changelog-history.rst revision 1.1.1.1
1 .. Copyright (C) Internet Systems Consortium, Inc. ("ISC") 2 .. 3 .. SPDX-License-Identifier: MPL-2.0 4 .. 5 .. This Source Code Form is subject to the terms of the Mozilla Public 6 .. License, v. 2.0. If a copy of the MPL was not distributed with this 7 .. file, you can obtain one at https://mozilla.org/MPL/2.0/. 8 .. 9 .. See the COPYRIGHT file distributed with this work for additional 10 .. information regarding copyright ownership. 11 12 Changes prior to 9.20.1 13 ----------------------- 14 15 .. code-block:: none 16 17 --- 9.20.0 released --- 18 19 6404. [placeholder] 20 21 6403. [security] qctx-zversion was not being cleared when it should have 22 been leading to an assertion failure if it needed to be 23 reused. (CVE-2024-4076) [GL #4507] 24 25 6402. [security] A malicious DNS client that sends many queries with a 26 SIG(0)-signed message can cause the server to respond 27 slowly or not respond at all to other clients. Use the 28 offload threadpool for SIG(0) signature verifications, 29 add the 'sig0checks-quota' configuration option to 30 introduce a quota for SIG(0)-signed queries running in 31 parallel and add the 'sig0checks-quota-exempt' option to 32 exempt certain clients by their IP/network addresses. 33 (CVE-2024-1975) [GL #4480] 34 35 6401. [security] An excessively large number of rrtypes per owner can 36 slow down database query processing, so a limit has been 37 placed on the number of rrtypes that can be stored per 38 owner (node) in a cache or zone database. This is 39 configured with the new "max-rrtypes-per-name" option, 40 and defaults to 100. (CVE-2024-1737) 41 [GL #3403] [GL #4548] 42 43 6400. [security] Excessively large rdatasets can slow down database 44 query processing, so a limit has been placed on the 45 number of records that can be stored per rdataset 46 in a cache or zone database. This is configured 47 with the new "max-records-per-type" option, and 48 defaults to 100. (CVE-2024-1737) 49 [GL #497] [GL #3405] 50 51 6399. [security] Malicious DNS client that sends many queries over 52 TCP but never reads responses can cause server to 53 respond slowly or not respond at all for other 54 clients. (CVE-2024-0760) [GL #4481] 55 56 6398. [bug] Fix potential data races in our DoH implementation 57 related to HTTP/2 session object management and 58 endpoints set object management after reconfiguration. 59 We would like to thank Dzintars and Ivo from nic.lv 60 for bringing this to our attention. [GL #4473] 61 62 6397. [placeholder] 63 64 6396. [func] Outgoing zone transfers are no longer enabled by 65 default. To enable them, an "allow-transfer" ACL 66 must be specified. [GL #4728] 67 68 6395. [bug] Handle ISC_R_HOSTDOWN and ISC_R_NETDOWN in resolver.c. 69 [GL #4736] 70 71 6394. [bug] Named's -4 and -6 options now apply to zone primaries, 72 also-notify and parental-agents. Report when a zone 73 has these options configured but does not have an IPv4 74 or IPv6 address listed respectively. [GL #3472] 75 76 6393. [func] Deal with uv_tcp_close_reset() error return codes 77 more gracefully. [GL #4708] 78 79 6392. [bug] Use a completely new memory context when flushing the 80 cache. [GL #2744] 81 82 6391. [placeholder] 83 84 6390. [placeholder] 85 86 6389. [bug] dnssec-verify and dnssec-signzone could fail if there 87 was an obscured DNSKEY RRset at a delegatation. 88 [GL #4517] 89 90 6388. [placeholder] 91 92 6387. [func] Added a new statistics variable "recursive high-water" 93 that reports the maximum number of simultaneous 94 recursive clients BIND has handled while running. 95 [GL #4668] 96 97 6386. [bug] When shutting down catzs->view could point to freed 98 memory. Obtain a reference to the view to prevent this. 99 [GL #4502] 100 101 6385. [func] Relax SVCB alias mode checks to allow parameters. 102 [GL #4704] 103 104 6384. [bug] Remove infinite loop when including a directory in a 105 zone file. [GL #4357] 106 107 6383. [bug] Address an infinite loop in $GENERATE when a negative 108 value was converted in nibble mode. [GL #4353] 109 110 6382. [bug] Fix RPZ response's SOA record TTL, which was incorrectly 111 set to 1 if 'add-soa' is used. [GL #3323] 112 113 .. code-block:: none 114 115 --- 9.19.24 released --- 116 117 6381. [bug] dns_qp_lookup() could position the iterator at the 118 wrong predecessor when searching for names with 119 uncommon characters, which are encoded as two-octet 120 sequences in QP trie keys. [GL #4702] 121 122 6380. [func] Queries and responses now emit distinct dnstap entries 123 for DoT and DoH. [GL #4523] 124 125 6379. [bug] A QP iterator bug could result in DNSSEC validation 126 failing because the wrong NSEC was returned. [GL #4659] 127 128 6378. [func] The option to specify the number of UDP dispatches was 129 previously removed. An attempt to use the option now 130 prints a warning. [GL #1879] 131 132 6377. [func] Introduce 'dnssec-ksr', a DNSSEC tool to create 133 Key Signing Requests (KSRs) and Signed Key Responses 134 (SKRs). [GL #1128] 135 136 6376. [func] Allow 'dnssec-keygen' options '-f' and '-k' to be used 137 together to create a subset of keys from the DNSSEC 138 policy. [GL !8188] 139 140 6375. [func] Allow multiple RNDC message to be processed from 141 a single TCP read. [GL #4416] 142 143 6374. [func] Don't count expired / future RRSIGs in verification 144 failure quota. [GL #4586] 145 146 6373. [func] Offload the isc_http response processing to worker 147 thread. [GL #4680] 148 149 6372. [func] Implement signature jitter for dnssec-policy. [GL #4554] 150 151 6371. [bug] Access to the trust bytes in the ncache data needed to 152 be made thread safe. [GL #4475] 153 154 6370. [bug] Wrong source address used for IPv6 notify messages. 155 [GL #4669] 156 157 .. code-block:: none 158 159 --- 9.19.23 released --- 160 161 6369. [func] The 'fixed' value for the 'rrset-order' option has 162 been marked and documented as deprecated. [GL #4446] 163 164 6368. [func] The 'sortlist' option has been marked and documented 165 as deprecated. [GL #4593] 166 167 6367. [bug] Since the dns_validator_destroy() function doesn't 168 guarantee that it destroys the validator, rename it to 169 dns_validator_shutdown() and require explicit 170 dns_validator_detach() to follow. Implement an expected 171 behavior of the function to release a name associated 172 with the validator. [GL #4654] 173 174 6366. [bug] An assertion could be triggered in the QPDB cache when 175 encountering a delegation below a DNAME. [GL #4652] 176 177 6365. [placeholder] 178 179 6364. [protocol] Add RESOLVER.ARPA to the built in empty zones. 180 [GL #4580] 181 182 6363. [bug] dig/mdig +ednsflags=<non-zero-value> did not re-enable 183 EDNS if it had been disabled. [GL #4641] 184 185 6362. [bug] Reduce memory consumption of QP-trie based databases 186 by dynamically allocating the nodenames. [GL #4614] 187 188 6361. [bug] Some invalid ISO 8601 durations were accepted 189 erroneously. [GL #4624] 190 191 6360. [bug] Don't return static-stub synthesised NS RRset. 192 [GL #4608] 193 194 6359. [bug] Fix bug in Depends (keymgr_dep) function. [GL #4552] 195 196 .. code-block:: none 197 198 --- 9.19.22 released --- 199 200 6358. [bug] Fix validate_dnskey_dsset when KSK is not signing, 201 do not skip remainder of DS RRset. [GL #4625] 202 203 6357. [func] The QP zone database implementation introduced in 204 change #6355 has now been replaced with a version 205 based on the multithreaded dns_qpmulti API, which 206 is based on RCU and reduces the need for locking. 207 The new implementation is called "qpzone". The 208 previous "qp" implementation has been renamed 209 "qpcache", and can only be used for the cache. 210 [GL #4348] 211 212 6356. [bug] Attach the loop also in the dns_cache_flush(), so 213 the cache pruning still works after the flush. 214 [GL #4621] 215 216 6355. [func] The red-black tree data structure underlying the 217 RBTDB has been replaced with QP-tries. This is 218 expected to improve scalability and reduce 219 CPU consumption under load. It is currently known to 220 have higher memory consumption than the traditional 221 RBTDB; this will be addressed in future releases. 222 223 Nodes in a QP-trie contain the full domain name, 224 while nodes in a red-black tree only contain names 225 relative to a parent. Because of this difference, 226 zone files dumped with masterfile-style "relative" 227 will no longer have multiple different $ORIGIN 228 statements throughout the file. 229 230 This version is a minimal adaptation, keeping RBTDB 231 code largely unchanged, except as needed to replace 232 the underlying data structure. It uses the 233 single-thread "dns_qp" interface with locks for 234 synchronization. A future version will use the 235 multithreaded "dns_qpmulti" interface instead, 236 and will be renamed to QPDB. 237 238 The RBT-based version of RBTDB is still in place 239 for now, and can be used by specifying "database rbt" 240 in a "zone" statement, or by compiling with 241 "configure --with-zonedb=rbt --with-cachedb=rbt". 242 [GL #4411] 243 244 6354. [bug] Change 6035 introduced a regression when chasing DS 245 records resulting in an assertion failure. [GL #4612] 246 247 6353. [bug] Improve the TTL-based cleaning by removing the expired 248 headers from the heap, so they don't block the next 249 cleaning round and clean more than a single item for 250 each new addition to the RBTDB. [GL #4591] 251 252 6352. [bug] Revert change 6319 and decrease lock contention during 253 RBTDB tree pruning by not cleaning up nodes recursively 254 within a single prune_tree() call. [GL #4596] 255 256 6351. [protocol] Support for the RESINFO record type has been added. 257 [GL #4413] 258 259 6350. [bug] Address use after free in expire_lru_headers. [GL #4495] 260 261 6349. [placeholder] 262 263 6348. [bug] BIND could previously abort when trying to 264 establish a connection to a remote server using an 265 incorrect 'tls' configuration. That has been 266 fixed. Thanks to Tobias Wolter for bringing 267 the issue to our attention. [GL #4572] 268 269 6347. [func] Disallow stale-answer-client-timeout non-zero values. 270 [GL #4447] 271 272 6346. [bug] Cleaned up several minor bugs in the RBTDB dbiterator 273 implementation. [GL !8741] 274 275 6345. [bug] Added missing dns_rdataset_disassociate calls in 276 validator.c:findnsec3proofs. [GL #4571] 277 278 6344. [bug] Fix case insensitive setting for isc_ht hashtable. 279 [GL #4568] 280 281 6343. [bug] Fix case insensitive setting for isc_ht hashtable. 282 [GL #4568] 283 284 6342. [placeholder] 285 286 6341. [bug] Address use after free in ccmsg_senddone. [GL #4549] 287 288 6340. [test] Fix incorrectly reported errors when running tests 289 with `make test` on platforms with older pytest. 290 [GL #4560] 291 292 6339. [bug] The alignas() can't be used on types larger than 293 max_align_t; instead add padding into the structures 294 where we want avoid false memory sharing. [GL #4187] 295 296 6338. [func] Optimize slabheader placement, so the infrastructure 297 records are put in the beginning of the slabheader 298 linked list. [GL !8675] 299 300 6337. [bug] Nsupdate could assert while shutting down. [GL #4529] 301 302 6336. [func] Expose the zones with the 'first refresh' flag set in 303 statistics channel's "Incoming Zone Transfers" section 304 to indicate the zones that are not yet fully ready, and 305 their first refresh is pending or is in-progress. Also 306 expose the number of such zones in the output of the 307 'rndc status' command. [GL #4241] 308 309 6335. [func] The 'dnssec-validation yes' option now requires an 310 explicitly configured 'trust-anchors' statement (or 311 'managed-keys' or 'trusted-keys' statements, both 312 deprecated). [GL #4373] 313 314 6334. [doc] Improve ARM parental-agents definition. [GL #4531] 315 316 6333. [bug] Fix the DNS_GETDB_STALEFIRST flag, which was defined 317 incorrectly in lib/ns/query.c. [GL !8683] 318 319 6332. [bug] Range-check the arguments to fetch-quota-param. 320 [GL #362] 321 322 6331. [func] Add HSM support for dnssec-policy. You can now 323 configure keys with a key-store that allows you to 324 set the directory to store key files and to set a 325 PKCS #11 URI string. [GL #1129] 326 327 6330. [doc] Update ZSK minimum lifetime documentation in ARM, also 328 depends on signing delay. [GL #4510] 329 330 6329. [func] Nsupdate can now set the UL EDNS option when sending 331 UPDATE requests. [GL #4419] 332 333 6328. [func] Add workaround to enforce dynamic linker to pull 334 jemalloc earlier than libc to ensure all memory 335 allocations are done via jemalloc. [GL #4404] 336 337 6327. [func] Expose the TCP client count in statistics channel. 338 [GL #4425] 339 340 6326. [bug] Changes to "listen-on" statements were ignored on 341 reconfiguration unless the port or interface address was 342 changed, making it impossible to change a related 343 listener transport type. Thanks to Thomas Amgarten. 344 [GL #4518] [GL #4528] 345 346 6325. [func] The 'tls' block was extended with a new 347 'cipher-suites' option that allows setting 348 allowed cipher suites for TLSv1.3. 349 [GL #3504] 350 351 6324. [bug] Fix a possible crash in 'dig +nssearch +nofail' and 352 'host -C' commands when one of the name servers returns 353 SERVFAIL. [GL #4508] 354 355 .. code-block:: none 356 357 --- 9.19.21 released --- 358 359 6323. [placeholder] 360 361 6322. [security] Specific DNS answers could cause a denial-of-service 362 condition due to DNS validation taking a long time. 363 (CVE-2023-50387) [GL #4424] 364 365 The same code change also addresses another problem: 366 preparing NSEC3 closest encloser proofs could exhaust 367 available CPU resources. (CVE-2023-50868) [GL #4459] 368 369 6321. [security] Change 6315 inadvertently introduced regressions that 370 could cause named to crash. [GL #4234] 371 372 6320. [placeholder] 373 374 .. code-block:: none 375 376 --- 9.19.20 released --- 377 378 6319. [func] Limit isc_async_run() overhead for RBTDB tree pruning. 379 [GL #4383] 380 381 6318. [placeholder] 382 383 6317. [security] Restore DNS64 state when handling a serve-stale timeout. 384 (CVE-2023-5679) [GL #4334] 385 386 6316. [security] Specific queries could trigger an assertion check with 387 nxdomain-redirect enabled. (CVE-2023-5517) [GL #4281] 388 389 6315. [security] Speed up parsing of DNS messages with many different 390 names. (CVE-2023-4408) [GL #4234] 391 392 6314. [bug] Address race conditions in dns_tsigkey_find(). 393 [GL #4182] 394 395 6313. [bug] When dnssec-policy is in effect the DNSKEY's TTLs in 396 the zone where not being updated to match the policy. 397 This lead to failures when DNSKEYs where updated as the 398 TTLs mismatched. [GL #4466] 399 400 6312. [bug] Conversion from NSEC3 signed to NSEC signed could 401 temporarily put the zone into a state where it was 402 treated as unsigned until the NSEC chain was built. 403 Additionally conversion from one set of NSEC3 parameters 404 to another could also temporarily put the zone into a 405 state where it was treated as unsigned until the new 406 NSEC3 chain was built. [GL #1794] [GL #4495] 407 408 6311. [func] Zone content checks are now disabled by default 409 when running named-compilezone. named-checkzone 410 can still be used for checking zone integrity, 411 or the former checks in named-compilezone can be 412 re-enabled by using "named-compilezone -i full 413 -k fail -n fail -r warn -m warn -M warn -S warn 414 -T warn -W warn -C check-svcb:fail". [GL #4364] 415 416 6310. [bug] Memory leak in zone.c:sign_zone. When named signed a 417 zone it could leak dst_keys due to a misplaced 418 'continue'. [GL #4488] 419 420 6309. [bug] Changing a zone's primaries while a refresh was in 421 progress could trigger an assertion. [GL #4310] 422 423 6308. [bug] Prevent crashes caused by the zone journal getting 424 destroyed before all changes from an incoming IXFR are 425 written to it. [GL #4496] 426 427 6307. [bug] Obtain a client->handle reference when calling 428 async_restart. [GL #4439] 429 430 6306. [func] Log more details about the cause of "not exact" errors. 431 [GL #4500] 432 433 6305. [placeholder] 434 435 6304. [bug] The wrong time was being used to determine what RRSIGs 436 where to be generated when dnssec-policy was in use. 437 [GL #4494] 438 439 6303. [bug] Dig failed to correctly process a SIGINT received while 440 waiting for a TCP connection to complete. [GL #4138] 441 442 6302. [func] The "trust-anchor-telemetry" statement is no longer 443 marked as experimental. This silences a relevant log 444 message that was emitted even when the feature was 445 explicitly disabled. [GL #4497] 446 447 6301. [bug] Fix data races with atomic members of the xfrin 448 structure in xfrin_start() and xfrin_send_request() 449 functions. [GL #4493] 450 451 6300. [bug] Fix statistics export to use full 64 bit signed numbers 452 instead of truncating values to unsigned 32 bits. 453 [GL #4467] 454 455 6299. [port] NetBSD has added 'hmac' to libc which collides with our 456 use of 'hmac'. [GL #4478] 457 458 6298. [bug] Fix dns_qp_lookup bugs related to the iterator. 459 [GL !8558] 460 461 .. code-block:: none 462 463 --- 9.19.19 released --- 464 465 6297. [bug] Improve LRU cleaning behaviour. [GL #4448] 466 467 6296. [func] The "resolver-nonbackoff-tries" and 468 "resolver-retry-interval" options have been removed; 469 Using them is now a fatal error. [GL #4405] 470 471 6295. [bug] Fix an assertion failure which could occur during 472 shutdown when DNSSEC validation was running. [GL #4462] 473 474 6294. [bug] BIND might sometimes crash after startup or 475 re-configuration when one 'tls' entry is used multiple 476 times to connect to remote servers due to initialisation 477 attempts from contexts of multiple threads. That has 478 been fixed. [GL #4464] 479 480 6293. [func] Initial support for accepting the PROXYv2 protocol in 481 all currently implemented DNS transports in BIND and 482 complementary support for sending it in dig are included 483 into this release. [GL #4388] 484 485 6292. [func] Lower the maximum number of allowed NSEC3 iterations, 486 from 150 to 50. DNSSEC responses with a higher 487 iteration count are treated as insecure. For signing 488 with dnssec-policy, iterations must be set to zero. 489 [GL #4363] 490 491 6291. [bug] SIGTERM failed to properly stop multiple outstanding 492 lookup in dig. [GL #4457] 493 494 6290. [bug] Dig +yaml will now report "no servers could be reached" 495 also for UDP setup failure when no other servers or 496 tries are left. [GL #1229] 497 498 6289. [test] Remove legacy system test runner in favor of pytest. 499 [GL #4251] 500 501 6288. [func] Refactor the isc_mem overmem handling to always use 502 isc_mem_isovermem and remove the water callback. 503 [GL #4451] 504 505 6287. [bug] Recognize escapes when reading the public key from file. 506 [GL !8502] 507 508 6286. [bug] Dig +yaml will now report "no servers could be reached" 509 on TCP connection failure as well as for UDP timeouts. 