4748. [cleanup] Sprintf to snprintf coversions. [RT #46132] (cherry picked from commit a009d03a1abf73c8146c1696ce1100e62c3b9dbb)

Don't use memset() to wipe memory (#45947) (cherry picked from commit d5707676e45551d1ceb600a674f3f13351fd3105)

update copyright notice / whitespace

Added Ed25519 support (#44696)

4461. [bug] win32: not all external data was properly marked as external data for windows dll. [RT #43161] (cherry picked from commit 8eceb0bffe4ab4ccf72f71bb69d2b8106743af5d)

4450. [port] Provide more nuanced HSM support which better matches the specific PKCS11 providers capabilities. [RT #42458] (cherry picked from commit 8ee6f289d87851a5b898b24a64587f0e6bc225bc)

4401. [misc] Change LICENSE to MPL 2.0.

Merged rt42505 (misc DNSSEC bugs)

[master] print syncpublish and syncdelete in key file comments

update copyright notice / whitespace

[master] fix use after free on xfr timeout 4289. [bug] The server could crash due to memory being used after it was freed if a zone transfer timed out. [RT #41297]

update copyright notice / whitespace

4128. [bug] Address issues raised by Coverity 7.6. [RT #39537]

[24702] Include key filename in logged message Squashed commit of the following: commit 593e6bc7e29938ff5c2f7508bde303fb069a97a9 Author: Mukund Sivaraman <muks@isc.org> Date: Tue Jun 10 19:17:40 2014 +0530 Increase size of filename buffers commit b8685678e026ba98b8833e26664193b6345eb00e Author: Evan Hunt <each@isc.org> Date: Wed Jun 4 18:57:44 2014 -0700 [rt24702] some tweaks during review commit adfbc8f808716c63e9e097d92beef104527e5c6f Author: Mukund Sivaraman <muks@isc.org> Date: Wed Jun 4 18:18:35 2014 +0530 [24702] Include key filename in logged message commit f1eff77e7e3704b145c3d65101a735467dd81dc3 Author: Mukund Sivaraman <muks@isc.org> Date: Wed Jun 4 18:12:43 2014 +0530 Add dst_key_getfilename()

[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]

[master] better error output when initializing pkcs11 3786. [func] Provide more detailed error codes when using native PKCS#11. "pkcs11-tokens" now fails robustly rather than asserting when run against an HSM with an incomplete PCKS#11 API implementation. [RT #35479]

fix GSSAPI with native PKCS#11 typo [#35207]

update copyrights

[master] native PKCS#11 support 3705. [func] "configure --enable-native-pkcs11" enables BIND to use the PKCS#11 API for all cryptographic functions, so that it can drive a hardware service module directly without the need to use a modified OpenSSL as intermediary (so long as the HSM's vendor provides a complete-enough implementation of the PKCS#11 interface). This has been tested successfully with the Thales nShield HSM and with SoftHSMv2 from the OpenDNSSEC project. [RT #29031]

3642. [func] Allow externally generated DNSKEY to be imported into the DNSKEY management framework. A new tool dnssec-importkey is used to this. [RT #34698]

3632. [bug] Signature from newly inactive keys were not being removed. [RT #32178]

[master] unify internal and export libraries 3550. [func] Unified the internal and export versions of the BIND libraries, allowing external clients to use the same libraries as BIND. [RT #33131]

[master] add zone memory context pools 3492. [bug] Fixed a regression in zone loading performance due to lock contention. [RT #30399]

update copyright notice

[master] address TKEY bugs 3486. [bug] named could crash when using TKEY-negotiated keys that had been deleted and then recreated. [RT #32506] commit 6a48b9999766d26cddc7cef275cd984b7d53c014 Author: Evan Hunt <each@isc.org> Date: Tue Jan 29 14:59:46 2013 -0800 [rt32506] don't dump key if dump is unimplemented commit d0ae0f44b460bab2e8bb24bba683d3ef69ec1765 Author: Evan Hunt <each@isc.org> Date: Tue Jan 29 14:42:25 2013 -0800 [rt32506] make sure LRU needs adjusting before adjusting it commit 0437f8f06b1cb72a6d5e3c30f27febca23846d95 Author: Evan Hunt <each@isc.org> Date: Tue Jan 29 12:28:28 2013 -0800 [rt32506] demonstrate bugs in tkey test

