-
Notifications
You must be signed in to change notification settings - Fork 11
/
Copy pathCHANGES
12456 lines (8547 loc) · 409 KB
/
CHANGES
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
--- 9.10.0rc2 released ---
3817. [func] The "delve" command is now spelled "delv" to avoid
a namespace collision with the Xapian project.
[RT #35801]
3815. [doc] Clarify "nsupdate -y" usage in man page. [RT #35808]
3810. [bug] Work around broken nameservers that fail to ignore
unknown EDNS options. [RT #35766]
3809. [doc] Fix SIT and NSID documentation.
3808. [doc] Clean up "prefetch" documentation. [RT #35751]
3807. [bug] Fix sign extention bug in dns_name_fromtext when
lowercase is set. [RT #35743]
3806. [test] Improved system test portability. [RT #35625]
3805. [contrib] Added contrib/perftcpdns, a performance testing tool
for DNS over TCP. [RT #35710]
--- 9.10.0rc1 released ---
3804. [bug] Corrected a race condition in dispatch.c in which
portentry could be reset leading to an assertion
failure in socket_search(). (Change #3708
addressed the same issue but was incomplete.)
[RT #35128]
3803. [bug] "named-checkconf -z" incorrectly rejected zones
using alternate data sources for not having a "file"
option. [RT #35685]
3802. [bug] Various header files were not being installed.
3801. [port] Fix probing for gssapi support on FreeBSD. [RT #35615]
3800. [bug] A pending event on the route socket could cause an
assertion failure when shutting down named. [RT #35674]
3799. [bug] Improve named's command line error reporting.
[RT #35603]
3798. [bug] 'rndc zonestatus' was reporting the wrong re-signing
time. [RT #35659]
3797. [port] netbsd: geoip support probing was broken. [RT #35642]
3796. [bug] Register dns and pkcs#11 error codes. [RT #35629]
3795. [bug] Make named-checkconf detect raw masterfiles for
hint zones and reject them. [RT #35268]
3794. [maint] Added AAAA for C.ROOT-SERVERS.NET.
3793. [bug] zone.c:save_nsec3param() could assert when out of
memory. [RT #35621]
3792. [func] Provide links to the alternate statistics views when
displaying in a browser. [RT #35605]
3791. [placeholder]
3790. [bug] Handle broken nameservers that send BADVERS in
response to unknown EDNS options. Maintain
statistics on BADVERS responses.
3789. [bug] Null pointer dereference on rbt creation failure.
3788. [bug] dns_peer_getrequestsit was returning request_nsid by
mistake.
--- 9.10.0b2 released ---
3787. [bug] The code that checks whether "auto-dnssec" is
allowed was ignoring "allow-update" ACLs set at
the options or view level. [RT #29536]
3786. [func] Provide more detailed error codes when using
native PKCS#11. "pkcs11-tokens" now fails robustly
rather than asserting when run against an HSM with
an incomplete PKCS#11 API implementation. [RT #35479]
3785. [bug] Debugging code dumphex didn't accept arbitrarily long
input (only compiled with -DDEBUG). [RT #35544]
3784. [bug] Using "rrset-order fixed" when it had not been
enabled at compile time caused inconsistent
results. It now works as documented, defaulting
to cyclic mode. [RT #28104]
3783. [func] "tsig-keygen" is now available as an alternate
command name for "ddns-confgen". It generates
a TSIG key in named.conf format without comments.
[RT #35503]
3782. [func] Specifying "auto" as the salt when using
"rndc signing -nsec3param" causes named to
generate a 64-bit salt at random. [RT #35322]
3781. [tuning] Use adaptive mutex locks when available; this
has been found to improve performance under load
on many systems. "configure --with-locktype=standard"
restores conventional mutex locks. [RT #32576]
3780. [bug] $GENERATE handled negative numbers incorrectly.
[RT #25528]
3779. [cleanup] Clarify the error message when using an option
that was not enabled at compile time. [RT #35504]
3778. [bug] Log a warning when the wrong address family is
used in "listen-on" or "listen-on-v6". [RT #17848]
3777. [bug] EDNS EXPIRE code could dump core when processing
DLZ queries. [RT #35493]
3776. [func] "rndc -q" suppresses output from successful
rndc commands. Errors are printed on stderr.