510 [GL #4396] 511 512 6285. [func] Remove AES-based DNS cookies. [GL #4421] 513 514 6284. [bug] Fix a catz db update notification callback registration 515 logic error, which could cause an assertion failure when 516 receiving an AXFR update for a catalog zone while the 517 previous update process of the catalog zone was already 518 running. [GL #4418] 519 520 6283. [bug] Fix a data race in isc_hashmap by using atomics for the 521 iterators number. [GL !8474] 522 523 6282. [func] Deprecate AES-based DNS cookies. [GL #4421] 524 525 6281. [bug] Fix a data race in dns_tsigkeyring_dump(). [GL #4328] 526 527 .. code-block:: none 528 529 --- 9.19.18 released --- 530 531 6280. [bug] Fix missing newlines in the output of "rndc nta -dump". 532 [GL !8454] 533 534 6279. [func] Use QNAME minimization when fetching nameserver 535 addresses. [GL #4209] 536 537 6278. [bug] The call to isc_mem_setwater() was incorrectly 538 removed from dns_cache_setcachesize(), causing 539 cache overmem conditions not to be detected. [GL #4340] 540 541 6277. [bug] Take into account local authoritative zones when 542 falling back to serve-stale. [GL #4355] 543 544 6276. [cleanup] Remove both lock-file configuration option and the 545 -X argument to named. [GL #4391] 546 547 6275. [bug] Fix assertion failure when using lock-file configuration 548 option together -X argument to named. [GL #4386] 549 550 6274. [bug] The 'lock-file' file was being removed when it 551 shouldn't have been making it ineffective if named was 552 started 3 or more times. [GL #4387] 553 554 6273. [bug] Don't reuse the existing TCP streams in dns_xfrin, so 555 parallel TCP transfers works again. [GL #4379] 556 557 6272. [func] Enable systemd units support with the 'notify-reload' 558 service type by settng the MONOTONIC_USEC field when 559 sending an sd_notify() message to the service manager 560 to notify it about reloading the service. Note that the 561 'NotifyAccess=all' option is required in the systemd 562 unit file's '[Service]' section. [GL #4377] 563 564 6271. [bug] Fix a shutdown race in dns__catz_update_cb(). [GL #4381] 565 566 6270. [bug] Handle an assertion when the primary server returned 567 NOTIMP to IXFR or FORMERR to EDNS to SOA/IXFR/AXFR 568 request when transfering a zone. [GL #4372] 569 570 6269. [maint] B.ROOT-SERVERS.NET addresses are now 170.247.170.2 and 571 2801:1b8:10::b. [GL #4101] 572 573 6268. [func] Offload the IXFR and AXFR processing to unblock 574 the networking threads. [GL #4367] 575 576 6267. [func] The timeouts for resending zone refresh queries over UDP 577 were lowered to enable named to more quickly determine 578 that a primary is down. [GL #4260] 579 580 6266. [func] The zone option 'inline-signing' is ignored from now 581 on iff there is no 'dnssec-policy' configured for the 582 corresponding zone. [GL #4349] 583 584 6265. [bug] Don't schedule resign operations on the raw version 585 of an inline-signing zone. [GL #4350] 586 587 6264. [func] Use atomics to handle some ADB entry members 588 to reduce ADB locking contention. [GL #4326] 589 590 6263. [func] Convert the RPZ summary database to use a QP trie 591 instead of an RBT. [GL !8352] 592 593 6262. [bug] Duplicate control sockets didn't generate a 594 configuration failure leading to hard to diagnose 595 rndc connection errors. These are now caught by 596 named-checkconf and named. [GL #4253] 597 598 6261. [bug] Fix a possible assertion failure on an error path in 599 resolver.c:fctx_query(), when using an uninitialized 600 link. [GL #4331] 601 602 6260. [func] Added options to the QP trie that will be needed 603 when it is used as a zone or cache database: backward 604 iteration, and retrieval of DNSSEC predecessor 605 nodes and node chains. [GL !8338] 606 607 6259. [placeholder] 608 609 6258. [func] Use explictly created external memory pools for 610 dns_message in the ns_client and dns_resolver. 611 [GL #4325] 612 613 6257. [func] Expose the "Refresh SOA" query state (before the XFR) 614 in the incoming zone transfers section of the 615 statistics channel and show the local and remote 616 addresses for that query. Also Improve the 617 "Duration (s)" field to show the duration of the 618 "Pending" and "Refresh SOA" states too, before the 619 actual transfer starts. [GL !8305] 620 621 6256. [func] Expose the SOA query transport type (used before/during 622 XFR) in the incoming zone transfers section of the 623 statistics channel. [GL !8240] 624 625 6255. [func] Expose data about incoming zone transfers in progress 626 using statistics channel. [GL #3883] 627 628 6254. [cleanup] Add semantic patch to do an explicit cast from char 629 to unsigned char in ctype.h class of functions. 630 [GL #4327] 631 632 6253. [cleanup] Remove the support for control channel over Unix 633 Domain Sockets. [GL #4311] 634 635 6252. [test] Python system tests have to be executed by invoking 636 pytest directly. Executing them with the legacy test 637 runner is no longer supported. [GL #4250] 638 639 6251. [bug] Interating a hashmap could return the same element 640 twice. [GL #3422] 641 642 6250. [bug] The wrong covered value was being set by 643 dns_ncache_current for RRSIG records in the returned 644 rdataset structure. This resulted in TYPE0 being 645 reported as the covered value of the RRSIG when dumping 646 the cache contents. [GL #4314] 647 648 6249. [cleanup] Reduce the number of reserved UDP dispatches 649 to the number of loops, replace the round-robin 650 mechanism in dns_dispatchset_t with dispatches 651 pinned to loops, and use lock-free hash tables 652 for looking up query IDs and active TCP 653 connections. [GL !8304] 654 655 6248. [func] Add an option "resolver-use-dns64", which enables 656 application of DNS64 rules to server addresses 657 when sending recursive queries. This allows 658 resolution to be performed via NAT64. [GL #608] 659 660 6247. [func] Implement incremental hashing in both isc_siphash 661 and isc_hash units. [GL #4306] 662 663 .. code-block:: none 664 665 --- 9.19.17 released --- 666 667 6246. [placeholder] 668 669 6245. [security] Limit the amount of recursion that can be performed 670 by isccc_cc_fromwire. (CVE-2023-3341) [GL #4152] 671 672 6244. [bug] Adjust log levels on malformed messages to NOTICE when 673 transferring in a zone. [GL #4290] 674 675 6243. [bug] Restore the call order of dns_validator_destroy and 676 fetchctx_detach to prevent use after free. [GL #4214] 677 678 6242. [func] Ignore jemalloc versions before 4.0.0 as we now 679 need explicit memory arenas and tcache support. 680 [GL #4296] 681 682 6241. [placeholder] 683 684 6240. [bug] Use dedicated per-worker thread jemalloc memory 685 arenas for send buffers allocation to reduce memory 686 consumption and avoid lock contention. [GL #4038] 687 688 6239. [func] Deprecate the 'dnssec-must-be-secure' option. 689 [GL #3700] 690 691 6238. [cleanup] Refactor several objects relying on dns_rbt trees 692 to instead of dns_nametree, a wrapper around dns_qp. 693 [GL !8213] 694 695 6237. [bug] Address memory leaks due to not clearing OpenSSL error 696 stack. [GL #4159] 697 698 6236. [func] Add isc_mem_cget() and isc_mem_cput() calloc-like 699 functions that take nmemb and size, do checked 700 multiplication and zero the memory before returning 701 it to the user. Replace isc_mem_getx(..., ISC_MEM_ZERO) 702 with isc_mem_cget(...) usage. [GL !8237] 703 704 6235. [doc] Clarify BIND 9 time formats. [GL #4266] 705 706 6234. [bug] Restore stale-refresh-time value after flushing the 707 cache. [GL #4278] 708 709 6233. [func] Extend client side support for the EDNS EXPIRE option 710 to IXFR and AXFR query types. [GL #4170] 711 712 6232. [bug] Following the introduction of krb5-subdomain-self-rhs 713 and ms-subdomain-self-rhs update rules, removal of 714 nonexistent PTR and SRV records via UPDATE could fail. 715 [GL #4280] 716 717 6231. [func] Make nsupdate honor -v for SOA requests only if the 718 server is specified. [GL #1181] 719 720 6230. [bug] Prevent an unnecessary query restart if a synthesized 721 CNAME target points to the CNAME owner. [GL #3835] 722 723 6229. [func] Add basic USDT framework for adding static 724 tracing points. [GL #4041] 725 726 6228. [func] Limit the number of inactive network manager handles 727 and uvreq objects that we keep around for reusing 728 later. [GL #4265] 729 730 6227. [bug] Check the statistics-channel HTTP Content-length 731 to prevent negative or overflowing values from 732 causing a crash. [GL #4125] 733 734 6226. [bug] Attach dispatchmgr in the dns_view object to prevent 735 use-after-free when shutting down. [GL #4228] 736 737 6225. [func] Convert dns_nta, dns_forward and dns_keytable units 738 to use QP trie instead of an RBT. [GL !7811] 739 740 6224. [bug] Check the If-Modified-Since value length to prevent 741 out-of-bounds write. [GL #4124] 742 743 6223. [func] Make -E engine option for OpenSSL Engine API use only. 744 OpenSSL Provider API will now require engine to not be 745 set. [GL #8153] 746 747 6222. [func] Fixes to provider/engine based ECDSA key handling. 748 [GL !8152] 749 750 .. code-block:: none 751 752 --- 9.19.16 released --- 753 754 6221. [cleanup] Refactor dns_rdataset internals, move rdatasetheader 755 declarations out of rbtdb.c so they can be used by other 756 databases in the future, and split the zone and cache 757 functions from rbtdb.c into separate modules. [GL !7873] 758 759 6220. [func] Deprecate the 'dialup' and 'heartbeat-interval' 760 options. [GL #3700] 761 762 6219. [bug] Ignore 'max-zone-ttl' on 'dnssec-policy insecure'. 763 [GL #4032] 764 765 6218. [func] Add inline-signing to dnssec-policy. [GL #3677] 766 767 6217. [func] The dns_badcache unit was refactored to use cds_lfht 768 instead of hand-crafted locked hashtable. [GL #4223] 769 770 6216. [bug] Pin dns_request events to the originating loop 771 to serialize access to the data. [GL #4086] 772 773 6215. [protocol] Return REFUSED to GSS-API TKEY requests if GSS-API 774 support is not configured. [GL #4225] 775 776 6214. [bug] Fix the memory leak in for struct stub_glue_request 777 allocated in stub_request_nameserver_address() but not 778 freed in stub_glue_response(). [GL #4227] 779 780 6213. [bug] Mark a primary server as temporarily unreachable if the 781 TCP connection attempt times out. [GL #4215] 782 783 6212. [placeholder] 784 785 6211. [func] Remove 'auto-dnssec'. This obsoletes the configuration 786 options 'dnskey-sig-validity', 'dnssec-dnskey-kskonly', 787 'dnssec-update-mode', 'sig-validity-interval', and 788 'update-check-ksk'. [GL #3672] 789 790 6210. [func] Don't add signing records for DNSKEY added with dynamic 791 update. The dynamic update DNSSEC management feature was 792 removed with GL #3686. [GL !8070] 793 794 6209. [func] Reduce query-response latency by making recursive 795 queries (CNAME, DNAME, NSEC) asynchronous instead 796 of directly calling the respective functions. [GL #4185] 797 798 6208. [func] Return BADCOOKIE for out-of-date or otherwise bad, well 799 formed DNS SERVER COOKIES. [GL #4194] 800 801 .. code-block:: none 802 803 --- 9.19.15 released --- 804 805 6207. [cleanup] The code implementing TSIG/TKEY support has been cleaned 806 up and refactored for improved robustness, readability, 807 and consistency with other code modules. [GL !7828] 808 809 6206. [bug] Add shutdown checks in dns_catz_dbupdate_callback() to 810 avoid a race with dns_catz_shutdown_catzs(). [GL #4171] 811 812 6205. [bug] Restore support to read legacy HMAC-MD5 K file pairs. 813 [GL #4154] 814 815 6204. [bug] Use NS records for relaxed QNAME-minimization mode. 816 This reduces the number of queries named makes when 817 resolving, as it allows the non-existence of NS RRsets 818 at non-referral nodes to be cached in addition to the 819 referrals that are normally cached. [GL #3325] 820 821 6203. [cleanup] Ensure that the size calculation does not overflow 822 when allocating memory for an array. 823 [GL #4120] [GL #4121] [GL #4122] 824 825 6202. [func] Use per-loop memory contexts for dns_resolver 826 objects. [GL !8015] 827 828 6201. [bug] The free_all_cpu_call_rcu_data() call at the end 829 of isc_loopmgr_run() was causing ~200 ms extra 830 latency. [GL #4163] 831 832 6200. [placeholder] 833 834 6199. [bug] Improve HTTP Connection: header protocol conformance 835 in the statistics channel. [GL #4126] 836 837 6198. [func] Remove the holes in the isc_result_t enum to compact 838 the isc_result tables. [GL #4149] 839 840 6197. [bug] Fix a data race between the dns_zone and dns_catz 841 modules when registering/unregistering a database 842 update notification callback for a catalog zone. 843 [GL #4132] 844 845 6196. [cleanup] Report "permission denied" instead of "unexpected error" 846 when trying to update a zone file on a read-only file 847 system. Thanks to Midnight Veil. [GL #4134] 848 849 6195. [bug] Use rcu to reference view->adb. [GL #4021] 850 851 6194. [func] Change function 'find_zone_keys()' to look for signing 852 keys by looking for key files instead of a DNSKEY 853 RRset lookup. [GL #4141] 854 855 6193. [bug] Fix a catz db update notification callback registration 856 logic error, which could crash named when receiving an 857 AXFR update for a catalog zone while the previous update 858 process of the catalog zone was already running. 859 [GL #4136] 860 861 .. code-block:: none 862 863 --- 9.19.14 released --- 864 865 6192. [placeholder] 866 867 6191. [placeholder] 868 869 6190. [security] Improve the overmem cleaning process to prevent the 870 cache going over the configured limit. (CVE-2023-2828) 871 [GL #4055] 872 873 6189. [bug] Fix an extra dns_validator deatch when encountering 874 deadling which would lead to assertion failure. 875 [GL #4115] 876 877 6188. [performance] Reduce memory consumption by allocating properly 878 sized send buffers for stream-based transports. 879 [GL #4038] 880 881 6187. [bug] Address view shutdown INSIST when accessing the 882 zonetable. [GL #4093] 883 884 6186. [bug] Fix a 'clients-per-query' miscalculation bug. When the 885 'stale-answer-enable' options was enabled and the 886 'stale-answer-client-timeout' option was enabled and 887 larger than 0, named was taking two places from the 888 'clients-per-query' limit for each client and was 889 failing to gradually auto-tune its value, as configured. 890 [GL #4074] 891 892 6185. [func] Add "ClientQuota" statistics channel counter, which 893 indicates the number of the resolver's spilled queries 894 due to reaching the clients per query quota. [GL !7978] 895 896 6184. [func] Special-case code that was added to allow GSS-TSIG 897 to work around bugs in the Windows 2000 version of 898 Active Directory has been removed. The 'nsupdate -o' 899 option and 'oldgsstsig' command have been 900 deprecated, and are now treated as synonyms for 901 'nsupdate -g' and 'gsstsig' respectively. [GL #4012] 902 903 6183. [bug] Fix a serve-stale bug where a delegation from cache 904 could be returned to the client. [GL #3950] 905 906 6182. [cleanup] Remove configure checks for epoll, kqueue and 907 /dev/poll. [GL #4098] 908 909 6181. [placeholder] 910 911 6180. [bug] The session key object could be incorrectly added 912 to multiple different views' keyrings. [GL #4079] 913 914 6179. [bug] Fix an interfacemgr use-after-free error in 915 zoneconf.c:isself(). [GL #3765] 916 917 6178. [func] Add support for the multi-signer model 2 (RFC 8901) when 918 using inline-signing. [GL #2710] 919 920 6177. [placeholder] 921 922 6176. [test] Add support for using pytest & pytest-xdist to 923 execute the system test suite. [GL #3978] 924 925 6175. [test] Fix the `upforwd` system test to be more reliable, 926 927 6174. [placeholder] 928 929 6173. [bug] Properly process extra "nameserver" lines in 930 resolv.conf otherwise the next line is not properly 931 processed. [GL #4066] 932 933 6172. [cleanup] Refactor the loop manager and qp-trie code to remove 934 isc_qsbr and use liburcu instead. [GL #3936] 935 936 6171. [cleanup] Remove the stack implementation added in change 6108: 937 we are using the liburcu concurrent data structures 938 instead. [GL !7920] 939 940 6170. [func] The 'rndc -t' option allows a timeout to be set in 941 seconds, so that commands that take a long time to 942 complete (e.g., reloading a very large configuration) 943 can be given time to do so. The default is 60 944 seconds. [GL #4046] 945 946 6169. [bug] named could crash when deleting inline-signing zones 947 with "rndc delzone". [GL #4054] 948 949 6168. [func] Refactor the glue cache to store list of the GLUE 950 directly in the rdatasetheader instead of keeping 951 it in the hashtable indexed by the node pointer. 952 [GL #4045] 953 954 6167. [func] Add 'cdnskey' configuration option. [GL #4050] 955 956 6166. [func] Retry without DNS COOKIE on FORMERR if it appears that 957 the FORMERR was due to the presence of a DNS COOKIE 958 option. [GL #4049] 959 960 6165. [bug] Fix a logic error in dighost.c which could call the 961 dighost_shutdown() callback twice and cause problems 962 if the callback function was not idempotent. [GL #4039] 963 964 .. code-block:: none 965 966 --- 9.19.13 released --- 967 968 6164. [bug] Set the rndc idle read timeout back to 60 seconds, 969 from the netmgr default of 30 seconds, in order to 970 match the behavior of 9.16 and earlier. [GL #4046] 971 972 6163. [func] Add option to dnstap-read to use timestamps in 973 milliseconds (thanks to Oliver Ford). [GL #2360] 974 975 6162. [placeholder] 976 977 6161. [bug] Fix log file rotation when using absolute path as 978 file. [GL #3991] 979 980 6160. [bug] 'delv +ns' could print duplicate output. [GL #4020] 981 982 6159. [bug] Fix use-after-free bug in TCP accept connection 983 failure. [GL #4018] 984 985 6158. [func] Add ISC_LIST_FOREACH() and ISC_LIST_FOREACH_SAFE() 986 to walk the ISC_LIST() in a unified manner and use 987 the safe macro to fix the potential UAF when shutting 988 down the isc_httpd. [GL #4031] 989 990 6157. [bug] When removing delegations in an OPTOUT range 991 empty-non-terminal NSEC3 records generated by 992 those delegations were not removed. [GL #4027] 993 994 6156. [bug] Reimplement the maximum and idle timeouts for incoming 995 zone tranfers. [GL #4004] 996 997 6155. [bug] Treat ISC_R_INVALIDPROTO as a networking error 998 in the dispatch code to avoid retrying with the 999 same server. [GL #4005] 1000 1001 6154. [func] Add spinlock implementation. The spinlock is much 1002 smaller (8 bytes) than pthread_mutex (40 bytes), so 1003 it can be easily embedded into objects for more 1004 fine-grained locking (per-object vs per-bucket). 1005 1006 On the other hand, the spinlock is unsuitable for 1007 situations where the lock might be held for a long 1008 time as it keeps the waiting threads in a spinning 1009 busy loop. [GL #3977] 1010 1011 6153. [bug] Fix the streaming protocols (TCP, TLS) shutdown 1012 sequence. [GL #4011] 1013 1014 6152. [bug] In dispatch, honour the configured source-port 1015 selection when UDP connection fails with address 1016 in use error. 1017 1018 Also treat ISC_R_NOPERM same as ISC_R_ADDRINUSE. 1019 [GL #3986] 1020 1021 6151. [bug] When the same ``notify-source`` address and port number 1022 was configured for multiple destinations and zones, an 1023 unresponsive server could tie up the socket until it 1024 timed out; in the meantime, NOTIFY messages for other 1025 servers silently failed.