Update documentation to remove obsolete bind9-bugs@isc.org email address (cherry picked from commit efc9bc5d8d7295968cdb61b383ef562a1f8934ff) (cherry picked from commit 486e79050f98c1cbd119a828044d3d5b7637e473) (cherry picked from commit b02bf3b8a29911466365dcc95dc561d03478fe4b)

4811. [bug] Revert api changes to use <isc/buffer.h> inline macros. Provide a alternative mechanism to turn on the use of inline macros when building BIND. [RT #46520] (cherry picked from commit a1a5145867e99a688f8754263dc4f7da6ceb21aa)

Fix configure issue detecting stdatomic.h support (#46959) (cherry picked from commit 63d0c6a3fc890ff02bd8f0f6215e5b495eb076b8) (cherry picked from commit 7e1ed157621bf554d5f2dff29a3c249037d214f3)

regen v9_11

regen v9_11

4842. [bug] Conditionally compile opensslecdsa_link.c to avoid warnings about unused function. [RT #46790] (cherry picked from commit 63459cdc05b20b9e7fc9256e825860725aab9633)

regen v9_11

regen v9_11

fix merge error

4814. [cleanup] Use AS_HELP_STRING for consistent help text. [RT #46521] (cherry picked from commit 6bbbf129365d3267eff75fbc2432563f5d0b7bbf)

[v9_11] Check if -latomic is needed to handle 64-bit stdatomic.h types 4809. [port] Check at configure time whether -latomic is needed for stdatomic.h. [RT #46324] (cherry picked from commit e3d9aafff0f2749469d5edf6dacd4ecf2f7224c0)

regen v9_11

regen v9_11

[v9_11] use mysql_config if available 4763. [contrib] Improve compatibility when building MySQL DLZ module by using mysql_config if available. [RT #45558]

regen v9_11

[v9_11] add configured prefixes to summary 4746. [cleanup] Add configured prefixes to configure summary output. [RT #46153] (cherry picked from commit c0f8a8f30a59fd1d35260deaccde4eee38dc6a93)

Don't use memset() to wipe memory (#45947) (cherry picked from commit d5707676e45551d1ceb600a674f3f13351fd3105)

Use C11's stdatomic.h instead of isc_atomic where available (cherry picked from commit 404c9b1c53fd13f3a7f404522b13f48e2a71a8a0)

regen v9_11

regen v9_11

regen v9_11

fix pthread_np.h detection [rt45680]

Added Ed25519 support (#44696)

4655. [bug] Lack of seccomp could be falsely reported. [RT #45599] (cherry picked from commit 4f4b94a042817debd8f9440888cde926b24c6405)

use 'test "constant" <condition> "$variable"' [RT #45486] (cherry picked from commit aed501fb88a9f5e864dc1d606c14fe973296b9de)

regen v9_11

4639. [bug] Fix a regression in --with-tuning reporting introduced by change 4488. [RT #45396]

4623. [bug] Use --with-protobuf-c and --with-libfstrm to find protoc-c and fstrm_capture. [RT #45187] (cherry picked from commit 366cff85a915c1f128d76ae9b4e85475e66e0b54)

regen v9_11

[v9_11] give threads unique names to assist debugging 4602. [func] Threads are now set to human-readable names to assist debugging, when supported by the OS. [RT #43234] (cherry picked from commit d26ae7fc0802f67a50f6f01152f356182d47305e)

[v9_11] update README, remove FAQ 4593. [doc] Update README using markdown, remove outdated FAQ file in favor of the knowledge base.

4590. [bug] Support for PTHREAD_MUTEX_ADAPTIVE_NP was not being properly detected. [RT #44871] (cherry picked from commit 88740c7fce1daf99664f41a41b49b01da167eaad)

[v9_11] some output was not silenced with configure -q 4589. [cleanup] "configure -q" is now silent. [RT #44829] (cherry picked from commit 897049d129ce1f6c6c7b1894a4d0073aadf381a9)

4581. [port] Linux: Add getpid and getrandom to the list of system calls named uses for seccomp. [RT #44883] (cherry picked from commit f94f3e279169d0b7ab15e2b5b39c6705f87218f8)

--enable-developer now compiles bin/tests's XTARGETS [RT #44205] (cherry picked from commit 434477aa0267514e01cc2aebfcda033ed7c241e2)

regen v9_11

regen v9_11

[v9_11] add support for native pkcs11 on keyper 4547. [port] Add support for --enable-native-pkcs11 on the AEP Keyper HSM. [RT #42463]

4515. [port] FreeBSD: Find readline headers when they are in edit/readline/ instead of readline/. [RT #43658]

4514. [port] NetBSD: strip -WL, from ld command line. [RT #43204] (cherry picked from commit 69e77384fabeced4d38f894ce022c15285e9f60b)

4513. [cleanup] Minimum Python versions are now 2.7 and 3.2. [RT #43566] (cherry picked from commit 472e99cfa69b16d39a02516925b540f6b51de8d4)

