4504. [security] Allow the maximum number of records in a zone to be specified. This provides a control for issues raised in CVE-2016-6170. [RT #42143] (cherry picked from commit 5f8412a4cb5ee14a0e8cddd4107854b40ee3291e)

4439. [bug] Address race conditions getting ownernames of nodes. [RT #43005] (cherry picked from commit c7e021e2e64a73f665a3a57b6eb06670d2a21603)

4401. [misc] Change LICENSE to MPL 2.0.

[master] copyrights, win32 definitions

4376. [experimental] Added support for Catalog Zones, a new method for provisioning secondary servers in which a list of zones to be served is stored in a DNS zone and can be propagated to slaves via AXFR/IXFR. [RT #41581] 4375. [func] Add support for automatic reallocation of isc_buffer to isc_buffer_put* functions. [RT #42394]

update copyright notice / whitespace

Improve performance of RBT (#41165)

[master] unify internal and export libraries 3550. [func] Unified the internal and export versions of the BIND libraries, allowing external clients to use the same libraries as BIND. [RT #33131]

update copyrights

[master] RPZ speedup (phase 2, multiple RPZ's) 3495. [func] Support multiple response-policy zones, while improving RPZ performance. [RT #32476]

update copyright notice

merging fast format zone files Conflicts: .gitignore bin/named/zoneconf.c bin/tests/.gitignore bin/tests/system/autosign/tests.sh bin/tests/system/masterformat/clean.sh bin/tests/system/masterformat/ns1/compile.sh bin/tests/system/masterformat/tests.sh configure lib/dns/db.c lib/dns/include/dns/db.h lib/dns/include/dns/types.h lib/dns/master.c lib/dns/masterdump.c lib/dns/rbt.c lib/dns/rbtdb.c lib/dns/sdb.c lib/dns/sdlz.c lib/dns/tests/.cvsignore lib/dns/tests/Makefile.in lib/dns/win32/libdns.def lib/dns/xfrin.c lib/dns/zone.c lib/export/dns/Makefile.in lib/isc/include/isc/file.h lib/isc/unix/file.c lib/isc/win32/file.c lib/isccfg/namedconf.c

Squashed commit of the following: commit aea73609ac5d41ed091360e94370798965f28f05 commit eef7f44c57a060b24a426eb8888e16176a0a69b1 commit a88a26d864ad399fa2d40e3b9659b4d26f454ca1 commit 1b90d59568e7e3b65690c6bd075cf4d60b03e454 Merge: 74d8f73 cd02924 commit 74d8f73ed553bb64a305e284905762f7ff0029aa commit 9a59ef6bbd4befe91e5691e8b85afe1cb7ab0706 commit c63606a53b4f1bb7066b37d3cfe588e9dc21a119 commit 2c392a840c8838455d144ce163bd873bee400c97 commit 0241f53563e6e7bed462a883d98a8931f01e0980 commit 79fe22b5d6f04bdaa3073cf54d41952194e879e1 commit 351b3049625f2edd39729dd85413e961b97d4b3b commit 7207674fc77c9a10d84c0cb94e36d1c09bb31459 commit 543ad34cf08f901c20b438c9d2f45482cff13d5e commit fc45b99ce4438627fdcbeb4365695ba0065fa46f commit c425207f57e0a5157372aa7edbb79b13170563e5 commit ef8c5e23ca284e0ea02f69ce1f356d537c19d93b commit ba0d4e3aa51efe412cfa1d031651f949442d1802 commit 41c7969c7cb6884b93011f7ace3fd9522efc021e and more from CVS for rt26172 Add - optional "recursive-only yes|no" to the response-policy statement - optional max-policy-ttl to limit the lies that "recursive-only no" can introduce into resolvers' caches - test that queries with RD=0 are not rewritten by default - performance smoke test Change encoding of PASSTHRU action to "rpz-passthru". (The old encoding is still accepted.) Fix rt26180 assert botch in zone_findrdataset() in this branch as well. Fix missing signatures on NOERROR results despite RPZ hits when there are signatures and the client asks for DNSSEC,