``named`` will now retry these 1026 failing messages over TCP. NOTIFY failures are now 1027 logged at level INFO. [GL #4001] [GL #4002] 1028 1029 6150. [bug] If the zones have active upstream forwards, the 1030 shutting down the server might cause assertion 1031 failures as the forward were all canceled from 1032 the main loop instead from the loops associated 1033 with the zone. [GL #4015] 1034 1035 6149. [test] As a workaround, include an OpenSSL header file before 1036 including cmocka.h in the unit tests, because OpenSSL 1037 3.1.0 uses __attribute__(malloc), conflicting with a 1038 redefined malloc in cmocka.h. [GL #4000] 1039 1040 6148. [bug] Fix a use-after-free bug in dns_xfrin_create(). 1041 [GL !7832] 1042 1043 6147. [performance] Fix the TCP server parent quota use. [GL #3985] 1044 1045 .. code-block:: none 1046 1047 --- 9.19.12 released --- 1048 1049 6146. [performance] Replace the zone table red-black tree and associated 1050 locking with a lock-free qp-trie. [GL !7582] 1051 1052 6145. [bug] Fix a possible use-after-free bug in the 1053 dns__catz_done_cb() function. [GL #3997] 1054 1055 6144. [bug] A reference counting problem (double detach) might 1056 occur when shutting down zone transfer early after 1057 switching the dns_xfrin to use dns_dispatch API. 1058 [GL #3984] 1059 1060 6143. [bug] A reference counting problem on the error path in 1061 the xfrin_connect_done() might cause an assertion 1062 failure on shutdown. [GL #3989] 1063 1064 6142. [bug] Reduce the number of dns_dnssec_verify calls made 1065 determining if revoked keys needs to be removed from 1066 the trust anchors. [GL #3981] 1067 1068 6141. [bug] Fix several issues in nsupdate timeout handling and 1069 update the -t option's documentation. [GL #3674] 1070 1071 6140. [func] Implement automatic parental-agents ('checkds yes'). 1072 [GL #3901] 1073 1074 6139. [func] Add isc_histo_t general-purpose log-linear histograms, 1075 and use them for message size statistics. [GL !7696] 1076 1077 6138. [doc] Fix the DF-flag documentation on the outgoing 1078 UDP packets. [GL #3710] 1079 1080 6137. [cleanup] Remove the trampoline jump when spawning threads. 1081 [GL !7293] 1082 1083 6136. [cleanup] Remove the isc_fsaccess API in favor of creating 1084 temporary file first and atomically replace the key 1085 with non-truncated content. [GL #3982] 1086 1087 6135. [cleanup] Change isc_stdtime_get(&t) to t = isc_stdtime_now(). 1088 [GL !7757] 1089 1090 6134. [bug] Fix a crash when dig or host receive a signal. 1091 [GL #3970] 1092 1093 6133. [cleanup] Refactor the isc_job_run() to not make any allocations 1094 by embedding isc_job_t into callback argument, and 1095 running it directly. As a side-effect, isc_async_run 1096 and isc_job_run now executes jobs in the natural order. 1097 1098 Use the new improved API to execute connect, read and 1099 send callbacks from netmgr in more straightforward 1100 manner, speeding up the networking. [GL #3961] 1101 1102 6132. [doc] Remove a dead link in the DNSSEC guide. [GL #3967] 1103 1104 6131. [test] Add a minimal test-only library to allow testing 1105 of the DNSRPS API without FastRPZ installed. 1106 Thanks to Farsight Securty. [GL !7693] 1107 1108 6130. [func] The new "delv +ns" option activates name server mode, 1109 in which delv sets up an internal recursive 1110 resolver and uses that, rather than an external 1111 server, to look up the requested data. All messages 1112 sent and received during the resolution and 1113 validation process are logged. This can be used in 1114 place of "dig +trace"; it more accurately 1115 replicates the behavior of named when resolving 1116 a query. [GL #3842] 1117 1118 6129. [cleanup] Value stored to 'source' during its initialization is 1119 never read. [GL #3965] 1120 1121 6128. [bug] Fix an omission in an earlier commit to avoid a race 1122 between the 'dns__catz_update_cb()' and 1123 'dns_catz_dbupdate_callback()' functions. [GL #3968] 1124 1125 6127. [cleanup] Refactor network manager netievent callbacks to 1126 use isc_job_run()/isc_async_run(). [GL #3964] 1127 1128 6126. [func] Remove zone type "delegation-only" and the 1129 "delegation-only" and "root-delegation-only" 1130 options. [GL #3953] 1131 1132 6125. [bug] Hold a catz reference while the update process is 1133 running, so that the catalog zone is not destroyed 1134 during shutdown until the update process is finished or 1135 properly canceled by the activated 'shuttingdown' flag. 1136 [GL #3955] 1137 1138 6124. [bug] When changing from a NSEC3 capable DNSSEC algorithm to 1139 an NSEC3 incapable DNSSEC algorithm using KASP the zone 1140 could sometimes be incompletely signed. [GL #3937] 1141 1142 6123. [placeholder] 1143 1144 6122. [func] BIND now requires liburcu for lock-free data structures 1145 and concurrent safe memory reclamation. It replaces the 1146 home-grown lock-free linked list and QSBR machinery 1147 added in changes 6108 and 6109. [GL #3935] 1148 1149 6121. [cleanup] Remove support for TKEY Mode 2 (Diffie-Hellman Exchanged 1150 Keying). [GL #3905] 1151 1152 .. code-block:: none 1153 1154 --- 9.19.11 released --- 1155 1156 6120. [bug] Use two pairs of dns_db_t and dns_dbversion_t in a 1157 catalog zone structure to avoid a race between the 1158 dns__catz_update_cb() and dns_catz_dbupdate_callback() 1159 functions. [GL #3907] 1160 1161 6119. [bug] Make sure to revert the reconfigured zones to the 1162 previous version of the view, when the new view 1163 reconfiguration fails during the configuration of 1164 one of the configured zones. [GL #3911] 1165 1166 6118. [func] Add 'cds-digest-types' configuration option. Also allow 1167 dnssec-signzone to create multple CDS records. 1168 [GL #3837] 1169 1170 6117. [func] Add a qp-trie data structure. This is a foundation for 1171 our plan to replace, in stages, BIND's red-black tree. 1172 The qp-trie has lock-free multithreaded reads, using 1173 QSBR for safe memory reclamation. [GL !7130] 1174 1175 6116. [placeholder] 1176 1177 6115. [bug] Unregister db update notify callback before detaching 1178 from the previous db inside the catz update notify 1179 callback. [GL #3777] 1180 1181 6114. [func] Run the catalog zone update process on the offload 1182 threads. [GL #3881] 1183 1184 6113. [func] Add shutdown signaling for catalog zones. [GL !7571] 1185 1186 6112. [func] Add reference count tracing for dns_catz_zone_t and 1187 dns_catz_zones_t. [GL !7570] 1188 1189 6111. [cleanup] Move irs_resconf into libdns, and remove the 1190 now empty libirs. [GL !7463] 1191 1192 6110. [cleanup] Refactor the dns_xfrin module to use dns_dispatch 1193 to set up TCP connections and send and receive 1194 messages. [GL #3886] 1195 1196 6109. [func] Infrastructure for QSBR, asynchronous safe memory 1197 reclamation for lock-free data structures. [GL !7471] 1198 1199 6108. [func] Support for simple lock-free singly-linked stacks. 1200 [GL !7470] 1201 1202 6107. [cleanup] Remove the dns_sdb API and rewrite the named 1203 builtin databases to implement dns_db directly. 1204 [GL #3882] 1205 1206 6106. [cleanup] Move bind9_getaddresses() to isc_getaddresses() 1207 and remove the now empty libbind9. [GL !7462] 1208 1209 6105. [bug] Detach 'rpzs' and 'catzs' from the previous view in 1210 configure_rpz() and configure_catz(), respectively, 1211 just after attaching it to the new view. [GL #3880] 1212 1213 6104. [cleanup] Move libbind9's configuration checking code into 1214 libisccfg alongside the other configuration code. 1215 [GL !7461] 1216 1217 6103. [func] All uses of the isc_task and isc_event APIs have 1218 been refactored to use isc_loop instead, and the 1219 original APIs have been removed. [GL #3797] 1220 1221 6102. [cleanup] Several nugatory headers have been removed from libisc. 1222 [GL !7464] 1223 1224 6101. [port] Clarify the portability dodge needed for `strerror_r()` 1225 [GL !7465] 1226 1227 6100. [cleanup] Deprecate <isc/deprecated.h>, because obsolete 1228 functions are now deleted instead of marked with 1229 an attribute. [GL !7466] 1230 1231 6099. [performance] Change the internal read-write lock to modified C-RW-WP 1232 algorithm that is more reader-writer fair and has better 1233 performance for our workloads. [GL #1609] 1234 1235 6098. [test] Don't test HMAC-MD5 when not supported by libcrypto. 1236 [GL #3871] 1237 1238 6097. [port] Improve support for yield / pause instructions in spin 1239 loops on AArch64 platforms. [GL !7469] 1240 1241 6096. [bug] Fix RPZ reference counting error on shutdown in 1242 dns__rpz_timer_cb(). [GL #3866] 1243 1244 6095. [test] Test various 'islands of trust' configurations when 1245 using managed keys. [GL #3662] 1246 1247 6094. [bug] Building against (or running with) libuv versions 1248 1.35.0 and 1.36.0 is now a fatal error. The rules for 1249 mixing and matching compile-time and run-time libuv 1250 versions have been tightened for libuv versions between 1251 1.35.0 and 1.40.0. [GL #3840] 1252 1253 6093. [performance] Reduce the size of each rdataset header object 1254 by 16 bytes. [GL !7505] 1255 1256 6092. [bug] dnssec-cds failed to cleanup properly. [GL #3831] 1257 1258 6091. [cleanup] Drop RHEL 7 and clones support. [GL #3729] 1259 1260 6090. [bug] Fix a bug in resolver's resume_dslookup() function by 1261 making sure that dns_resolver_createfetch() is called 1262 with valid parameters, as required by the function. 1263 [GL #3839] 1264 1265 6089. [bug] Source ports configured for query-source, 1266 transfer-source, etc, were being ignored. (This 1267 feature is deprecated, but it is not yet removed, 1268 so the bug still needed fixing.) [GL #3790] 1269 1270 6088. [cleanup] /etc/bind.keys is no longer needed and has been 1271 removed from the distribution. named and delv can 1272 still load keys from a file for testing purposes, 1273 but they no longer do so by default. [GL #3850] 1274 1275 6087. [cleanup] Remove support for the `DNS_NAME_DOWNCASE` option to 1276 the various dns_*_fromwire() functions. It has long 1277 been unused and is unsupported since change 6022. 1278 [GL !7467] 1279 1280 6086. [cleanup] Remove some remnants of bitstring labels. [GL !7196] 1281 1282 6085. [func] Add isc_time_monotonic() to simplify time measurements. 1283 [GL !7468] 1284 1285 6084. [bug] When BIND was built without jemalloc, the allocator flag 1286 ISC_MEM_ZERO could return non-zero memory. [GL #3845] 1287 1288 .. code-block:: none 1289 1290 --- 9.19.10 released --- 1291 1292 6083. [bug] Fix DNSRPS-enabled builds as they were inadvertently 1293 broken by changes 5949 and 6042. [GL #3827] 1294 1295 6082. [test] fuzz/dns_message_checksig leaked memory when shutting 1296 down. [GL #3828] 1297 1298 6081. [bug] Handle primary server address lookup failures in 1299 nsupdate more gracefully. [GL #3830] 1300 1301 6080. [bug] 'named -V' leaked memory. [GL #3829] 1302 1303 6079. [bug] Force set the DS state after a 'rdnc dnssec -checkds' 1304 command. [GL #3822] 1305 1306 6078. [func] Cleanup the memory statistic counters to a bare 1307 minumum - InUse with Malloced as alias. [GL #3718] 1308 1309 6077. [func] Implement query forwarding to DoT-enabled upstream 1310 servers. [GL #3726] 1311 1312 6076. [bug] Handle OS errors when creating UDP and TCP sockets 1313 more gracefully. [GL #3800] 1314 1315 6075. [bug] Add missing node lock when setting node->wild in 1316 add_wildcard_magic. [GL #3799] 1317 1318 6074. [func] Refactor the isc_nm_xfr_allowed() function to return 1319 isc_result_t instead of boolean. [GL #3808] 1320 1321 6073. [bug] Set RD=1 on DS requests to parental-agents. [GL #3783] 1322 1323 6072. [bug] Avoid the OpenSSL lock contention when initializing 1324 Message Digest Contexts by using explicit algorithm 1325 fetching, initializing static contexts for every 1326 supported algorithms, and initializing the new context 1327 by copying the static copy. [GL #3795] 1328 1329 6071. [func] The use of "port" when configuring query-source, 1330 transfer-source, notify-source and parental-source 1331 addresses has been deprecated, along with the 1332 use-v[46]-udp-ports and avoid-v[46]-udp-ports 1333 options. A warning will be logged when these 1334 options are used. In a future release, they 1335 will be removed. [GL #3781] 1336 1337 6070. [func] DSCP parsing has now been fully removed, and 1338 configuration of DSCP values in named.conf is a 1339 configuration error. [GL #3789] 1340 1341 6069. [bug] Detach from the view in zone_shutdown() to 1342 release the memory held by the dead view 1343 early. [GL #3801] 1344 1345 6068. [bug] Downloading a zone via TLS from a server which does 1346 not negotiate "dot" ALPN token could crash BIND 1347 on shutdown. That has been fixed. [GL #3767] 1348 1349 .. code-block:: none 1350 1351 --- 9.19.9 released --- 1352 1353 6067. [security] Fix serve-stale crash when recursive clients soft quota 1354 is reached. (CVE-2022-3924) [GL #3619] 1355 1356 6066. [security] Handle RRSIG lookups when serve-stale is active. 1357 (CVE-2022-3736) [GL #3622] 1358 1359 6065. [placeholder] 1360 1361 6064. [security] An UPDATE message flood could cause named to exhaust all 1362 available memory. This flaw was addressed by adding a 1363 new "update-quota" statement that controls the number of 1364 simultaneous UPDATE messages that can be processed or 1365 forwarded. The default is 100. A stats counter has been 1366 added to record events when the update quota is 1367 exceeded, and the XML and JSON statistics version 1368 numbers have been updated. (CVE-2022-3094) [GL #3523] 1369 1370 6063. [cleanup] The RSA and ECDSA parts of the DNSSEC has been 1371 refactored for a better OpenSSL 3.x integration and 1372 preliminary PKCS#11 support via for OpenSSL Providers 1373 has been added. [GL #3785] 1374 1375 6062. [func] The DSCP implementation, which has been 1376 nonfunctional for some time, is now marked as 1377 obsolete and the implementation has been removed. 1378 Configuring DSCP values in named.conf has no 1379 effect, and a warning will be logged that 1380 the feature should no longer be used. [GL #3773] 1381 1382 6061. [bug] Fix unexpected "Prohibited" extended DNS error 1383 on allow-recursion. [GL #3743] 1384 1385 6060. [bug] Fix a use-after-free bug in dns_zonemgr_releasezone() 1386 by detaching from the zone manager outside of the write 1387 lock. [GL #3768] 1388 1389 6059. [bug] In some serve stale scenarios, like when following an 1390 expired CNAME record, named could return SERVFAIL if the 1391 previous request wasn't successful. Consider non-stale 1392 data when in serve-stale mode. [GL #3678] 1393 1394 6058. [bug] Prevent named from crashing when "rndc delzone" 1395 attempts to delete a zone added by a catalog zone. 1396 [GL #3745] 1397 1398 6057. [bug] Fix shutdown and error path bugs in the rpz unit. 1399 [GL #3735] 1400 1401 6056. [bug] Fix a race in adb.c:clean_namehooks(), so that an ADB 1402 entry does not expire without holding the entries lock. 1403 [GL #3754] 1404 1405 6055. [cleanup] Remove setting alternate transfer sources, make options 1406 alt-transfer-source, alt-transfer-transfer-source-v6, 1407 and use-alt-transfer-source ancient. [GL #3714] 1408 1409 6054. [func] Refactor remote servers (primaries, parental-agents) 1410 in zone.c. Store common code in new source files 1411 remote.c and remote.h. Introduce a new way to set the 1412 source address and port. [GL !7110] 1413 1414 6053. [bug] Fix an ADB quota management bug in resolver. [GL #3752] 1415 1416 6052. [func] Replace DNS over TCP and DNS over TLS transports 1417 code with a new, unified transport implementation. 1418 [GL #3374] 1419 1420 6051. [bug] Improve thread safety in the dns_dispatch unit. 1421 [GL #3178] [GL #3636] 1422 1423 6050. [bug] Changes to the RPZ response-policy min-update-interval 1424 and add-soa options now take effect as expected when 1425 named is reconfigured. [GL #3740] 1426 1427 6049. [bug] Exclude ABD hashtables from the ADB memory 1428 overmem checks and don't clean ADB names 1429 and ADB entries used in the last 10 seconds 1430 (ADB_CACHE_MINIMUM). [GL #3739] 1431 1432 6048. [bug] Fix a log message error in dns_catz_update_from_db(), 1433 where serials with values of 2^31 or larger were logged 1434 incorrectly as negative numbers. [GL #3742] 1435 1436 6047. [bug] Try the next server instead of trying the same 1437 server again on an outgoing query timeout. 1438 [GL #3637] 1439 1440 6046. [bug] TLS session resumption might lead to handshake 1441 failures when client certificates are used for 1442 authentication (Mutual TLS). This has been fixed. 1443 [GL #3725] 1444 1445 6045. [cleanup] The list of supported DNSSEC algorithms changed log 1446 level from "warning" to "notice" to match named's other 1447 startup messages. [GL !7217] 1448 1449 6044. [bug] There was an "RSASHA236" typo in a log message. 1450 [GL !7206] 1451 1452 .. code-block:: none 1453 1454 --- 9.19.8 released --- 1455 1456 6043. [bug] The key file IO locks objects would never get 1457 deleted from the hashtable due to off-by-one error. 1458 [GL #3727] 1459 1460 6042. [bug] ANY responses could sometimes have the wrong TTL. 1461 [GL #3613] 1462 1463 6041. [func] Set the RLIMIT_NOFILE to rlim_max returned from 1464 getrlimit() instead of trying to guess the maximum 1465 allowed value. [GL #3676] 1466 1467 6040. [bug] Speed up the named shutdown time by explicitly 1468 canceling all recursing ns_client objects for 1469 each ns_clientmgr. [GL #3183] 1470 1471 6039. [bug] Removing a catalog zone from catalog-zones without 1472 also removing the referenced zone could leave a 1473 dangling pointer. [GL #3683] 1474 1475 6038. [placeholder] 1476 1477 6037. [func] Reject zones which have DS records not at delegation 1478 points. [GL #3697] 1479 1480 6036. [bug] nslookup and host were not honoring the selected port 1481 in TCP mode. [GL #3721] 1482 1483 6035. [bug] Refactor the dns_resolver unit to store the fetch 1484 contexts and zone counter directly in the hash 1485 tables without buckets and implement effective 1486 cleaning of both objects. [GL #3709] 1487 1488 6034. [func] Deprecate alt-transfer-source, alt-transfer-source-v6 1489 and use-alt-transfer-source. [GL #3694] 1490 1491 6033. [func] Log messages related to serve-stale now include the RR 1492 type involved. [GL !7145] 1493 1494 6032. [bug] After change 5995, zone transfers were using a small 1495 compression context that only had space for the first 1496 few dozen names in each message. They now use a large 1497 compression context with enough space for every name. 1498 [GL #3706] 1499 1500 6031. [bug] Move the "final reference detached" log message 1501 from dns_zone unit to the DEBUG(1) log level. 1502 [GL #3707] 1503 1504 6030. [bug] Refactor the ADB to use a global LRU queue, store 1505 the ADB names and ADB entries directly in the hash 1506 tables instead of buckets, and properly clean the 1507 ADB names and entries when not in use. [GL #3239] 1508 [GL #3238] [GL #2615] [GL #2078] [GL #2437] 1509 [GL #3312] [GL #2441] 1510 1511 6029. [cleanup] Remove the unused external cache cleaning mechanism 1512 as RBTDB has its own internal cache cleaning 1513 mechanism and we don't support any other database 1514 implementations. [GL #3639] 1515 1516 6028. [performance] Build-time code generation of DNS RRtype switches 1517 is now much faster. [GL !7121] 1518 1519 6027. [bug] Fix assertion failure in isc_http API used by 1520 statschannel if the read callback would be called 1521 on HTTP request that has been already closed. 