11] Fix calculation of dates for a successor key 4685. [bug] dnssec-settime incorrectly calculated publication and activation dates for a successor key. [RT #45806] (cherry picked from commit 5201b96d0343697ebcc73e6140db8d3729132c3b)

update copyright notice / whitespace

[v9_11] silence gcc 7 warnings 4673. [port] Silence GCC 7 warnings. [RT #45592] (cherry picked from commit cdacec1dcb93149b8efc7af38ec916adcdd706f3)

4401. [misc] Change LICENSE to MPL 2.0.

[master] dnssec-keymgr 4349. [contrib] kasp2policy: A python script to create a DNSSEC policy file from an OpenDNSSEC KASP XML file. 4348. [func] dnssec-keymgr: A new python-based DNSSEC key management utility, which reads a policy definition file and can create or update DNSSEC keys as needed to ensure that a zone's keys match policy, roll over correctly on schedule, etc. Thanks to Sebastian Castro for assistance in development. [RT #39211]

update copyright notice / whitespace

4301. [bug] dnssec-settime -p [DP]sync was not working. [RT #41534]

4264. [bug] Check const of strchr/strrchr assignments match argument's const status. [RT #41150]

4252. [func] Add support for automating the generation CDS and CDNSKEY rrsets to named and dnssec-signzone. [RT #40424]

4098. [bug] Address use-after-free issue when using a predecessor key with dnssec-settime. [RT #39272]

4074. [cleanup] Cleaned up more warnings from gcc -Wshadow. [RT #38708]

update copyright notice / whitespace

[master] clean up gcc -Wshadow warnings 4039. [cleanup] Cleaned up warnings from gcc -Wshadow. [RT #37381]

[10686] Add version printing option to various BIND utilites Squashed commit of the following: commit 95effe9b2582a7eb878ccb8cb9ef51dfc5bbfde7 Author: Evan Hunt <each@isc.org> Date: Tue Jun 10 16:52:45 2014 -0700 [rt10686] move version() to dnssectool.c commit df205b541d1572ea5306a5f671af8b54b9c5c770 Author: Mukund Sivaraman <muks@isc.org> Date: Tue Jun 10 21:38:31 2014 +0530 Rearrange order of cases commit cfd30893f2540bf9d607e1fd37545ea7b441e0d0 Author: Mukund Sivaraman <muks@isc.org> Date: Tue Jun 10 21:38:08 2014 +0530 Add version printer to dnssec-verify commit a625ea338c74ab5e21634033ef87f170ba37fdbe Author: Mukund Sivaraman <muks@isc.org> Date: Tue Jun 10 21:32:19 2014 +0530 Add version printer to dnssec-signzone commit d91e1c0f0697b3304ffa46fccc66af65591040d9 Author: Mukund Sivaraman <muks@isc.org> Date: Tue Jun 10 21:26:01 2014 +0530 Add version printer to dnssec-settime commit 46fc8775da3e13725c31d13e090b406d69b8694f Author: Mukund Sivaraman <muks@isc.org> Date: Tue Jun 10 21:25:48 2014 +0530 Fix docbook commit 8123d2efbd84cdfcbc70403aa9bb27b96921bab2 Author: Mukund Sivaraman <muks@isc.org> Date: Tue Jun 10 21:20:17 2014 +0530 Add version printer to dnssec-revoke commit d0916420317d3e8c69cf1b37d2209ea2d072b913 Author: Mukund Sivaraman <muks@isc.org> Date: Tue Jun 10 21:17:54 2014 +0530 Add version printer to dnssec-keygen commit 93b0bd5ebc043298dc7d8f446ea543cb40eaecf8 Author: Mukund Sivaraman <muks@isc.org> Date: Tue Jun 10 21:14:11 2014 +0530 Add version printer to dnssec-keyfromlabel commit 07001bcd9ae2d7b09dd9e243b0ab35307290d05d Author: Mukund Sivaraman <muks@isc.org> Date: Tue Jun 10 21:13:39 2014 +0530 Update usage help output, docbook commit 85cdd702f41c96fbc767fc689d1ed97fe1f3a926 Author: Mukund Sivaraman <muks@isc.org> Date: Tue Jun 10 21:07:18 2014 +0530 Add version printer to dnssec-importkey commit 9274fc61e38205aad561edf445940b4e73d788dc Author: Mukund Sivaraman <muks@isc.org> Date: Tue Jun 10 21:01:53 2014 +0530 Add version printer to dnssec-dsfromkey commit bf4605ea2d7282e751fd73489627cc8a99f45a90 Author: Mukund Sivaraman <muks@isc.org> Date: Tue Jun 10 20:49:22 2014 +0530 Add -V to nsupdate usage output

[master] better error output when initializing pkcs11 3786. [func] Provide more detailed error codes when using native PKCS#11. "pkcs11-tokens" now fails robustly rather than asserting when run against an HSM with an incomplete PCKS#11 API implementation. [RT #35479]

