CHANGES revision fd82c70695888c134287b8018296028c252d100e
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4871. [bug] Fix configure glitch in detecting stdatomic.h
297be3708069ef31814d6d75c0d71a50a78feb03Mark Andrews support on systems with multiple compilers.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4870. [test] Update included ATF library to atf-0.21 preserving
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the ATF tool. [RT #46967]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4869. [bug] Address some cases where NULL with zero length could
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein be passed to memmove which is undefined behaviour and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein can lead to bad optimisation. [RT #46888]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4867. [cleanup] Normalize rndc on/off commands (validation and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein querylog) so they accept the same synonyms
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein for on/off (yes/no, true/false, enable/disable).
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Thanks to Tony Finch. [RT #47022]
297be3708069ef31814d6d75c0d71a50a78feb03Mark Andrews4866. [port] DST library initialization verifies MD5 (when MD5
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein was not disabled) and SHA-1 hash and HMAC support.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4864. [bug] named acting as a slave for a catalog zone crashed if
e21a2904f02a03fa06b6db04d348f65fe9c67b2bMark Andrews the latter contained a master definition without an IP
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein address. [RT #45999]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4863. [bug] Fix various other bugs reported by Valgrind's
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein memcheck tool. [RT #46978]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4862. [bug] The rdata flags for RRSIG were not being properly set
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein when constructing a rdataslab. [RT #46978]
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews4861. [bug] The isc_crc64 unit test was not endian independent.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4860. [bug] isc_int8_t should be signed char. [RT #46973]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4859. [bug] A loop was possible when attempting to validate
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein unsigned CNAME responses from secure zones;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein this caused a delay in returning SERVFAIL and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein also increased the chances of encountering
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein CVE-2017-3145. [RT #46839]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4858. [security] Addresses could be referenced after being freed
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in resolver.c, causing an assertion failure.
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews (CVE-2017-3145) [RT #46839]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4857. [bug] Maintain attach/detach semantics for event->db,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein event->node, event->rdataset and event->sigrdataset
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in query.c. [RT #46891]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4856. [bug] 'rndc zonestatus' reported the wrong underlying type
297be3708069ef31814d6d75c0d71a50a78feb03Mark Andrews for a inline slave zone. [RT #46875]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4852. [bug] Handle strftime() failing in isc_time_formatISO8601ms.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Add REQUIRE's and INSIST's to isc_time_formattimestamp,
297be3708069ef31814d6d75c0d71a50a78feb03Mark Andrews isc_time_formathttptimestamp, isc_time_formatISO8601,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein isc_time_formatISO8601ms. [RT #46892]
297be3708069ef31814d6d75c0d71a50a78feb03Mark Andrews4851. [port] Support using kyua as well as atf-run to run the unit
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein tests. [RT #46853]
297be3708069ef31814d6d75c0d71a50a78feb03Mark Andrews4850. [bug] Named failed to restart with multiple added zones in
297be3708069ef31814d6d75c0d71a50a78feb03Mark Andrews lmdb database. [RT #46889]
297be3708069ef31814d6d75c0d71a50a78feb03Mark Andrews4849. [bug] Duplicate zones could appear in the .nzf file if
297be3708069ef31814d6d75c0d71a50a78feb03Mark Andrews addzone failed. [RT #46435]
297be3708069ef31814d6d75c0d71a50a78feb03Mark Andrews4846. [test] Adjust timing values in runtime system test. Address
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein named.pid removal races in runtime system test.
297be3708069ef31814d6d75c0d71a50a78feb03Mark Andrews4844. [test] Address memory leaks in libatf-c. [RT #46798]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4843. [bug] dnssec-signzone free hashlist on exit. [RT #46791]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4842. [bug] Conditionally compile opensslecdsa_link.c to avoid
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein warnings about unused function. [RT #46790]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4841. [bug] Address -fsanitize=undefined warnings. [RT #46786]
297be3708069ef31814d6d75c0d71a50a78feb03Mark Andrews4840. [test] Add tests to cover fallback to using ZSK on inactive
297be3708069ef31814d6d75c0d71a50a78feb03Mark Andrews KSK. [RT #46787]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4839. [bug] zone.c:zone_sign was not properly determining
297be3708069ef31814d6d75c0d71a50a78feb03Mark Andrews if there were active KSK and ZSK keys for
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein a algorithm when update-check-ksk is true
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein (default) leaving records unsigned with one or
297be3708069ef31814d6d75c0d71a50a78feb03Mark Andrews more DNSKEY algorithms. [RT #46774]
297be3708069ef31814d6d75c0d71a50a78feb03Mark Andrews4838. [bug] zone.c:add_sigs was not properly determining
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein if there were active KSK and ZSK keys for
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein a algorithm when update-check-ksk is true
297be3708069ef31814d6d75c0d71a50a78feb03Mark Andrews (default) leaving records unsigned with one or
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein more DNSKEY algorithms. [RT #46754]
297be3708069ef31814d6d75c0d71a50a78feb03Mark Andrews4837. [bug] dns_update_signatures{inc} (add_sigs) was not
297be3708069ef31814d6d75c0d71a50a78feb03Mark Andrews properly determining if there were active KSK and
7208386cd37a2092c70eddf80cf29519b16c4c80Mark Andrews ZSK keys for a algorithm when update-check-ksk is
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein true (default) leaving records unsigned when there
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein were multiple DNSKEY algorithms for the zone.
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews4836. [bug] Zones created using "rndc addzone" could
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews temporarily fail to inherit an "allow-transfer"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein ACL that had been configured in the options
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews statement. [RT #46603]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4835. [cleanup] Clean up and refactor LMDB-related code. [RT #46718]
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews4834. [port] Fix LMDB support on OpenBSD. [RT #46718]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4833. [bug] isc_event_free should check that the event is not
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews linked when called. [RT #46725]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4832. [bug] Events were not being removed from zone->rss_events.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4831. [bug] Convert the RRSIG expirytime to 64 bits for
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein comparisions in diff.c:resign. [RT #46710]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4830. [bug] Failure to configure ATF when requested did not cause
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews an error in top-level configure script. [RT #46655]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4829. [bug] isc_heap_delete did not zero the index value when
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the heap was created with a callback to do that.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4828. [bug] Do not use thread-local storage for storing LMDB reader
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein locktable slots. [RT #46556]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4827. [misc] Add a precommit check script util/checklibs.sh
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4826. [cleanup] Prevent potential build failures in bin/confgen/ and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein bin/named/ when using parallel make. [RT #46648]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4825. [bug] Prevent a bogus "error during managed-keys processing
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein (no more)" warning from being logged. [RT #46645]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4823. [test] Refactor reclimit system test to improve its
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein reliability and speed. [RT #46632]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4822. [bug] Use resign_sooner in dns_db_setsigningtime. [RT #46473]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4821. [bug] When resigning ensure that the SOA's expire time is
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein always later that the resigning time of other records.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4820. [bug] dns_db_subtractrdataset should transfer the resigning
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein information to the new header. [RT #46473]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4819. [bug] Fully backout the transaction when adding a RRset
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to the resigning / removal heaps fails. [RT #46473]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4818. [test] The logfileconfig system test could intermittently
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein report false negatives on some platforms. [RT #46615]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4817. [cleanup] Use DNS_NAME_INITABSOLUTE and DNS_NAME_INITNONABSOLUTE.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews4816. [bug] Don't use a common array for storing EDNS options
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews in DiG as it could fill up. [RT #45611]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews4815. [bug] rbt_test.c:insert_and_delete needed to call
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews dns_rbt_addnode instead of dns_rbt_addname. [RT #46553]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews4814. [cleanup] Use AS_HELP_STRING for consistent help text. [RT #46521]
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews4812. [bug] Minor improvements to stability and consistency of code
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews handling managed keys. [RT #46468]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews4810. [test] The chain system test failed if the IPv6 interfaces
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews were not configured. [RT #46508]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews4809. [port] Check at configure time whether -latomic is needed
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews for stdatomic.h. [RT #46324]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4808. [bug] Properly test for zlib.h. [RT #46504]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4805. [bug] TCP4Active and TCP6Active weren't being updated
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein correctly. [RT #46454]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4804. [port] win32: access() does not work on directories as
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein required by POSIX. Supply a alternative in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein isc_file_isdirwritable. [RT #46394]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4803. [bug] Backport parts of RT #45293 and RT #46267, specifically
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the fix for RT #46055 and mkeys system test
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein improvements. [RT #46430]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4800. [bug] When processing delzone, write one zone config per
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein line to the NZF. [RT #46323]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4799. [cleanup] Improve clarity of keytable unit tests. [RT #46407]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4792. [bug] Fix map file header correctness check. [RT #38418]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4791. [doc] Fixed outdated documentation about export libraries.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4790. [bug] nsupdate could trigger a require when sending a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein update to the second address of the server.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4788. [cleanup] When using "update-policy local", log a warning
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein when an update matching the session key is received
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein from a remote host. [RT #46213]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4787. [cleanup] Turn nsec3param_salt_totext() into a public function,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein dns_nsec3param_salttotext(), and add unit tests for it.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4783. [test] dnssec: 'check that NOTIFY is sent at the end of
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein NSEC3 chain generation failed' required more time
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein on some machines for the IXFR to complete. [RT #46388]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4782. [test] dnssec: 'checking positive and negative validation
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein with negative trust anchors' required more time to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein complete on some machines. [RT #46386]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4781. [maint] B.ROOT-SERVERS.NET is now 199.9.14.201. [RT #45889]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4780. [bug] When answering ANY queries, don't include the NS
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein RRset in the authority section if it was already
ceeb18e6907a10547859faa340ecad83bedae90cMark Andrews in the answer section. [RT #44543]
ceeb18e6907a10547859faa340ecad83bedae90cMark Andrews4779. [bug] Expire NTA at the start of the second. Don't update
ceeb18e6907a10547859faa340ecad83bedae90cMark Andrews the expiry value if the record has already expired
ceeb18e6907a10547859faa340ecad83bedae90cMark Andrews after a successful check. [RT #46368]
ceeb18e6907a10547859faa340ecad83bedae90cMark Andrews4777. [cleanup] Removed a redundant call to configure_view_acl().
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4776. [bug] Improve portability of ht_test. [RT #46333]
ceeb18e6907a10547859faa340ecad83bedae90cMark Andrews4775. [bug] Address Coverity warnings in ht_test.c [RT #46281]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4774. [bug] <isc/util.h> was incorrectly included in several
ceeb18e6907a10547859faa340ecad83bedae90cMark Andrews header files. [RT #46311]
ceeb18e6907a10547859faa340ecad83bedae90cMark Andrews4773. [doc] Fixed generating Doxygen documentation for functions
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein annotated using certain macros. Miscellaneous
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Doxygen-related cleanups. [RT #46276]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4771. [bug] When sending RFC 5011 refresh queries, disregard
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein cached DNSKEY rrsets. [RT #46251]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4770. [bug] Cache additional data from priming queries as glue.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Previously they were ignored as unsigned
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein non-answer data from a secure zone, and never
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein actually got added to the cache, causing hints
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to be used frequently for root-server
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein addresses, which triggered re-priming. [RT #45241]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4769. [bug] Enforce the requirement that the managed keys
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein directory (specified by "managed-keys-directory",
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein and defaulting to the working directory if not
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein specified) must be writable. [RT #46077]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4766. [cleanup] Addresss Coverity warnings. [RT #46150]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4763. [contrib] Improve compatibility when building MySQL DLZ
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein module by using mysql_config if available.
bea931e17b7567f09107f93ab7e25c7f00abeb9cMark Andrews4762. [func] "update-policy local" is now restricted to updates
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein from local addresses. (Previously, other addresses
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein were allowed so long as updates were signed by the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein local session key.) [RT #45492]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4761. [protocol] Add support for DOA. [RT #45612]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4759. [func] Add logging channel "trust-anchor-telementry" to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein record trust-anchor-telementry in incoming requests.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Both _ta-XXXX.<anchor>/NULL and EDNS KEY-TAG options
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein are logged. [RT #46124]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4758. [doc] Remove documentation of unimplemented "topology".
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4756. [bug] Interrupting dig could lead to an INSIST failure after
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein certain errors were encountered while querying a host
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein whose name resolved to more than one address. Change
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein 4537 increased the odds of triggering this issue by
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein causing dig to hang indefinitely when certain error
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein paths were evaluated. dig now also retries TCP queries
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein (once) if the server gracefully closes the connection
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein before sending a response. [RT #42832, #45159]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4755. [cleanup] Silence unnecessary log message when NZF file doesn't
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein exist. [RT #46186]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4754. [bug] dns_zone_setview needs a two stage commit to properly
ceeb18e6907a10547859faa340ecad83bedae90cMark Andrews handle errors. [RT #45841]
ceeb18e6907a10547859faa340ecad83bedae90cMark Andrews4753. [contrib] Software obtainable from known upstream locations
ceeb18e6907a10547859faa340ecad83bedae90cMark Andrews (i.e., zkt, nslint, query-loc) has been removed.
ceeb18e6907a10547859faa340ecad83bedae90cMark Andrews Links to these and other packages can be found at
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4752. [test] Add unit test for isc_net_pton. [RT #46171]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4749. [func] The ISC DLV service has been shut down, and all
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein DLV records have been removed from dlv.isc.org.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - Removed references to ISC DLV in documentation
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - Removed DLV key from bind.keys
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - No longer use ISC DLV by default in delv
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4748. [cleanup] Sprintf to snprintf coversions. [RT #46132]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4746. [cleanup] Add configured prefixes to configure summary
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein output. [RT #46153]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4745. [test] Add color-coded pass/fail messages to system
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein tests when running on terminals that support them.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4744. [bug] Suppress trust-anchor-telementry queries if
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein validation is disabled. [RT #46131]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4741. [bug] Make isc_refcount_current() atomically read the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein counter value. [RT #46074]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4740. [cleanup] Avoid triggering format-truncated warnings. [RT #46107]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4739. [cleanup] Address clang static analysis warnings. [RT #45952]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4738. [port] win32: strftime mishandles %Z. [RT #46039]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4737. [cleanup] Address Coverity warnings. [RT #46012]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4736. [cleanup] (a) Added comments to NSEC3-related functions in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein lib/dns/zone.c. (b) Refactored NSEC3 salt formatting
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein code. (c) Minor tweaks to lock and result handling.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4735. [bug] Add @ISC_OPENSSL_LIBS@ to isc-config. [RT #46078]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4734. [contrib] Added sample configuration for DNS-over-TLS in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4731. [bug] Fix use after free when closing an LMDB. [RT #46000]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4730. [bug] Fix out of bounds access in DHCID totext() method.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4729. [bug] Don't use memset() to wipe memory, as it may be
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein removed by compiler optimizations when the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein memset() occurs on automatic stack allocation
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein just before function return. [RT #45947]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4728. [func] Use C11's stdatomic.h instead of isc_atomic
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein where available. [RT #40668]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4727. [bug] Retransferring an inline-signed slave using NSEC3
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein around the time its NSEC3 salt was changed could result
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in an infinite signing loop. [RT #45080]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4726. [port] Prevent setsockopt() errors related to TCP_FASTOPEN
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein from being logged on FreeBSD if the kernel does not
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein support it. Notify the user when the kernel does
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein support TCP_FASTOPEN, but it is disabled by sysctl.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Add a new configure option, --disable-tcp-fastopen, to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein disable use of TCP_FASTOPEN altogether. [RT #44754]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4725. [bug] Nsupdate: "recvsoa" was incorrectly reported for
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews failures in sending the update message. The correct
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein location to be reported is "update_completed".
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4723. [bug] Statistics counter DNSTAPdropped was misidentified
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein as DNSSECdropped. [RT #46002]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews4722. [cleanup] Clean up uses of strcpy() and strcat() in favor of
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews strlcpy() and strlcat() for safety. [RT #45981]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews4719. [bug] Address PVS static analyzer warnings. [RT #45946]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews4717. [bug] Treat replies with QCOUNT=0 as truncated if TC=1,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein FORMERR if TC=0, and log the error correctly.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4715. [bug] TreeMemMax was mis-identified as a second HeapMemMax
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in the Json cache statistics. [RT #45980]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4714. [port] openbsd/libressl: add support for building with
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein --enable-openssl-hash. [RT #45982]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4713. [cleanup] Minor revisions to RPZ code to reduce
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein differences with the development branch. [RT #46037]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4712. [bug] "dig +domain" and "dig +search" didn't retain the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein search domain when retrying with TCP. [RT #45547]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4711. [test] Some RR types were missing from genzones.sh.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4709. [cleanup] Use dns_name_fullhash() to hash names for RRL.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4703. [bug] BINDInstall.exe was missing some buffer length checks.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4698. [port] Add --with-python-install-dir configure option to allow
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein specifying a nonstandard installation directory for
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Python modules. [RT #45407]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4697. [bug] Restore workaround for Microsoft Windows TSIG hash
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein computation bug. [RT #45854]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4696. [port] Enable filter-aaaa support by default on Windows
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein builds. [RT #45883]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4695. [bug] cookie-secrets were not being properly checked by
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein named-checkconf. [RT #45886]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4692. [bug] Fix build failures with libressl introduced in 4676.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4690. [bug] Command line options -4/-6 were handled inconsistently
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein between tools. [RT #45632]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4689. [cleanup] Turn on minimal responses for CDNSKEY and CDS in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein addition to DNSKEY and DS. Thanks to Tony Finch.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4688. [protocol] Check and display EDNS KEY TAG options (RFC 8145) in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein messages. [RT #44804]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4686. [bug] dnssec-settime -p could print a bogus warning about
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein key deletion scheduled before its inactivation when a
297be3708069ef31814d6d75c0d71a50a78feb03Mark Andrews key had an inactivation date set but no deletion date
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein set. [RT #45807]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4685. [bug] dnssec-settime incorrectly calculated publication and
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce activation dates for a successor key. [RT #45806]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4684. [bug] delv could send bogus DNS queries when an explicit
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein server address was specified on the command line along
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein with -4/-6. [RT #45804]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4683. [bug] Prevent nsupdate from immediately exiting on invalid
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein user input in interactive mode. [RT #28194]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4682. [bug] Don't report errors on records below a DNAME.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4680. [bug] Fix failing over to another master server address when
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein nsupdate is used with GSS-API. [RT #45380]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4679. [cleanup] Suggest using -o when dnssec-verify finds a SOA record
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein not at top of zone and -o is not used. [RT #45519]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4678. [bug] geoip-use-ecs has the wrong type when geoip support
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein is disabled at configure time. [RT #45763]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4677. [cleanup] Split up the main function in dig to better support
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the iOS app version. [RT #45508]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4676. [cleanup] Allow BIND to be built using OpenSSL 1.0.X with
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein deprecated functions removed. [RT #45706]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4675. [cleanup] Don't use C++ keyword class. [RT #45726]
4556ad3a270bf049b3225433a402666aaffe3c36Mark Andrews4673. [port] Silence GCC 7 warnings. [RT #45592]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4671. [bug] Fix a race condition that could cause the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein resolver to crash with assertion failure when
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein chasing DS in specific conditions with a very
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein short RTT to the upstream nameserver. [RT #45168]
4556ad3a270bf049b3225433a402666aaffe3c36Mark Andrews4670. [cleanup] Ensure that a request MAC is never sent back
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in an XFR response unless the signature was
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein verified. [RT #45494]
4556ad3a270bf049b3225433a402666aaffe3c36Mark Andrews4668. [bug] Use localtime_r and gmtime_r for thread safety.
4556ad3a270bf049b3225433a402666aaffe3c36Mark Andrews4667. [cleanup] Refactor RDATA unit tests. [RT #45610]
4556ad3a270bf049b3225433a402666aaffe3c36Mark Andrews4666. [bug] dnssec-keymgr: Domain names beginning with digits (0-9)
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein could cause a parser error when reading the policy
4556ad3a270bf049b3225433a402666aaffe3c36Mark Andrews file. This now works correctly so long as the domain
4556ad3a270bf049b3225433a402666aaffe3c36Mark Andrews name is quoted. [RT #45641]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4665. [protocol] Added support for ED25519 and ED448 DNSSEC signing
035992291cb70ec3be4046fcea921b4a6acb1c77Mark Andrews algorithms (RFC 8080). (Note: these algorithms
035992291cb70ec3be4046fcea921b4a6acb1c77Mark Andrews depend on code currently in the development branch
035992291cb70ec3be4046fcea921b4a6acb1c77Mark Andrews of OpenSSL which has not yet been released.)
68b30890ebd441a6a1ae3fdf71744d07d02cd030Mark Andrews4663. [cleanup] Clarify error message printed by dnssec-dsfromkey.
035992291cb70ec3be4046fcea921b4a6acb1c77Mark Andrews4662. [performance] Improve cache memory cleanup of zero TTL records
68b30890ebd441a6a1ae3fdf71744d07d02cd030Mark Andrews by putting them at the tail of LRU header lists.
035992291cb70ec3be4046fcea921b4a6acb1c77Mark Andrews4661. [bug] A race condition could occur if a zone was reloaded
035992291cb70ec3be4046fcea921b4a6acb1c77Mark Andrews while resigning, triggering a crash in
035992291cb70ec3be4046fcea921b4a6acb1c77Mark Andrews rbtdb.c:closeversion(). [RT #45276]
035992291cb70ec3be4046fcea921b4a6acb1c77Mark Andrews4660. [bug] Remove spurious "peer" from Windows socket log
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein messages. [RT #45617]
4556ad3a270bf049b3225433a402666aaffe3c36Mark Andrews4659. [bug] Remove spurious log message about lmdb-mapsize
4556ad3a270bf049b3225433a402666aaffe3c36Mark Andrews not being supported when parsing builtin
4556ad3a270bf049b3225433a402666aaffe3c36Mark Andrews configuration file. [RT #45618]
4556ad3a270bf049b3225433a402666aaffe3c36Mark Andrews4658. [bug] Clean up build directory created by "setup.py install"
4556ad3a270bf049b3225433a402666aaffe3c36Mark Andrews immediately. [RT #45628]
4556ad3a270bf049b3225433a402666aaffe3c36Mark Andrews4657. [bug] rrchecker system test result could be improperly
4556ad3a270bf049b3225433a402666aaffe3c36Mark Andrews determined. [RT #45602]
4556ad3a270bf049b3225433a402666aaffe3c36Mark Andrews4656. [bug] Apply "port" and "dscp" values specified in catalog
4556ad3a270bf049b3225433a402666aaffe3c36Mark Andrews zone's "default-masters" option to the generated
4556ad3a270bf049b3225433a402666aaffe3c36Mark Andrews configuration of its member zones. [RT #45545]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4655. [bug] Lack of seccomp could be falsely reported. [RT #45599]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4654. [cleanup] Don't use C++ keywords delete, new and namespace.
297be3708069ef31814d6d75c0d71a50a78feb03Mark Andrews4652. [bug] Nsupdate could attempt to use a zeroed address on
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein server timeout. [RT #45417]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4651. [test] Silence coverity warnings in tsig_test.c. [RT #45528]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4605. [performance] (partial backport) Improve general query
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein performance. Improves performance of owner case
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein restoration, hash function, etc. Uses inline
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein buffer implementation by default. [RT #45637]
297be3708069ef31814d6d75c0d71a50a78feb03Mark Andrews --- 9.11.2 released ---
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein --- 9.11.2rc2 released ---
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4653. [bug] Reorder includes to move @DST_OPENSSL_INC@ and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein @ISC_OPENSSL_INC@ after shipped include directories.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein --- 9.11.2rc1 released ---
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4649. [bug] The wrong zone was logged when a catalog zone is added.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4648. [bug] "rndc reconfig" on a slave no longer causes all member
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein zones of configured catalog zones to be removed from
297be3708069ef31814d6d75c0d71a50a78feb03Mark Andrews configuration. [RT #45310]
bea931e17b7567f09107f93ab7e25c7f00abeb9cMark Andrews4647. [bug] Change 4643 broke verification of TSIG signed TCP
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews message sequences where not all the messages contain
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein TSIG records. These may be used in AXFR and IXFR
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein responses. [RT #45509]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4645. [bug] Fix PKCS#11 RSA parsing when MD5 is disabled.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein --- 9.11.2b1 released ---
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4643. [security] An error in TSIG handling could permit unauthorized
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein zone transfers or zone updates. (CVE-2017-3142)
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein (CVE-2017-3143) [RT #45383]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4642. [cleanup] Add more logging of RFC 5011 events affecting the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein status of managed keys: newly observed keys,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein deletion of revoked keys, etc. [RT #45354]
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce4641. [cleanup] Parallel builds (make -j) could fail with --with-atf /
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce --enable-developer. [RT #45373]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4640. [bug] If query_findversion failed in query_getdb due to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein memory failure the error status was incorrectly
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein discarded. [RT #45331]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4639. [bug] Fix a regression in --with-tuning reporting introduced
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein by change 4488. [RT #45396]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4638. [bug] Reloading or reconfiguring named could fail on
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein some platforms when LMDB was in use. [RT #45203]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4636. [bug] Normalize rpz policy zone names when checking for
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein existence. [RT #45358]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4635. [bug] Fix RPZ NSDNAME logging that was logging
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein failures as NSIP. [RT #45052]
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce4634. [contrib] check5011.pl needs to handle optional space before
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce semi-colon in +multi-line output. [RT #45352]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4633. [maint] Updated AAAA (2001:500:200::b) for B.ROOT-SERVERS.NET.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4632. [security] The BIND installer on Windows used an unquoted
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein service path, which can enable privilege escalation.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein (CVE-2017-3141) [RT #45229]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4631. [security] Some RPZ configurations could go into an infinite
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein query loop when encountering responses with TTL=0.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein (CVE-2017-3140) [RT #45181]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4630. [bug] "dyndb" is dependent on dlopen existing / being
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein enabled. [RT #45291]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4629. [bug] dns_client_startupdate could not be called with a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein running client. [RT #45277]
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce4628. [bug] Fixed a potential reference leak in query_getdb().
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4626. [test] Added more tests for handling of different record
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein ordering in CNAME and DNAME responses. [QA #430]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4625. [bug] Running "rndc addzone" and "rndc delzone" at close
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to the same time could trigger a deadlock if using
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein LMDB. [RT #45209]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4623. [bug] Use --with-protobuf-c and --with-libfstrm to find
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein protoc-c and fstrm_capture. [RT #45187]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4622. [bug] Remove unnecessary escaping of semicolon in CAA and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein URI records. [RT #45216]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4621. [port] Force alignment of oid arrays to silence loader
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein warnings. [RT #45131]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4620. [port] Handle EPFNOSUPPORT being returned when probing
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to see if a socket type is supported. [RT #45214]
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews4619. [bug] Call isc_mem_put instead of isc_mem_free in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein bin/named/server.c:setup_newzones. [RT #45202]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4618. [bug] Check isc_mem_strdup results in dns_view_setnewzones.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Add logging for lmdb call failures. [RT #45204]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4617. [test] Update rndc system test to be more delay tolerant.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4616. [bug] When using LMDB, zones deleted using "rndc delzone"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein were not correctly removed from the new-zone
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein database. [RT #45185]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4615. [bug] AD could be set on truncated answer with no records
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein present in the answer and authority sections.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4614. [test] Fixed an error in the sockaddr unit test. [RT #45146]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4612. [bug] Silence 'may be use uninitalised' warning and simplify
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the code in lwres/getaddinfo:process_answer.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4611. [bug] The default LMDB mapsize was too low and caused
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein errors after few thousand zones were added using
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein rndc addzone. A new config option "lmdb-mapsize"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein has been introduced to configure the LMDB
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein mapsize depending on operational needs.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4609. [cleanup] Rearrange makefiles to enable parallel execution
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein (i.e. "make -j"). [RT #45078]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4608. [func] DiG now warns about .local queries which are reserved
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein for Multicast DNS. [RT #44783]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4606. [port] Stop using experimental "Experimental keys on scalar"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein feature of perl as it has been removed. [RT #45012]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4604. [bug] Don't use ERR_load_crypto_strings() when building
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein with OpenSSL 1.1.0. [RT #45117]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4603. [doc] Automatically generate named.conf(5) man page
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein from doc/misc/options. Thanks to Tony Finch.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4602. [func] Threads are now set to human-readable
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein names to assist debugging, when supported by
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the OS. [RT #43234]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4601. [bug] Reject incorrect RSA key lengths during key
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein generation and and sign/verify context
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein creation. [RT #45043]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4600. [bug] Adjust RPZ trigger counts only when the entry
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein being deleted exists. [RT #43386]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4599. [bug] Fix inconsistencies in inline signing time
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein comparison that were introduced with the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein introduction of rdatasetheader->resign_lsb.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4597. [bug] The validator now ignores SHA-1 DS digest type
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein when a DS record with SHA-384 digest type is
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein present and is a supported digest type.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4596. [bug] Validate glue before adding it to the additional
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein section. This also fixes incorrect TTL capping
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein when the RRSIG expired earlier than the TTL.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4593. [doc] Update README using markdown, remove outdated FAQ
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein file in favor of the knowledge base.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4592. [bug] A race condition on shutdown could trigger an
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein assertion failure in dispatch.c. [RT #43822]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4591. [port] Addressed some python 3 compatibility issues.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Thanks to Ville Skytta. [RT #44955] [RT #44956]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4590. [bug] Support for PTHREAD_MUTEX_ADAPTIVE_NP was not being
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein properly detected. [RT #44871]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4589. [cleanup] "configure -q" is now silent. [RT #44829]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4588. [bug] nsupdate could send queries for TKEY to the wrong
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein server when using GSSAPI. Thanks to Tomas Hozza.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4587. [bug] named-checkzone failed to handle occulted data below
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein DNAMEs correctly. [RT #44877]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4586. [func] dig, host and nslookup now use TCP for ANY queries.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4585. [port] win32: Set CompileAS value. [RT #42474]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4584. [bug] A number of memory usage statistics were not properly
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein reported when they exceeded 4G. [RT #44750]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4574. [bug] Dig leaked memory with multiple +subnet options.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4555. [func] dig +ednsopt: EDNS options can now be specified by
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein name in addition to numeric value. [RT #44461]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein --- 9.11.1 released ---
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein --- 9.11.1rc3 released ---
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4582. [security] 'rndc ""' could trigger a assertion failure in named.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein (CVE-2017-3138) [RT #44924]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4581. [port] Linux: Add getpid and getrandom to the list of system
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein calls named uses for seccomp. [RT #44883]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4580. [bug] 4578 introduced a regression when handling CNAME to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein referral below the current domain. [RT #44850]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein --- 9.11.1rc2 released ---
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4578. [security] Some chaining (CNAME or DNAME) responses to upstream
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein queries could trigger assertion failures.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein (CVE-2017-3137) [RT #44734]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4575. [security] DNS64 with "break-dnssec yes;" can result in an
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein assertion failure. (CVE-2017-3136) [RT #44653]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein --- 9.11.1rc1 released ---
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4571. [bug] Out-of-tree builds of backtrace_test failed.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4570. [cleanup] named did not correctly fall back to the built-in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein initializing keys if the bind.keys file was present
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein but empty. [RT #44531]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4569. [func] Store both local and remote addresses in dnstap
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein logging, and modify dnstap-read output format to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein print them. [RT #43595]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4568. [contrib] Added a --with-bind option to the dnsperf configure
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein script to specify BIND prefix path.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4567. [port] Call getprotobyname and getservbyname prior to calling
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein chroot so that shared libraries get loaded. [RT #44537]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4565. [cleanup] The inline macro versions of isc_buffer_put*()
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein did not implement automatic buffer reallocation.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4564. [maint] Update the built in managed keys to include the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein upcoming root KSK. [RT #44579]
297be3708069ef31814d6d75c0d71a50a78feb03Mark Andrews4563. [bug] Modified zones would occasionally fail to reload.
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce4561. [port] Silence a warning in strict C99 compilers. [RT #44414]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4560. [bug] mdig: add -m option to enable memory debugging rather
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein than having it on all the time. [RT #44509]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4559. [bug] openssl_link.c didn't compile if ISC_MEM_TRACKLINES
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein was turned off. [RT #44509]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4558. [bug] Synthesised CNAME before matching DNAME was still
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein being cached when it should not have been. [RT #44318]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4557. [security] Combining dns64 and rpz can result in dereferencing
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein a NULL pointer (read). (CVE-2017-3135) [RT#44434]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4554. [bug] Remove double unlock in dns_dispatchmgr_setudp.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4553. [bug] Named could deadlock there were multiple changes to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein NSEC/NSEC3 parameters for a zone being processed at
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the same time. [RT #42770]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4552. [bug] Named could trigger a assertion when sending notify
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein messages. [RT #44019]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4551. [test] Add system tests for integrity checks of MX and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein SRV records. [RT #43953]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4550. [cleanup] Increased the number of available master file
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein output style flags from 32 to 64. [RT #44043]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4547. [port] Add support for --enable-native-pkcs11 on the AEP
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Keyper HSM. [RT #42463]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein --- 9.11.1b1 released ---
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4545. [func] Expand YAML output from dnstap-read to include
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein a detailed breakdown of the DNS message contents.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4544. [bug] Add message/payload size to dnstap-read YAML output.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4543. [bug] dns_client_startupdate now delays sending the update
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein request until isc_app_ctxrun has been called.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4541. [bug] rndc addzone should properly reject non master/slave
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein zones. [RT #43665]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4540. [bug] Correctly handle ecs entries in dns_acl_isinsecure.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4539. [bug] Referencing a nonexistent zone with RPZ could lead
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to a assertion failure when configuring. [RT #43787]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4538. [bug] Call dns_client_startresolve from client->task.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4537. [bug] Handle timeouts better in dig/host/nslookup. [RT #43576]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4536. [bug] ISC_SOCKEVENTATTR_USEMINMTU was not being cleared
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein when reusing the event structure. [RT #43885]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4535. [bug] Address race condition in setting / testing of
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein DNS_REQUEST_F_SENDING. [RT #43889]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4534. [bug] Only set RD, RA and CD in QUERY responses. [RT #43879]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4533. [bug] dns_client_update should terminate on prerequisite
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein failures (NXDOMAIN, YXDOMAIN, NXRRSET, YXRRSET)
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein and also on BADZONE. [RT #43865]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4532. [contrib] Make gen-data-queryperf.py python 3 compatible.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4531. [security] 'is_zone' was not being properly updated by redirect2
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein and subsequently preserved leading to an assertion
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein failure. (CVE-2016-9778) [RT #43837]
297be3708069ef31814d6d75c0d71a50a78feb03Mark Andrews4530. [bug] Change 4489 broke the handling of CNAME -> DNAME
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in responses resulting in SERVFAIL being returned.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews4529. [cleanup] Silence noisy log warning when DSCP probe fails
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews due to firewall rules. [RT #43847]
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce4528. [bug] Only set the flag bits for the i/o we are waiting
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein for on EPOLLERR or EPOLLHUP. [RT #43617]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4527. [doc] Support DocBook XSL Stylesheets v1.79.1. [RT #43831]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4526. [doc] Corrected errors and improved formatting of
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein grammar definitions in the ARM. [RT #43739]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews4525. [doc] Fixed outdated documentation on managed-keys.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4524. [bug] The net zero test was broken causing IPv4 servers
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews with addresses ending in .0 to be rejected. [RT #43776]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4523. [doc] Expand config doc for <querysource4> and
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <querysource6>. [RT #43768]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews4522. [bug] Handle big gaps in log file version numbers better.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews4521. [cleanup] Log it as an error if an entropy source is not
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews found and there is no fallback available. [RT #43659]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews4520. [cleanup] Alphabetize more of the grammar when printing it
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein out. Fix unbalanced indenting. [RT #43755]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4519. [port] win32: handle ERROR_MORE_DATA. [RT #43534]
47012ae6dbf18a2503d7b33c1c9583dc38625cb7Mark Andrews4517. [security] Named could mishandle authority sections that were
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews missing RRSIGs triggering an assertion failure.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein (CVE-2016-9444) [RT # 43632]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4516. [bug] isc_socketmgr_renderjson was missing from the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein windows build. [RT #43602]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews4515. [port] FreeBSD: Find readline headers when they are in
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews edit/readline/ instead of readline/. [RT #43658]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4514. [port] NetBSD: strip -WL, from ld command line. [RT #43204]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews4513. [cleanup] Minimum Python versions are now 2.7 and 3.2.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews4512. [bug] win32: @GEOIP_INC@ missing from delv.vcxproj.in.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews4511. [bug] win32: mdig.exe-BNFT was missing Configure. [RT #43554]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews4510. [security] Named mishandled some responses where covering RRSIG
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein records are returned without the requested data
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein resulting in a assertion failure. (CVE-2016-9147)
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews4509. [test] Make the rrl system test more reliable on slower
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews machines by using mdig instead of dig. [RT #43280]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews4508. [security] Named incorrectly tried to cache TKEY records which
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews could trigger a assertion failure when there was
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein a class mismatch. (CVE-2016-9131) [RT #43522]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4507. [bug] Named could incorrectly log 'allows updates by IP
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein address, which is insecure' [RT #43432]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4505. [port] Use IP_PMTUDISC_OMIT if available. [RT #35494]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews4504. [security] Allow the maximum number of records in a zone to
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews be specified. This provides a control for issues
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein raised in CVE-2016-6170. [RT #42143]
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews4503. [cleanup] "make uninstall" now removes files installed by
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein BIND. (This currently excludes Python files
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein due to lack of support in setup.py.) [RT #42192]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4502. [func] Report multiple and experimental options when printing
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein grammar. [RT #43134]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4500. [bug] Support modifier I64 in isc__print_printf. [RT #43526]
33682c92e96b39c395cdb2c3feb8eb5914e7d5a8Andreas Gustafsson4499. [port] MacOSX: silence deprecated function warning
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews by using arc4random_stir() when available
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews instead of arc4random_addrandom(). [RT #43503]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews4498. [test] Simplify prerequisite checks in system tests.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4497. [port] Add support for OpenSSL 1.1.0. [RT #41284]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4496. [func] dig: add +idnout to control whether labels are
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein display in punycode or not. Requires idn support
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews to be enabled at compile time. [RT #43398]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4495. [bug] A isc_mutex_init call was not being checked.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4494. [bug] Look for <editline/readline.h>. [RT #43429]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4493. [bug] bin/tests/system/dyndb/driver/Makefile.in should use
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein SO_TARGETS. [RT# 43336]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4492. [bug] irs_resconf_load failed to initialize sortlistnxt
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein causing bad writes if resolv.conf contained a
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews sortlist directive. [RT #43459]
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews4491. [bug] Improve message emitted when testing whether sendmsg
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein works with TOS/TCLASS fails. [RT #43483]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4490. [maint] Added AAAA (2001:500:12::d0d) for G.ROOT-SERVERS.NET.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews4489. [security] It was possible to trigger assertions when processing
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews a response containing a DNAME answer. (CVE-2016-8864)
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4488. [port] Darwin: use -framework for Kerberos. [RT #43418]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4487. [test] Make system tests work on Windows. [RT #42931]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4486. [bug] Look in $prefix/lib/pythonX.Y/site-packages for
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the python modules we install. [RT #43330]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4485. [bug] Failure to find readline when requested should be
297be3708069ef31814d6d75c0d71a50a78feb03Mark Andrews fatal to configure. [RT #43328]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4484. [func] Check prefixes in acls to make sure the address and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein prefix lengths are consistent. Warn only in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein BIND 9.11 and earlier. [RT #43367]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4483. [bug] Address use before require check and remove extraneous
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein dns_message_gettsigkey call in dns_tsig_sign.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4482. [cleanup] Change #4455 was incomplete. [RT #43252]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4478. [func] Add +continue option to mdig, allow continue on socket
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein errors. [RT #43281]
297be3708069ef31814d6d75c0d71a50a78feb03Mark Andrews4477. [test] Fix mkeys test timing issues. [RT #41028]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4476. [test] Fix reclimit test on slower machines. [RT #43283]
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce4475. [doc] Update named-checkconf documentation. [RT #43153]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4474. [bug] win32: call WSAStartup in fromtext_in_wks so that
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein getprotobyname and getservbyname work. [RT #43197]
297be3708069ef31814d6d75c0d71a50a78feb03Mark Andrews4473. [bug] Only call fsync / _commit on regular files. [RT #43196]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4472. [bug] Named could fail to find the correct NSEC3 records when
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein a zone was updated between looking for the answer and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein looking for the NSEC3 records proving nonexistence
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein of the answer. [RT #43247]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein --- 9.11.0 released ---
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein --- 9.11.0rc3 released ---
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4471. [cleanup] Render client/query logging format consistent for
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein ease of log file parsing. (Note that this affects
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein "querylog" format: there is now an additional field
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein indicating the client object address.) [RT #43238]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4470. [bug] Reset message with intent parse before
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein calling dns_dispatch_getnext. [RT #43229]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein --- 9.11.0rc2 released ---
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4468. [bug] Address ECS option handling issues. [RT #43191]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4467. [security] It was possible to trigger an assertion when
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein rendering a message. (CVE-2016-2776) [RT #43139]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4466. [bug] Interface scanning didn't work on a Windows system
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein without a non local IPv6 addresses. [RT #43130]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4465. [bug] Don't use "%z" as Windows doesn't support it.