1522 [GL #3693] 1523 1524 6026. [cleanup] Deduplicate time unit conversion factors. 1525 [GL !7033] 1526 1527 6025. [bug] Copy TLS identifier when setting up primaries for 1528 catalog member zones. [GL #3638] 1529 1530 6024. [func] Deprecate 'auto-dnssec'. [GL #3667] 1531 1532 6023. [func] Remove dynamic update DNSSEC management feature. 1533 [GL #3686] 1534 1535 6022. [performance] The decompression implementation in dns_name_fromwire() 1536 is now smaller and faster. [GL #3655] 1537 1538 6021. [bug] Use the current domain name when checking answers from 1539 a dual-stack-server. [GL #3607] 1540 1541 6020. [bug] Ensure 'named-checkconf -z' respects the check-wildcard 1542 option when loading a zone. [GL #1905] 1543 1544 6019. [func] Deprecate `coresize`, `datasize`, `files`, and 1545 `stacksize` named.conf options. [GL #3676] 1546 1547 6018. [cleanup] Remove the --with-tuning configure option. 1548 [GL #3664] 1549 1550 6017. [bug] The view's zone table was not locked when it should 1551 have been leading to race conditions when external 1552 extensions that manipulate the zone table where in 1553 use. [GL #3468] 1554 1555 6016. [func] Change NSEC3PARAM TTL to match the SOA MINIMUM. 1556 [GL #3570] 1557 1558 6015. [bug] Some browsers (Firefox) send more than 10 HTTP 1559 headers. Bump the number of allowed HTTP headers 1560 to 100. [GL #3670] 1561 1562 6014. [func] Add isc_hashmap API implementation that implements 1563 Robin Hood hashing. The API requires the keys to 1564 be stored with the stored value. [GL !6790] 1565 1566 .. code-block:: none 1567 1568 --- 9.19.7 released --- 1569 1570 6013. [bug] Fix a crash that could happen when you change 1571 a dnssec-policy zone with NSEC3 to start using 1572 inline-signing. [GL #3591] 1573 1574 6012. [placeholder] 1575 1576 6011. [func] Refactor the privilege setting part of named_os unit 1577 to make libcap on Linux mandatory and use setreuid 1578 and setregid if available. [GL #3583] 1579 1580 6010. [func] Make the initial interface scan happen before 1581 dropping the privileges. This requires exiting 1582 exclusive mode before scanning the interfaces 1583 and re-entering it again when we are done. This 1584 is because starting the listening on interfaces 1585 requires the loopmgr to be running and not paused. 1586 [GL #3583] 1587 1588 6009. [bug] Don't trust a placeholder KEYDATA from the managed-keys 1589 zone by adding it into secroots. [GL #2895] 1590 1591 6008. [bug] Fixed a race condition that could cause a crash 1592 in dns_zone_synckeyzone(). [GL #3617] 1593 1594 6007. [cleanup] Don't enforce the jemalloc use on NetBSD. [GL #3634] 1595 1596 6006. [cleanup] The zone dumping was using isc_task API to launch 1597 the zonedump on the offloaded threadpool. Remove 1598 the task and launch the offloaded work directly. 1599 [GL #3628] 1600 1601 6005. [func] The zone loading has been moved to the offload 1602 threadpool instead of doing incremental repeated 1603 tasks, so zone loading scheduling is now driven 1604 by the operating system scheduler rather than fixed 1605 (100) quantum. [GL #3625] 1606 1607 6004. [func] Add check-svcb to control the checking of additional 1608 constraints on SVBC records. This change impacts on 1609 named, named-checkconf, named-checkzone, 1610 named-compilezone and nsupdate. [GL #3576] 1611 1612 6003. [bug] Fix an inheritance bug when setting the port on 1613 remote servers in configuration. [GL #3627] 1614 1615 6002. [bug] Fix a resolver prefetch bug when the record's TTL value 1616 is equal to the configured prefetch eligibility value, 1617 but the record was erroneously not treated as eligible 1618 for prefetching. [GL #3603] 1619 1620 6001. [bug] Always call dns_adb_endudpfetch() after calling 1621 dns_adb_beginudpfetch() for UDP queries in resolver.c, 1622 in order to adjust back the quota. [GL #3598] 1623 1624 6000. [bug] Fix a startup issue on Solaris systems with many 1625 (reportedly > 510) CPUs. Thanks to Stacey Marshall from 1626 Oracle for deep investigation of the problem. [GL #3563] 1627 1628 5999. [bug] rpz-ip rules could be ineffective in some scenarios 1629 with CD=1 queries. [GL #3247] 1630 1631 5998. [placeholder] 1632 1633 5997. [cleanup] Less ceremonial UNEXPECTED_ERROR() and FATAL_ERROR() 1634 reporting macros. [GL !6914] 1635 1636 5996. [bug] Fix a couple of bugs in cfg_print_duration(), which 1637 could result in generating incomplete duration values 1638 when printing the configuration using named-checkconf. 1639 [GL !6880] 1640 1641 5995. [performance] A new algorithm for DNS name compression based on a 1642 hash set of message offsets. Name compression is now 1643 more complete as well as being generally faster, and 1644 the implementation is less complicated and requires 1645 much less memory. [GL !6517] 1646 1647 5994. [func] Refactor the isc_httpd implementation used in the 1648 statistics channel. [GL !6879] 1649 1650 5993. [cleanup] Store dns_name_t attributes as boolean members of 1651 the structure. Remove DNS_NAMEATTR_* macros. 1652 Fix latent attribute handling bug in RBT. [GL !6902] 1653 1654 .. code-block:: none 1655 1656 --- 9.19.6 released --- 1657 1658 5992. [func] Introduce the new isc_mem_*x() APIs that takes extra 1659 flags as the last argument. Currently ISC_MEM_ZERO 1660 and ISC_MEM_ALIGN(n) flags have been implemented that 1661 clears the memory to avoid the isc_mem_get()/memset() 1662 pattern and make aligned allocation which replaces the 1663 previous isc_mem_*_aligned() calls. [GL !6398] 1664 1665 5991. [protocol] Add support for parsing and validating "dohpath" to 1666 SVCB. [GL #3544] 1667 1668 5990. [test] fuzz/dns_message_checksig now creates the key directory 1669 it uses when testing in /tmp at run time. [GL #3569] 1670 1671 5989. [func] Implement support for DDNS update forwarding using DoT 1672 to TLS-enabled primary servers. [GL #3512] 1673 1674 5988. [bug] Some out of memory conditions in opensslrsa_link.c 1675 could lead to memory leaks. [GL #3551] 1676 1677 5987. [func] Provide custom isc_mem based allocators for libuv, 1678 OpenSSL and libxml2 libraries that support replacing 1679 the internal allocators. [GL #3559] 1680 1681 5986. [func] Make the memory context debugging options local to 1682 the memory context and make it immutable for the memory 1683 context lifetime. [GL #3559] 1684 1685 5985. [func] Bump the minimal libuv version to 1.34.0. [GL #3567] 1686 1687 5984. [func] 'named -V' now reports the list of supported 1688 DNSSEC/DS/HMAC algorithms and the supported TKEY modes. 1689 [GL #3541] 1690 1691 5983. [bug] Changing just the TSIG key names for primaries in 1692 catalog zones' member zones was not effective. 1693 [GL #3557] 1694 1695 5982. [func] Extend dig to allow requests to be signed using SIG(0) 1696 as well as providing a mechanism to specify the signing 1697 time. [GL !5923] 1698 1699 5981. [test] Add dns_message_checksig fuzzer to check messages 1700 signed using TSIG or SIG(0). [GL !5923] 1701 1702 5980. [func] The internal isc_entropy API provider has been 1703 changed from OpenSSL RAND_bytes() to uv_random() 1704 to use system provided entropy. [GL !6803] 1705 1706 5979. [func] Implement DoT support for nsupdate. [GL #1781] 1707 1708 5978. [port] The ability to use pkcs11 via engine_pkcs11 has been 1709 restored, by only using deprecated APIs in 1710 OpenSSL 3.0.0. BIND needs to be compiled with 1711 '-DOPENSSL_API_COMPAT=10100' specified in the CFLAGS 1712 at compile time. [GL !6711] 1713 1714 5977. [bug] named could incorrectly return non-truncated, glueless 1715 referrals for responses whose size was close to the UDP 1716 packet size limit. [GL #1967] 1717 1718 5976. [cleanup] isc_timer_t objects are now created, started and 1719 destroyed in a particular loop, and timer callbacks 1720 run in that loop. isc_timer_stop() can still be called 1721 from any loop; when run from a different loop than 1722 the one associated with the timer, the request will 1723 be recorded in atomic variable and the timer will 1724 be stopped on the next callback call. [GL #3202] 1725 1726 5975. [func] Implement TLS transport support for dns_request and 1727 dns_dispatch. [GL #3529] 1728 1729 5974. [bug] Fix an assertion failure in dispatch caused by 1730 extra read callback call. [GL #3545] 1731 1732 5973. [bug] Fixed a possible invalid detach in UPDATE 1733 processing. [GL #3522] 1734 1735 5972. [bug] Gracefully handle when the statschannel HTTP connection 1736 gets cancelled during sending data back to the client. 1737 [GL #3542] 1738 1739 5971. [func] Add libsystemd sd_notify() support. [GL #1176] 1740 1741 5970. [func] Log the reason why a query was refused. [GL !6669] 1742 1743 5969. [bug] DNSSEC signing statistics failed to identify the 1744 algorithm involved. The key names have been changed 1745 to be the algorithm number followed by "+" followed 1746 by the key id (e.g. "8+54274"). [GL #3525] 1747 1748 5968. [cleanup] Remove 'resolve' binary from tests. [GL !6733] 1749 1750 5967. [cleanup] Flagged the obsolete "random-device" option as 1751 ancient; it is now an error to configure it. [GL #3399] 1752 1753 5966. [func] You can now specify if a server must return a DNS 1754 COOKIE before accepting the response over UDP. 1755 [GL #2295] 1756 1757 server <prefix> { require-cookie <yes_or_no>; }; 1758 1759 5965. [cleanup] Move the duplicated ASCII case conversion tables to 1760 isc_ascii where they can be shared, and replace the 1761 various hot-path tolower() loops with calls to new 1762 isc_ascii implementations. [GL !6516] 1763 1764 5964. [func] When an international domain name is not valid, DiG will 1765 now pass it through unchanged, instead of stopping with 1766 an error message. [GL #3527] 1767 1768 5963. [bug] Ensure struct named_server is properly initialized. 1769 [GL #6531] 1770 1771 .. code-block:: none 1772 1773 --- 9.19.5 released --- 1774 1775 5962. [security] Fix memory leak in EdDSA verify processing. 1776 (CVE-2022-38178) [GL #3487] 1777 1778 5961. [placeholder] 1779 1780 5960. [security] Fix serve-stale crash that could happen when 1781 stale-answer-client-timeout was set to 0 and there was 1782 a stale CNAME in the cache for an incoming query. 1783 (CVE-2022-3080) [GL #3517] 1784 1785 5959. [security] Fix memory leaks in the DH code when using OpenSSL 3.0.0 1786 and later versions. The openssldh_compare(), 1787 openssldh_paramcompare(), and openssldh_todns() 1788 functions were affected. (CVE-2022-2906) [GL #3491] 1789 1790 5958. [security] When an HTTP connection was reused to get 1791 statistics from the stats channel, and zlib 1792 compression was in use, each successive 1793 response sent larger and larger blocks of memory, 1794 potentially reading past the end of the allocated 1795 buffer. (CVE-2022-2881) [GL #3493] 1796 1797 5957. [security] Prevent excessive resource use while processing large 1798 delegations. (CVE-2022-2795) [GL #3394] 1799 1800 5956. [func] Make RRL code treat all QNAMEs that are subject to 1801 wildcard processing within a given zone as the same 1802 name. [GL #3459] 1803 1804 5955. [port] The libxml2 library has deprecated the usage of 1805 xmlInitThreads() and xmlCleanupThreads() functions. Use 1806 xmlInitParser() and xmlCleanupParser() instead. 1807 [GL #3518] 1808 1809 5954. [func] Fallback to IDNA2003 processing in dig when IDNA2008 1810 conversion fails. [GL #3485] 1811 1812 5953. [bug] Fix a crash on shutdown in delete_trace_entry(). Add 1813 mctx attach/detach pair to make sure that the memory 1814 context used by a memory pool is not destroyed before 1815 the memory pool itself. [GL #3515] 1816 1817 5952. [bug] Use quotes around address strings in YAML output. 1818 [GL #3511] 1819 1820 5951. [bug] In some cases, the dnstap query_message field was 1821 erroneously set when logging response messages. 1822 [GL #3501] 1823 1824 5950. [func] Implement a feature to set an Extended DNS Error (EDE) 1825 code on responses modified by RPZ. [GL #3410] 1826 1827 5949. [func] Add new isc_loopmgr API that runs the application 1828 event loops and completely replaces the isc_app 1829 API. Refactor the isc_taskmgr, isc_timermgr and 1830 isc_netmgr to use the isc_loopmgr event loops. 1831 [GL #3508] 1832 1833 5948. [bug] Fix nsec3.c:dns_nsec3_activex() function, add a missing 1834 dns_db_detachnode() call. [GL #3500] 1835 1836 5947. [func] Change dnssec-policy to allow graceful transition from 1837 an NSEC only zone to NSEC3. [GL #3486] 1838 1839 5946. [bug] Fix statistics channel's handling of multiple HTTP 1840 requests in a single connection which have non-empty 1841 request bodies. [GL #3463] 1842 1843 5945. [bug] If parsing /etc/bind.key failed, delv could assert 1844 when trying to parse the built in trust anchors as 1845 the parser hadn't been reset. [GL !6468] 1846 1847 5944. [bug] Fix +http-plain-get and +http-plain-post options 1848 support in dig. Thanks to Marco Davids at SIDN for 1849 reporting the problem. [GL !6672] 1850 1851 5943. [placeholder] 1852 1853 5942. [bug] Fix tkey.c:buildquery() function's error handling by 1854 adding the missing cleanup code. [GL #3492] 1855 1856 5941. [func] Zones with dnssec-policy now require dynamic DNS or 1857 inline-siging to be configured explicitly. [GL #3381] 1858 1859 5940. [placeholder] 1860 1861 5939. [placeholder] 1862 1863 5938. [bug] An integer type overflow could cause an assertion 1864 failure when freeing memory. [GL #3483] 1865 1866 5937. [cleanup] The dns_rdatalist_tordataset() and 1867 dns_rdatalist_fromrdataset() functions can no 1868 longer fail. Clean up their prototypes and error 1869 handling, and that of other calling functions that 1870 subsequently cannot fail, including 1871 dns_message_setquerytsig(). [GL #3467] 1872 1873 5936. [bug] Don't enable serve-stale for lookups that error because 1874 it is a duplicate query or a query that would be 1875 dropped. [GL #2982] 1876 1877 5935. [bug] Fix DiG lookup reference counting bug, which could 1878 be observed in NSSEARCH mode. [GL #3478] 1879 1880 .. code-block:: none 1881 1882 --- 9.19.4 released --- 1883 1884 5934. [func] Improve fetches-per-zone fetch limit logging to log 1885 the final allowed and spilled values of the fetch 1886 counters before the counter object gets destroyed. 1887 [GL #3461] 1888 1889 5933. [port] Automatically disable RSASHA1 and NSEC3RSASHA1 in 1890 named on Fedorda 33, Oracle Linux 9 and RHEL9 when 1891 they are disabled by the security policy. [GL #3469] 1892 1893 5932. [bug] Fix rndc dumpdb -expired and always include expired 1894 RRsets, not just for RBTDB_VIRTUAL time window. 1895 [GL #3462] 1896 1897 5931. [bug] Fix DiG query error handling robustness in NSSEARCH 1898 mode by making sure that udp_ready(), tcp_connected(), 1899 and send_done() callbacks start the next query in chain 1900 even if there is some kind of error with the previous 1901 query. [GL #3419] 1902 1903 5930. [bug] Fix DiG query retry and fail-over bug in UDP mode. 1904 Also simplify the overall retry and fail-over logic to 1905 make it behave predictably, and always respect the 1906 documented +retry/+tries count set by a command-line 1907 option (or use the default values of 2 or 3 1908 respectively). [GL #3407] 1909 1910 5929. [func] The use of the "max-zone-ttl" option in "zone" and 1911 "options" blocks is now deprecated; this should 1912 now be configured as part of "dnssec-policy" 1913 instead. The old option still works in zones 1914 with no "dnssec-policy" configured, but a warning 1915 will be logged when loading configuration. Its 1916 functionality will be removed in a future release. 1917 Using "max-zone-ttl" and "dnssec-policy" in the 1918 same zone is now a fatal error. [GL #2918] 1919 1920 5928. [placeholder] 1921 1922 5927. [bug] A race was possible in dns_dispatch_connect() 1923 that could trigger an assertion failure if two 1924 threads called it near-simultaneously. [GL #3456] 1925 1926 5926. [func] Handle transient TCP connect() EADDRINUSE failures 1927 on FreeBSD (and possibly other BSDs) by trying three 1928 times before giving up. [GL #3451] 1929 1930 5925. [bug] With a forwarder configured for all queries, resolution 1931 failures encountered during DS chasing could trigger 1932 assertion failures due to a logic bug in 1933 resume_dslookup() that caused it to call 1934 dns_resolver_createfetch() with an invalid name. 1935 [GL #3439] 1936 1937 5924. [func] When it's necessary to use AXFR to respond to an 1938 IXFR request, a message explaining the reason 1939 is now logged at level info. [GL #2683] 1940 1941 5923. [bug] Fix inheritance for dnssec-policy when checking for 1942 inline-signing. [GL #3438] 1943 1944 5922. [bug] Forwarding of UPDATE message could fail with the 1945 introduction of netmgr. This has been fixed. [GL #3389] 1946 1947 5921. [test] Convert system tests to use a default DNSKEY algorithm 1948 where the test is not DNSKEY algorithm specific. 1949 [GL #3440] 1950 1951 5920. [bug] Don't pass back the current name offset when the 1952 compression is disabled in the non-improving case. 1953 [GL #3423] 1954 1955 .. code-block:: none 1956 1957 --- 9.19.3 released --- 1958 1959 5919. [func] The "rndc fetchlimit" command lists name servers 1960 and domain names that are being rate-limited by 1961 "fetches-per-server" or "fetches-per-zone" limits. 1962 [GL #665] 1963 1964 5918. [test] Convert system tests to use a default HMAC algorithm 1965 where the test is not HMAC specific. [GL #3433] 1966 1967 5917. [bug] Update ifconfig.sh script as is miscomputed interface 1968 identifiers when destroying interfaces. [GL #3061] 1969 1970 5916. [bug] When resolving a name, don't give up immediately if an 1971 authoritative server returns FORMERR; try the other 1972 servers first. [GL #3152] 1973 1974 5915. [bug] Detect missing closing brace (}) and computational 1975 overflows in $GENERATE directives. [GL #3429] 1976 1977 5914. [bug] When synth-from-dnssec generated a response using 1978 records from a higher zone, it could unexpectedly prove 1979 non-existance of records in a subordinate grafted-on 1980 namespace. [GL #3402] 1981 1982 5913. [placeholder] 1983 1984 5912. [cleanup] The "glue-cache" option has been removed. The glue cache 1985 feature still works and is now permanently enabled. 1986 [GL #2147] 1987 1988 5911. [bug] Update HTTP listener settings on reconfiguration. 1989 [GL #3415] 1990 1991 5910. [cleanup] Move built-in dnssec-policies into the defaultconf. 