test devent->sigrdataset rather than devent->rdataset before calling query_putrdataset

update copyright notice / whitespace

4857. [bug] Maintain attach/detach semantics for event->db, event->node, event->rdataset and event->sigrdataset in query.c. [RT #46891]

4817. [cleanup] Use DNS_NAME_INITABSOLUTE and DNS_NAME_INITNONABSOLUTE. [RT #45433] (cherry picked from commit 3d905e053369cff1412b9d20aa5bb23376e0fed4)

[v9_11] fix merge error; missing hunk from change 4780

[v9_11] omit NS from authority section if it was in answer 4780. [bug] When answering ANY queries, don't include the NS RRset in the authority section if it was already in the answer section. [RT #44543]

4759. [func] Add logging channel "trust-anchor-telementry" to record trust-anchor-telementry in incoming requests. Both _ta-XXXX.<anchor>/NULL and EDNS KEY-TAG options are logged. [RT #46124] (cherry picked from commit b41c1aacbc550fa67bfa62df3114b1d668b9c8d8)

4739. [cleanup] Address clang static analysis warnings. [RT #45952] (cherry picked from commit f9f3f20d2d08e1c8756a1b260d7c5125426d8395)

[v9_11] backport rpz tweaks 4713. [cleanup] Minor revisions to RPZ code to reduce differences with the development branch. [RT #46037]

[v9_11] turn on minimal responses for CDS/CDNSKEY 4678. [cleanup] Turn on minimal responses for CDNSKEY and CDS in addition to DNSKEY and DS. Thanks to Tony Finch. [RT #45690] (cherry picked from commit 391a3a2f202a374e20f394b92116f129dcbb99a1)

[v9_11] silence gcc 7 warnings 4673. [port] Silence GCC 7 warnings. [RT #45592] (cherry picked from commit cdacec1dcb93149b8efc7af38ec916adcdd706f3)

4640. [bug] If query_findversion failed in query_getdb due to memory failure the error status was incorrectly discarded. [RT #45331] (cherry picked from commit b551ee14bd12fff52aa05f7f94cd4e17cea52be3)

Don't log NSDNAME failures as NSIP (#45052) (cherry picked from commit 2c11da844192d8366a6e0047dff15a2746f9467e)

[v9_11] fix rpz formerr loop 4531. [security] Some RPZ configurations could go into an infinite query loop when encountering responses with TTL=0. (CVE-2017-3140) [RT #45181]

[v9_11] Add DLZ db version to activeversions 4628. [bug] Fixed a potential reference leak in query_getdb(). [RT #45247] (cherry picked from commit 594eadcc341bc29f5977a5f09d910132ea9bd244)

remove unused assignments [RT #45147] (cherry picked from commit 78551a3f2c9dd53a85386a6234860127e23befd9)

Validate glue before adding it to the additional section (#45062) (cherry picked from commit b0dbcba2d25dfa49a2e705e4481298729334605a)

4575. [security] Dns64 with break-dnssec yes; can result in a assertion failure. (CVE-2017-3136) [RT #44653] (cherry picked from commit 3bce12e4b6d37f570ffc7747b499f8b90e8521ac)

4556. [security] Combining dns64 and rpz can result in dereferencing a NULL pointer (read). (CVE-2017-3135) [RT#44434] (cherry picked from commit 5abe80ef138340e3d4f551059a3c340b78940933)

update copyright notice / whitespace

whitespace (cherry picked from commit bf0b64999352b8bf72b200ece4f9d6997e94e7ab)

4531. [security] 'is_zone' was not being properly updated by redirect2 and subsequently preserved leading to an assertion failure. (CVE-2016-9778) [RT #43837] (cherry picked from commit d376792dae686e0fc0e3986ad3335d1b7ff0c279)

4472. [bug] Named could fail to find the correct NSEC3 records when a zone was update between looking for the answer and looking for the NSEC3 records proving non-existance of the answer. [RT #43247]

