update copyright notice / whitespace

[v9_11] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957] (cherry picked from commit 129c4414cb6cff8042f1985fe5833aaae6043142) (cherry picked from commit f662d5484e0cf4cd83da300620b3701fee5a2ca1)

regen v9_11

Set a LMDB mapsize and also provide a config option to control it (#44954) (cherry picked from commit 241b49e6119eb37eebe2de98f0e8bde436074cb3)

[v9_11] update copyrights that had been missed recently

update copyright notice / whitespace

[v9_11] auto-generate named.conf.docbook 4603. [doc] Automatically generate named.conf(5) man page from doc/misc/options. Thanks to Tony Finch. [RT #43525]

4527. [doc] Support DocBook XSL Stylesheets v1.79.1. [RT #43831] (cherry picked from commit 1b8ce3b3302f0afe682d04df8a1f20b4ac346fb2)

4504. [security] Allow the maximum number of records in a zone to be specified. This provides a control for issues raised in CVE-2016-6170. [RT #42143] (cherry picked from commit 5f8412a4cb5ee14a0e8cddd4107854b40ee3291e)

add managed keys to view section (cherry picked from commit 7551ec1ebe25600dc552b9dcfa58088adbaacc58)

4447. [tuning] Allow the fstrm_iothr_init() options to be set using named.conf to control how dnstap manages the data flow. [RT #42974] (cherry picked from commit 934837913ff197b1a10ad027705d4497fae21e59)

4437. [func] Minimal-responses now has two additional modes no-auth and no-auth-recursive which suppress adding the NS records to the authority section as well as the associated address records for the nameservers. [RT #42005] (cherry picked from commit 78e31dd18798f22828059b0f5cbc1c984c7e142c)

4401. [misc] Change LICENSE to MPL 2.0.

4376. [experimental] Added support for Catalog Zones, a new method for provisioning secondary servers in which a list of zones to be served is stored in a DNS zone and can be propagated to slaves via AXFR/IXFR. [RT #41581] 4375. [func] Add support for automatic reallocation of isc_buffer to isc_buffer_put* functions. [RT #42394]

[master] minimal-any 4371. [func] New "minimal-any" option reduces the size of UDP responses for qtype ANY by returning a single arbitrarily selected RRset instead of all RRsets. Thanks to Tony Finch. [RT #41615]

update copyright notice / whitespace

add automatic-interface-scan to ARM grammar

Use optimal message sizes to improve compression in AXFRs (#40996)

4244. [bug] The parser was not reporting that use-ixfr is obsolete. [RT #41010]

cleanup trailing white space in SGML like files

regen master

[master] upgrade doc toolchain 4237. [doc] Upgraded documentation toolchain to use DocBook 5 and dblatex. [RT #40766]

[master] need id tag on refentry

Updated CHANGES note to include require-server-cookie: 4152. [func] Implement DNS COOKIE option. This replaces the experimental SIT option of BIND 9.10. The following named.conf directives are available: send-cookie, cookie-secret, cookie-algorithm, nocookie-udp-size and require-server-cookie. The following dig options are available: +[no]cookie[=value] and +[no]badcookie. [RT #39928]

docbook <command> tags around named server references

update copyright notice / whitespace

[master] add TCP pipelining support 4040. [func] Added server-side support for pipelined TCP queries. TCP connections are no longer closed after the first query received from a client. (The new "keep-response-order" option allows clients to be specified for which the old behavior will still be used.) [RT #37821]

Add a TCP only option to server/peer

[master] increase and allow configuration of lwresd tasks/clients 3852. [func] Increase the default number of clients available for servicing lightweight resolver queries, and make them configurable via the "lwres-tasks" and "lwres-clients" options. (Thanks to Tomas Hozza.) [RT #35857]

[master] correct dates in man pages

update copyright notice

[master] removed reference to "auto-dnssec create"

3574. [doc] The 'hostname' keyword was missing from server-id description in the named.conf man page. [RT #33476]

[master] fix typo

regen master

[master] change "fast" to "map" 3475. [cleanup] Changed name of 'map' zone file format (previously 'fast'). [RT #32458]

3387. [func] Support for a DS digest can be disabled at runtime with disable-ds-digests. [RT #21581]

update copyright notice

Add documentation for 'fast' format

new "dnssec-lookaside" option is "no", not "off"

3209. [func] Add "dnssec-lookaside 'off'". [RT #24858]

Remove the ixfr-from-differences side-effect which causes an AXFR and extend request-ixfr to the zone level.

3109. [func] The also-notify option now uses the same syntax as a zone's masters clause. This means it is now possible to specify a TSIG key to use when sending notifies to a given server, or to include an explicit named masters list in an also-notfiy statement. [RT #23508]

2039. [func] Redirect on NXDOMAIN support. [RT #23146]

3011. [func] Change the default query timeout from 30 seconds to 10. Allow setting this in named.conf using the new 'resolver-query-timeout' option, which specifies a max time in seconds. 0 means 'default' and anything longer than 30 will be silently set to 30. [RT #22852]

update copyright notice

3004. [func] DNS64 reverse support. [RT #22769]

2989. [func] Added support for writable DLZ zones. (Contributed by Andrew Tridgell of the Samba project.) [RT #22629] 2988. [experimental] Added a "dlopen" DLZ driver, allowing the creation of external DLZ drivers that can be loaded as shared objects at runtime rather than linked with named. Currently this is switched on via a compile-time option, "configure --with-dlz-dlopen". Note: the syntax for configuring DLZ zones is likely to be refined in future releases. (Contributed by Andrew Tridgell of the Samba project.) [RT #22629] 2987. [func] Improve ease of configuring TKEY/GSS updates by adding a "tkey-gssapi-keytab" option. If set, updates will be allowed with any key matching a principal in the specified keytab file. "tkey-gssapi-credential" is no longer required and is expected to be deprecated. (Contributed by Andrew Tridgell of the Samba project.) [RT #22629]

update copyright notice

2893. [bug] Improve managed keys support. New named.conf option managed-keys-directory. [RT #20924]

2799. [cleanup] Changed the "secure-to-insecure" option to "dnssec-secure-to-insecure", and "dnskey-ksk-only" to "dnssec-dnskey-kskonly", for clarity. [RT #20586]

Respinning to fix memory leak in dnssec-signzone. (Also adopting doc changes.)