7329012471d165cd3dc4180ad2a0a43de91e7f01Mark Andrews4464. [bug] Fix windows python support. [RT #43173]
7329012471d165cd3dc4180ad2a0a43de91e7f01Mark Andrews4463. [bug] The dnstap system test failed on some systems.
7329012471d165cd3dc4180ad2a0a43de91e7f01Mark Andrews4462. [bug] Don't describe a returned EDNS COOKIE as "good"
a1b05dea35aa30b152a47115e18bbe679d3fcf19Mark Andrews when there isn't a valid server cookie. [RT #43167]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4461. [bug] win32: not all external data was properly marked
7329012471d165cd3dc4180ad2a0a43de91e7f01Mark Andrews as external data for windows dll. [RT #43161]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein --- 9.11.0rc1 released ---
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4460. [test] Add system test for dnstap using unix domain sockets.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4459. [bug] TCP client objects created to handle pipeline queries
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein were not cleaned up correctly, causing uncontrolled
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein memory growth. [RT #43106]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4458. [cleanup] Update assertions to be more correct, and also remove
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein use of a reserved word. [RT #43090]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4457. [maint] Added AAAA (2001:500:a8::e) for E.ROOT-SERVERS.NET.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4456. [doc] Add DOCTYPE and lang attribute to <html> tags.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4455. [cleanup] Allow dyndb modules to correctly log the filename
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce and line number when processing configuration text
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein from named.conf. [RT #43050]
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce4454. [bug] 'rndc dnstap -reopen' had a race issue. [RT #43089]
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce4453. [bug] Prefetching of DS records failed to update their
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein RRSIGs. [RT #42865]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4452. [bug] The default key manager policy file is now
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <sysdir>/dnssec-policy.conf (usually
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4451. [cleanup] Log more useful information if a PKCS#11 provider
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein library cannot be loaded. [RT #43076]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4450. [port] Provide more nuanced HSM support which better matches
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the specific PKCS11 providers capabilities. [RT #42458]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4449. [test] Fix catalog zones test on slower systems. [RT #42997]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4448. [bug] win32: ::1 was not being found when iterating
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein interfaces. [RT #42993]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4447. [tuning] Allow the fstrm_iothr_init() options to be set using
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein named.conf to control how dnstap manages the data
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein flow. [RT #42974]
727f5b8846457a33d06f515a10a7e1aa849ddf18Andreas Gustafsson4446. [bug] The cache_find() and _findrdataset() functions
727f5b8846457a33d06f515a10a7e1aa849ddf18Andreas Gustafsson could find rdatasets that had been marked stale.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4445. [cleanup] isc_errno_toresult() can now be used to call the
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews formerly private function isc__errno2result().
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4444. [bug] Fixed some issues related to dyndb: A bug caused
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein braces to be omitted when passing configuration text
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein from named.conf to a dyndb driver, and there was a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein use-after-free in the sample dyndb driver. [RT #43050]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4443. [func] Set TCP_MAXSEG in addition to IPV6_USE_MIN_MTU on
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein TCP sockets. [RT #42864]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4442. [bug] Fix RPZ CIDR tree insertion bug that corrupted
297be3708069ef31814d6d75c0d71a50a78feb03Mark Andrews tree data structure with overlapping networks
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein (longest prefix match was ineffective).
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4441. [cleanup] Alphabetize host's help output. [RT #43031]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4440. [func] Enable TCP fast open support when available on the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein server side. [RT #42866]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4439. [bug] Address race conditions getting ownernames of nodes.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4438. [func] Use LIFO rather than FIFO when processing startup
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein notify and refresh queries. [RT #42825]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4437. [func] Minimal-responses now has two additional modes
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein no-auth and no-auth-recursive which suppress
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein adding the NS records to the authority section
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein as well as the associated address records for the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein nameservers. [RT #42005]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4436. [func] Return TLSA records as additional data for MX and SRV
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein lookups. [RT #42894]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4435. [tuning] Only set IPV6_USE_MIN_MTU for UDP when the message
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein will not fit into a single IPv4 encapsulated IPv6
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein UDP packet when transmitted over a Ethernet link.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4434. [protocol] Return EDNS EXPIRE option for master zones in addition
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to slave zones. [RT #43008]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4433. [cleanup] Report an error when passing an invalid option or
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein view name to "rndc dumpdb". [RT #42958]
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews4432. [test] Hide rndc output on expected failures in logfileconfig
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews system test. [RT #27996]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4431. [bug] named-checkconf now checks the rate-limit clause.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4430. [bug] Lwresd died if a search list was not defined.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Found by 0x710DDDD At Alibaba Security. [RT #42895]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4429. [bug] Address potential use after free on fclose() error.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4428. [bug] The "test dispatch getnext" unit test could fail
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in a threaded build. [RT #42979]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4427. [bug] The "query" and "response" parameters to the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein "dnstap" option had their functions reversed.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein --- 9.11.0b3 released ---
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4426. [bug] Addressed Coverity warnings. [RT #42908]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4425. [bug] arpaname, dnstap-read and named-rrchecker were not
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein being installed into ${prefix}/bin. Tidy up
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein installation issues with CHANGE 4421. [RT #42910]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4424. [experimental] Named now sends _ta-XXXX.<trust-anchor>/NULL queries
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to provide feedback to the trust-anchor administrators
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein about how key rollovers are progressing as per
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein draft-ietf-dnsop-edns-key-tag-02. This can be
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein disabled using 'trust-anchor-telemetry no;'.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4423. [maint] Added missing IPv6 address 2001:500:84::b for
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4422. [port] Silence clang warnings in dig.c and dighost.c.
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce4421. [func] When built with LMDB (Lightning Memory-mapped
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce Database), named will now use a database to store
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce the configuration for zones added by "rndc addzone"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein instead of using a flat NZF file. This improves
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein performance of "rndc delzone" and "rndc modzone"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein significantly. Existing NZF files will
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein automatically by converted to NZD databases.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein To view the contents of an NZD or to roll back to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein NZF format, use "named-nzd2nzf". To disable
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein this feature, use "configure --without-lmdb".
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4420. [func] nslookup now looks for AAAA as well as A by default.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4419. [bug] Don't cause undefined result if the label of an
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein entry in catalog zone is changed. [RT #42708]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4418. [bug] Fix a compiler warning in GSSAPI code. [RT #42879]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4417. [bug] dnssec-keymgr could fail to create successor keys
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein if the prepublication interval was set to a value
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein smaller than the default. [RT #42820]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4416. [bug] dnssec-keymgr: Domain names in policy files could
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein fail to match due to trailing dots. [RT #42807]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4415. [bug] dnssec-keymgr: Expired/deleted keys were not always
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein excluded. [RT #42884]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4414. [bug] Corrected a bug in the MIPS implementation of
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein isc_atomic_xadd(). [RT #41965]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4413. [bug] GSSAPI negotiation could fail if GSS_S_CONTINUE_NEEDED
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein was returned. [RT #42733]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein --- 9.11.0b2 released ---
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4412. [cleanup] Make fixes for GCC 6. ISC_OFFSET_MAXIMUM macro was
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein removed. [RT #42721]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4411. [func] "rndc dnstap -roll" automatically rolls the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein dnstap output file; the previous version is
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein saved with ".0" suffix, and earlier versions
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein with ".1" and so on. An optional numeric argument
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein indicates how many prior files to save. [RT #42830]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4410. [bug] Address use after free and memory leak with dnstap.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4409. [bug] DNS64 should exclude mapped addresses by default when
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein an exclude acl is not defined. [RT #42810]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4408. [func] Continue waiting for expected response when we the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein response we get does not match the request. [RT #41026]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4407. [performance] Use GCC builtin for clz in RPZ lookup code.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4406. [security] getrrsetbyname with a non absolute name could
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein trigger an infinite recursion bug in lwresd
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein and named with lwres configured if when combined
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein with a search list entry the resulting name is
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein too long. (CVE-2016-2775) [RT #42694]
47012ae6dbf18a2503d7b33c1c9583dc38625cb7Mark Andrews4405. [bug] Change 4342 introduced a regression where you could
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein not remove a delegation in a NSEC3 signed zone using
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein OPTOUT via nsupdate. [RT #42702]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4404. [misc] Allow krb5-config to be used when configuring gssapi.
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce4403. [bug] Rename variables and arguments that shadow: basename,
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce clone and gai_error.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4402. [bug] protoc-c is now a hard requirement for --enable-dnstap.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein --- 9.11.0b1 released ---
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4401. [misc] Change LICENSE to MPL 2.0.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4400. [bug] ttl policy was not being inherited in policy.py.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4399. [bug] policy.py 'ECCGOST', 'ECDSAP256SHA256', and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein 'ECDSAP384SHA384' don't have settable keysize.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4398. [bug] Correct spelling of ECDSAP256SHA256 in policy.py.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4397. [bug] Update Windows python support. [RT #42538]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4396. [func] dnssec-keymgr now takes a '-r randomfile' option.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4395. [bug] Improve out-of-tree installation of python modules.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4394. [func] Add rndc command "dnstap-reopen" to close and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein reopen dnstap output files. [RT #41803]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4393. [bug] Address potential NULL pointer dereferences in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein dnstap code.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4392. [func] Collect statistics for RSSAC02v3 traffic-volume,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein traffic-sizes and rcode-volume reporting. [RT #41475]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4391. [contrib] Fix leaks in contrib DLZ code. [RT #42707]
727f5b8846457a33d06f515a10a7e1aa849ddf18Andreas Gustafsson4390. [doc] Description of masters with TSIG, allow-query and
8e245ec21beee31a780de9b89ba1e8bb2b9f4c9aAndreas Gustafsson allow-transfer options in catalog zones. [RT #42692]
8e245ec21beee31a780de9b89ba1e8bb2b9f4c9aAndreas Gustafsson4389. [test] Rewritten test suite for catalog zones. [RT #42676]
7c0ebe385b36d64c2424dd5a3e62d441c08e7037Andreas Gustafsson4388. [func] Support for master entries with TSIG keys in catalog
727f5b8846457a33d06f515a10a7e1aa849ddf18Andreas Gustafsson zones. [RT #42577]
8e245ec21beee31a780de9b89ba1e8bb2b9f4c9aAndreas Gustafsson4387. [bug] Change 4336 was not complete leading to SERVFAIL
8e245ec21beee31a780de9b89ba1e8bb2b9f4c9aAndreas Gustafsson being return as NS records expired. [RT #42683]
8e245ec21beee31a780de9b89ba1e8bb2b9f4c9aAndreas Gustafsson4386. [bug] Remove shadowed overmem function/variable. [RT #42706]
8e245ec21beee31a780de9b89ba1e8bb2b9f4c9aAndreas Gustafsson4385. [func] Add support for allow-query and allow-transfer ACLs
8e245ec21beee31a780de9b89ba1e8bb2b9f4c9aAndreas Gustafsson to catalog zones. [RT #42578]
7c0ebe385b36d64c2424dd5a3e62d441c08e7037Andreas Gustafsson4384. [bug] Change 4256 accidentally disabled logging of the
727f5b8846457a33d06f515a10a7e1aa849ddf18Andreas Gustafsson rndc command. [RT #42654]
8e245ec21beee31a780de9b89ba1e8bb2b9f4c9aAndreas Gustafsson4383. [bug] Correct spelling error in stats channel description of
8e245ec21beee31a780de9b89ba1e8bb2b9f4c9aAndreas Gustafsson "EDNS client subnet option received". [RT #42633]
7c0ebe385b36d64c2424dd5a3e62d441c08e7037Andreas Gustafsson4382. [bug] rndc {addzone,modzone,delzone,showzone} should all
727f5b8846457a33d06f515a10a7e1aa849ddf18Andreas Gustafsson compare the zone name using a canonical format.
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce4381. [bug] Missing "zone-directory" option in catalog zone
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein definition caused BIND to crash. [RT #42579]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein --- 9.11.0a3 released ---
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4380. [experimental] Added a "zone-directory" option to "catalog-zones"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein syntax, allowing local masterfiles for slaves
47012ae6dbf18a2503d7b33c1c9583dc38625cb7Mark Andrews that are provisioned by catalog zones to be stored
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in a directory other than the server's working
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein directory. [RT #42527]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4379. [bug] An INSIST could be triggered if a zone contains
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein RRSIG records with expiry fields that loop
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein using serial number arithmetic. [RT #40571]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4378. [contrib] #include <isc/string.h> for strlcat in zone2ldap.c.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4377. [bug] Don't reuse zero TTL responses beyond the current
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein client set (excludes ANY/SIG/RRSIG queries).
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4376. [experimental] Added support for Catalog Zones, a new method for
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein provisioning secondary servers in which a list of
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein zones to be served is stored in a DNS zone and can
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein be propagated to slaves via AXFR/IXFR. [RT #41581]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4375. [func] Add support for automatic reallocation of isc_buffer
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to isc_buffer_put* functions. [RT #42394]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4374. [bug] Use SAVE/RESTORE macros in query.c to reduce the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein probability of reference counting errors as seen
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in 4365. [RT #42405]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4373. [bug] Address undefined behavior in getaddrinfo. [RT #42479]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4372. [bug] Address undefined behavior in libt_api. [RT #42480]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4371. [func] New "minimal-any" option reduces the size of UDP
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein responses for qtype ANY by returning a single
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein arbitrarily selected RRset instead of all RRsets.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Thanks to Tony Finch. [RT #41615]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4370. [bug] Address python3 compatibility issues with RNDC module.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein [RT #42499] [RT #42506]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein --- 9.11.0a2 released ---
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce4369. [bug] Fix 'make' and 'make install' out-of-tree python
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce support. [RT #42484]
727f5b8846457a33d06f515a10a7e1aa849ddf18Andreas Gustafsson4368. [bug] Fix a crash when calling "rndc stats" on some
727f5b8846457a33d06f515a10a7e1aa849ddf18Andreas Gustafsson Windows builds because some Visual Studio compilers
727f5b8846457a33d06f515a10a7e1aa849ddf18Andreas Gustafsson generated crashing code for the "%z" printf()
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein format specifier. [RT #42380]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4367. [bug] Remove unnecessary assignment of loadtime in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein zone_touched. [RT #42440]
727f5b8846457a33d06f515a10a7e1aa849ddf18Andreas Gustafsson4366. [bug] Address race condition when updating rbtnode bit
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein fields. [RT #42379]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4365. [bug] Address zone reference counting errors involving
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein nxdomain-redirect. [RT #42258]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4364. [port] freebsd: add -Wl,-E to loader flags [RT #41690]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4363. [port] win32: Disable explicit triggering UAC when running
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein BINDInstall.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4362. [func] Changed rndc reconfig behavior so that newly added
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein zones are loaded asynchronously and the loading does
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein not block the server. [RT #41934]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4361. [cleanup] Where supported, file modification times returned
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein by isc_file_getmodtime() are now accurate to the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein nanosecond. [RT #41968]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4360. [bug] Silence spurious 'bad key type' message when there is
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein a existing TSIG key. [RT #42195]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4359. [bug] Inherited 'also-notify' lists were not being checked
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein by named-checkconf. [RT #42174]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4358. [test] Added American Fuzzy Lop harness that allows
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein feeding fuzzed packets into BIND.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4357. [func] Add the python RNDC module. [RT #42093]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4356. [func] Add the ability to specify whether to wait for
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein nameserver addresses to be looked up or not to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein RPZ with a new modifying directive 'nsip-wait-recurse'.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4355. [func] "pkcs11-list" now displays the extractability
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein attribute of private or secret keys stored in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein an HSM, as either "true", "false", or "never"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Thanks to Daniel Stirnimann. [RT #36557]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4354. [bug] Check that the received HMAC length matches the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein expected length prior to check the contents on the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein control channel. This prevents a OOB read error.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein This was reported by Lian Yihan, <lianyihan@360.cn>.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4353. [cleanup] Update PKCS#11 header files. [RT #42175]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4352. [cleanup] The ISC DNSSEC Lookaside Validation (DLV) service
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein is scheduled to be disabled in 2017. A warning is
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein now logged when named is configured to use it,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein either explicitly or via "dnssec-lookaside auto;"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4351. [bug] 'dig +noignore' didn't work. [RT #42273]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4350. [contrib] Declare result in dlz_filesystem_dynamic.c.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4349. [contrib] kasp2policy: A python script to create a DNSSEC
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein policy file from an OpenDNSSEC KASP XML file.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4348. [func] dnssec-keymgr: A new python-based DNSSEC key
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein management utility, which reads a policy definition
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein file and can create or update DNSSEC keys as needed
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to ensure that a zone's keys match policy, roll over
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein correctly on schedule, etc. Thanks to Sebastian
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Castro for assistance in development. [RT #39211]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4347. [port] Corrected a build error on x86_64 Solaris. [RT #42150]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4346. [bug] Fixed a regression introduced in change #4337 which
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein caused signed domains with revoked KSKs to fail
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein validation. [RT #42147]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4345. [contrib] perftcpdns mishandled the return values from
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein clock_nanosleep. [RT #42131]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4344. [port] Address openssl version differences. [RT #42059]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4343. [bug] dns_dnssec_syncupdate mis-declared in <dns/dnssec.h>.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4342. [bug] 'rndc flushtree' could fail to clean the tree if there
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein wasn't a node at the specified name. [RT #41846]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein --- 9.11.0a1 released ---
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4341. [bug] Correct the handling of ECS options with
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein address family 0. [RT #41377]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4340. [performance] Implement adaptive read-write locks, reducing the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein overhead of locks that are only held briefly.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4339. [test] Use "mdig" to test pipelined queries. [RT #41929]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4338. [bug] Reimplement change 4324 as it wasn't properly doing
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein all the required book keeping. [RT #41941]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4337. [bug] The previous change exposed a latent flaw in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein key refresh queries for managed-keys when
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein a cached DNSKEY had TTL 0. [RT #41986]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4336. [bug] Don't emit records with zero ttl unless the records
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein were learnt with a zero ttl. [RT #41687]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4335. [bug] zone->view could be detached too early. [RT #41942]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4334. [func] 'named -V' now reports zlib version. [RT #41913]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4333. [maint] L.ROOT-SERVERS.NET is now 199.7.83.42 and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein 2001:500:9f::42.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4332. [placeholder]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4331. [func] When loading managed signed zones detect if the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein RRSIG's inception time is in the future and regenerate
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the RRSIG immediately. [RT #41808]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4330. [protocol] Identify the PAD option as "PAD" when printing out
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4329. [func] Warn about a common misconfiguration when forwarding
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein RFC 1918 zones. [RT #41441]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4328. [performance] Add dns_name_fromwire() benchmark test. [RT #41694]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4327. [func] Log query and depth counters during fetches when
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein querytrace (./configure --enable-querytrace) is
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein enabled (helps in diagnosing). [RT #41787]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4326. [protocol] Add support for AVC. [RT #41819]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4325. [func] Add a line to "rndc status" indicating the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein hostname and operating system details. [RT #41610]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4324. [bug] When deleting records from a zone database, interior
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein nodes could be left empty but not deleted, damaging
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein search performance afterward. [RT #40997]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4323. [bug] Improve HTTP header processing on statschannel.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4322. [security] Duplicate EDNS COOKIE options in a response could
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein trigger an assertion failure. (CVE-2016-2088)
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4321. [bug] Zones using mapped files containing out-of-zone data
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein could return SERVFAIL instead of the expected NODATA
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein or NXDOMAIN results. [RT #41596]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4320. [bug] Insufficient memory allocation when handling
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein "none" ACL could cause an assertion failure in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein named when parsing ACL configuration. [RT #41745]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4319. [security] Fix resolver assertion failure due to improper
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein DNAME handling when parsing fetch reply messages.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein (CVE-2016-1286) [RT #41753]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4318. [security] Malformed control messages can trigger assertions
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in named and rndc. (CVE-2016-1285) [RT #41666]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4317. [bug] Age all unused servers on fetch timeout. [RT #41597]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4316. [func] Add option to tools to print RRs in unknown
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein presentation format [RT #41595].
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4315. [bug] Check that configured view class isn't a meta class.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein [RT #41572].
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4314. [contrib] Added 'dnsperf-2.1.0.0-1', a set of performance
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein testing tools provided by Nominum, Inc.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4313. [bug] Handle ns_client_replace failures in test mode.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4312. [bug] dig's unknown DNS and EDNS flags (MBZ value) logging
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein was not consistent. [RT #41600]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4311. [bug] Prevent "rndc delzone" from being used on
bea931e17b7567f09107f93ab7e25c7f00abeb9cMark Andrews response-policy zones. [RT #41593]
47b6d855e3a569e46ec2481dd1abb62e99752817Mark Andrews4310. [performance] Use __builtin_expect() where available to annotate
47b6d855e3a569e46ec2481dd1abb62e99752817Mark Andrews conditions with known behavior. [RT #41411]
7526edc7677371c366232de5f39a678b7dcda747Mark Andrews4309. [cleanup] Remove the spurious "none" filename from log messages
7526edc7677371c366232de5f39a678b7dcda747Mark Andrews when processing built-in configuration. [RT #41594]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4308. [func] Added operating system details to "named -V"
47b6d855e3a569e46ec2481dd1abb62e99752817Mark Andrews output. [RT #41452]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4307. [bug] "dig +subnet" and "mdig +subnet" could send
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein incorrectly-formatted Client Subnet options
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein if the prefix length was not divisible by 8.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Also fixed a memory leak in "mdig". [RT #45178]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4306. [maint] Added a PKCS#11 openssl patch supporting
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein version 1.0.2f [RT #38312]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4305. [bug] dnssec-signzone was not removing unnecessary rrsigs
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein from the zone's apex. [RT #41483]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4304. [port] xfer system test failed as 'tail -n +value' is not
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein portable. [RT #41315]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4303. [bug] "dig +subnet" was unable to send a prefix length of
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein zero, as it was incorrectly changed to 32 for v4
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein prefixes or 128 for v6 prefixes. In addition to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein fixing this, "dig +subnet=0" has been added as a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein short form for 0.0.0.0/0. The same changes have
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein also been made in "mdig". [RT #41553]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4302. [port] win32: fixed a build error in VS 2015. [RT #41426]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4301. [bug] dnssec-settime -p [DP]sync was not working. [RT #41534]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4300. [bug] A flag could be set in the wrong field when setting
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein up non-recursive queries; this could cause the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein SERVFAIL cache to cache responses it shouldn't.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein New querytrace logging has been added which
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein identified this error. [RT #41155]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4299. [bug] Check that exactly totallen bytes are read when
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein reading a RRset from raw files in both single read
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein and incremental modes. [RT #41402]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4298. [bug] dns_rpz_add errors in loadzone were not being
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein propagated up the call stack. [RT #41425]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4297. [test] Ensure delegations in RPZ zones fail robustly.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4296. [bug] TCP packet sizes were calculated incorrectly in the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein stats channel; they could be counted in the wrong
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein histogram bucket. [RT #40587]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4295. [bug] An unchecked result in dns_message_pseudosectiontotext()
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein could allow incorrect text formatting of EDNS EXPIRE
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein options. [RT #41437]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4294. [bug] Fixed a regression in which "rndc stop -p" failed
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to print the PID. [RT #41513]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4293. [bug] Address memory leak on priming query creation failure.
f7b41fd9291b8f4dba27e2b57e1d93f0913a4f1dMark Andrews4292. [placeholder]
f7b41fd9291b8f4dba27e2b57e1d93f0913a4f1dMark Andrews4291. [cleanup] Added a required include to dns/forward.h. [RT #41474]
f7b41fd9291b8f4dba27e2b57e1d93f0913a4f1dMark Andrews4290. [func] The timers returned by the statistics channel
f7b41fd9291b8f4dba27e2b57e1d93f0913a4f1dMark Andrews (indicating current time, server boot time, and
f7b41fd9291b8f4dba27e2b57e1d93f0913a4f1dMark Andrews most recent reconfiguration time) are now reported
f7b41fd9291b8f4dba27e2b57e1d93f0913a4f1dMark Andrews with millisecond accuracy. [RT #40082]
f7b41fd9291b8f4dba27e2b57e1d93f0913a4f1dMark Andrews4289. [bug] The server could crash due to memory being used
12351e0500dff39f56844401fd191a36bcc4a7adMark Andrews after it was freed if a zone transfer timed out.
f7b41fd9291b8f4dba27e2b57e1d93f0913a4f1dMark Andrews4288. [bug] Fixed a regression in resolver.c:possibly_mark()
f7b41fd9291b8f4dba27e2b57e1d93f0913a4f1dMark Andrews which caused known-bogus servers to be queried
f7b41fd9291b8f4dba27e2b57e1d93f0913a4f1dMark Andrews anyway. [RT #41321]
f7b41fd9291b8f4dba27e2b57e1d93f0913a4f1dMark Andrews4287. [bug] Silence an overly noisy log message when message
12351e0500dff39f56844401fd191a36bcc4a7adMark Andrews parsing fails. [RT #41374]
12351e0500dff39f56844401fd191a36bcc4a7adMark Andrews4286. [security] render_ecs errors were mishandled when printing out
12351e0500dff39f56844401fd191a36bcc4a7adMark Andrews a OPT record resulting in a assertion failure.
f7b41fd9291b8f4dba27e2b57e1d93f0913a4f1dMark Andrews (CVE-2015-8705) [RT #41397]
f7b41fd9291b8f4dba27e2b57e1d93f0913a4f1dMark Andrews4285. [security] Specific APL data could trigger a INSIST.
f7b41fd9291b8f4dba27e2b57e1d93f0913a4f1dMark Andrews (CVE-2015-8704) [RT #41396]
12351e0500dff39f56844401fd191a36bcc4a7adMark Andrews4284. [bug] Some GeoIP options were incorrectly documented
f7b41fd9291b8f4dba27e2b57e1d93f0913a4f1dMark Andrews using abbreviated forms which were not accepted by
12351e0500dff39f56844401fd191a36bcc4a7adMark Andrews named. The code has been updated to allow both
12351e0500dff39f56844401fd191a36bcc4a7adMark Andrews long and abbreviated forms. [RT #41381]
f7b41fd9291b8f4dba27e2b57e1d93f0913a4f1dMark Andrews4283. [bug] OPENSSL_config is no longer re-callable. [RT #41348]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4282. [func] 'dig +[no]mapped' determine whether the use of mapped
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein IPv4 addresses over IPv6 is permitted or not. The
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein default is +mapped. [RT #41307]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4281. [bug] Teach dns_message_totext about BADCOOKIE. [RT #41257]
297be3708069ef31814d6d75c0d71a50a78feb03Mark Andrews4280. [performance] Use optimal message sizes to improve compression
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in AXFRs. This reduces network traffic. [RT #40996]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4279. [test] Don't use fixed ports when unit testing. [RT #41194]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4278. [bug] 'delv +short +[no]split[=##]' didn't work as expected.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4277. [performance] Improve performance of the RBT, the central zone
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein datastructure: The aux hashtable was improved,
4e243fdc6b33a6371208b48d64912d8e327b4f5cAndreas Gustafsson hash function was updated to perform more
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein uniform mapping, uppernode was added to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein dns_rbtnode, and other cleanups and performance
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein improvements were made. [RT #41165]
297be3708069ef31814d6d75c0d71a50a78feb03Mark Andrews4276. [protocol] Add support for SMIMEA. [RT #40513]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4275. [performance] Lazily initialize dns_compress->table only when
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein compression is enabled. [RT #41189]
bea931e17b7567f09107f93ab7e25c7f00abeb9cMark Andrews4274. [performance] Speed up typemap processing from text. [RT #41196]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4273. [bug] Only call dns_test_begin() and dns_test_end() once each
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in nsec3_test as it fails with GOST if called multiple
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4272. [bug] dig: the +norrcomments option didn't work with +multi.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4271. [test] Unit tests could deadlock in isc__taskmgr_pause().
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4270. [security] Update allowed OpenSSL versions as named is
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein potentially vulnerable to CVE-2015-3193.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4269. [bug] Zones using "map" format master files currently
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein don't work as policy zones. This limitation has
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein now been documented; attempting to use such zones
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in "response-policy" statements is now a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein configuration error. [RT #38321]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4268. [func] "rndc status" now reports the path to the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein configuration file. [RT #36470]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4267. [test] Check sdlz error handling. [RT #41142]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4266. [placeholder]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4265. [bug] Address unchecked isc_mem_get calls. [RT #41187]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4264. [bug] Check const of strchr/strrchr assignments match
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein argument's const status. [RT #41150]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4263. [contrib] Address compiler warnings in mysqldyn module.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4262. [bug] Fixed a bug in epoll socket code that caused
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein sockets to not be registered for ready
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein notification in some cases, causing named to not
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein read from or write to them, resulting in what
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein appear to the user as blocked connections.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4261. [maint] H.ROOT-SERVERS.NET is 198.97.190.53 and 2001:500:1::53.
297be3708069ef31814d6d75c0d71a50a78feb03Mark Andrews4260. [security] Insufficient testing when parsing a message allowed
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein records with an incorrect class to be be accepted,
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews triggering a REQUIRE failure when those records
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein were subsequently cached. (CVE-2015-8000) [RT #40987]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4259. [func] Add an option for non-destructive control channel
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein access using a "read-only" clause. In such
297be3708069ef31814d6d75c0d71a50a78feb03Mark Andrews cases, a restricted set of rndc commands are
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein allowed for querying information from named.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4258. [bug] Limit rndc query message sizes to 32 KiB. This should
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein not break any legitimate rndc commands, but will
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein prevent a rogue rndc query from allocating too
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein much memory. [RT #41073]
297be3708069ef31814d6d75c0d71a50a78feb03Mark Andrews4257. [cleanup] Python scripts reported incorrect version. [RT #41080]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4256. [bug] Allow rndc command arguments to be quoted so as
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to allow spaces. [RT #36665]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4255. [performance] Add 'message-compression' option to disable DNS
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein compression in responses. [RT #40726]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4254. [bug] Address missing lock when getting zone's serial.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4253. [security] Address fetch context reference count handling error
acb72d5e2c83b597332e3eb0c7d59e1142f1adfdMark Andrews on socket error. (CVE-2015-8461) [RT#40945]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4252. [func] Add support for automating the generation CDS and
22c71c7b86fa57a19f7df0da4222eb8593e6ad12Mark Andrews CDNSKEY rrsets to named and dnssec-signzone.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4251. [bug] NTAs were deleted when the server was reconfigured
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein or reloaded. [RT #41058]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4250. [func] Log the TSIG key in use during inbound zone
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein transfers. [RT #41075]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4249. [func] Improve error reporting of TSIG / SIG(0) records in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the wrong location. [RT #41030]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4248. [performance] Add an isc_atomic_storeq() function, use it in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein stats counters to improve performance.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein [RT #39972] [RT #39979]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4247. [port] Require both HAVE_JSON and JSON_C_VERSION to be
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein defined to report json library version. [RT #41045]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4246. [test] Ensure the statschannel system test runs when BIND
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein is not built with libjson. [RT #40944]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4245. [placeholder]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4244. [bug] The parser was not reporting that use-ixfr is obsolete.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4243. [func] Improved stats reporting from Timothe Litt. [RT #38941]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4242. [bug] Replace the client if not already replaced when
7326ba2f542b89196323867a1457f596f99e315dMark Andrews prefetching. [RT #41001]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews4241. [doc] Improved the TSIG, TKEY, and SIG(0) sections in
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews the ARM. [RT #40955]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews4240. [port] Fix LibreSSL compatibility. [RT #40977]
3a3705ef7747327df182bf8d009333d2472253d5Mark Andrews4239. [func] Changed default servfail-ttl value to 1 second from 10.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Also, the maximum value is now 30 instead of 300.
3b4098640dd85040270f39b9a5ee5e22de99d3d6Mark Andrews4238. [bug] Don't send to servers on net zero (0.0.0.0/8).
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4237. [doc] Upgraded documentation toolchain to use DocBook 5
68b30890ebd441a6a1ae3fdf71744d07d02cd030Mark Andrews and dblatex. [RT #40766]
68b30890ebd441a6a1ae3fdf71744d07d02cd030Mark Andrews4236. [performance] On machines with 2 or more processors (CPU), the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein default value for the number of UDP listeners
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein has been changed to the number of detected
68b30890ebd441a6a1ae3fdf71744d07d02cd030Mark Andrews processors minus one. [RT #40761]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4235. [func] Added support in named for "dnstap", a fast method of
083a5588a3488b6335ee7bafa505d00644c7c58dMark Andrews capturing and logging DNS traffic, and a new command
6bf6622b7b9053dc52527478473b572f042c4b5bMark Andrews "dnstap-read" to read a dnstap log file. Use
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein "configure --enable-dnstap" to enable this
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein feature (note that this requires libprotobuf-c
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein and libfstrm). See the ARM for configuration details.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Thanks to Robert Edmonds of Farsight Security.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews4234. [func] Add deflate compression in statistics channel HTTP
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews server. [RT #40861]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews4233. [test] Add tests for CDS and CDNSKEY with delegation-only.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews4232. [contrib] Address unchecked memory allocation calls in
a404eb87dc8f91fe81bedce8bb3957fc3c7684a5Mark Andrews query-loc and zone2ldap. [RT #40789]
89bc48260b64a8859ae717e9e5bae380e275fef4Mark Andrews4231. [contrib] Address unchecked calloc call in dlz_mysqldyn_mod.c.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4230. [contrib] dlz_wildcard_dynamic.c:dlz_create could return a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein uninitialized result. [RT #40839]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4229. [bug] A variable could be used uninitialized in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein dns_update_signaturesinc. [RT #40784]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4228. [bug] Address race condition in dns_client_destroyrestrans.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4227. [bug] Silence static analysis warnings. [RT #40828]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4226. [bug] Address a theoretical shutdown race in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein zone.c:notify_send_queue(). [RT #38958]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4225. [port] freebsd/openbsd: Use '${CC} -shared' for building
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein shared libraries. [RT #39557]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4224. [func] Added support for "dyndb", a new interface for loading
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein zone data from an external database, developed by
7526edc7677371c366232de5f39a678b7dcda747Mark Andrews Red Hat for the FreeIPA project.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein DynDB drivers fully implement the BIND database
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein API, and are capable of significantly better
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein performance and functionality than DLZ drivers,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein while taking advantage of advanced database
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein features not available in BIND such as multi-master
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein replication.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Thanks to Adam Tkac and Petr Spacek of Red Hat.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4223. [func] Add support for setting max-cache-size to percentage
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein of available physical memory, set default to 90%.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4222. [func] Bias IPv6 servers when selecting the next server to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein query. [RT #40836]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4221. [bug] Resource leak on DNS_R_NXDOMAIN in fctx_create.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4220. [doc] Improve documentation for zone-statistics.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4219. [bug] Set event->result to ISC_R_WOULDBLOCK on EWOULDBLOCK,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein EGAIN when these soft error are not retried for
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein isc_socket_send*().
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4218. [bug] Potential null pointer dereference on out of memory
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein if mmap is not supported. [RT #40777]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4217. [protocol] Add support for CSYNC. [RT #40532]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4216. [cleanup] Silence static analysis warnings. [RT #40649]
3b4098640dd85040270f39b9a5ee5e22de99d3d6Mark Andrews4215. [bug] nsupdate: skip to next request on GSSTKEY create
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein failure. [RT #40685]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4214. [protocol] Add support for TALINK. [RT #40544]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4213. [bug] Don't reuse a cache across multiple classes.
538a83db7509d598da95a93bd7b74ef3112123a4Mark Andrews4212. [func] Re-query if we get a bad client cookie returned over
7208386cd37a2092c70eddf80cf29519b16c4c80Mark Andrews UDP. [RT #40748]
1586d8cbac5d73031716561386f60758c6c332d5Mark Andrews4211. [bug] Ensure that lwresd gets at least one task to work
1586d8cbac5d73031716561386f60758c6c332d5Mark Andrews with if enabled. [RT #40652]
3b4098640dd85040270f39b9a5ee5e22de99d3d6Mark Andrews4210. [cleanup] Silence use after free false positive. [RT #40743]
92554adb458c7b336e5390c5c9fbf2fcc1276524Mark Andrews4209. [bug] Address resource leaks in dlz modules. [RT #40654]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4208. [bug] Address null pointer dereferences on out of memory.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4207. [bug] Handle class mismatches with raw zone files.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4206. [bug] contrib: fixed a possible NULL dereference in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein DLZ wildcard module. [RT #40745]
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews4205. [bug] 'named-checkconf -p' could include unwanted spaces
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein when printing tuples with unset optional fields.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4204. [bug] 'dig +trace' failed to lookup the correct type if
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the initial root NS query was retried. [RT #40296]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4203. [test] The rrchecker system test now tests conversion
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to and from unknown-type format. [RT #40584]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4202. [bug] isccc_cc_fromwire() could return an incorrect
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein result. [RT #40614]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4201. [func] The default preferred-glue is now the address record
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein type of the transport the query was received
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein over. [RT #40468]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews4200. [cleanup] win32: update BINDinstall to be BIND release
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein independent. [RT #38915]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4199. [protocol] Add support for NINFO, RKEY, SINK, TA.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein [RT #40545] [RT #40547] [RT #40561] [RT #40563]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4198. [placeholder]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4197. [bug] 'named-checkconf -z' didn't handle 'in-view' clauses.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4196. [doc] Improve how "enum + other" types are documented.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4195. [bug] 'max-zone-ttl unlimited;' was broken. [RT #40608]
acb72d5e2c83b597332e3eb0c7d59e1142f1adfdMark Andrews4194. [bug] named-checkconf -p failed to properly print a port
acb72d5e2c83b597332e3eb0c7d59e1142f1adfdMark Andrews range. [RT #40634]
acb72d5e2c83b597332e3eb0c7d59e1142f1adfdMark Andrews4193. [bug] Handle broken servers that return BADVERS incorrectly.
acb72d5e2c83b597332e3eb0c7d59e1142f1adfdMark Andrews4192. [bug] The default rrset-order of random was not always being
acb72d5e2c83b597332e3eb0c7d59e1142f1adfdMark Andrews applied. [RT #40456]
acb72d5e2c83b597332e3eb0c7d59e1142f1adfdMark Andrews4191. [protocol] Accept DNS-SD non LDH PTR records in reverse zones
acb72d5e2c83b597332e3eb0c7d59e1142f1adfdMark Andrews as per RFC 6763. [RT #37889]
acb72d5e2c83b597332e3eb0c7d59e1142f1adfdMark Andrews4190. [protocol] Accept Active Directory gc._msdcs.<forest> name as
a1b05dea35aa30b152a47115e18bbe679d3fcf19Mark Andrews valid with check-names. <forest> still needs to be
acb72d5e2c83b597332e3eb0c7d59e1142f1adfdMark Andrews LDH. [RT #40399]
acb72d5e2c83b597332e3eb0c7d59e1142f1adfdMark Andrews4189. [cleanup] Don't exit on overly long tokens in named.conf.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4188. [bug] Support HTTP/1.0 client properly on the statistics
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein channel. [RT #40261]
acb72d5e2c83b597332e3eb0c7d59e1142f1adfdMark Andrews4187. [func] When any RR type implementation doesn't
acb72d5e2c83b597332e3eb0c7d59e1142f1adfdMark Andrews implement totext() for the RDATA's wire
acb72d5e2c83b597332e3eb0c7d59e1142f1adfdMark Andrews representation and returns ISC_R_NOTIMPLEMENTED,
acb72d5e2c83b597332e3eb0c7d59e1142f1adfdMark Andrews such RDATA is now printed in unknown
acb72d5e2c83b597332e3eb0c7d59e1142f1adfdMark Andrews presentation format (RFC 3597). RR types affected
acb72d5e2c83b597332e3eb0c7d59e1142f1adfdMark Andrews include LOC(29) and APL(42). [RT #40317].
acb72d5e2c83b597332e3eb0c7d59e1142f1adfdMark Andrews4186. [bug] Fixed an RPZ bug where a QNAME would be matched
acb72d5e2c83b597332e3eb0c7d59e1142f1adfdMark Andrews against a policy RR with wildcard owner name
acb72d5e2c83b597332e3eb0c7d59e1142f1adfdMark Andrews (trigger) where the QNAME was the wildcard owner
acb72d5e2c83b597332e3eb0c7d59e1142f1adfdMark Andrews name's parent. For example, the bug caused a query
acb72d5e2c83b597332e3eb0c7d59e1142f1adfdMark Andrews with QNAME "example.com" to match a policy RR with
acb72d5e2c83b597332e3eb0c7d59e1142f1adfdMark Andrews "*.example.com" as trigger. [RT #40357]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4185. [bug] Fixed an RPZ bug where a policy RR with wildcard
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein owner name (trigger) would prevent another policy RR
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein with its parent owner name from being
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein loaded. For example, the bug caused a policy RR
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein with trigger "example.com" to not have any
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein effect when a previous policy RR with trigger
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein "*.example.com" existed in that RPZ zone.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4184. [bug] Fixed a possible memory leak in name compression
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein when rendering long messages. (Also, improved
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein wire_test for testing such messages.) [RT #40375]
22c71c7b86fa57a19f7df0da4222eb8593e6ad12Mark Andrews4183. [cleanup] Use timing-safe memory comparisons in cryptographic
22c71c7b86fa57a19f7df0da4222eb8593e6ad12Mark Andrews code. Also, the timing-safe comparison functions have
22c71c7b86fa57a19f7df0da4222eb8593e6ad12Mark Andrews been renamed to avoid possible confusion with
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein memcmp(). Thanks to Loganaden Velvindron of
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein AFRINIC. [RT #40148]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4182. [cleanup] Use mnemonics for RR class and type comparisons.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4181. [bug] Queued notify messages could be dequeued from the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein wrong rate limiter queue. [RT #40350]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4180. [bug] Error responses in pipelined queries could
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein cause a crash in client.c. [RT #40289]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4179. [bug] Fix double frees in getaddrinfo() in libirs.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4178. [bug] Fix assertion failure in parsing UNSPEC(103) RR from
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein text. [RT #40274]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4177. [bug] Fix assertion failure in parsing NSAP records from
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein text. [RT #40285]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4176. [bug] Address race issues with lwresd. [RT #40284]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4175. [bug] TKEY with GSS-API keys needed bigger buffers.
