[rt43670] more emphatic warning

4889. [func] Warn about the use of old root keys without the new root key being present. Warn about dlv.isc.org's key being present. Warn about both managed and trusted root keys being present. [RT #43670] (cherry picked from commit baef0ca9886bb67d7c6a2ae0405e504ccdc0fb9f)

4885. [security] update-policy rules that otherwise ignore the name field now require that it be set to "." to ensure that any type list present is properly interpreted. [RT #47126] (cherry picked from commit ec771bbdc80223ab94eda2173f3b20fd3ecfad49)

update copyright notice / whitespace

[v9_11] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957] (cherry picked from commit 129c4414cb6cff8042f1985fe5833aaae6043142) (cherry picked from commit f662d5484e0cf4cd83da300620b3701fee5a2ca1)

4817. [cleanup] Use DNS_NAME_INITABSOLUTE and DNS_NAME_INITNONABSOLUTE. [RT #45433] (cherry picked from commit 3d905e053369cff1412b9d20aa5bb23376e0fed4)

[v9_11] de-DLV 4749. [func] The ISC DLV service has been shut down, and all DLV records have been removed from dlv.isc.org. - Removed references to ISC DLV in documentation - Removed DLV key from bind.keys - No longer use ISC DLV by default in delv [RT #46155]

4695. [bug] cookie-secrets were not being properly checked by named-checkconf. [RT #45886] (cherry picked from commit 2e743d9bdc61132183b9965e37fbe8418e3beb8a)

4654. [cleanup] Don't use C++ keywords delete, new and namespace. [RT #45538] (cherry picked from commit 4bf32aa58774452b05433716f8fa298257dd7fda)

4636. [bug] Normalize rpz policy zone names when checking for existence. [RT #45358] (cherry picked from commit e85e95c19e5655952f3c4208043760445da93e54)

4530. [bug] "dyndb" is dependent on dlopen existing / being enabled. [RT #45291] (cherry picked from commit aa3a8979bc7eb1596d044eff572b3c35310584fa)

update copyright notice / whitespace

Set a LMDB mapsize and also provide a config option to control it (#44954) (cherry picked from commit 241b49e6119eb37eebe2de98f0e8bde436074cb3)

4539. [bug] Referencing a nonexistant zone with rpz could lead to a assertion failure when configuring. [RT #43787] (cherry picked from commit 762c4fc5a8cc0433a6139aecb9e91624af51e3b1)

update copyright notice / whitespace

4504. [security] Allow the maximum number of records in a zone to be specified. This provides a control for issues raised in CVE-2016-6170. [RT #42143] (cherry picked from commit 5f8412a4cb5ee14a0e8cddd4107854b40ee3291e)

4450. [port] Provide more nuanced HSM support which better matches the specific PKCS11 providers capabilities. [RT #42458] (cherry picked from commit 8ee6f289d87851a5b898b24a64587f0e6bc225bc)

4447. [tuning] Allow the fstrm_iothr_init() options to be set using named.conf to control how dnstap manages the data flow. [RT #42974] (cherry picked from commit 934837913ff197b1a10ad027705d4497fae21e59)

4431. [bug] named-checkconf now checks the rate-limit clause. [RT #42970]

4401. [misc] Change LICENSE to MPL 2.0.

update copyright notice / whitespace

4359. [bug] Inherited 'also-notify' lists were not being checked by named-checkconf. [RT #42174]

update copyrights

4329. [func] Warn about a common misconfiguration when forwarding RFC 1918 zones. [RT #41441]

update copyright notice / whitespace

4172. [bug] Named / named-checkconf didn't handle a view of CLASS0. [RT #40265]

set error code if aes selected and not implemented

update copyright notice / whitespace

4152. [func] Implement DNS COOKIE option. This replaces the experimental SIT option of BIND 9.10. The following named.conf directives are avaliable: send-cookie, cookie-secret, cookie-algorithm and nocookie-udp-size. The following dig options are available: +[no]cookie[=value] and +[no]badcookie. [RT #39928]

#ifdef protect 'b'

[master] add TCP pipelining support 4040. [func] Added server-side support for pipelined TCP queries. TCP connections are no longer closed after the first query received from a client. (The new "keep-response-order" option allows clients to be specified for which the old behavior will still be used.) [RT #37821]

update copyright notice / whitespace

[master] clean up gcc -Wshadow warnings 4039. [cleanup] Cleaned up warnings from gcc -Wshadow. [RT #37381]

[master] allow 1-week nta-lifetime/nta-recheck 3983. [bug] Change #3940 was incomplete: negative trust anchors could be set to last up to a week, but the "nta-lifetime" and "nta-recheck" options were still limted to one day. [RT #37522]