3440. [bug] Reorder get_key_struct to not trigger a assertion when cleaning up due to out of memory error. [RT #32131]

[master] silence noisy OpenSSL logging 3402. [bug] Correct interface numbers for IPv4 and IPv6 interfaces.

[master] silence coverity warnings 3401. [bug] Addressed Coverity warnings. [RT #31484]

3387. [func] Support for a DS digest can be disabled at runtime with disable-ds-digests. [RT #21581]

Conflicts: lib/dns/dst_parse.c lib/isc/win32/file.c

3339. [func] Allow the maximum supported rsa exponent size to be specified: "max-rsa-exponent-size <value>;" [RT #29228]

update copyright notice

Use '==' not '=' in conditional test when not using openssl.

3317. [func] Add ECDSA support (RFC 6605). [RT #21918]

3174. [bug] Always compute to revoked key tag from scratch. [RT #24711]

3152. [cleanup] Some versions of gcc and clang failed due to incorrect use of __builtin_expect. [RT #25183]

update copyright notice

cast to unsigned

3143. [bug] Silence clang compiler warnings. [RT #25174]

3143. [bug] Silence clang compiler warnings. [RT #25174]

3087. [bug] DDNS updates using SIG(0) with update-policy match type "external" could cause a crash. [RT #23735]

3076. [func] New '-L' option in dnssec-keygen, dnsset-settime, and dnssec-keyfromlabel sets the default TTL of the key. When possible, automatic signing will use that TTL when the key is published. [RT #23304]

update copyright notice

3006. [func] Allow dynamically generated TSIG keys to be preserved across restarts of named. Initially this is for TSIG keys generated using GSSAPI. [RT #22639]

2999. [func] Add GOST support (RFC 5933). [RT #20639]

2989. [func] Added support for writable DLZ zones. (Contributed by Andrew Tridgell of the Samba project.) [RT #22629] 2988. [experimental] Added a "dlopen" DLZ driver, allowing the creation of external DLZ drivers that can be loaded as shared objects at runtime rather than linked with named. Currently this is switched on via a compile-time option, "configure --with-dlz-dlopen". Note: the syntax for configuring DLZ zones is likely to be refined in future releases. (Contributed by Andrew Tridgell of the Samba project.) [RT #22629] 2987. [func] Improve ease of configuring TKEY/GSS updates by adding a "tkey-gssapi-keytab" option. If set, updates will be allowed with any key matching a principal in the specified keytab file. "tkey-gssapi-credential" is no longer required and is expected to be deprecated. (Contributed by Andrew Tridgell of the Samba project.) [RT #22629]

2982. [bug] Reference count dst keys. dst_key_attach() can be used increment the reference count. Note: dns_tsigkey_createfromkey() callers should now always call dst_key_free() rather than setting it to NULL on success. [RT #22672]

2976. [bug] named die on exit after negotiating a GSS-TSIG key. [RT #3415]

typo in threaded build, silence compiler warning

2887. [bug] Report the keytag times in UTC in the .key file, local time is presented as a comment within the comment. [RT #21223] 2886. [bug] ctime() is not thread safe. [RT #21223]

update copyright notice

Prevent Linux spurious warnings about fwrite(). [RT #20812]

#include <time.h> for the ctime() prototype.

