Update documentation to remove obsolete bind9-bugs@isc.org email address (cherry picked from commit efc9bc5d8d7295968cdb61b383ef562a1f8934ff) (cherry picked from commit 486e79050f98c1cbd119a828044d3d5b7637e473) (cherry picked from commit b02bf3b8a29911466365dcc95dc561d03478fe4b)

4811. [bug] Revert api changes to use <isc/buffer.h> inline macros. Provide a alternative mechanism to turn on the use of inline macros when building BIND. [RT #46520] (cherry picked from commit a1a5145867e99a688f8754263dc4f7da6ceb21aa)

Fix configure issue detecting stdatomic.h support (#46959) (cherry picked from commit 63d0c6a3fc890ff02bd8f0f6215e5b495eb076b8) (cherry picked from commit 7e1ed157621bf554d5f2dff29a3c249037d214f3)

regen v9_11

Merged rt46864 (check MD5 amd SHA1 support)

Don't use memset() to wipe memory (#45947) (cherry picked from commit d5707676e45551d1ceb600a674f3f13351fd3105)

Use C11's stdatomic.h instead of isc_atomic where available (cherry picked from commit 404c9b1c53fd13f3a7f404522b13f48e2a71a8a0)

Added Ed25519 support (#44696)

[v9_11] give threads unique names to assist debugging 4602. [func] Threads are now set to human-readable names to assist debugging, when supported by the OS. [RT #43234] (cherry picked from commit d26ae7fc0802f67a50f6f01152f356182d47305e)

4581. [port] Linux: Add getpid and getrandom to the list of system calls named uses for seccomp. [RT #44883] (cherry picked from commit f94f3e279169d0b7ab15e2b5b39c6705f87218f8)

4515. [port] FreeBSD: Find readline headers when they are in edit/readline/ instead of readline/. [RT #43658]

[v9_11] use arc4random_stir() when available 4499. [port] MacOSX: silence deprecated function warning by using arc4random_stir() when available instead of arc4random_addrandom(). [RT #43503] (cherry picked from commit 3fb62a5a4e57c00e4d818f09b9beabeb587a4b52)

4494. [bug] Look for <editline/readline.h>. [RT #43429] (cherry picked from commit 6fbb2b51d8614d154c870734f3ffc1b5aa3f3896)

[v9_11] store "addzone" zone config in a NZD database 4421. [func] When built with LMDB (Lightning Memory-mapped Database), named will now use a database to store the configuration for zones added by "rndc addzone" instead of using a flat NZF file. This improves performance of "rndc delzone" and "rndc modzone" significantly. Existing NZF files will automatically by converted to NZD databases. To view the contents of an NZD or to roll back to NZF format, use "named-nzd2nzf". To disable this feature, use "configure --without-lmdb". [RT #39837]

regen

Use GCC builtin for clz in RPZ lookup code (#42818) (cherry picked from commit 27038b159b50e69ea216a513edbd6ee68cdf89aa)

4358. [test] Added American Fuzzy Lop harness that allows feeding fuzzed packets into BIND. [RT #41723]

Use __built_expect() where available (#41411)

[master] add uname data to named -V 4308. [func] Added operating system details to "named -V" output. [RT #41452]

[master] dnstap 4235. [func] Added support in named for "dnstap", a fast method of capturing and logging DNS traffic, and a new command "dnstap-read" to read a dnstap log file. Use "configure --enable-dnstap" to enable this feature (note that this requires libprotobuf-c and libfstrm). See the ARM for configuration details. Thanks to Robert Edmonds of Farsight Security. [RT #40211]

4234. [func] Add deflate compression in statistics channel HTTP server. [RT #40861]

4152. [func] Implement DNS COOKIE option. This replaces the experimental SIT option of BIND 9.10. The following named.conf directives are avaliable: send-cookie, cookie-secret, cookie-algorithm and nocookie-udp-size. The following dig options are available: +[no]cookie[=value] and +[no]badcookie. [RT #39928]

4133. [port] Update how various json libraries are handled. [RT #39646]

Add a --enable-querytrace configure switch for very verbose query tracelogging (#37520)

4025. [port] bsdi: failed to build. [RT #38047]

Hardened OpenSSL digest/HMAC calls [RT #37944]

added hooks for gperftools CPU profiler [#37339]