3958. [bug] Detect when writeable files have multiple references in named.conf. [RT #37172]

update copyright notice

3934. [bug] Catch bad 'sit-secret' in named-checkconf. Improve sit-secrets documentation. [RT #36980]

3911. [func] Implement EDNS EXPIRE option client side. [RT #35925]

3899. [bug] "request-ixfr" is only applicable to slave and redirect zones. [RT #36608]

alphabetize optionstable

[master] silence warning

[master] complete NTA work 3882. [func] By default, negative trust anchors will be tested periodically to see whether data below them can be validated, and if so, they will be allowed to expire early. The "rndc nta -force" option overrides this behvaior. The default NTA lifetime and the recheck frequency can be configured by the "nta-lifetime" and "nta-recheck" options. [RT #36146]

3795. [bug] Make named-checkconf detect raw masterfiles for hint zones and reject them. [RT #35268] Squashed commit of the following: commit 5b0254711d6b77940d6217b9131b9d401df8a866 Author: Mukund Sivaraman <muks@isc.org> Date: Fri Mar 28 02:09:01 2014 +0530 Remove redundant helper function commit a4341c1a2ba830c8cee1def57a533f987f67c3dc Author: Mark Andrews <marka@isc.org> Date: Thu Jan 30 10:08:17 2014 +1100 error out if masterfile-format raw is specified for a hint zone.

[master] check allow-update in view/options 3787. [bug] The code that checks whether "auto-dnssec" is allowed was ignoring "allow-update" ACLs set at the options or view level. [RT #29536]

[master] max-zone-ttl 3746. [func] New "max-zone-ttl" option enforces maximum TTLs for zones. If loading a zone containing a higher TTL, the load fails. DDNS updates with higher TTLs are accepted but the TTL is truncated. (Note: Currently supported for master zones only; inline-signing slaves will be added.) [RT #38405]

3743. [bug] delegation-only flag wasn't working in forward zone declarations despite being documented. This is needed to support turning off forwarding and turning on delegation only at the same name. [RT #35392]

[master] skip unnecesary also-notify data 3713. [bug] Save memory by not storing "also-notify" addresses in zone objects that are configured not to send notify requests. [RT #35195]

update copyright notice

[master] replace memcpy() with memmove(). 3698. [cleanup] Replaced all uses of memcpy() with memmove(). [RT #35120]

[master] warn if key-directory doesn't exist 3694. [bug] Warn when a key-directory is configured for a zone, but does not exist or is not a directory. [RT #35109]

[master] "in-view" zone option 3673. [func] New "in-view" zone option allows direct sharing of zones between views. [RT #32968]

3582. [bug] Silence false positive warning regarding missing file directive for inline slave zones. [RT #33662]

[master] add DSCP support 3535. [func] Add support for setting Differentiated Services Code Point (DSCP) values in named. Most configuration options which take a "port" option (e.g., listen-on, forwarders, also-notify, masters, notify-source, etc) can now also take a "dscp" option specifying a code point for use with outgoing traffic, if supported by the underlying OS. [RT #27596]

update copyright notice

[master] forbid inline-signing slave with no file 3491. [bug] Slave zones using inline-signing must specify a file name. [RT #31946]

3437. [bug] isc_buffer_init -> isc_buffer_constinit to initialise buffers with constant data. [RT #32064] Squashed commit of the following: commit 3433b96bf11f8c90ccbe412f01d02a6d8bbc2d33 Author: Mark Andrews <marka@isc.org> Date: Sat Dec 8 12:41:16 2012 +1100 isc_buffer_init -> isc_buffer_constinit commit c22dbcc1122a0a44f7b46068e0ccbc25353a57d5 Author: Mark Andrews <marka@isc.org> Date: Sat Dec 8 12:38:39 2012 +1100 isc_buffer_init -> isc_buffer_constinit commit 900820416c45c1887d0d22d7a010df60a903bd56 Author: Mark Andrews <marka@isc.org> Date: Sat Dec 8 12:24:19 2012 +1100 remove isc_buffer_reconstinit commit f815711c17b05f9961786a90b9bae902d3c01494 Author: Mark Andrews <marka@isc.org> Date: Wed Dec 5 15:42:57 2012 +1100 add isc_buffer_constinit

[master] multiple-dlz/dlz-nxdomain 3432. [func] Multiple DLZ databases can now be configured. DLZ databases are searched in the order configured, unless set to "search no", in which case a zone can be configured to be retrieved from a particular DLZ database by using a "dlz <name>" option in the zone statement. DLZ databases can support type "master" and "redirect" zones. [RT #27597]