1224c3b69b3d18f7127aa042644936af25a2d679Mark Andrews4174. [bug] "dnssec-coverage -r" didn't handle time unit
1224c3b69b3d18f7127aa042644936af25a2d679Mark Andrews suffixes correctly. [RT #38444]
1224c3b69b3d18f7127aa042644936af25a2d679Mark Andrews4173. [bug] dig +sigchase was not properly matching the trusted
1224c3b69b3d18f7127aa042644936af25a2d679Mark Andrews key. [RT #40188]
1224c3b69b3d18f7127aa042644936af25a2d679Mark Andrews4172. [bug] Named / named-checkconf didn't handle a view of CLASS0.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4171. [bug] Fixed incorrect class checks in TSIG RR
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein implementation. [RT #40287]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4170. [security] An incorrect boundary check in the OPENPGPKEY
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein rdatatype could trigger an assertion failure.
47012ae6dbf18a2503d7b33c1c9583dc38625cb7Mark Andrews (CVE-2015-5986) [RT #40286]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4169. [test] Added a 'wire_test -d' option to read input as
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein raw binary data, for use as a fuzzing harness.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4168. [security] A buffer accounting error could trigger an
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein assertion failure when parsing certain malformed
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein DNSSEC keys. (CVE-2015-5722) [RT #40212]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4167. [func] Update rndc's usage output to include recently added
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein commands. Thanks to Tony Finch for submitting a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein patch. [RT #40010]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4166. [func] Print informative output from rndc showzone when
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein allow-new-zones is not enabled for a view. Thanks to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Tony Finch for submitting a patch. [RT #40009]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4165. [security] A failure to reset a value to NULL in tkey.c could
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein result in an assertion failure. (CVE-2015-5477)
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4164. [bug] Don't rename slave files and journals on out of memory.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4163. [bug] Address compiler warnings. [RT #40024]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4162. [bug] httpdmgr->flags was not being initialized. [RT #40017]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4161. [test] Add JSON test for traffic size stats; also test
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein for consistency between "rndc stats" and the XML
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein and JSON statistics channel contents. [RT #38700]
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews4160. [placeholder]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4159. [cleanup] Alphabetize dig's help output. [RT #39966]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4158. [placeholder]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4157. [placeholder]
47012ae6dbf18a2503d7b33c1c9583dc38625cb7Mark Andrews4156. [func] Added statistics counters to track the sizes
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein of incoming queries and outgoing responses in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein histogram buckets, as specified in RSSAC002.
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews4155. [func] Allow RPZ rewrite logging to be configured on a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein per-zone basis using a newly introduced log clause in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the response-policy option. [RT #39754]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4154. [bug] A OPT record should be included with the FORMERR
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews response when there is a malformed EDNS option.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4153. [bug] Dig should zero non significant +subnet bits. Check
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein that non significant ECS bits are zero on receipt.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4152. [func] Implement DNS COOKIE option. This replaces the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein experimental SIT option of BIND 9.10. The following
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein named.conf directives are available: send-cookie,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein cookie-secret, cookie-algorithm, nocookie-udp-size
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein and require-server-cookie. The following dig options
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein are available: +[no]cookie[=value] and +[no]badcookie.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4151. [bug] 'rndc flush' could cause a deadlock. [RT #39835]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4150. [bug] win32: listen-on-v6 { any; }; was not working. Apply
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein minimal fix. [RT #39667]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4149. [bug] Fixed a race condition in the getaddrinfo()
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein implementation in libirs, which caused the delv
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein utility to crash with an assertion failure when using
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the '@server' syntax with a hostname argument.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4148. [bug] Fix a bug when printing zone names with '/' character
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in XML and JSON statistics output. [RT #39873]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4147. [bug] Filter-aaaa / filter-aaaa-on-v4 / filter-aaaa-on-v6
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein was returning referrals rather than nodata responses
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein when the AAAA records were filtered. [RT #39843]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4146. [bug] Address reference leak that could prevent a clean
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews shutdown. [RT #37125]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4145. [bug] Not all unassociated adb entries where being printed.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4144. [func] Add statistics counters for nxdomain redirections.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4143. [placeholder]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4142. [bug] rndc addzone with view specified saved NZF config
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein that could not be read back by named. This has now
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein been fixed. [RT #39845]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4141. [bug] A formatting bug caused rndc zonestatus to print
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein negative numbers for large serial values. This has
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein now been fixed. [RT #39854]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4140. [cleanup] Remove redundant nzf_remove() call during delzone.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4139. [doc] Fix rpz-client-ip documentation. [RT #39783]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4138. [security] An uninitialized value in validator.c could result
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in an assertion failure. (CVE-2015-4620) [RT #39795]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4137. [bug] Make rndc reconfig report configuration errors the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein same way rndc reload does. [RT #39635]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4136. [bug] Stale statistics counters with the leading
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews '#' prefix (such as #NXDOMAIN) were not being
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein updated correctly. This has been fixed. [RT #39141]
71eeac3530eabb7f70f4b6bdba5addb40a5bca27Mark Andrews4135. [cleanup] Log expired NTA at startup. [RT #39680]
71eeac3530eabb7f70f4b6bdba5addb40a5bca27Mark Andrews4134. [cleanup] Include client-ip rules when logging the number
71eeac3530eabb7f70f4b6bdba5addb40a5bca27Mark Andrews of RPZ rules of each type. [RT #39670]
71eeac3530eabb7f70f4b6bdba5addb40a5bca27Mark Andrews4133. [port] Update how various json libraries are handled.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4132. [cleanup] dig: added +rd as a synonym for +recurse,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein added +class as an unabbreviated alternative
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to +cl. [RT #39686]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4131. [bug] Addressed further problems with reloading RPZ
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein zones. [RT #39649]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4130. [bug] The compatibility shim for *printf() misprinted some
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein large numbers. [RT #39586]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4129. [port] Address API changes in OpenSSL 1.1.0. [RT #39532]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4128. [bug] Address issues raised by Coverity 7.6. [RT #39537]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4127. [protocol] CDS and CDNSKEY need to be signed by the key signing
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein key as per RFC 7344, Section 4.1. [RT #37215]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4126. [bug] Addressed a regression introduced in change #4121.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4125. [test] Added tests for dig, renamed delv test to digdelv.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4124. [func] Log errors or warnings encountered when parsing the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein internal default configuration. Clarify the logging
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews of errors and warnings encountered in rndc
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein addzone or modzone parameters. [RT #39440]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4123. [port] Added %z (size_t) format options to the portable
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein internal printf/sprintf implementation. [RT #39586]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4122. [bug] The server could match a shorter prefix than what was
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein available in CLIENT-IP policy triggers, and so, an
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein unexpected action could be taken. This has been
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein corrected. [RT #39481]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4121. [bug] On servers with one or more policy zones
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein configured as slaves, if a policy zone updated
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein during regular operation (rather than at
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein startup) using a full zone reload, such as via
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein AXFR, a bug could allow the RPZ summary data to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein fall out of sync, potentially leading to an
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein assertion failure in rpz.c when further
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein incremental updates were made to the zone, such
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein as via IXFR. [RT #39567]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4120. [bug] A bug in RPZ could cause the server to crash if
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein policy zones were updated while recursion was
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein pending for RPZ processing of an active query.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4119. [test] Allow dig to set the message opcode. [RT #39550]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4118. [bug] Teach isc-config.sh about irs. [RT #39213]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4117. [protocol] Add EMPTY.AS112.ARPA as per RFC 7534.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4116. [bug] Fix a bug in RPZ that could cause some policy
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein zones that did not specifically require
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein recursion to be treated as if they did;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein consequently, setting qname-wait-recurse no; was
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein sometimes ineffective. [RT #39229]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4115. [func] "rndc -r" now prints the result code (e.g.,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein ISC_R_SUCCESS, ISC_R_TIMEOUT, etc) after
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein running the requested command. [RT #38913]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4114. [bug] Fix a regression in radix tree implementation
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein introduced by ECS code. This bug was never
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein released, but it was reported by a user testing
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein master. [RT #38983]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4113. [test] Check for Net::DNS is some system test
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein prerequisites. [RT #39369]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4112. [bug] Named failed to load when "root-delegation-only"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein was used without a list of domains to exclude.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4111. [doc] Alphabetize rndc man page. [RT #39360]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4110. [bug] Address memory leaks / null pointer dereferences
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein on out of memory. [RT #39310]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4109. [port] linux: support reading the local port range from
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4108. [func] An additional NXDOMAIN redirect method (option
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein "nxdomain-redirect") has been added, allowing
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein redirection to a specified DNS namespace instead
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein of a single redirect zone. [RT #37989]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4107. [bug] Address potential deadlock when updating zone content.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4106. [port] Improve readline support. [RT #38938]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4105. [port] Misc fixes for Microsoft Visual Studio
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein 2015 CTP6 in 64 bit mode. [RT #39308]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4104. [bug] Address uninitialized elements. [RT #39252]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4103. [port] Misc fixes for Microsoft Visual Studio
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein 2015 CTP6. [RT #39267]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4102. [bug] Fix a use after free bug introduced in change
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein #4094. [RT #39281]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4101. [bug] dig: the +split and +rrcomments options didn't
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein work with +short. [RT #39291]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4100. [bug] Inherited owernames on the line immediately following
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein a $INCLUDE were not working. [RT #39268]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4099. [port] clang: make unknown commandline options hard errors
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein when determining what options are supported.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4098. [bug] Address use-after-free issue when using a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein predecessor key with dnssec-settime. [RT #39272]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4097. [func] Add additional logging about xfrin transfer status.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4096. [bug] Fix a use after free of query->sendevent.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4095. [bug] zone->options2 was not being properly initialized.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4094. [bug] A race during shutdown or reconfiguration could
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein cause an assertion in mem.c. [RT #38979]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4093. [func] Dig now learns the SIT value from truncated
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein responses when it retries over TCP. [RT #39047]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4092. [bug] 'in-view' didn't work for zones beneath a empty zone.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4091. [cleanup] Some cleanups in isc mem code. [RT #38896]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4090. [bug] Fix a crash while parsing malformed CAA RRs in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein presentation format, i.e., from text such as
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein from master files. Thanks to John Van de
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Meulebrouck Brendgard for discovering and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein reporting this problem. [RT #39003]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4089. [bug] Send notifies immediately for slave zones during
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein startup. [RT #38843]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4088. [port] Fixed errors when building with libressl. [RT #38899]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4087. [bug] Fix a crash due to use-after-free due to sequencing
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein of tasks actions. [RT #38495]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4086. [bug] Fix out-of-srcdir build with native pkcs11. [RT #38831]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4085. [bug] ISC_PLATFORM_HAVEXADDQ could be inconsistently set.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4084. [bug] Fix a possible race in updating stats counters.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4083. [cleanup] Print the number of CPUs and UDP listeners
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein consistently in the log and in "rndc status"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein output; indicate whether threads are supported
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in "named -V" output. [RT #38811]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4082. [bug] Incrementally sign large inline zone deltas.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4081. [cleanup] Use dns_rdatalist_init consistently. [RT #38759]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4080. [func] Completed change #4022, adding a "lock-file" option
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to named.conf to override the default lock file,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in addition to the "named -X <filename>" command
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein line option. Setting the lock file to "none"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein using either method disables the check completely.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4079. [func] Preserve the case of the owner name of records to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the RRset level. [RT #37442]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4078. [bug] Handle the case where CMSG_SPACE(sizeof(int)) !=
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein CMSG_SPACE(sizeof(char)). [RT #38621]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4077. [test] Add static-stub regression test for DS NXDOMAIN
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein return making the static stub disappear. [RT #38564]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4076. [bug] Named could crash on shutdown with outstanding
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein reload / reconfig events. [RT #38622]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4075. [placeholder]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4074. [cleanup] Cleaned up more warnings from gcc -Wshadow. [RT #38708]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4073. [cleanup] Add libjson-c version number reporting to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein "named -V"; normalize version number formatting.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4072. [func] Add a --enable-querytrace configure switch for
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein very verbose query trace logging. (This option
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein has a negative performance impact and should be
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein used only for debugging.) [RT #37520]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4071. [cleanup] Initialize pthread mutex attrs just once, instead of
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein doing it per mutex creation. [RT #38547]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4070. [bug] Fix a segfault in nslookup in a query such as
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4069. [doc] Reorganize options in the nsupdate man page.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4068. [bug] Omit unknown serial number from JSON zone statistics.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4067. [cleanup] Reduce noise from RRL when query logging is
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein disabled. [RT #38648]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4066. [doc] Reorganize options in the dig man page. [RT #38516]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4065. [test] Additional RFC 5011 tests. [RT #38569]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4064. [contrib] dnssec-keyset.sh: Generates a specified number
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein of DNSSEC keys with timing set to implement a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein pre-publication key rollover strategy. Thanks
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to Jeffry A. Spain. [RT #38459]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4063. [bug] Asynchronous zone loads were not handled
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein correctly when the zone load was already in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein progress; this could trigger a crash in zt.c.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4062. [bug] Fix an out-of-bounds read in RPZ code. If the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein read succeeded, it doesn't result in a bug
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein during operation. If the read failed, named
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein could segfault. [RT #38559]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4061. [bug] Handle timeout in legacy system test. [RT #38573]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4060. [bug] dns_rdata_freestruct could be called on a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein uninitialized structure when handling a error.
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews4059. [bug] Addressed valgrind warnings. [RT #38549]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4058. [bug] UDP dispatches could use the wrong pseudorandom
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein number generator context. [RT #38578]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4057. [bug] 'dnssec-dsfromkey -T 0' failed to add ttl field.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4056. [bug] Expanded automatic testing of trust anchor
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein management and fixed several small bugs including
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein a memory leak and a possible loss of key state
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein information. [RT #38458]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4055. [func] "rndc managed-keys" can be used to check status
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein of trust anchors or to force keys to be refreshed,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Also, the managed keys data file has easier-to-read
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein comments. [RT #38458]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4054. [func] Added a new tool 'mdig', a lightweight clone of
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews dig able to send multiple pipelined queries.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4053. [security] Revoking a managed trust anchor and supplying
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein an untrusted replacement could cause named
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to crash with an assertion failure.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein (CVE-2015-1349) [RT #38344]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4052. [bug] Fix a leak of query fetchlock. [RT #38454]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews4051. [bug] Fix a leak of pthread_mutexattr_t. [RT #38454]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4050. [bug] RPZ could send spurious SERVFAILs in response
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to duplicate queries. [RT #38510]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4049. [bug] CDS and CDNSKEY had the wrong attributes. [RT #38491]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4048. [bug] adb hash table was not being grown. [RT #38470]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews4047. [cleanup] "named -V" now reports the current running versions
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews of OpenSSL and the libxml2 libraries, in addition to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the versions that were in use at build time.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4046. [bug] Accounting of "total use" in memory context
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein statistics was not correct. [RT #38370]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4045. [bug] Skip to next master on dns_request_createvia4 failure.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4044. [bug] Change 3955 was not complete, resulting in an assertion
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein failure if the timing was just right. [RT #38352]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4043. [func] "rndc modzone" can be used to modify the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein configuration of an existing zone, using similar
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein syntax to "rndc addzone". [RT #37895]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4042. [bug] zone.c:iszonesecure was being called too late.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4041. [func] TCP sockets can now be shared while connecting.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein (This will be used to enable client-side support
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein of pipelined queries.) [RT #38231]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4040. [func] Added server-side support for pipelined TCP
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein queries. Clients may continue sending queries via
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein TCP while previous queries are being processed
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in parallel. (The new "keep-response-order"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein option allows clients to be specified for which
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the old behavior will still be used.) [RT #37821]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4039. [cleanup] Cleaned up warnings from gcc -Wshadow. [RT #37381]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4038. [bug] Add 'rpz' flag to node and use it to determine whether
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to call dns_rpz_delete. This should prevent unbalanced
7526edc7677371c366232de5f39a678b7dcda747Mark Andrews add / delete calls. [RT #36888]
7526edc7677371c366232de5f39a678b7dcda747Mark Andrews4037. [bug] also-notify was ignoring the tsig key when checking
7526edc7677371c366232de5f39a678b7dcda747Mark Andrews for duplicates resulting in some expected notify
7526edc7677371c366232de5f39a678b7dcda747Mark Andrews messages not being sent. [RT #38369]
7526edc7677371c366232de5f39a678b7dcda747Mark Andrews4036. [bug] Make call to open a temporary file name safe during
7526edc7677371c366232de5f39a678b7dcda747Mark Andrews NZF creation. [RT #38331]
7526edc7677371c366232de5f39a678b7dcda747Mark Andrews4035. [bug] Close temporary and NZF FILE pointers before moving
7526edc7677371c366232de5f39a678b7dcda747Mark Andrews the former into the latter's place, as required on
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Windows. [RT #38332]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4034. [func] When added, negative trust anchors (NTA) are now
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein saved to files (viewname.nta), in order to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein persist across restarts of the named server.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4033. [bug] Missing out of memory check in request.c:req_send.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4032. [bug] Built-in "empty" zones did not correctly inherit the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein "allow-transfer" ACL from the options or view.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4031. [bug] named-checkconf -z failed to report a missing file
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein with a hint zone. [RT #38294]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4030. [func] "rndc delzone" is now applicable to zones that were
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein configured in named.conf, as well as zones that
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein were added via "rndc addzone". (Note, however, that
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein if named.conf is not also modified, the deleted zone
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein will return when named is reloaded.) [RT #37887]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4029. [func] "rndc showzone" displays the current configuration
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein of a specified zone. [RT #37887]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4028. [bug] $GENERATE with a zero step was not being caught as a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein error. A $GENERATE with a / but no step was not being
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein caught as a error. [RT #38262]
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews4027. [port] Net::DNS 0.81 compatibility. [RT #38165]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4026. [bug] Fix RFC 3658 reference in dig +sigchase. [RT #38173]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4025. [port] bsdi: failed to build. [RT #38047]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4024. [bug] dns_rdata_opt_first, dns_rdata_opt_next,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein dns_rdata_opt_current, dns_rdata_txt_first,
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews dns_rdata_txt_next and dns_rdata_txt_current were
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein documented but not implemented. These have now been
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein implemented.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein dns_rdata_spf_first, dns_rdata_spf_next and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein dns_rdata_spf_current were documented but not
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein implemented. The prototypes for these
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein functions have been removed. [RT #38068]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4023. [bug] win32: socket handling with explicit ports and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein invoking named with -4 was broken for some
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein configurations. [RT #38068]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4022. [func] Stop multiple spawns of named by limiting number of
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein processes to 1. This is done by using a lockfile and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein checking whether we can listen on any configured
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein TCP interfaces. [RT #37908]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4021. [bug] Adjust max-recursion-queries to accommodate
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the need for more queries when the cache is
bea931e17b7567f09107f93ab7e25c7f00abeb9cMark Andrews empty. [RT #38104]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4020. [bug] Change 3736 broke nsupdate's SOA MNAME discovery
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein resulting in updates being sent to the wrong server.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4019. [func] If named is not configured to validate the answer
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein then allow fallback to plain DNS on timeout even
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein when we know the server supports EDNS. [RT #37978]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4018. [placeholder]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4017. [test] Add system test to check lookups to legacy servers
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein with broken DNS behavior. [RT #37965]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4016. [bug] Fix a dig segfault due to bad linked list usage.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4015. [bug] Nameservers that are skipped due to them being
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein CNAMEs were not being logged. They are now logged
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to category 'cname' as per BIND 8. [RT #37935]
47012ae6dbf18a2503d7b33c1c9583dc38625cb7Mark Andrews4014. [bug] When including a master file origin_changed was
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein not being properly set leading to a potentially
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein spurious 'inherited owner' warning. [RT #37919]
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews4013. [func] Add a new tcp-only option to server (config) /
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein peer (struct) to use TCP transport to send
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein queries (in place of UDP transport with a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein TCP fallback on truncated (TC set) response).
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews4012. [cleanup] Check returned status of OpenSSL digest and HMAC
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein functions when they return one. Note this applies
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein only to FIPS capable OpenSSL libraries put in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein FIPS mode and MD5. [RT #37944]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4011. [bug] master's list port and dscp inheritance was not
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein properly implemented. [RT #37792]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4010. [cleanup] Clear the prefetchable state when initiating a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein prefetch. [RT #37399]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4009. [func] delv: added a +tcp option. [RT #37855]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4008. [contrib] Updated zkt to latest version (1.1.3). [RT #37886]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4007. [doc] Remove acl forward reference restriction. [RT #37772]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4006. [security] A flaw in delegation handling could be exploited
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to put named into an infinite loop. This has
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein been addressed by placing limits on the number
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein of levels of recursion named will allow (default 7),
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein and the number of iterative queries that it will
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein send (default 50) before terminating a recursive
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein query (CVE-2014-8500).
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The recursion depth limit is configured via the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein "max-recursion-depth" option, and the query limit
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein via the "max-recursion-queries" option. [RT #37580]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4005. [func] The buffer used for returning text from rndc
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein commands is now dynamically resizable, allowing
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein arbitrarily large amounts of text to be sent back
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to the client. (Prior to this change, it was
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein possible for the output of "rndc tsig-list" to be
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein truncated.) [RT #37731]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4004. [bug] When delegations had AAAA glue but not A, a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein reference could be leaked causing an assertion
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein failure on shutdown. [RT #37796]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4003. [security] When geoip-directory was reconfigured during
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein named run-time, the previously loaded GeoIP
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein data could remain, potentially causing wrong
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein ACLs to be used or wrong results to be served
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein based on geolocation (CVE-2014-8680). [RT #37720]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4002. [security] Lookups in GeoIP databases that were not
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein loaded could cause an assertion failure
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein (CVE-2014-8680). [RT #37679]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4001. [security] The caching of GeoIP lookups did not always
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein handle address families correctly, potentially
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein resulting in an assertion failure (CVE-2014-8680).
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein4000. [bug] NXDOMAIN redirection incorrectly handled NXRRSET
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein from the redirect zone. [RT #37722]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3999. [func] "mkeys" and "nzf" files are now named after
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein their corresponding views, unless the view name
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein contains characters that would be incompatible
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein with use in a filename (i.e., slash, backslash,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein or capital letters). If a view name does contain
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein these characters, the files will still be named
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein using a cryptographic hash of the view name.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Regardless of this, if a file using the old name
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein format is found to exist, it will continue to be
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein used. [RT #37704]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3998. [bug] isc_radix_search was returning matches that were
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein too precise. [RT #37680]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3997. [protocol] Add OPENGPGKEY record. [RT# 37671]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3996. [bug] Address use after free on out of memory error in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein keyring_add. [RT #37639]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3995. [bug] receive_secure_serial holds the zone lock for too
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein long. [RT #37626]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3994. [func] Dig now supports setting the last unassigned DNS
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein header flag bit (dig +zflag). [RT #37421]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3993. [func] Dig now supports EDNS negotiation by default.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein (dig +[no]ednsnegotiation).
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Note: This is disabled by default in BIND 9.10
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein and enabled by default in BIND 9.11. [RT #37604]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3992. [func] DiG can now send queries without questions
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein (dig +header-only). [RT #37599]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3991. [func] Add the ability to buffer logging output by specifying
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein "buffered yes;" when defining a channel. [RT #26561]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3990. [test] Add tests for unknown DNSSEC algorithm handling.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3989. [cleanup] Remove redundant dns_db_resigned calls. [RT #35748]
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews3988. [func] Allow the zone serial of a dynamically updatable
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein zone to be updated via "rndc signing -serial".
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3987. [port] Handle future Visual Studio 14 incompatible changes.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3986. [doc] Add the BIND version number to page footers
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in the ARM. [RT #37398]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3985. [doc] Describe how +ndots and +search interact in dig.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3984. [func] Accept 256 byte long PINs in native PKCS#11
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein crypto. [RT #37410]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3983. [bug] Change #3940 was incomplete: negative trust anchors
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein could be set to last up to a week, but the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein "nta-lifetime" and "nta-recheck" options were
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein still limited to one day. [RT #37522]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews3982. [doc] Include release notes in product documentation.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3981. [bug] Cache DS/NXDOMAIN independently of other query types.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3980. [bug] Improve --with-tuning=large by self tuning of SO_RCVBUF
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein size. [RT #37187]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3979. [bug] Negative trust anchor fetches were not properly
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein managed. [RT #37488]
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews3978. [test] Added a unit test for Diffie-Hellman key
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein computation, completing change #3974. [RT #37477]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3977. [cleanup] "rndc secroots" reported a "not found" error when
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein there were no negative trust anchors set. [RT #37506]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3976. [bug] When refreshing managed-key trust anchors, clear
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein any cached trust so that they will always be
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews revalidated with the current set of secure
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein roots. [RT #37506]
f051d76c87e055c6ea3879e0c97a76609df915ccMark Andrews3975. [bug] Don't populate or use the bad cache for queries that
f051d76c87e055c6ea3879e0c97a76609df915ccMark Andrews don't request or use recursion. [RT #37466]
f051d76c87e055c6ea3879e0c97a76609df915ccMark Andrews3974. [bug] Handle DH_compute_key() failure correctly in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3973. [test] Added hooks for Google Performance Tools CPU profiler,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein including real-time/wall-clock profiling. Use
3b4098640dd85040270f39b9a5ee5e22de99d3d6Mark Andrews "configure --with-gperftools-profiler" to enable.
3b4098640dd85040270f39b9a5ee5e22de99d3d6Mark Andrews3972. [bug] Fix host's usage statement. [RT #37397]
3b4098640dd85040270f39b9a5ee5e22de99d3d6Mark Andrews3971. [bug] Reduce the cascading failures due to a bad $TTL line
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in named-checkconf / named-checkzone. [RT #37138]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3970. [contrib] Fixed a use after free bug in the SDB LDAP driver.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3969. [test] Added 'delv' system test. [RT #36901]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3968. [bug] Silence spurious log messages when using 'named -[46]'.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3967. [test] Add test for inlined signed zone in multiple views
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein with different DNSKEY sets. [RT #35759]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3966. [bug] Missing dns_db_closeversion call in receive_secure_db.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3965. [func] Log outgoing packets and improve packet logging to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein support logging the remote address. [RT #36624]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3964. [func] nsupdate now performs check-names processing.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3963. [test] Added NXRRSET test cases to the "dlzexternal"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein system test. [RT #37344]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews3962. [bug] 'dig +topdown +trace +sigchase' address unhandled error
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein conditions. [RT #34663]
f02216f5b390ff0a589fa080f29350fd7794bf5cMark Andrews3961. [bug] Forwarding of SIG(0) signed UPDATE messages failed with
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews BADSIG. [RT #37216]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews3960. [bug] 'dig +sigchase' could loop forever. [RT #37220]
bea931e17b7567f09107f93ab7e25c7f00abeb9cMark Andrews3959. [bug] Updates could be lost if they arrived immediately
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein after a rndc thaw. [RT #37233]
3a3705ef7747327df182bf8d009333d2472253d5Mark Andrews3958. [bug] Detect when writeable files have multiple references
3a3705ef7747327df182bf8d009333d2472253d5Mark Andrews in named.conf. [RT #37172]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews3957. [bug] "dnssec-keygen -S" failed for ECCGOST, ECDSAP256SHA256
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews and ECDSAP384SHA384. [RT #37183]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews3956. [func] Notify messages are now rate limited by notify-rate and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein startup-notify-rate instead of serial-query-rate.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3955. [bug] Notify messages due to changes are no longer queued
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein behind startup notify messages. [RT #24454]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3954. [bug] Unchecked mutex init in dlz_dlopen_driver.c [RT #37112]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3953. [bug] Don't escape semi-colon in TXT fields. [RT #37159]
a057e8e33baa5fa369be28a9680585200ce3ff73Mark Andrews3952. [bug] dns_name_fullcompare failed to set *nlabelsp when the
3a3705ef7747327df182bf8d009333d2472253d5Mark Andrews two name pointers were the same. [RT #37176]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews3951. [func] Add the ability to set yet-to-be-defined EDNS flags
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews to dig (+ednsflags=#). [RT #37142]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews3950. [port] Changed the bin/python Makefile to work around a
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews bmake bug in FreeBSD 10 and NetBSD 6. [RT #36993]
a1b05dea35aa30b152a47115e18bbe679d3fcf19Mark Andrews3949. [experimental] Experimental support for draft-andrews-edns1 by sending
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews EDNS(1) queries (define DRAFT_ANDREWS_EDNS1 when
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews building). Add support for limiting the EDNS version
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews advertised to servers: server { edns-version 0; };
3b4098640dd85040270f39b9a5ee5e22de99d3d6Mark Andrews Log the EDNS version received in the query log.
3b4098640dd85040270f39b9a5ee5e22de99d3d6Mark Andrews3948. [port] solaris: RCVBUFSIZE was too large on Solaris with
3b4098640dd85040270f39b9a5ee5e22de99d3d6Mark Andrews --with-tuning=large. [RT #37059]
3b4098640dd85040270f39b9a5ee5e22de99d3d6Mark Andrews3947. [cleanup] Set the executable bit on libraries when using
3b4098640dd85040270f39b9a5ee5e22de99d3d6Mark Andrews libtool. [RT #36786]
3b4098640dd85040270f39b9a5ee5e22de99d3d6Mark Andrews3946. [cleanup] Improved "configure" search for a python interpreter.
a057e8e33baa5fa369be28a9680585200ce3ff73Mark Andrews3945. [bug] Invalid wildcard expansions could be incorrectly
a057e8e33baa5fa369be28a9680585200ce3ff73Mark Andrews accepted by the validator. [RT #37093]
a057e8e33baa5fa369be28a9680585200ce3ff73Mark Andrews3944. [test] Added a regression test for "server-id". [RT #37057]
3b4098640dd85040270f39b9a5ee5e22de99d3d6Mark Andrews3943. [func] SERVFAIL responses can now be cached for a
3b4098640dd85040270f39b9a5ee5e22de99d3d6Mark Andrews limited time (configured by "servfail-ttl",
3b4098640dd85040270f39b9a5ee5e22de99d3d6Mark Andrews default 10 seconds, limit 30). This can reduce
3b4098640dd85040270f39b9a5ee5e22de99d3d6Mark Andrews the frequency of retries when an authoritative
47012ae6dbf18a2503d7b33c1c9583dc38625cb7Mark Andrews server is known to be failing, e.g., due to
47012ae6dbf18a2503d7b33c1c9583dc38625cb7Mark Andrews ongoing DNSSEC validation problems. [RT #21347]
3b4098640dd85040270f39b9a5ee5e22de99d3d6Mark Andrews3942. [bug] Wildcard responses from a optout range should be
3b4098640dd85040270f39b9a5ee5e22de99d3d6Mark Andrews marked as insecure. [RT #37072]
47012ae6dbf18a2503d7b33c1c9583dc38625cb7Mark Andrews3941. [doc] Include the BIND version number in the ARM. [RT #37067]
3b4098640dd85040270f39b9a5ee5e22de99d3d6Mark Andrews3940. [func] "rndc nta" now allows negative trust anchors to be
083a5588a3488b6335ee7bafa505d00644c7c58dMark Andrews set for up to one week. [RT #37069]
083a5588a3488b6335ee7bafa505d00644c7c58dMark Andrews3939. [func] Improve UPDATE forwarding performance by allowing TCP
083a5588a3488b6335ee7bafa505d00644c7c58dMark Andrews connections to be shared. [RT #37039]
083a5588a3488b6335ee7bafa505d00644c7c58dMark Andrews3938. [func] Added quotas to be used in recursive resolvers
083a5588a3488b6335ee7bafa505d00644c7c58dMark Andrews that are under high query load for names in zones
47012ae6dbf18a2503d7b33c1c9583dc38625cb7Mark Andrews whose authoritative servers are nonresponsive or
47012ae6dbf18a2503d7b33c1c9583dc38625cb7Mark Andrews are experiencing a denial of service attack.
6bf6622b7b9053dc52527478473b572f042c4b5bMark Andrews - "fetches-per-server" limits the number of
6bf6622b7b9053dc52527478473b572f042c4b5bMark Andrews simultaneous queries that can be sent to any
6bf6622b7b9053dc52527478473b572f042c4b5bMark Andrews single authoritative server. The configured
bea931e17b7567f09107f93ab7e25c7f00abeb9cMark Andrews value is a starting point; it is automatically
bea931e17b7567f09107f93ab7e25c7f00abeb9cMark Andrews adjusted downward if the server is partially or
6bf6622b7b9053dc52527478473b572f042c4b5bMark Andrews completely non-responsive. The algorithm used to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein adjust the quota can be configured via the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein "fetch-quota-params" option.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - "fetches-per-zone" limits the number of
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein simultaneous queries that can be sent for names
297be3708069ef31814d6d75c0d71a50a78feb03Mark Andrews within a single domain. (Note: Unlike
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein "fetches-per-server", this value is not
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein self-tuning.)
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - New stats counters have been added to count
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein queries spilled due to these quotas.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein See the ARM for details of these options. [RT #37125]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3937. [func] Added some debug logging to better indicate the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein conditions causing SERVFAILs when resolving.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3936. [func] Added authoritative support for the EDNS Client
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Subnet (ECS) option.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein ACLs can now include "ecs" elements which specify
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein an address or network prefix; if an ECS option is
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews included in a DNS query, then the address encoded
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews in the option will be matched against "ecs" ACL
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Also, if an ECS address is included in a query,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein then it will be used instead of the client source
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein address when matching "geoip" ACL elements. This
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein behavior can be overridden with "geoip-use-ecs no;".
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein (Note: to enable "geoip" ACLs, use "configure
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein --with-geoip". This requires libGeoIP version
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein 1.5.0 or higher.)
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein When "ecs" or "geoip" ACL elements are used to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein select a view for a query, the response will include
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein an ECS option to indicate which client network the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein answer is valid for.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein (Thanks to Vincent Bernat.) [RT #36781]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3935. [bug] "geoip asnum" ACL elements would not match unless
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the full organization name was specified. They
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein can now match against the AS number alone (e.g.,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein AS1234). [RT #36945]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3934. [bug] Catch bad 'sit-secret' in named-checkconf. Improve
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein sit-secret documentation. [RT #36980]
297be3708069ef31814d6d75c0d71a50a78feb03Mark Andrews3933. [bug] Corrected the implementation of dns_rdata_casecompare()
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein for the HIP rdata type. [RT #36911]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3932. [test] Improved named-checkconf tests. [RT #36911]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3931. [cleanup] Cleanup how dlz grammar is defined. [RT #36879]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3930. [bug] "rndc nta -r" could cause a server hang if the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein NTA was not found. [RT #36909]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3929. [bug] 'host -a' needed to clear idnoptions. [RT #36963]
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews3928. [test] Improve rndc system test. [RT #36898]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3927. [bug] dig: report PKCS#11 error codes correctly when
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein compiled with --enable-native-pkcs11. [RT #36956]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3926. [doc] Added doc for geoip-directory. [RT #36877]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3925. [bug] DS lookup of RFC 1918 empty zones failed. [RT #36917]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3924. [bug] Improve 'rndc addzone' error reporting. [RT #35187]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3923. [bug] Sanity check the xml2-config output. [RT #22246]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3922. [bug] When resigning, dnssec-signzone was removing
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein all signatures from delegation nodes. It now
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein retains DS and (if applicable) NSEC signatures.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3921. [bug] AD was inappropriately set on RPZ responses. [RT #36833]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3920. [doc] Added doc for masterfile-style. [RT #36823]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3919. [bug] dig: continue to next line if a address lookup fails
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in batch mode. [RT #36755]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3918. [doc] Update check-spf documentation. [RT #36910]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3917. [bug] dig, nslookup and host now continue on names that are
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein too long after applying a search list elements.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3916. [contrib] zone2sqlite checked wrong result code. Address
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein compiler warnings. [RT #36931]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3915. [bug] Address a assertion if a route event arrived while
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein shutting down. [RT #36887]
035992291cb70ec3be4046fcea921b4a6acb1c77Mark Andrews3914. [bug] Allow the URI target and CAA value fields to
035992291cb70ec3be4046fcea921b4a6acb1c77Mark Andrews be zero length. [RT #36737]
035992291cb70ec3be4046fcea921b4a6acb1c77Mark Andrews3913. [bug] Address race issue in dispatch. [RT #36731]
035992291cb70ec3be4046fcea921b4a6acb1c77Mark Andrews3912. [bug] Address some unrecoverable lookup failures. [RT #36330]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3911. [func] Implement EDNS EXPIRE option client side, allowing
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein a slave server to set the expiration timer correctly
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein when transferring zone data from another slave
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein server. [RT #35925]
035992291cb70ec3be4046fcea921b4a6acb1c77Mark Andrews3910. [bug] Fix races to free event during shutdown. [RT #36720]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3909. [bug] When computing the number of elements required for a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein acl count_acl_elements could have a short count leading
68b30890ebd441a6a1ae3fdf71744d07d02cd030Mark Andrews to a assertion failure. Also zero out new acl elements
035992291cb70ec3be4046fcea921b4a6acb1c77Mark Andrews in dns_acl_merge. [RT #36675]
68b30890ebd441a6a1ae3fdf71744d07d02cd030Mark Andrews3908. [bug] rndc now differentiates between a zone in multiple
68b30890ebd441a6a1ae3fdf71744d07d02cd030Mark Andrews views and a zone that doesn't exist at all. [RT #36691]
68b30890ebd441a6a1ae3fdf71744d07d02cd030Mark Andrews3907. [cleanup] Alphabetize rndc help. [RT #36683]
68b30890ebd441a6a1ae3fdf71744d07d02cd030Mark Andrews3906. [protocol] Update URI record format to comply with
68b30890ebd441a6a1ae3fdf71744d07d02cd030Mark Andrews draft-faltstrom-uri-08. [RT #36642]
68b30890ebd441a6a1ae3fdf71744d07d02cd030Mark Andrews3905. [bug] Address deadlock between view.c and adb.c. [RT #36341]
68b30890ebd441a6a1ae3fdf71744d07d02cd030Mark Andrews3904. [func] Add the RPZ SOA to the additional section. [RT36507]
035992291cb70ec3be4046fcea921b4a6acb1c77Mark Andrews3903. [bug] Improve the accuracy of DiG's reported round trip
68b30890ebd441a6a1ae3fdf71744d07d02cd030Mark Andrews time. [RT 36611]
035992291cb70ec3be4046fcea921b4a6acb1c77Mark Andrews3902. [bug] liblwres wasn't handling link-local addresses in
68b30890ebd441a6a1ae3fdf71744d07d02cd030Mark Andrews nameserver clauses in resolv.conf. [RT #36039]
68b30890ebd441a6a1ae3fdf71744d07d02cd030Mark Andrews3901. [protocol] Added support for CAA record type (RFC 6844).