1992 These are now printed with 'named -C'. [GL !6467] 1993 1994 5909. [bug] The server-side destination port was missing from dnstap 1995 captures of client traffic. [GL #3309] 1996 1997 5908. [bug] Fix race conditions in route_connected(). [GL #3401] 1998 1999 5907. [bug] Fix a crash in dig NS search mode when one of the NS 2000 server queries fail. [GL #3207] 2001 2002 5906. [cleanup] Various features (e.g. prefetch, RPZ) no longer share 2003 common pointers when initiating recursion. This 2004 rationalizes recursion quota handling and makes the 2005 value of the RecursClients statistics counter more 2006 accurate. [GL #3168] 2007 2008 5905. [bug] When the TCP connection would be closed/reset between 2009 the connect/accept and the read, the uv_read_start() 2010 return value would be unexpected and cause an assertion 2011 failure. [GL #3400] 2012 2013 5904. [func] Changed dnssec-signzone -H default to 0 additional 2014 NSEC3 iterations. [GL #3395] 2015 2016 5903. [bug] When named checks that the OPCODE in a response matches 2017 that of the request, if there is a mismatch named logs 2018 an error. Some of those error messages incorrectly 2019 used RCODE instead of OPCODE to lookup the nemonic. 2020 This has been corrected. [GL !6420] 2021 2022 5902. [func] NXDOMAIN cache records are no longer retained in 2023 the cache after expiry, even when serve-stale is 2024 in use. [GL #3386] 2025 2026 5901. [bug] When processing a catalog zone member zone make sure 2027 that there is no configured pre-existing forward-only 2028 forward zone with that name. [GL #2506] 2029 2030 5900. [placeholder] 2031 2032 .. code-block:: none 2033 2034 --- 9.19.2 released --- 2035 2036 5899. [func] Don't try to process DNSSEC-related and ZONEMD records 2037 in catz. [GL #3380] 2038 2039 5898. [cleanup] Simplify BIND's internal DNS name compression API. As 2040 RFC 6891 explains, it isn't practical to deploy new 2041 label types or compression methods, so it isn't 2042 necessary to have an API designed to support them. 2043 Remove compression terminology that refers to Internet 2044 Drafts that expired in the 1990s. [GL !6270] 2045 2046 5897. [bug] Views that weren't configured to use RFC 5011 key 2047 management would still set up an empty managed-keys 2048 zone. This has been fixed. [GL #3349] 2049 2050 5896. [func] Add some more dnssec-policy checks to detect weird 2051 policies. [GL #1611] 2052 2053 5895. [test] Add new set of unit test macros and move the unit 2054 tests under single namespace in /tests/. [GL !6243] 2055 2056 5894. [func] Avoid periodic interface re-scans on Linux by 2057 default, where a reliable event-based mechanism for 2058 detecting interface state changes is available. 2059 [GL #3064] 2060 2061 5893. [func] Add TLS session resumption support to the client-side 2062 TLS code. [GL !6274] 2063 2064 5892. [cleanup] Refactored the the hash tables in resolver.c to 2065 use the isc_ht API. [GL !6271] 2066 2067 5891. [func] Key timing options for `dnssec-settime` and related 2068 utilities now accept "UNSET" times as printed by 2069 `dnssec-settime -p`. [GL #3361] 2070 2071 5890. [bug] When the fetches-per-server quota was adjusted 2072 because of an authoritative server timing out more 2073 or less frequently, it was incorrectly set to 1 2074 rather than the intended value. This has been 2075 fixed. [GL #3327] 2076 2077 5889. [cleanup] Refactored and simplified the shutdown processes in 2078 dns_view, dns_resolver, dns_requestmgr, and dns_adb 2079 by reducing interdependencies between the objects. 2080 [GL !6278] 2081 2082 5888. [bug] Only write key files if the dnssec-policy keymgr has 2083 changed the metadata. [GL #3302] 2084 2085 5887. [cleanup] Remove the on-shutdown mechanics from isc_task API. 2086 Replace it by isc_task_send() when we are shutting 2087 down. [GL !6275] 2088 2089 .. code-block:: none 2090 2091 --- 9.19.1 released --- 2092 2093 5886. [security] Fix a crash in DNS-over-HTTPS (DoH) code caused by 2094 premature TLS stream socket object deletion. 2095 (CVE-2022-1183) [GL #3216] 2096 2097 5885. [bug] RPZ NSIP and NSDNAME rule processing didn't handle stub 2098 and static-stub zones at or above the query name. This 2099 has now been addressed. [GL #3232] 2100 2101 5884. [cleanup] Reduce struct padding in ADB address entries, and use a 2102 binary hash function to find addresses. [GL !6219] 2103 2104 5883. [cleanup] Move netmgr/uv-compat.{c,h} to <isc/uv.h>, so 2105 the compatibility libuv shims could be used outside 2106 the network manager. [GL !6199] 2107 2108 5882. [contrib] Avoid name space collision in dlz modules by prefixing 2109 functions with 'dlz_'. [GL !5778] 2110 2111 5881. [placeholder] 2112 2113 5880. [func] Add new named command-line option -C to print built-in 2114 defaults. [GL #1326] 2115 2116 5879. [contrib] dlz: Add FALLTHROUGH and UNREACHABLE macros. [GL #3306] 2117 2118 5878. [func] Check the algorithm name or OID embedded at the start 2119 of the signature field for PRIVATEDNS and PRIVATEOID 2120 SIG and RRSIG records are well formed. [GL #3296] 2121 2122 5877. [func] Introduce the concept of broken catalog zones described 2123 in the DNS catalog zones draft version 5 document. 2124 [GL #3224] 2125 2126 5876. [func] Add DNS Extended Errors when stale answers are returned 2127 from cache. [GL #2267] 2128 2129 5875. [bug] Fixed a deadlock that could occur if an rndc 2130 connection arrived during the shutdown of network 2131 interfaces. [GL #3272] 2132 2133 5874. [placeholder] 2134 2135 5873. [bug] Refactor the fctx_done() function to set fctx to 2136 NULL after detaching, so that reference counting 2137 errors will be easier to avoid. [GL #2969] 2138 2139 5872. [bug] udp_recv() in dispatch could trigger an INSIST when the 2140 callback's result indicated success but the response 2141 was canceled in the meantime. [GL #3300] 2142 2143 5871. [bug] Fix dig hanging on TLS context creation errors. 2144 [GL #3285] 2145 2146 5870. [cleanup] Remove redundant macros in the RBT implementation. 2147 [GL !6158] 2148 2149 5869. [func] Enable use of IP(V6)_RECVERR on Linux that allows 2150 the kernel to report destination host/network 2151 unreachable errors to the userspace application. 2152 [GL #4251] 2153 2154 5868. [cleanup] Use Daniel Lemire's "nearly divisionless" algorithm 2155 for unbiased bounded random numbers, and move 2156 re-seeding out of the hot path. [GL !6161] 2157 2158 5867. [bug] Fix assertion failure triggered by attaching to dns_adb 2159 in dns_adb_createfind() that has been triggered to shut 2160 down in different thread between the check for shutting 2161 down condition and the attach to dns_adb. [GL #3298] 2162 2163 5866. [bug] Work around a jemalloc quirk which could trigger an 2164 out-of-memory condition in named over time. [GL #3287] 2165 2166 5865. [func] Make statistics channel and control channel listen 2167 on a single network manager thread. [GL !6032] 2168 2169 5864. [func] The OID embedded at the start of a PRIVATEOID public 2170 key in a KEY, DNSKEY, CDNSKEY, or RKEY RR is now 2171 checked for validity when reading from wire or from 2172 zone files, and the OID is printed when 2173 'dig +rrcomments' is used. Similarly, the name 2174 embedded at the start of a PRIVATEDNS public key 2175 is also checked for validity. [GL #3234] 2176 2177 5863. [bug] If there was a pending negative cache DS entry, 2178 validations depending upon it could fail. [GL #3279] 2179 2180 5862. [bug] dig returned a 0 exit status on UDP connection failure. 2181 [GL #3235] 2182 2183 5861. [func] Implement support for catalog zones change of ownership 2184 (coo) mechanism described in the DNS catalog zones draft 2185 version 5 document. [GL #3223] 2186 2187 5860. [func] Implement support for catalog zones options new syntax 2188 based on catalog zones custom properties with "ext" 2189 suffix described in the DNS catalog zones draft version 2190 5 document. [GL #3222] 2191 2192 5859. [bug] Fix an assertion failure when using dig with +nssearch 2193 and +tcp options by starting the next query in the 2194 send_done() callback (like in the UDP mode) instead 2195 of doing that recursively in start_tcp(). Also 2196 ensure that queries interrupted while connecting 2197 are detached properly. [GL #3144] 2198 2199 5858. [bug] Don't remove CDS/CDNSKEY DELETE records on zone sign 2200 when using 'auto-dnssec maintain;'. [GL #2931] 2201 2202 5857. [bug] Fixed a possible crash during shutdown due to ADB 2203 entries being unlinked from the hash table too 2204 soon. [GL #3256] 2205 2206 .. code-block:: none 2207 2208 --- 9.19.0 released --- 2209 2210 5856. [bug] The "starting maxtime timer" message related to outgoing 2211 zone transfers was incorrectly logged at the ERROR level 2212 instead of DEBUG(1). [GL #3208] 2213 2214 5855. [bug] Ensure that zone maintenance queries have a retry limit. 2215 [GL #3242] 2216 2217 5854. [func] Implement reference counting for TLS contexts and 2218 allow reloading of TLS certificates on reconfiguration 2219 without destroying the underlying TCP listener sockets 2220 for TLS-based DNS transports. [GL #3122] 2221 2222 5853. [bug] When using both the `+qr` and `+y` options `dig` could 2223 crash if the connection to the first server was not 2224 successful. [GL #3244] 2225 2226 5852. [func] Add new "reuseport" option to enable/disable load 2227 balancing of sockets. [GL #3249] 2228 2229 5851. [placeholder] 2230 2231 5850. [func] Run the RPZ update process on the offload threads. 2232 [GL #3190] 2233 2234 5849. [cleanup] Remove use of exclusive mode in ns_interfacemgr in 2235 favor of rwlocked access to localhost and localnets 2236 members of dns_aclenv_t structure. [GL #3229] 2237 2238 5848. [bug] dig could hang in some cases involving multiple servers 2239 in a lookup, when a request fails and the next one 2240 refuses to start for some reason, for example if it was 2241 an IPv4 mapped IPv6 address. [GL #3248] 2242 2243 5847. [cleanup] Remove task privileged mode in favor of processing 2244 all events in the loadzone task in a single run 2245 by setting the quantum to UINT_MAX. [GL #3253] 2246 2247 5846. [func] In dns_zonemgr, create per-thread task, zonetask, and 2248 loadtask and pin the zones to individual threads, 2249 instead of having "many", spreading the zones among 2250 them and hoping for the best. This also removes any 2251 need to dynamically reallocate the pools with memory 2252 contexts and tasks. [GL #3226] 2253 2254 5845. [bug] Refactor the timer to keep track of posted events 2255 as to use isc_task_purgeevent() instead of using 2256 isc_task_purgerange(). The isc_task_purgeevent() 2257 has been refactored to purge a single event instead 2258 of walking through the list of posted events. 2259 [GL #3252] 2260 2261 5844. [bug] dig +nssearch was hanging until manually interrupted. 2262 [GL #3145] 2263 2264 5843. [bug] When an UPDATE targets a zone that is not configured, 2265 the requested zone name is now logged in the "not 2266 authoritative" error message, so that it is easier to 2267 track down problematic update clients. [GL #3209] 2268 2269 5842. [cleanup] Remove the task exclusive mode use in ns_clientmgr. 2270 [GL #3230] 2271 2272 5841. [bug] Refactor the address database: 2273 - Use self-resizing hash tables, eliminating the 2274 need to go into task-exclusive mode when resizing. 2275 - Simplify reference counting of ADB objects 2276 and the process for shutting down. [GL #3213] 2277 2278 5840. [cleanup] Remove multiple application context use in dns_client 2279 unit. [GL !6041] 2280 2281 5839. [func] Add support for remote TLS certificates 2282 verification, both to BIND and dig, making it possible 2283 to implement Strict and Mutual TLS authentication, 2284 as described in RFC 9103, Section 9.3. [GL #3163] 2285 2286 5838. [cleanup] When modifying a member zone in a catalog zone, and it 2287 is detected that the zone exists and was not created by 2288 the current catalog zone, distinguish the two cases when 2289 the zone was not added by a catalog zone at all, and 2290 when the zone was added by a different catalog zone, 2291 and log a warning message accordingly. [GL #3221] 2292 2293 5837. [func] Key timing options for `dnssec-keygen` and 2294 `dnssec-settime` now accept times as printed by 2295 `dnssec-settime -p`. [GL !2947] 2296 2297 5836. [bug] Quote the dns64 prefix in error messages that complain 2298 about problems with it, to avoid confusion with the 2299 following dns64 ACLs. [GL #3210] 2300 2301 5835. [cleanup] Remove extrahandlesize from the netmgr, the callers 2302 now have to allocate the object before calling 2303 isc_nm_setdata() and deallocate the memory in the close 2304 callback passed to isc_nm_setdata(). [GL #3227] 2305 2306 5834. [cleanup] C99 variable-length arrays are difficult to use safely, 2307 so avoid them except in test code. [GL #3201] 2308 2309 5833. [bug] When encountering socket error while trying to initiate 2310 a TCP connection to a server, dig could hang 2311 indefinitely, when there were more servers to try. 2312 [GL #3205] 2313 2314 5832. [bug] When timing-out or having other types of socket errors 2315 during a query, dig wasn't trying to perform the lookup 2316 using other servers, in case they exist. [GL #3128] 2317 2318 5831. [bug] When resending a UDP request in the result of a timeout, 2319 the recv_done() function in dighost.c was prepending 2320 the new query into the loookup's queries list instead 2321 of inserting, which could cause an assertion failure 2322 when the resent query's result was SERVFAIL. [GL #3020] 2323 2324 5830. [func] Implement incremental resizing of isc_ht hash tables to 2325 perform the rehashing gradually. The catalog zone 2326 implementation has been optimized to work with hundreds 2327 of thousands of member zones. [GL #3212] [GL #3744] 2328 2329 5829. [func] Refactor and simplify isc_timer API in preparation 2330 for further refactoring on top of network manager 2331 loops. [GL #3202] 2332 2333 5828. [bug] Replace single TCP write timer with per-TCP write 2334 timers. [GL #3200] 2335 2336 5827. [cleanup] The command-line utilities printed their version numbers 2337 inconsistently; they all now print to stdout. (They are 2338 still inconsistent abotut whether you use `-v` or `-V` 2339 to request the version). [GL #3189] 2340 2341 5826. [cleanup] Stop dig from complaining about lack of IDN support when 2342 the user asks for no IDN translation. [GL #3188] 2343 2344 5825. [func] Set the minimum MTU on UDPv6 and TCPv6 sockets and 2345 limit TCP maximum segment size (TCP_MAXSEG) to (1220) 2346 for both TCPv4 and TCPv6 sockets. [GL #2201] 2347 2348 5824. [bug] Invalid dnssec-policy definitions were being accepted 2349 where the defined keys did not cover both KSK and ZSK 2350 roles for a given algorithm. This is now checked for 2351 and the dnssec-policy is rejected if both roles are 2352 not present for all algorithms in use. [GL #3142] 2353 2354 5823. [func] Replace hazard pointers based lock-free list with 2355 locked-list based queue that's simpler and has no or 2356 little performance impact. [GL #3180] 2357 2358 5822. [bug] When calling dns_dispatch_send(), attach/detach 2359 dns_request_t object as the read callback could 2360 be called before send callback dereferencing 2361 dns_request_t object too early. [GL #3105] 2362 2363 5821. [bug] Fix query context management issues in the TCP part 2364 of dig. [GL #3184] 2365 2366 5820. [security] An assertion could occur in resume_dslookup() if the 2367 fetch had been shut down earlier. (CVE-2022-0667) 2368 [GL #3129] 2369 2370 5819. [security] Lookups involving a DNAME could trigger an INSIST when 2371 "synth-from-dnssec" was enabled. (CVE-2022-0635) 2372 [GL #3158] 2373 2374 5818. [security] A synchronous call to closehandle_cb() caused 2375 isc__nm_process_sock_buffer() to be called recursively, 2376 which in turn left TCP connections hanging in the 2377 CLOSE_WAIT state blocking indefinitely when 2378 out-of-order processing was disabled. (CVE-2022-0396) 2379 [GL #3112] 2380 2381 5817. [security] The rules for acceptance of records into the cache 2382 have been tightened to prevent the possibility of 2383 poisoning if forwarders send records outside 2384 the configured bailiwick. (CVE-2021-25220) [GL #2950] 2385 2386 5816. [bug] Make BIND compile with LibreSSL 3.5.0, as it was using 2387 not very accurate pre-processor checks for using shims. 2388 [GL #3172] 2389 2390 5815. [bug] If an oversized key name of a specific length was used 2391 in the text form of an HTTP or SVBC record, an INSIST 2392 could be triggered when parsing it. [GL #3175] 2393 2394 5814. [bug] The RecursClients statistics counter could underflow 2395 in certain resolution scenarios. [GL #3147] 2396 2397 5813. [func] The "keep-response-order" ACL has been declared 2398 obsolete, and is now non-operational. [GL #3140] 2399 2400 5812. [func] Drop the artificial limit on the number of queries 2401 processed in a single TCP read callback. [GL #3141] 2402 2403 5811. [bug] Reimplement the maximum and idle timeouts for outgoing 2404 zone tranfers. [GL #1897] 2405 2406 5810. [func] New option '-J' for dnssec-signzone and dnssec-verify 2407 allows loading journal files. [GL #2486] 2408 2409 5809. [bug] Reset client TCP connection when data received cannot 2410 be parsed as a valid DNS request. [GL #3149] 2411 2412 5808. [bug] Certain TCP failures were not caught and handled 2413 correctly by the dispatch manager, causing 2414 connections to time out rather than returning 2415 SERVFAIL. [GL #3133] 2416 2417 5807. [bug] Add a TCP "write" timer, and time out writing 2418 connections after the "tcp-idle-timeout" period 2419 has elapsed. [GL #3132] 2420 2421 5806. [bug] An error in checking the "blackhole" ACL could cause 2422 DNS requests sent by named to fail if the 2423 destination address or prefix was specifically 2424 excluded from the ACL. [GL #3157] 2425 2426 5805. [func] The result of each resolver priming attempt is now 2427 included in the "resolver priming query complete" log 2428 message. [GL #3139] 2429 2430 5804. [func] Add a debug log message when starting and ending 2431 the task exclusive mode. [GL #3137] 2432 2433 5803. [func] Use compile-time paths in the documentation. 