[v9_11] make uninstall 4503. [cleanup] "make uninstall" now removes file installed by BIND. (This currently excludes Python files due to lack of support in setup.py.) [RT #42912] (cherry picked from commit 6087f87afb4d8fce0102c52ad2acf415d8d4c0f3)

[v9_11] use arc4random_stir() when available 4499. [port] MacOSX: silence deprecated function warning by using arc4random_stir() when available instead of arc4random_addrandom(). [RT #43503] (cherry picked from commit 3fb62a5a4e57c00e4d818f09b9beabeb587a4b52)

check for LIBRESSL_VERSION_NUMBER (cherry picked from commit f53fc4540a00aac6cedb040d81d74b7faafdbe79)

[v9_11] simplify prereq checks by using feature-test.c 4498. [test] Simplify prerequisite checks in system tests. [RT #43516] (cherry picked from commit 5480a74b70651d49dd79bb762a65203512ec2725)

4497. [port] Add support for OpenSSL 1.1.0. [RT #41284] (cherry picked from commit 1fce0951ed172fc3834a3a379c4e00b78224cc5d)

4494. [bug] Look for <editline/readline.h>. [RT #43429] (cherry picked from commit 6fbb2b51d8614d154c870734f3ffc1b5aa3f3896)

4492. [bug] irs_resconf_load failed to initialise sortlistnxt causing bad writes if resolv.conf contained a sortlist directive. [RT #43459] (cherry picked from commit 55b78fff62967fa693d67ecf28d48229643f91e5)

4488. [port] Darwin: use -framework for Kerberos. [RT #43418] (cherry picked from commit 8d6fefac31e77b8cb9197b49ad55b0e22efb4b78)

4487. [test] Make system tests work on Windows. [RT #42931]

further readline changes [RT #43139] (cherry picked from commit 09f914d2d4b693cb597d252b70e79c5e553c2e8a)

don't clobber readline (cherry picked from commit ccf0bea98ab2fc3c3bd67f8785ff40d4639c66d0)

4484. [bug] Failure to find readline when requested should be fatal to configure. [RT #43328] (cherry picked from commit 6caac8d9a9746ad6cdd9d2cb667244195598d849)

[v9_11] add cfg_parse_buffer3() function with linenum parameter 4482. [cleanup] Change #4455 was incomplete. [RT #43252] (cherry picked from commit 676ac3cc8234dafcbab053554c657113e811e562)

4460. [test] Add system test for dnstap using unix domain sockets. [RT #42926] (cherry picked from commit 3e1fa8411be8baa134083d6893e93406adc038ea)

[v9_11] regen configure (cannot wait for cron) (cherry picked from commit 228a095c29f64bc5e8fc4e68a445ae5385827e2d)

4450. [port] Provide more nuanced HSM support which better matches the specific PKCS11 providers capabilities. [RT #42458] (cherry picked from commit 8ee6f289d87851a5b898b24a64587f0e6bc225bc)

4440. [func] Enable TCP fast open support when available on the server side. [RT #42866] (cherry picked from commit a977bc4c8ebc9dfc61f3f7435cb473216d0ec0dc)

regen

remove spurious breaks (cherry picked from commit e95391abd4f51582ebd69d7482b5c715946033a1)

4425. [bug] arpaname and dnstap-read were not being installed into ${prefix}/bin. Tidy up installation issues with CHANGE 4421. [RT #42910] (cherry picked from commit 711aff9fa75c1f2a1ba03e72ec5068b058ed437c)

[v9_11] store "addzone" zone config in a NZD database 4421. [func] When built with LMDB (Lightning Memory-mapped Database), named will now use a database to store the configuration for zones added by "rndc addzone" instead of using a flat NZF file. This improves performance of "rndc delzone" and "rndc modzone" significantly. Existing NZF files will automatically by converted to NZD databases. To view the contents of an NZD or to roll back to NZF format, use "named-nzd2nzf". To disable this feature, use "configure --without-lmdb". [RT #39837]

Use GCC builtin for clz in RPZ lookup code (#42818) (cherry picked from commit 27038b159b50e69ea216a513edbd6ee68cdf89aa)

4404. [misc] Allow krb5-config to be used when configuring gssapi. [RT #42580] (cherry picked from commit c8fb7e488a807127ad7ee223d8bf6a3a9f27a0ac)

4402. [bug] protoc-c is now a hard requirement for --enable-dnstap. (cherry picked from commit d75bbd0d983b2ef58a5a6c07da3c2dace00fa70d)

4395 [bug] Improve out-of-tree installation of python modules. [RT #42586]

4394. [func] Add rndc command "dnstap-reopen" to close and reopen dnstap output filed. [RT #41803]

[master] prevent spurious warning when configuring native-pkcs11

4364. [port] freebsd: add -Wl,-E to loader flags [RT #41690]

[master] nanosecond-accurate file modification times 4361. [cleanup] Where supported, file modification times returned by isc_file_getmodtime() are now accurate to the nanosecond. [RT #41968]