[master] allow dnssec options in inline-signing slaves 3408. [bug] Some DNSSEC-related options (update-check-ksk, dnssec-loadkeys-interval, dnssec-dnskey-kskonly) are now legal in slave zones as long as inline-signing is in use. [RT #31078]

update copyright notice

3387. [func] Support for a DS digest can be disabled at runtime with disable-ds-digests. [RT #21581]

3385. [bug] named-checkconf didn't detect missing master lists in also-notify clauses. [RT #30810]

we didn't catch a zero option at the global level when views are active

allow "forward" and "forwarders" in static-stub 3363. [bug] Need to allow "forward" and "fowarders" options in static-stub zones; this had been overlooked. [RT #30482]

properly range-check fields that do not allow 0 3362. [bug] Setting some option values to 0 in named.conf could trigger an assertion failure on startup. [RT #27730]

address memory leak with bad tsig secret 3359. [bug] An improperly-formed TSIG secret could cause a memory leak. [RT #30607]

remove rundundent call 'result = isc_parse_uint8(&ui, r.base, 10);'

3339. [func] Allow the maximum supported rsa exponent size to be specified: "max-rsa-exponent-size <value>;" [RT #29228]

merged filter-aaaa-on-v6 (ATT SoW) 3327. [func] Added 'filter-aaaa-on-v6' option; this is similar to 'filter-aaaa-on-v4' but applies to IPv6 connections. (Use "configure --enable-filter-aaaa" to enable this option.) [RT #27308]

3312. [bug] named-checkconf didn't detect a bad dns64 clients acl. [RT #27631]

update copyright notice

set $Id$

Revert "Re-created rt27597a for ongoing DLZ work" This reverts commit d731ee9121c3864839c3bdcd3b7ee603ec3999ff.

Re-created rt27597a for ongoing DLZ work

Revert accidental merge of unfinished DLZ work

checkpoint: multiple-DLZ functionality - multiple DLZ's can be specified, including multiple DLZ's using the same driver; e.g., two different back-ends both loaded by the dlopen driver - new "search" option can be specified in a DLZ indicating whether this DLZ database should be searched for unknown zones. The default is "yes". If "no", then the zone can only be found by named if it's registered in the zone table, which happens if the zone is configured for dynamic updates, or if "dlz <dlzname>" is specified in the zone statement. (The latter functionality is incomplete in this commit).

3228. [tuning] Dynamically grow symbol table to improve zone loading performance. [RT #26523]

3209. [func] Add "dnssec-lookaside 'off'". [RT #24858]

remove debugging printf that was left in by mistake

update copyright notice

3181. [func] Inline-signing is now supported for master zones. [RT #26224]

3147. [func] Initial inline signing support. [RT #23657]

3129. [bug] Named could crash on 'rndc reconfig' when allow-new-zones was set to yes and named ACLs were used, [RT #22739]

3111. [bug] Improved consistency checks for dnssec-enable and dnssec-validation, added test cases to the checkconf system test. [RT #24398]

fixed an error in prior commit

3103. [bug] Configuring 'dnssec-validation auto' in a view instead of in the options statement could trigger an assertion failure in named-checkconf. [RT #24382]

3102. [func] New 'dnssec-loadkeys-interval' option configures how often, in minutes, to check the key repository for updates when using automatic key maintenance. Default is every 60 minutes (formerly hard-coded to 12 hours). [RT #23744] 3101. [bug] Zones using automatic key maintenance could fail to check the key repository for updates. [RT #23744]

Forgot to initialize a fixedname, which made it a brokenname.

3069. [cleanup] Silence warnings messages from clang static analysis. [RT #20256]

2039. [func] Redirect on NXDOMAIN support. [RT #23146]

update copyright notice

3004. [func] DNS64 reverse support. [RT #22769]

2947. [func] Add new zone type "static-stub". It's like a stub zone, but the nameserver names and/or their IP addresses are statically configured. [RT #21474] (for 9.8.0)

update copyright notice

2981. [func] Partial DNS64 support (AAAA synthesis). [RT #21991]

2936. [func] Improved configuration syntax and multiple-view support for addzone/delzone feature (see change #2930). Removed "new-zone-file" option, replaced with "allow-new-zones (yes|no)". The new-zone-file for each view is now created automatically, with a filename generated from a hash of the view name. It is no longer necessary to "include" the new-zone-file in named.conf; this happens automatically. Zones that were not added via "rndc addzone" can no longer be removed with "rndc delzone". [RT #19447]

isc_boolean_t -> dns_v4_aaaa_t

update copyright notice

2920. [func] Allow 'filter-aaaa-on-v4' to be applied selectively to IPv4 clients. New acl 'filter-aaaa' (default any).