2434 [GL #2717] 2435 2436 5802. [test] Add system test to test engine_pkcs11. [GL !5727] 2437 2438 5801. [bug] Log "quota reached" message when hard quota 2439 is reached when accepting a connection. [GL #3125] 2440 2441 5800. [func] Add ECS support to the DLZ interface. [GL #3082] 2442 2443 5799. [bug] Use L1 cache-line size detected at runtime. [GL #3108] 2444 2445 5798. [test] Add system test to test dnssec-keyfromlabel. [GL #3092] 2446 2447 5797. [bug] A failed view configuration during a named 2448 reconfiguration procedure could cause inconsistencies 2449 in BIND internal structures, causing a crash or other 2450 unexpected errors. [GL #3060] 2451 2452 5796. [bug] Ignore the invalid (<= 0) values returned 2453 by the sysconf() check for the L1 cache line 2454 size. [GL #3108] 2455 2456 5795. [bug] rndc could crash when interrupted by a signal 2457 before receiving a response. [GL #3080] 2458 2459 5794. [func] Set the IPV6_V6ONLY on all IPv6 sockets to 2460 restrict the IPv6 sockets to sending and 2461 receiving IPv6 packets only. [GL #3093] 2462 2463 5793. [bug] Correctly detect and enable UDP recvmmsg support 2464 in all versions of libuv that support it. [GL #3095] 2465 2466 5792. [bug] Don't schedule zone events on ISC_R_SHUTTINGDOWN 2467 event failures. [GL #3084] 2468 2469 5791. [func] Remove workaround for servers returning FORMERR 2470 when receiving NOTIFY query with SOA record in 2471 ANSWER section. [GL #3086] 2472 2473 5790. [bug] The control channel was incorrectly looking for 2474 ISC_R_CANCELED as a signal that the named is 2475 shutting down. In the dispatch refactoring, 2476 the result code returned from network manager 2477 is now ISC_R_SHUTTINGDOWN. Change the control 2478 channel code to use ISC_R_SHUTTINGDOWN result 2479 code to detect named being shut down. [GL #3079] 2480 2481 .. code-block:: none 2482 2483 --- 9.17.22 released --- 2484 2485 5789. [bug] Allow replacing expired zone signatures with 2486 signatures created by the KSK. [GL #3049] 2487 2488 5788. [bug] An assertion could occur if a catalog zone event was 2489 scheduled while the task manager was being shut 2490 down. [GL #3074] 2491 2492 5787. [doc] Update 'auto-dnssec' documentation, it may only be 2493 activated at zone level. [GL #3023] 2494 2495 5786. [bug] Defer detaching from zone->raw in zone_shutdown() if 2496 the zone is in the process of being dumped to disk, to 2497 ensure that the unsigned serial number information is 2498 always written in the raw-format header of the signed 2499 version on an inline-signed zone. [GL #3071] 2500 2501 5785. [bug] named could leak memory when two dnssec-policy clauses 2502 had the same name. named failed to log this error. 2503 [GL #3085] 2504 2505 5784. [func] Implement TLS-contexts reuse. Reusing the 2506 previously created TLS context objects can reduce 2507 initialisation time for some configurations and enables 2508 TLS session resumption for incoming zone transfers over 2509 TLS (XoT). [GL #3067] 2510 2511 5783. [func] named is now able to log TLS pre-master secrets for 2512 debugging purposes. This requires setting the 2513 SSLKEYLOGFILE environment variable appropriately. 2514 [GL #2723] 2515 2516 5782. [func] Use ECDSA P-256 instead of a 4096-bit RSA when 2517 generating ephemeral key and certificate for the 2518 'tls ephemeral' configuration. [GL #2264] 2519 2520 5781. [bug] Make BIND work with OpenSSL 3.0.1 as it is now 2521 enforcing minimum buffer lengths in EVP_MAC_final and 2522 hence EVP_DigestSignFinal. rndc and TSIG at a minimum 2523 were broken by this change. [GL #3057] 2524 2525 5780. [bug] The Linux kernel may send netlink messages 2526 indicating that network interfaces have changed 2527 when they have not. This caused frequent unnecessary 2528 re-scans of the interfaces. Netlink messages now 2529 only trigger re-scanning if a new address is seen 2530 or an existing address is removed. [GL #3055] 2531 2532 5779. [test] Drop cppcheck suppressions and workarounds. [GL #2886] 2533 2534 5778. [bug] Destroyed TLS contexts could have been used after a 2535 reconfiguration, making BIND unable to serve queries 2536 over TLS and HTTPS. [GL #3053] 2537 2538 5777. [bug] TCP connections could hang after receiving 2539 non-matching responses. [GL #3042] 2540 2541 5776. [bug] Add a missing isc_condition_destroy() for nmsocket 2542 condition variable and add missing isc_mutex_destroy() 2543 for nmworker lock. [GL #3051] 2544 2545 .. code-block:: none 2546 2547 --- 9.17.21 released --- 2548 2549 5775. [bug] Added a timer in the resolver to kill fetches that 2550 have deadlocked as a result of dependency loops 2551 with the ADB or the validator. This condition is 2552 now logged with the message "shut down hung fetch 2553 while resolving '<name>/<type>'". [GL #3040] 2554 2555 5774. [func] Restore NSEC Aggressive Cache ("synth-from-dnssec") 2556 as active by default. It is limited to NSEC only 2557 and by default ignores NSEC records with next name 2558 in form \000.domain. [GL #1265] 2559 2560 5773. [func] Change the message when accepting TCP connection has 2561 failed to say "Accepting TCP connection failed" and 2562 change the log level for ISC_R_NOTCONNECTED, ISC_R_QUOTA 2563 and ISC_R_SOFTQUOTA results codes from ERROR to INFO. 2564 [GL #2700] 2565 2566 5772. [bug] The resolver could hang on shutdown due to dispatch 2567 resources not being cleaned up when a TCP connection 2568 was reset. [GL #3026] 2569 2570 5771. [bug] Use idn2 UseSTD3ASCIIRules=false to disable additional 2571 unicode validity checks because enabling the additional 2572 checks would break valid domain names that contains 2573 non-alphanumerical characters such as underscore 2574 character (_) or wildcard (*). This reverts change 2575 [GL !5738] from the previous release. [GL #1610] 2576 2577 5770. [func] BIND could abort on startup on systems using old 2578 OpenSSL versions when 'protocols' option is used inside 2579 a 'tls' statement. [GL !5602] 2580 2581 5769. [func] Added support for client-side 'tls' parameters when 2582 doing incoming zone transfers via XoT. [GL !5602] 2583 2584 5768. [bug] dnssec-dsfromkey failed to omit revoked keys. [GL #853] 2585 2586 5767. [func] Extend allow-transfer option with 'port' and 2587 'transport' options to restrict zone transfers to 2588 a specific port and DNS transport protocol. 2589 [GL #2776] 2590 2591 5766. [func] Unused 'tls' clause options 'ca-file' and 'hostname' 2592 were disabled. [GL !5600] 2593 2594 5765. [bug] Fix a bug in DoH implementation making 'dig' 2595 abort when ALPN negotiation fails. [GL #3022] 2596 2597 5764. [bug] dns_sdlz_putrr failed to process some valid resource 2598 records. [GL #3021] 2599 2600 5763. [bug] Fix a bug in DoT code leading to an abort when 2601 a zone transfer ends with an unexpected DNS message. 2602 [GL #3004] 2603 2604 5762. [bug] Fix a "named" crash related to removing and restoring a 2605 `catalog-zone` entry in the configuration file and 2606 running `rndc reconfig`. [GL #1608] 2607 2608 5761. [bug] OpenSSL 3.0.0 support could fail to correctly read 2609 ECDSA private keys leading to incorrect signatures 2610 being generated. [GL #3014] 2611 2612 5760. [bug] Prevent a possible use-after-free error in resolver. 2613 [GL #3018] 2614 2615 5759. [func] Set Extended DNS Error Code 18 - Prohibited if query 2616 access is denied to the specific client. [GL #1836] 2617 2618 5758. [bug] mdig now honors the operating system's preferred 2619 ephemeral port range. [GL #2374] 2620 2621 5757. [test] Replace sed in nsupdate system test with awk to 2622 construct the nsupdate command. The sed expression 2623 was not reliably changing the ttl. [GL #3003] 2624 2625 5756. [func] Assign HTTP freshness lifetime to responses sent 2626 via DNS-over-HTTPS, according to the recommendations 2627 given in RFC 8484. [GL #2854] 2628 2629 .. code-block:: none 2630 2631 --- 9.17.20 released --- 2632 2633 5755. [bug] The statistics channel wasn't correctly handling 2634 multiple HTTP requests, or pipelined or truncated 2635 requests. [GL #2973] 2636 2637 5754. [bug] "tls" statements may omit "key-file" and "cert-file", 2638 but if either one is specified, then both must be. 2639 [GL #2986] 2640 2641 5753. [placeholder] 2642 2643 5752. [bug] Fix an assertion failure caused by missing member zones 2644 during a reload of a catalog zone. [GL #2308] 2645 2646 5751. [port] Add support for OpenSSL 3.0.0. OpenSSL 3.0.0 2647 deprecated 'engine' support. If OpenSSL 3.0.0 has 2648 been built without support for deprecated functionality 2649 pkcs11 via engine_pkcs11 is no longer available. 2650 [GL #2843] 2651 2652 5750. [bug] Fix a bug when comparing two RSA keys. There was a typo 2653 which caused the "p" prime factors to not being 2654 compared. [GL #2972] 2655 2656 5749. [bug] Handle duplicate references to the same catalog 2657 zone gracefully. [GL #2916] 2658 2659 5748. [func] Update "nsec3param" defaults to iterations 0, salt 2660 length 0. [GL #2956] 2661 2662 5747. [func] Update rndc serve-stale status output to be less 2663 confusing. [GL #2742] 2664 2665 5746. [bug] A lame server delegation could lead to a loop in which 2666 a resolver fetch depends on an ADB find which depends 2667 on the same resolver fetch. Previously, this would 2668 cause the fetch to hang until timing out, but after 2669 change #5730 it would hang forever. The condition is 2670 now detected and avoided. [GL #2927] 2671 2672 5745. [bug] Fetch context objects now use attach/detach 2673 semantics to make it easier to find and debug 2674 reference-counting errors, and several such errors 2675 have been fixed. [GL #2953] 2676 2677 5744. [func] The network manager is now used for netlink sockets 2678 to monitor network interface changes. This was the 2679 last remaining use of the old isc_socket and 2680 isc_socketmgr APIs, so they have now been removed. 2681 The "named -S" argument and the "reserved-sockets" 2682 option in named.conf have no function now, and are 2683 deprecated. "socketmgr" statistics are no longer 2684 reported in the statistics channel. [GL #2926] 2685 2686 5743. [func] Add finer-grained "update-policy" rules, 2687 "krb5-subdomain-self-rhs" and "ms-subdomain-self-rhs", 2688 which restrict SRV and PTR record changes, allowing 2689 only records whose content matches the machine name 2690 embedded in the Kerberos principal making the change. 2691 [GL #481] 2692 2693 5742. [func] ISC_LIKELY() and ISC_UNLIKELY() macros have been 2694 removed. [GL #2952] 2695 2696 5741. [bug] Log files with "timestamp" suffixes could be left in 2697 place after rolling, even if the number of preserved 2698 log files exceeded the configured "versions" limit. 2699 [GL #828] 2700 2701 5740. [func] Implement incremental resizing of RBT hash table to 2702 perform the rehashing gradually. [GL #2941] 2703 2704 5739. [func] Change default of 'dnssec-dnskey-kskonly' to 'yes'. 2705 [GL #1316] 2706 2707 5738. [bug] Enable idn2 UseSTD3ASCIIRules=true to implement 2708 additional unicode validity checks. [GL #1610] 2709 2710 5737. [bug] Address Coverity warning in lib/dns/dnssec.c. 2711 [GL #2935] 2712 2713 .. code-block:: none 2714 2715 --- 9.17.19 released --- 2716 2717 5736. [security] The "lame-ttl" option is now forcibly set to 0. This 2718 effectively disables the lame server cache, as it could 2719 previously be abused by an attacker to significantly 2720 degrade resolver performance. (CVE-2021-25219) 2721 [GL #2899] 2722 2723 5735. [cleanup] The result codes which BIND 9 uses internally are now 2724 all defined as a single list of enum values rather than 2725 as multiple sets of integers scattered around shared 2726 libraries. This prevents the need for locking in some 2727 functions operating on result codes, and makes result 2728 codes more debugger-friendly. [GL #719] 2729 2730 5734. [bug] Fix intermittent assertion failures in dig which were 2731 triggered during zone transfers. [GL #2884] 2732 2733 5733. [func] Require the "dot" Application-Layer Protocol Negotiation 2734 (ALPN) token to be selected in the TLS handshake for 2735 zone transfers over TLS (XoT), as required by RFC 9103 2736 section 7.1. [GL #2794] 2737 2738 5732. [cleanup] Remove the dns_lib_init(), dns_lib_shutdown(), 2739 ns_lib_init(), and ns_lib_shutdown() functions, as they 2740 no longer served any useful purpose. [GL #88] 2741 2742 5731. [bug] Disallow defining "http" configuration clauses called 2743 "default" as they were silently ignored. [GL #2925] 2744 2745 5730. [func] The resolver and the request and dispatch managers have 2746 been substantially refactored, and are now based on the 2747 network manager instead of the old isc_socket API. All 2748 outgoing DNS queries and requests now use the new API; 2749 isc_socket is only used to monitor for network interface 2750 changes. [GL #2401] 2751 2752 5729. [func] Allow finer control over TLS protocol configuration by 2753 implementing new options for "tls" configuration clauses 2754 ("dhparam-file", "ciphers", "prefer-server-ciphers", 2755 "session-tickets"). These options make achieving perfect 2756 forward secrecy (PFS) possible for DNS-over-TLS (DoT) 2757 and DNS-over-HTTPS (DoH). [GL #2796] 2758 2759 5728. [func] Allow specifying supported TLS protocol versions for 2760 each "tls" configuration clause. [GL #2795] 2761 2762 5727. [placeholder] 2763 2764 5726. [bug] Fix a use-after-free bug which was triggered while 2765 checking for duplicate "http" configuration clauses. 2766 [GL #2924] 2767 2768 5725. [bug] Fix an assertion failure triggered by passing an invalid 2769 HTTP path to dig. [GL #2923] 2770 2771 5724. [bug] Address a potential deadlock when checking zone content 2772 consistency. [GL #2908] 2773 2774 5723. [bug] Change 5709 broke backward compatibility for the 2775 "check-names master ..." and "check-names slave ..." 2776 options. This has been fixed. [GL #2911] 2777 2778 5722. [bug] Preserve the contents of the receive buffer for TCPDNS 2779 and TLSDNS when growing its size. [GL #2917] 2780 2781 5721. [func] A new realloc()-like function, isc_mem_reget(), was 2782 added to the libisc API for resizing memory chunks 2783 allocated using isc_mem_get(). Memory (re)allocation 2784 functions are now guaranteed to return non-NULL pointers 2785 for zero-sized allocation requests. [GL !5440] 2786 2787 5720. [contrib] Remove old-style DLZ drivers that had to be enabled at 2788 build time. [GL #2814] 2789 2790 5719. [func] Remove support for the "map" zone file format. 2791 [GL #2882] 2792 2793 5718. [bug] The "sig-signing-type" zone configuration option was 2794 processed incorrectly, causing valid configurations to 2795 be rejected. This has been fixed. [GL #2906] 2796 2797 5717. [func] The "cache-file" option, which was documented as "for 2798 testing purposes only" and not to be used, has been 2799 removed. [GL #2903] 2800 2801 5716. [placeholder] 2802 2803 5715. [func] Add a check for ports specified in "*-source(-v6)" 2804 options clashing with a global listening port. Such a 2805 configuration was already unsupported, but it failed 2806 silently; it is now treated as an error. [GL #2888] 2807 2808 5714. [bug] Remove the "adjust interface" mechanism which was 2809 responsible for setting up listeners on interfaces when 2810 the "*-source(-v6)" address and port were the same as 2811 the "listen-on(-v6)" address and port. Such a 2812 configuration is no longer supported; under certain 2813 timing conditions, that mechanism could prevent named 2814 from listening on some TCP ports. This has been fixed. 2815 [GL #2852] 2816 2817 5713. [func] Add "primaries" as a synonym for "masters" and 2818 "default-primaries" as a synonym for "default-masters" 2819 in catalog zone configuration options. [GL #2818] 2820 2821 5712. [func] Remove native PKCS#11 support in favor of engine_pkcs11 2822 from the OpenSC project. [GL #2691] 2823 2824 .. code-block:: none 2825 2826 --- 9.17.18 released --- 2827 2828 5711. [bug] "map" files exceeding 2GB in size failed to load due to 2829 a size comparison that incorrectly treated the file size 2830 as a signed integer. [GL #2878] 2831 2832 5710. [placeholder] 2833 2834 5709. [func] When reporting zone types in the statistics channel, the 2835 terms "primary" and "secondary" are now used instead of 2836 "master" and "slave", respectively. Enum values 2837 throughout the code have been updated to use this 2838 terminology as well. [GL #1944] 2839 2840 5708. [placeholder] 2841 2842 5707. [bug] A bug was fixed which prevented dig from querying 2843 DNS-over-HTTPS (DoH) servers via IPv6. [GL #2860] 2844 2845 5706. [cleanup] Support for external applications to register with 2846 libisc and use it has been removed. Export versions of 2847 BIND 9 libraries have not been supported for some time, 2848 but the isc_lib_register() function was still available; 2849 it has now been removed. [GL !2420] 2850 2851 5705. [bug] Change #5686 altered the internal memory structure of 2852 zone databases, but neglected to update the MAPAPI value 2853 for zone files in "map" format. This caused named to 2854 attempt to load incompatible map files, triggering an 2855 assertion failure on startup. The MAPAPI value has now 2856 been updated, so named rejects outdated files when 2857 encountering them. [GL #2872] 2858 2859 5704. [bug] Change #5317 caused the EDNS TCP Keepalive option to be 2860 ignored inadvertently in client requests. It has now 2861 been fixed and this option is handled properly again. 2862 [GL #1927] 2863 2864 5703. [bug] Fix a crash in dig caused by closing an HTTP/2 socket 2865 associated with an unused HTTP/2 session. [GL #2858] 2866 2867 5702. [bug] Improve compatibility with DNS-over-HTTPS (DoH) clients 2868 by allowing HTTP/2 request headers in any order. 2869 [GL #2875] 2870 2871 5701. [bug] named-checkconf failed to detect syntactically invalid 2872 values of the "key" and "tls" parameters used to define 2873 members of remote server lists. [GL #2461] 2874 2875 5700. [bug] When a member zone was removed from a catalog zone, 2876 journal files for the former were not deleted. 2877 [GL #2842] 2878 2879 5699. [func] Data structures holding DNSSEC signing statistics are 2880 now grown and shrunk as necessary upon key rollover 2881 events. [GL #1721] 2882 2883 5698. [bug] When a DNSSEC-signed zone which only has a single 2884 signing key available is migrated to use KASP, that key 2885 is now treated as a Combined Signing Key (CSK). 2886 [GL #2857] 2887 2888 5697. [func] dnssec-cds now only generates SHA-2 DS records by 2889 default and avoids copying deprecated SHA-1 records from 2890 a child zone to its delegation in the parent. If the 2891 child zone does not publish SHA-2 CDS records, 2892 dnssec-cds will generate them from the CDNSKEY records. 2893 The "-a algorithm" option now affects the process of 2894 generating DS digest records from both CDS and CDNSKEY 2895 records. Thanks to Tony Finch. [GL #2871] 2896 2897 5696. [protocol] Support for HTTPS and SVCB record types has been added. 2898 [GL #1132] 2899 2900 5695. [func] Add a new dig command-line option, "+showbadcookie", 2901 which causes a BADCOOKIE response message to be 2902 displayed when it is received from the server. 2903 [GL #2319] 2904 2905 5694. [bug] Stale data in the cache could cause named to send 2906 non-minimized queries despite QNAME minimization being 2907 enabled. [GL #2665] 2908 2909 5693. [func] Restore support for reading "timeout" and "attempts" 2910 options from /etc/resolv.conf, and use their values in 2911 dig, host, and nslookup. (This was previously supported 2912 by liblwres, and was still mentioned in the man pages, 2913 but had stopped working after liblwres was deprecated in 2914 favor of libirs.) [GL #2785] 2915 2916 5692. [bug] Fix a rare crash in DNS-over-HTTPS (DoH) code caused by 2917 detaching from an HTTP/2 session handle too early when 2918 sending data. [GL #2851] 2919 2920 5691. [bug] When a dynamic zone was made available in another view 2921 using the "in-view" statement, running "rndc freeze" 2922 always reported an "already frozen" error even though 2923 the zone was successfully frozen. [GL #2844] 2924 2925 5690. [func] dnssec-signzone now honors Predecessor and Successor 2926 metadata found in private key files: if a signature for 2927 an RRset generated by the inactive predecessor exists 2928 and does not need to be replaced, no additional 2929 signature is now created for that RRset using the 2930 successor key. This enables dnssec-signzone to gradually 2931 replace RRSIGs during a ZSK rollover. [GL #1551] 2932 2933 .. code-block:: none 2934 2935 --- 9.17.17 released --- 2936 2937 5689. [security] An assertion failure occurred when named attempted to 2938 send a UDP packet that exceeded the MTU size, if 2939 Response Rate Limiting (RRL) was enabled. 