[RT #21393]
3775. [bug] dlz_dlopen driver could return the wrong error
code on API version mismatch, leading to a segfault.
[RT #35495]
3774. [func] When using "request-nsid", log the NSID value in
printable form as well as hex. [RT #20864]
3773. [func] "host", "nslookup" and "nsupdate" now have
options to print the version number and exit.
[RT #26057]
3772. [contrib] Added sqlite3 dynamically-loadable DLZ module.
(Based in part on a contribution from Tim Tessier.)
[RT #20822]
3771. [cleanup] Adjusted log level for "using built-in key"
messages. [RT #24383]
3770. [bug] "dig +trace" could fail with an assertion when it
needed to fall back to TCP due to a truncated
response. [RT #24660]
3769. [doc] Improved documentation of "rndc signing -list".
[RT #30652]
3768. [bug] "dnssec-checkds" was missing the SHA-384 digest
algorithm. [RT #34000]
3767. [func] Log explicitly when using rndc.key to configure
command channel. [RT #35316]
3766. [cleanup] Fixed problems with building outside the source
tree when using native PKCS#11. [RT #35459]
3765. [bug] Fixed a bug in "rndc secroots" that could crash
named when dumping an empty keynode. [RT #35469]
3764. [bug] The dnssec-keygen/settime -S and -i options
(to set up a successor key and set the prepublication
interval) were missing from dnssec-keyfromlabel.
[RT #35394]
3763. [bug] delve: Cache DNSSEC records to avoid the need to
re-fetch them when restarting validation. [RT #35476]
3762. [bug] Address build problems with --pkcs11-native +
--with-openssl with ECDSA support. [RT #35467]
3761. [bug] Address dangling reference bug in dns_keytable_add.
[RT #35471]
3760. [bug] Improve SIT with native PKCS#11 and on Windows.
[RT #35433]
3759. [port] Enable delve on Windows. [RT #35441]
3758. [port] Enable export library APIs on Windows. [RT #35382]
3757. [port] Enable Python tools (dnssec-coverage,
dnssec-checkds) to run on Windows. [RT #34355]
3756. [bug] GSSAPI Kerberos realm checking was broken in
check_config leading to spurious messages being
logged. [RT #35443]
--- 9.10.0b1 released ---
3755. [func] Add stats counters for known EDNS options + others.
[RT #35447]
3754. [cleanup] win32: Installer now places files in the
Program Files area rather than system services.
[RT #35361]
3753. [bug] allow-notify was ignoring keys. [RT #35425]
3752. [bug] Address potential REQUIRE failure if
DNS_STYLEFLAG_COMMENTDATA is set when printing out
a rdataset.
3751. [tuning] The default setting for the -U option (setting
the number of UDP listeners per interface) has
been adjusted to improve performance. [RT #35417]
3750. [experimental] Partially implement EDNS EXPIRE option as described
in draft-andrews-dnsext-expire-00. Retrieval of
the remaining time until expiry for slave zones
is supported.
EXPIRE uses an experimental option code (65002),
which is subject to change. [RT #35416]
3749. [func] "dig +subnet" sends an EDNS client subnet option
containing the specified address/prefix when
querying. (Thanks to Wilmer van der Gaast.)
[RT #35415]
3748. [test] Use delve to test dns_client interfaces. [RT #35383]
3747. [bug] A race condition could lead to a core dump when
destroying a resolver fetch object. [RT #35385]
3746. [func] New "max-zone-ttl" option enforces maximum
TTLs for zones. If loading a zone containing a
higher TTL, the load fails. DDNS updates with
higher TTLs are accepted but the TTL is truncated.
(Note: Currently supported for master zones only;
inline-signing slaves will be added.) [RT #38405]
3745. [func] "configure --with-tuning=large" adjusts various
compiled-in constants and default settings to
values suited to large servers with abundant
memory. [RT #29538]
3744. [experimental] SIT: send and process Source Identity Tokens
(similar to DNS Cookies by Donald Eastlake 3rd),
which are designed to help clients detect off-path
spoofed responses and for servers to identify
legitimate clients.
SIT uses an experimental EDNS option code (65001),
which will be changed to an IANA-assigned value
if the experiment is deemed a success.