4437. [func] Minimal-responses now has two additional modes no-auth and no-auth-recursive which suppress adding the NS records to the authority section as well as the associated address records for the nameservers. [RT #42005] (cherry picked from commit 78e31dd18798f22828059b0f5cbc1c984c7e142c)

4434. [protocol] Return EDNS EXPIRE option for master zones in addition to slave zones. [RT #43008] (cherry picked from commit bf2238b064ed2398a9e9db27c6fb73f58c4db38a)

4401. [misc] Change LICENSE to MPL 2.0.

also cleanup node

detach before restore

reset zversion on restart

4377. [bug] Don't reuse zero TTL responses beyond the current client set (excludes ANY/SIG/RRSIG queries). [RT #42142]

[master] copyrights, win32 definitions

4374. [bug] Use SAVE/RESTORE macros in query.c to reduce the probability of reference counting errors as seen in 4365. [RT #42405]

[master] minimal-any 4371. [func] New "minimal-any" option reduces the size of UDP responses for qtype ANY by returning a single arbitrarily selected RRset instead of all RRsets. Thanks to Tony Finch. [RT #41615]

4365. [bug] Address zone reference counting errors involving nxdomain-redirect. [RT #42258]

4358. [test] Added American Fuzzy Lop harness that allows feeding fuzzed packets into BIND. [RT #41723]

4356. [func] Add the ability to specify whether to wait for nameserver addresses to be looked up or not to rpz with a new modifying directive 'nsip-wait-recurse'. [RT #35009]

Code cleanups (#41656)

add missing line break

4313. [bug] Handle ns_client_replace failures in test mode. [RT #41190]

update copyright notice / whitespace

[master] NOSETFC incorrectly applied 4300. [bug] A flag could be set in the wrong field when setting up nonrecursive queries; this could cause the SERVFAIL cache to cache responses it shouldn't. New querytrace logging has been added which identified this error. [RT #41155]

4281. [bug] Teach dns_message_totext about BADCOOKIE. [RT #41257]

add blank line

4242. [bug] Replace the client if not already replaced when prefetching. [RT #41001]

4227. [bug] Silence static analysis warnings. [RT #40828

make macro name match category name

Fix RPZ bugs related to wildcard triggers (#40357)

Updated CHANGES note to include require-server-cookie: 4152. [func] Implement DNS COOKIE option. This replaces the experimental SIT option of BIND 9.10. The following named.conf directives are available: send-cookie, cookie-secret, cookie-algorithm, nocookie-udp-size and require-server-cookie. The following dig options are available: +[no]cookie[=value] and +[no]badcookie. [RT #39928]

if UDP and we have a bad cookie send a immediate badcookie response

future cookie code

Allow RPZ rewrite logging to be configured on a per-zone basis (#39754)

update copyright notice / whitespace

4152. [func] Implement DNS COOKIE option. This replaces the experimental SIT option of BIND 9.10. The following named.conf directives are avaliable: send-cookie, cookie-secret, cookie-algorithm and nocookie-udp-size. The following dig options are available: +[no]cookie[=value] and +[no]badcookie. [RT #39928]

update copyright notice / whitespace

Add statistics counters for nxdomain redirections. [RT #39790]

[master] log outdated rpz settings regardless of enable-querytrace

[master] rpz_ver check was ineffective

[master] further RPZ fixes 4131. [bug] Addressed further problems with reloading RPZ zones. [RT #39649]

[master] address regression 4126. [bug] Addressed a regression introduced in change #4121. [RT #39611]

Fix RPZ radix tree search() for CLIENT-IP triggers (#39481)

[master] revert erroneous cleanup

[master] minor cleanup

[master] address a possible policy update race 4120. [bug] A bug in RPZ could cause the server to crash if policy zones were updated while recursion was pending for RPZ processing of an active query. [RT #39415]

restore is_zone on return from redirect lookup [RT #37989b] (cherry picked from commit 1d405c1412b3a2e5aafb37ea55b332914246349e)

update copyright notice / whitespace

4108. [func] A additional nxdomain redirect (nxdomain-redirect) method is now supported. [RT #37989]