2940 (CVE-2021-25218) [GL #2856] 2941 2942 5688. [bug] Zones using KASP and inline-signed zones failed to apply 2943 changes from the unsigned zone to the signed zone under 2944 certain circumstances. This has been fixed. [GL #2735] 2945 2946 5687. [bug] "rndc reload <zonename>" could trigger a redundant 2947 reload for an inline-signed zone whose zone file was not 2948 modified since the last "rndc reload". This has been 2949 fixed. [GL #2855] 2950 2951 5686. [func] The number of internal data structures allocated for 2952 each zone was reduced. [GL #2829] 2953 2954 5685. [bug] named failed to check the opcode of responses when 2955 performing zone refreshes, stub zone updates, and UPDATE 2956 forwarding. This has been fixed. [GL #2762] 2957 2958 5684. [func] The DNS-over-HTTP (DoH) configuration syntax was 2959 extended: 2960 - The maximum number of active DoH connections can now 2961 be set using the "http-listener-clients" option. The 2962 default is 300. 2963 - The maximum number of concurrent HTTP/2 streams per 2964 connection can now be set using the 2965 "http-streams-per-connection" option. The default is 2966 100. 2967 - Both of these values can also be set on a per-listener 2968 basis using the "listener-clients" and 2969 "streams-per-connection" parameters in an "http" 2970 statement. 2971 [GL #2809] 2972 2973 5683. [bug] The configuration-checking code now verifies HTTP paths. 2974 [GL !5231] 2975 2976 5682. [bug] Some changes to "zone-statistics" settings were not 2977 properly processed by "rndc reconfig". This has been 2978 fixed. [GL #2820] 2979 2980 5681. [func] Relax the checks in the dns_zone_cdscheck() function to 2981 allow CDS and CDNSKEY records in the zone that do not 2982 match an existing DNSKEY record, as long as the 2983 algorithm matches. This allows a clean rollover from one 2984 provider to another in a multi-signer DNSSEC 2985 configuration. [GL #2710] 2986 2987 5680. [bug] HTTP GET requests without query strings caused a crash 2988 in DoH code. This has been fixed. [GL !5268] 2989 2990 5679. [func] Thread affinity is no longer set. [GL #2822] 2991 2992 5678. [bug] The "check DS" code failed to release all resources upon 2993 named shutdown when a refresh was in progress. This has 2994 been fixed. [GL #2811] 2995 2996 5677. [func] Previously, named accepted FORMERR responses both with 2997 and without an OPT record, as an indication that a given 2998 server did not support EDNS. To implement full 2999 compliance with RFC 6891, only FORMERR responses without 3000 an OPT record are now accepted. This intentionally 3001 breaks communication with servers that do not support 3002 EDNS and that incorrectly echo back the query message 3003 with the RCODE field set to FORMERR and the QR bit set 3004 to 1. [GL #2249] 3005 3006 5676. [func] Memory allocation has been substantially refactored; it 3007 is now based on the memory allocation API provided by 3008 the jemalloc library, which is a new optional build 3009 dependency for BIND 9. [GL #2433] 3010 3011 5675. [bug] Compatibility with DoH clients has been improved by 3012 ignoring the value of the "Accept" HTTP header. 3013 [GL !5246] 3014 3015 5674. [bug] A shutdown hang was triggered by DoH clients prematurely 3016 aborting HTTP/2 streams. This has been fixed. [GL !5245] 3017 3018 5673. [func] Add a new build-time option, --disable-doh, to allow 3019 building BIND 9 without the libnghttp2 library. 3020 [GL #2478] 3021 3022 5672. [bug] Authentication of rndc messages could fail if a 3023 "controls" statement was configured with multiple key 3024 algorithms for the same listener. This has been fixed. 3025 [GL #2756] 3026 3027 .. code-block:: none 3028 3029 --- 9.17.16 released --- 3030 3031 5671. [bug] A race condition could occur where two threads were 3032 competing for the same set of key file locks, leading to 3033 a deadlock. This has been fixed. [GL #2786] 3034 3035 5670. [bug] create_keydata() created an invalid placeholder keydata 3036 record upon a refresh failure, which prevented the 3037 database of managed keys from subsequently being read 3038 back. This has been fixed. [GL #2686] 3039 3040 5669. [func] KASP support was extended with the "check DS" feature. 3041 Zones with "dnssec-policy" and "parental-agents" 3042 configured now check for DS presence and can perform 3043 automatic KSK rollovers. [GL #1126] 3044 3045 5668. [bug] Rescheduling a setnsec3param() task when a zone failed 3046 to load on startup caused a hang on shutdown. This has 3047 been fixed. [GL #2791] 3048 3049 5667. [bug] The configuration-checking code failed to account for 3050 the inheritance rules of the "dnssec-policy" option. 3051 This has been fixed. [GL #2780] 3052 3053 5666. [doc] The safe "edns-udp-size" value was tweaked to match the 3054 probing value from BIND 9.16 for better compatibility. 3055 [GL #2183] 3056 3057 5665. [bug] If nsupdate sends an SOA request and receives a REFUSED 3058 response, it now fails over to the next available 3059 server. [GL #2758] 3060 3061 5664. [func] For UDP messages larger than the path MTU, named now 3062 sends an empty response with the TC (TrunCated) bit set. 3063 In addition, setting the DF (Don't Fragment) flag on 3064 outgoing UDP sockets was re-enabled. [GL #2790] 3065 3066 5663. [bug] Non-zero OPCODEs are now properly handled when receiving 3067 queries over DNS-over-TLS (DoT) and DNS-over-HTTPS (DoH) 3068 channels. [GL #2787] 3069 3070 5662. [bug] Views with recursion disabled are now configured with a 3071 default cache size of 2 MB unless "max-cache-size" is 3072 explicitly set. This prevents cache RBT hash tables from 3073 being needlessly preallocated for such views. [GL #2777] 3074 3075 5661. [bug] Change 5644 inadvertently introduced a deadlock: when 3076 locking the key file mutex for each zone structure in a 3077 different view, the "in-view" logic was not considered. 3078 This has been fixed. [GL #2783] 3079 3080 5660. [bug] The configuration-checking code failed to account for 3081 the inheritance rules of the "key-directory" option. 3082 [GL #2778] 3083 3084 This change was included in BIND 9.17.15. 3085 3086 5659. [bug] When preparing DNS responses, named could replace the 3087 letters 'W' (uppercase) and 'w' (lowercase) with '\000'. 3088 This has been fixed. [GL #2779] 3089 3090 This change was included in BIND 9.17.15. 3091 3092 5658. [bug] Increasing "max-cache-size" for a running named instance 3093 (using "rndc reconfig") did not cause the hash tables 3094 used by cache databases to be grown accordingly. This 3095 has been fixed. [GL #2770] 3096 3097 5657. [cleanup] Support was removed for both built-in atomics in old 3098 versions of Clang (< 3.6.0) and GCC (< 4.7.0), and 3099 atomics emulated with a mutex. [GL #2606] 3100 3101 5656. [bug] Named now ensures that large responses work correctly 3102 over DNS-over-HTTPS (DoH), and that zone transfer 3103 requests over DoH are explicitly rejected. [GL !5148] 3104 3105 5655. [bug] Signed, insecure delegation responses prepared by named 3106 either lacked the necessary NSEC records or contained 3107 duplicate NSEC records when both wildcard expansion and 3108 CNAME chaining were required to prepare the response. 3109 This has been fixed. [GL #2759] 3110 3111 5654. [port] Windows support has been removed. [GL #2690] 3112 3113 5653. [bug] A bug that caused the NSEC3 salt to be changed on every 3114 restart for zones using KASP has been fixed. [GL #2725] 3115 3116 .. code-block:: none 3117 3118 --- 9.17.14 released --- 3119 3120 5652. [bug] A copy-and-paste error in change 5584 caused the 3121 IP_DONTFRAG socket option to be enabled instead of 3122 disabled. This has been fixed. [GL #2746] 3123 3124 5651. [func] Refactor zone dumping to be processed asynchronously via 3125 the uv_work_t thread pool API. [GL #2732] 3126 3127 5650. [bug] Prevent a crash that could occur if serve-stale was 3128 enabled and a prefetch was triggered during a query 3129 restart. [GL #2733] 3130 3131 5649. [bug] If a query was answered with stale data on a server with 3132 DNS64 enabled, an assertion could occur if a non-stale 3133 answer arrived afterward. [GL #2731] 3134 3135 5648. [bug] The calculation of the estimated IXFR transaction size 3136 in dns_journal_iter_init() was invalid. [GL #2685] 3137 3138 5647. [func] The interface manager has been refactored to use fewer 3139 client manager objects, which in turn use fewer memory 3140 contexts and tasks. This should result in less 3141 fragmented memory and better startup performance. 3142 [GL #2433] 3143 3144 5646. [bug] The default TCP timeout for rndc has been increased to 3145 60 seconds. This was its original value, but it had been 3146 inadvertently lowered to 10 when rndc was updated to use 3147 the network manager. [GL #2643] 3148 3149 5645. [cleanup] Remove the rarely-used dns_name_copy() function and 3150 rename dns_name_copynf() to dns_name_copy(). [GL !5081] 3151 3152 5644. [bug] Fix a race condition in reading and writing key files 3153 for zones using KASP and configured in multiple views. 3154 [GL #1875] 3155 3156 5643. [placeholder] 3157 3158 5642. [bug] Zones which are configured in multiple views with 3159 different values set for "dnssec-policy" and with 3160 identical values set for "key-directory" are now 3161 detected and treated as a configuration error. 3162 [GL #2463] 3163 3164 5641. [bug] Address a potential memory leak in 3165 dst_key_fromnamedfile(). [GL #2689] 3166 3167 5640. [func] Add new configuration options for setting the size of 3168 receive and send buffers in the operating system: 3169 "tcp-receive-buffer", "tcp-send-buffer", 3170 "udp-receive-buffer", and "udp-send-buffer". [GL #2313] 3171 3172 5639. [bug] Check that the first and last SOA record of an AXFR are 3173 consistent. [GL #2528] 3174 3175 .. code-block:: none 3176 3177 --- 9.17.13 released --- 3178 3179 5638. [bug] Improvements related to network manager/task manager 3180 integration: 3181 - isc_managers_create() and isc_managers_destroy() 3182 functions were added to handle setup and teardown of 3183 netmgr, taskmgr, timermgr, and socketmgr, since these 3184 require a precise order of operations now. 3185 - Event queue processing is now quantized to prevent 3186 infinite looping. 3187 - The netmgr can now be paused from within a netmgr 3188 thread. 3189 - Deadlocks due to a conflict between netmgr's 3190 pause/resume and listen/stoplistening operations were 3191 fixed. 3192 [GL #2654] 3193 3194 5637. [placeholder] 3195 3196 5636. [bug] named and named-checkconf did not report an error when 3197 multiple zones with the "dnssec-policy" option set were 3198 using the same zone file. This has been fixed. 3199 [GL #2603] 3200 3201 5635. [bug] Journal compaction could fail when a journal with 3202 invalid transaction headers was not detected at startup. 3203 This has been fixed. [GL #2670] 3204 3205 5634. [bug] If "dnssec-policy" was active and a private key file was 3206 temporarily offline during a rekey event, named could 3207 incorrectly introduce replacement keys and break a 3208 signed zone. This has been fixed. [GL #2596] 3209 3210 5633. [doc] The "inline-signing" option was incorrectly described as 3211 being inherited from the "options"/"view" levels and was 3212 incorrectly accepted at those levels without effect. 3213 This has been fixed. [GL #2536] 3214 3215 5632. [func] Add a new built-in KASP, "insecure", which is used to 3216 transition a zone from a signed to an unsigned state. 3217 The existing built-in KASP "none" should no longer be 3218 used to unsign a zone. [GL #2645] 3219 3220 5631. [protocol] Update the implementation of the ZONEMD RR type to match 3221 RFC 8976. [GL #2658] 3222 3223 5630. [func] Treat DNSSEC responses containing NSEC3 records with 3224 iteration counts greater than 150 as insecure. 3225 [GL #2445] 3226 3227 5629. [func] Reduce the maximum supported number of NSEC3 iterations 3228 that can be configured for a zone to 150. [GL #2642] 3229 3230 5628. [bug] Host and nslookup could crash upon receiving a SERVFAIL 3231 response. This has been fixed. [GL #2564] 3232 3233 5627. [bug] RRSIG(SOA) RRsets placed anywhere other than at the zone 3234 apex were triggering infinite resigning loops. This has 3235 been fixed. [GL #2650] 3236 3237 5626. [bug] When generating zone signing keys, KASP now also checks 3238 for key ID conflicts among newly created keys, rather 3239 than just between new and existing ones. [GL #2628] 3240 3241 5625. [bug] A deadlock could occur when multiple "rndc addzone", 3242 "rndc delzone", and/or "rndc modzone" commands were 3243 invoked simultaneously for different zones. This has 3244 been fixed. [GL #2626] 3245 3246 5624. [func] Task manager events are now processed inside network 3247 manager loops. The task manager no longer needs its own 3248 set of worker threads, which improves resolver 3249 performance. [GL #2638] 3250 3251 5623. [bug] When named was shut down during an ongoing zone 3252 transfer, xfrin_fail() could incorrectly be called 3253 twice. This has been fixed. [GL #2630] 3254 3255 5622. [cleanup] The lib/samples/ directory has been removed, as export 3256 versions of libraries are no longer maintained. 3257 [GL !4835] 3258 3259 5621. [placeholder] 3260 3261 5620. [bug] If zone journal files written by BIND 9.16.11 or earlier 3262 were present when BIND was upgraded, the zone file for 3263 that zone could have been inadvertently rewritten with 3264 the current zone contents. This caused the original zone 3265 file structure (e.g. comments, $INCLUDE directives) to 3266 be lost, although the zone data itself was preserved. 3267 This has been fixed. [GL #2623] 3268 3269 5619. [protocol] Implement draft-vandijk-dnsop-nsec-ttl, updating the 3270 protocol such that NSEC(3) TTL values are set to the 3271 minimum of the SOA MINIMUM value or the SOA TTL. 3272 [GL #2347] 3273 3274 5618. [bug] Change 5149 introduced some inconsistencies in the way 3275 record TTLs were presented in cache dumps. These 3276 inconsistencies have been eliminated. [GL #389] 3277 [GL #2289] 3278 3279 .. code-block:: none 3280 3281 --- 9.17.12 released --- 3282 3283 5617. [placeholder] 3284 3285 5616. [security] named crashed when a DNAME record placed in the ANSWER 3286 section during DNAME chasing turned out to be the final 3287 answer to a client query. (CVE-2021-25215) [GL #2540] 3288 3289 5615. [security] Insufficient IXFR checks could result in named serving a 3290 zone without an SOA record at the apex, leading to a 3291 RUNTIME_CHECK assertion failure when the zone was 3292 subsequently refreshed. This has been fixed by adding an 3293 owner name check for all SOA records which are included 3294 in a zone transfer. (CVE-2021-25214) [GL #2467] 3295 3296 5614. [bug] Ensure all resources are properly cleaned up when a call 3297 to gss_accept_sec_context() fails. [GL #2620] 3298 3299 5613. [bug] It was possible to write an invalid transaction header 3300 in the journal file for a managed-keys database after 3301 upgrading. This has been fixed. Invalid headers in 3302 existing journal files are detected and named is able 3303 to recover from them. [GL #2600] 3304 3305 5612. [bug] Continued refactoring of the network manager: 3306 - allow recovery from read and connect timeout events, 3307 - ensure that calls to isc_nm_*connect() always 3308 return the connection status via a callback 3309 function. 3310 [GL #2401] 3311 3312 5611. [func] Set "stale-answer-client-timeout" to "off" by default. 3313 [GL #2608] 3314 3315 5610. [bug] Prevent a crash which could happen when a lookup 3316 triggered by "stale-answer-client-timeout" was attempted 3317 right after recursion for a client query finished. 3318 [GL #2594] 3319 3320 5609. [func] The ISC implementation of SPNEGO was removed from BIND 9 3321 source code. It was no longer necessary as all major 3322 contemporary Kerberos/GSSAPI libraries include support 3323 for SPNEGO. [GL #2607] 3324 3325 5608. [bug] When sending queries over TCP, dig now properly handles 3326 "+tries=1 +retry=0" by not retrying the connection when 3327 the remote server closes the connection prematurely. 3328 [GL #2490] 3329 3330 5607. [bug] As "rndc dnssec -checkds" and "rndc dnssec -rollover" 3331 commands may affect the next scheduled key event, 3332 reconfiguration of zone keys is now triggered after 3333 receiving either of these commands to prevent 3334 unnecessary key rollover delays. [GL #2488] 3335 3336 5606. [bug] CDS/CDNSKEY DELETE records are now removed when a zone 3337 transitions from a secure to an insecure state. 3338 named-checkzone also no longer reports an error when 3339 such records are found in an unsigned zone. [GL #2517] 3340 3341 5605. [bug] "dig -u" now uses the CLOCK_REALTIME clock source for 3342 more accurate time reporting. [GL #2592] 3343 3344 5604. [experimental] A "filter-a.so" plugin, which is similar to the 3345 "filter-aaaa.so" plugin but which omits A records 3346 instead of AAAA records, has been added. Thanks to 3347 GitLab user @treysis. [GL #2585] 3348 3349 5603. [placeholder] 3350 3351 5602. [bug] Fix TCPDNS and TLSDNS timers in Network Manager. This 3352 makes the "tcp-initial-timeout" and "tcp-idle-timeout" 3353 options work correctly again. [GL #2583] 3354 3355 5601. [bug] Zones using KASP could not be thawed after they were 3356 frozen using "rndc freeze". This has been fixed. 3357 [GL #2523] 3358 3359 5600. [bug] Send a full certificate chain instead of just the leaf 3360 certificate to DNS-over-TLS (DoT) and DNS-over-HTTPS 3361 (DoH) clients. This makes BIND 9 DoT/DoH servers 3362 compatible with a broader set of clients. [GL #2514] 3363 3364 5599. [bug] Fix a named crash which occurred after skipping a 3365 primary server while transferring a zone over TLS. 3366 [GL #2562] 3367 3368 5598. [port] Silence -Wchar-subscripts compiler warnings triggered on 3369 some platforms due to calling character classification 3370 functions declared in the <ctype.h> header with 3371 arguments of type char. [GL #2567] 3372 3373 .. code-block:: none 3374 3375 --- 9.17.11 released --- 3376 3377 5597. [bug] When serve-stale was enabled and starting the recursive 3378 resolution process for a query failed, a named instance 3379 could crash if it was configured as both a recursive and 3380 authoritative server. This problem was introduced by 3381 change 5573 and has now been fixed. [GL #2565] 3382 3383 5596. [func] Client-side support for DNS-over-HTTPS (DoH) has been 3384 added to dig. "dig +https" can now query a server via 3385 HTTP/2. [GL #1641] 3386 3387 5595. [cleanup] Public header files for BIND 9 libraries no longer 3388 directly include third-party library headers. This 3389 prevents the need to include paths to third-party header 3390 files in CFLAGS whenever BIND 9 public header files are 3391 used, which could cause build-time issues on hosts with 3392 older versions of BIND 9 installed. [GL #2357] 3393 3394 5594. [bug] Building with --enable-dnsrps --enable-dnsrps-dl failed. 