2710. [func] New 'dnssec-signzone -x' flag and 'dnskey-ksk-only' zone option cause a zone to be signed with only KSKs signing the DNSKEY RRset, not ZSKs. This reduces the size of a DNSKEY answer. [RT #20340]

update copyright notice

2708. [func] Insecure to secure and NSEC3 parameter changes via update are now fully supported and no longer require defines to enable. We now no longer overload the NSEC3PARAM flag field, nor the NSEC OPT bit at the apex. Secure to insecure changes are controlled by by the named.conf option 'secure-to-insecure'. Warning: If you had previously enabled support by adding defines at compile time to BIND 9.6 you should ensure that all changes that are in progress have completed prior to upgrading to BIND 9.7. BIND 9.7 is not backwards compatible.

2448. [func] Add NSEC3 support. [RT #15452]

2398. [bug] Improve file descriptor management. New, temporary, named.conf option reserved-sockets, default 512. [RT #18344]

2349. [func] Provide incremental re-signing support for secure dynamic zones. [RT #1091] back out incorrect branch rt1091 and apply correct branch rt1091a.

update copyright notice

2286. [func] Allow a TCP connection to be used as a weak authentication method for reverse zones. New update-policy methods tcp-self and 6to4-self. [RT #17378]

commit lruttl to the mainline. A tag was set called skan_lruttl-mainline-base, and I will tag this as skan_lruttl-mainline-merge after this commit

2244. [func] Allow the check of nameserver names against the SOA MNAME field to be disabled by specifying 'notify-to-soa yes;'. [RT #17073]

add masterfile-format

documentation updates from Jeremy

update copyright notice

minor man page updated from Jeremy [RT #16859]

2165. [func] Allow the destination address of a query to determine if we will answer the query or recurse. allow-query-on, allow-recursion-on and allow-query-cache-on. [RT #16291]

2129. [func] Provide a pool of UDP sockets for queries to be made over. See use-queryport-pool, queryport-pool-ports and queryport-pool-updateinterval. [RT #16415]

update copyright notice

2128. [doc] xsltproc --nonet, update DTD versions. [RT #16635]

2082. [doc] Document 'cache-file' as a test only option.

2035. [func] Make falling back to TCP on UDP refresh failure optional. Default "try-tcp-refresh yes;" for BIND 8 compatibility. [RT #16123]

make query-source{-v6} clearer

2007. [func] It is now possible to explicitly enable DNSSEC validation. default dnssec-validation no; to be changed to yes in 9.5.0. [RT #15674]

2001. [func] Check the KSK flag when updating a secure dynamic zone. New zone option "update-check-ksk yes;". [RT #15817]

1964. [func] Seperate out MX and SRV to CNAME checks. [RT #15723]

1959. [func] Control the zeroing of the negative response TTL to a soa query. Defaults "zero-no-soa-ttl yes;" and "zero-no-soa-ttl-cache no;". [RT #15460]

1953. [func] Named now falls back to advertising EDNS with a 512 byte receive buffer if the initial EDNS queries fail. [RT #14852] 1952. [func] The maximum EDNS UDP response named will send can now be set in named.conf (max-udp-size). This is independent of the advertised receive buffer (edns-udp-size). [RT #14852]

update copyright notice

1947. [func] It is now possible to configure named to accept expired RRSIGs. Default "dnssec-accept-expired no;". Setting "dnssec-accept-expired yes;" leaves named vulnerable to replay attacks. [RT #14685]

1913. [func] Automatic empty zone creation for D.F.IP6.ARPA and friends. Note: RFC 1918 zones are not yet covered by this but are likely to be in a future release. New options: empty-server, empty-contact, empty-zones-enable and disable-empty-zone.

1891. [func] Limit the number of recursive clients that can be waiting for a single query (<qname,qtype,qclass>) to resolve. New options clients-per-query and max-clients-per-query.

1868. [func] edns-udp-size can now be overridden on a per server basis. [RT #14851]

1862. [func] Add additional zone data constancy checks. named-checkzone has extended checking of NS, MX and SRV record and the hosts they reference. named has extended post zone load checks. New zone options: check-mx and integrity-check. [RT #4940]

update copyright notice

1856. [doc] Switch Docbook toolchain from DSSSL to XSL.

1798. [func] The server syntax has been extended to support a range of servers. [RT #11132]

update copyrights

1792. [func] New zone option "notify-delay". Specify a minimum delay between sets of NOTIFY messages.

1755. [func] allow-update is now settable at the options / view level. [RT #6636]

1676. [func] New option "allow-query-cache". This lets allow-query be used to specify the default zone access level rather than having to have every zone override the global value. allow-query-cache can be set at both the options and view levels. If allow-query-cache is not set allow-query applies.

1747. [bug] BIND 8 compatability: named/named-checkconf failed to parse "host-statistics-max" in named.conf.

1705. [func] Allow the journal's name to be changed via named.conf.

1701. [doc] A minimal named.conf man page.