[rt36039] 3902. bug] liblwres wasn't handling link-local addresses in nameserver clauses in resolv.conf. [RT #36039]

[master] enable libseccomp system call filtering 3851. [func] Allow libseccomp based system-call filtering on Linux; use "configure --enable-seccomp" to turn it on. Thanks to Loganaden Velvindron for the contribution. [RT #35347]

[master] check for arc4random_addrandom() 3840. [port] Check for arc4random_addrandom() before using it; it's been removed from OpenBSD 5.5. [RT #35907]

[master] use adaptive locks when available 3781. [tuning] Use adaptive mutex locks when available; this has been found to improve performance under load on many systems. "configure --with-locktype=standard" restores conventional mutex locks. [RT #32576]

[master] merge several interdependent fixes 3760. [bug] Improve SIT with native PKCS#11 and on Windows. [RT #35433] 3759. [port] Enable delve on Windows. [RT #35441] 3758. [port] Enable export library APIs on windows. [RT #35382]

remove ENABLE_SIT

don't set want_openssl_aes unless CRYPTO = -DOPENSSL

[master] add "--with-tuning=large" option 3745. [func] "configure --with-tuning=large" adjusts various compiled-in constants and default settings to values suited to large servers with abundant memory. [RT #29538]

3744. [experimental] SIT: send and process Source Identity Tokens (which are similar to DNS Cookies by Donald Eastlake) and are designed to help clients detect off path spoofed responses and for servers to detect legitimate clients. SIT use a experimental EDNS option code (65001). SIT can be enabled via --enable-developer or --enable-sit. It is on by default in Windows. RRL processing as been updated to know about SIT with legitimate clients not being rate limited. [RT #35389]

Add Linux support to: 3733. [func] Improve interface scanning support. Interface information will be automatically updated if the OS supports routing sockets (MacOS, *BSD, Linux). Use "automatic-interface-scan no;" to disable. Add "rndc scan" to trigger a scan. [RT #23027]

3733. [func] Improve interface scanning support. Interface information will be automatically updated if the OS supports routing sockets. Use "automatic-interface-scan no;" to disable. Add "rndc scan" to trigger a scan. [RT #23027]

[master] address several issues with native pkcs11

[master] native PKCS#11 support 3705. [func] "configure --enable-native-pkcs11" enables BIND to use the PKCS#11 API for all cryptographic functions, so that it can drive a hardware service module directly without the need to use a modified OpenSSL as intermediary (so long as the HSM's vendor provides a complete-enough implementation of the PKCS#11 interface). This has been tested successfully with the Thales nShield HSM and with SoftHSMv2 from the OpenDNSSEC project. [RT #29031]

3661. [bug] Address lock order reversal deadlock with inline zones. [RT #34856]

[master] portability fix 3614. [port] Check for <linux/types.h>. [RT #34162]

[master] add JSON statistics channel 3524. [func] Added an alternate statistics channel in JSON format, when the server is built with the json-c library: http://[address]:[port]/json. [RT #32630]

[master] add geoip support 3504. [func] Add support for ACLs based on geographic location, using MaxMind GeoIP databases. Based on code contributed by Ken Brownfield <kb@slide.com>. [RT #30681]

3435. [bug] Cross compilation support in configure was broken. [RT #32078]

update libtool support to version 2.4.2

Merge rt28412b - check for mmap() in configure - implement isc_file_mmap() and isc_file_munmap() to do malloc()/read() and free() when run on systems that do not support mmap().

merged filter-aaaa-on-v6 (ATT SoW) 3327. [func] Added 'filter-aaaa-on-v6' option; this is similar to 'filter-aaaa-on-v4' but applies to IPv6 connections. (Use "configure --enable-filter-aaaa" to enable this option.) [RT #27308]

3317. [func] Add ECDSA support (RFC 6605). [RT #21918]

regen

3244. [func] Added readline support to nslookup and nsupdate. Also simplified nsupdate syntax to make "update" and "prereq" optional. [RT #24659]

3171. [port] darwin 10.* and freebsd [89] are now built threaded by default.