SIT can be enabled via "configure --enable-sit" (or
--enable-developer). It is enabled by default in
Windows.
Servers can be configured to send smaller responses
to clients that have not identified themselves via
SIT. RRL processing has also been updated;
legitimate clients are not subject to rate
limiting. [RT #35389]
3743. [bug] delegation-only flag wasn't working in forward zone
declarations despite being documented. This is
needed to support turning off forwarding and turning
on delegation only at the same name. [RT #35392]
3742. [port] linux: libcap support: declare curval at start of
block. [RT #35387]
3741. [func] "delve" (domain entity lookup and validation engine):
A new tool with dig-like semantics for performing DNS
lookups, with internal DNSSEC validation, using the
same resolver and validator logic as named. This
allows easy validation of DNSSEC data in environments
with untrustworthy resolvers, and assists with
troubleshooting of DNSSEC problems. [RT #32406]
3740. [contrib] Minor fixes to configure --with-dlz-bdb,
--with-dlz-postgres and --with-dlz-odbc. [RT #35340]
3739. [func] Added per-zone stats counters to track TCP and
UDP queries. [RT #35375]
3738. [bug] --enable-openssl-hash failed to build. [RT #35343]
3737. [bug] 'rndc retransfer' could trigger a assertion failure
with inline zones. [RT #35353]
3736. [bug] nsupdate: When specifying a server by name,
fall back to alternate addresses if the first
address for that name is not reachable. [RT #25784]
3735. [cleanup] Merged the libiscpk11 library into libisc
to simplify dependencies. [RT #35205]
3734. [bug] Improve building with libtool. [RT #35314]
3733. [func] Improve interface scanning support. Interface
information will be automatically updated if the
OS supports routing sockets (MacOS, *BSD, Linux).
Use "automatic-interface-scan no;" to disable.
Add "rndc scan" to trigger a scan. [RT #23027]
3732. [contrib] Fixed a type mismatch causing the ODBC DLZ
driver to dump core on 64-bit systems. [RT #35324]
3731. [func] Added a "no-case-compress" ACL, which causes
named to use case-insensitive compression
(disabling change #3645) for specified
clients. (This is useful when dealing
with broken client implementations that
use case-sensitive name comparisons,
rejecting responses that fail to match the
capitalization of the query that was sent.)
[RT #35300]
3730. [cleanup] Added "never" as a synonym for "none" when
configuring key event dates in the dnssec tools.
[RT #35277]
3729. [bug] dnssec-keygen could set the publication date
incorrectly when only the activation date was
specified on the command line. [RT #35278]
3728. [doc] Expanded native-PKCS#11 documentation,
specifically pkcs11: URI labels. [RT #35287]
3727. [func] The isc_bitstring API is no longer used and
has been removed from libisc. [RT #35284]
3726. [cleanup] Clarified the error message when attempting
to configure more than 32 response-policy zones.
[RT #35283]
3725. [contrib] Updated zkt and nslint to newest versions,
cleaned up and rearranged the contrib
directory, and added a README.
--- 9.10.0a2 released ---
3724. [bug] win32: Fixed a bug that prevented dig and
host from exiting properly after completing
a UDP query. [RT #35288]
3723. [cleanup] Imported keys are now handled the same way
regardless of DNSSEC algorithm. [RT #35215]
3722. [bug] Using geoip ACLs in a blackhole statement
could cause a segfault. [RT #35272]
3721. [doc] Improved documentation of the EDNS processing
enhancements introduced in change #3593. [RT #35275]
3720. [bug] Address compiler warnings. [RT #35261]
3719. [bug] Address memory leak in in peer.c. [RT #35255]
3718. [bug] A missing ISC_LINK_INIT in log.c. [RT #35260]
3717. [port] hpux: Treat EOPNOTSUPP as a expected error code when
probing to see if it is possible to set dscp values
on a per packet basis. [RT #35252]
3716. [bug] The dns_request code was setting dcsp values when not
requested. [RT #35252]
3715. [bug] The region and city databases could fail to
initialize when using some versions of libGeoIP,
causing assertion failures when named was
configured to use them. [RT #35427]
3714. [test] System tests that need to test for cryptography
support before running can now use a common
"testcrypto.sh" script to do so. [RT #35213]
3713. [bug] Save memory by not storing "also-notify" addresses
in zone objects that are configured not to send
notify requests. [RT #35195]
3712. [placeholder]
3711. [placeholder]
3710. [bug] Address double dns_zone_detach when switching to
using automatic empty zones from regular zones.