update copyright notice

Merge statistics code (ATT SoW, rt24117) This includes the following changes: 3326. [func] Added task list statistics: task model, worker threads, quantum, tasks running, tasks ready. [RT #27678] 3325. [func] Report cache statistics: memory use, number of nodes, number of hash buckets, hit and miss counts. [RT #27056] 3324. [test] Add better tests for ADB stats [RT #27057] 3323. [func] Report the number of buckets the resolver is using. [RT #27020] 3322. [func] Monitor the number of active TCP and UDP dispatches. [RT #27055] 3321. [func] Monitor the number of recursive fetches and the number of open sockets, and report these values in the statistics channel. [RT #27054] 3320. [func] Added support for monitoring of recursing client count. [RT #27009] 3319. [func] Added support for monitoring of ADB entry count and hash size. [RT #27057]

Commit rt25172 changes to HEAD including - fix precedence among competing rules - improve ARM text including documenting rule precedence - try to rewrite CNAME chains until first hit - new "rpz" logging channel - same fix for "NS ." as in RT 24985

3164. [func] Enable DLZ modules to retrieve client information, so that responses can be changed depending on the source address of the query. [RT #25768]

update copyright notice

3008. [func] Response policy zones (RPZ) support. [RT #21726]

2708. [func] Insecure to secure and NSEC3 parameter changes via update are now fully supported and no longer require defines to enable. We now no longer overload the NSEC3PARAM flag field, nor the NSEC OPT bit at the apex. Secure to insecure changes are controlled by by the named.conf option 'secure-to-insecure'. Warning: If you had previously enabled support by adding defines at compile time to BIND 9.6 you should ensure that all changes that are in progress have completed prior to upgrading to BIND 9.7. BIND 9.7 is not backwards compatible.

2660. [func] Add a new set of DNS libraries for non-BIND9 applications. See README.libdns. [RT #19369]

update copyright notice

2636. [func] Simplify zone signing and key maintenance with the dnssec-* tools. Major changes: - all dnssec-* tools now take a -K option to specify a directory in which key files will be stored - DNSSEC can now store metadata indicating when they are scheduled to be published, acttivated, revoked or removed; these values can be set by dnssec-keygen or overwritten by the new dnssec-settime command - dnssec-signzone -S (for "smart") option reads key metadata and uses it to determine automatically which keys to publish to the zone, use for signing, revoke, or remove from the zone [RT #19816]

2619. [func] Add support for RFC 5011, automatic trust anchor maintenance. The new "managed-keys" statement can be used in place of "trusted-keys" for zones which support this protocol. (Note: this syntax is expected to change prior to 9.7.0 final.) [RT #19248]

update copyright notice

2589. [bug] dns_db_unregister() failed to clear '*dbimp'. [RT #19626]

2448. [func] Add NSEC3 support. [RT #15452]

2355. [func] Extend the number statistics counters available. [RT #17590]

update copyright notice

remove return

2349. [func] Provide incremental re-signing support for secure dynamic zones. [RT #1091]

update copyright notice

update copyright notice

2157. [func] dns_db_transfernode() created. [RT #16685] 2156. [bug] Fix node reference leaks in lookup.c:lookup_find(), resolver.c:validated() and resolver.c:cache_name(). Fix a memory leak in rbtdb.c:free_noqname(). Make lookup.c:lookup_find() robust against event leaks. [RT #16685]

1927. [bug] Access to soanode or nsnode in rbtdb violated the lock order rule and could cause a dead lock. [RT# 15518]

1817. [func] Add support for additional zone file formats for improving loading performance. The masterfile-format option in named.conf can be used to specify a non-default format. A separate command named-compilezone was provided to generate zone files in the new format. Additionally, the -I and -O options for dnssec-signzone specify the input and output formats.

1817. [func] add support for additional zone file formats for improving loading performance. The masterfile-format option in named.conf can be used to specify a non-default format. A new separate command named-compilezone was provided to generate zone files in a new format.

update copyright notice

1851. [doc] Doxygen comment markup. [RT #11398]

1526. [func] Implemented "additional section caching (or acache)", an internal cache framework for additional section content to improve response performance. Several configuration options were provided to control the behavior.

update copyright notice