regen

3066. [func] The DLZ "dlopen" driver is now built by default, no longer requiring a configure option. To disable it, use "configure --without-dlopen". Driver also supported on win32. [RT #23467]

regen

regen

3008. [func] Response policy zones (RPZ) support. [RT #21726]

rege

regen

2989. [func] Added support for writable DLZ zones. (Contributed by Andrew Tridgell of the Samba project.) [RT #22629] 2988. [experimental] Added a "dlopen" DLZ driver, allowing the creation of external DLZ drivers that can be loaded as shared objects at runtime rather than linked with named. Currently this is switched on via a compile-time option, "configure --with-dlz-dlopen". Note: the syntax for configuring DLZ zones is likely to be refined in future releases. (Contributed by Andrew Tridgell of the Samba project.) [RT #22629] 2987. [func] Improve ease of configuring TKEY/GSS updates by adding a "tkey-gssapi-keytab" option. If set, updates will be allowed with any key matching a principal in the specified keytab file. "tkey-gssapi-credential" is no longer required and is expected to be deprecated. (Contributed by Andrew Tridgell of the Samba project.) [RT #22629]

2978. [port] hpux: look for <devpoll.h> [RT #21919]

add kerberosv5/krb5.h to search list

2910. [func] Sanity check Kerberos credentials. [RT #20986]

2901. [port] Use AC_C_FLEXIBLE_ARRAY_MEMBER. [RT #21316]

2885. [bug] Improve -fno-strict-aliasing support probing in configure. [RT #21080]

regen

regen

2732. [func] Add optional filter-aaaa-on-v4 option, available if built with './configure --enable-filter-aaaa'. Filters out AAAA answers to clients connecting via IPv4. (This is NOT recommended for general use.) [RT #20339]

2667. [func] Add support for logging stack backtrace on assertion failure (not available for all platforms). [RT #19780] 9.7.0

fixed build error on hpux due to gai_strerror() prototype mismatch [RT #20194]

2660. [func] Add a new set of DNS libraries for non-BIND9 applications. See README.libdns. [RT #19369]

2629. [port] Check for seteuid()/setegid(), use setresuid()/ setresgid() if not present. [RT #19932]

2610. [port] sunos: Change #2363 was not complete. [RT #19796]

2534. [func] Check NAPTR records regular expressions and replacement strings to ensure they are syntaxically valid and consistant. [RT #18168]

2529. [cleanup] Upgrade libtool to silence complaints from recent version of autoconf. [RT #18657]

2505. [port] Treat amd64 similarly to x86_64 when determining atomic operation support. [RT #19031]

linux doesn't need checks for -lsocket and -lnsl

2503. [port] linux: improve compatibility with Linux Standard Base. [RT #18793]

2469. [port] solaris: Work around Solaris's select() limitations. [RT #18769]

2407. [port] hpux: test for sys/dyntune.h. [RT #18421]

2407. [port] hpux: test for sys/dyntune.h. [RT #18421]

Linux: use libcap for capability management if possible. [RT# 18026]

2363. [port] sunos: pre-set "lt_cv_sys_max_cmd_len=4096;". [RT #17513]

Make "rrset-order fixed" a compile-time option. settable by "./configure --enable-fixed-rrset". Disabled by default. [rt17977]

2325. [port] Linux: use capset() function if available. [RT #17557]

2287. [bug] Use 'volatile' if the compiler supports it. [RT #17413]

Fix compiler warnings on SCO OSr5

2127. [port] Improved OpenSSL 0.9.8 support. [RT #16563]

2122. [func] Experimental http server and statistics support for named via xml.

2105. [func] GSS-TSIG support (RFC 3645).

2054. [port] freebsd: do not explicitly link against -lpthread. [RT #16170]

1994. [port] OpenSSL 0.9.8 support. [RT #15694]

1978. [port] Handle systems which have a broken recvmsg(). [RT #15742]

1950. [port] Solaris 2.5.1 and earlier cannot bind() then connect() a TCP socket. This prevents the source address being set for TCP connections. [RT #15628]

1916. [func] Integrate contibuted IDN code from JPNIC. [RT #15383]

1916. [func] Integrate contibuted IDN code from JPNIC. [RT #15383]

1902. [port] Use uintptr_t if available. [RT #14606]

1898. [port] sunos: non blocking i/o support. [RT #14951]

1883. [port] sunos: portability fixes. [RT #14814]

regen

1814. [func] UNIX domain controls are now supported.