68b30890ebd441a6a1ae3fdf71744d07d02cd030Mark Andrews3900. [bug] Fix a crash in PostgreSQL DLZ driver. [RT #36637]
035992291cb70ec3be4046fcea921b4a6acb1c77Mark Andrews3899. [bug] "request-ixfr" is only applicable to slave and redirect
68b30890ebd441a6a1ae3fdf71744d07d02cd030Mark Andrews zones. [RT #36608]
68b30890ebd441a6a1ae3fdf71744d07d02cd030Mark Andrews3898. [bug] Too small a buffer in tohexstr() calls in test code.
bddb70a27123e31020438cff811d898d44b42c71Mark Andrews3897. [bug] RPZ summary information was not properly being updated
bddb70a27123e31020438cff811d898d44b42c71Mark Andrews after a AXFR resulting in changes sometimes being
bddb70a27123e31020438cff811d898d44b42c71Mark Andrews ignored. [RT #35885]
bddb70a27123e31020438cff811d898d44b42c71Mark Andrews3896. [bug] Address performance issues with DSCP code on some
68b30890ebd441a6a1ae3fdf71744d07d02cd030Mark Andrews platforms. [RT #36534]
68b30890ebd441a6a1ae3fdf71744d07d02cd030Mark Andrews3895. [func] Add the ability to set the DSCP code point to dig.
68b30890ebd441a6a1ae3fdf71744d07d02cd030Mark Andrews3894. [bug] Buffers in isc_print_vsnprintf were not properly
68b30890ebd441a6a1ae3fdf71744d07d02cd030Mark Andrews initialized leading to potential overflows when
68b30890ebd441a6a1ae3fdf71744d07d02cd030Mark Andrews printing out quad values. [RT #36505]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3893. [bug] Peer DSCP values could be returned without being set.
bddb70a27123e31020438cff811d898d44b42c71Mark Andrews3892. [bug] Setting '-t aaaa' in .digrc had unintended side
bddb70a27123e31020438cff811d898d44b42c71Mark Andrews effects. [RT #36452]
bddb70a27123e31020438cff811d898d44b42c71Mark Andrews3891. [bug] Use ${INSTALL_SCRIPT} rather than ${INSTALL_PROGRAM}
bddb70a27123e31020438cff811d898d44b42c71Mark Andrews to install python programs.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3890. [bug] RRSIG sets that were not loaded in a single transaction
68b30890ebd441a6a1ae3fdf71744d07d02cd030Mark Andrews at start up where not being correctly added to
68b30890ebd441a6a1ae3fdf71744d07d02cd030Mark Andrews re-signing heaps. [RT #36302]
68b30890ebd441a6a1ae3fdf71744d07d02cd030Mark Andrews3889. [port] hurd: configure fixes as per:
68b30890ebd441a6a1ae3fdf71744d07d02cd030Mark Andrews https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=746540
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3888. [func] 'rndc status' now reports the number of automatic
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein zones. [RT #36015]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3887. [cleanup] Make all static symbols in rbtdb64 end in "64" so
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein they are easier to use in a debugger. [RT #36373]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3886. [bug] rbtdb_write_header should use a once to initialize
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein FILE_VERSION. [RT #36374]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3885. [port] Use 'open()' rather than 'file()' to open files in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3884. [protocol] Add CDS and CDNSKEY record types. [RT #36333]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3883. [placeholder]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3882. [func] By default, negative trust anchors will be tested
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein periodically to see whether data below them can be
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein validated, and if so, they will be allowed to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein expire early. The "rndc nta -force" option
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein overrides this behavior. The default NTA lifetime
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein and the recheck frequency can be configured by the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein "nta-lifetime" and "nta-recheck" options. [RT #36146]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3881. [bug] Address memory leak with UPDATE error handling.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3880. [test] Update ans.pl to work with new TSIG support in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Net::DNS; add additional Net::DNS version prerequisite
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein checks. [RT #36327]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3879. [func] Add version printing option to various BIND utilities.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3878. [bug] Using the incorrect filename for a DLZ module
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein caused a segmentation fault on startup. [RT #36286]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3877. [bug] Inserting and deleting parent and child nodes
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in response policy zones could trigger an assertion
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein failure. [RT #36272]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3876. [bug] Improve efficiency of DLZ redirect zones by
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein suppressing unnecessary database lookups. [RT #35835]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3875. [cleanup] Clarify log message when unable to read private
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein key files. [RT #24702]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3874. [test] Check that only "check-names master" is needed for
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein updates to be accepted.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3873. [protocol] Only warn for SPF without TXT spf record. [RT #36210]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3872. [bug] Address issues found by static analysis. [RT #36209]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3871. [bug] Don't publish an activated key automatically before
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein its publish time. [RT #35063]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3870. [func] Updated the random number generator used in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the resolver to use the updated ChaCha based one
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein (similar to OpenBSD's changes). Also moved the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein RNG to libisc and added unit tests for it.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3869. [doc] Document that in-view zones cannot be used for
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein response policy zones. [RT #35941]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3868. [bug] isc_mem_setwater incorrectly cleared hi_called
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein potentially leaving over memory cleaner running.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3867. [func] "rndc nta" can now be used to set a temporary
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein negative trust anchor, which disables DNSSEC
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein validation below a specified name for a specified
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein period of time (not exceeding 24 hours). This
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein can be used when validation for a domain is known
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to be failing due to a configuration error on
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the part of the domain owner rather than a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein spoofing attack. [RT #29358]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3866. [bug] Named could die on disk full in generate_session_key.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3865. [test] Improved testability of the red-black tree
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce implementation and added unit tests. [RT #35904]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3864. [bug] RPZ didn't work well when being used as forwarder.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3863. [bug] The "E" flag was missing from the query log as a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein unintended side effect of code rearrangement to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein support EDNS EXPIRE. [RT #36117]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3862. [cleanup] Return immediately if we are not going to log the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein message in ns_client_dumpmessage.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3861. [security] Missing isc_buffer_availablelength check results
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in a REQUIRE assertion when printing out a packet
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein (CVE-2014-3859). [RT #36078]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3860. [bug] ioctl(DP_POLL) array size needs to be determined
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein at run time as it is limited to {OPEN_MAX}.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3859. [placeholder]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3858. [bug] Disable GCC 4.9 "delete null pointer check".
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3857. [bug] Make it harder for a incorrect NOEDNS classification
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to be made. [RT #36020]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3856. [bug] Configuring libjson without also configuring libxml
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein resulted in a REQUIRE assertion when retrieving
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein statistics using json. [RT #36009]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3855. [bug] Limit smoothed round trip time aging to no more than
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein once a second. [RT #32909]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3854. [cleanup] Report unrecognized options, if any, in the final
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein configure summary. [RT #36014]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3853. [cleanup] Refactor dns_rdataslab_fromrdataset to separate out
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the handling of a rdataset with no records. [RT #35968]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3852. [func] Increase the default number of clients available
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein for servicing lightweight resolver queries, and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein make them configurable via the "lwres-tasks" and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein "lwres-clients" options. (Thanks to Tomas Hozza.)
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3851. [func] Allow libseccomp based system-call filtering
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein on Linux; use "configure --enable-seccomp" to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein turn it on. Thanks to Loganaden Velvindron
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein of AFRINIC for the contribution. [RT #35347]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3850. [bug] Disabling forwarding could trigger a REQUIRE assertion.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3849. [doc] Alphabetized dig's +options. [RT #35992]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3848. [bug] Adjust 'statistics-channels specified but not effective'
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein error message to account for JSON support. [RT #36008]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3847. [bug] 'configure --with-dlz-postgres' failed to fail when
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein there is not support available.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3846. [bug] "dig +notcp ixfr=<serial>" should result in a UDP
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein ixfr query. [RT #35980]
89bc48260b64a8859ae717e9e5bae380e275fef4Mark Andrews3845. [placeholder]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3844. [bug] Use the x64 version of the Microsoft Visual C++
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Redistributable when built for 64 bit Windows.
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews3843. [protocol] Check EDNS EXPIRE option in dns_rdata_fromwire.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3842. [bug] Adjust RRL log-only logging category. [RT #35945]
89bc48260b64a8859ae717e9e5bae380e275fef4Mark Andrews3841. [cleanup] Refactor zone.c:add_opt to use dns_message_buildopt.
89bc48260b64a8859ae717e9e5bae380e275fef4Mark Andrews3840. [port] Check for arc4random_addrandom() before using it;
89bc48260b64a8859ae717e9e5bae380e275fef4Mark Andrews it's been removed from OpenBSD 5.5. [RT #35907]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3839. [test] Use only posix-compatible shell in system tests.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3838. [protocol] EDNS EXPIRE as been assigned a code point of 9.
3970098dcd2a7122541667b4b56cea8abce8ccf2Mark Andrews3837. [security] A NULL pointer is passed to query_prefetch resulting
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein a REQUIRE assertion failure when a fetch is actually
89bc48260b64a8859ae717e9e5bae380e275fef4Mark Andrews initiated (CVE-2014-3214). [RT #35899]
89bc48260b64a8859ae717e9e5bae380e275fef4Mark Andrews3836. [bug] Address C++ keyword usage in header file.
89bc48260b64a8859ae717e9e5bae380e275fef4Mark Andrews3835. [bug] Geoip ACL elements didn't work correctly when
89bc48260b64a8859ae717e9e5bae380e275fef4Mark Andrews referenced via named or nested ACLs. [RT #35879]
89bc48260b64a8859ae717e9e5bae380e275fef4Mark Andrews3834. [bug] The re-signing heaps were not being updated soon enough
89bc48260b64a8859ae717e9e5bae380e275fef4Mark Andrews leading to multiple re-generations of the same RRSIG
89bc48260b64a8859ae717e9e5bae380e275fef4Mark Andrews when a zone transfer was in progress. [RT #35273]
89bc48260b64a8859ae717e9e5bae380e275fef4Mark Andrews3833. [bug] Cross compiling was broken due to calling genrandom at
89bc48260b64a8859ae717e9e5bae380e275fef4Mark Andrews build time. [RT #35869]
89bc48260b64a8859ae717e9e5bae380e275fef4Mark Andrews3832. [func] "named -L <filename>" causes named to send log
89bc48260b64a8859ae717e9e5bae380e275fef4Mark Andrews messages to the specified file by default instead
89bc48260b64a8859ae717e9e5bae380e275fef4Mark Andrews of to the system log. (Thanks to Tony Finch.)
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3831. [cleanup] Reduce logging noise when EDNS state changes occur.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3830. [func] When query logging is enabled, log query errors at
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the same level ('info') as the queries themselves.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3829. [func] "dig +ttlunits" causes dig to print TTL values
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein with time-unit suffixes: w, d, h, m, s for
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein weeks, days, hours, minutes, and seconds. (Thanks
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to Tony Finch.) [RT #35823]
3b4098640dd85040270f39b9a5ee5e22de99d3d6Mark Andrews3828. [func] "dnssec-signzone -N date" updates serial number
3b4098640dd85040270f39b9a5ee5e22de99d3d6Mark Andrews to the current date in YYYYMMDDNN format.
3b4098640dd85040270f39b9a5ee5e22de99d3d6Mark Andrews3827. [placeholder]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3826. [bug] Corrected bad INSIST logic in isc_radix_remove().
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3825. [bug] Address sign extension bug in isc_regex_validate.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3824. [bug] A collision between two flag values could cause
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein problems with cache cleaning when SIT was enabled.
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews3823. [func] Log the rpz cname target when rewriting. [RT #35667]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3822. [bug] Log the correct type of static-stub zones when
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein removing them. [RT #35842]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3821. [contrib] Added a new "mysqldyn" DLZ module with dynamic
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein update and transaction support. Thanks to Marty
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Lee for the contribution. [RT #35656]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3820. [func] The DLZ API doesn't pass the database version to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the lookup() function; this can cause DLZ modules
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein that allow dynamic updates to mishandle prerequisite
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein checks. This has been corrected by adding a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein 'dbversion' field to the dns_clientinfo_t
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein structure. [RT #35656]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3819. [bug] NSEC3 hashes need to be able to be entered and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein displayed without padding. This is not a issue for
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein currently defined algorithms but may be for future
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein hash algorithms. [RT #27925]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3818. [bug] Stop lying to the optimizer that 'void *arg' is a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein constant in isc_event_allocate.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3817. [func] The "delve" command is now spelled "delv" to avoid
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein a namespace collision with the Xapian project.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3816. [func] "dig +qr" now reports query size. (Thanks to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Tony Finch.) [RT #35822]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3815. [doc] Clarify "nsupdate -y" usage in man page. [RT #35808]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3814. [func] The "masterfile-style" zone option controls the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein formatting of dumped zone files. Options are
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein "relative" (multiline format) and "full" (one
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein record per line). The default is "relative".
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3813. [func] "host" now recognizes the "timeout", "attempts" and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein "debug" options when set in /etc/resolv.conf.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein (Thanks to Adam Tkac at RedHat.) [RT #21885]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3812. [func] Dig now supports sending arbitrary EDNS options from
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the command line (+ednsopt=code[:value]). [RT #35584]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3811. [func] "serial-update-method date;" sets serial number
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein on dynamic update to today's date in YYYYMMDDNN
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein format. (Thanks to Bradley Forschinger.) [RT #24903]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3810. [bug] Work around broken nameservers that fail to ignore
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein unknown EDNS options. [RT #35766]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3809. [doc] Fix SIT and NSID documentation.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3808. [doc] Clean up "prefetch" documentation. [RT #35751]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3807. [bug] Fix sign extension bug in dns_name_fromtext when
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein lowercase is set. [RT #35743]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3806. [test] Improved system test portability. [RT #35625]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3805. [contrib] Added contrib/perftcpdns, a performance testing tool
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein for DNS over TCP. [RT #35710]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein --- 9.10.0rc1 released ---
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3804. [bug] Corrected a race condition in dispatch.c in which
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein portentry could be reset leading to an assertion
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein failure in socket_search(). (Change #3708
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein addressed the same issue but was incomplete.)
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3803. [bug] "named-checkconf -z" incorrectly rejected zones
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein using alternate data sources for not having a "file"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein option. [RT #35685]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3802. [bug] Various header files were not being installed.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3801. [port] Fix probing for gssapi support on FreeBSD. [RT #35615]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3800. [bug] A pending event on the route socket could cause an
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews assertion failure when shutting down named. [RT #35674]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews3799. [bug] Improve named's command line error reporting.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3798. [bug] 'rndc zonestatus' was reporting the wrong re-signing
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews time. [RT #35659]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews3797. [port] netbsd: geoip support probing was broken. [RT #35642]
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews3796. [bug] Register dns and pkcs#11 error codes. [RT #35629]
47012ae6dbf18a2503d7b33c1c9583dc38625cb7Mark Andrews3795. [bug] Make named-checkconf detect raw masterfiles for
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews hint zones and reject them. [RT #35268]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews3794. [maint] Added AAAA for C.ROOT-SERVERS.NET.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews3793. [bug] zone.c:save_nsec3param() could assert when out of
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein memory. [RT #35621]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3792. [func] Provide links to the alternate statistics views when
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein displaying in a browser. [RT #35605]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3791. [placeholder]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3790. [bug] Handle broken nameservers that send BADVERS in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein response to unknown EDNS options. Maintain
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein statistics on BADVERS responses.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3789. [bug] Null pointer dereference on rbt creation failure.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3788. [bug] dns_peer_getrequestsit was returning request_nsid by
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein --- 9.10.0b2 released ---
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3787. [bug] The code that checks whether "auto-dnssec" is
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein allowed was ignoring "allow-update" ACLs set at
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the options or view level. [RT #29536]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3786. [func] Provide more detailed error codes when using
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein native PKCS#11. "pkcs11-tokens" now fails robustly
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein rather than asserting when run against an HSM with
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein an incomplete PKCS#11 API implementation. [RT #35479]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3785. [bug] Debugging code dumphex didn't accept arbitrarily long
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein input (only compiled with -DDEBUG). [RT #35544]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3784. [bug] Using "rrset-order fixed" when it had not been
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein enabled at compile time caused inconsistent
3b4098640dd85040270f39b9a5ee5e22de99d3d6Mark Andrews results. It now works as documented, defaulting
3b4098640dd85040270f39b9a5ee5e22de99d3d6Mark Andrews to cyclic mode. [RT #28104]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3783. [func] "tsig-keygen" is now available as an alternate
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein command name for "ddns-confgen". It generates
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein a TSIG key in named.conf format without comments.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3782. [func] Specifying "auto" as the salt when using
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein "rndc signing -nsec3param" causes named to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein generate a 64-bit salt at random. [RT #35322]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3781. [tuning] Use adaptive mutex locks when available; this
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein has been found to improve performance under load
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein on many systems. "configure --with-locktype=standard"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein restores conventional mutex locks. [RT #32576]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3780. [bug] $GENERATE handled negative numbers incorrectly.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3779. [cleanup] Clarify the error message when using an option
3b4098640dd85040270f39b9a5ee5e22de99d3d6Mark Andrews that was not enabled at compile time. [RT #35504]
3b4098640dd85040270f39b9a5ee5e22de99d3d6Mark Andrews3778. [bug] Log a warning when the wrong address family is
3b4098640dd85040270f39b9a5ee5e22de99d3d6Mark Andrews used in "listen-on" or "listen-on-v6". [RT #17848]
3b4098640dd85040270f39b9a5ee5e22de99d3d6Mark Andrews3777. [bug] EDNS EXPIRE code could dump core when processing
3b4098640dd85040270f39b9a5ee5e22de99d3d6Mark Andrews DLZ queries. [RT #35493]
3b4098640dd85040270f39b9a5ee5e22de99d3d6Mark Andrews3776. [func] "rndc -q" suppresses output from successful
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein rndc commands. Errors are printed on stderr.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3775. [bug] dlz_dlopen driver could return the wrong error
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein code on API version mismatch, leading to a segfault.
00124ad0406365d39f4b2d1011ef6a76706e9df0Mark Andrews3774. [func] When using "request-nsid", log the NSID value in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein printable form as well as hex. [RT #20864]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3773. [func] "host", "nslookup" and "nsupdate" now have
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein options to print the version number and exit.
00124ad0406365d39f4b2d1011ef6a76706e9df0Mark Andrews3772. [contrib] Added sqlite3 dynamically-loadable DLZ module.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews (Based in part on a contribution from Tim Tessier.)
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews3771. [cleanup] Adjusted log level for "using built-in key"
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews messages. [RT #24383]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews3770. [bug] "dig +trace" could fail with an assertion when it
00124ad0406365d39f4b2d1011ef6a76706e9df0Mark Andrews needed to fall back to TCP due to a truncated
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein response. [RT #24660]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3769. [doc] Improved documentation of "rndc signing -list".
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3768. [bug] "dnssec-checkds" was missing the SHA-384 digest
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein algorithm. [RT #34000]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3767. [func] Log explicitly when using rndc.key to configure
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein command channel. [RT #35316]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3766. [cleanup] Fixed problems with building outside the source
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein tree when using native PKCS#11. [RT #35459]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3765. [bug] Fixed a bug in "rndc secroots" that could crash
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein named when dumping an empty keynode. [RT #35469]
3b4098640dd85040270f39b9a5ee5e22de99d3d6Mark Andrews3764. [bug] The dnssec-keygen/settime -S and -i options
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews (to set up a successor key and set the prepublication
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein interval) were missing from dnssec-keyfromlabel.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3763. [bug] delve: Cache DNSSEC records to avoid the need to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein re-fetch them when restarting validation. [RT #35476]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3762. [bug] Address build problems with --pkcs11-native +
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein --with-openssl with ECDSA support. [RT #35467]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3761. [bug] Address dangling reference bug in dns_keytable_add.
3b4098640dd85040270f39b9a5ee5e22de99d3d6Mark Andrews3760. [bug] Improve SIT with native PKCS#11 and on Windows.
3b4098640dd85040270f39b9a5ee5e22de99d3d6Mark Andrews3759. [port] Enable delve on Windows. [RT #35441]
3b4098640dd85040270f39b9a5ee5e22de99d3d6Mark Andrews3758. [port] Enable export library APIs on Windows. [RT #35382]
3b4098640dd85040270f39b9a5ee5e22de99d3d6Mark Andrews3757. [port] Enable Python tools (dnssec-coverage,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein dnssec-checkds) to run on Windows. [RT #34355]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3756. [bug] GSSAPI Kerberos realm checking was broken in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein check_config leading to spurious messages being
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein logged. [RT #35443]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein --- 9.10.0b1 released ---
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3755. [func] Add stats counters for known EDNS options + others.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews3754. [cleanup] win32: Installer now places files in the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Program Files area rather than system services.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3753. [bug] allow-notify was ignoring keys. [RT #35425]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3752. [bug] Address potential REQUIRE failure if
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein DNS_STYLEFLAG_COMMENTDATA is set when printing out
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3751. [tuning] The default setting for the -U option (setting
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the number of UDP listeners per interface) has
297be3708069ef31814d6d75c0d71a50a78feb03Mark Andrews been adjusted to improve performance. [RT #35417]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3750. [experimental] Partially implement EDNS EXPIRE option as described
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in draft-andrews-dnsext-expire-00. Retrieval of
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the remaining time until expiry for slave zones
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein is supported.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein EXPIRE uses an experimental option code (65002),
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein which is subject to change. [RT #35416]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3749. [func] "dig +subnet" sends an EDNS client subnet option
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein containing the specified address/prefix when
47012ae6dbf18a2503d7b33c1c9583dc38625cb7Mark Andrews querying. (Thanks to Wilmer van der Gaast.)
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3748. [test] Use delve to test dns_client interfaces. [RT #35383]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3747. [bug] A race condition could lead to a core dump when
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein destroying a resolver fetch object. [RT #35385]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3746. [func] New "max-zone-ttl" option enforces maximum
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein TTLs for zones. If loading a zone containing a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein higher TTL, the load fails. DDNS updates with
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein higher TTLs are accepted but the TTL is truncated.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein (Note: Currently supported for master zones only;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein inline-signing slaves will be added.) [RT #38405]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3745. [func] "configure --with-tuning=large" adjusts various
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein compiled-in constants and default settings to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein values suited to large servers with abundant
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein memory. [RT #29538]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3744. [experimental] SIT: send and process Source Identity Tokens
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein (similar to DNS Cookies by Donald Eastlake 3rd),
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein which are designed to help clients detect off-path
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein spoofed responses and for servers to identify
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein legitimate clients.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein SIT uses an experimental EDNS option code (65001),
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein which will be changed to an IANA-assigned value
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein if the experiment is deemed a success.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein SIT can be enabled via "configure --enable-sit" (or
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein --enable-developer). It is enabled by default in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Servers can be configured to send smaller responses
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to clients that have not identified themselves via
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein SIT. RRL processing has also been updated;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein legitimate clients are not subject to rate
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein limiting. [RT #35389]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3743. [bug] delegation-only flag wasn't working in forward zone
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein declarations despite being documented. This is
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein needed to support turning off forwarding and turning
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein on delegation only at the same name. [RT #35392]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3742. [port] linux: libcap support: declare curval at start of
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein block. [RT #35387]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3741. [func] "delve" (domain entity lookup and validation engine):
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein A new tool with dig-like semantics for performing DNS
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein lookups, with internal DNSSEC validation, using the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein same resolver and validator logic as named. This
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein allows easy validation of DNSSEC data in environments
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein with untrustworthy resolvers, and assists with
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein troubleshooting of DNSSEC problems. [RT #32406]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3740. [contrib] Minor fixes to configure --with-dlz-bdb,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein --with-dlz-postgres and --with-dlz-odbc. [RT #35340]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews3739. [func] Added per-zone stats counters to track TCP and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein UDP queries. [RT #35375]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3738. [bug] --enable-openssl-hash failed to build. [RT #35343]
47012ae6dbf18a2503d7b33c1c9583dc38625cb7Mark Andrews3737. [bug] 'rndc retransfer' could trigger a assertion failure
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein with inline zones. [RT #35353]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3736. [bug] nsupdate: When specifying a server by name,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein fall back to alternate addresses if the first
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein address for that name is not reachable. [RT #25784]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3735. [cleanup] Merged the libiscpk11 library into libisc
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to simplify dependencies. [RT #35205]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3734. [bug] Improve building with libtool. [RT #35314]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3733. [func] Improve interface scanning support. Interface
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein information will be automatically updated if the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein OS supports routing sockets (MacOS, *BSD, Linux).
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Use "automatic-interface-scan no;" to disable.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Add "rndc scan" to trigger a scan. [RT #23027]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3732. [contrib] Fixed a type mismatch causing the ODBC DLZ
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein driver to dump core on 64-bit systems. [RT #35324]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3731. [func] Added a "no-case-compress" ACL, which causes
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein named to use case-insensitive compression
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein (disabling change #3645) for specified
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein clients. (This is useful when dealing
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein with broken client implementations that
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein use case-sensitive name comparisons,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein rejecting responses that fail to match the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein capitalization of the query that was sent.)
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3730. [cleanup] Added "never" as a synonym for "none" when
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein configuring key event dates in the dnssec tools.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3729. [bug] dnssec-keygen could set the publication date
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein incorrectly when only the activation date was
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein specified on the command line. [RT #35278]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3728. [doc] Expanded native-PKCS#11 documentation,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein specifically pkcs11: URI labels. [RT #35287]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3727. [func] The isc_bitstring API is no longer used and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein has been removed from libisc. [RT #35284]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3726. [cleanup] Clarified the error message when attempting
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to configure more than 32 response-policy zones.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3725. [contrib] Updated zkt and nslint to newest versions,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein cleaned up and rearranged the contrib
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein directory, and added a README.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein --- 9.10.0a2 released ---
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3724. [bug] win32: Fixed a bug that prevented dig and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein host from exiting properly after completing
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein a UDP query. [RT #35288]
92554adb458c7b336e5390c5c9fbf2fcc1276524Mark Andrews3723. [cleanup] Imported keys are now handled the same way
92554adb458c7b336e5390c5c9fbf2fcc1276524Mark Andrews regardless of DNSSEC algorithm. [RT #35215]
92554adb458c7b336e5390c5c9fbf2fcc1276524Mark Andrews3722. [bug] Using geoip ACLs in a blackhole statement
92554adb458c7b336e5390c5c9fbf2fcc1276524Mark Andrews could cause a segfault. [RT #35272]
92554adb458c7b336e5390c5c9fbf2fcc1276524Mark Andrews3721. [doc] Improved documentation of the EDNS processing
92554adb458c7b336e5390c5c9fbf2fcc1276524Mark Andrews enhancements introduced in change #3593. [RT #35275]
92554adb458c7b336e5390c5c9fbf2fcc1276524Mark Andrews3720. [bug] Address compiler warnings. [RT #35261]
92554adb458c7b336e5390c5c9fbf2fcc1276524Mark Andrews3719. [bug] Address memory leak in in peer.c. [RT #35255]
92554adb458c7b336e5390c5c9fbf2fcc1276524Mark Andrews3718. [bug] A missing ISC_LINK_INIT in log.c. [RT #35260]
92554adb458c7b336e5390c5c9fbf2fcc1276524Mark Andrews3717. [port] hpux: Treat EOPNOTSUPP as a expected error code when
92554adb458c7b336e5390c5c9fbf2fcc1276524Mark Andrews probing to see if it is possible to set dscp values
92554adb458c7b336e5390c5c9fbf2fcc1276524Mark Andrews on a per packet basis. [RT #35252]
92554adb458c7b336e5390c5c9fbf2fcc1276524Mark Andrews3716. [bug] The dns_request code was setting dcsp values when not
92554adb458c7b336e5390c5c9fbf2fcc1276524Mark Andrews requested. [RT #35252]
297be3708069ef31814d6d75c0d71a50a78feb03Mark Andrews3715. [bug] The region and city databases could fail to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein initialize when using some versions of libGeoIP,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein causing assertion failures when named was
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein configured to use them. [RT #35427]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3714. [test] System tests that need to test for cryptography
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein support before running can now use a common
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein "testcrypto.sh" script to do so. [RT #35213]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3713. [bug] Save memory by not storing "also-notify" addresses
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in zone objects that are configured not to send
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein notify requests. [RT #35195]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3712. [placeholder]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3711. [placeholder]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3710. [bug] Address double dns_zone_detach when switching to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein using automatic empty zones from regular zones.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3709. [port] Use built-in versions of strptime() and timegm()
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein on all platforms to avoid portability issues.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3708. [bug] Address a portentry locking issue in dispatch.c.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3707. [bug] irs_resconf_load now returns ISC_R_FILENOTFOUND
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein on a missing resolv.conf file and initializes the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein structure as if it had been configured with:
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein nameserver ::1
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein nameserver 127.0.0.1
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Note: Callers will need to be updated to treat
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein ISC_R_FILENOTFOUND as a qualified success or else
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein they will leak memory. The following code fragment
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein will work with both old and new versions without
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein changing the behaviour of the existing code.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein resconf = NULL;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein result = irs_resconf_load(mctx, "/etc/resolv.conf",
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein if (result != ISC_SUCCESS) {
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein if (resconf != NULL)
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein irs_resconf_destroy(&resconf);
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3706. [contrib] queryperf: Fixed a possible integer overflow when
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein printing results. [RT #35182]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3705. [func] "configure --enable-native-pkcs11" enables BIND
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to use the PKCS#11 API for all cryptographic
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein functions, so that it can drive a hardware service
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein module directly without the need to use a modified
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein OpenSSL as intermediary (so long as the HSM's vendor
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein provides a complete-enough implementation of the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein PKCS#11 interface). This has been tested successfully
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein with the Thales nShield HSM and with SoftHSMv2 from
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the OpenDNSSEC project. [RT #29031]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3704. [protocol] Accept integer timestamps in RRSIG records. [RT #35185]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3703. [func] To improve recursive resolver performance, cache
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein records which are still being requested by clients
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein can now be automatically refreshed from the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein authoritative server before they expire, reducing
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein or eliminating the time window in which no answer
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein is available in the cache. See the "prefetch" option
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein for more details. [RT #35041]
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce3702. [func] 'dnssec-coverage -l' option specifies a length
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce of time to check for coverage; events further into
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce the future are ignored. 'dnssec-coverage -z'
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein checks only ZSK events, and 'dnssec-coverage -k'
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein checks only KSK events. (Thanks to Peter Palfrader.)
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3701. [func] named-checkconf can now obscure shared secrets
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein when printing by specifying '-x'. [RT #34465]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3700. [func] Allow access to subgroups of XML statistics via
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein special URLs http://<server>:<port>/xml/v3/server,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein /zones, /net, /tasks, /mem, and /status. [RT #35115]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3699. [bug] Improvements to statistics channel XSL stylesheet:
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the stylesheet can now be cached by the browser;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein section headers are omitted from the stats display
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein when there is no data in those sections to be
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein displayed; counters are now right-justified for
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews easier readability. [RT #35117]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3698. [cleanup] Replaced all uses of memcpy() with memmove().
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3697. [bug] Handle "." as a search list element when IDN support
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein is enabled. [RT #35133]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3696. [bug] dig failed to handle AXFR style IXFR responses which
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein span multiple messages. [RT #35137]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3695. [bug] Address a possible race in dispatch.c. [RT #35107]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3694. [bug] Warn when a key-directory is configured for a zone,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein but does not exist or is not a directory. [RT #35108]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3693. [security] memcpy was incorrectly called with overlapping
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein ranges resulting in malformed names being generated
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein on some platforms. This could cause INSIST failures
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews when serving NSEC3 signed zones (CVE-2014-0591).
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3692. [bug] Two calls to dns_db_getoriginnode were fatal if there
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein was no data at the node. [RT #35080]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3691. [contrib] Address null pointer dereference in LDAP and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein MySQL DLZ modules.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3690. [bug] Iterative responses could be missed when the source
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein port for an upstream query was the same as the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein listener port (53). [RT #34925]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3689. [bug] Fixed a bug causing an insecure delegation from one
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein static-stub zone to another to fail with a broken
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein trust chain. [RT #35081]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3688. [bug] loadnode could return a freed node on out of memory.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3687. [bug] Address null pointer dereference in zone_xfrdone.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3686. [func] "dnssec-signzone -Q" drops signatures from keys
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein that are still published but no longer active.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3685. [bug] "rndc refresh" didn't work correctly with slave
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein zones using inline-signing. [RT #35105]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3684. [bug] The list of included files would grow on reload.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3683. [cleanup] Add a more detailed "not found" message to rndc
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein commands which specify a zone name. [RT #35059]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3682. [bug] Correct the behavior of rndc retransfer to allow
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein inline-signing slave zones to retain NSEC3 parameters
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein instead of reverting to NSEC. [RT #34745]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3681. [port] Update the Windows build system to support feature
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein selection and WIN64 builds. This is a work in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein progress. [RT #34160]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3680. [bug] Ensure buffer space is available in "rndc zonestatus".
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3679. [bug] dig could fail to clean up TCP sockets still
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein waiting on connect(). [RT #35074]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3678. [port] Update config.guess and config.sub. [RT #35060]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3677. [bug] 'nsupdate' leaked memory if 'realm' was used multiple
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein times. [RT #35073]
8e245ec21beee31a780de9b89ba1e8bb2b9f4c9aAndreas Gustafsson3676. [bug] "named-checkconf -z" now checks zones of type
8e245ec21beee31a780de9b89ba1e8bb2b9f4c9aAndreas Gustafsson hint and redirect as well as master. [RT #35046]
8e245ec21beee31a780de9b89ba1e8bb2b9f4c9aAndreas Gustafsson3675. [misc] Provide a place for third parties to add version
8e245ec21beee31a780de9b89ba1e8bb2b9f4c9aAndreas Gustafsson information for their extensions in the version
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce file by setting the EXTENSIONS variable.
8e245ec21beee31a780de9b89ba1e8bb2b9f4c9aAndreas Gustafsson --- 9.10.0a1 released ---
8e245ec21beee31a780de9b89ba1e8bb2b9f4c9aAndreas Gustafsson3674. [bug] RPZ zeroed ttls if the query type was '*'. [RT #35026]
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce3673. [func] New "in-view" zone option allows direct sharing
8e245ec21beee31a780de9b89ba1e8bb2b9f4c9aAndreas Gustafsson of zones between views. [RT #32968]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3672. [func] Local address can now be specified when using
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein dns_client API. [RT #34811]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3671. [bug] Don't allow dnssec-importkey overwrite a existing
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews non-imported private key.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3670. [bug] Address read after free in server side of
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein lwres_getrrsetbyname. [RT #29075]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3669. [port] freebsd: --with-gssapi needs -lhx509. [RT #35001]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3668. [bug] Fix cast in lex.c which could see 0xff treated as eof.
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce3667. [test] dig: add support to keep the TCP socket open between
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce successive queries (+[no]keepopen). [RT #34918]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3666. [func] Add a tool, named-rrchecker, for checking the syntax
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein of individual resource records. This tool is intended
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to be called by provisioning systems so that the front
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein end does not need to be upgraded to support new DNS
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein record types. [RT #34778]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3665. [bug] Failure to release lock on error in receive_secure_db.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3664. [bug] Updated OpenSSL PKCS#11 patches to fix active list
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein locking and other bugs. [RT #34855]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3663. [bug] Address bugs in dns_rdata_fromstruct and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein dns_rdata_tostruct for WKS and ISDN types. [RT #34910]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3662. [bug] 'host' could die if a UDP query timed out. [RT #34870]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3661. [bug] Address lock order reversal deadlock with inline zones.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews3660. [cleanup] Changed the name of "isc-config.sh" to "bind9-config".
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews3659. [port] solaris: don't add explicit dependencies/rules for
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews python programs as make won't use the implicit rules.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3658. [port] linux: Address platform specific compilation issue
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews when libcap-devel is installed. [RT #34838]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3657. [port] Some readline clones don't accept NULL pointers when
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein calling add_history. [RT #34842]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3656. [security] Treat an all zero netmask as invalid when generating
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the localnets acl. (The prior behavior could
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein allow unexpected matches when using some versions
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein of Winsock: CVE-2013-6320.) [RT #34687]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3655. [cleanup] Simplify TCP message processing when requesting a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein zone transfer. [RT #34825]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3654. [bug] Address race condition with manual notify requests.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3653. [func] Create delegations for all "children" of empty zones
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein except "forward first". [RT #34826]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3652. [bug] Address bug with rpz-drop policy. [RT #34816]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3651. [tuning] Adjust when a master server is deemed unreachable.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3650. [tuning] Use separate rate limiting queues for refresh and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein notify requests. [RT #30589]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3649. [cleanup] Include a comment in .nzf files, giving the name of
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the associated view. [RT #34765]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3648. [test] Updated the ATF test framework to version 0.17.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3647. [bug] Address a race condition when shutting down a zone.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3646. [bug] Journal filename string could be set incorrectly,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein causing garbage in log messages. [RT #34738]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3645. [protocol] Use case sensitive compression when responding to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein queries. [RT #34737]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3644. [protocol] Check that EDNS subnet client options are well formed.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3643. [doc] Clarify RRL "slip" documentation.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3642. [func] Allow externally generated DNSKEY to be imported
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein into the DNSKEY management framework. A new tool
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce dnssec-importkey is used to do this. [RT #34698]
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce3641. [bug] Handle changes to sig-validity-interval settings
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein better. [RT #34625]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3640. [bug] ndots was not being checked when searching. Only
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein continue searching on NXDOMAIN responses. Add the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein ability to specify ndots to nslookup. [RT #34711]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3639. [bug] Treat type 65533 (KEYDATA) as opaque except when used
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in a key zone. [RT #34238]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3638. [cleanup] Add the ability to handle ENOPROTOOPT in case it is
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein encountered. [RT #34668]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3637. [bug] 'allow-query-on' was checking the source address
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein rather than the destination address. [RT #34590]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3636. [bug] Automatic empty zones now behave better with
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews forward only "zones" beneath them. [RT #34583]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3635. [bug] Signatures were not being removed from a zone with
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein only KSK keys for a algorithm. [RT #34439]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3634. [func] Report build-id in rndc status. Report build-id
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein when building from a git repository. [RT #20422]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3633. [cleanup] Refactor OPT processing in named to make it easier
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to support new EDNS options. [RT #34414]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3632. [bug] Signature from newly inactive keys were not being
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein removed. [RT #32178]
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews3631. [bug] Remove spurious warning about missing signatures when
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews qtype is SIG. [RT #34600]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3630. [bug] Ensure correct ID computation for MD5 keys. [RT #33033]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3629. [func] Allow the printing of cryptographic fields in DNSSEC
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews records by dig to be suppressed (dig +nocrypto).
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3628. [func] Report DNSKEY key id's when dumping the cache.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3627. [bug] RPZ changes were not effective on slaves. [RT #34450]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3626. [func] dig: NSID output now easier to read. [RT #21160]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3625. [bug] Don't send notify messages to machines outside of the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3624. [bug] Look for 'json_object_new_int64' when looking for a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the json library. [RT #34449]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3623. [placeholder]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3622. [tuning] Eliminate an unnecessary lock when incrementing
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein cache statistics. [RT #34339]
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews3621. [security] Incorrect bounds checking on private type 'keydata'
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein can lead to a remotely triggerable REQUIRE failure
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein (CVE-2013-4854). [RT #34238]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3620. [func] Added "rpz-client-ip" policy triggers, enabling
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein RPZ responses to be configured on the basis of
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews the client IP address; this can be used, for
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein example, to blacklist misbehaving recursive
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein or stub resolvers. [RT #33605]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3619. [bug] Fixed a bug in RPZ with "recursive-only no;"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3618. [func] "rndc reload" now checks modification times of
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein include files as well as master files to determine
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein whether to skip reloading a zone. [RT #33936]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3617. [bug] Named was failing to answer queries during
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein "rndc reload" [RT #34098]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3616. [bug] Change #3613 was incomplete. [RT #34177]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3615. [cleanup] "configure" now finishes by printing a summary
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein of optional BIND features and whether they are
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein active or inactive. ("configure --enable-full-report"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein increases the verbosity of the summary.) [RT #31777]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3614. [port] Check for <linux/types.h>. [RT #34162]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3613. [bug] named could crash when deleting inline-signing
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein zones with "rndc delzone". [RT #34066]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3612. [port] Check whether to use -ljson or -ljson-c. [RT #34115]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3611. [bug] Improved resistance to a theoretical authentication
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein attack based on differential timing. [RT #33939]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3610. [cleanup] win32: Some executables had been omitted from the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein installer. [RT #34116]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3609. [bug] Corrected a possible deadlock in applications using
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the export version of the isc_app API. [RT #33967]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3608. [port] win32: added todos.pl script to ensure all text files
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the win32 build depends on are converted to DOS
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein newline format. [RT #22067]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews3607. [bug] dnssec-keygen had broken 'Invalid keyfile' error
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews message. [RT #34045]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3606. [func] "rndc flushtree" now flushes matching
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein records in the address database and bad cache
bea931e17b7567f09107f93ab7e25c7f00abeb9cMark Andrews as well as the DNS cache. (Previously only the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein DNS cache was flushed.) [RT #33970]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3605. [port] win32: Addressed several compatibility issues
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein with newer versions of Visual Studio. [RT #33916]
3b4098640dd85040270f39b9a5ee5e22de99d3d6Mark Andrews3604. [bug] Fixed a compile-time error when building with
3b4098640dd85040270f39b9a5ee5e22de99d3d6Mark Andrews JSON but not XML. [RT #33959]
3b4098640dd85040270f39b9a5ee5e22de99d3d6Mark Andrews3603. [bug] Install <isc/stat.h>. [RT #33956]
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews3602. [contrib] Added DLZ Perl module, allowing Perl scripts to
3b4098640dd85040270f39b9a5ee5e22de99d3d6Mark Andrews integrate with named and serve DNS data.