4358. [test] Added American Fuzzy Lop harness that allows feeding fuzzed packets into BIND. [RT #41723]

[master] more python2/3 compatibility fixes; use setup.py to install

[master] dnssec-keymgr 4349. [contrib] kasp2policy: A python script to create a DNSSEC policy file from an OpenDNSSEC KASP XML file. 4348. [func] dnssec-keymgr: A new python-based DNSSEC key management utility, which reads a policy definition file and can create or update DNSSEC keys as needed to ensure that a zone's keys match policy, roll over correctly on schedule, etc. Thanks to Sebastian Castro for assistance in development. [RT #39211]

[master] fix build error due to incorrect readline probing

[master] fix AES configuration for cross-compiling

[master] adaptive RW locks 3440. [performance] Implement adaptive read-write locks, reducing the overhead of locks that are only held briefly. [RT #37329]

don't run 'make clean' if --no-create is specified

Code cleanups (#41656)

s/use_zlib/with_zlib/ to be consistent

with-zlib should be auto but forced on by default for developers

Use __built_expect() where available (#41411)

[master] add uname data to named -V 4308. [func] Added operating system details to "named -V" output. [RT #41452]

bracket mismatch; window openssl version check

4270. [security] Update allowed OpenSSL versions as named is potentially vulnerable to CVE-2015-3193.

[master] mention --enable-full-report in config summary output

[master] fix python script versions 4257. [cleanup] Python scripts reported incorrect version. [RT #41080]

[master] isc_atomic_storeq()/stats improvements 4248. [func] Add an isc_atomic_storeq() function, use it in stats counters to improve performance. [RT #39972] [RT #39979]

[master] fix statschannel with no libjson 4246. [test] Ensure the statschannel system test runs when BIND is not built with libjson. [RT #40944]

use /usr/local/share/xsl/docbook-ns on freebsd

[master] upgrade doc toolchain 4237. [doc] Upgraded documentation toolchain to use DocBook 5 and dblatex. [RT #40766]

[master] dnstap 4235. [func] Added support in named for "dnstap", a fast method of capturing and logging DNS traffic, and a new command "dnstap-read" to read a dnstap log file. Use "configure --enable-dnstap" to enable this feature (note that this requires libprotobuf-c and libfstrm). See the ARM for configuration details. Thanks to Robert Edmonds of Farsight Security. [RT #40211]

4234. [func] Add deflate compression in statistics channel HTTP server. [RT #40861]

address linking issues

4225. [port] freebsd/openbsd: Use '${CC} -shared' for building shared libraries. [RT #39557]

[master] merge dyndb 4224. [func] Added support for "dyndb", a new interface for loading zone data from an external database, developed by Red Hat for the FreeIPA project. DynDB drivers fully implement the BIND database API, and are capable of significantly better performance and functionality than DLZ drivers, while taking advantage of advanced database features not available in BIND such as multi-master replication. Thanks to Adam Tkac and Petr Spacek of Red Hat. [RT #35271]

[master] add debian/ubuntu path for docbook-xsl to configure

check for libxml2

[master] better reporting of xml/json unavailability - error if "configure --with-libxml2" but the library isn't available - log a warning on startup if only JSON or only XML can be served

4152. [func] Implement DNS COOKIE option. This replaces the experimental SIT option of BIND 9.10. The following named.conf directives are avaliable: send-cookie, cookie-secret, cookie-algorithm and nocookie-udp-size. The following dig options are available: +[no]cookie[=value] and +[no]badcookie. [RT #39928]

Fix a bug printing zone names with '/' character in XML and JSON stats (#39873)

4133. [port] Update how various json libraries are handled. [RT #39646]

all of NEED*PRINT are needed if %z is not supported

add print.o/print.c forn ISC_PLATFORM_NEEDPRINTF abd ISC_PLATFORM_NEEDFPRINTF

[master] add %z format options to printf 4123. [port] Added %z (size_t) format options to the portable internal printf/sprintf implementation. [RT #39586]

[master] improve readline support 4106. [port] Improve readline support. [RT #38938]

fixed test == bugs for PYTHON

4099. [port] clang: make unknown commandline options hard errors when determining what options are supported. [RT #39273]

4095. [bug] ISC_PLATFORM_HAVEXADDQ could be inconsistently set. [RT #38828]

Update win32 configure for --enable-querytrace (#37520) Also enable querytrace when --enable-developer is specified.