4081. [cleanup] Use dns_rdatalist_init consistently. [RT #38759]

4079. [func] Preserve the case of the ownername of records to the RRset level. [RT #37442]

Add a --enable-querytrace configure switch for very verbose query tracelogging (#37520)

Fix a leak of query fetchlock (#38454) 4052. [bug] Fix a leak of query fetchlock. [RT #38454]

[master] silence RPZ log messages 4050. [cleanup] Silence occasional spurious "duplicate query" log messages from RPZ. [RT #38510]

update copyright notice / whitespace

[master] clean up gcc -Wshadow warnings 4039. [cleanup] Cleaned up warnings from gcc -Wshadow. [RT #37381]

4010. [cleanup] Clear the prefetchable state when initiating a prefetch. [RT #37399]

[master] refactor max-recursion-queries - the counters weren't set correctly when fetches timed out. instead we now pass down a counter object.

[master] limit recursion depth and iterative queries 4006. [security] A flaw in delegation handling could be exploited to put named into an infinite loop. This has been addressed by placing limits on the number of levels of recursion named will allow (default 7), and the number of iterative queries that it will send (default 50) before terminating a recursive query (CVE-2014-8500). The recursion depth limit is configured via the "max-recursion-depth" option. [RT #35780]

[master] fix nxrrset in nxdomain redirection 4000. [bug] NXDOMAIN redirection incorrectly handled NXRRSET from the redirect zone. [RT #37722]

3975. [bug] Don't populate or use the bad cache for queries that don't request or use recursion. [RT #37466]

3949. [experimental] Experimental support for draft-andrews-edns1 by sending EDNS(1) queries (define DRAFT_ANDREWS_EDNS1 when building). Add support for limiting the EDNS version advertised to servers: server { edns-version 0; }; Log the EDNS version received in the query log. [RT #35864]

[master] fix warnings/doc errors - possible use before assignment in query.c - missing <varlistentry> in ARM

[master] servfail cache 3943. [func] SERVFAIL responses can now be cached for a limited time (configured by "servfail-ttl", default 10 seconds, limit 30). This can reduce the frequency of retries when an authoritative server is known to be failing, e.g., due to ongoing DNSSEC validation problems. [RT #21347]

#include isc/print.h>

[master] add better servfail logging 3937. [func] Added some debug logging to better indicate the conditions causing SERVFAILs when resolving. [RT #35538]

3921. [bug] AD was inappopriately set on RPZ responses. [RT #36833]

update copyright notice

3904. [func] Add the RPZ SOA to the additional section. [RT36507]

[master] complete NTA work 3882. [func] By default, negative trust anchors will be tested periodically to see whether data below them can be validated, and if so, they will be allowed to expire early. The "rndc nta -force" option overrides this behvaior. The default NTA lifetime and the recheck frequency can be configured by the "nta-lifetime" and "nta-recheck" options. [RT #36146]

[master] suppress unnecessary db lookups in DLZ redirect zones 3876. [bug] Improve efficiency of DLZ redirect zones by suppressing unnecessary database lookups. [RT #35835]

More changes for: 3864. [bug] RPZ didn't work well when being used as forwarder. [RT #36060]

3864. [bug] RPZ didn't work well when being used as forwarder. [RT #36060]

3863. [bug] The "E" flag was missing from the query log as a unintended side effect of code rearrangement to support EDNS EXPIRE. [RT #36117]

3842. [bug] Adjust RRL log-only logging category. [RT #35945]

3837. [security] A NULL pointer is passed to query_prefetch resulting a REQUIRE assertion failure when a fetch is actually initiated. [ RT #35899] Squashed commit of the following: commit 7f4e1f3917d743089c42cc52ec2c0eea598d2c00 Author: Mukund Sivaraman <muks@isc.org> Date: Sun May 4 22:34:34 2014 +0530 Fix a comment commit 6a35a6a2346013fa8e3798b9b680d8a3031fcb03 Author: Mark Andrews <marka@isc.org> Date: Sun May 4 23:34:25 2014 +1000 pass the correct name to query_prefetch