[RT #35177]
3709. [port] Use built-in versions of strptime() and timegm()
on all platforms to avoid portability issues.
[RT #35183]
3708. [bug] Address a portentry locking issue in dispatch.c.
[RT #35128]
3707. [bug] irs_resconf_load now returns ISC_R_FILENOTFOUND
on a missing resolv.conf file and initializes the
structure as if it had been configured with:
nameserver ::1
nameserver 127.0.0.1
Note: Callers will need to be updated to treat
ISC_R_FILENOTFOUND as a qualified success or else
they will leak memory. The following code fragment
will work with both old and new versions without
changing the behaviour of the existing code.
resconf = NULL;
result = irs_resconf_load(mctx, "/etc/resolv.conf",
&resconf);
if (result != ISC_SUCCESS) {
if (resconf != NULL)
irs_resconf_destroy(&resconf);
....
}
[RT #35194]
3706. [contrib] queryperf: Fixed a possible integer overflow when
printing results. [RT #35182]
3705. [func] "configure --enable-native-pkcs11" enables BIND
to use the PKCS#11 API for all cryptographic
functions, so that it can drive a hardware service
module directly without the need to use a modified
OpenSSL as intermediary (so long as the HSM's vendor
provides a complete-enough implementation of the
PKCS#11 interface). This has been tested successfully
with the Thales nShield HSM and with SoftHSMv2 from
the OpenDNSSEC project. [RT #29031]
3704. [protocol] Accept integer timestamps in RRSIG records. [RT #35185]
3703. [func] To improve recursive resolver performance, cache
records which are still being requested by clients
can now be automatically refreshed from the
authoritative server before they expire, reducing
or eliminating the time window in which no answer
is available in the cache. See the "prefetch" option
for more details. [RT #35041]
3702. [func] 'dnssec-coverage -l' option specifies a length
of time to check for coverage; events further into
the future are ignored. 'dnssec-coverage -z'
checks only ZSK events, and 'dnssec-coverage -k'
checks only KSK events. (Thanks to Peter Palfrader.)
[RT #35168]
3701. [func] named-checkconf can now obscure shared secrets
when printing by specifying '-x'. [RT #34465]
3700. [func] Allow access to subgroups of XML statistics via
special URLs http://<server>:<port>/xml/v3/server,
/zones, /net, /tasks, /mem, and /status. [RT #35115]
3699. [bug] Improvements to statistics channel XSL stylesheet:
the stylesheet can now be cached by the browser;
section headers are omitted from the stats display
when there is no data in those sections to be
displayed; counters are now right-justified for
easier readability. [RT #35117]
3698. [cleanup] Replaced all uses of memcpy() with memmove().
[RT #35120]
3697. [bug] Handle "." as a search list element when IDN support
is enabled. [RT #35133]
3696. [bug] dig failed to handle AXFR style IXFR responses which
span multiple messages. [RT #35137]
3695. [bug] Address a possible race in dispatch.c. [RT #35107]
3694. [bug] Warn when a key-directory is configured for a zone,
but does not exist or is not a directory. [RT #35108]
3693. [security] memcpy was incorrectly called with overlapping
ranges resulting in malformed names being generated
on some platforms. This could cause INSIST failures
when serving NSEC3 signed zones (CVE-2014-0591).
[RT #35120]
3692. [bug] Two calls to dns_db_getoriginnode were fatal if there
was no data at the node. [RT #35080]
3691. [contrib] Address null pointer dereference in LDAP and
MySQL DLZ modules.
3690. [bug] Iterative responses could be missed when the source
port for an upstream query was the same as the
listener port (53). [RT #34925]
3689. [bug] Fixed a bug causing an insecure delegation from one
static-stub zone to another to fail with a broken
trust chain. [RT #35081]
3688. [bug] loadnode could return a freed node on out of memory.
[RT #35106]
3687. [bug] Address null pointer dereference in zone_xfrdone.
[RT #35042]
3686. [func] "dnssec-signzone -Q" drops signatures from keys
that are still published but no longer active.
