update copyright notice / whitespace

4647. [bug] Change 4643 broke verification of TSIG signed TCP message sequences where not all the messages contain TSIG records. These may be used in AXFR and IXFR responses. [RT #45509]

4507. [bug] Name could incorrectly log 'allows updates by IP address, which is insecure' [RT #43432] (cherry picked from commit 2b2b85c8970983a77d478efed0a50e5b57d53ce4)

[v9_11] Merged rt43077 (new RSA verify unit test) (cherry picked from commit fc41d120f06d5d0cbe2c89cdd15041365964c7ec)

4401. [misc] Change LICENSE to MPL 2.0.

[master] fix python script versions 4257. [cleanup] Python scripts reported incorrect version. [RT #41080]

cleanup trailing whitespace

[master] dnstap 4235. [func] Added support in named for "dnstap", a fast method of capturing and logging DNS traffic, and a new command "dnstap-read" to read a dnstap log file. Use "configure --enable-dnstap" to enable this feature (note that this requires libprotobuf-c and libfstrm). See the ARM for configuration details. Thanks to Robert Edmonds of Farsight Security. [RT #40211]

update copyright notice / whitespace

4217. [protocol] Add support for CSYNC. [RT #40532]

[master] add diffie-hellman key unit test 3978. [test] Added a unit test for Diffie-Hellman key computation, completing change #3974. [RT #37477]

3952. [bug] dns_name_fullcompare failed to set *nlabelsp when the two name pointers were the same. [RT #37176]

3893. [bug] Peer DSCP values could be returned without being set. [RT #36538]

[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]

[35904] Add various RBT unit tests No CHANGES entry was added as this commit mainly adds tests related code. Squashed commit of the following: commit d3d44508daa128fb8b60f64b3a8c81f80602273d Author: Evan Hunt <each@isc.org> Date: Wed May 7 09:36:41 2014 -0700 [rt35904] remove private non-static names from .def file commit dbca45661c3939f21c3bb3f405d08cfe1b35d7aa Author: Mukund Sivaraman <muks@isc.org> Date: Wed May 7 21:39:32 2014 +0530 Remove test for shortcut findnode() The implementation was not included in this review branch, but the tests erroneously made it through. This functionality will be addressed in a different ticket (RT#35906). commit 94ff14576ab3407f2612d34727b7eacfefc3668c Author: Mukund Sivaraman <muks@isc.org> Date: Wed May 7 21:36:50 2014 +0530 Minor indent fix commit 50972f17697bb222996e433faa8224843366f9b2 Author: Evan Hunt <each@isc.org> Date: Tue May 6 20:05:21 2014 -0700 [rt35904] style commit 5c4d5d41fcc5bfecdeebc008896974385c841b8d Author: Mukund Sivaraman <muks@isc.org> Date: Sun May 4 19:19:36 2014 +0530 RBT related updates * Add various RBT unit tests * Add some helper methods useful in unit testing RBT code * General cleanup

[master] merge libiscpk11 to libisc 3735. [cleanup] Merged the libiscpk11 library into libisc to simplify dependencies. [RT #35205]

update copyrights

[master] native PKCS#11 support 3705. [func] "configure --enable-native-pkcs11" enables BIND to use the PKCS#11 API for all cryptographic functions, so that it can drive a hardware service module directly without the need to use a modified OpenSSL as intermediary (so long as the HSM's vendor provides a complete-enough implementation of the PKCS#11 interface). This has been tested successfully with the Thales nShield HSM and with SoftHSMv2 from the OpenDNSSEC project. [RT #29031]

sort and one file per line

3692. [bug] Two calls to dns_db_getoriginnode were fatal if there was no data at the node. [RT #35080]

update copyrights

[master] add geoip support 3504. [func] Add support for ACLs based on geographic location, using MaxMind GeoIP databases. Based on code contributed by Ken Brownfield <kb@slide.com>. [RT #30681]

3420. [bug] Address VPATH compilation issues. [RT #31879]

3364. [security] Named could die on specially crafted record. [RT #30416]

3356. [bug] Cap the TTL of signed RRsets when RRSIGs are approaching their expiry, so they don't remain in caches after expiry. [RT #26429]

reverse bad copyright update

update copyright notice

merging fast format zone files Conflicts: .gitignore bin/named/zoneconf.c bin/tests/.gitignore bin/tests/system/autosign/tests.sh bin/tests/system/masterformat/clean.sh bin/tests/system/masterformat/ns1/compile.sh bin/tests/system/masterformat/tests.sh configure lib/dns/db.c lib/dns/include/dns/db.h lib/dns/include/dns/types.h lib/dns/master.c lib/dns/masterdump.c lib/dns/rbt.c lib/dns/rbtdb.c lib/dns/sdb.c lib/dns/sdlz.c lib/dns/tests/.cvsignore lib/dns/tests/Makefile.in lib/dns/win32/libdns.def lib/dns/xfrin.c lib/dns/zone.c lib/export/dns/Makefile.in lib/isc/include/isc/file.h lib/isc/unix/file.c lib/isc/win32/file.c lib/isccfg/namedconf.c

3336. [func] Maintain statistics for RRsets tagged as "stale". [RT #29514]

create and use multiple fetch dispatches Added API to create a set of UDP dispatches which can be shared round-robin style when making upstream queries for authoritative data; this should reduce lock contention in the query source dispatch.

set $Id$

update copyright notice

3266. [bug] The maximum number of NSEC3 iterations for a DNSKEY RRset was not being properly computed. [RT #26543]

3241. [func] Extended the header of raw-format master files to include the serial number of the zone from which they were generated, if different (as in the case of inline-signing zones). This is to be used in inline-signing zones, to track changes between the unsigned and signed versions of the zone, which may have different serial numbers. (Note: raw zonefiles generated by this version of BIND are no longer compatble with prior versions. To generate a backward-compatible raw zonefile using dnssec-signzone or named-compilezone, specify output format "raw=0" instead of simply "raw".) [RT #26587]

3235. [func] dns_db_diffx, a extended dns_db_diff which returns the generated diff and optionally writes it to a journal. [RT #26386]

3185. [func] New 'rndc signing' option for auto-dnssec zones: - 'rndc signing -list' displays the current state of signing operations - 'rndc signing -clear' clears the signing state records for keys that have fully signed the zone - 'rndc signing -nsec3param' sets the NSEC3 parameters for the zone The 'rndc keydone' syntax is removed. [RT #23729]

3168. [bug] Nxdomain redirection could trigger a assert with a ANY query. [RT #26017]

3150. [func] Improved startup and reconfiguration time by enabling zones to load in multiple threads. [RT #25333]

3145. [test] Capture output of ATF unit tests in "./atf.out" if there were any errors while running them. [RT #25527]

3144. [bug] dns_dbiterator_seek() could trigger an assert when used with a nonexistent database node. [RT #25358]

3131. [func] Improve scalability by allocating one zone task per 100 zones at startup time, rather than using a fixed-size task table. [RT #24406]

3130. [func] Support alternate methods for managing a dynamic zone's serial number. Two methods are currently defined using serial-update-method, "increment" (default) and "unixtime". [RT #23849]

3065. [bug] RRSIG could have time stamps too far in the future. [RT #23356]

3043. [test] Merged in the NetBSD ATF test framework (currently version 0.12) for development of future unit tests. Use configure --with-atf to build ATF internally or configure --with-atf=prefix to use an external copy. [RT #23209]