1781. [port] FreeBSD 5.3: set PTHREAD_SCOPE_SYSTEM. [RT #12810]

1731. [port] darwin: relax version test in ifconfig.sh. [RT #12581] 1730. [port] Determine the length type used by the socket API. [RT #12581]

1709. [port] solaris: add SMF support from Sun.

regen

regen

regen

1566. [port] Support for the cmsg framework on Solaris and HP/UX. This also solved the problem that match-destinations for IPv6 addresses did not work on these systems. [RT #10221]

regen

1550. [port] Call tzset(), if available, before calling chroot().

regen 1496. [port] test for pthread_attr_setstacksize().

regen

regen

regen: 1388. [port] irix: check for sys/sysctl.h and NET_RT_IFLIST before defining HAVE_IFLIST_SYSCTL. [RT #3770]

regen for: 1218. [port] Compaq Trucluster support.

regenerated; among other things, this removes #undef NET_IF6_H and adds #undef HAVE_NET_IF6_H

1065. [func] Runtime support to select new / old style interface scanning using ioctls.

isc__strerror

959. [port] freebsd: ncpus via sysctlbyname(). [RT #1584]

ssize_t is a signed value

958. [port] ssize_t is not available on all platforms. [RT #1607]

use ISC_PLATFORM_RLIMITTYPE unconditionally, eliminating the need for the HAVE_RLIM_T macro

check for getc_unlocked()

check for <sys/prctl.h>, not <linux/prctl.h> [RT #679]

692. [bug] Deal with systems that have getaddrinfo() but not gai_strerror(). [RT #679]

632. [port] Cope with rlim_t missing on BSD/OS systems. [RT #575]

- if pthreads are not found, build a nonthreaded version - check for pthread_attr_getstacksize

487. [port] flockfile() is not defined on all systems. Also check for libpthreads, if libpthread isn't found.

--disable-ipv6 shouldn't turn off detection, since that causes problems.

HAVE_RANDOMDEV -> PATH_RANDOMDEV

--with-randomdev sets HAVE_RANDOMDEV, use that instead of /dev/random.

Trailing whitespace trimmed. Perhaps running "perl util/spacewhack.pl in your own CVS tree will help minimize CVS conflicts. Maybe not. Blame Graff for getting me to trim all trailing whitespace.

add isc_thread_setconcurrency()

Check for sysconf()

Conditionalize setting of struct sockaddr_in6's sin6_scope_id member. Some machines have it, older ipv6 flavors do not.

Add HAVE_ADDRINFO and HAVE_GETADDRINFO to config.h.in and configure.in

Use autoconf's AC_C_BIGENDIAN macro to detect endian flavor, and use WORDS_BIGENDIAN from config.h{,.in}

add sha1 implementation

Silence a few more warnings: + missing sigwait prototype on BSD/OS 4.0/4.0.1 + PTHREAD_ONCE_INIT unbraced initializer warnings on Solaris 2.8. + IN6ADDR_ANY_INIT unbraced initializer warnings on BSD/OS 4.*, Linux and Solaris 2.8.

quiet va_start() warnings on BSD/OS 4.1

Added configuration tweaks for UnixWare: -- set compiler flags, yacc program. -- define HAVE_UNIXWARE_SIGWAIT for one arg sigwait semantics. -- provide for inclusion of netinet/in6.h for IPv6 support. Don't bother searching for netinet6/in6.h, just unconditionally declare it is needed on BSD/OS.

put SHUTUP_SPUTAUX in acconfig.h

115. [port] Shut up the -Wmissing-declarations warning about <stdio.h>'s __sputaux on BSD/OS pre-4.1.

Linux PR_SET_KEEPCAPS support

includes copyright and warning about using config.h in public headers

added HAVE_NETINET6_IN6_H

check for chroot and linux/capability.h

make sendmsg() and recvmsg() work on solaris and hpux through nasty methods

regen after configure.in changes

sysctl-based network interface list scanning

update

NEED_AF_INET6 and HAVE_SA_LEN are now obsolete

update

basic NLS support

update

update

AC_PREREQ; support both mit-pthreads and ptl2 on NetBSD; sa_len fixes

added autoconf check for sa_len

Clean up many compiler warnings.

First pass at addrlength grossness cleanup. Man, this is ugly.

add NEED_INET_ATON

Solaris port: inet_pton, AF_INET6

make this go on the Alpha.

add libpthread and libxnet?

BIND9 Pool Creation