4450. [port] Provide more nuanced HSM support which better matches the specific PKCS11 providers capabilities. [RT #42458] (cherry picked from commit 8ee6f289d87851a5b898b24a64587f0e6bc225bc)

4401. [misc] Change LICENSE to MPL 2.0.

added print.h includes, updated copyrights

3744. [experimental] SIT: send and process Source Identity Tokens (which are similar to DNS Cookies by Donald Eastlake) and are designed to help clients detect off path spoofed responses and for servers to detect legitimate clients. SIT use a experimental EDNS option code (65001). SIT can be enabled via --enable-developer or --enable-sit. It is on by default in Windows. RRL processing as been updated to know about SIT with legitimate clients not being rate limited. [RT #35389]

[master] testcrypto.sh in system tests 3714. [test] System tests that need to test for cryptography support before running can now use a common "testcrypto.sh" script to do so. [RT #35213]

update copyrights

[master] native PKCS#11 support 3705. [func] "configure --enable-native-pkcs11" enables BIND to use the PKCS#11 API for all cryptographic functions, so that it can drive a hardware service module directly without the need to use a modified OpenSSL as intermediary (so long as the HSM's vendor provides a complete-enough implementation of the PKCS#11 interface). This has been tested successfully with the Thales nShield HSM and with SoftHSMv2 from the OpenDNSSEC project. [RT #29031]

update copyright notice

3437. [bug] isc_buffer_init -> isc_buffer_constinit to initialise buffers with constant data. [RT #32064] Squashed commit of the following: commit 3433b96bf11f8c90ccbe412f01d02a6d8bbc2d33 Author: Mark Andrews <marka@isc.org> Date: Sat Dec 8 12:41:16 2012 +1100 isc_buffer_init -> isc_buffer_constinit commit c22dbcc1122a0a44f7b46068e0ccbc25353a57d5 Author: Mark Andrews <marka@isc.org> Date: Sat Dec 8 12:38:39 2012 +1100 isc_buffer_init -> isc_buffer_constinit commit 900820416c45c1887d0d22d7a010df60a903bd56 Author: Mark Andrews <marka@isc.org> Date: Sat Dec 8 12:24:19 2012 +1100 remove isc_buffer_reconstinit commit f815711c17b05f9961786a90b9bae902d3c01494 Author: Mark Andrews <marka@isc.org> Date: Wed Dec 5 15:42:57 2012 +1100 add isc_buffer_constinit

update copyright notice

call dns_tsigkeyring_detach(&ring)

2660. [func] Add a new set of DNS libraries for non-BIND9 applications. See README.libdns. [RT #19369]

update copyright notice

2636. [func] Simplify zone signing and key maintenance with the dnssec-* tools. Major changes: - all dnssec-* tools now take a -K option to specify a directory in which key files will be stored - DNSSEC can now store metadata indicating when they are scheduled to be published, acttivated, revoked or removed; these values can be set by dnssec-keygen or overwritten by the new dnssec-settime command - dnssec-signzone -S (for "smart") option reads key metadata and uses it to determine automatically which keys to publish to the zone, use for signing, revoke, or remove from the zone [RT #19816]

update copyright notice

update copyright notice

update copyright notice

1940. [bug] Fixed a number of error conditions reported by Coverity.

1654. [bug] isc_result_totext() contained array bounds read error. 1653. [func] Add key type checking to dst_key_fromfilename(), DST_TYPE_KEY should be used to read TSIG, TKEY and SIG(0) keys. 1652. [bug] TKEY still uses KEY.

update copyright notice

create/destroy hash

added regression test for RT #1866, #1869

avoid unnecessary auto array initialization

isc_{base64|hex}_decodestring took an unused mctx. Remove the mctx.

remove extraneous spaces

argument handling was broken

remove a const-related warning

add copyrights to the tkey system test

Add a tkey system test