[RT #34990]
3685. [bug] "rndc refresh" didn't work correctly with slave
zones using inline-signing. [RT #35105]
3684. [bug] The list of included files would grow on reload.
[RT 35090]
3683. [cleanup] Add a more detailed "not found" message to rndc
commands which specify a zone name. [RT #35059]
3682. [bug] Correct the behavior of rndc retransfer to allow
inline-signing slave zones to retain NSEC3 parameters
instead of reverting to NSEC. [RT #34745]
3681. [port] Update the Windows build system to support feature
selection and WIN64 builds. This is a work in
progress. [RT #34160]
3680. [bug] Ensure buffer space is available in "rndc zonestatus".
[RT #35084]
3679. [bug] dig could fail to clean up TCP sockets still
waiting on connect(). [RT #35074]
3678. [port] Update config.guess and config.sub. [RT #35060]
3677. [bug] 'nsupdate' leaked memory if 'realm' was used multiple
times. [RT #35073]
3676. [bug] "named-checkconf -z" now checks zones of type
hint and redirect as well as master. [RT #35046]
3675. [misc] Provide a place for third parties to add version
information for their extensions in the version
file by setting the EXTENSIONS variable.
--- 9.10.0a1 released ---
3674. [bug] RPZ zeroed ttls if the query type was '*'. [RT #35026]
3673. [func] New "in-view" zone option allows direct sharing
of zones between views. [RT #32968]
3672. [func] Local address can now be specified when using
dns_client API. [RT #34811]
3671. [bug] Don't allow dnssec-importkey overwrite a existing
non-imported private key.
3670. [bug] Address read after free in server side of
lwres_getrrsetbyname. [RT #29075]
3669. [port] freebsd: --with-gssapi needs -lhx509. [RT #35001]
3668. [bug] Fix cast in lex.c which could see 0xff treated as eof.
[RT #34993]
3667. [test] dig: add support to keep the TCP socket open between
successive queries (+[no]keepopen). [RT #34918]
3666. [func] Add a tool, named-rrchecker, for checking the syntax
of individual resource records. This tool is intended
to be called by provisioning systems so that the front
end does not need to be upgraded to support new DNS
record types. [RT #34778]
3665. [bug] Failure to release lock on error in receive_secure_db.
[RT #34944]
3664. [bug] Updated OpenSSL PKCS#11 patches to fix active list
locking and other bugs. [RT #34855]
3663. [bug] Address bugs in dns_rdata_fromstruct and
dns_rdata_tostruct for WKS and ISDN types. [RT #34910]
3662. [bug] 'host' could die if a UDP query timed out. [RT #34870]
3661. [bug] Address lock order reversal deadlock with inline zones.
[RT #34856]
3660. [cleanup] Changed the name of "isc-config.sh" to "bind9-config".
[RT #23825]
3659. [port] solaris: don't add explict dependencies/rules for
python programs as make won't use the implicit rules.
[RT #34835]
3658. [port] linux: Address platform specific compilation issue
when libcap-devel is installed. [RT #34838]
3657. [port] Some readline clones don't accept NULL pointers when
calling add_history. [RT #34842]
3656. [security] Treat an all zero netmask as invalid when generating
the localnets acl. (The prior behavior could
allow unexpected matches when using some versions
of Winsock: CVE-2013-6320.) [RT #34687]
3655. [cleanup] Simplify TCP message processing when requesting a
zone transfer. [RT #34825]
3654. [bug] Address race condition with manual notify requests.
[RT #34806]
3653. [func] Create delegations for all "children" of empty zones
except "forward first". [RT #34826]
3652. [bug] Address bug with rpz-drop policy. [RT #34816]
3651. [tuning] Adjust when a master server is deemed unreachable.
[RT #27075]
3650. [tuning] Use separate rate limiting queues for refresh and
notify requests. [RT #30589]
3649. [cleanup] Include a comment in .nzf files, giving the name of
the associated view. [RT #34765]
3648. [test] Updated the ATF test framework to version 0.17.
[RT #25627]
3647. [bug] Address a race condition when shutting down a zone.
[RT #34750]
3646. [bug] Journal filename string could be set incorrectly,
causing garbage in log messages. [RT #34738]
3645. [protocol] Use case sensitive compression when responding to
queries. [RT #34737]
3644. [protocol] Check that EDNS subnet client options are well formed.