[master] log query errors at info when query logging is on 3830. [func] When query logging is enabled, log query errors at the same level ('info') as the queries themselves. [RT #35844]

3823. [func] Log the rpz cname target when rewriting. [RT #35667]

[master] better DDNS in DLZ; mysqldyn 3821. [contrib] Added a new "mysqldyn" DLZ module with dynamic update and transaction support. Thanks to Marty Lee for the contribution. [RT #35656] 3820. [func] The DLZ API doesn't pass the database version to the lookup() function; this can cause DLZ modules that allow dynamic updates to mishandle prerequisite checks. This has been corrected by adding a 'dbversion' field to the dns_clientinfo_t structure. [RT #35656]

[master] fix misuses of isc__buffer functions, update comment

[master] fix DLZ coredump 3777. [bug] EDNS EXPIRE code could dump core when processing DLZ queries. [RT #35493]

update copyright notice

increment dns_nsstatscounter_recursclients when prefetching

add EDNS EXPIRE processing on ixfr and axfr out

3750. [experimental] Partially implement EDNS EXPIRE option as described in draft-andrews-dnsext-expire-00. Retrivial of remaining time to expiry from slave zones is supported. EXPIRE uses an experimental option code (65002) and is subject to change. [RT #35416]

silence Function returns no value

3744. [experimental] SIT: send and process Source Identity Tokens (which are similar to DNS Cookies by Donald Eastlake) and are designed to help clients detect off path spoofed responses and for servers to detect legitimate clients. SIT use a experimental EDNS option code (65001). SIT can be enabled via --enable-developer or --enable-sit. It is on by default in Windows. RRL processing as been updated to know about SIT with legitimate clients not being rate limited. [RT #35389]

[master] tcp and udp stats counters 3739. [func] Added per-zone stats counters to track TCP and UDP queries. [RT #35375]

fix for pre C99 compiler

update copyright notice

3703. [func] Prefetch about to expire records if they are queried for, see prefetch option for details. [RT #35041]

update copyright notice

[master] replace memcpy() with memmove(). 3698. [cleanup] Replaced all uses of memcpy() with memmove(). [RT #35120]

3693. [security] memcpy was incorrectly called with overlapping ranges resulting in malformed names being generated on some platforms. This could cause INSIST failures when serving NSEC3 signed zones. [RT #35120]

3674. [bug] RPZ zeroed ttls if the query type was '*'. [RT #35026]

remove unnecessary assignment

3652. [bug] Address bug with rpz-drop policy. [RT #34816]

assignment not read

3636. [bug] Automatic empty zones now behave better with forward only "zones" beneath them. [RT #34583]

3631. [bug] Remove spurious warning about missing signatures when qtype is SIG. [RT #34600]

[master] perf: eliminate cache stats attach/detach 3622. [tuning] Eliminate an unnecessary lock when incrementing cache statistics. [RT #34339]

[master] silence warning

update copyright notice

[master] rpz work 3620. [func] Added "rpz-client-ip" policy triggers, enabling RPZ responses to be configured on the basis of the client IP address; this can be used, for example, to blacklist misbehaving recursive or stub resolvers. [RT #33605] 3619. [bug] Fixed a bug in RPZ with "recursive-only no;" [RT #33776]

[master] improve RRL handling of deferrals and slipped NXDOMAIN 3590. [bug] When using RRL on recursive servers, defer rate-limiting until after recursion is complete; also, use correct rcode for slipped NXDOMAIN responses. [RT #33604]

[master] change RRL log category 'query-errors' 3575. [func] Changed the logging category for RRL events from 'queries' to 'query-errors'. [RT #33540]