3b4098640dd85040270f39b9a5ee5e22de99d3d6Mark Andrews (Contributed by John Eaglesham of Yahoo.)
bea931e17b7567f09107f93ab7e25c7f00abeb9cMark Andrews3601. [bug] Added to PKCS#11 openssl patches a value len
bea931e17b7567f09107f93ab7e25c7f00abeb9cMark Andrews attribute in DH derive key. [RT #33928]
7208386cd37a2092c70eddf80cf29519b16c4c80Mark Andrews3600. [cleanup] dig: Fixed a typo in the warning output when receiving
47012ae6dbf18a2503d7b33c1c9583dc38625cb7Mark Andrews an oversized response. [RT #33910]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews3599. [tuning] Check for pointer equivalence in name comparisons.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews3598. [cleanup] Improved portability of map file code. [RT #33820]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews3597. [bug] Ensure automatic-resigning heaps are reconstructed
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews when loading zones in map format. [RT #33381]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews3596. [port] Updated win32 build documentation, added
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews dnssec-verify. [RT #22067]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews3595. [port] win32: Fix build problems introduced by change #3550.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews3594. [maint] Update config.guess and config.sub. [RT #33816]
47012ae6dbf18a2503d7b33c1c9583dc38625cb7Mark Andrews3593. [func] Update EDNS processing to better track remote server
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews capabilities. [RT #30655]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews3592. [doc] Moved documentation of rndc command options to the
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews rndc man page. [RT #33506]
68abac6cb23aa2c6489ccc16663e051d7aad3ad9Mark Andrews3591. [func] Use CRC-64 to detect map file corruption at load
68abac6cb23aa2c6489ccc16663e051d7aad3ad9Mark Andrews time. [RT #33746]
68abac6cb23aa2c6489ccc16663e051d7aad3ad9Mark Andrews3590. [bug] When using RRL on recursive servers, defer
47012ae6dbf18a2503d7b33c1c9583dc38625cb7Mark Andrews rate-limiting until after recursion is complete;
68abac6cb23aa2c6489ccc16663e051d7aad3ad9Mark Andrews also, use correct rcode for slipped NXDOMAIN
68abac6cb23aa2c6489ccc16663e051d7aad3ad9Mark Andrews responses. [RT #33604]
68abac6cb23aa2c6489ccc16663e051d7aad3ad9Mark Andrews3589. [func] Report serial numbers in when starting zone transfers.
68abac6cb23aa2c6489ccc16663e051d7aad3ad9Mark Andrews Report accepted NOTIFY requests including serial.
68abac6cb23aa2c6489ccc16663e051d7aad3ad9Mark Andrews3588. [bug] dig: addressed a memory leak in the sigchase code
68abac6cb23aa2c6489ccc16663e051d7aad3ad9Mark Andrews that could cause a shutdown crash. [RT #33733]
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews3587. [func] 'named -g' now checks the logging configuration but
68abac6cb23aa2c6489ccc16663e051d7aad3ad9Mark Andrews does not use it. [RT #33473]
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews3586. [bug] Handle errors in xmlDocDumpFormatMemoryEnc. [RT #33706]
68abac6cb23aa2c6489ccc16663e051d7aad3ad9Mark Andrews3585. [func] "rndc delzone -clean" option removes zone files
68abac6cb23aa2c6489ccc16663e051d7aad3ad9Mark Andrews when deleting a zone. [RT #33570]
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews3584. [security] Caching data from an incompletely signed zone could
68abac6cb23aa2c6489ccc16663e051d7aad3ad9Mark Andrews trigger an assertion failure in resolver.c
68abac6cb23aa2c6489ccc16663e051d7aad3ad9Mark Andrews (CVE-2013-3919). [RT #33690]
68abac6cb23aa2c6489ccc16663e051d7aad3ad9Mark Andrews3583. [bug] Address memory leak in GSS-API processing [RT #33574]
68abac6cb23aa2c6489ccc16663e051d7aad3ad9Mark Andrews3582. [bug] Silence false positive warning regarding missing file
47012ae6dbf18a2503d7b33c1c9583dc38625cb7Mark Andrews directive for inline slave zones. [RT #33662]
68abac6cb23aa2c6489ccc16663e051d7aad3ad9Mark Andrews3581. [bug] Changed the tcp-listen-queue default to 10. [RT #33029]
d71e2e0c61df16ff37c9934c371a4a60c08974f7Mark Andrews3580. [bug] Addressed a possible race in acache.c [RT #33602]
d71e2e0c61df16ff37c9934c371a4a60c08974f7Mark Andrews3579. [maint] Updates to PKCS#11 openssl patches, supporting
d71e2e0c61df16ff37c9934c371a4a60c08974f7Mark Andrews versions 0.9.8y, 1.0.0k, 1.0.1e [RT #33463]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3578. [bug] 'rndc -c file' now fails if 'file' does not exist.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3577. [bug] Handle zero TTL values better. [RT #33411]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3576. [bug] Address a shutdown race when validating. [RT #33573]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3575. [func] Changed the logging category for RRL events from
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein 'queries' to 'query-errors'. [RT #33540]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3574. [doc] The 'hostname' keyword was missing from server-id
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein description in the named.conf man page. [RT #33476]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3573. [bug] "rndc addzone" and "rndc delzone" incorrectly handled
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein zone names containing punctuation marks and other
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein nonstandard characters. [RT #33419]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3572. [func] Threads are now enabled by default on most
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein operating systems. [RT #25483]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3571. [bug] Address race condition in dns_client_startresolve().
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3570. [bug] Check internal pointers are valid when loading map
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein files. [RT #33403]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3569. [contrib] Ported mysql DLZ driver to dynamically-loadable
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein module, and added multithread support. [RT #33394]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3568. [cleanup] Add a product description line to the version file,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to be reported by named -v/-V. [RT #33366]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3567. [bug] Silence clang static analyzer warnings. [RT #33365]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3566. [func] Log when forwarding updates to master. [RT #33240]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3565. [placeholder]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3564. [bug] Improved handling of corrupted map files. [RT #33380]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3563. [contrib] zone2sqlite failed with some table names. [RT #33375]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3562. [func] Update map file header format to include a SHA-1 hash
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein of the database content, so that corrupted map files
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein can be rejected at load time. [RT #32459]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3561. [bug] dig: issue a warning if an EDNS query returns FORMERR
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein or NOTIMP. Adjust usage message. [RT #33363]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3560. [bug] isc-config.sh did not honor includedir and libdir
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein when set via configure. [RT #33345]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3559. [func] Check that both forms of Sender Policy Framework
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein records exist or do not exist. [RT #33355]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3558. [bug] IXFR of a DLZ stored zone was broken. [RT #33331]
47012ae6dbf18a2503d7b33c1c9583dc38625cb7Mark Andrews3557. [bug] Reloading redirect zones was broken. [RT #33292]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3556. [maint] Added AAAA for D.ROOT-SERVERS.NET.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3555. [bug] Address theoretical race conditions in acache.c
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein (change #3553 was incomplete). [RT #33252]
1586d8cbac5d73031716561386f60758c6c332d5Mark Andrews3554. [bug] RRL failed to correctly rate-limit upward
1586d8cbac5d73031716561386f60758c6c332d5Mark Andrews referrals and failed to count dropped error
1586d8cbac5d73031716561386f60758c6c332d5Mark Andrews responses in the statistics. [RT #33225]
1586d8cbac5d73031716561386f60758c6c332d5Mark Andrews3553. [bug] Address suspected double free in acache. [RT #33252]
47012ae6dbf18a2503d7b33c1c9583dc38625cb7Mark Andrews3552. [bug] Wrong getopt option string for 'nsupdate -r'.
1586d8cbac5d73031716561386f60758c6c332d5Mark Andrews3551. [bug] resolver.querydscp[46] were uninitialized. [RT #32686]
1586d8cbac5d73031716561386f60758c6c332d5Mark Andrews3550. [func] Unified the internal and export versions of the
1586d8cbac5d73031716561386f60758c6c332d5Mark Andrews BIND libraries, allowing external clients to use
1586d8cbac5d73031716561386f60758c6c332d5Mark Andrews the same libraries as BIND. [RT #33131]
1586d8cbac5d73031716561386f60758c6c332d5Mark Andrews3549. [doc] Documentation for "request-nsid" was missing.
1586d8cbac5d73031716561386f60758c6c332d5Mark Andrews3548. [bug] The NSID request code in resolver.c was broken
1586d8cbac5d73031716561386f60758c6c332d5Mark Andrews resulting in invalid EDNS options being sent.
1586d8cbac5d73031716561386f60758c6c332d5Mark Andrews3547. [bug] Some malformed unknown rdata records were not properly
1586d8cbac5d73031716561386f60758c6c332d5Mark Andrews detected and rejected. [RT #33129]
1586d8cbac5d73031716561386f60758c6c332d5Mark Andrews3546. [func] Add EUI48 and EUI64 types. [RT #33082]
1586d8cbac5d73031716561386f60758c6c332d5Mark Andrews3545. [bug] RRL slip behavior was incorrect when set to 1.
1586d8cbac5d73031716561386f60758c6c332d5Mark Andrews3544. [contrib] check5011.pl: Script to report the status of
1586d8cbac5d73031716561386f60758c6c332d5Mark Andrews managed keys as recorded in managed-keys.bind.
1586d8cbac5d73031716561386f60758c6c332d5Mark Andrews Contributed by Tony Finch <dot@dotat.at>
1586d8cbac5d73031716561386f60758c6c332d5Mark Andrews3543. [bug] Update socket structure before attaching to socket
1586d8cbac5d73031716561386f60758c6c332d5Mark Andrews manager after accept. [RT #33084]
1586d8cbac5d73031716561386f60758c6c332d5Mark Andrews3542. [placeholder]
1586d8cbac5d73031716561386f60758c6c332d5Mark Andrews3541. [bug] Parts of libdns were not properly initialized when
1586d8cbac5d73031716561386f60758c6c332d5Mark Andrews built in libexport mode. [RT #33028]
1586d8cbac5d73031716561386f60758c6c332d5Mark Andrews3540. [test] libt_api: t_info and t_assert were not thread safe.
1586d8cbac5d73031716561386f60758c6c332d5Mark Andrews3539. [port] win32: timestamp format didn't match other platforms.
1586d8cbac5d73031716561386f60758c6c332d5Mark Andrews3538. [test] Running "make test" now requires loopback interfaces
1586d8cbac5d73031716561386f60758c6c332d5Mark Andrews to be set up. [RT #32452]
1586d8cbac5d73031716561386f60758c6c332d5Mark Andrews3537. [tuning] Slave zones, when updated, now send NOTIFY messages
1586d8cbac5d73031716561386f60758c6c332d5Mark Andrews to peers before being dumped to disk rather than
1586d8cbac5d73031716561386f60758c6c332d5Mark Andrews after. [RT #27242]
1586d8cbac5d73031716561386f60758c6c332d5Mark Andrews3536. [func] Add support for setting Differentiated Services Code
1586d8cbac5d73031716561386f60758c6c332d5Mark Andrews Point (DSCP) values in named. Most configuration
1586d8cbac5d73031716561386f60758c6c332d5Mark Andrews options which take a "port" option (e.g.,
1586d8cbac5d73031716561386f60758c6c332d5Mark Andrews listen-on, forwarders, also-notify, masters,
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews notify-source, etc) can now also take a "dscp"
47012ae6dbf18a2503d7b33c1c9583dc38625cb7Mark Andrews option specifying a code point for use with
47012ae6dbf18a2503d7b33c1c9583dc38625cb7Mark Andrews outgoing traffic, if supported by the underlying
47012ae6dbf18a2503d7b33c1c9583dc38625cb7Mark Andrews OS. [RT #27596]
47012ae6dbf18a2503d7b33c1c9583dc38625cb7Mark Andrews3535. [bug] Minor win32 cleanups. [RT #32962]
1586d8cbac5d73031716561386f60758c6c332d5Mark Andrews3534. [bug] Extra text after an embedded NULL was ignored when
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews parsing zone files. [RT #32699]
1586d8cbac5d73031716561386f60758c6c332d5Mark Andrews3533. [contrib] query-loc-0.4.0: memory leaks. [RT #32960]
1586d8cbac5d73031716561386f60758c6c332d5Mark Andrews3532. [contrib] zkt: fixed buffer overrun, resource leaks. [RT #32960]
bea931e17b7567f09107f93ab7e25c7f00abeb9cMark Andrews3531. [bug] win32: A uninitialized value could be returned on out
1586d8cbac5d73031716561386f60758c6c332d5Mark Andrews of memory. [RT #32960]
1586d8cbac5d73031716561386f60758c6c332d5Mark Andrews3530. [contrib] Better RTT tracking in queryperf. [RT #30128]
1586d8cbac5d73031716561386f60758c6c332d5Mark Andrews3529. [func] Named now listens on both IPv4 and IPv6 interfaces
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews by default. Named previously only listened on IPv4
1586d8cbac5d73031716561386f60758c6c332d5Mark Andrews interfaces by default unless named was running in
1586d8cbac5d73031716561386f60758c6c332d5Mark Andrews IPv6 only mode. [RT #32945]
1586d8cbac5d73031716561386f60758c6c332d5Mark Andrews3528. [func] New "dnssec-coverage" command scans the timing
1586d8cbac5d73031716561386f60758c6c332d5Mark Andrews metadata for a set of DNSSEC keys and reports if a
1586d8cbac5d73031716561386f60758c6c332d5Mark Andrews lapse in signing coverage has been scheduled
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews inadvertently. (Note: This tool depends on python;
1586d8cbac5d73031716561386f60758c6c332d5Mark Andrews it will not be built or installed on systems that
1586d8cbac5d73031716561386f60758c6c332d5Mark Andrews do not have a python interpreter.) [RT #28098]
1586d8cbac5d73031716561386f60758c6c332d5Mark Andrews3527. [compat] Add a URI to allow applications to explicitly
1586d8cbac5d73031716561386f60758c6c332d5Mark Andrews request a particular XML schema from the statistics
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews channel, returning 404 if not supported. [RT #32481]
1586d8cbac5d73031716561386f60758c6c332d5Mark Andrews3526. [cleanup] Set up dependencies for unit tests correctly during
1586d8cbac5d73031716561386f60758c6c332d5Mark Andrews build. [RT #32803]
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews3525. [func] Support for additional signing algorithms in rndc:
1586d8cbac5d73031716561386f60758c6c332d5Mark Andrews hmac-sha1, -sha224, -sha256, -sha384, and -sha512.
1586d8cbac5d73031716561386f60758c6c332d5Mark Andrews The -A option to rndc-confgen can be used to
1586d8cbac5d73031716561386f60758c6c332d5Mark Andrews select the algorithm for the generated key.
1586d8cbac5d73031716561386f60758c6c332d5Mark Andrews (The default is still hmac-md5; this may
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews change in a future release.) [RT #20363]
1586d8cbac5d73031716561386f60758c6c332d5Mark Andrews3524. [func] Added an alternate statistics channel in JSON format,
1586d8cbac5d73031716561386f60758c6c332d5Mark Andrews when the server is built with the json-c library:
1586d8cbac5d73031716561386f60758c6c332d5Mark Andrews http://[address]:[port]/json. [RT #32630]
1586d8cbac5d73031716561386f60758c6c332d5Mark Andrews3523. [contrib] Ported filesystem and ldap DLZ drivers to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein dynamically-loadable modules, and added the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein "wildcard" module based on a contribution from
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews Vadim Goncharov <vgoncharov@nic.ru>. [RT #23569]
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews3522. [bug] DLZ lookups could fail to return SERVFAIL when
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein they ought to. [RT #32685]
47012ae6dbf18a2503d7b33c1c9583dc38625cb7Mark Andrews3521. [bug] Address memory leak in opensslecdsa_link.c. [RT #32249]
47012ae6dbf18a2503d7b33c1c9583dc38625cb7Mark Andrews3520. [bug] 'mctx' was not being referenced counted in some places
47012ae6dbf18a2503d7b33c1c9583dc38625cb7Mark Andrews where it should have been. [RT #32794]
47012ae6dbf18a2503d7b33c1c9583dc38625cb7Mark Andrews3519. [func] Full replay protection via four-way handshake is
47012ae6dbf18a2503d7b33c1c9583dc38625cb7Mark Andrews now mandatory for rndc clients. Very old versions
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein of rndc will no longer work. [RT #32798]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3518. [bug] Increase the size of dns_rrl_key.s.rtype by one bit
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein so that all dns_rrl_rtype_t enum values fit regardless
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein of whether it is teated as signed or unsigned by
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the compiler. [RT #32792]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3517. [bug] Reorder destruction to avoid shutdown race. [RT #32777]
47012ae6dbf18a2503d7b33c1c9583dc38625cb7Mark Andrews3516. [placeholder]
47012ae6dbf18a2503d7b33c1c9583dc38625cb7Mark Andrews3515. [port] '%T' is not portable in strftime(). [RT #32763]
47012ae6dbf18a2503d7b33c1c9583dc38625cb7Mark Andrews3514. [bug] The ranges for valid key sizes in ddns-confgen and
47012ae6dbf18a2503d7b33c1c9583dc38625cb7Mark Andrews rndc-confgen were too constrained. Keys up to 512
47012ae6dbf18a2503d7b33c1c9583dc38625cb7Mark Andrews bits are now allowed for most algorithms, and up
47012ae6dbf18a2503d7b33c1c9583dc38625cb7Mark Andrews to 1024 bits for hmac-sha384 and hmac-sha512.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3513. [func] "dig -u" prints times in microseconds rather than
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein milliseconds. [RT #32704]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3512. [func] "rndc validation check" reports the current status
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein of DNSSEC validation. [RT #21397]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3511. [doc] Improve documentation of redirect zones. [RT #32756]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3510. [func] "rndc status" and XML statistics channel now report
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein server start and reconfiguration times. [RT #21048]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3509. [cleanup] Added a product line to version file to allow for
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein easy naming of different products (BIND
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein vs BIND ESV, for example). [RT #32755]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3508. [contrib] queryperf was incorrectly rejecting the -T option.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3507. [bug] Statistics channel XSL had a glitch when attempting
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to chart query data before any queries had been
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein received. [RT #32620]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3506. [func] When setting "max-cache-size" and "max-acache-size",
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the keyword "unlimited" is no longer defined as equal
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to 4 gigabytes (except on 32-bit platforms); it
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein means literally unlimited. [RT #32358]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3505. [bug] When setting "max-cache-size" and "max-acache-size",
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein larger values than 4 gigabytes could not be set
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein explicitly, though larger sizes were available
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein when setting cache size to 0. This has been
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein corrected; the full range is now available.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3504. [func] Add support for ACLs based on geographic location,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein using MaxMind GeoIP databases. Based on code
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein contributed by Ken Brownfield <kb@slide.com>.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3503. [doc] Clarify size_spec syntax. [RT #32449]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3502. [func] zone-statistics: "no" is now a synonym for "none",
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein instead of "terse". [RT #29165]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3501. [func] zone-statistics now takes three options: full,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein terse, and none. "yes" and "no" are retained as
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein synonyms for full and terse, respectively. [RT #29165]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3500. [security] Support NAPTR regular expression validation on
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein all platforms without using libregex, which
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein can be vulnerable to memory exhaustion attack
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein (CVE-2013-2266). [RT #32688]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3499. [doc] Corrected ARM documentation of built-in zones.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3498. [bug] zone statistics for zones which matched a potential
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein empty zone could have their zone-statistics setting
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3497. [func] When deleting a slave/stub zone using 'rndc delzone'
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein report the files that were being used so they can
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein be cleaned up if desired. [RT #27899]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3496. [placeholder]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3495. [func] Support multiple response-policy zones (up to 32),
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein while improving RPZ performance. "response-policy"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein syntax now includes a "min-ns-dots" clause, with
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein default 1, to exclude top-level domains from
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein NSIP and NSDNAME checking. --enable-rpz-nsip and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein --enable-rpz-nsdname are now the default. [RT #32251]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3494. [func] DNS RRL: Blunt the impact of DNS reflection and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein amplification attacks by rate-limiting substantially-
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein identical responses. [RT #28130]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3493. [contrib] Added BDBHPT dynamically-loadable DLZ module,
c115370fcb34be129ad93fd61c4a4767a214eea2Mark Andrews contributed by Mark Goldfinch. [RT #32549]
c115370fcb34be129ad93fd61c4a4767a214eea2Mark Andrews3492. [bug] Fixed a regression in zone loading performance
c115370fcb34be129ad93fd61c4a4767a214eea2Mark Andrews due to lock contention. [RT #30399]
c115370fcb34be129ad93fd61c4a4767a214eea2Mark Andrews3491. [bug] Slave zones using inline-signing must specify a
c115370fcb34be129ad93fd61c4a4767a214eea2Mark Andrews file name. [RT #31946]
c115370fcb34be129ad93fd61c4a4767a214eea2Mark Andrews3490. [bug] When logging RDATA during update, truncate if it's
c115370fcb34be129ad93fd61c4a4767a214eea2Mark Andrews too long. [RT #32365]
c115370fcb34be129ad93fd61c4a4767a214eea2Mark Andrews3489. [bug] --enable-developer now turns on ISC_LIST_CHECKINIT.
c115370fcb34be129ad93fd61c4a4767a214eea2Mark Andrews dns_dlzcreate() failed to properly initialize
c115370fcb34be129ad93fd61c4a4767a214eea2Mark Andrews dlzdb.link. When cloning a rdataset do not copy
c115370fcb34be129ad93fd61c4a4767a214eea2Mark Andrews the link contents. [RT #32651]
c115370fcb34be129ad93fd61c4a4767a214eea2Mark Andrews3488. [bug] Use after free error with DH generated keys. [RT #32649]
c115370fcb34be129ad93fd61c4a4767a214eea2Mark Andrews3487. [bug] Change 3444 was not complete. There was a additional
c115370fcb34be129ad93fd61c4a4767a214eea2Mark Andrews place where the NOQNAME proof needed to be saved.
c115370fcb34be129ad93fd61c4a4767a214eea2Mark Andrews3486. [bug] named could crash when using TKEY-negotiated keys
c115370fcb34be129ad93fd61c4a4767a214eea2Mark Andrews that had been deleted and then recreated. [RT #32506]
c115370fcb34be129ad93fd61c4a4767a214eea2Mark Andrews3485. [cleanup] Only compile openssl_gostlink.c if we support GOST.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3484. [bug] Some statistics were incorrectly rendered in XML.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3483. [placeholder]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3482. [func] dig +nssearch now prints name servers that don't
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein have address records (missing AAAA or A, or the name
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein doesn't exist). [RT #29348]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3481. [cleanup] Removed use of const const in atf.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3480. [bug] Silence logging noise when setting up zone
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein statistics. [RT #32525]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3479. [bug] Address potential memory leaks in gssapi support
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein code. [RT #32405]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews3478. [port] Fix a build failure in strict C99 environments
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews3477. [func] Expand logging when adding records via DDNS update
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews3476. [bug] "rndc zonestatus" could report a spurious "not
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews found" error on inline-signing zones. [RT #29226]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3475. [cleanup] Changed name of 'map' zone file format (previously
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews 'fast'). [RT #32458]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3474. [bug] nsupdate could assert when the local and remote
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein address families didn't match. [RT #22897]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews3473. [bug] dnssec-signzone/verify could incorrectly report
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein an error condition due to an empty node above an
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein opt-out delegation lacking an NSEC3. [RT #32072]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews3472. [bug] The active-connections counter in the socket
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews statistics could underflow. [RT #31747]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews3471. [bug] The number of UDP dispatches now defaults to
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews the number of CPUs even if -n has been set to
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews a higher value. [RT #30964]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3470. [bug] Slave zones could fail to dump when successfully
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews refreshing after an initial failure. [RT #31276]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3469. [bug] Handle DLZ lookup failures more gracefully. Improve
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein backward compatibility between versions of DLZ dlopen
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews API. [RT #32275]
df6faef67126d1277b0f21defd41c54994bf6fcfMark Andrews3468. [security] RPZ rules to generate A records (but not AAAA records)
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein could trigger an assertion failure when used in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein conjunction with DNS64 (CVE-2012-5689). [RT #32141]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews3467. [bug] Added checks in dnssec-keygen and dnssec-settime
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to check for delete date < inactive date. [RT #31719]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews3466. [contrib] Corrected the DNS_CLIENTINFOMETHODS_VERSION check
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews in DLZ example driver. [RT #32275]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews3465. [bug] Handle isolated reserved ports. [RT #31778]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews3464. [maint] Updates to PKCS#11 openssl patches, supporting
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein versions 0.9.8x, 1.0.0j, 1.0.1c [RT #29749]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews3463. [doc] Clarify managed-keys syntax in ARM. [RT #32232]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews3462. [doc] Clarify server selection behavior of dig when using
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein -4 or -6 options. [RT #32181]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3461. [bug] Negative responses could incorrectly have AD=1
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein set. [RT #32237]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews3460. [bug] Only link against readline where needed. [RT #29810]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3459. [func] Added -J option to named-checkzone/named-compilezone
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to specify the path to the journal file. [RT #30958]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3458. [bug] Return FORMERR when presented with a overly long
df6faef67126d1277b0f21defd41c54994bf6fcfMark Andrews domain named in a request. [RT #29682]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3457. [protocol] Add ILNP records (NID, LP, L32, L64). [RT #31836]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3456. [port] g++47: ATF failed to compile. [RT #32012]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3455. [contrib] queryperf: fix getopt option list. [RT #32338]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3454. [port] sparc64: improve atomic support. [RT #25182]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3453. [bug] 'rndc addzone' of a zone with 'inline-signing yes;'
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein failed. [RT #31960]
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews3452. [bug] Accept duplicate singleton records. [RT #32329]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3451. [port] Increase per thread stack size from 64K to 1M.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3450. [bug] Stop logfileconfig system test spam system logs.
276e28f813ffef042d5a6e9f3373ef4e2ad37996Mark Andrews3449. [bug] gen.c: use the pre-processor to construct format
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein strings so that compiler can perform sanity checks;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein check the snprintf results. [RT #17576]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3448. [bug] The allow-query-on ACL was not processed correctly.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3447. [port] Add support for libxml2-2.9.x [RT #32231]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3446. [port] win32: Add source ID (see change #3400) to build.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3445. [bug] Warn about zone files with blank owner names
00124ad0406365d39f4b2d1011ef6a76706e9df0Mark Andrews immediately after $ORIGIN directives. [RT #31848]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3444. [bug] The NOQNAME proof was not being returned from cached
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein insecure responses. [RT #21409]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3443. [bug] ddns-confgen: Some TSIG algorithms were incorrectly
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein rejected when generating keys. [RT #31927]
dca44b90c96352111e0f1cdfdeccde1a13732161Mark Andrews3442. [port] Net::DNS 0.69 introduced a non backwards compatible
dca44b90c96352111e0f1cdfdeccde1a13732161Mark Andrews change. [RT #32216]
a404eb87dc8f91fe81bedce8bb3957fc3c7684a5Mark Andrews3441. [maint] D.ROOT-SERVERS.NET is now 199.7.91.13.
89bc48260b64a8859ae717e9e5bae380e275fef4Mark Andrews3440. [bug] Reorder get_key_struct to not trigger a assertion when
a404eb87dc8f91fe81bedce8bb3957fc3c7684a5Mark Andrews cleaning up due to out of memory error. [RT #32131]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3439. [placeholder]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3438. [bug] Don't accept unknown data escape in quotes. [RT #32031]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3437. [bug] isc_buffer_init -> isc_buffer_constinit to initialize
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein buffers with constant data. [RT #32064]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3436. [bug] Check malloc/calloc return values. [RT #32088]
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews3435. [bug] Cross compilation support in configure was broken.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3434. [bug] Pass client info to the DLZ findzone() entry
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein point in addition to lookup(). This makes it
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein possible for a database to answer differently
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein whether it's authoritative for a name depending
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein on the address of the client. [RT #31775]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3433. [bug] dlz_findzone() did not correctly handle
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein ISC_R_NOMORE. [RT #31172]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3432. [func] Multiple DLZ databases can now be configured.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein DLZ databases are searched in the order configured,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein unless set to "search no", in which case a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein zone can be configured to be retrieved from a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein particular DLZ database by using a "dlz <name>"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein option in the zone statement. DLZ databases can
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein support type "master" and "redirect" zones.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3431. [bug] ddns-confgen: Some valid key algorithms were
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein not accepted. [RT #31927]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3430. [bug] win32: isc_time_formatISO8601 was missing the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein 'T' between the date and time. [RT #32044]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3429. [bug] dns_zone_getserial2 could a return success without
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein returning a valid serial. [RT #32007]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3428. [cleanup] dig: Add timezone to date output. [RT #2269]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3427. [bug] dig +trace incorrectly displayed name server
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein addresses instead of names. [RT #31641]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3426. [bug] dnssec-checkds: Clearer output when records are not
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein found. [RT #31968]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3425. [bug] "acacheentry" reference counting was broken resulting
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in use after free. [RT #31908]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3424. [func] dnssec-dsfromkey now emits the hash without spaces.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3423. [bug] "rndc signing -nsec3param" didn't accept the full
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein range of possible values. Address portability issues.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3422. [bug] Added a clear error message for when the SOA does not
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein match the referral. [RT #31281]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3421. [bug] Named loops when re-signing if all keys are offline.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3420. [bug] Address VPATH compilation issues. [RT #31879]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3419. [bug] Memory leak on validation cancel. [RT #31869]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3418. [func] New XML schema (version 3.0) for the statistics channel
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein adds query type statistics at the zone level, and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein flattens the XML tree and uses compressed format to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein optimize parsing. Includes new XSL that permits
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein charting via the Google Charts API on browsers that
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein support javascript in XSL. The old XML schema has been
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein deprecated. [RT #30023]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3417. [placeholder]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews3416. [bug] Named could die on shutdown if running with 128 UDP
00124ad0406365d39f4b2d1011ef6a76706e9df0Mark Andrews dispatches per interface. [RT #31743]
00124ad0406365d39f4b2d1011ef6a76706e9df0Mark Andrews3415. [bug] named could die with a REQUIRE failure if a validation
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews was canceled. [RT #31804]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews3414. [bug] Address locking issues found by Coverity. [RT #31626]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews3413. [func] Record the number of DNS64 AAAA RRsets that have been
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews synthesized. [RT #27636]
3b4098640dd85040270f39b9a5ee5e22de99d3d6Mark Andrews3412. [bug] Copy timeval structure from control message data.
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews3411. [tuning] Use IPV6_USE_MIN_MTU or equivalent with TCP in addition
3b4098640dd85040270f39b9a5ee5e22de99d3d6Mark Andrews to UDP. [RT #31690]
3b4098640dd85040270f39b9a5ee5e22de99d3d6Mark Andrews3410. [bug] Addressed Coverity warnings. [RT #31626]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3409. [contrib] contrib/dane/mkdane.sh: Tool to generate TLSA RR's
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein from X.509 certificates, for use with DANE
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein (DNS-based Authentication of Named Entities).
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews3408. [bug] Some DNSSEC-related options (update-check-ksk,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein dnssec-loadkeys-interval, dnssec-dnskey-kskonly)
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein are now legal in slave zones as long as
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein inline-signing is in use. [RT #31078]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3407. [placeholder]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3406. [bug] mem.c: Fix compilation errors when building with
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein ISC_MEM_TRACKLINES or ISC_MEMPOOL_NAMES disabled.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Also, ISC_MEM_DEBUG is no longer optional. [RT #31559]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3405. [bug] Handle time going backwards in acache. [RT #31253]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3404. [bug] dnssec-signzone: When re-signing a zone, remove
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein RRSIG and NSEC records from nodes that used to be
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in-zone but are now below a zone cut. [RT #31556]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3403. [bug] Silence noisy OpenSSL logging. [RT #31497]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3402. [test] The IPv6 interface numbers used for system
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein tests were incorrect on some platforms. [RT #25085]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3401. [bug] Addressed Coverity warnings. [RT #31484]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3400. [cleanup] "named -V" can now report a source ID string, defined
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in the "srcid" file in the build tree and normally set
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to the most recent git hash. [RT #31494]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3399. [port] netbsd: rename 'bool' parameter to avoid namespace
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein clash. [RT #31515]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3398. [bug] SOA parameters were not being updated with inline
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein signed zones if the zone was modified while the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein server was offline. [RT #29272]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3397. [bug] dig crashed when using +nssearch with +tcp. [RT #25298]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3396. [bug] OPT records were incorrectly removed from signed,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein truncated responses. [RT #31439]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3395. [protocol] Add RFC 6598 reverse zones to built in empty zones
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein list, 64.100.IN-ADDR.ARPA ... 127.100.IN-ADDR.ARPA.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3394. [bug] Adjust 'successfully validated after lower casing
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews signer' log level and category. [RT #31414]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3393. [bug] 'host -C' could core dump if REFUSED was received.
dca44b90c96352111e0f1cdfdeccde1a13732161Mark Andrews3392. [func] Keep statistics on REFUSED responses. [RT #31412]
dca44b90c96352111e0f1cdfdeccde1a13732161Mark Andrews3391. [bug] A DNSKEY lookup that encountered a CNAME failed.
dca44b90c96352111e0f1cdfdeccde1a13732161Mark Andrews3390. [bug] Silence clang compiler warnings. [RT #30417]
dca44b90c96352111e0f1cdfdeccde1a13732161Mark Andrews3389. [bug] Always return NOERROR (not 0) in TSIG. [RT #31275]
dca44b90c96352111e0f1cdfdeccde1a13732161Mark Andrews3388. [bug] Fixed several Coverity warnings.
dca44b90c96352111e0f1cdfdeccde1a13732161Mark Andrews Note: This change includes a fix for a bug that
dca44b90c96352111e0f1cdfdeccde1a13732161Mark Andrews was subsequently determined to be an exploitable
dca44b90c96352111e0f1cdfdeccde1a13732161Mark Andrews security vulnerability, CVE-2012-5688: named could
dca44b90c96352111e0f1cdfdeccde1a13732161Mark Andrews die on specific queries with dns64 enabled.
dca44b90c96352111e0f1cdfdeccde1a13732161Mark Andrews3387. [func] DS digest can be disabled at runtime with
dca44b90c96352111e0f1cdfdeccde1a13732161Mark Andrews disable-ds-digests. [RT #21581]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3386. [bug] Address locking violation when generating new NSEC /
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein NSEC3 chains. [RT #31224]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3385. [bug] named-checkconf didn't detect missing master lists
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in also-notify clauses. [RT #30810]
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce3384. [bug] Improved logging of crypto errors. [RT #30963]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3383. [security] A certain combination of records in the RBT could
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein cause named to hang while populating the additional
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein section of a response. [RT #31090]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3382. [bug] SOA query from slave used use-v6-udp-ports range,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein if set, regardless of the address family in use.
6101b9f0d904a708e900a74abc16d1e0eda67264Mark Andrews3381. [contrib] Update queryperf to support more RR types.
6101b9f0d904a708e900a74abc16d1e0eda67264Mark Andrews3380. [bug] named could die if a nonexistent master list was
6101b9f0d904a708e900a74abc16d1e0eda67264Mark Andrews referenced in a also-notify. [RT #31004]
6101b9f0d904a708e900a74abc16d1e0eda67264Mark Andrews3379. [bug] isc_interval_zero and isc_time_epoch should be
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein "const (type)* const". [RT #31069]
6101b9f0d904a708e900a74abc16d1e0eda67264Mark Andrews3378. [bug] Handle missing 'managed-keys-directory' better.
6101b9f0d904a708e900a74abc16d1e0eda67264Mark Andrews3377. [bug] Removed spurious newline from NSEC3 multiline
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews output. [RT #31044]
dcb551033f0b33eb5c113169750a61084d8250a1Mark Andrews3376. [bug] Lack of EDNS support was being recorded without a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein successful response. [RT #30811]
6101b9f0d904a708e900a74abc16d1e0eda67264Mark Andrews3375. [bug] 'rndc dumpdb' failed on empty caches. [RT #30808]
6101b9f0d904a708e900a74abc16d1e0eda67264Mark Andrews3374. [bug] isc_parse_uint32 failed to return a range error on
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein systems with 64 bit longs. [RT #30232]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3373. [bug] win32: open raw files in binary mode. [RT #30944]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3372. [bug] Silence spurious "deleted from unreachable cache"
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews messages. [RT #30501]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews3371. [bug] AD=1 should behave like DO=1 when deciding whether to
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews add NS RRsets to the additional section or not.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3370. [bug] Address use after free while shutting down. [RT #30241]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3369. [bug] nsupdate terminated unexpectedly in interactive mode
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein if built with readline support. [RT #29550]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3368. [bug] <dns/iptable.h>, <dns/private.h> and <dns/zone.h>
297be3708069ef31814d6d75c0d71a50a78feb03Mark Andrews were not C++ safe.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3367. [bug] dns_dnsseckey_create() result was not being checked.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3366. [bug] Fixed Read-After-Write dependency violation for IA64
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein atomic operations. [RT #25181]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3365. [bug] Removed spurious newlines from log messages in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3364. [security] Named could die on specially crafted record.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3363. [bug] Need to allow "forward" and "fowarders" options
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in static-stub zones; this had been overlooked.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3362. [bug] Setting some option values to 0 in named.conf
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein could trigger an assertion failure on startup.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3361. [bug] "rndc signing -nsec3param" didn't work correctly
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein when salt was set to '-' (no salt). [RT #30099]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3360. [bug] 'host -w' could die. [RT #18723]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3359. [bug] An improperly-formed TSIG secret could cause a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein memory leak. [RT #30607]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3358. [placeholder]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3357. [port] Add support for libxml2-2.8.x [RT #30440]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3356. [bug] Cap the TTL of signed RRsets when RRSIGs are
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein approaching their expiry, so they don't remain
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in caches after expiry. [RT #26429]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3355. [port] Use more portable awk in verify system test.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3354. [func] Improve OpenSSL error logging. [RT #29932]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3353. [bug] Use a single task for task exclusive operations.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3352. [bug] Ensure that learned server attributes timeout of the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein adb cache. [RT #29856]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3351. [bug] isc_mem_put and isc_mem_putanddetach didn't report
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein caller if either ISC_MEM_DEBUGSIZE or ISC_MEM_DEBUGCTX
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein memory debugging flags are set. [RT #30243]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3350. [bug] Memory read overrun in isc___mem_reallocate if
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein ISC_MEM_DEBUGCTX memory debugging flag is set.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3349. [bug] Change #3345 was incomplete. [RT #30233]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3348. [bug] Prevent RRSIG data from being cached if a negative
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein record matching the covering type exists at a higher
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein trust level. Such data already can't be retrieved from
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the cache since change 3218 -- this prevents it
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein being inserted into the cache as well. [RT #26809]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3347. [bug] dnssec-settime: Issue a warning when writing a new
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein private key file would cause a change in the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein permissions of the existing file. [RT #27724]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3346. [security] Bad-cache data could be used before it was
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein initialized, causing an assert. [RT #30025]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3345. [bug] Addressed race condition when removing the last item
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein or inserting the first item in an ISC_QUEUE.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3344. [func] New "dnssec-checkds" command checks a zone to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein determine which DS records should be published
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in the parent zone, or which DLV records should be
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein published in a DLV zone, and queries the DNS to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein ensure that it exists. (Note: This tool depends
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein on python; it will not be built or installed on
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein systems that do not have a python interpreter.)
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3343. [placeholder]
727f5b8846457a33d06f515a10a7e1aa849ddf18Andreas Gustafsson3342. [bug] Change #3314 broke saving of stub zones to disk
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce resulting in excessive cpu usage in some cases.
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce3341. [func] New "dnssec-verify" command checks a signed zone
727f5b8846457a33d06f515a10a7e1aa849ddf18Andreas Gustafsson to ensure correctness of signatures and of NSEC/NSEC3
727f5b8846457a33d06f515a10a7e1aa849ddf18Andreas Gustafsson chains. [RT #23673]
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce3340. [func] Added new 'map' zone file format, which is an image
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce of a zone database that can be loaded directly into
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce memory via mmap(), allowing much faster zone loading.
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce (Note: Because of pointer sizes and other
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce considerations, this file format is platform-dependent;
727f5b8846457a33d06f515a10a7e1aa849ddf18Andreas Gustafsson 'map' zone files cannot always be transferred from one
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce server to another.) [RT #25419]
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce3339. [func] Allow the maximum supported rsa exponent size to be
727f5b8846457a33d06f515a10a7e1aa849ddf18Andreas Gustafsson specified: "max-rsa-exponent-size <value>;" [RT #29228]
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce3338. [bug] Address race condition in units tests: asyncload_zone
727f5b8846457a33d06f515a10a7e1aa849ddf18Andreas Gustafsson and asyncload_zt. [RT #26100]
727f5b8846457a33d06f515a10a7e1aa849ddf18Andreas Gustafsson3337. [bug] Change #3294 broke support for the multiple keys
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce in controls. [RT #29694]
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce3336. [func] Maintain statistics for RRsets tagged as "stale".