[master] include dso.h when testing DSO_METHOD_dlfcn

Add a --enable-querytrace configure switch for very verbose query tracelogging (#37520)

[master] add TCP pipelining support 4040. [func] Added server-side support for pipelined TCP queries. TCP connections are no longer closed after the first query received from a client. (The new "keep-response-order" option allows clients to be specified for which the old behavior will still be used.) [RT #37821]

[master] clean up gcc -Wshadow warnings 4039. [cleanup] Cleaned up warnings from gcc -Wshadow. [RT #37381]

[master] clean up release note stylesheets

4025. [port] bsdi: failed to build. [RT #38047]

Hardened OpenSSL digest/HMAC calls [RT #37944]

[master] allow arbitrary-size rndc output 4005. [func] The buffer used for returning text from rndc commands is now dynamically resizable, allowing arbitrarily large amounts of text to be sent back to the client. (Prior to this change, it was possible for the output of "rndc tsig-list" to be truncated.) [RT #37731]

[master] [rt37398] version string in ARM page footers 3986. [doc] Add the BIND version number to page footers in the ARM. [RT #37398]

[master] include relnotes in doc 3982. [doc] Include release notes in product documentation. [RT #37272]

added hooks for gperftools CPU profiler [#37339]

[master] update contact info in README and confiure --help

3949. [experimental] Experimental support for draft-andrews-edns1 by sending EDNS(1) queries (define DRAFT_ANDREWS_EDNS1 when building). Add support for limiting the EDNS version advertised to servers: server { edns-version 0; }; Log the EDNS version received in the query log. [RT #35864]

[master] [rt36786] use INSTALL_PROGRAM for shared libs 3947. [cleanup] Set the executable bit on libraries when using libtool. [RT #36786]

[master] improve python probing 3946. [cleanup] Improved "configure" search for a python interpreter. [RT #36992]

[master] [rt37057] server-id tests 3944. [test] Added a regression test for "server-id". [RT #37057]

[master] correct libgeoip check in configure

3923. [bug] Sanity check the xml2-config output. [RT #22246]

[rt36039] 3902. bug] liblwres wasn't handling link-local addresses in nameserver clauses in resolv.conf. [RT #36039]

allow -Werror to be enabled; turn on -Werror by default with --enable-developer (cherry picked from commit 2be0f12aafda4bccd2ffd9cf3dc6fe11b9b20832)

3889. [port] hurd: configure fixes as per: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=746540

[master] suppress unnecessary db lookups in DLZ redirect zones 3876. [bug] Improve efficiency of DLZ redirect zones by suppressing unnecessary database lookups. [RT #35835]