update copyright notice

2956. [bug] named-checkconf did not fail on a bad trusted key. [RT #20705]

2801. [func] Detect and report records that are different according to DNSSEC but are sematically equal according to plain DNS. Apply plain DNS comparisons rather than DNSSEC comparisons when processing UPDATE requests. dnssec-signzone now removes such semantically duplicate records prior to signing the RRset. named-checkzone -r {ignore|warn|fail} (default warn) named-compilezone -r {ignore|warn|fail} (default warn) named.conf: check-dup-records {ignore|warn|fail};

2799. [cleanup] Changed the "secure-to-insecure" option to "dnssec-secure-to-insecure", and "dnskey-ksk-only" to "dnssec-dnskey-kskonly", for clarity. [RT #20586]

update copyright notice

2712. [func] New 'auto-dnssec' zone option allows zone signing to be fully automated in zones configured for dynamic DNS. 'auto-dnssec allow;' permits a zone to be signed by creating keys for it in the key-directory and using 'rndc sign <zone>'. 'auto-dnssec maintain;' allows that too, plus it also keeps the zone's DNSSEC keys up to date according to their timing metadata. [RT #19943]

2710. [func] New 'dnssec-signzone -x' flag and 'dnskey-ksk-only' zone option cause a zone to be signed with only KSKs signing the DNSKEY RRset, not ZSKs. This reduces the size of a DNSKEY answer. [RT #20340]

2708. [func] Insecure to secure and NSEC3 parameter changes via update are now fully supported and no longer require defines to enable. We now no longer overload the NSEC3PARAM flag field, nor the NSEC OPT bit at the apex. Secure to insecure changes are controlled by by the named.conf option 'secure-to-insecure'. Warning: If you had previously enabled support by adding defines at compile time to BIND 9.6 you should ensure that all changes that are in progress have completed prior to upgrading to BIND 9.7. BIND 9.7 is not backwards compatible.

remove references to the "ddns-autoconf" option, which no longer exists

2660. [func] Add a new set of DNS libraries for non-BIND9 applications. See README.libdns. [RT #19369]

indent

update copyright notice

2630. [func] Improved syntax for DDNS autoconfiguration: use "update-policy local;" to switch on local DDNS in a zone. [RT #19875]

update copyright notice

2609. [func] Simplify the configuration of dynamic zones: - add ddns-confgen command to generate configuration text for named.conf - add zone option "ddns-autoconf yes;", which causes named to generate a TSIG session key and allow updates to the zone using that key - add '-l' (localhost) option to nsupdate, which causes nsupdate to connect to a locally-running named process using the session key generated by named [RT #19284]

2606. [bug] "delegation-only" was not being accepted in delegation-only type zones. [RT #19717]

update copyright notice

2572. [func] Simplify DLV configuration, with a new option "dnssec-lookaside auto;" This is the equivalent of "dnssec-lookaside . trust-anchor dlv.isc.org;" plus setting a trusted-key for dlv.isc.org. Note: The trusted key is hard-coded into named, but is also stored in (and can be overridden by) $sysconfdir/bind.keys. As the ISC DLV key rolls over it can be kept up to date by replacing the bind.keys file with a key downloaded from https://www.isc.org/solutions/dlv. [RT #18685]

silence compiler warnings [RT #17079]

update copyright notice

spelling

1204 -> 1024U

2496. [bug] Add sanity length checks to NSID option. [RT #18813]

2441. [bug] isc_radix_insert() could copy radix tree nodes incompletely. [RT #18573] 2440. [bug] named-checkconf used an incorrect test to determine if an ACL was set to none.

Make "rrset-order fixed" a compile-time option. settable by "./configure --enable-fixed-rrset". Disabled by default. [rt17977]

2349. [func] Provide incremental re-signing support for secure dynamic zones. [RT #1091] back out incorrect branch rt1091 and apply correct branch rt1091a.

2349. [func] Provide incremental re-signing support for secure dynamic zones. [RT #1091]

update copyright notice

update copyright notice

2345. [bug] named-checkconf failed to detect when forwarders were set at both the options/view level and in a root zone. [RT #17671]

2277. [bug] Empty zone names were not correctly being caught at in the post parse checks. [RT #17357]

2272. [bug] Handle illegal dnssec-lookaside trust-anchor names. [RT #17262]

2262. [bug] Error status from all but the last view could be lost. [RT #17292]

Fix compiler warnings on SCO OSr5

Add support for O(1) ACL processing, based on radix tree code originally written by kevin brintnall. [RT #16288]

2222. [func] named-checkconf now checks server key references. [RT #17097]

update copyright notice