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3335. [func] nslookup: return a nonzero exit code when unable
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to get an answer. [RT #29492]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3334. [bug] Hold a zone table reference while performing a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein asynchronous load of a zone. [RT #28326]
885c1096e0c296b0188f01ca7511df1f70a6cddaMark Andrews3333. [bug] Setting resolver-query-timeout too low can cause
885c1096e0c296b0188f01ca7511df1f70a6cddaMark Andrews named to not recover if it loses connectivity.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews3332. [bug] Re-use cached DS rrsets if possible. [RT #29446]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews3331. [security] dns_rdataslab_fromrdataset could produce bad
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein rdataslabs. [RT #29644]
3a3705ef7747327df182bf8d009333d2472253d5Mark Andrews3330. [func] Fix missing signatures on NOERROR results despite
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein RPZ rewriting. Also
a057e8e33baa5fa369be28a9680585200ce3ff73Mark Andrews - add optional "recursive-only yes|no" to the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein response-policy statement
885c1096e0c296b0188f01ca7511df1f70a6cddaMark Andrews - add optional "max-policy-ttl" to the response-policy
885c1096e0c296b0188f01ca7511df1f70a6cddaMark Andrews statement to limit the false data that
885c1096e0c296b0188f01ca7511df1f70a6cddaMark Andrews "recursive-only no" can introduce into
885c1096e0c296b0188f01ca7511df1f70a6cddaMark Andrews resolvers' caches
885c1096e0c296b0188f01ca7511df1f70a6cddaMark Andrews - add a RPZ performance test to bin/tests/system/rpz
885c1096e0c296b0188f01ca7511df1f70a6cddaMark Andrews when queryperf is available.
885c1096e0c296b0188f01ca7511df1f70a6cddaMark Andrews - the encoding of PASSTHRU action to "rpz-passthru".
885c1096e0c296b0188f01ca7511df1f70a6cddaMark Andrews (The old encoding is still accepted.)
885c1096e0c296b0188f01ca7511df1f70a6cddaMark Andrews3329. [bug] Handle RRSIG signer-name case consistently: We
d71e2e0c61df16ff37c9934c371a4a60c08974f7Mark Andrews generate RRSIG records with the signer-name in
7526edc7677371c366232de5f39a678b7dcda747Mark Andrews lower case. We accept them with any case, but if
885c1096e0c296b0188f01ca7511df1f70a6cddaMark Andrews they fail to validate, we try again in lower case.
885c1096e0c296b0188f01ca7511df1f70a6cddaMark Andrews3328. [bug] Fixed inconsistent data checking in dst_parse.c.
885c1096e0c296b0188f01ca7511df1f70a6cddaMark Andrews3327. [func] Added 'filter-aaaa-on-v6' option; this is similar
885c1096e0c296b0188f01ca7511df1f70a6cddaMark Andrews to 'filter-aaaa-on-v4' but applies to IPv6
885c1096e0c296b0188f01ca7511df1f70a6cddaMark Andrews connections. (Use "configure --enable-filter-aaaa"
885c1096e0c296b0188f01ca7511df1f70a6cddaMark Andrews to enable this option.) [RT #27308]
885c1096e0c296b0188f01ca7511df1f70a6cddaMark Andrews3326. [func] Added task list statistics: task model, worker
885c1096e0c296b0188f01ca7511df1f70a6cddaMark Andrews threads, quantum, tasks running, tasks ready.
885c1096e0c296b0188f01ca7511df1f70a6cddaMark Andrews3325. [func] Report cache statistics: memory use, number of
885c1096e0c296b0188f01ca7511df1f70a6cddaMark Andrews nodes, number of hash buckets, hit and miss counts.
885c1096e0c296b0188f01ca7511df1f70a6cddaMark Andrews3324. [test] Add better tests for ADB stats [RT #27057]
083a5588a3488b6335ee7bafa505d00644c7c58dMark Andrews3323. [func] Report the number of buckets the resolver is using.
885c1096e0c296b0188f01ca7511df1f70a6cddaMark Andrews3322. [func] Monitor the number of active TCP and UDP dispatches.
7208386cd37a2092c70eddf80cf29519b16c4c80Mark Andrews3321. [func] Monitor the number of recursive fetches and the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein number of open sockets, and report these values in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the statistics channel. [RT #27054]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3320. [func] Added support for monitoring of recursing client
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein count. [RT #27009]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews3319. [func] Added support for monitoring of ADB entry count and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein hash size. [RT #27057]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3318. [tuning] Reduce the amount of work performed while holding a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein bucket lock when finished with a fetch context.
7526edc7677371c366232de5f39a678b7dcda747Mark Andrews3317. [func] Add ECDSA support (RFC 6605). [RT #21918]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3316. [tuning] Improved locking performance when recursing.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3315. [tuning] Use multiple dispatch objects for sending upstream
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein queries; this can improve performance on busy
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein multiprocessor systems by reducing lock contention.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3314. [bug] The masters list could be updated while stub_callback
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein or refresh_callback were using it. [RT #26732]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3313. [protocol] Add TLSA record type. [RT #28989]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3312. [bug] named-checkconf didn't detect a bad dns64 clients acl.
885c1096e0c296b0188f01ca7511df1f70a6cddaMark Andrews3311. [bug] Abort the zone dump if zone->db is NULL in
885c1096e0c296b0188f01ca7511df1f70a6cddaMark Andrews zone.c:zone_gotwritehandle. [RT #29028]
885c1096e0c296b0188f01ca7511df1f70a6cddaMark Andrews3310. [test] Increase table size for mutex profiling. [RT #28809]
885c1096e0c296b0188f01ca7511df1f70a6cddaMark Andrews3309. [bug] resolver.c:fctx_finddone() was not thread safe.
885c1096e0c296b0188f01ca7511df1f70a6cddaMark Andrews3308. [placeholder]
885c1096e0c296b0188f01ca7511df1f70a6cddaMark Andrews3307. [bug] Add missing ISC_LANG_BEGINDECLS and ISC_LANG_ENDDECLS.
885c1096e0c296b0188f01ca7511df1f70a6cddaMark Andrews3306. [bug] Improve DNS64 reverse zone performance. [RT #28563]
885c1096e0c296b0188f01ca7511df1f70a6cddaMark Andrews3305. [func] Add wire format lookup method to sdb. [RT #28563]
885c1096e0c296b0188f01ca7511df1f70a6cddaMark Andrews3304. [bug] Use hmctx, not mctx when freeing rbtdb->heaps.
885c1096e0c296b0188f01ca7511df1f70a6cddaMark Andrews3303. [bug] named could die when reloading. [RT #28606]
885c1096e0c296b0188f01ca7511df1f70a6cddaMark Andrews3302. [bug] dns_dnssec_findmatchingkeys could fail to find
885c1096e0c296b0188f01ca7511df1f70a6cddaMark Andrews keys if the zone name contained character that
885c1096e0c296b0188f01ca7511df1f70a6cddaMark Andrews required special mappings. [RT #28600]
885c1096e0c296b0188f01ca7511df1f70a6cddaMark Andrews3301. [contrib] Update queryperf to build on darwin. Add -R flag
885c1096e0c296b0188f01ca7511df1f70a6cddaMark Andrews for non-recursive queries. [RT #28565]
885c1096e0c296b0188f01ca7511df1f70a6cddaMark Andrews3300. [bug] Named could die if gssapi was enabled in named.conf
885c1096e0c296b0188f01ca7511df1f70a6cddaMark Andrews but was not compiled in. [RT #28338]
885c1096e0c296b0188f01ca7511df1f70a6cddaMark Andrews3299. [bug] Make SDB handle errors from database drivers better.
885c1096e0c296b0188f01ca7511df1f70a6cddaMark Andrews3298. [bug] Named could dereference a NULL pointer in
885c1096e0c296b0188f01ca7511df1f70a6cddaMark Andrews zmgr_start_xfrin_ifquota if the zone was being removed.
885c1096e0c296b0188f01ca7511df1f70a6cddaMark Andrews3297. [bug] Named could die on a malformed master file. [RT #28467]
885c1096e0c296b0188f01ca7511df1f70a6cddaMark Andrews3296. [bug] Named could die with a INSIST failure in
885c1096e0c296b0188f01ca7511df1f70a6cddaMark Andrews client.c:exit_check. [RT #28346]
885c1096e0c296b0188f01ca7511df1f70a6cddaMark Andrews3295. [bug] Adjust isc_time_secondsastimet range check to be more
885c1096e0c296b0188f01ca7511df1f70a6cddaMark Andrews portable. [RT # 26542]
885c1096e0c296b0188f01ca7511df1f70a6cddaMark Andrews3294. [bug] isccc/cc.c:table_fromwire failed to free alist on
9090a36b61a90746738f66bce09ceaf8d8491d7eAndreas Gustafsson error. [RT #28265]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3293. [func] nsupdate: list supported type. [RT #28261]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3292. [func] Log messages in the axfr stream at debug 10.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3291. [port] Fixed a build error on systems without ENOTSUP.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3290. [bug] <isc/hmacsha.h> was not being installed. [RT #28169]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3289. [bug] 'rndc retransfer' failed for inline zones. [RT #28036]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3288. [bug] dlz_destroy() function wasn't correctly registered
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein by the DLZ dlopen driver. [RT #28056]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3287. [port] Update ans.pl to work with Net::DNS 0.68. [RT #28028]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3286. [bug] Managed key maintenance timer could fail to start
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein after 'rndc reconfig'. [RT #26786]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3285. [bug] val-frdataset was incorrectly disassociated in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein proveunsecure after calling startfinddlvsep.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3284. [bug] Address race conditions with the handling of
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3283. [bug] Raw zones with with more than 512 records in a RRset
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein failed to load. [RT #27863]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3282. [bug] Restrict the TTL of NS RRset to no more than that
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein of the old NS RRset when replacing it.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein [RT #27792] [RT #27884]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3281. [bug] SOA refresh queries could be treated as cancelled
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein despite succeeding over the loopback interface.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3280. [bug] Potential double free of a rdataset on out of memory
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein with DNS64. [RT #27762]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3279. [bug] Hold a internal reference to the zone while performing
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein a asynchronous load. Address potential memory leak
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein if the asynchronous is cancelled. [RT #27750]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3278. [bug] Make sure automatic key maintenance is started
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein when "auto-dnssec maintain" is turned on during
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein "rndc reconfig". [RT #26805]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3277. [bug] win32: isc_socket_dup is not implemented. [RT #27696]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3276. [bug] win32: ns_os_openfile failed to return NULL on
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein safe_open failure. [RT #27696]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3275. [bug] Corrected rndc -h output; the 'rndc sync -clean'
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein option had been misspelled as '-clear'. (To avoid
47012ae6dbf18a2503d7b33c1c9583dc38625cb7Mark Andrews future confusion, both options now work.) [RT #27173]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3274. [placeholder]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3273. [bug] AAAA responses could be returned in the additional
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein section even when filter-aaaa-on-v4 was in use.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3272. [func] New "rndc zonestatus" command prints information
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein about the specified zone. [RT #21671]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3271. [port] darwin: mksymtbl is not always stable, loop several
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein times before giving up. mksymtbl was using non
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein portable perl to covert 64 bit hex strings. [RT #27653]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein --- 9.9.0rc2 released ---
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3270. [bug] "rndc reload" didn't reuse existing zones correctly
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein when inline-signing was in use. [RT #27650]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3269. [port] darwin 11 and later now built threaded by default.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3268. [bug] Convert RRSIG expiry times to 64 timestamps to work
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein out the earliest expiry time. [RT #23311]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3267. [bug] Memory allocation failures could be mis-reported as
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein unexpected error. New ISC_R_UNSET result code.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3266. [bug] The maximum number of NSEC3 iterations for a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein DNSKEY RRset was not being properly computed.
c60793c77f6b6b8b66ad57c73cd7eb67e8d7ff6fAndreas Gustafsson3265. [bug] Corrected a problem with lock ordering in the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein inline-signing code. [RT #27557]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3264. [bug] Automatic regeneration of signatures in an
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein inline-signing zone could stall when the server
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein was restarted. [RT #27344]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3263. [bug] "rndc sync" did not affect the unsigned side of an
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein inline-signing zone. [RT #27337]
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews3262. [bug] Signed responses were handled incorrectly by RPZ.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3261. [func] RRset ordering now defaults to random. [RT #27174]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3260. [bug] "rrset-order cyclic" could appear not to rotate
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews for some query patterns. [RT #27170/27185]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein --- 9.9.0rc1 released ---
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3259. [bug] named-compilezone: Suppress "dump zone to <file>"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein message when writing to stdout. [RT #27109]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3258. [test] Add "forcing full sign with unreadable keys" test.
c60793c77f6b6b8b66ad57c73cd7eb67e8d7ff6fAndreas Gustafsson3257. [bug] Do not generate a error message when calling fsync()
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in a pipe or socket. [RT #27109]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3256. [bug] Disable empty zones for lwresd -C. [RT #27139]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3255. [func] No longer require that a empty zones be explicitly
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein enabled or that a empty zone is disabled for
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein RFC 1918 empty zones to be configured. [RT #27139]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3254. [bug] Set isc_socket_ipv6only() on the IPv6 control channels.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3253. [bug] Return DNS_R_SYNTAX when the input to a text field is
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein too long. [RT #26956]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3252. [bug] When master zones using inline-signing were
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein updated while the server was offline, the source
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein zone could fall out of sync with the signed
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein copy. They can now resynchronize. [RT #26676]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3251. [bug] Enforce a upper bound (65535 bytes) on the amount of
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein memory dns_sdlz_putrr() can allocate per record to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein prevent run away memory consumption on ISC_R_NOSPACE.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3250. [func] 'configure --enable-developer'; turn on various
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein configure options, normally off by default, that
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein we want developers to build and test with. [RT #27103]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3249. [bug] Update log message when saving slave zones files for
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein analysis after load failures. [RT #27087]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3248. [bug] Configure options --enable-fixed-rrset and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein --enable-exportlib were incompatible with each
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein other. [RT #27087]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3247. [bug] 'raw' format zones failed to preserve load order
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein breaking 'fixed' sort order. [RT #27087]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3246. [bug] Named failed to start with a empty also-notify list.
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews3245. [bug] Don't report a error unchanged serials unless there
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews were other changes when thawing a zone with
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein ixfr-fromdifferences. [RT #26845]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3244. [func] Added readline support to nslookup and nsupdate.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Also simplified nsupdate syntax to make "update"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein and "prereq" optional. [RT #24659]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3243. [port] freebsd,netbsd,bsdi: the thread defaults were not
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein being properly set.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3242. [func] Extended the header of raw-format master files to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein include the serial number of the zone from which
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein they were generated, if different (as in the case
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein of inline-signing zones). This is to be used in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein inline-signing zones, to track changes between the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein unsigned and signed versions of the zone, which may
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein have different serial numbers.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein (Note: raw zonefiles generated by this version of
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein BIND are no longer compatible with prior versions.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein To generate a backward-compatible raw zonefile
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein using dnssec-signzone or named-compilezone, specify
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein output format "raw=0" instead of simply "raw".)
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3241. [bug] Address race conditions in the resolver code.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3240. [bug] DNSKEY state change events could be missed. [RT #26874]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3239. [bug] dns_dnssec_findmatchingkeys needs to use a consistent
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein timestamp. [RT #26883]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3238. [bug] keyrdata was not being reinitialized in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein lib/dns/rbtdb.c:iszonesecure. [RT #26913]
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews3237. [bug] dig -6 didn't work with +trace. [RT #26906]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3236. [bug] Backed out changes #3182 and #3202, related to
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews EDNS(0) fallback behavior. [RT #26416]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3235. [func] dns_db_diffx, a extended dns_db_diff which returns
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the generated diff and optionally writes it to a
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews journal. [RT #26386]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3234. [bug] 'make depend' produced invalid makefiles. [RT #26830]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3233. [bug] 'rndc freeze/thaw' didn't work for inline zones.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3232. [bug] Zero zone->curmaster before return in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein dns_zone_setmasterswithkeys(). [RT #26732]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3231. [bug] named could fail to send a incompressible zone.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3230. [bug] 'dig axfr' failed to properly handle a multi-message
297be3708069ef31814d6d75c0d71a50a78feb03Mark Andrews axfr with a serial of 0. [RT #26796]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3229. [bug] Fix local variable to struct var assignment
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein found by CLANG warning.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3228. [tuning] Dynamically grow symbol table to improve zone
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein loading performance. [RT #26523]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3227. [bug] Interim fix to make WKS's use of getprotobyname()
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein and getservbyname() self thread safe. [RT #26232]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3226. [bug] Address minor resource leakages. [RT #26624]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3225. [bug] Silence spurious "setsockopt(517, IPV6_V6ONLY) failed"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein messages. [RT #26507]
a1b05dea35aa30b152a47115e18bbe679d3fcf19Mark Andrews3224. [bug] 'rndc signing' argument parsing was broken. [RT #26684]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3223. [bug] 'task_test privilege_drop' generated false positives.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3222. [cleanup] Replace dns_journal_{get,set}_bitws with
297be3708069ef31814d6d75c0d71a50a78feb03Mark Andrews dns_journal_{get,set}_sourceserial. [RT #26634]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3221. [bug] Fixed a potential core dump on shutdown due to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein referencing fetch context after it's been freed.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein --- 9.9.0b2 released ---
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3220. [bug] Change #3186 was incomplete; dns_db_rpz_findips()
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein could fail to set the database version correctly,
47012ae6dbf18a2503d7b33c1c9583dc38625cb7Mark Andrews causing an assertion failure. [RT #26180]
68b30890ebd441a6a1ae3fdf71744d07d02cd030Mark Andrews3219. [bug] Disable NOEDNS caching following a timeout.
68b30890ebd441a6a1ae3fdf71744d07d02cd030Mark Andrews3218. [security] Cache lookup could return RRSIG data associated with
68b30890ebd441a6a1ae3fdf71744d07d02cd030Mark Andrews nonexistent records, leading to an assertion
68b30890ebd441a6a1ae3fdf71744d07d02cd030Mark Andrews failure. [RT #26590]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3217. [cleanup] Fix build problem with --disable-static. [RT #26476]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3216. [bug] resolver.c:validated() was not thread-safe. [RT #26478]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3215. [bug] 'rndc recursing' could cause a core dump. [RT #26495]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3214. [func] Add 'named -U' option to set the number of UDP
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein listener threads per interface. [RT #26485]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3213. [doc] Clarify ixfr-from-differences behavior. [RT #25188]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3212. [bug] rbtdb.c: failed to remove a node from the deadnodes
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein list prior to adding a reference to it leading a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein possible assertion failure. [RT #23219]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3211. [func] dnssec-signzone: "-f -" prints to stdout; "-O full"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein option prints in single-line-per-record format.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3210. [bug] Canceling the oldest query due to recursive-client
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein overload could trigger an assertion failure. [RT #26463]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3209. [func] Add "dnssec-lookaside 'no'". [RT #24858]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3208. [bug] 'dig -y' handle unknown tsig algorithm better.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3207. [contrib] Fixed build error in Berkeley DB DLZ module. [RT #26444]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3206. [cleanup] Add ISC information to log at start time. [RT #25484]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3205. [func] Upgrade dig's defaults to better reflect modern
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein nameserver behavior. Enable "dig +adflag" and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein "dig +edns=0" by default. Enable "+dnssec" when
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein running "dig +trace". [RT #23497]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3204. [bug] When a master server that has been marked as
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein unreachable sends a NOTIFY, mark it reachable
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein again. [RT #25960]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3203. [bug] Increase log level to 'info' for validation failures
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein from expired or not-yet-valid RRSIGs. [RT #21796]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3202. [bug] NOEDNS caching on timeout was too aggressive.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3201. [func] 'rndc querylog' can now be given an on/off parameter
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein instead of only being used as a toggle. [RT #18351]
3a3705ef7747327df182bf8d009333d2472253d5Mark Andrews3200. [doc] Some rndc functions were undocumented or were
3a3705ef7747327df182bf8d009333d2472253d5Mark Andrews missing from 'rndc -h' output. [RT #25555]
3a3705ef7747327df182bf8d009333d2472253d5Mark Andrews3199. [func] When logging client information, include the name
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein being queried. [RT #25944]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3198. [doc] Clarified that dnssec-settime can alter keyfile
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein permissions. [RT #24866]
a057e8e33baa5fa369be28a9680585200ce3ff73Mark Andrews3197. [bug] Don't try to log the filename and line number when
a057e8e33baa5fa369be28a9680585200ce3ff73Mark Andrews the config parser can't open a file. [RT #22263]
a057e8e33baa5fa369be28a9680585200ce3ff73Mark Andrews3196. [bug] nsupdate: return nonzero exit code when target zone
a057e8e33baa5fa369be28a9680585200ce3ff73Mark Andrews doesn't exist. [RT #25783]
3a3705ef7747327df182bf8d009333d2472253d5Mark Andrews3195. [cleanup] Silence "file not found" warnings when loading
3a3705ef7747327df182bf8d009333d2472253d5Mark Andrews managed-keys zone. [RT #26340]
3a3705ef7747327df182bf8d009333d2472253d5Mark Andrews3194. [doc] Updated RFC references in the 'empty-zones-enable'
3b4098640dd85040270f39b9a5ee5e22de99d3d6Mark Andrews documentation. [RT #25203]
3b4098640dd85040270f39b9a5ee5e22de99d3d6Mark Andrews3193. [cleanup] Changed MAXZONEKEYS to DNS_MAXZONEKEYS, moved to
083a5588a3488b6335ee7bafa505d00644c7c58dMark Andrews3192. [bug] A query structure could be used after being freed.
083a5588a3488b6335ee7bafa505d00644c7c58dMark Andrews3191. [bug] Print NULL records using "unknown" format. [RT #26392]
6bf6622b7b9053dc52527478473b572f042c4b5bMark Andrews3190. [bug] Underflow in error handling in isc_mutexblock_init.
6bf6622b7b9053dc52527478473b572f042c4b5bMark Andrews3189. [test] Added a summary report after system tests. [RT #25517]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3188. [bug] zone.c:zone_refreshkeys() could fail to detach
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein references correctly when errors occurred, causing
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein a hang on shutdown. [RT #26372]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3187. [port] win32: support for Visual Studio 2008. [RT #26356]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein --- 9.9.0b1 released ---
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3186. [bug] Version/db mis-match in rpz code. [RT #26180]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3185. [func] New 'rndc signing' option for auto-dnssec zones:
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - 'rndc signing -list' displays the current
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein state of signing operations
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - 'rndc signing -clear' clears the signing state
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein records for keys that have fully signed the zone
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - 'rndc signing -nsec3param' sets the NSEC3
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein parameters for the zone
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The 'rndc keydone' syntax is removed. [RT #23729]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3184. [bug] named had excessive cpu usage when a redirect zone was
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein configured. [RT #26013]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3183. [bug] Added RTLD_GLOBAL flag to dlopen call. [RT #26301]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3182. [bug] Auth servers behind firewalls which block packets
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein greater than 512 bytes may cause other servers to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein perform poorly. Now, adb retains edns information
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein and caches noedns servers. [RT #23392/24964]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3181. [func] Inline-signing is now supported for master zones.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3180. [func] Local copies of slave zones are now saved in raw
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein format by default, to improve startup performance.
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews 'masterfile-format text;' can be used to override
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the default, if desired. [RT #25867]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3179. [port] kfreebsd: build issues. [RT #26273]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3178. [bug] A race condition introduced by change #3163 could
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein cause an assertion failure on shutdown. [RT #26271]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3177. [func] 'rndc keydone', remove the indicator record that
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein named has finished signing the zone with the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein corresponding key. [RT #26206]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3176. [doc] Corrected example code and added a README to the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein sample external DLZ module in contrib/dlz/example.
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews3175. [bug] Fix how DNSSEC positive wildcard responses from a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein NSEC3 signed zone are validated. Stop sending a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein unnecessary NSEC3 record when generating such
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein responses. [RT #26200]
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews3174. [bug] Always compute to revoked key tag from scratch.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3173. [port] Correctly validate root DS responses. [RT #25726]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3172. [port] darwin 10.* and freebsd [89] are now built threaded by
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3171. [bug] Exclusively lock the task when adding a zone using
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein 'rndc addzone'. [RT #25600]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein --- 9.9.0a3 released ---
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews3170. [func] RPZ update:
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - fix precedence among competing rules
47012ae6dbf18a2503d7b33c1c9583dc38625cb7Mark Andrews - improve ARM text including documenting rule precedence
47012ae6dbf18a2503d7b33c1c9583dc38625cb7Mark Andrews - try to rewrite CNAME chains until first hit
bea931e17b7567f09107f93ab7e25c7f00abeb9cMark Andrews - new "rpz" logging channel
bea931e17b7567f09107f93ab7e25c7f00abeb9cMark Andrews - RDATA for CNAME rules can include wildcards
47012ae6dbf18a2503d7b33c1c9583dc38625cb7Mark Andrews - replace "NO-OP" named.conf policy override with
47012ae6dbf18a2503d7b33c1c9583dc38625cb7Mark Andrews "PASSTHRU" and add "DISABLED" override ("NO-OP"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein is still recognized)
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3169. [func] Catch db/version mis-matches when calling dns_db_*().
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3168. [bug] Nxdomain redirection could trigger an assert with
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein a ANY query. [RT #26017]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3167. [bug] Negative answers from forwarders were not being
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein correctly tagged making them appear to not be cached.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3166. [bug] Upgrading a zone to support inline-signing failed.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3165. [bug] dnssec-signzone could generate new signatures when
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein resigning, even when valid signatures were already
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein present. [RT #26025]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3164. [func] Enable DLZ modules to retrieve client information,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein so that responses can be changed depending on the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein source address of the query. [RT #25768]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3163. [bug] Use finer-grained locking in client.c to address
a1b05dea35aa30b152a47115e18bbe679d3fcf19Mark Andrews concurrency problems with large numbers of threads.
a1b05dea35aa30b152a47115e18bbe679d3fcf19Mark Andrews3162. [test] start.pl: modified to allow for "named.args" in
a1b05dea35aa30b152a47115e18bbe679d3fcf19Mark Andrews ns*/ subdirectory to override stock arguments to
7526edc7677371c366232de5f39a678b7dcda747Mark Andrews named. Largely from RT #26044, but no separate ticket.
7526edc7677371c366232de5f39a678b7dcda747Mark Andrews3161. [bug] zone.c:del_sigs failed to always reset rdata leading
7526edc7677371c366232de5f39a678b7dcda747Mark Andrews assertion failures. [RT #25880]
7526edc7677371c366232de5f39a678b7dcda747Mark Andrews3160. [bug] When printing out a NSEC3 record in multiline form
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the newline was not being printed causing type codes
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to be run together. [RT #25873]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3159. [bug] On some platforms, named could assert on startup
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein when running in a chrooted environment without
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein /proc. [RT #25863]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3158. [bug] Recursive servers would prefer a particular UDP
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein socket instead of using all available sockets.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3157. [tuning] Reduce the time spent in "rndc reconfig" by parsing
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the config file before pausing the server. [RT #21373]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3156. [placeholder]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein --- 9.9.0a2 released ---
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3155. [bug] Fixed a build failure when using contrib DLZ
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein drivers (e.g., mysql, postgresql, etc). [RT #25710]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3154. [bug] Attempting to print an empty rdataset could trigger
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein an assert. [RT #25452]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3153. [func] Extend request-ixfr to zone level and remove the
47012ae6dbf18a2503d7b33c1c9583dc38625cb7Mark Andrews side effect of forcing an AXFR. [RT #25156]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3152. [cleanup] Some versions of gcc and clang failed due to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein incorrect use of __builtin_expect. [RT #25183]
47012ae6dbf18a2503d7b33c1c9583dc38625cb7Mark Andrews3151. [bug] Queries for type RRSIG or SIG could be handled
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein incorrectly. [RT #21050]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3150. [func] Improved startup and reconfiguration time by
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein enabling zones to load in multiple threads. [RT #25333]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3149. [placeholder]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3148. [bug] Processing of normal queries could be stalled when
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein forwarding a UPDATE message. [RT #24711]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3147. [func] Initial inline signing support. [RT #23657]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein --- 9.9.0a1 released ---
47012ae6dbf18a2503d7b33c1c9583dc38625cb7Mark Andrews3146. [test] Fixed gcc4.6.0 errors in ATF. [RT #25598]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3145. [test] Capture output of ATF unit tests in "./atf.out" if
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein there were any errors while running them. [RT #25527]
47012ae6dbf18a2503d7b33c1c9583dc38625cb7Mark Andrews3144. [bug] dns_dbiterator_seek() could trigger an assert when
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein used with a nonexistent database node. [RT #25358]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3143. [bug] Silence clang compiler warnings. [RT #25174]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3142. [bug] NAPTR is class agnostic. [RT #25429]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3141. [bug] Silence spurious "zone serial (0) unchanged" messages
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein associated with empty zones. [RT #25079]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3140. [func] New command "rndc flushtree <name>" clears the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein specified name from the server cache along with
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein all names under it. [RT #19970]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3139. [test] Added tests from RFC 6234, RFC 2202, and RFC 1321
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein for the hashing algorithms (md5, sha1 - sha512, and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein their hmac counterparts). [RT #25067]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3138. [bug] Address memory leaks and out-of-order operations when
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein shutting named down. [RT #25210]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3137. [func] Improve hardware scalability by allowing multiple
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein worker threads to process incoming UDP packets.
47012ae6dbf18a2503d7b33c1c9583dc38625cb7Mark Andrews This can significantly increase query throughput
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein on some systems. [RT #22992]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3136. [func] Add RFC 1918 reverse zones to the list of built-in
7208386cd37a2092c70eddf80cf29519b16c4c80Mark Andrews empty zones switched on by the 'empty-zones-enable'
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews option. [RT #24990]
7208386cd37a2092c70eddf80cf29519b16c4c80Mark Andrews3135. [port] FreeBSD: workaround broken IPV6_USE_MIN_MTU processing.
7208386cd37a2092c70eddf80cf29519b16c4c80Mark Andrews See http://www.freebsd.org/cgi/query-pr.cgi?pr=158307
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews3134. [bug] Improve the accuracy of dnssec-signzone's signing
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein statistics. [RT #16030]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3133. [bug] Change #3114 was incomplete. [RT #24577]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3132. [placeholder]
acb72d5e2c83b597332e3eb0c7d59e1142f1adfdMark Andrews3131. [tuning] Improve scalability by allocating one zone task
acb72d5e2c83b597332e3eb0c7d59e1142f1adfdMark Andrews per 100 zones at startup time, rather than using a
acb72d5e2c83b597332e3eb0c7d59e1142f1adfdMark Andrews fixed-size task table. [RT #24406]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3130. [func] Support alternate methods for managing a dynamic
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein zone's serial number. Two methods are currently
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein defined using serial-update-method, "increment"
acb72d5e2c83b597332e3eb0c7d59e1142f1adfdMark Andrews (default) and "unixtime". [RT #23849]
acb72d5e2c83b597332e3eb0c7d59e1142f1adfdMark Andrews3129. [bug] Named could crash on 'rndc reconfig' when
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein allow-new-zones was set to yes and named ACLs
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein were used. [RT #22739]
acb72d5e2c83b597332e3eb0c7d59e1142f1adfdMark Andrews3128. [func] Inserting an NSEC3PARAM via dynamic update in an
acb72d5e2c83b597332e3eb0c7d59e1142f1adfdMark Andrews auto-dnssec zone that has not been signed yet
acb72d5e2c83b597332e3eb0c7d59e1142f1adfdMark Andrews will cause it to be signed with the specified NSEC3
acb72d5e2c83b597332e3eb0c7d59e1142f1adfdMark Andrews parameters when keys are activated. The
acb72d5e2c83b597332e3eb0c7d59e1142f1adfdMark Andrews NSEC3PARAM record will not appear in the zone until
acb72d5e2c83b597332e3eb0c7d59e1142f1adfdMark Andrews it is signed, but the parameters will be stored.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3127. [bug] 'rndc thaw' will now remove a zone's journal file
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein if the zone serial number has been changed and
acb72d5e2c83b597332e3eb0c7d59e1142f1adfdMark Andrews ixfr-from-differences is not in use. [RT #24687]
acb72d5e2c83b597332e3eb0c7d59e1142f1adfdMark Andrews3126. [security] Using DNAME record to generate replacements caused
acb72d5e2c83b597332e3eb0c7d59e1142f1adfdMark Andrews RPZ to exit with a assertion failure. [RT #24766]
acb72d5e2c83b597332e3eb0c7d59e1142f1adfdMark Andrews3125. [security] Using wildcard CNAME records as a replacement with
acb72d5e2c83b597332e3eb0c7d59e1142f1adfdMark Andrews RPZ caused named to exit with a assertion failure.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3124. [bug] Use an rdataset attribute flag to indicate
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein negative-cache records rather than using rrtype 0;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein this will prevent problems when that rrtype is
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein used in actual DNS packets. [RT #24777]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3123. [security] Change #2912 exposed a latent flaw in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein dns_rdataset_totext() that could cause named to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein crash with an assertion failure. [RT #24777]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3122. [cleanup] dnssec-settime: corrected usage message. [RT #24664]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3121. [security] An authoritative name server sending a negative
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein response containing a very large RRset could
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein trigger an off-by-one error in the ncache code
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein and crash named. [RT #24650]
f4429c1c31ec32f05125baab1adcc4f09863f7afMark Andrews3120. [bug] Named could fail to validate zones listed in a DLV
f4429c1c31ec32f05125baab1adcc4f09863f7afMark Andrews that validated insecure without using DLV and had
f4429c1c31ec32f05125baab1adcc4f09863f7afMark Andrews DS records in the parent zone. [RT #24631]
f4429c1c31ec32f05125baab1adcc4f09863f7afMark Andrews3119. [bug] When rolling to a new DNSSEC key, a private-type
f4429c1c31ec32f05125baab1adcc4f09863f7afMark Andrews record could be created and never marked complete.
acb72d5e2c83b597332e3eb0c7d59e1142f1adfdMark Andrews3118. [bug] nsupdate could dump core on shutdown when using
acb72d5e2c83b597332e3eb0c7d59e1142f1adfdMark Andrews SIG(0) keys. [RT #24604]
acb72d5e2c83b597332e3eb0c7d59e1142f1adfdMark Andrews3117. [cleanup] Remove doc and parser references to the
acb72d5e2c83b597332e3eb0c7d59e1142f1adfdMark Andrews never-implemented 'auto-dnssec create' option.
acb72d5e2c83b597332e3eb0c7d59e1142f1adfdMark Andrews3116. [func] New 'dnssec-update-mode' option controls updates
acb72d5e2c83b597332e3eb0c7d59e1142f1adfdMark Andrews of DNSSEC records in signed dynamic zones. Set to
acb72d5e2c83b597332e3eb0c7d59e1142f1adfdMark Andrews 'no-resign' to disable automatic RRSIG regeneration
acb72d5e2c83b597332e3eb0c7d59e1142f1adfdMark Andrews while retaining the ability to sign new or changed
acb72d5e2c83b597332e3eb0c7d59e1142f1adfdMark Andrews data. [RT #24533]
a404eb87dc8f91fe81bedce8bb3957fc3c7684a5Mark Andrews3115. [bug] Named could fail to return requested data when
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein following a CNAME that points into the same zone.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3114. [bug] Retain expired RRSIGs in dynamic zones if key is
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein inactive and there is no replacement key. [RT #23136]
f4429c1c31ec32f05125baab1adcc4f09863f7afMark Andrews3113. [doc] Document the relationship between serial-query-rate
f4429c1c31ec32f05125baab1adcc4f09863f7afMark Andrews and NOTIFY messages.
f4429c1c31ec32f05125baab1adcc4f09863f7afMark Andrews3112. [doc] Add missing descriptions of the update policy name
f4429c1c31ec32f05125baab1adcc4f09863f7afMark Andrews types "ms-self", "ms-subdomain", "krb5-self" and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein "krb5-subdomain", which allow machines to update
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein their own records, to the BIND 9 ARM.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3111. [bug] Improved consistency checks for dnssec-enable and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein dnssec-validation, added test cases to the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein checkconf system test. [RT #24398]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3110. [bug] dnssec-signzone: Wrong error message could appear
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein when attempting to sign with no KSK. [RT #24369]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3109. [func] The also-notify option now uses the same syntax
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein as a zone's masters clause. This means it is
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein now possible to specify a TSIG key to use when
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein sending notifies to a given server, or to include
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein an explicit named masters list in an also-notify
7f723eabc5768f576470cd9cc82fd4af200013a1Mark Andrews statement. [RT #23508]
7f723eabc5768f576470cd9cc82fd4af200013a1Mark Andrews3108. [cleanup] dnssec-signzone: Clarified some error and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein warning messages; removed #ifdef ALLOW_KSKLESS_ZONES
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein code (use -P instead). [RT #20852]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3107. [bug] dnssec-signzone: Report the correct number of ZSKs
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein when using -x. [RT #20852]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3106. [func] When logging client requests, include the name of
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the TSIG key if any. [RT #23619]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3105. [bug] GOST support can be suppressed by "configure
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein --without-gost" [RT #24367]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3104. [bug] Better support for cross-compiling. [RT #24367]
7f723eabc5768f576470cd9cc82fd4af200013a1Mark Andrews3103. [bug] Configuring 'dnssec-validation auto' in a view
7f723eabc5768f576470cd9cc82fd4af200013a1Mark Andrews instead of in the options statement could trigger
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein an assertion failure in named-checkconf. [RT #24382]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3102. [func] New 'dnssec-loadkeys-interval' option configures
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein how often, in minutes, to check the key repository
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein for updates when using automatic key maintenance.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Default is every 60 minutes (formerly hard-coded
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to 12 hours). [RT #23744]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3101. [bug] Zones using automatic key maintenance could fail
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to check the key repository for updates. [RT #23744]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3100. [security] Certain response policy zone configurations could
7f723eabc5768f576470cd9cc82fd4af200013a1Mark Andrews trigger an INSIST when receiving a query of type
7f723eabc5768f576470cd9cc82fd4af200013a1Mark Andrews RRSIG. [RT #24280]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3099. [test] "dlz" system test now runs but gives R:SKIPPED if
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein not compiled with --with-dlz-filesystem. [RT #24146]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3098. [bug] DLZ zones were answering without setting the AA bit.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3097. [test] Add a tool to test handling of malformed packets.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3096. [bug] Set KRB5_KTNAME before calling log_cred() in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein dst_gssapi_acceptctx(). [RT #24004]
7f723eabc5768f576470cd9cc82fd4af200013a1Mark Andrews3095. [bug] Handle isolated reserved ports in the port range.
7f723eabc5768f576470cd9cc82fd4af200013a1Mark Andrews3094. [doc] Expand dns64 documentation.
7f723eabc5768f576470cd9cc82fd4af200013a1Mark Andrews3093. [bug] Fix gssapi/kerberos dependencies [RT #23836]
7f723eabc5768f576470cd9cc82fd4af200013a1Mark Andrews3092. [bug] Signatures for records at the zone apex could go
7f723eabc5768f576470cd9cc82fd4af200013a1Mark Andrews stale due to an incorrect timer setting. [RT #23769]
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews3091. [bug] Fixed a bug in which zone keys that were published
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein and then subsequently activated could fail to trigger
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein automatic signing. [RT #22911]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3090. [func] Make --with-gssapi default [RT #23738]
7f723eabc5768f576470cd9cc82fd4af200013a1Mark Andrews3089. [func] dnssec-dsfromkey now supports reading keys from
7f723eabc5768f576470cd9cc82fd4af200013a1Mark Andrews standard input "dnssec-dsfromkey -f -". [RT #20662]
7f723eabc5768f576470cd9cc82fd4af200013a1Mark Andrews3088. [bug] Remove bin/tests/system/logfileconfig/ns1/named.conf
7f723eabc5768f576470cd9cc82fd4af200013a1Mark Andrews and add setup.sh in order to resolve changing
7f723eabc5768f576470cd9cc82fd4af200013a1Mark Andrews named.conf issue. [RT #23687]
7f723eabc5768f576470cd9cc82fd4af200013a1Mark Andrews3087. [bug] DDNS updates using SIG(0) with update-policy match
7f723eabc5768f576470cd9cc82fd4af200013a1Mark Andrews type "external" could cause a crash. [RT #23735]
7f723eabc5768f576470cd9cc82fd4af200013a1Mark Andrews3086. [bug] Running dnssec-settime -f on an old-style key will
7f723eabc5768f576470cd9cc82fd4af200013a1Mark Andrews now force an update to the new key format even if no
7f723eabc5768f576470cd9cc82fd4af200013a1Mark Andrews other change has been specified, using "-P now -A now"
7f723eabc5768f576470cd9cc82fd4af200013a1Mark Andrews as default values. [RT #22474]
7f723eabc5768f576470cd9cc82fd4af200013a1Mark Andrews3085. [func] New '-R' option in dnssec-signzone forces removal
7f723eabc5768f576470cd9cc82fd4af200013a1Mark Andrews of signatures which have not yet expired but
7f723eabc5768f576470cd9cc82fd4af200013a1Mark Andrews were generated by a key that no longer exists.