[RT #34718]
3643. [doc] Clarify RRL "slip" documentation.
3642. [func] Allow externally generated DNSKEY to be imported
into the DNSKEY management framework. A new tool
dnssec-importkey is used to do this. [RT #34698]
3641. [bug] Handle changes to sig-validity-interval settings
better. [RT #34625]
3640. [bug] ndots was not being checked when searching. Only
continue searching on NXDOMAIN responses. Add the
ability to specify ndots to nslookup. [RT #34711]
3639. [bug] Treat type 65533 (KEYDATA) as opaque except when used
in a key zone. [RT #34238]
3638. [cleanup] Add the ability to handle ENOPROTOOPT in case it is
encountered. [RT #34668]
3637. [bug] 'allow-query-on' was checking the source address
rather than the destination address. [RT #34590]
3636. [bug] Automatic empty zones now behave better with
forward only "zones" beneath them. [RT #34583]
3635. [bug] Signatures were not being removed from a zone with
only KSK keys for a algorithm. [RT #34439]
3634. [func] Report build-id in rndc status. Report build-id
when building from a git repository. [RT #20422]
3633. [cleanup] Refactor OPT processing in named to make it easier
to support new EDNS options. [RT #34414]
3632. [bug] Signature from newly inactive keys were not being
removed. [RT #32178]
3631. [bug] Remove spurious warning about missing signatures when
qtype is SIG. [RT #34600]
3630. [bug] Ensure correct ID computation for MD5 keys. [RT #33033]
3629. [func] Allow the printing of cryptographic fields in DNSSEC
records by dig to be suppressed (dig +nocrypto).
[RT #34534]
3628. [func] Report DNSKEY key id's when dumping the cache.
[RT #34533]
3627. [bug] RPZ changes were not effective on slaves. [RT #34450]
3626. [func] dig: NSID output now easier to read. [RT #21160]
3625. [bug] Don't send notify messages to machines outside of the
test setup.
3624. [bug] Look for 'json_object_new_int64' when looking for a
the json library. [RT #34449]
3623. [placeholder]
3622. [tuning] Eliminate an unnecessary lock when incrementing
cache statistics. [RT #34339]
3621. [security] Incorrect bounds checking on private type 'keydata'
can lead to a remotely triggerable REQUIRE failure
(CVE-2013-4854). [RT #34238]
3620. [func] Added "rpz-client-ip" policy triggers, enabling
RPZ responses to be configured on the basis of
the client IP address; this can be used, for
example, to blacklist misbehaving recursive
or stub resolvers. [RT #33605]
3619. [bug] Fixed a bug in RPZ with "recursive-only no;"
[RT #33776]
3618. [func] "rndc reload" now checks modification times of
include files as well as master files to determine
whether to skip reloading a zone. [RT #33936]
3617. [bug] Named was failing to answer queries during
"rndc reload" [RT #34098]
3616. [bug] Change #3613 was incomplete. [RT #34177]
3615. [cleanup] "configure" now finishes by printing a summary
of optional BIND features and whether they are
active or inactive. ("configure --enable-full-report"
increases the verbosity of the summary.) [RT #31777]
3614. [port] Check for <linux/types.h>. [RT #34162]
3613. [bug] named could crash when deleting inline-signing
zones with "rndc delzone". [RT #34066]
3612. [port] Check whether to use -ljson or -ljson-c. [RT #34115]
3611. [bug] Improved resistance to a theoretical authentication
attack based on differential timing. [RT #33939]
3610. [cleanup] win32: Some executables had been omitted from the
installer. [RT #34116]
3609. [bug] Corrected a possible deadlock in applications using
the export version of the isc_app API. [RT #33967]
3608. [port] win32: added todos.pl script to ensure all text files
the win32 build depends on are converted to DOS
newline format. [RT #22067]
3607. [bug] dnssec-keygen had broken 'Invalid keyfile' error
message. [RT #34045]
3606. [func] "rndc flushtree" now flushes matching
records in the address database and bad cache
as well as the DNS cache. (Previously only the
DNS cache was flushed.) [RT #33970]
3605. [port] win32: Addressed several compatibility issues
with newer versions of Visual Studio. [RT #33916]
3604. [bug] Fixed a compile-time error when building with
JSON but not XML. [RT #33959]
3603. [bug] Install <isc/stat.h>. [RT #33956]
3602. [contrib] Added DLZ Perl module, allowing Perl scripts to
integrate with named and serve DNS data.