[master] --enable-seccomp wasn't defaulting to no

[35942] Update random number generator to ChaCha based (and add tests) Squashed commit of the following: commit 219a904fea95c74016229b6f4436d4f09de1bfd0 Author: Evan Hunt <each@isc.org> Date: Mon Jun 2 12:20:54 2014 -0700 [rt35942] style commit 90bc77185e9798af4595989abb8698efef8c70d7 Author: Mukund Sivaraman <muks@isc.org> Date: Mon Jun 2 18:01:30 2014 +0530 Return p-value=0 when prerequisite (monobit) fails commit 5594669728f1181a447616f60b835e4a043d1b21 Author: Mukund Sivaraman <muks@isc.org> Date: Mon Jun 2 17:44:25 2014 +0530 Print proportion of test sequences passing too commit 9e94b67a4114651224a8285f7c4a7fb03907f376 Author: Mukund Sivaraman <muks@isc.org> Date: Mon Jun 2 17:34:03 2014 +0530 Check uniform distribution of p-values commit acf911b32dd84ac1c30c57d8937cfeb6b3ff972f Author: Mukund Sivaraman <muks@isc.org> Date: Mon Jun 2 17:17:39 2014 +0530 Check proportion of sequences passing a test commit 7289eb441fc4ec623364ad882e22b240ba8da308 Author: Mukund Sivaraman <muks@isc.org> Date: Mon Jun 2 04:33:37 2014 +0530 Refactor common setup code into random_test() No behavioral change is made. commit 51feef3e08c233d34a6b8b9d25a72d43110b4eed Author: Mukund Sivaraman <muks@isc.org> Date: Sun Jun 1 17:31:57 2014 +0530 Fix binary rank computation commit 0ea3c03dea353f309d13c38e26aa0abbffdcff2b Author: Mukund Sivaraman <muks@isc.org> Date: Tue May 27 06:01:10 2014 +0530 Add binary matrix rank RNG test commit eb4e7c53540ac97436d94714d30084907eeff01a Author: Mukund Sivaraman <muks@isc.org> Date: Mon May 26 15:45:31 2014 +0530 Add function to find rank of a binary matrix commit 1292a06e0e09ebd37d4ecf5337814951dcacc4a4 Author: Evan Hunt <each@isc.org> Date: Thu May 29 16:21:51 2014 -0700 [rt35942] style; check whether we need libm for exp() commit c19788e5a89235e937a5aedf2ebea50f33406609 Author: Evan Hunt <each@isc.org> Date: Thu May 29 15:31:19 2014 -0700 [rt35942] incidental spelling error fixed commit c833326ad0df21e2a8b35958e85ccc0a692e38be Author: Mukund Sivaraman <muks@isc.org> Date: Thu May 29 11:34:37 2014 +0530 Revert "Add function to find rank of a binary matrix" This reverts commit 21b2f230e17f7fc638f81d9a34bcb148b0c4a6fb. This test will be added in RT#36125. commit cf786a533d34fdcd9e1c5650356e56d33e93a29f Author: Mukund Sivaraman <muks@isc.org> Date: Thu May 29 11:33:18 2014 +0530 Revert "Add binary matrix rank RNG test" This reverts commit dd843b9ca84fa9af80ec39631152f82778f0b97c. This test will be added in RT#36125. commit dd843b9ca84fa9af80ec39631152f82778f0b97c Author: Mukund Sivaraman <muks@isc.org> Date: Tue May 27 06:01:10 2014 +0530 Add binary matrix rank RNG test commit 21b2f230e17f7fc638f81d9a34bcb148b0c4a6fb Author: Mukund Sivaraman <muks@isc.org> Date: Mon May 26 15:45:31 2014 +0530 Add function to find rank of a binary matrix commit 313c30088d6ba933bde3abb920f2a6d16b9b77e1 Author: Mukund Sivaraman <muks@isc.org> Date: Mon May 26 13:38:44 2014 +0530 Add block frequency random test commit 0d279c60ed3eabe52cf3e1435bf14ec62752536f Author: Mukund Sivaraman <muks@isc.org> Date: Mon May 26 13:04:03 2014 +0530 Add preconditions from NIST spec commit 7a6c5f2ce5078814d5cf0fea30596e58171174c1 Author: Mukund Sivaraman <muks@isc.org> Date: Mon May 26 12:51:03 2014 +0530 Add functions to use in RNG tests commit 8c5cb5594f904f6669cdffaa364f799b4a2c6b58 Author: Mukund Sivaraman <muks@isc.org> Date: Thu May 22 00:26:10 2014 +0530 Add runs RNG test commit 4882f078cc2596c0911066ffb783e4dd145a63ec Author: Mukund Sivaraman <muks@isc.org> Date: Wed May 21 23:58:20 2014 +0530 Pre-compute bitcounts LUT commit 896db3809fba2d9884a4a3a2fa847a73e007ad7f Author: Mukund Sivaraman <muks@isc.org> Date: Wed May 21 23:30:23 2014 +0530 Fix the bit value being checked (this shouldn't affect the test) commit b932cbb5dae39eb819db29cf9490fb51d59b7c56 Author: Mukund Sivaraman <muks@isc.org> Date: Wed May 21 19:35:12 2014 +0530 Add monobits RNG test commit 7bef19fd8b095aa567a975ef5c97d5812162d92e Author: Mukund Sivaraman <muks@isc.org> Date: Wed May 21 16:53:02 2014 +0530 Add API documentation commit 54483f7feb64b5646dd1da45b1fd396e7d04b926 Author: Mukund Sivaraman <muks@isc.org> Date: Wed May 21 16:39:03 2014 +0530 Rename isc_rngctx_t to isc_rng_t commit 7c5031b53555137a82c6b6218cd4dd5e95acf94d Author: Evan Hunt <each@isc.org> Date: Tue May 20 23:29:53 2014 -0700 [rt35942] use attach/detach with isc_rngctx_t commit 8aabae5e09888e6af651ed27bd6b4e9f76334d55 Author: Mukund Sivaraman <muks@isc.org> Date: Tue May 20 18:32:42 2014 +0530 Move RNG from dispatch.c to libisc commit e6d4ad4f389998b91d46e95e258cf420cb21d977 Author: Mukund Sivaraman <muks@isc.org> Date: Mon May 12 19:16:27 2014 +0530 Replace old arc4random with new ChaCha implementation from OpenBSD

3858. [bug] Disable GCC 4.9 "delete null pointer check". [RT #35968]

3856. [bug] Configuring libjson without also configuring libxml resulting in a REQUIRE assertion when retrieving statistics using json. [RT #36009]

[master] report unrecognized configure options 3854. [cleanup] Report unrecognized options, if any, in the final configure summary. [RT #36014]

[master] enable libseccomp system call filtering 3851. [func] Allow libseccomp based system-call filtering on Linux; use "configure --enable-seccomp" to turn it on. Thanks to Loganaden Velvindron for the contribution. [RT #35347]

3847. [bug] 'configure --with-dlz-postgres' failed to fail when there is not support available.