UNUSED(engine) if !defined(OPENSSL)

2738. [func] Add RSASHA256 and RSASHA512 tests to the dnssec system test. [RT #20453]

keygen progress indication [RT #20284]

2726. [func] Added support for SHA-2 DNSSEC algorithms, RSASHA256 and RSASHA512. [RT #20023]

2721. [port] Have dst__entropy_status() prime the random number generator. [RT #20369]

2712. [func] New 'auto-dnssec' zone option allows zone signing to be fully automated in zones configured for dynamic DNS. 'auto-dnssec allow;' permits a zone to be signed by creating keys for it in the key-directory and using 'rndc sign <zone>'. 'auto-dnssec maintain;' allows that too, plus it also keeps the zone's DNSSEC keys up to date according to their timing metadata. [RT #19943]

remove, not zero, extended flags

zero extended flags

remove extended flags before comparing if set

silence compiler warning/enforce const [RT #20390]

silence comiler warning

2709. [func] Added some data fields, currently unused, to the private key file format, to allow implementation of explicit key rollover in a future release without impairing backward or forward compatibility. [RT #20310]

explicit engine rt20230a

silence signed/unsigned comparision warning

2689. [bug] Correctly handle snprintf result. [RT #20306]

2685. [bug] Fixed dnssec-signzone -S handling of revoked keys. Also, added warnings when revoking a ZSK, as this is not defined by protocol (but is legal). [RT #19943]

2677. [func] Changes to key metadata behavior: - Keys without "publish" or "active" dates set will no longer be used for smart signing. However, those dates will be set to "now" by default when a key is created; to generate a key but not use it yet, use dnssec-keygen -G. - New "inactive" date (dnssec-keygen/settime -I) sets the time when a key is no longer used for signing but is still published. - The "unpublished" date (-U) is deprecated in favor of "deleted" (-D). [rt20247]

2669. [func] Update PKCS#11 support to support Keyper HSM. Update PKCS#11 patch to be against openssl-0.9.8i.

2668. [func] Several improvements to dnssec-* tools, including: - dnssec-keygen and dnssec-settime can now set key metadata fields 0 (to unset a value, use "none") - dnssec-revoke sets the revocation date in addition to the revoke bit - dnssec-settime can now print individual metadata fields instead of always printing all of them, and can print them in unix epoch time format for use by scripts [RT #19942]

2660. [func] Add a new set of DNS libraries for non-BIND9 applications. See README.libdns. [RT #19369]

2651. [bug] Dates could print incorrectly in K*.key files on 64-bit systems. [RT #20076]

2642. [bug] nsupdate could dump core on solaris when reading improperly formatted key files. [RT #20015]

update copyright notice

2636. [func] Simplify zone signing and key maintenance with the dnssec-* tools. Major changes: - all dnssec-* tools now take a -K option to specify a directory in which key files will be stored - DNSSEC can now store metadata indicating when they are scheduled to be published, acttivated, revoked or removed; these values can be set by dnssec-keygen or overwritten by the new dnssec-settime command - dnssec-signzone -S (for "smart") option reads key metadata and uses it to determine automatically which keys to publish to the zone, use for signing, revoke, or remove from the zone [RT #19816]

update copyright notice

2619. [func] Add support for RFC 5011, automatic trust anchor maintenance. The new "managed-keys" statement can be used in place of "trusted-keys" for zones which support this protocol. (Note: this syntax is expected to change prior to 9.7.0 final.) [RT #19248]

2609. [func] Simplify the configuration of dynamic zones: - add ddns-confgen command to generate configuration text for named.conf - add zone option "ddns-autoconf yes;", which causes named to generate a TSIG session key and allow updates to the zone using that key - add '-l' (localhost) option to nsupdate, which causes nsupdate to connect to a locally-running named process using the session key generated by named [RT #19284]

update copyright notice

2567. [bug] dst__privstruct_writefile() could miss write errors. [RT #19360]

2503. [port] linux: improve compatibility with Linux Standard Base. [RT #18793]

2495. [bug] Tighten RRSIG checks. [RT #18795]

2448. [func] Add NSEC3 support. [RT #15452]

update copyright notice

add EVP and PKCS11

2346. [func] Memory statistics now cover all active memory contexts in increased detail. [RT #17580]

update copyright notice

update copyright notice

update copyright notice