(Contributed by John Eaglesham of Yahoo.)
3601. [bug] Added to PKCS#11 openssl patches a value len
attribute in DH derive key. [RT #33928]
3600. [cleanup] dig: Fixed a typo in the warning output when receiving
an oversized response. [RT #33910]
3599. [tuning] Check for pointer equivalence in name comparisons.
[RT #18125]
3598. [cleanup] Improved portability of map file code. [RT #33820]
3597. [bug] Ensure automatic-resigning heaps are reconstructed
when loading zones in map format. [RT #33381]
3596. [port] Updated win32 build documentation, added
dnssec-verify. [RT #22067]
3595. [port] win32: Fix build problems introduced by change #3550.
[RT #33807]
3594. [maint] Update config.guess and config.sub. [RT #33816]
3593. [func] Update EDNS processing to better track remote server
capabilities. [RT #30655]
3592. [doc] Moved documentation of rndc command options to the
rndc man page. [RT #33506]
3591. [func] Use CRC-64 to detect map file corruption at load
time. [RT #33746]
3590. [bug] When using RRL on recursive servers, defer
rate-limiting until after recursion is complete;
also, use correct rcode for slipped NXDOMAIN
responses. [RT #33604]
3589. [func] Report serial numbers in when starting zone transfers.
Report accepted NOTIFY requests including serial.
[RT# 33037]
3588. [bug] dig: addressed a memory leak in the sigchase code
that could cause a shutdown crash. [RT #33733]
3587. [func] 'named -g' now checks the logging configuration but
does not use it. [RT #33473]
3586. [bug] Handle errors in xmlDocDumpFormatMemoryEnc. [RT #33706]
3585. [func] "rndc delzone -clean" option removes zone files
when deleting a zone. [RT #33570]
3584. [security] Caching data from an incompletely signed zone could
trigger an assertion failure in resolver.c
(CVE-2013-3919). [RT #33690]
3583. [bug] Address memory leak in GSS-API processing [RT #33574]
3582. [bug] Silence false positive warning regarding missing file
directive for inline slave zones. [RT #33662]
3581. [bug] Changed the tcp-listen-queue default to 10. [RT #33029]
3580. [bug] Addressed a possible race in acache.c [RT #33602]
3579. [maint] Updates to PKCS#11 openssl patches, supporting
versions 0.9.8y, 1.0.0k, 1.0.1e [RT #33463]
3578. [bug] 'rndc -c file' now fails if 'file' does not exist.
[RT #33571]
3577. [bug] Handle zero TTL values better. [RT #33411]
3576. [bug] Address a shutdown race when validating. [RT #33573]
3575. [func] Changed the logging category for RRL events from
'queries' to 'query-errors'. [RT #33540]
3574. [doc] The 'hostname' keyword was missing from server-id
description in the named.conf man page. [RT #33476]
3573. [bug] "rndc addzone" and "rndc delzone" incorrectly handled
zone names containing punctuation marks and other
nonstandard characters. [RT #33419]
3572. [func] Threads are now enabled by default on most
operating systems. [RT #25483]
3571. [bug] Address race condition in dns_client_startresolve().
[RT #33234]
3570. [bug] Check internal pointers are valid when loading map
files. [RT #33403]
3569. [contrib] Ported mysql DLZ driver to dynamically-loadable
module, and added multithread support. [RT #33394]
3568. [cleanup] Add a product description line to the version file,
to be reported by named -v/-V. [RT #33366]
3567. [bug] Silence clang static analyzer warnings. [RT #33365]
3566. [func] Log when forwarding updates to master. [RT #33240]
3565. [placeholder]
3564. [bug] Improved handling of corrupted map files. [RT #33380]
3563. [contrib] zone2sqlite failed with some table names. [RT #33375]
3562. [func] Update map file header format to include a SHA-1 hash
of the database content, so that corrupted map files
can be rejected at load time. [RT #32459]
3561. [bug] dig: issue a warning if an EDNS query returns FORMERR
or NOTIMP. Adjust usage message. [RT #33363]
3560. [bug] isc-config.sh did not honor includedir and libdir
when set via configure. [RT #33345]
3559. [func] Check that both forms of Sender Policy Framework
records exist or do not exist. [RT #33355]
3558. [bug] IXFR of a DLZ stored zone was broken. [RT #33331]
3557. [bug] Reloading redirect zones was broken. [RT #33292]
3556. [maint] Added AAAA for D.ROOT-SERVERS.NET.