9.11

[master] check for arc4random_addrandom() 3840. [port] Check for arc4random_addrandom() before using it; it's been removed from OpenBSD 5.5. [RT #35907]

[master] globally rename "delve" to "delv" 3817. [func] The "delve" command is now spelled "delv" to avoid a namespace collision with the Xapian project. [RT #35801]

[master] customize configure --help

only look for gsskrb5_register_acceptor_identity if gssapi_krb5.h exists

use discovered gssapi include path when linking

[master] fix gssapi probing on freebsd 3801. [port] Fix probing for gssapi support on FreeBSD. [RT #35615]

[RT#35643] fixed -lrt in LIBS

3797. [port] netbsd: geoip support probing was broken. [RT #35642]

[master] better error output when initializing pkcs11 3786. [func] Provide more detailed error codes when using native PKCS#11. "pkcs11-tokens" now fails robustly rather than asserting when run against an HSM with an incomplete PCKS#11 API implementation. [RT #35479]

[master] forbid --with-openssl and --enable-native-pkcs11 together

[master] use adaptive locks when available 3781. [tuning] Use adaptive mutex locks when available; this has been found to improve performance under load on many systems. "configure --with-locktype=standard" restores conventional mutex locks. [RT #32576]

[master] merge several interdependent fixes 3760. [bug] Improve SIT with native PKCS#11 and on Windows. [RT #35433] 3759. [port] Enable delve on Windows. [RT #35441] 3758. [port] Enable export library APIs on windows. [RT #35382]

remove ENABLE_SIT

don't set want_openssl_aes unless CRYPTO = -DOPENSSL

--with-openssl=no failed

set ISC_OPENSSL_LIBS to DST_OPENSSL_LIBS for want_openssl_aes=yes

[master] add "--with-tuning=large" option 3745. [func] "configure --with-tuning=large" adjusts various compiled-in constants and default settings to values suited to large servers with abundant memory. [RT #29538]

test for AES_encrypt and fall back to sha256

3744. [experimental] SIT: send and process Source Identity Tokens (which are similar to DNS Cookies by Donald Eastlake) and are designed to help clients detect off path spoofed responses and for servers to detect legitimate clients. SIT use a experimental EDNS option code (65001). SIT can be enabled via --enable-developer or --enable-sit. It is on by default in Windows. RRL processing as been updated to know about SIT with legitimate clients not being rate limited. [RT #35389]

[master] delve 3741. [func] "delve" (domain entity lookup and validation engine): A new tool with dig-like semantics for performing DNS lookups, with internal DNSSEC validation, using the same resolver and validator logic as named. This allows easy validation of DNSSEC data in environments with untrustworthy resolvers, and assists with troubleshooting of DNSSEC problems. (Note: not yet available on win32.) [RT #32406]

[master] fixed some dlz configure options 3740. [contrib] Minor fixes to configure --with-dlz-bdb, --with-dlz-postgres and --with-dlz-odbc. [RT #35340]

regen

[master] merge libiscpk11 to libisc 3735. [cleanup] Merged the libiscpk11 library into libisc to simplify dependencies. [RT #35205]

define and use BACKTRACECFLAGS

hpux: move -Wl,+vnocompatwarnings to STD_CWARNINGS; add +vnocompatwarnings to SO_LDFLAGS

-Wl,+vnocompatwarnings is a compiler flag to pass to the loader not a direct loader flag

3734. [bug] Improve building with libtool. [RT #35314]

Add Linux support to: 3733. [func] Improve interface scanning support. Interface information will be automatically updated if the OS supports routing sockets (MacOS, *BSD, Linux). Use "automatic-interface-scan no;" to disable. Add "rndc scan" to trigger a scan. [RT #23027]

3733. [func] Improve interface scanning support. Interface information will be automatically updated if the OS supports routing sockets. Use "automatic-interface-scan no;" to disable. Add "rndc scan" to trigger a scan. [RT #23027]

[master] update contrib 3725. [contrib] Updated zkt and nslint to newest versions, cleaned up and rearranged the contrib directory, added a README.

[master] fixed geoip in blackhole ACLs 3722. [bug] Using geoip ACLs in a blackhole statement could cause a segfault. [RT #35272]

[master] correct copyrights and attributions see RT #35423 for details; highlights: - remove license clauses 3 and 4 from NetBSD code - remove advertising clause from historical BSD code - add openssl advertising attributions

[master] testcrypto.sh in system tests 3714. [test] System tests that need to test for cryptography support before running can now use a common "testcrypto.sh" script to do so. [RT #35213]

[master] missing 'test'

[master] address several issues with native pkcs11

[master] native PKCS#11 support 3705. [func] "configure --enable-native-pkcs11" enables BIND to use the PKCS#11 API for all cryptographic functions, so that it can drive a hardware service module directly without the need to use a modified OpenSSL as intermediary (so long as the HSM's vendor provides a complete-enough implementation of the PKCS#11 interface). This has been tested successfully with the Thales nShield HSM and with SoftHSMv2 from the OpenDNSSEC project. [RT #29031]

[master] add isc_string_strcasestr for portability

remove unnecessary echo

reword/reorder configuration summary

3675. [misc] Provide a place for third parties to add version information for their extensions in the version file by setting the EXTENSIONS variable.