[master] fixed several RRL issues 3554. [bug] RRL failed to correctly rate-limit upward referrals and failed to count dropped error responses in the statistics. [RT #33225]

[master] address windows build warnings

remove unreachable line

[master] RPZ speedup (phase 2, multiple RPZ's) 3495. [func] Support multiple response-policy zones, while improving RPZ performance. [RT #32476]

[master] DNS RRL 3494. [func] DNS RRL: Blunt the impact of DNS reflection and amplification attacks by rate-limiting substantially- identical responses. [RT #28130]

[master] fix DNS64 with RPZ-remapped A records 3468. [security] RPZ rules to generate A records (but not AAAA records) could trigger an assertion failure when used in conjunction with DNS64. [RT #32141]

3461. [bug] Negative responses could incorrectly have AD=1 set. [RT #32237]

update copyright notice

[master] allow-query-on works now 3448. [bug] The allow-query-on ACL was not processed correctly. [RT #29486]

[master] pass client info to DLZ findzone method 3434. [bug] Pass client info to the DLZ findzone() entry point in addition to lookup(). This makes it possible for a database to answer differently whether it's authoritative for a name depending on the address of the client. [RT #31775]

[master] multiple-dlz/dlz-nxdomain 3432. [func] Multiple DLZ databases can now be configured. DLZ databases are searched in the order configured, unless set to "search no", in which case a zone can be configured to be retrieved from a particular DLZ database by using a "dlz <name>" option in the zone statement. DLZ databases can support type "master" and "redirect" zones. [RT #27597]

silence clang --analyze warning

3418. [func] New XML schema (version 3.0) for the statistics channel adds query type statistics at the zone level, and flattens the XML tree and uses compressed format to optimize parsing. Includes new XSL that permits charting via the Google Charts API on browsers that support javascript in XSL. The old XML schema has been deprecated. [RT #30023] 3417. [placeholder]

3413. [func] Record the number of DNS64 AAAA RRsets that have been synthesized. [RT #27636] Squashed commit of the following: commit b375c287a3d95ed2eb29977d4347d845f393add7 Author: Evan Hunt <each@isc.org> Date: Wed Oct 24 21:28:04 2012 -0700 [rt27636] add dns64 responses stat counter

fix coverity issues 3388. [bug] Fixed several Coverity warnings. [RT #30996]

fixed an exploitable hang bug 3383. [security] A certain combinations of records in the RBT could cause named to hang while populating the additional section of a response. [RT #31090]

3371. [bug] AD=1 should behave like DO=1 when deciding whether to add NS RRsets to the additional section or not. [RT #30479]

update copyright notice

3356. [bug] Cap the TTL of signed RRsets when RRSIGs are approaching their expiry, so they don't remain in caches after expiry. [RT #26429]

3339. [func] Allow the maximum supported rsa exponent size to be specified: "max-rsa-exponent-size <value>;" [RT #29228]

update copyright notice

Squashed commit of the following: commit aea73609ac5d41ed091360e94370798965f28f05 commit eef7f44c57a060b24a426eb8888e16176a0a69b1 commit a88a26d864ad399fa2d40e3b9659b4d26f454ca1 commit 1b90d59568e7e3b65690c6bd075cf4d60b03e454 Merge: 74d8f73 cd02924 commit 74d8f73ed553bb64a305e284905762f7ff0029aa commit 9a59ef6bbd4befe91e5691e8b85afe1cb7ab0706 commit c63606a53b4f1bb7066b37d3cfe588e9dc21a119 commit 2c392a840c8838455d144ce163bd873bee400c97 commit 0241f53563e6e7bed462a883d98a8931f01e0980 commit 79fe22b5d6f04bdaa3073cf54d41952194e879e1 commit 351b3049625f2edd39729dd85413e961b97d4b3b commit 7207674fc77c9a10d84c0cb94e36d1c09bb31459 commit 543ad34cf08f901c20b438c9d2f45482cff13d5e commit fc45b99ce4438627fdcbeb4365695ba0065fa46f commit c425207f57e0a5157372aa7edbb79b13170563e5 commit ef8c5e23ca284e0ea02f69ce1f356d537c19d93b commit ba0d4e3aa51efe412cfa1d031651f949442d1802 commit 41c7969c7cb6884b93011f7ace3fd9522efc021e and more from CVS for rt26172 Add - optional "recursive-only yes|no" to the response-policy statement - optional max-policy-ttl to limit the lies that "recursive-only no" can introduce into resolvers' caches - test that queries with RD=0 are not rewritten by default - performance smoke test Change encoding of PASSTHRU action to "rpz-passthru". (The old encoding is still accepted.) Fix rt26180 assert botch in zone_findrdataset() in this branch as well. Fix missing signatures on NOERROR results despite RPZ hits when there are signatures and the client asks for DNSSEC,