7f723eabc5768f576470cd9cc82fd4af200013a1Mark Andrews3084. [func] A new command "rndc sync" dumps pending changes in
7f723eabc5768f576470cd9cc82fd4af200013a1Mark Andrews a dynamic zone to disk; "rndc sync -clean" also
7f723eabc5768f576470cd9cc82fd4af200013a1Mark Andrews removes the journal file after syncing. Also,
7f723eabc5768f576470cd9cc82fd4af200013a1Mark Andrews "rndc freeze" no longer removes journal files.
7f723eabc5768f576470cd9cc82fd4af200013a1Mark Andrews3083. [bug] NOTIFY messages were not being sent when generating
f4429c1c31ec32f05125baab1adcc4f09863f7afMark Andrews a NSEC3 chain incrementally. [RT #23702]
f4429c1c31ec32f05125baab1adcc4f09863f7afMark Andrews3082. [port] strtok_r is threads only. [RT #23747]
f4429c1c31ec32f05125baab1adcc4f09863f7afMark Andrews3081. [bug] Failure of DNAME substitution did not return
f4429c1c31ec32f05125baab1adcc4f09863f7afMark Andrews YXDOMAIN. [RT #23591]
f4429c1c31ec32f05125baab1adcc4f09863f7afMark Andrews3080. [cleanup] Replaced compile time constant by STDTIME_ON_32BITS.
f4429c1c31ec32f05125baab1adcc4f09863f7afMark Andrews3079. [bug] Handle isc_event_allocate failures in t_tasks.
f4429c1c31ec32f05125baab1adcc4f09863f7afMark Andrews3078. [func] Added a new include file with function typedefs
f4429c1c31ec32f05125baab1adcc4f09863f7afMark Andrews for the DLZ "dlopen" driver. [RT #23629]
f4429c1c31ec32f05125baab1adcc4f09863f7afMark Andrews3077. [bug] zone.c:zone_refreshkeys() incorrectly called
f4429c1c31ec32f05125baab1adcc4f09863f7afMark Andrews dns_zone_attach(), use zone->irefs instead. [RT #23303]
f4429c1c31ec32f05125baab1adcc4f09863f7afMark Andrews3076. [func] New '-L' option in dnssec-keygen, dnsset-settime, and
f4429c1c31ec32f05125baab1adcc4f09863f7afMark Andrews dnssec-keyfromlabel sets the default TTL of the
f4429c1c31ec32f05125baab1adcc4f09863f7afMark Andrews key. When possible, automatic signing will use that
f4429c1c31ec32f05125baab1adcc4f09863f7afMark Andrews TTL when the key is published. [RT #23304]
f4429c1c31ec32f05125baab1adcc4f09863f7afMark Andrews3075. [bug] dns_dnssec_findzonekeys{2} used a inconsistent
f4429c1c31ec32f05125baab1adcc4f09863f7afMark Andrews timestamp when determining which keys are active.
f4429c1c31ec32f05125baab1adcc4f09863f7afMark Andrews3074. [bug] Make the adb cache read through for zone data and
f4429c1c31ec32f05125baab1adcc4f09863f7afMark Andrews glue learn for zone named is authoritative for.
f4429c1c31ec32f05125baab1adcc4f09863f7afMark Andrews3073. [bug] managed-keys changes were not properly being recorded.
f4429c1c31ec32f05125baab1adcc4f09863f7afMark Andrews3072. [bug] dns_dns64_aaaaok() potential NULL pointer dereference.
f4429c1c31ec32f05125baab1adcc4f09863f7afMark Andrews3071. [bug] has_nsec could be used uninitialized in
f4429c1c31ec32f05125baab1adcc4f09863f7afMark Andrews update.c:next_active. [RT #20256]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3070. [bug] dnssec-signzone potential NULL pointer dereference.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3069. [cleanup] Silence warnings messages from clang static analysis.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3068. [bug] Named failed to build with a OpenSSL without engine
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein support. [RT #23473]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3067. [bug] ixfr-from-differences {master|slave}; failed to
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews select the master/slave zones. [RT #23580]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3066. [func] The DLZ "dlopen" driver is now built by default,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein no longer requiring a configure option. To
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein disable it, use "configure --without-dlopen".
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Driver also supported on win32. [RT #23467]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3065. [bug] RRSIG could have time stamps too far in the future.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3064. [bug] powerpc: add sync instructions to the end of atomic
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein operations. [RT #23469]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3063. [contrib] More verbose error reporting from DLZ LDAP. [RT #23402]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3062. [func] Made several changes to enhance human readability
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein of DNSSEC data in dig output and in generated
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - DNSKEY record comments are more verbose, no
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein longer used in multiline mode only
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - multiline RRSIG records reformatted
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - multiline output mode for NSEC3PARAM records
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - "dig +norrcomments" suppresses DNSKEY comments
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - "dig +split=X" breaks hex/base64 records into
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein fields of width X; "dig +nosplit" disables this.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3061. [func] New option "dnssec-signzone -D", only write out
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein generated DNSSEC records. [RT #22896]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3060. [func] New option "dnssec-signzone -X <date>" allows
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein specification of a separate expiration date
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein for DNSKEY RRSIGs and other RRSIGs. [RT #22141]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3059. [test] Added a regression test for change #3023.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3058. [bug] Cause named to terminate at startup or rndc reconfig/
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein reload to fail, if a log file specified in the conf
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein file isn't a plain file. [RT #22771]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3057. [bug] "rndc secroots" would abort after the first error
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein and so could miss some views. [RT #23488]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3056. [func] Added support for URI resource record. [RT #23386]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3055. [placeholder]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3054. [bug] Added elliptic curve support check in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein GOST OpenSSL engine detection. [RT #23485]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3053. [bug] Under a sustained high query load with a finite
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein max-cache-size, it was possible for cache memory
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to be exhausted and not recovered. [RT #23371]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3052. [test] Fixed last autosign test report. [RT #23256]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3051. [bug] NS records obscure DNAME records at the bottom of the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein zone if both are present. [RT #23035]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3050. [bug] The autosign system test was timing dependent.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Wait for the initial autosigning to complete
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein before running the rest of the test. [RT #23035]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3049. [bug] Save and restore the gid when creating creating
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein named.pid at startup. [RT #23290]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3048. [bug] Fully separate view key management. [RT #23419]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3047. [bug] DNSKEY NODATA responses not cached fixed in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein validator.c. Tests added to dnssec system test.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3046. [bug] Use RRSIG original TTL to compute validated RRset
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein and RRSIG TTL. [RT #23332]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3045. [removed] Replaced by change #3050.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3044. [bug] Hold the socket manager lock while freeing the socket.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3043. [test] Merged in the NetBSD ATF test framework (currently
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein version 0.12) for development of future unit tests.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Use configure --with-atf to build ATF internally
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein or configure --with-atf=prefix to use an external
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein copy. [RT #23209]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3042. [bug] dig +trace could fail attempting to use IPv6
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein addresses on systems with only IPv4 connectivity.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3041. [bug] dnssec-signzone failed to generate new signatures on
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein ttl changes. [RT #23330]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3040. [bug] Named failed to validate insecure zones where a node
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein with a CNAME existed between the trust anchor and the
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews top of the zone. [RT #23338]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3039. [func] Redirect on NXDOMAIN support. [RT #23146]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3038. [bug] Install <dns/rpz.h>. [RT #23342]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3037. [doc] Update COPYRIGHT to contain all the individual
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein copyright notices that cover various parts.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3036. [bug] Check built-in zone arguments to see if the zone
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein is re-usable or not. [RT #21914]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3035. [cleanup] Simplify by using strlcpy. [RT #22521]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3034. [cleanup] nslookup: use strlcpy instead of safecopy. [RT #22521]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3033. [cleanup] Add two INSIST(bucket != DNS_ADB_INVALIDBUCKET).
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3032. [bug] rdatalist.c: add missing REQUIREs. [RT #22521]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3031. [bug] dns_rdataclass_format() handle a zero sized buffer.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3030. [bug] dns_rdatatype_format() handle a zero sized buffer.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3029. [bug] isc_netaddr_format() handle a zero sized buffer.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3028. [bug] isc_sockaddr_format() handle a zero sized buffer.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3027. [bug] Add documented REQUIREs to cfg_obj_asnetprefix() to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein catch NULL pointer dereferences before they happen.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews3026. [bug] lib/isc/httpd.c: check that we have enough space
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein after calling grow_headerspace() and if not
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein re-call grow_headerspace() until we do. [RT #22521]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3025. [bug] Fixed a possible deadlock due to zone resigning.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3024. [func] RTT Banding removed due to minor security increase
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein but major impact on resolver latency. [RT #23310]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3023. [bug] Named could be left in an inconsistent state when
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein receiving multiple AXFR response messages that were
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein not all TSIG-signed. [RT #23254]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3022. [bug] Fixed rpz SERVFAILs after failed zone transfers
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3021. [bug] Change #3010 was incomplete. [RT #22296]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3020. [bug] auto-dnssec failed to correctly update the zone when
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein changing the DNSKEY RRset. [RT #23232]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3019. [test] Test: check apex NSEC3 records after adding DNSKEY
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein record via UPDATE. [RT #23229]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3018. [bug] Named failed to check for the "none;" acl when deciding
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein if a zone may need to be re-signed. [RT #23120]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3017. [doc] dnssec-keyfromlabel -I was not properly documented.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3016. [bug] rndc usage missing '-b'. [RT #22937]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3015. [port] win32: fix IN6_IS_ADDR_LINKLOCAL and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein IN6_IS_ADDR_SITELOCAL macros. [RT #22724]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3014. [placeholder]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3013. [bug] The DNS64 ttl was not always being set as expected.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews3012. [bug] Remove DNSKEY TTL change pairs before generating
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein signing records for any remaining DNSKEY changes.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3011. [func] Change the default query timeout from 30 seconds
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to 10. Allow setting this in named.conf using the new
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein 'resolver-query-timeout' option, which specifies a max
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein time in seconds. 0 means 'default' and anything longer
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein than 30 will be silently set to 30. [RT #22852]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3010. [bug] Fixed a bug where "rndc reconfig" stopped the timer
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein for refreshing managed-keys. [RT #22296]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews3009. [bug] clients-per-query code didn't work as expected with
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein particular query patterns. [RT #22972]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein --- 9.8.0b1 released ---
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3008. [func] Response policy zones (RPZ) support. [RT #21726]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3007. [bug] Named failed to preserve the case of domain names in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein rdata which is not compressible when writing master
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein files. [RT #22863]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3006. [func] Allow dynamically generated TSIG keys to be preserved
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein across restarts of named. Initially this is for
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews TSIG keys generated using GSSAPI. [RT #22639]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3005. [port] Solaris: Work around the lack of
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein gsskrb5_register_acceptor_identity() by setting
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the KRB5_KTNAME environment variable to the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein contents of tkey-gssapi-keytab. Also fixed
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein test errors on MacOSX. [RT #22853]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3004. [func] DNS64 reverse support. [RT #22769]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3003. [experimental] Added update-policy match type "external",
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein enabling named to defer the decision of whether to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein allow a dynamic update to an external daemon.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews (Contributed by Andrew Tridgell.) [RT #22758]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3002. [bug] isc_mutex_init_errcheck() failed to destroy attr.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3001. [func] Added a default trust anchor for the root zone, which
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein can be switched on by setting "dnssec-validation auto;"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in the named.conf options. [RT #21727]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein3000. [bug] More TKEY/GSS fixes:
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - nsupdate can now get the default realm from
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the user's Kerberos principal
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - corrected gsstest compilation flags
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - improved documentation
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - fixed some NULL dereferences
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2999. [func] Add GOST support (RFC 5933). [RT #20639]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2998. [func] Add isc_task_beginexclusive and isc_task_endexclusive
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to the task api. [RT #22776]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2997. [func] named -V now reports the OpenSSL and libxml2 verions
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein it was compiled against. [RT #22687]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews2996. [security] Temporarily disable SO_ACCEPTFILTER support.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews2995. [bug] The Kerberos realm was not being correctly extracted
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews from the signer's identity. [RT #22770]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews2994. [port] NetBSD: use pthreads by default on NetBSD >= 5.0, and
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews do not use threads on earlier versions. Also kill
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews the unproven-pthreads, mit-pthreads, and ptl2 support.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews2993. [func] Dynamically grow adb hash tables. [RT #21186]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews2992. [contrib] contrib/check-secure-delegation.pl: A simple tool
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews for looking at a secure delegation. [RT #22059]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews2991. [contrib] contrib/zone-edit.sh: A simple zone editing tool for
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews dynamic zones. [RT #22365]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews2990. [bug] 'dnssec-settime -S' no longer tests prepublication
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews interval validity when the interval is set to 0.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews2989. [func] Added support for writable DLZ zones. (Contributed
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews by Andrew Tridgell of the Samba project.) [RT #22629]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2988. [experimental] Added a "dlopen" DLZ driver, allowing the creation
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein of external DLZ drivers that can be loaded as
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein shared objects at runtime rather than linked with
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein named. Currently this is switched on via a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein compile-time option, "configure --with-dlz-dlopen".
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Note: the syntax for configuring DLZ zones
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein is likely to be refined in future releases.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein (Contributed by Andrew Tridgell of the Samba
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein project.) [RT #22629]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2987. [func] Improve ease of configuring TKEY/GSS updates by
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein adding a "tkey-gssapi-keytab" option. If set,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein updates will be allowed with any key matching
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein a principal in the specified keytab file.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein "tkey-gssapi-credential" is no longer required
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein and is expected to be deprecated. (Contributed
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein by Andrew Tridgell of the Samba project.)
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews2986. [func] Add new zone type "static-stub". It's like a stub
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein zone, but the nameserver names and/or their IP
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein addresses are statically configured. [RT #21474]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2985. [bug] Add a regression test for change #2896. [RT #21324]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2984. [bug] Don't run MX checks when the target of the MX record
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein is ".". [RT #22645]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2983. [bug] Include "loadkeys" in rndc help output. [RT #22493]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein --- 9.8.0a1 released ---
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews2982. [bug] Reference count dst keys. dst_key_attach() can be used
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein increment the reference count.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Note: dns_tsigkey_createfromkey() callers should now
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein always call dst_key_free() rather than setting it
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to NULL on success. [RT #22672]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2981. [func] Partial DNS64 support (AAAA synthesis). [RT #21991]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2980. [bug] named didn't properly handle UPDATES that changed the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein TTL of the NSEC3PARAM RRset. [RT #22363]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2979. [bug] named could deadlock during shutdown if two
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews "rndc stop" commands were issued at the same
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews time. [RT #22108]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews2978. [port] hpux: look for <devpoll.h> [RT #21919]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2977. [bug] 'nsupdate -l' report if the session key is missing.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2976. [bug] named could die on exit after negotiating a GSS-TSIG
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein key. [RT #22573]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2975. [bug] rbtdb.c:cleanup_dead_nodes_callback() acquired the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein wrong lock which could lead to server deadlock.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews2974. [bug] Some valid UPDATE requests could fail due to a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein consistency check examining the existing version
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein of the zone rather than the new version resulting
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein from the UPDATE. [RT #22413]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2973. [bug] bind.keys.h was being removed by the "make clean"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein at the end of configure resulting in build failures
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein where there is very old version of perl installed.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Move it to "make maintainer-clean". [RT #22230]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2972. [bug] win32: address windows socket errors. [RT #21906]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2971. [bug] Fixed a bug that caused journal files not to be
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews compacted on Windows systems as a result of
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein non-POSIX-compliant rename() semantics. [RT #22434]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2970. [security] Adding a NO DATA negative cache entry failed to clear
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein any matching RRSIG records. A subsequent lookup of
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein of NO DATA cache entry could trigger a INSIST when the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein unexpected RRSIG was also returned with the NO DATA
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein cache entry.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein CVE-2010-3613, VU#706148. [RT #22288]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2969. [security] Fix acl type processing so that allow-query works
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in options and view statements. Also add a new
47012ae6dbf18a2503d7b33c1c9583dc38625cb7Mark Andrews set of tests to verify proper functioning.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein CVE-2010-3615, VU#510208. [RT #22418]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2968. [security] Named could fail to prove a data set was insecure
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein before marking it as insecure. One set of conditions
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein that can trigger this occurs naturally when rolling
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein DNSKEY algorithms.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein CVE-2010-3614, VU#837744. [RT #22309]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2967. [bug] 'host -D' now turns on debugging messages earlier.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2966. [bug] isc_print_vsnprintf() failed to check if there was
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews space available in the buffer when adding a left
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein justified character with a non zero width,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein (e.g. "%-1c"). [RT #22270]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2965. [func] Test HMAC functions using test data from RFC 2104 and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein RFC 4634. [RT #21702]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2964. [placeholder]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2963. [security] The allow-query acl was being applied instead of the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein allow-query-cache acl to cache lookups. [RT #22114]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews2962. [port] win32: add more dependencies to BINDBuild.dsw.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2961. [bug] Be still more selective about the non-authoritative
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein answers we apply change 2748 to. [RT #22074]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2960. [func] Check that named accepts non-authoritative answers.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2959. [func] Check that named starts with a missing masterfile.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2958. [bug] named failed to start with a missing master file.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2957. [bug] entropy_get() and entropy_getpseudo() failed to match
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the API for RAND_bytes() and RAND_pseudo_bytes()
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein respectively. [RT #21962]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews2956. [port] Enable atomic operations on the PowerPC64. [RT #21899]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews2955. [func] Provide more detail in the recursing log. [RT #22043]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews2954. [bug] contrib: dlz_mysql_driver.c bad error handling on
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews build_sqldbinstance failure. [RT #21623]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews2953. [bug] Silence spurious "expected covering NSEC3, got an
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews exact match" message when returning a wildcard
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews no data response. [RT #21744]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews2952. [port] win32: named-checkzone and named-checkconf failed
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews to initialize winsock. [RT #21932]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews2951. [bug] named failed to generate a correct signed response
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews in a optout, delegation only zone with no secure
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews delegations. [RT #22007]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2950. [bug] named failed to perform a SOA up to date check when
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein falling back to TCP on UDP timeouts when
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein ixfr-from-differences was set. [RT #21595]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2949. [bug] dns_view_setnewzones() contained a memory leak if
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein it was called multiple times. [RT #21942]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2948. [port] MacOS: provide a mechanism to configure the test
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein interfaces at reboot. See bin/tests/system/README
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein for details.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews2947. [placeholder]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2946. [doc] Document the default values for the minimum and maximum
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein zone refresh and retry values in the ARM. [RT #21886]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2945. [doc] Update empty-zones list in ARM. [RT #21772]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2944. [maint] Remove ORCHID prefix from built in empty zones.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2943. [func] Add support to load new keys into managed zones
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein without signing immediately with "rndc loadkeys".
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Add support to link keys with "dnssec-keygen -S"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein and "dnssec-settime -S". [RT #21351]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2942. [contrib] zone2sqlite failed to setup the entropy sources.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2941. [bug] sdb and sdlz (dlz's zone database) failed to support
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein DNAME at the zone apex. [RT #21610]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2940. [port] Remove connection aborted error message on
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Windows. [RT #21549]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2939. [func] Check that named successfully skips NSEC3 records
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein that fail to match the NSEC3PARAM record currently
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in use. [RT #21868]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2938. [bug] When generating signed responses, from a signed zone
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein that uses NSEC3, named would use a uninitialized
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein pointer if it needed to skip a NSEC3 record because
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein it didn't match the selected NSEC3PARAM record for
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein zone. [RT #21868]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2937. [bug] Worked around an apparent race condition in over
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein memory conditions. Without this fix a DNS cache DB or
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein ADB could incorrectly stay in an over memory state,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein effectively refusing further caching, which
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein subsequently made a BIND 9 caching server unworkable.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein This fix prevents this problem from happening by
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews polling the state of the memory context, rather than
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein making a copy of the state, which appeared to cause
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein a race. This is a "workaround" in that it doesn't
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein solve the possible race per se, but several experiments
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein proved this change solves the symptom. Also, the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein polling overhead hasn't been reported to be an issue.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews This bug should only affect a caching server that
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews specifies a finite max-cache-size. It's also quite
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews likely that the bug happens only when enabling threads,
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews but it's not confirmed yet. [RT #21818]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews2936. [func] Improved configuration syntax and multiple-view
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews support for addzone/delzone feature (see change
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews #2930). Removed "new-zone-file" option, replaced
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews with "allow-new-zones (yes|no)". The new-zone-file
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews for each view is now created automatically, with
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews a filename generated from a hash of the view name.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews It is no longer necessary to "include" the
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews new-zone-file in named.conf; this happens
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein automatically. Zones that were not added via
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein "rndc addzone" can no longer be removed with
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein "rndc delzone". [RT #19447]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2935. [bug] nsupdate: improve 'file not found' error message.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews2934. [bug] Use ANSI C compliant shift range in lib/isc/entropy.c.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2933. [bug] 'dig +nsid' used stack memory after it went out of
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein scope. This could potentially result in a unknown,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein potentially malformed, EDNS option being sent instead
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein of the desired NSID option. [RT #21781]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2932. [cleanup] Corrected a numbering error in the "dnssec" test.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2931. [bug] Temporarily and partially disable change 2864
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein because it would cause infinite attempts of RRSIG
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein queries. This is an urgent care fix; we'll
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein revisit the issue and complete the fix later.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews2930. [experimental] New "rndc addzone" and "rndc delzone" commands
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews allow dynamic addition and deletion of zones.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein To enable this feature, specify a "new-zone-file"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein option at the view or options level in named.conf.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Zone configuration information for the new zones
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein will be written into that file. To make the new
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein zones persist after a restart, "include" the file
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein into named.conf in the appropriate view. (Note:
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein This feature is not yet documented, and its syntax
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein is expected to change.) [RT #19447]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2929. [bug] Improved handling of GSS security contexts:
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - added LRU expiration for generated TSIGs
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews - added the ability to use a non-default realm
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - added new "realm" keyword in nsupdate
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - limited lifetime of generated keys to 1 hour
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein or the lifetime of the context (whichever is
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2928. [bug] Be more selective about the non-authoritative
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein answer we apply change 2748 to. [RT #21594]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2927. [placeholder]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2926. [placeholder]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2925. [bug] Named failed to accept uncachable negative responses
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein from insecure zones. [RT #21555]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2924. [func] 'rndc secroots' dump a combined summary of the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein current managed keys combined with trusted keys.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2923. [bug] 'dig +trace' could drop core after "connection
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein timeout". [RT #21514]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2922. [contrib] Update zkt to version 1.0.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews2921. [bug] The resolver could attempt to destroy a fetch context
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein too soon. [RT #19878]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2920. [func] Allow 'filter-aaaa-on-v4' to be applied selectively
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to IPv4 clients. New acl 'filter-aaaa' (default any).
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2919. [func] Add autosign-ksk and autosign-zsk virtual time tests.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2918. [maint] Add AAAA address for I.ROOT-SERVERS.NET.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2917. [func] Virtual time test framework. [RT #20801]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2916. [func] Add framework to use IPv6 in tests.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein fd92:7065:b8e:ffff::1 ... fd92:7065:b8e:ffff::7
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2915. [cleanup] Be smarter about which objects we attempt to compile
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein based on configure options. [RT #21444]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2914. [bug] Make the "autosign" system test more portable.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2913. [func] Add pkcs#11 system tests. [RT #20784]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2912. [func] Windows clients don't like UPDATE responses that clear
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the zone section. [RT #20986]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2911. [bug] dnssec-signzone didn't handle out of zone records well.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2910. [func] Sanity check Kerberos credentials. [RT #20986]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2909. [bug] named-checkconf -p could die if "update-policy local;"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein was specified in named.conf. [RT #21416]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2908. [bug] It was possible for re-signing to stop after removing
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein a DNSKEY. [RT #21384]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2907. [bug] The export version of libdns had undefined references.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2906. [bug] Address RFC 5011 implementation issues. [RT #20903]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2905. [port] aix: set use_atomic=yes with native compiler.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2904. [bug] When using DLV, sub-zones of the zones in the DLV,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein could be incorrectly marked as insecure instead of
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein secure leading to negative proofs failing. This was
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein a unintended outcome from change 2890. [RT #21392]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2903. [bug] managed-keys-directory missing from namedconf.c.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2902. [func] Add regression test for change 2897. [RT #21040]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2901. [port] Use AC_C_FLEXIBLE_ARRAY_MEMBER. [RT #21316]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2900. [bug] The placeholder negative caching element was not
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein properly constructed triggering a INSIST in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein dns_ncache_towire(). [RT #21346]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2899. [port] win32: Support linking against OpenSSL 1.0.0.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2898. [bug] nslookup leaked memory when -domain=value was
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein specified. [RT #21301]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2897. [bug] NSEC3 chains could be left behind when transitioning
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to insecure. [RT #21040]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2896. [bug] "rndc sign" failed to properly update the zone
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein when adding a DNSKEY for publication only. [RT #21045]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2895. [func] genrandom: add support for the generation of multiple
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein files. [RT #20917]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2894. [contrib] DLZ LDAP support now use '$' not '%'. [RT #21294]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2893. [bug] Improve managed keys support. New named.conf option
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein managed-keys-directory. [RT #20924]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2892. [bug] Handle REVOKED keys better. [RT #20961]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2891. [maint] Update empty-zones list to match
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein draft-ietf-dnsop-default-local-zones-13. [RT #21099]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2890. [bug] Handle the introduction of new trusted-keys and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein DS, DLV RRsets better. [RT #21097]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2889. [bug] Elements of the grammar where not properly reported.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2888. [bug] Only the first EDNS option was displayed. [RT #21273]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2887. [bug] Report the keytag times in UTC in the .key file,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein local time is presented as a comment within the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein comment. [RT #21223]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2886. [bug] ctime() is not thread safe. [RT #21223]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2885. [bug] Improve -fno-strict-aliasing support probing in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein configure. [RT #21080]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2884. [bug] Insufficient validation in dns_name_getlabelsequence().
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2883. [bug] 'dig +short' failed to handle really large datasets.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2882. [bug] Remove memory context from list of active contexts
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein before clearing 'magic'. [RT #21274]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2881. [bug] Reduce the amount of time the rbtdb write lock
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein is held when closing a version. [RT #21198]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2880. [cleanup] Make the output of dnssec-keygen and dnssec-revoke
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein consistent. [RT #21078]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2879. [contrib] DLZ bdbhpt driver fails to close correct cursor.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2878. [func] Incrementally write the master file after performing
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein a AXFR. [RT #21010]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2877. [bug] The validator failed to skip obviously mismatching
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein RRSIGs. [RT #21138]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2876. [bug] Named could return SERVFAIL for negative responses
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein from unsigned zones. [RT #21131]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2875. [bug] dns_time64_fromtext() could accept non digits.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2874. [bug] Cache lack of EDNS support only after the server
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein successfully responds to the query using plain DNS.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2873. [bug] Canceling a dynamic update via the dns/client module
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein could trigger an assertion failure. [RT #21133]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2872. [bug] Modify dns/client.c:dns_client_createx() to only
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein require one of IPv4 or IPv6 rather than both.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2871. [bug] Type mismatch in mem_api.c between the definition and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the header file, causing build failure with
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein --enable-exportlib. [RT #21138]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2870. [maint] Add AAAA address for L.ROOT-SERVERS.NET.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2869. [bug] Fix arguments to dns_keytable_findnextkeynode() call.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2868. [cleanup] Run "make clean" at the end of configure to ensure
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein any changes made by configure are integrated.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Use --with-make-clean=no to disable. [RT #20994]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2867. [bug] Don't set GSS_C_SEQUENCE_FLAG as Windows DNS servers
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein don't like it. [RT #20986]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2866. [bug] Windows does not like the TSIG name being compressed.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2865. [bug] memset to zero event.data. [RT #20986]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2864. [bug] Direct SIG/RRSIG queries were not handled correctly.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2863. [port] linux: disable IPv6 PMTUD and use network minimum MTU.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2862. [bug] nsupdate didn't default to the parent zone when
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein updating DS records. [RT #20896]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2861. [doc] dnssec-settime man pages didn't correctly document the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein inactivation time. [RT #21039]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2860. [bug] named-checkconf's usage was out of date. [RT #21039]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2859. [bug] When canceling validation it was possible to leak
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein memory. [RT #20800]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2858. [bug] RTT estimates were not being adjusted on ICMP errors.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2857. [bug] named-checkconf did not fail on a bad trusted key.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2856. [bug] The size of a memory allocation was not always properly
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein recorded. [RT #20927]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2855. [func] nsupdate will now preserve the entered case of domain
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein names in update requests it sends. [RT #20928]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2854. [func] dig: allow the final soa record in a axfr response to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein be suppressed, dig +onesoa. [RT #20929]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2853. [bug] add_sigs() could run out of scratch space. [RT #21015]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2852. [bug] Handle broken DNSSEC trust chains better. [RT #15619]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2851. [doc] nslookup.1, removed <informalexample> from the docbook
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein source as it produced bad nroff. [RT #21007]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2850. [bug] If isc_heap_insert() failed due to memory shortage
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the heap would have corrupted entries. [RT #20951]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2849. [bug] Don't treat errors from the xml2 library as fatal.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2848. [doc] Moved README.dnssec, README.libdns, README.pkcs11 and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein README.rfc5011 into the ARM. [RT #20899]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2847. [cleanup] Corrected usage message in dnssec-settime. [RT #20921]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2846. [bug] EOF on unix domain sockets was not being handled
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein correctly. [RT #20731]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2845. [bug] RFC 5011 client could crash on shutdown. [RT #20903]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2844. [doc] notify-delay default in ARM was wrong. It should have
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein been five (5) seconds.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2843. [func] Prevent dnssec-keygen and dnssec-keyfromlabel from
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein creating key files if there is a chance that the new
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein key ID will collide with an existing one after
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein either of the keys has been revoked. (To override
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein this in the case of dnssec-keyfromlabel, use the -y
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein option. dnssec-keygen will simply create a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein different, non-colliding key, so an override is
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein not necessary.) [RT #20838]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2842. [func] Added "smartsign" and improved "autosign" and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein "dnssec" regression tests. [RT #20865]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2841. [bug] Change 2836 was not complete. [RT #20883]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2840. [bug] Temporary fixed pkcs11-destroy usage check.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2839. [bug] A KSK revoked by named could not be deleted.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2838. [placeholder]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2837. [port] Prevent Linux spurious warnings about fwrite().
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2836. [bug] Keys that were scheduled to become active could
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein be delayed. [RT #20874]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2835. [bug] Key inactivity dates were inadvertently stored in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the private key file with the outdated tag
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein "Unpublish" rather than "Inactive". This has been
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein fixed; however, any existing keys that had Inactive
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein dates set will now need to have them reset, using
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein 'dnssec-settime -I'. [RT #20868]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2834. [bug] HMAC-SHA* keys that were longer than the algorithm
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein digest length were used incorrectly, leading to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein interoperability problems with other DNS
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein implementations. This has been corrected.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein (Note: If an oversize key is in use, and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein compatibility is needed with an older release of
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein BIND, the new tool "isc-hmac-fixup" can convert
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the key secret to a form that will work with all
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein versions.) [RT #20751]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2833. [cleanup] Fix usage messages in dnssec-keygen and dnssec-settime.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2832. [bug] Modify "struct stat" in lib/export/samples/nsprobe.c
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to avoid redefinition in some OSs [RT 20831]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2831. [security] Do not attempt to validate or cache
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews out-of-bailiwick data returned with a secure
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein answer; it must be re-fetched from its original
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein source and validated in that context. [RT #20819]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2830. [bug] Changing the OPTOUT setting could take multiple
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein passes. [RT #20813]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2829. [bug] Fixed potential node inconsistency in rbtdb.c.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2828. [security] Cached CNAME or DNAME RR could be returned to clients
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein without DNSSEC validation. [RT #20737]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2827. [security] Bogus NXDOMAIN could be cached as if valid. [RT #20712]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2826. [bug] NSEC3->NSEC transitions could fail due to a lock not
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein being released. [RT #20740]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2825. [bug] Changing the setting of OPTOUT in a NSEC3 chain that
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein was in the process of being created was not properly
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein recorded in the zone. [RT #20786]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews2824. [bug] "rndc sign" was not being run by the correct task.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2823. [bug] rbtdb.c:getsigningtime() was missing locks. [RT #20781]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews2822. [bug] rbtdb.c:loadnode() could return the wrong result.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2821. [doc] Add note that named-checkconf doesn't automatically
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2820. [func] Handle read access failure of OpenSSL configuration
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein file more user friendly (PKCS#11 engine patch).
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews2819. [cleanup] Removed unnecessary DNS_POINTER_MAXHOPS define.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews2818. [cleanup] rndc could return an incorrect error code
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein when a zone was not found. [RT #20767]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2817. [cleanup] Removed unnecessary isc_task_endexclusive() calls.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2816. [bug] previous_closest_nsec() could fail to return
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein data for NSEC3 nodes [RT #29730]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2815. [bug] Exclusively lock the task when freezing a zone.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews2814. [func] Provide a definitive error message when a master
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews zone is not loaded. [RT #20757]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2813. [bug] Better handling of unreadable DNSSEC key files.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2812. [bug] Make sure updates can't result in a zone with
297be3708069ef31814d6d75c0d71a50a78feb03Mark Andrews NSEC-only keys and NSEC3 records. [RT #20748]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2811. [cleanup] Add "rndc sign" to list of commands in rndc usage
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein output. [RT #20733]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2810. [doc] Clarified the process of transitioning an NSEC3 zone
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to insecure. [RT #20746]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2809. [cleanup] Restored accidentally-deleted text in usage output
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in dnssec-settime and dnssec-revoke [RT #20739]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2808. [bug] Remove the attempt to install atomic.h from lib/isc.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein atomic.h is correctly installed by the architecture
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein specific subdirectories. [RT #20722]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2807. [bug] Fixed a possible ASSERT when reconfiguring zone
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein keys. [RT #20720]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein --- 9.7.0rc1 released ---
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2806. [bug] "rdnc sign" could delay re-signing the DNSKEY
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein when it had changed. [RT #20703]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews2805. [bug] Fixed namespace problems encountered when building
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews external programs using non-exported BIND9 libraries
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews (i.e., built without --enable-exportlib). [RT #20679]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2804. [bug] Send notifies when a zone is signed with "rndc sign"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein or as a result of a scheduled key change. [RT #20700]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2803. [port] win32: Install named-journalprint, nsec3hash, arpaname
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein and genrandom under windows. [RT #20670]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2802. [cleanup] Rename journalprint to named-journalprint. [RT #20670]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews2801. [func] Detect and report records that are different according
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews to DNSSEC but are semantically equal according to plain
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews DNS. Apply plain DNS comparisons rather than DNSSEC
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein comparisons when processing UPDATE requests.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein dnssec-signzone now removes such semantically duplicate
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein records prior to signing the RRset.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein named-checkzone -r {ignore|warn|fail} (default warn)
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein named-compilezone -r {ignore|warn|fail} (default warn)
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein named.conf: check-dup-records {ignore|warn|fail};
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2800. [func] Reject zones which have NS records which refer to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein CNAMEs, DNAMEs or don't have address record (class IN
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein only). Reject UPDATEs which would cause the zone
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to fail the above checks if committed. [RT #20678]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2799. [cleanup] Changed the "secure-to-insecure" option to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein "dnssec-secure-to-insecure", and "dnskey-ksk-only"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to "dnssec-dnskey-kskonly", for clarity. [RT #20586]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2798. [bug] Addressed bugs in managed-keys initialization
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein and rollover. [RT #20683]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2797. [bug] Don't decrement the dispatch manager's maxbuffers.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2796. [bug] Missing dns_rdataset_disassociate() call in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein dns_nsec3_delnsec3sx(). [RT #20681]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2795. [cleanup] Add text to differentiate "update with no effect"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein log messages. [RT #18889]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2794. [bug] Install <isc/namespace.h>. [RT #20677]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2793. [func] Add "autosign" and "metadata" tests to the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein automatic tests. [RT #19946]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2792. [func] "filter-aaaa-on-v4" can now be set in view
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein options (if compiled in). [RT #20635]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2791. [bug] The installation of isc-config.sh was broken.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2790. [bug] Handle DS queries to stub zones. [RT #20440]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2789. [bug] Fixed an INSIST in dispatch.c [RT #20576]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2788. [bug] dnssec-signzone could sign with keys that were
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein not requested [RT #20625]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2787. [bug] Spurious log message when zone keys were
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein dynamically reconfigured. [RT #20659]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2786. [bug] Additional could be promoted to answer. [RT #20663]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein --- 9.7.0b3 released ---
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2785. [bug] Revoked keys could fail to self-sign [RT #20652]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2784. [bug] TC was not always being set when required glue was
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein dropped. [RT #20655]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2783. [func] Return minimal responses to EDNS/UDP queries with a UDP
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein buffer size of 512 or less. [RT #20654]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2782. [port] win32: use getaddrinfo() for hostname lookups.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2781. [bug] Inactive keys could be used for signing. [RT #20649]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2780. [bug] dnssec-keygen -A none didn't properly unset the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein activation date in all cases. [RT #20648]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2779. [bug] Dynamic key revocation could fail. [RT #20644]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2778. [bug] dnssec-signzone could fail when a key was revoked
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein without deleting the unrevoked version. [RT #20638]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2777. [contrib] DLZ MYSQL auto reconnect support discovery was wrong.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2776. [bug] Change #2762 was not correct. [RT #20647]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2775. [bug] Accept RSASHA256 and RSASHA512 as NSEC3 compatible
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in dnssec-keyfromlabel. [RT #20643]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2774. [bug] Existing cache DB wasn't being reused after
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein reconfiguration. [RT #20629]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2773. [bug] In autosigned zones, the SOA could be signed
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein with the KSK. [RT #20628]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2772. [security] When validating, track whether pending data was from
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the additional section or not and only return it if
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein validates as secure. [RT #20438]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2771. [bug] dnssec-signzone: DNSKEY records could be
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein corrupted when importing from key files [RT #20624]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2770. [cleanup] Add log messages to resolver.c to indicate events
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein causing FORMERR responses. [RT #20526]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2769. [cleanup] Change #2742 was incomplete. [RT #19589]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2768. [bug] dnssec-signzone: -S no longer implies -g [RT #20568]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2767. [bug] named could crash on startup if a zone was
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein configured with auto-dnssec and there was no
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein key-directory. [RT #20615]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2766. [bug] isc_socket_fdwatchpoke() should only update the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein socketmgr state if the socket is not pending on a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein read or write. [RT #20603]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2765. [bug] Skip masters for which the TSIG key cannot be found.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2764. [bug] "rndc-confgen -a" could trigger a REQUIRE. [RT #20610]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2763. [bug] "rndc sign" didn't create an NSEC chain. [RT #20591]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2762. [bug] DLV validation failed with a local slave DLV zone.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2761. [cleanup] Enable internal symbol table for backtrace only for
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein systems that are known to work. Currently, BSD
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein variants, Linux and Solaris are supported. [RT #20202]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2760. [cleanup] Corrected named-compilezone usage summary. [RT #20533]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2759. [doc] Add information about .jbk/.jnw files to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the ARM. [RT #20303]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2758. [bug] win32: Added a workaround for a windows 2008 bug
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein that could cause the UDP client handler to shut
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein down. [RT #19176]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2757. [bug] dig: assertion failure could occur in connect
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein timeout. [RT #20599]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2756. [bug] Fixed corrupt logfile message in update.c. [RT #20597]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2755. [placeholder]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2754. [bug] Secure-to-insecure transitions failed when zone
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein was signed with NSEC3. [RT #20587]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2753. [bug] Removed an unnecessary warning that could appear when
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein building an NSEC chain. [RT #20589]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2752. [bug] Locking violation. [RT #20587]
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews2751. [bug] Fixed a memory leak in dnssec-keyfromlabel. [RT #20588]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2750. [bug] dig: assertion failure could occur when a server
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein didn't have an address. [RT #20579]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2749. [bug] ixfr-from-differences generated a non-minimal ixfr
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein for NSEC3 signed zones. [RT #20452]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2748. [func] Identify bad answers from GTLD servers and treat them
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein as referrals. [RT #18884]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2747. [bug] Journal roll forwards failed to set the re-signing
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein time of RRSIGs correctly. [RT #20541]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2746. [port] hpux: address signed/unsigned expansion mismatch of
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2745. [bug] configure script didn't probe the return type of
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein gai_strerror(3) correctly. [RT #20573]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2744. [func] Log if a query was over TCP. [RT #19961]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2743. [bug] RRSIG could be incorrectly set in the NSEC3 record
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein for a insecure delegation.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein --- 9.7.0b2 released ---
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2742. [cleanup] Clarify some DNSSEC-related log messages in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2741. [func] Allow the dnssec-keygen progress messages to be
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein suppressed (dnssec-keygen -q). Automatically
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein suppress the progress messages when stdin is not
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein a tty. [RT #20474]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2740. [placeholder]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2739. [cleanup] Clean up API for initializing and clearing trust
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein anchors for a view. [RT #20211]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2738. [func] Add RSASHA256 and RSASHA512 tests to the dnssec system
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein test. [RT #20453]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2737. [func] UPDATE requests can leak existence information.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2736. [func] Improve the performance of NSEC signed zones with
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein more than a normal amount of glue below a delegation.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2735. [bug] dnssec-signzone could fail to read keys
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein that were specified on the command line with
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein full paths, but weren't in the current
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein directory. [RT #20421]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2734. [port] cygwin: arpaname did not compile. [RT #20473]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2733. [cleanup] Clean up coding style in pkcs11-* tools. [RT #20355]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2732. [func] Add optional filter-aaaa-on-v4 option, available
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein if built with './configure --enable-filter-aaaa'.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Filters out AAAA answers to clients connecting
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein via IPv4. (This is NOT recommended for general
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein use.) [RT #20339]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2731. [func] Additional work on change 2709. The key parser
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein will now ignore unrecognized fields when the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein minor version number of the private key format
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein has been increased. It will reject any key with
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the major version number increased. [RT #20310]
297be3708069ef31814d6d75c0d71a50a78feb03Mark Andrews2730. [func] Have dnssec-keygen display a progress indication
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein a la 'openssl genrsa' on standard error. Note
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein when the first '.' is followed by a long stop
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein one has the choice between slow generation vs.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2729. [func] When constructing a CNAME from a DNAME use the DNAME
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein TTL. [RT #20451]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2728. [bug] dnssec-keygen, dnssec-keyfromlabel and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein dnssec-signzone now warn immediately if asked to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein write into a nonexistent directory. [RT #20278]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2727. [func] The 'key-directory' option can now specify a relative
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein path. [RT #20154]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2726. [func] Added support for SHA-2 DNSSEC algorithms,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein RSASHA256 and RSASHA512. [RT #20023]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2725. [doc] Added information about the file "managed-keys.bind"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to the ARM. [RT #20235]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2724. [bug] Updates to a existing node in secure zone using NSEC
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein were failing. [RT #20448]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2723. [bug] isc_base32_totext(), isc_base32hex_totext(), and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein isc_base64_totext(), didn't always mark regions of
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein memory as fully consumed after conversion. [RT #20445]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2722. [bug] Ensure that the memory associated with the name of
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein a node in a rbt tree is not altered during the life
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein of the node. [RT #20431]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2721. [port] Have dst__entropy_status() prime the random number
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein generator. [RT #20369]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2720. [bug] RFC 5011 trust anchor updates could trigger an
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein assert if the DNSKEY record was unsigned. [RT #20406]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2719. [func] Skip trusted/managed keys for unsupported algorithms.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2718. [bug] The space calculations in opensslrsa_todns() were
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein incorrect. [RT #20394]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2717. [bug] named failed to update the NSEC/NSEC3 record when
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the last private type record was removed as a result
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein of completing the signing the zone with a key.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2716. [bug] nslookup debug mode didn't return the ttl. [RT #20414]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein --- 9.7.0b1 released ---
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2715. [bug] Require OpenSSL support to be explicitly disabled.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2714. [port] aix/powerpc: 'asm("ics");' needs non standard assembler
297be3708069ef31814d6d75c0d71a50a78feb03Mark Andrews2713. [bug] powerpc: atomic operations missing asm("ics") /
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein __isync() calls.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2712. [func] New 'auto-dnssec' zone option allows zone signing
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to be fully automated in zones configured for
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein dynamic DNS. 'auto-dnssec allow;' permits a zone
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to be signed by creating keys for it in the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein key-directory and using 'rndc sign <zone>'.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein 'auto-dnssec maintain;' allows that too, plus it
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein also keeps the zone's DNSSEC keys up to date
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein according to their timing metadata. [RT #19943]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2711. [port] win32: Add the bin/pkcs11 tools into the full
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein build. [RT #20372]
297be3708069ef31814d6d75c0d71a50a78feb03Mark Andrews2710. [func] New 'dnssec-signzone -x' flag and 'dnskey-ksk-only'
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein zone option cause a zone to be signed with only KSKs
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein signing the DNSKEY RRset, not ZSKs. This reduces
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews the size of a DNSKEY answer. [RT #20340]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2709. [func] Added some data fields, currently unused, to the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein private key file format, to allow implementation
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews of explicit key rollover in a future release
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein without impairing backward or forward compatibility.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2708. [func] Insecure to secure and NSEC3 parameter changes via
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein update are now fully supported and no longer require
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein defines to enable. We now no longer overload the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein NSEC3PARAM flag field, nor the NSEC OPT bit at the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein apex. Secure to insecure changes are controlled by
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein by the named.conf option 'secure-to-insecure'.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Warning: If you had previously enabled support by
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein adding defines at compile time to BIND 9.6 you should
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein ensure that all changes that are in progress have
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein completed prior to upgrading to BIND 9.7. BIND 9.7
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein is not backwards compatible.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2707. [func] dnssec-keyfromlabel no longer require engine name
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to be specified in the label if there is a default
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein engine or the -E option has been used. Also, it
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein now uses default algorithms as dnssec-keygen does
297be3708069ef31814d6d75c0d71a50a78feb03Mark Andrews (i.e., RSASHA1, or NSEC3RSASHA1 if -3 is used).