3669. [port] freebsd: --with-gssapi needs -lhx509. [RT #35001]

remove debugging sets

3661. [bug] Address lock order reversal deadlock with inline zones. [RT #34856]

3658. [port] linux: Address platform specific compilation issue when libcap-devel is installed. [RT #34838]

only generate DSA/ECDSA signatures in named if we have a source of randomness and only on specific platforms

[master] update to atf 0.17 3648. [test] Updated the ATF test framework to version 0.17. [RT #25627]

3634. [func] Report build-id in rndc status. Report build-id when building from a git repository. [RT #20422]

3624. [bug] Look for 'json_object_new_int64' when looking for a the json library. [RT #34449]

corrected a typo in the configure summary [RT #34448]

[master] fix libjson test, add summary details

[master] add configure summary 3615. [cleanup] "configure" now finishes by printing a summary of optional BIND features and whether they are active or inactive. ("configure --enable-full-report" increases the verbosity of the summary.) [RT #31777]

[master] portability fix 3614. [port] Check for <linux/types.h>. [RT #34162]

[master] check for -ljson-c as well as -ljson 3512. [port] Check whether to use -ljson or -ljson-c. [RT #34115]

[master] added isc_safe_memcmp() 3611. [bug] Improved resistance to a theoretical authentication attack based on differential timing. [RT #33939]

[rt18155] regen configure

[master] enable threads by default 3572. [func] Threads are now enabled by default on most operating systems. [RT #25483]

[master] add product description 3568. [cleanup] Add a product description line to the version file, to be reported by named -v/-V. [RT #33366]

[master] unify internal and export libraries 3550. [func] Unified the internal and export versions of the BIND libraries, allowing external clients to use the same libraries as BIND. [RT #33131]

[master] add dnssec-coverage tool 3528. [func] New "dnssec-coverage" command scans the timing metadata for a set of DNSSEC keys and reports if a lapse in signing coverage has been scheduled inadvertently. (Note: This tool depends on python; it will not be built or installed on systems that do not have a python interpreter.) [RT #28098]

[master] make dst test work outside srcdir 3526. [cleanup] Set up dependencies for unit tests correctly during build. [RT #32803]

remove spurious HERE

[master] add JSON statistics channel 3524. [func] Added an alternate statistics channel in JSON format, when the server is built with the json-c library: http://[address]:[port]/json. [RT #32630]

[master] need to quote PRODUCT

3509. [cleanup] Added a product line to version file to allow for easy naming of different products (BIND vs BIND ESV, for example). [RT #32755]

fix configure.in to remove warnings when running autoconf only compile geoip.o when requested. silence compiler warnings

[master] add geoip support 3504. [func] Add support for ACLs based on geographic location, using MaxMind GeoIP databases. Based on code contributed by Ken Brownfield <kb@slide.com>. [RT #30681]

[master] RPZ speedup (phase 2, multiple RPZ's) 3495. [func] Support multiple response-policy zones, while improving RPZ performance. [RT #32476]

3489. [bug] --enable-developer now turns on ISC_LIST_CHECKINIT. dns_dlzcreate() failed to properly initialize dlzdb.link. When cloning a rdataset do not copy the link contents. [RT #32651] Squashed commit of the following: commit c36c49cbdaeec8b2506dffadbffa543283702fa2 Author: Mark Andrews <marka@isc.org> Date: Mon Feb 18 23:24:57 2013 +1100 don't copy the link when cloning a rdataset commit 9fef5827edcc925075832dcce900eeca9057456d Author: Mark Andrews <marka@isc.org> Date: Mon Feb 18 23:23:25 2013 +1100 initialise the dlzdb link; don't return a stale pointer on error commit a13c584732eae2dde48920a73886b54f1fe6b030 Author: Mark Andrews <marka@isc.org> Date: Mon Feb 18 23:21:59 2013 +1100 turn on ISC_LIST_CHECKINIT

3485. [cleanup] Only compile openssl_gostlink.c if we support GOST.

regenerate

regenerate

be consistent with in how readline is condigured

3460. [bug] Only link against readline where needed. [RT #29810]

3447. [port] Add support for libxml2-2.9.x [RT #32231]

3435. [bug] Cross compilation support in configure was broken. [RT #32078]

[master] multiple-dlz/dlz-nxdomain 3432. [func] Multiple DLZ databases can now be configured. DLZ databases are searched in the order configured, unless set to "search no", in which case a zone can be configured to be retrieved from a particular DLZ database by using a "dlz <name>" option in the zone statement. DLZ databases can support type "master" and "redirect" zones. [RT #27597]

regen

[v9_9] work around libtool issue - revert d3617e0d87428168e326830311dc074f0e31b77e - use -Xcompiler option to libtool so it won't suppress -shared - regenerate configure Conflicts: bin/tests/system/dlzexternal/Makefile.in

update libtool support to version 2.4.2

3420. [bug] Address VPATH compilation issues. [RT #31879]

regenerate

regen

regen configure

3357. [port] Add support for libxml2-2.8.x [RT #30440]

regen configure

regen

3344. [func] New "dnssec-checkds" command checks a zone to determine which DS records should be published in the parent zone, or which DLV records should be published in a DLV zone, and queries the DNS to ensure that it exists. (Note: This tool depends on python; it will not be built or installed on systems that do not have a python interpreter.) [RT #28099]

regenerate

test for argparse in configure

Moved from contrib, set up configure - moved checkds.py from contrib to bin/python/dnssec-checkds.py - moved tests from contrib to bin/tests/system/checkds - set up configure to find the python path

regen

Merge rt28412b - check for mmap() in configure - implement isc_file_mmap() and isc_file_munmap() to do malloc()/read() and free() when run on systems that do not support mmap().