update copyright notice

merged filter-aaaa-on-v6 (ATT SoW) 3327. [func] Added 'filter-aaaa-on-v6' option; this is similar to 'filter-aaaa-on-v4' but applies to IPv6 connections. (Use "configure --enable-filter-aaaa" to enable this option.) [RT #27308]

Merge statistics code (ATT SoW, rt24117) This includes the following changes: 3326. [func] Added task list statistics: task model, worker threads, quantum, tasks running, tasks ready. [RT #27678] 3325. [func] Report cache statistics: memory use, number of nodes, number of hash buckets, hit and miss counts. [RT #27056] 3324. [test] Add better tests for ADB stats [RT #27057] 3323. [func] Report the number of buckets the resolver is using. [RT #27020] 3322. [func] Monitor the number of active TCP and UDP dispatches. [RT #27055] 3321. [func] Monitor the number of recursive fetches and the number of open sockets, and report these values in the statistics channel. [RT #27054] 3320. [func] Added support for monitoring of recursing client count. [RT #27009] 3319. [func] Added support for monitoring of ADB entry count and hash size. [RT #27057]

3299. [bug] Make SDB handle errors from database drivers better. [RT #28534]

set $Id$

Revert "Re-created rt27597a for ongoing DLZ work" This reverts commit d731ee9121c3864839c3bdcd3b7ee603ec3999ff.

Re-created rt27597a for ongoing DLZ work

Revert accidental merge of unfinished DLZ work

checkpoint: multiple-DLZ functionality - multiple DLZ's can be specified, including multiple DLZ's using the same driver; e.g., two different back-ends both loaded by the dlopen driver - new "search" option can be specified in a DLZ indicating whether this DLZ database should be searched for unknown zones. The default is "yes". If "no", then the zone can only be found by named if it's registered in the zone table, which happens if the zone is configured for dynamic updates, or if "dlz <dlzname>" is specified in the zone statement. (The latter functionality is incomplete in this commit).

3280. [bug] Potential double free of a rdataset on out of memory with DNS64. [RT #27762]

update copyright notice

3273. [bug] AAAA responses could be returned in the additional section even when filter-aaaa-on-v4 was in use. [RT #27292]

3262. [bug] Signed responses were handled incorrectly by RPZ. [RT #27316]

update copyright notice

3260. [bug] "rrset-order cyclic" could appear not to rotate for some query patterns. [RT #27170/27185]

3218. [security] Cache lookup could return RRSIG data associated with nonexistent records, leading to an assertion failure. [RT #26590]

3186. [bug] Version/db mis-match in rpz code. [RT #26180]

3175. [bug] Fix how DNSSEC positive wildcard responses from a NSEC3 signed zone are validated. Stop sending a unnecessary NSEC3 record when generating such responses. [RT #26200]

update copyright notice

Commit rt25172 changes to HEAD including - fix precedence among competing rules - improve ARM text including documenting rule precedence - try to rewrite CNAME chains until first hit - new "rpz" logging channel - same fix for "NS ." as in RT 24985

update copyright notice

3168. [bug] Nxdomain redirection could trigger a assert with a ANY query. [RT #26017]

update copyright notice

3164. [func] Enable DLZ modules to retrieve client information, so that responses can be changed depending on the source address of the query. [RT #25768]

update copyright notice

3151. [bug] Queries for type RRSIG or SIG could be handled incorrectly. [RT #21050]