3555. [bug] Address theoretical race conditions in acache.c
(change #3553 was incomplete). [RT #33252]
3554. [bug] RRL failed to correctly rate-limit upward
referrals and failed to count dropped error
responses in the statistics. [RT #33225]
3553. [bug] Address suspected double free in acache. [RT #33252]
3552. [bug] Wrong getopt option string for 'nsupdate -r'.
[RT #33280]
3551. [bug] resolver.querydscp[46] were uninitialized. [RT #32686]
3550. [func] Unified the internal and export versions of the
BIND libraries, allowing external clients to use
the same libraries as BIND. [RT #33131]
3549. [doc] Documentation for "request-nsid" was missing.
[RT #33153]
3548. [bug] The NSID request code in resolver.c was broken
resulting in invalid EDNS options being sent.
[RT #33153]
3547. [bug] Some malformed unknown rdata records were not properly
detected and rejected. [RT #33129]
3546. [func] Add EUI48 and EUI64 types. [RT #33082]
3545. [bug] RRL slip behavior was incorrect when set to 1.
[RT #33111]
3544. [contrib] check5011.pl: Script to report the status of
managed keys as recorded in managed-keys.bind.
Contributed by Tony Finch <dot@dotat.at>
3543. [bug] Update socket structure before attaching to socket
manager after accept. [RT #33084]
3542. [placeholder]
3541. [bug] Parts of libdns were not properly initialized when
built in libexport mode. [RT #33028]
3540. [test] libt_api: t_info and t_assert were not thread safe.
3539. [port] win32: timestamp format didn't match other platforms.
3538. [test] Running "make test" now requires loopback interfaces
to be set up. [RT #32452]
3537. [tuning] Slave zones, when updated, now send NOTIFY messages
to peers before being dumped to disk rather than
after. [RT #27242]
3536. [func] Add support for setting Differentiated Services Code
Point (DSCP) values in named. Most configuration
options which take a "port" option (e.g.,
listen-on, forwarders, also-notify, masters,
notify-source, etc) can now also take a "dscp"
option specifying a code point for use with
outgoing traffic, if supported by the underlying
OS. [RT #27596]
3535. [bug] Minor win32 cleanups. [RT #32962]
3534. [bug] Extra text after an embedded NULL was ignored when
parsing zone files. [RT #32699]
3533. [contrib] query-loc-0.4.0: memory leaks. [RT #32960]
3532. [contrib] zkt: fixed buffer overrun, resource leaks. [RT #32960]
3531. [bug] win32: A uninitialized value could be returned on out
of memory. [RT #32960]
3530. [contrib] Better RTT tracking in queryperf. [RT #30128]
3529. [func] Named now listens on both IPv4 and IPv6 interfaces
by default. Named previously only listened on IPv4
interfaces by default unless named was running in
IPv6 only mode. [RT #32945]
3528. [func] New "dnssec-coverage" command scans the timing
metadata for a set of DNSSEC keys and reports if a
lapse in signing coverage has been scheduled
inadvertently. (Note: This tool depends on python;
it will not be built or installed on systems that
do not have a python interpreter.) [RT #28098]
3527. [compat] Add a URI to allow applications to explicitly
request a particular XML schema from the statistics
channel, returning 404 if not supported. [RT #32481]
3526. [cleanup] Set up dependencies for unit tests correctly during
build. [RT #32803]
3525. [func] Support for additional signing algorithms in rndc:
hmac-sha1, -sha224, -sha256, -sha384, and -sha512.
The -A option to rndc-confgen can be used to
select the algorithm for the generated key.
(The default is still hmac-md5; this may
change in a future release.) [RT #20363]
3524. [func] Added an alternate statistics channel in JSON format,