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2706. [bug] Loading a zone with a very large NSEC3 salt could
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein trigger an assert. [RT #20368]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2705. [placeholder]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2704. [bug] Serial of dynamic and stub zones could be inconsistent
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein with their SOA serial. [RT #19387]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2703. [func] Introduce an OpenSSL "engine" argument with -E
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein for all binaries which can take benefit of
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein crypto hardware. [RT #20230]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2702. [func] Update PKCS#11 tools (bin/pkcs11) [RT #20225 & all]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2701. [doc] Correction to ARM: hmac-md5 is no longer the only
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein supported TSIG key algorithm. [RT #18046]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2700. [doc] The match-mapped-addresses option is discouraged.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2699. [bug] Missing lock in rbtdb.c. [RT #20037]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2698. [placeholder]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2697. [port] win32: ensure that S_IFMT, S_IFDIR, S_IFCHR and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein S_IFREG are defined after including <isc/stat.h>.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2696. [bug] named failed to successfully process some valid
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein acl constructs. [RT #20308]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2695. [func] DHCP/DDNS - update fdwatch code for use by
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein DHCP. Modify the api to isc_sockfdwatch_t (the
297be3708069ef31814d6d75c0d71a50a78feb03Mark Andrews callback function for isc_socket_fdwatchcreate)
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to include information about the direction (read
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein or write) and add isc_socket_fdwatchpoke.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2694. [bug] Reduce default NSEC3 iterations from 100 to 10.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2693. [port] Add some noreturn attributes. [RT #20257]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2692. [port] win32: 32/64 bit cleanups. [RT #20335]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2691. [func] dnssec-signzone: retain the existing NSEC or NSEC3
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews chain when re-signing a previously-signed zone.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Use -u to modify NSEC3 parameters or switch
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein between NSEC and NSEC3. [RT #20304]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2690. [bug] win32: fix isc_thread_key_getspecific() prototype.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2689. [bug] Correctly handle snprintf result. [RT #20306]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews2688. [bug] Use INTERFACE_F_POINTTOPOINT, not IFF_POINTOPOINT,
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews to decide to fetch the destination address. [RT #20305]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2687. [bug] Fixed dnssec-signzone -S handling of revoked keys.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews Also, added warnings when revoking a ZSK, as this is
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews not defined by protocol (but is legal). [RT #19943]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2686. [bug] dnssec-signzone should clean the old NSEC chain when
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein signing with NSEC3 and vice versa. [RT #20301]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2685. [contrib] Update contrib/zkt to version 0.99c. [RT #20054]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2684. [cleanup] dig: formalize +ad and +cd as synonyms for
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein +adflag and +cdflag. [RT #19305]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2683. [bug] dnssec-signzone should clean out old NSEC3 chains when
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the NSEC3 parameters used to sign the zone change.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2682. [bug] "configure --enable-symtable=all" failed to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein build. [RT #20282]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2681. [bug] IPSECKEY RR of gateway type 3 was not correctly
3970098dcd2a7122541667b4b56cea8abce8ccf2Mark Andrews decoded. [RT #20269]
3970098dcd2a7122541667b4b56cea8abce8ccf2Mark Andrews2680. [func] Move contrib/pkcs11-keygen to bin/pkcs11. [RT #20067]
3970098dcd2a7122541667b4b56cea8abce8ccf2Mark Andrews2679. [func] dig -k can now accept TSIG keys in named.conf
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein format. [RT #20031]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2678. [func] Treat DS queries as if "minimal-response yes;"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein was set. [RT #20258]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2677. [func] Changes to key metadata behavior:
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - Keys without "publish" or "active" dates set will
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein no longer be used for smart signing. However,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein those dates will be set to "now" by default when
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein a key is created; to generate a key but not use
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein it yet, use dnssec-keygen -G.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - New "inactive" date (dnssec-keygen/settime -I)
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein sets the time when a key is no longer used for
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein signing but is still published.
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews - The "unpublished" date (-U) is deprecated in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein favor of "deleted" (-D).
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2676. [bug] --with-export-installdir should have been
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein --with-export-includedir. [RT #20252]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2675. [bug] dnssec-signzone could crash if the key directory
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein did not exist. [RT #20232]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein --- 9.7.0a3 released ---
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews2674. [bug] "dnssec-lookaside auto;" crashed if named was built
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein without openssl. [RT #20231]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2673. [bug] The managed-keys.bind zone file could fail to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein load due to a spurious result from sync_keyzone()
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2672. [bug] Don't enable searching in 'host' when doing reverse
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein lookups. [RT #20218]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2671. [bug] Add support for PKCS#11 providers not returning
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the public exponent in RSA private keys
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein (OpenCryptoki for instance) in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein dnssec-keyfromlabel. [RT #19294]
bea931e17b7567f09107f93ab7e25c7f00abeb9cMark Andrews2670. [bug] Unexpected connect failures failed to log enough
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein information to be useful. [RT #20205]
47012ae6dbf18a2503d7b33c1c9583dc38625cb7Mark Andrews2669. [func] Update PKCS#11 support to support Keyper HSM.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Update PKCS#11 patch to be against openssl-0.9.8i.
47012ae6dbf18a2503d7b33c1c9583dc38625cb7Mark Andrews2668. [func] Several improvements to dnssec-* tools, including:
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - dnssec-keygen and dnssec-settime can now set key
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews metadata fields 0 (to unset a value, use "none")
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - dnssec-revoke sets the revocation date in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein addition to the revoke bit
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - dnssec-settime can now print individual metadata
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein fields instead of always printing all of them,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein and can print them in unix epoch time format for
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein use by scripts
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2667. [func] Add support for logging stack backtrace on assertion
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein failure (not available for all platforms). [RT #19780]
47012ae6dbf18a2503d7b33c1c9583dc38625cb7Mark Andrews2666. [func] Added an 'options' argument to dns_name_fromstring()
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein (API change from 9.7.0a2). [RT #20196]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2665. [func] Clarify syntax for managed-keys {} statement, add
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein ARM documentation about RFC 5011 support. [RT #19874]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2664. [bug] create_keydata() and minimal_update() in zone.c
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein didn't properly check return values for some
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein functions. [RT #19956]
47012ae6dbf18a2503d7b33c1c9583dc38625cb7Mark Andrews2663. [func] win32: allow named to run as a service using
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein "NT AUTHORITY\LocalService" as the account. [RT #19977]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2662. [bug] lwres_getipnodebyname() and lwres_getipnodebyaddr()
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein returned a misleading error code when lwresd was
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews down. [RT #20028]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2661. [bug] Check whether socket fd exceeds FD_SETSIZE when
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein creating lwres context. [RT #20029]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2660. [func] Add a new set of DNS libraries for non-BIND9
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein applications. See README.libdns. [RT #19369]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2659. [doc] Clarify dnssec-keygen doc: key name must match zone
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein name for DNSSEC keys. [RT #19938]
47012ae6dbf18a2503d7b33c1c9583dc38625cb7Mark Andrews2658. [bug] dnssec-settime and dnssec-revoke didn't process
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein key file paths correctly. [RT #20078]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2657. [cleanup] Lower "journal file <path> does not exist, creating it"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein log level to debug 1. [RT #20058]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2656. [func] win32: add a "tools only" check box to the installer
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein which causes it to only install dig, host, nslookup,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein nsupdate and relevant DLLs. [RT #19998]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2655. [doc] Document that key-directory does not affect
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2654. [bug] Improve error reporting on duplicated names for
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein deny-answer-xxx. [RT #20164]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2653. [bug] Treat ENGINE_load_private_key() failures as key
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein not found rather than out of memory. [RT #18033]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2652. [func] Provide more detail about what record is being
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein deleted. [RT #20061]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2651. [bug] Dates could print incorrectly in K*.key files on
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein 64-bit systems. [RT #20076]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2650. [bug] Assertion failure in dnssec-signzone when trying
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to read keyset-* files. [RT #20075]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2649. [bug] Set the domain for forward only zones. [RT #19944]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2648. [port] win32: isc_time_seconds() was broken. [RT #19900]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2647. [bug] Remove unnecessary SOA updates when a new KSK is
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein added. [RT #19913]
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews2646. [bug] Incorrect cleanup on error in socket.c. [RT #19987]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2645. [port] "gcc -m32" didn't work on amd64 and x86_64 platforms
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein which default to 64 bits. [RT #19927]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein --- 9.7.0a2 released ---
7208386cd37a2092c70eddf80cf29519b16c4c80Mark Andrews2644. [bug] Change #2628 caused a regression on some systems;
7208386cd37a2092c70eddf80cf29519b16c4c80Mark Andrews named was unable to write the PID file and would
7208386cd37a2092c70eddf80cf29519b16c4c80Mark Andrews fail on startup. [RT #20001]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews2643. [bug] Stub zones interacted badly with NSEC3 support.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews2642. [bug] nsupdate could dump core on solaris when reading
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews improperly formatted key files. [RT #20015]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews2641. [bug] Fixed an error in parsing update-policy syntax,
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews added a regression test to check it. [RT #20007]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews2640. [security] A specially crafted update packet will cause named
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews to exit. [RT #20000]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews2639. [bug] Silence compiler warnings in gssapi code. [RT #19954]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews2638. [bug] Install arpaname. [RT #19957]
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews2637. [func] Rationalize dnssec-signzone's signwithkey() calling.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews2636. [func] Simplify zone signing and key maintenance with the
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews dnssec-* tools. Major changes:
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews - all dnssec-* tools now take a -K option to
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews specify a directory in which key files will be
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews - DNSSEC can now store metadata indicating when
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews they are scheduled to be published, activated,
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews revoked or removed; these values can be set by
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews dnssec-keygen or overwritten by the new
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews dnssec-settime command
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews - dnssec-signzone -S (for "smart") option reads key
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews metadata and uses it to determine automatically
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews which keys to publish to the zone, use for
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews signing, revoke, or remove from the zone
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews2635. [bug] isc_inet_ntop() incorrectly handled 0.0/16 addresses.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2634. [port] win32: Add support for libxml2, enable
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein statschannel. [RT #19773]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2633. [bug] Handle 15 bit rand() functions. [RT #19783]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2632. [func] util/kit.sh: warn if documentation appears to be out of
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein date. [RT #19922]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2631. [bug] Handle "//", "/./" and "/../" in mkdirpath().
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein [RT #19926 ]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2630. [func] Improved syntax for DDNS autoconfiguration: use
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein "update-policy local;" to switch on local DDNS in a
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews zone. (The "ddns-autoconf" option has been removed.)
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2629. [port] Check for seteuid()/setegid(), use setresuid()/
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein setresgid() if not present. [RT #19932]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein2628. [port] linux: Allow /var/run/named/named.pid to be opened
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein at startup with reduced capabilities in operation.
2625. [bug] Missing UNLOCK in rbtdb.c. [RT #19865]
2622. [bug] Printing of named.conf grammar was broken. [RT #19919]
2617. [bug] ifconfig.sh failed to emit an error message when
2616. [bug] 'host' used the nameservers from resolv.conf even
configuration text for named.conf
from a NSEC3 signed master/slave zone. [RT #19464]
2596. [bug] Stale tree nodes of cache/dynamic rbtdb could stay
2590. [func] Report zone/class of "update with no effect".
2581. [contrib] dlz/mysql set MYSQL_OPT_RECONNECT option on connection.
of "dnssec-lookaside . trust-anchor dlv.isc.org;"
plus setting a trusted-key for dlv.isc.org.
by) $sysconfdir/bind.keys. As the ISC DLV key
the bind.keys file with a key downloaded from
https://www.isc.org/solutions/dlv. [RT #18685]
2561. [doc] Add isc-config.sh(1) man page. [RT #16378]
2550. [bug] Check --with-openssl=<path> finds <openssl/opensslv.h>.
2548. [bug] Install iterated_hash.h. [RT #19335]
2547. [bug] openssl_link.c:mem_realloc() could reference an
2544. [cleanup] Removed unused structure members in adb.c. [RT #19225]
2543. [contrib] Update contrib/zkt to version 0.98. [RT #19113]
2538. [bug] cache/ADB memory could grow over max-cache-size,
2519. [bug] dig/host with -4 or -6 didn't work if more than two
preceded in resolv.conf. [RT #19081]
document function in <isc/radix.h>. [RT #18534]
2500. [contrib] contrib/sdb/pgsql/zonetodb.c called non-existent
2499. [port] solaris: lib/lwres/getaddrinfo.c namespace clash.
are now /var/run/named/named.pid and
/var/run/lwresd/lwresd.pid respectively.
2481. [bug] rbtdb.c:matchparams() failed to handle NSEC3 chain
specified in named.conf doesn't seem to work with
2459. [contrib] Import dnssec-zkt to contrib/zkt. [RT #18448]
2455. [bug] Stop metadata being transferred via axfr/ixfr.
2452. [func] Improve bin/test/journalprint. [RT #18316]
epoll and /dev/poll to be selected at compile
completion event send out canceled read/write
in rbtdb.c. [RT #18455]
2413. [bug] Fixed an unreachable code path in socket.c. [RT #18442]
2407. [port] hpux: test for sys/dyntune.h. [RT #18421]
2400. [bug] Log if kqueue()/epoll_create()/open(/dev/poll) fails.
temporary, named.conf option reserved-sockets,
assertion in acl.c. [RT #18166]
2390. [bug] dispatch.c could make a false warning on 'odd socket'.
2387. [bug] Silence compiler warnings in lib/isc/radix.c.
2385. [bug] A condition variable in socket.c could leak in
2381. [port] dlz/mysql: support multiple install layouts for
mysql. <prefix>/include/{,mysql/}mysql.h and
2380. [bug] dns_view_find() was not returning NXDOMAIN/NXRRSET
2379. [contrib] queryperf/gen-data-queryperf.py: removed redundant
2351. [bug] convertxsl.pl generated very long lines. [RT #17906]
Documentation is in the new README.pkcs11 file.
were set at both the options/view level and in
named.conf. [RT #17581]
See <isc/mem.h> for details.
2328. [maint] Add AAAA addresses for A.ROOT-SERVERS.NET,
rbtdb.c. Implement dead node processing in zones as
lib/dns/rdata/in_1/apl_42.c. [RT #17469]
2317. [bug] "make distclean" removed bind9.xsl.h. [RT #17518]
addresses in acl.c. [RT #17519]
bin/named/lwdnoop.c. [RT #17476]
2312. [cleanup] Silence Coverity warning in lib/isc/unix/socket.c.
debug/fatal messages. [RT #17501]
2308. [cleanup] Silence Coverity warning in bin/named/controlconf.c.
2307. [bug] Remove infinite loop from lib/dns/sdb.c. [RT #17496]
2306. [bug] Remove potential race from lib/dns/resolver.c.
2303. [bug] Remove unnecessary code from bin/named/lwdgnba.c.
2302. [bug] Fix memset() calls in lib/tests/t_api.c. [RT #17472]
bin/tests/system/lwresd/lwtest.c. [RT #17474]
bin/tests/names/t_names.c. [RT #17473]
bin/nsupdate/nsupdate.c. [RT #17475]
bin/tests/timers/t_timers.c. [RT #17468]
bin/tests/dst/t_dst.c. [RT #17467]
2295. [bug] Silence static overrun error in bin/named/lwaddr.c.
2276. [bug] Install <dst/gssapi.h>. [RT #17359]
stub/slave master and journal files. [RT #17279]
2268. [bug] 0.IN-ADDR.ARPA was missing from the empty zones
2266. [bug] client.c:get_clientmctx() returned the same mctx
2257. [bug] win32: Use the full path to vcredist_x86.exe when
bindevt.dll. [RT #17159]
2255. [maint] L.ROOT-SERVERS.NET is now 199.7.83.42.
2254. [bug] timer.c:dispatch() failed to lock timer->lock
2247. [doc] Sort doc/misc/options. [RT #17067]
2246. [bug] Make the startup of test servers (ans.pl) more
2239. [func] Ship a pre built bin/named/bind9.xsl.h. [RT #17114]
2235. [bug] <isc/atomic.h> was not being installed. [RT #17135]
2231. [bug] Building dlzbdb (contrib/dlz/bin/dlzbdb) was broken.
If allow-query-cache is not set in named.conf then
If allow-recursion is not set in named.conf then
2194. [bug] Close journal before calling 'done' in xfrin.c.
2193. [port] win32: BINDInstall.exe is now linked statically.
2192. [port] win32: use vcredist_x86.exe to install Visual
2184. [bug] bind9.xsl.h didn't build out of the source tree.
2181. [port] sunos: libbind: add paths.h from BIND 8. [RT #16462]
need to ship Microsoft.VC80.MFCLOC.
2156. [bug] Fix node reference leaks in lookup.c:lookup_find(),
Fix a memory leak in rbtdb.c:free_noqname().
Make lookup.c:lookup_find() robust against
2154. [func] Scoped (e.g. IPv6 link-local) addresses may now be
dighost.c:get_trusted_key(). [RT #16678]
hmac_link.c. [RT #16437]
2145. [bug] Check DS/DLV digest lengths for known digests.
2141. [bug] dig/host should not be setting IDN_ASCCHECK (IDN
in adb.c. [RT #16670]
2138. [bug] Lock order reversal in resolver.c. [RT #16653]
2137. [port] Mips little endian and/or mips 64 bit are now
2136. [bug] nslookup/host looped if there was no search list
2135. [bug] Uninitialized rdataset in sdlz.c. [RT #16656]
2131. [contrib] dlz/mysql: AXFR was broken. [RT #16630]
2114. [bug] dig/host/nslookup: searches for names with multiple
2107. [bug] dighost.c: more cleanup of buffers. [RT #16499]
2103. [port] Add /usr/sfw to list of locations for OpenSSL
2100. [port] win32: copy libeay32.dll to Build\Debug.
2098. [bug] Race in rbtdb.c:no_references(), which occasionally
if resolv.conf does not exist or no nameservers
2091. [port] dighost.c: race condition on cleanup. [RT #16417]
2085. [doc] win32: added index.html and README to zip. [RT #16201]
2081. [port] libbind: minor 64-bit portability fix in memcluster.c.
2080. [port] libbind: res_init.c did not compile on older versions
2076. [bug] Several files were missing #include <config.h>
of authoritative servers that drop EDNS and/or CD
2046. [bug] rbtdb.c:rdataset_setadditional() could cause duplicate
2043. [port] nsupdate/nslookup: Force the flushing of the prompt
2038. [bug] dig/nslookup/host was unlinking from wrong list
a non slave/stub zone. [RT # 16073]
2028. [port] linux: socket.c compatibility for old systems.
2013. [bug] Handle unexpected TSIGs on unsigned AXFR/IXFR
2008. [func] It is now possible to enable/disable DNSSEC
breaks DNSSEC (firewall/proxy). [RT #15592]
2003. [bug] libbind: The DNS name/address lookup functions could
1988. [bug] Remove a bus error from the SHA256/SHA512 support.
1987. [func] DS/DLV SHA256 digest algorithm support. [RT #15608]
1981. [bug] win32: condition.c:wait() could fail to reattain
1968. [bug] Missing lock in resolver.c:validated(). [RT #15739]
1967. [func] dig/nslookup/host: warn about missing "QR". [RT #15779]
now be set in named.conf (max-udp-size). This is
xfrin.c:maybe_free() if named ran out of memory.
1944. [cleanup] isc_hash_create() does not need a read/write lock.
1928. [bug] Race in rbtdb.c:currentversion(). [RT #15517]
1922. [bug] check-tool.c:setup_logging() missing call to
1919. [contrib] queryperf: a set of new features: collecting/printing
'RD' was set in the query. host/nslookup skip servers
1907. [func] host/nslookup now continue (default)/fail on SERVFAIL.
1904. [func] Automatic empty zone creation for D.F.IP6.ARPA and
1866. [bug] resolv.conf parse errors were being ignored by
dig/host/nslookup. [RT #14841]
1865. [bug] Silently ignore nameservers in /etc/resolv.conf with
to disallow this (draft-ietf-ipv6-addr-arch-v4-02.txt).
when CFLAGS contains "-I /usr/local/include"
1839. [bug] <isc/hash.h> was not being installed.
1836. [cleanup] Silence compiler warnings in hash_test.c.
1834. [bug] Bad memset in rdata_test.c. [RT #13658]
rbtdb.c:subtractrdataset(). [RT #13519]
option in named.conf can be used to specify a
1816. [port] UnixWare: failed to compile lib/isc/unix/net.c.
1810. [bug] configure, lib/bind/configure make different default
1808. [bug] zone.c:notify_zone() contained a race condition,
1788. [bug] libbind9.la/libbind9.so needs to link against
1785. [bug] libbind9.la/libbind9.so needs to link against
1775. [bug] Only compile getnetent_r.c when threaded. [RT #13205]
file clause for rbt{64} master/hint zones. [RT #13009]
1750. [port] lib/bind/make/rules.in:subdirs was not bash friendly.
1748. [func] dig now returns the byte count for axfr/ixfr.
1747. [bug] BIND 8 compatibility: named/named-checkconf failed
to parse "host-statistics-max" in named.conf.
1745. [bug] Dig/host/nslookup accept replies from link locals
1731. [port] darwin: relax version test in ifconfig.sh.
1723. [cleanup] Silence compiler warnings from t_tasks.c. [RT #12493]
1717. [port] solaris: ifconfig.sh did not support Solaris 10.
"ifconfig.sh down" didn't work for Solaris 9.
1716. [doc] named.conf(5) was being installed in the wrong
1714. [bug] dig/host/nslookup were only trying the first
1707. [contrib] sdb/ldap updated to version 1.0-beta.
1705. [func] Allow the journal's name to be changed via named.conf.
"#include <isc/print.h>". [RT #12321]
1701. [doc] A minimal named.conf man page.
are defined in named.conf. [RT #12023]
/usr/lib. [RT #11971]
1668. [bug] DIG_SIGCHASE was making bin/dig/host dump core.
adb.c:set_target(). [RT #11582]
1648. [func] Update dnssec-lookaside named.conf syntax to support
1625. [bug] named failed to load/transfer RFC2535 signed zones
1612. [bug] check-names at the option/view level could trigger
1599. [bug] Fix memory leak on error path when checking named.conf.
DNSSEC specify "dnssec-enable yes;" in named.conf.
1567. [maint] B.ROOT-SERVERS.NET is now 192.228.79.201.
1566. [port] Support for the cmsg framework on Solaris and HP/UX.
were specified in /etc/resolv.conf. [RT #8232]
1551. [port] Open "/dev/null" before calling chroot().
1532. [port] netbsd: the configure test for <sys/sysctl.h>
requires <sys/param.h>.
1517. [port] Support for IPv6 interface scanning on HP/UX and
only (e.g. DE, LV, US and MUSEUM) these can be excluded
1503. [port] win32: install libeay32.dll outside of system32.
named.conf, tcp-listen-queue.
1498. [port] bsdos: 5.x support.
1478. [port] ifconfig.sh didn't account for other virtual
1456. [contrib] gen-data-queryperf.py from Stephane Bortzmeyer.
doc/misc/options. [RT #5616]
via named.conf (edns-udp-size).
1425. [port] linux/libbind: define __USE_MISC when testing *_r()
function prototypes in netdb.h. [RT #4921]
1422. [func] Log name/type/class when denying a query. [RT #4663]
1419. [port] openbsd: use /dev/arandom. [RT #4950]
1417. [func] ID.SERVER/CHAOS is now a built in zone.
1410. [func] Handle records that live in the parent zone, e.g. DS.
1397. [maint] J.ROOT-SERVERS.NET is now 192.58.128.30.
1388. [port] irix: check for sys/sysctl.h and NET_RT_IFLIST before
'recursing-file = "named.recursing";'.
1355. [bug] Fix DNSSEC wildcard proof for CNAME/DNAME.
1353. [contrib] sdb/ldap to version 0.9.
in socket.c and eliminating a host of socket
1339. [func] dig, host and nslookup now use IP6.ARPA for nibble
1336. [func] Nibble lookups under IP6.ARPA are now supported by
1334. [bug] When signing/verifying rdatasets, duplicate rdatas
1326. [bug] DNAME/CNAME signatures were not being cached when
1324. [port] darwin: ifconfig.sh now supports darwin.
1323. [port] linux: Slackware 4.0 needs <asm/unistd.h>. [RT #3205]
1298. [bug] The CINCLUDES macro in lib/dns/sec/dst/Makefile
1288. [bug] Adjusted REQUIRE's in lib/dns/name.c to better
1276. [bug] libbind: const pointer conflicts in res_debug.c.
1269. [port] Openserver: ifconfig.sh support.
<sys/param.h> is included or not. Be consistent.
1247. [bug] Don't reset the interface index for link/site local
1234. [bug] contrib/sdb: 'zonetodb' failed to call
1232. [bug] unix/errno2result() didn't handle EADDRNOTAVAIL.
1215. [port] solaris: add support to ifconfig.sh for x86 2.5.1
at the named.conf checking stage. [RT #2431]
1185. [bug] libbind: don't assume statp->_u._ext.ext is valid
lib/dns to use this function instead of local one.
occurs when parsing named.conf. [RT #2275]
1146. [func] Allow IPV6_IPV6ONLY to be set/cleared on a socket if
1145. [func] "host" no longer reports a NOERROR/NODATA response
named/lwresd at compile time. [RT #1982]
1119. [func] Added support in Win32 for NTFS file/directory ACL's
could cause an assertion failure in resolver.c
violation in adb.c. [RT #2017]
1103. [port] OpenUNIX 8 support (ifconfig.sh). [RT #1970]
1099. [cleanup] libbind: defining REPORT_ERRORS in lib/bind/dst caused
1090. [bug] libbind: dns_ho.c:add_hostent() was not returning
1088. [port] libbind: MPE/iX C.70 (incomplete)
on load/reload if views were used. [RT #1947]
1041. [bug] Dig/host/nslookup could catch an assertion failure
1032. [func] hostname.bind/txt/chaos now returns the name of
1031. [bug] libbind.a: isc__gettimeofday() infinite recursion.
1030. [bug] On systems with no resolv.conf file, nsupdate
1029. [bug] Some named.conf errors did not cause the loading
1002. [bug] When reporting an unknown class name in named.conf,
972. [bug] The file modification time code in zone.c was using the
non-existent nlist.h. [RT #1640]
957. [bug] sys/select.h inclusion was broken on older platforms.
in named/win32/os.c due to code changes in
updated to add include path for os.h header.
953. [func] The /var/run/named.key file from change #843
has been replaced by /etc/rndc.key. Both
method (rndc.conf / controls). Unlike
bin/tests. [RT #1555].
946. [cleanup] doc/misc/options is now machine-generated from the
when installing isc-config.sh.
were not accepted in named.conf. [RT #1469]
and added lib/isc/win32/entropy.c.
900. [bug] A config.guess update changed the system identification
bin/tests/system/ifconfig.sh now recognize the new
899. [bug] lib/dns/soa.c failed to compile on many platforms
897. [bug] A config.guess update changed the system identification
to Darwin. This was derived from the config.guess
849. [func] <isc/net.h> will ensure INADDR_LOOPBACK is defined.
844. [func] <isc/net.h> will ensure INADDR_LOOPBACK is defined,
just as <lwres/net.h> does.
843. [func] If no controls statement is present in named.conf,
generated by named and an rndc.conf-style file
named named.key will be written that uses it. rndc
838. [port] UnixWare 7.x.x is now suported by
833. [cleanup] Moved dns_soa_*() from <dns/journal.h> to
<dns/soa.h>, and extended them to support
832. [bug] The default location for named.conf in named-checkconf
825. [bug] zone.c:ns_query() detached from the wrong zone
character (i.e. "/") in its name and the directory
down-cased when signing/verifying records. [RT #1186]
in rndc.conf.
786. [bug] When DNSSEC signing/verifying data, owner names were
755. [bug] Fix incorrectly formatted log messages in zone.c.
748. [doc] List supported RFCs in doc/misc/rfc-compliance.
739. [port] Look for /dev/random in configure, rather than
737. [port] stdtime.c failed to compile on certain platforms.
dispatch.c:do_cancel(). [RT #733]
718. [cleanup] "internal" is no longer a reserved word in named.conf.
failure in adb.c. [RT #738]
703. [port] sys/select.h is needed on older platforms. [RT #695]
702. [func] If the address 0.0.0.0 is seen in resolv.conf,
693. [bug] An empty lwres statement in named.conf caused
685. [bug] nslookup should use the search list/domain options
from resolv.conf by default. [RT #405, #630]
646. [bug] The UnixWare ISC_PLATFORM_FIXIN6INADDR fix in isc/net.h
645. [port] BSD/OS 3.0 needs pthread_init(). [RT #603]
633. [port] Cope with rlim_t missing on BSD/OS systems. [RT #575]
for syntax checking named.conf files and zone files,
604. [bug] The named.conf parser could print incorrect line
577. [func] Log illegal RDATA combinations. e.g. multiple
570. [bug] rbtdb.c allowed zones containing nodes which had
568. [func] Add sample simple database drivers in contrib/sdb.
of rdata type/class mnemonics in log messages.
516. [bug] Cache lookups which had a NULL node pointer, e.g.
DNAME, would trigger an INSIST(!search.need_cleanup)
490. [func] When a slave/stub zone has not yet successfully
from the named.conf "listen-on" statement, sockets
477. [bug] The the isc-config.sh script could be installed before
471. [bug] nsupdate didn't compile on HP/UX 10.20
and subsequent name servers in resolv.conf if the
457. [bug] Dig/host/hslookup didn't properly handle connect
documented as such in named.conf. [RT #304, RT #311]
is specified in named.conf. [RT #306]
is specified in named.conf. [RT #301]
432. [func] Added refresh/retry jitter. The actual refresh/
428. [bug] rbtdb.c:find_closest_nxt() erroneously returned
(e.g. glue). This could cause SERVFAILs when
e.g. due to corrupt zones with multiple SOA records.
an argc/argv style vector of words and sets
view/global one for CNAME targets and additional
369. [func] Support new named.conf options, view and zone
the distribution, in doc/man/dnssec.
353. [bug] double increment in lwres/gethost.c:copytobuf().
348. [func] New boolean named.conf options 'additional-from-auth'
345. [bug] Large-scale changes/cleanups to dig:
341. [func] Support 'key' clause in named.conf zone masters
327. [bug] rndc.conf parser wasn't correctly recognizing an IP
320. [func] Multiple rndc changes: parses an rndc.conf file,
319. [func] The named.conf "controls" statement is now used
314. [func] The named.conf controls statement can now have
313. [bug] When parsing resolv.conf, don't terminate on an
resolv.conf search path from 6 to 8. If there
resolv.conf was empty or a comment.
310. [func] Changes to named.conf "controls" statement (inet
are listed in resolv.conf, silently ignore them
each library's ipv6.h defines the wrapper symbol of
any $sbindir/dig from a previous release.)
that lack /dev/random.
280. [func] Add isc-config.sh, which can be used to more
two or more files in libomapi.a were not namespace
278. [bug] bin/named/logconf.c:category_fromconf() didn't take
266. [bug] zone.c:save_nsrrset() node was not initialized.
262. [bug] 'master' was not initialized in zone.c:stub_callback().
for global options block of named.conf. Both accept
258. [bug] Fixed printing of lwres_addr_t.address field.
256. [func] isc_ratelimiter_t now has attach/detach semantics, and
253. [func] resolv.conf parser now recognizes ';' and '#' as
252. [bug] resolv.conf parser mishandled masks on sortlists.
244. [bug] empty named.conf file and empty options statement are
243. [func] new cachesize option for named.conf
+ missing sigwait prototype on BSD/OS 4.0/4.0.1.
BSD/OS 4.*, Linux and Solaris 2.8.
230. [func] Replace the dst sign/verify API with a cleaner one.
from confparser.c, because of yacc's code, are
212. [func] Added dns_message_get/settsigkey, to make TSIG
compiling in the lib/dns/sec/{dnssafe,openssl}
204. [cleanup] On HP/UX, pass +vnocompatwarnings to the linker
run on a PA 1.x system."
201. [cleanup] Removed the test/sdig program, it has been
replaced by bin/dig/dig.
(e.g., running out of network buffers) were
and/or interfaces. [19-May-2000 explorer]
191. [func] Patched to compile on UnixWare 7.x. This platform
range for overflow/underflow. In the case of
184. [cleanup] Variables/functions which began with two leading
underscores were made to conform to the ANSI/ISO
179. [func] options named.conf statement *must* now come
178. [func] Post-load of named.conf check verifies a slave zone
168. [bug] include statements in named.conf caused syntax errors
162. [bug] Ensure proper range for arguments to ctype.h functions.
masters [ port xxx ] { y.y.y.y [ port zzz ] ; }
util/check-includes for how this was tested.
145. [cleanup] Added <isc/lang.h> and ISC_LANG_BEGINDECLS/
<isc/result.h>.
of <isc/time.h>, and needed ISC_LANG_BEGINDECLS
need <isc/eventclass.h>.
instead of <isc/time.h>.
128. [cleanup] <isc/dir.h> had ISC_LANG_BEGINDECLS instead of
and creates null keys/sets zone status bit for
<isc/result.h>.
<isc/result.h>. Multiple inclusion protection
isc_symtab_t moved to <isc/types.h>.
<isc/net.h>.
118. [cleanup] libdns.a is now namespace-clean, on NetBSD, excepting
117. [cleanup] libdns.a changes:
116. [func] Added <isc/offset.h> for isc_offset_t (aka off_t
<isc/list.h>.
<isc/mutex.h>.
<isc/list.h>.
bin/tests/{db,mem,sockaddr,tasks,timers}/.
108. [cleanup] DNS_SETBIT/DNS_GETBIT/DNS_CLEARBIT moved from
105. [doc] doc/dev/coding.html expanded with other
103. [func] libisc buffer API changes for <isc/buffer.h>:
on BSD/OS 4.1.
101. [cleanup] Quieted EGCS warnings from lib/isc/print.c.
<isc/event.h>.
or <isc/result.h>.
<isc/result.h>.
90. [cleanup] Removed unneeded ISC_LANG_BEGINDECLS/ISC_LANG_ENDDECLS
from <named/listenlist.h>.
<isc/mem.h>. isc_interface_t and isc_interfaceiter_t
moved to <isc/types.h>.
86. [cleanup] isc_bufferlist_t moved from <isc/bufferlist.h> to
<isc/types.h>.
<isc/int.h>.
<isc/lang.h>.
subsumed by file.o.
OpenSSL libraries/headers.
from <dns/types.h>.
59. [bug] Cause net/host unreachable to be a hard error
58. [bug] bin/named/query.c could sometimes trigger the
(client->query.attributes & NS_QUERYATTR_NAMEBUFUSED)
53. [port] freebsd 4.0: lib/isc/unix/socket.c requires
<sys/param.h>.
logging module "dns/validator".
and isc_lex_t to <isc/types.h>.
31. [bug] Use ${LIBTOOL} to compile bin/named/main.@O@.
25. [bug] make install failed to install <isc/log.h> and
configure.in to check for presence of in6addr_any.
9. [cleanup] replaced bit-setting code in confctx.c and replaced
4. [port] bin/named/unix/os.c didn't compile on systems with
get only what we need from <linux/capability.h>, and
systems without /dev/random.
lib/isc/unix/include/isc/Makefile.in had a typo which