3126. [security] Using DNAME record to generate replacements caused RPZ to exit with a assertion failure. [RT #23766]

3125. [security] Using wildcard CNAME records as a replacement with RPZ caused named to exit with a assertion failure. [RT #24715]

3124. [bug] Use an rdataset attribute flag to indicate negative-cache records rather than using rrtype 0; this will prevent problems when that rrtype is used in actual DNS packets. [RT #24777] 3123. [security] Change #2912 exposed a latent flaw in dns_rdataset_totext() that could cause named to crash with an assertion failure. [RT #24777]

3115. [bug] Named could fail to return requested data when following a CNAME that points into the same zone. [RT #2445]

update copyright notice

3100. [security] Certain response policy zone configurations could trigger an INSIST when receiving a query of type RRSIG. [RT #24280]

3099. [test] "dlz" system test now runs but gives R:SKIPPED if not compiled with --with-dlz-filesystem. [RT #24146] 3098. [bug] DLZ zones were answering without setting the AA bit. [RT #24146]

fix too long with dname error

3069. [cleanup] Silence warnings messages from clang static analysis. [RT #20256]

3066. [func] The DLZ "dlopen" driver is now built by default, no longer requiring a configure option. To disable it, use "configure --without-dlopen". Driver also supported on win32. [RT #23467]

update copyright notice

2039. [func] Redirect on NXDOMAIN support. [RT #23146]

Fix prz SERVFAILs after failed zone transfers (RT23246).

3013. [bug] The DNS64 ttl was not always being set as expected. [RT #23034]

arguements out of order

update copyright notice

3008. [func] Response policy zones (RPZ) support. [RT #21726]

3000. [bug] More TKEY/GSS fixes: - nsupdate can now get the default realm from the user's Kerberos principal - corrected gsstest compilation flags - improved documentation - fixed some NULL dereferences [RT #22795]

2947. [func] Add new zone type "static-stub". It's like a stub zone, but the nameserver names and/or their IP addresses are statically configured. [RT #21474] (for 9.8.0)

update copyright notice

2981. [func] Partial DNS64 support (AAAA synthesis). [RT #21991]

2963. [security] The allow-query acl was being applied instead of the allow-query-cache acl to cache lookups. [RT #22114]

2960. [func] Check that named accepts non-authoritative answers. [RT #21594]

2953. [bug] Silence spurious "expected covering NSEC3, got an exact match" message when returning a wildcard no data response. [RT #21744]

2931. [bug] Temporarily and partially disable change 2864 because it would cause inifinite attempts of RRSIG queries. This is an urgent care fix; we'll revisit the issue and complete the fix later. [RT #21710]

update copyright notice

2925. [bug] Named failed to accept uncachable negative responses from insecure zones. [RT# 21555]

update copyright notice

2920. [func] Allow 'filter-aaaa-on-v4' to be applied selectively to IPv4 clients. New acl 'filter-aaaa' (default any).

update copyright notice

2864. [bug] Direct SIG/RRSIG queries were not handled correctly. [RT #21050]

2828. [security] Cached CNAME or DNAME RR could be returned to clients without DNSSEC validation. [RT #20737] 9.4-ESV, 9.5.3, 9.6.2, 9.7.0, 9.8.0(?)

Allow the optional filter-aaaa-on-v4 option in view statements to close #20635

2786. [bug] Additional could be promoted to answer. [RT #20663]

2783. [func] Return minimal responses to EDNS/UDP queries with a UDP buffer size of 512 or less. [RT #20654]

2772. [security] When validating, track whether pending data was from the additional section or not and only return it if validates as secure. [RT #20438]