merging fast format zone files Conflicts: .gitignore bin/named/zoneconf.c bin/tests/.gitignore bin/tests/system/autosign/tests.sh bin/tests/system/masterformat/clean.sh bin/tests/system/masterformat/ns1/compile.sh bin/tests/system/masterformat/tests.sh configure lib/dns/db.c lib/dns/include/dns/db.h lib/dns/include/dns/types.h lib/dns/master.c lib/dns/masterdump.c lib/dns/rbt.c lib/dns/rbtdb.c lib/dns/sdb.c lib/dns/sdlz.c lib/dns/tests/.cvsignore lib/dns/tests/Makefile.in lib/dns/win32/libdns.def lib/dns/xfrin.c lib/dns/zone.c lib/export/dns/Makefile.in lib/isc/include/isc/file.h lib/isc/unix/file.c lib/isc/win32/file.c lib/isccfg/namedconf.c

regen

regen for bin/tests/system/ecdsa/prereq.sh

regen for bin/tests/system/ecdsa/prereq.sh

merged filter-aaaa-on-v6 (ATT SoW) 3327. [func] Added 'filter-aaaa-on-v6' option; this is similar to 'filter-aaaa-on-v4' but applies to IPv6 connections. (Use "configure --enable-filter-aaaa" to enable this option.) [RT #27308]

3317. [func] Add ECDSA support (RFC 6605). [RT #21918]

regenerate

test for argparse in configure

Moved from contrib, set up configure - moved checkds.py from contrib to bin/python/dnssec-checkds.py - moved tests from contrib to bin/tests/system/checkds - set up configure to find the python path

regen

regen

regen

-l

regen

regen

3179. [port] kfreebsd: build issues. [RT #26273]

3171. [port] darwin 10.* and freebsd [89] are now built threaded by default.

regen

regenerate

regen

3131. [func] Improve scalability by allocating one zone task per 100 zones at startup time, rather than using a fixed-size task table. [RT #24406]

regen

regen

missling \

fixes for default --with-gssapi

fix up configure for RT #23836

Generating configure for fix to RT #23836.

regen

regen

regen

regen

regen

regen

regen

regen

add tests for isc_atomic_xadd() and isc_atomic_xaddq() since there is some suspicion that they may not be working properly on all platforms. This is committed direclty to the mainline as it's only a test. I did not regenerate configure from configure.in, but just added the one Makefile line. Evan will take a quick look at this after it's committed.

rege

regen

regen

2989. [func] Added support for writable DLZ zones. (Contributed by Andrew Tridgell of the Samba project.) [RT #22629] 2988. [experimental] Added a "dlopen" DLZ driver, allowing the creation of external DLZ drivers that can be loaded as shared objects at runtime rather than linked with named. Currently this is switched on via a compile-time option, "configure --with-dlz-dlopen". Note: the syntax for configuring DLZ zones is likely to be refined in future releases. (Contributed by Andrew Tridgell of the Samba project.) [RT #22629] 2987. [func] Improve ease of configuring TKEY/GSS updates by adding a "tkey-gssapi-keytab" option. If set, updates will be allowed with any key matching a principal in the specified keytab file. "tkey-gssapi-credential" is no longer required and is expected to be deprecated. (Contributed by Andrew Tridgell of the Samba project.) [RT #22629]

2978. [port] hpux: look for <devpoll.h> [RT #21919]

2965. [func] Test HMAC functions using test data from RFC 2104 and RFC 4634. [RT #21702]

2956. [port] Enable atomic operations on the PowerPC64. [RT #21899]

2941. [bug] sdb and sdlz (dlz's zone database) failed to support DNAME at the zone apex. [RT #21610]

2920. [func] Allow 'filter-aaaa-on-v4' to be applied selectively to IPv4 clients. New acl 'filter-aaaa' (default any).

2917. [func] Virtual time test framework. [RT #20801]

2915. [cleanup] Be smarter about which objects we attempt to compile based on configure options. [RT #21444]

add -lkrb5

add kerberosv5/krb5.h to search list

2910. [func] Sanity check Kerberos credentials. [RT #20986]

2905. [port] aix: set use_atomic=yes with native compiler. [RT #21402]

2901. [port] Use AC_C_FLEXIBLE_ARRAY_MEMBER. [RT #21316]

2885. [bug] Improve -fno-strict-aliasing support probing in configure. [RT #21080]

regen

regen

regen

regen

regen

regen

regen

ISC_PLATFORM_NORETURN_POST not ISC_PLATFORM_NORETURN

20257 configure