[master] dnssec-keygen fixes 3730. [cleanup] Added "never" as a synonym for "none" when configuring key event dates in the dnssec tools. [RT #35277] 3729. [bug] dnssec-kegeyn could set the publication date incorrectly when only the activation date was specified on the command line. [RT #35278]

update copyrights

[master] native PKCS#11 support 3705. [func] "configure --enable-native-pkcs11" enables BIND to use the PKCS#11 API for all cryptographic functions, so that it can drive a hardware service module directly without the need to use a modified OpenSSL as intermediary (so long as the HSM's vendor provides a complete-enough implementation of the PKCS#11 interface). This has been tested successfully with the Thales nShield HSM and with SoftHSMv2 from the OpenDNSSEC project. [RT #29031]

3642. [func] Allow externally generated DNSKEY to be imported into the DNSKEY management framework. A new tool dnssec-importkey is used to this. [RT #34698]

update copyright notice

[bug] Added checks in dnssec-keygen and dnssec-settime to check for delete date < inactive date. [RT #31719]

[master] remove libgen.h from dnssec tools we no longer use basename() or dirname()

update copyright notice

Conflicts: lib/dns/dst_parse.c lib/isc/win32/file.c

3122. [cleanup] dnssec-settime: corrected usage message. [RT #24664]

3086. [bug] Running dnssec-settime -f on an old-style key will now force an update to the new key format even if no other change has been specified, using "-P now -A now" as default values. [RT #22474]

update copyright notice

3076. [func] New '-L' option in dnssec-keygen, dnsset-settime, and dnssec-keyfromlabel sets the default TTL of the key. When possible, automatic signing will use that TTL when the key is published. [RT #23304]

2990. [bug] 'dnssec-settime -S' no longer tests prepublication interval validity when the interval is set to 0. [RT #22761]

update copyright notice

2943. [func] Add support to load new keys into managed zones without signing immediately with "rndc loadkeys". Add support to link keys with "dnssec-keygen -S" and "dnssec-settime -S". [RT #21351]

2847. [cleanup] Corrected usage message in dnssec-settime. [RT #20921]

2833. [cleanup] Fix usage messages in dnssec-keygen and dnssec-settime. [RT #20851]

update copyright notice

fix spacing

update copyright notice

2809. [cleanup] Restored accidentally-deleted text in usage output in dnssec-settime and dnssec-revoke [RT #20739]

Minor cleanup in dnssec-* tools

2731. [func] Additional work on change 2709. The key parser will now ignore unrecognized fields when the minor version number of the private key format has been increased. It will reject any key with the major version number increased. [RT #20310]

2712. [func] New 'auto-dnssec' zone option allows zone signing to be fully automated in zones configured for dynamic DNS. 'auto-dnssec allow;' permits a zone to be signed by creating keys for it in the key-directory and using 'rndc sign <zone>'. 'auto-dnssec maintain;' allows that too, plus it also keeps the zone's DNSSEC keys up to date according to their timing metadata. [RT #19943]

2709. [func] Added some data fields, currently unused, to the private key file format, to allow implementation of explicit key rollover in a future release without impairing backward or forward compatibility. [RT #20310]

explicit engine rt20230a

noreturn RT #20257

2685. [bug] Fixed dnssec-signzone -S handling of revoked keys. Also, added warnings when revoking a ZSK, as this is not defined by protocol (but is legal). [RT #19943]

2677. [func] Changes to key metadata behavior: - Keys without "publish" or "active" dates set will no longer be used for smart signing. However, those dates will be set to "now" by default when a key is created; to generate a key but not use it yet, use dnssec-keygen -G. - New "inactive" date (dnssec-keygen/settime -I) sets the time when a key is no longer used for signing but is still published. - The "unpublished" date (-U) is deprecated in favor of "deleted" (-D). [rt20247]

RT #20213: - correctly use -K option in dnssec-keygen - fix an improper free() in dnssec-revoke - fix grammar in dnssec-settime

update copyright notice

2668. [func] Several improvements to dnssec-* tools, including: - dnssec-keygen and dnssec-settime can now set key metadata fields 0 (to unset a value, use "none") - dnssec-revoke sets the revocation date in addition to the revoke bit - dnssec-settime can now print individual metadata fields instead of always printing all of them, and can print them in unix epoch time format for use by scripts [RT #19942]

update copyright notice

2658. [bug] dnssec-settime and dnssec-revoke didn't process key file paths correctly. [RT #20078]

misc. bug fixes including null pointer dereference and memory leak. [RT #19953] I don't update CHANGES as this code has never been publicly released.

fix a merge error from rebasing dnssec-settime (an assignment was left in place that was supposed to have been removed--this was already reviewed, I just merged the fix wrong)

windows portability fix (review by mgraff)

more win32 build fixes

2636. [func] Simplify zone signing and key maintenance with the dnssec-* tools. Major changes: - all dnssec-* tools now take a -K option to specify a directory in which key files will be stored - DNSSEC can now store metadata indicating when they are scheduled to be published, acttivated, revoked or removed; these values can be set by dnssec-keygen or overwritten by the new dnssec-settime command - dnssec-signzone -S (for "smart") option reads key metadata and uses it to determine automatically which keys to publish to the zone, use for signing, revoke, or remove from the zone [RT #19816]