3395 [GL #2298] 3396 3397 5593. [bug] Journal files written by older versions of named can now 3398 be read when loading zones, so that journal 3399 incompatibility does not cause problems on upgrade. 3400 Outdated journals are updated to the new format after 3401 loading. [GL #2505] 3402 3403 5592. [bug] Prevent hazard pointer table overflows on machines with 3404 many cores, by allowing the thread IDs (serving as 3405 indices into hazard pointer tables) of finished threads 3406 to be reused by those created later. [GL #2396] 3407 3408 5591. [bug] Fix a crash that occurred when 3409 "stale-answer-client-timeout" was triggered without any 3410 (stale) data available in the cache to answer the query. 3411 [GL #2503] 3412 3413 5590. [bug] NSEC3 records were not immediately created for dynamic 3414 zones using NSEC3 with "dnssec-policy", resulting in 3415 such zones going bogus. Add code to process the 3416 NSEC3PARAM queue at zone load time so that NSEC3 records 3417 for such zones are created immediately. [GL #2498] 3418 3419 5589. [placeholder] 3420 3421 5588. [func] Add a new "purge-keys" option for "dnssec-policy". This 3422 option determines the period of time for which key files 3423 are retained after they become obsolete. [GL #2408] 3424 3425 5587. [bug] A standalone libtool script no longer needs to be 3426 present in PATH to build BIND 9 from a source tarball 3427 prepared using "make dist". [GL #2504] 3428 3429 5586. [bug] An invalid direction field in a LOC record resulted in 3430 an INSIST failure when a zone file containing such a 3431 record was loaded. [GL #2499] 3432 3433 5585. [func] Memory contexts and memory pool implementations were 3434 refactored to reduce lock contention for shared memory 3435 contexts by replacing mutexes with atomic operations. 3436 The internal memory allocator was simplified so that it 3437 is only a thin wrapper around the system allocator. This 3438 change made the "-M external" named option redundant and 3439 it was therefore removed. [GL #2433] 3440 3441 5584. [bug] No longer set the IP_DONTFRAG option on UDP sockets, to 3442 prevent dropping outgoing packets exceeding 3443 "max-udp-size". [GL #2466] 3444 3445 5583. [func] Changes to DNS-over-HTTPS (DoH) configuration syntax: 3446 - When "http" is specified in "listen-on" or 3447 "listen-on-v6" statements, "tls" must also now be 3448 specified. If an unencrypted connection is desired 3449 (for example, when running behind a reverse proxy), 3450 use "tls none". 3451 - "http default" can now be specified in "listen-on" and 3452 "listen-on-v6" statements to use the default HTTP 3453 endpoint of "/dns-query". It is no longer necessary to 3454 include an "http" statement in named.conf unless 3455 overriding this value. 3456 [GL #2472] 3457 3458 5582. [bug] BIND 9 failed to build when static OpenSSL libraries 3459 were used and the pkg-config files for libssl and/or 3460 libcrypto were unavailable. This has been fixed by 3461 ensuring that the correct linking order for libssl and 3462 libcrypto is always used. [GL #2402] 3463 3464 5581. [bug] Fix a memory leak that occurred when inline-signed zones 3465 were added to the configuration, followed by a 3466 reconfiguration of named. [GL #2041] 3467 3468 5580. [test] The system test framework no longer differentiates 3469 between SKIPPED and UNTESTED system test results. Any 3470 system test which is not run is now marked as SKIPPED. 3471 [GL !4517] 3472 3473 5579. [bug] If an invalid key name (e.g. "a..b") was specified in a 3474 primaries list in named.conf, the wrong size was passed 3475 to isc_mem_put(), resulting in the returned memory being 3476 put on the wrong free list. This prevented named from 3477 starting up. [GL #2460] 3478 3479 .. code-block:: none 3480 3481 --- 9.17.10 released --- 3482 3483 5578. [protocol] Make "check-names" accept A records below "_spf", 3484 "_spf_rate", and "_spf_verify" labels in order to cater 3485 for the "exists" SPF mechanism specified in RFC 7208 3486 section 5.7 and appendix D.1. [GL #2377] 3487 3488 5577. [bug] Fix the "three is a crowd" key rollover bug in KASP by 3489 correctly implementing Equation (2) of the "Flexible and 3490 Robust Key Rollover" paper. [GL #2375] 3491 3492 5576. [experimental] Initial server-side implementation of DNS-over-HTTPS 3493 (DoH). Support for both TLS-encrypted and unencrypted 3494 HTTP/2 connections has been added to the network manager 3495 and integrated into named. (Note: there is currently no 3496 client-side support for DNS-over-HTTPS; this will be 3497 added to dig in a future release.) [GL #1144] 3498 3499 5575. [bug] When migrating to KASP, BIND 9 considered keys with the 3500 "Inactive" and/or "Delete" timing metadata to be 3501 possible active keys. This has been fixed. [GL #2406] 3502 3503 5574. [func] Incoming zone transfers can now use TLS. Addresses in a 3504 "primaries" list take an optional "tls" argument, 3505 specifying either a previously configured "tls" block or 3506 "ephemeral"; SOA queries and zone transfer requests are 3507 then sent via TLS. [GL #2392] 3508 3509 5573. [func] When serve-stale is enabled and stale data is available, 3510 named now returns stale answers upon encountering any 3511 unexpected error in the query resolution process. 3512 However, the "stale-refresh-time" window is still only 3513 started upon a timeout. [GL #2434] 3514 3515 5572. [bug] Address potential double free in generatexml(). 3516 [GL #2420] 3517 3518 5571. [bug] named failed to start when its configuration included a 3519 zone with a non-builtin "allow-update" ACL attached. 3520 [GL #2413] 3521 3522 5570. [bug] Improve performance of the DNSSEC verification code by 3523 reducing the number of repeated calls to 3524 dns_dnssec_keyfromrdata(). [GL #2073] 3525 3526 5569. [bug] Emit useful error message when "rndc retransfer" is 3527 applied to a zone of inappropriate type. [GL #2342] 3528 3529 5568. [bug] Fixed a crash in "dnssec-keyfromlabel" when using ECDSA 3530 keys. [GL #2178] 3531 3532 5567. [bug] Dig now reports unknown dash options while pre-parsing 3533 the options. This prevents "-multi" instead of "+multi" 3534 from reporting memory usage before ending option parsing 3535 with "Invalid option: -lti". [GL #2403] 3536 3537 5566. [func] Add "stale-answer-client-timeout" option, which is the 3538 amount of time a recursive resolver waits before 3539 attempting to answer the query using stale data from 3540 cache. [GL #2247] 3541 3542 5565. [func] The SONAMEs for BIND 9 libraries now include the current 3543 BIND 9 version number, in an effort to tightly couple 3544 internal libraries with a specific release. [GL #2387] 3545 3546 5564. [cleanup] Network manager's TLSDNS module was refactored to use 3547 libuv and libssl directly instead of a stack of TCP/TLS 3548 sockets. [GL #2335] 3549 3550 5563. [cleanup] Changed several obsolete configuration options to 3551 ancient, making them fatal errors. Also cleaned up the 3552 number of clause flags in the configuration parser. 3553 [GL #1086] 3554 3555 5562. [placeholder] 3556 3557 5561. [bug] KASP incorrectly set signature validity to the value of 3558 the DNSKEY signature validity. This is now fixed. 3559 [GL #2383] 3560 3561 5560. [func] The default value of "max-stale-ttl" has been changed 3562 from 12 hours to 1 day and the default value of 3563 "stale-answer-ttl" has been changed from 1 second to 30 3564 seconds, following RFC 8767 recommendations. [GL #2248] 3565 3566 .. code-block:: none 3567 3568 --- 9.17.9 released --- 3569 3570 5559. [bug] The --with-maxminddb=PATH form of the build-time option 3571 enabling support for libmaxminddb was not working 3572 correctly. This has been fixed. [GL #2366] 3573 3574 5558. [bug] Asynchronous hook modules could trigger an assertion 3575 failure when the fetch handle was detached too late. 3576 Thanks to Jinmei Tatuya at Infoblox. [GL #2379] 3577 3578 5557. [bug] Prevent RBTDB instances from being destroyed by multiple 3579 threads at the same time. [GL #2317] 3580 3581 5556. [bug] Further tweak newline printing in dnssec-signzone and 3582 dnssec-verify. [GL #2359] 3583 3584 5555. [placeholder] 3585 3586 5554. [bug] dnssec-signzone and dnssec-verify were missing newlines 3587 between log messages. [GL #2359] 3588 3589 5553. [bug] When reconfiguring named, removing "auto-dnssec" did not 3590 turn off DNSSEC maintenance. [GL #2341] 3591 3592 5552. [func] When switching to "dnssec-policy none;", named now 3593 permits a safe transition to insecure mode and publishes 3594 the CDS and CDNSKEY DELETE records, as described in RFC 3595 8078. [GL #1750] 3596 3597 5551. [bug] named no longer attempts to assign threads to CPUs 3598 outside the CPU affinity set. Thanks to Ole Bjrn 3599 Hessen. [GL #2245] 3600 3601 5550. [func] dnssec-signzone and named now log a warning when falling 3602 back to the "increment" SOA serial method. [GL #2058] 3603 3604 5549. [protocol] ipv4only.arpa is now served when DNS64 is configured. 3605 [GL #385] 3606 3607 5548. [placeholder] 3608 3609 5547. [placeholder] 3610 3611 .. code-block:: none 3612 3613 --- 9.17.8 released --- 3614 3615 5546. [placeholder] 3616 3617 5545. [func] OS support for load-balanced sockets is no longer 3618 required to receive incoming queries in multiple netmgr 3619 threads. [GL #2137] 3620 3621 5544. [func] Restore the default value of "nocookie-udp-size" to 4096 3622 bytes. [GL #2250] 3623 3624 5543. [bug] Fix UDP performance issues caused by making netmgr 3625 callbacks asynchronous-only. [GL #2320] 3626 3627 5542. [bug] Refactor netmgr. [GL #1920] [GL #2034] [GL #2061] 3628 [GL #2194] [GL #2221] [GL #2266] [GL #2283] [GL #2318] 3629 [GL #2321] 3630 3631 5541. [func] Adjust the "max-recursion-queries" default from 75 to 3632 100. [GL #2305] 3633 3634 5540. [port] Fix building with native PKCS#11 support for AEP Keyper. 3635 [GL #2315] 3636 3637 5539. [bug] Tighten handling of missing DNS COOKIE responses over 3638 UDP by falling back to TCP. [GL #2275] 3639 3640 5538. [func] Add NSEC3 support to KASP. A new option for 3641 "dnssec-policy", "nsec3param", can be used to set the 3642 desired NSEC3 parameters. NSEC3 salt collisions are 3643 automatically prevented during resalting. Salt 3644 generation is now logged with zone context. [GL #1620] 3645 3646 5537. [func] The query plugin mechanism has been extended 3647 to support asynchronous operations. For example, a 3648 plugin can now trigger recursion and resume 3649 processing when it is complete. Thanks to Jinmei 3650 Tatuya at Infoblox. [GL #2141] 3651 3652 5536. [func] Dig can now report the DNS64 prefixes in use 3653 (+dns64prefix). [GL #1154] 3654 3655 5535. [bug] dig/nslookup/host could crash on shutdown after an 3656 interrupt. [GL #2287] [GL #2288] 3657 3658 5534. [bug] The CNAME synthesized from a DNAME was incorrectly 3659 followed when the QTYPE was CNAME or ANY. [GL #2280] 3660 3661 .. code-block:: none 3662 3663 --- 9.17.7 released --- 3664 3665 5533. [func] Add the "stale-refresh-time" option, a time window that 3666 starts after a failed lookup, during which a stale RRset 3667 is served directly from cache before a new attempt to 3668 refresh it is made. [GL #2066] 3669 3670 5532. [cleanup] Unused header files were removed: 3671 bin/rndc/include/rndc/os.h, lib/isc/timer_p.h, 3672 lib/isccfg/include/isccfg/dnsconf.h and code related 3673 to those files. [GL #1913] 3674 3675 5531. [func] Add support for DNS over TLS (DoT) to dig and named. 3676 dig output now includes the transport protocol used. 3677 [GL #1816] [GL #1840] 3678 3679 5530. [bug] dnstap did not capture responses to forwarded UPDATE 3680 requests. [GL #2252] 3681 3682 5529. [func] The network manager API is now used by named to send 3683 zone transfer requests. [GL #2016] 3684 3685 5528. [func] Convert dig, host, and nslookup to use the network 3686 manager API. As a side effect of this change, "dig 3687 +unexpected" no longer works, and has been disabled. 3688 [GL #2140] 3689 3690 5527. [bug] A NULL pointer dereference occurred when creating an NTA 3691 recheck query failed. [GL #2244] 3692 3693 5526. [bug] Fix a race/NULL dereference in TCPDNS read. [GL #2227] 3694 3695 5525. [placeholder] 3696 3697 5524. [func] Added functionality to the network manager to support 3698 outgoing DNS queries in addition to incoming ones. 3699 [GL #2235] 3700 3701 5523. [bug] The initial lookup in a zone transitioning to/from a 3702 signed state could fail if the DNSKEY RRset was not 3703 found. [GL #2236] 3704 3705 5522. [bug] Fixed a race/NULL dereference in TCPDNS send. [GL #2227] 3706 3707 5521. [func] All use of libltdl was dropped. libuv's shared library 3708 handling interface is now used instead. [GL !4278] 3709 3710 5520. [bug] Fixed a number of shutdown races, reference counting 3711 errors, and spurious log messages that could occur 3712 in the network manager. [GL #2221] 3713 3714 5519. [cleanup] Unused source code was removed: lib/dns/dbtable.c, 3715 lib/dns/portlist.c, lib/isc/bufferlist.c, and code 3716 related to those files. [GL #2060] 3717 3718 5518. [bug] Stub zones now work correctly with primary servers using 3719 "minimal-responses yes". [GL #1736] 3720 3721 5517. [bug] Do not treat UV_EOF as a TCP4RecvErr or a TCP6RecvErr. 3722 [GL #2208] 3723 3724 .. code-block:: none 3725 3726 --- 9.17.6 released --- 3727 3728 5516. [func] The default EDNS buffer size has been changed from 4096 3729 to 1232 bytes, the EDNS buffer size probing has been 3730 removed, and named now sets the DF (Don't Fragment) flag 3731 on outgoing UDP packets. [GL #2183] 3732 3733 5515. [func] Add 'rndc dnssec -rollover' command to trigger a manual 3734 rollover for a specific key. [GL #1749] 3735 3736 5514. [bug] Fix KASP expected key size for Ed25519 and Ed448. 3737 [GL #2171] 3738 3739 5513. [doc] The ARM section describing the "rrset-order" statement 3740 was rewritten to make it unambiguous and up-to-date with 3741 the source code. [GL #2139] 3742 3743 5512. [bug] "rrset-order" rules using "order none" were causing 3744 named to crash despite named-checkconf treating them as 3745 valid. [GL #2139] 3746 3747 5511. [bug] 'dig -u +yaml' failed to display timestamps to the 3748 microsecond. [GL #2190] 3749 3750 5510. [bug] Implement the attach/detach semantics for dns_message_t 3751 to fix a data race in accessing an already-destroyed 3752 fctx->rmessage. [GL #2124] 3753 3754 5509. [bug] filter-aaaa: named crashed upon shutdown if it was in 3755 the process of recursing for A RRsets. [GL #1040] 3756 3757 5508. [func] Added new parameter "-expired" for "rndc dumpdb" that 3758 also prints expired RRsets (awaiting cleanup) to the 3759 dump file. [GL #1870] 3760 3761 5507. [bug] Named could compute incorrect SIG(0) responses. 3762 [GL #2109] 3763 3764 5506. [bug] Properly handle failed sysconf() calls, so we don't 3765 report invalid memory size. [GL #2166] 3766 3767 5505. [bug] Updating contents of a mixed-case RPZ could cause some 3768 rules to be ignored. [GL #2169] 3769 3770 5504. [func] The "glue-cache" option has been marked as deprecated. 3771 The glue cache feature will be permanently enabled in a 3772 future release. [GL #2146] 3773 3774 5503. [bug] Cleaned up reference counting of network manager 3775 handles, now using isc_nmhandle_attach() and _detach() 3776 instead of _ref() and _unref(). [GL #2122] 3777 3778 .. code-block:: none 3779 3780 --- 9.17.5 released --- 3781 3782 5502. [func] 'dig +bufsize=0' no longer disables EDNS. [GL #2054] 3783 3784 5501. [func] Log CDS/CDNSKEY publication. [GL #1748] 3785 3786 5500. [bug] Fix (non-)publication of CDS and CDNSKEY records. 3787 [GL #2103] 3788 3789 5499. [func] Add '-P ds' and '-D ds' arguments to dnssec-settime. 3790 [GL #1748] 3791 3792 5498. [test] The --with-gperftools-profiler configure option was 3793 removed. [GL !4045] 3794 3795 5497. [placeholder] 3796 3797 5496. [bug] Address a TSAN report by ensuring each rate limiter 3798 object holds a reference to its task. [GL #2081] 3799 3800 5495. [bug] With query minimization enabled, named failed to 3801 resolve ip6.arpa. names that had extra labels to the 3802 left of the IPv6 part. [GL #1847] 3803 3804 5494. [bug] Silence the EPROTO syslog message on older systems. 3805 [GL #1928] 3806 3807 5493. [bug] Fix off-by-one error when calculating new hash table 3808 size. [GL #2104] 3809 3810 5492. [bug] Tighten LOC parsing to reject a period (".") and/or "m" 3811 as a value. Fix handling of negative altitudes which are 3812 not whole meters. [GL #2074] 3813 3814 5491. [bug] rbtversion->glue_table_size could be read without the 3815 appropriate lock being held. [GL #2080] 3816 3817 5490. [func] Refactor readline support to use pkg-config and add 3818 support for the editline library. [GL !3942] 3819 3820 5489. [bug] Named erroneously accepted certain invalid resource 3821 records that were incorrectly processed after 3822 subsequently being written to disk and loaded back, as 3823 the wire format differed. Such records include: CERT, 3824 IPSECKEY, NSEC3, NSEC3PARAM, NXT, SIG, TLSA, WKS, and 3825 X25. [GL !3953] 3826 3827 5488. [bug] NTA code needed to have a weak reference on its 3828 associated view to prevent the latter from being deleted 3829 while NTA tests were being performed. [GL #2067] 3830 3831 5487. [cleanup] Update managed keys log messages to be less confusing. 3832 [GL #2027] 3833 3834 5486. [func] Add 'rndc dnssec -checkds' command, which signals to 3835 named that the DS record for a given zone or key has 3836 been updated in the parent zone. [GL #1613] 3837 3838 .. code-block:: none 3839 3840 --- 9.17.4 released --- 3841 3842 5485. [placeholder] 3843 3844 5484. [func] Expire zero TTL records quickly rather than using them 3845 for stale answers. [GL #1829] 3846 3847 5483. [func] Keeping "stale" answers in cache has been disabled by 3848 default and can be re-enabled with a new configuration 3849 option "stale-cache-enable". [GL #1712] 3850 3851 5482. [bug] If the Duplicate Address Detection (DAD) mechanism had 3852 not yet finished after adding a new IPv6 address to the 3853 system, BIND 9 would fail to bind to IPv6 addresses in a 3854 tentative state. [GL #2038] 3855 3856 5481. [security] "update-policy" rules of type "subdomain" were 3857 incorrectly treated as "zonesub" rules, which allowed 3858 keys used in "subdomain" rules to update names outside 3859 of the specified subdomains. The problem was fixed by 3860 making sure "subdomain" rules are again processed as 3861 described in the ARM. (CVE-2020-8624) [GL #2055] 3862 3863 5480. [security] When BIND 9 was compiled with native PKCS#11 support, it 3864 was possible to trigger an assertion failure in code 3865 determining the number of bits in the PKCS#11 RSA public 3866 key with a specially crafted packet. (CVE-2020-8623) 3867 [GL #2037] 3868 3869 5479. [security] named could crash in certain query resolution scenarios 3870 where QNAME minimization and forwarding were both 3871 enabled. (CVE-2020-8621) [GL #1997] 3872 3873 5478. [security] It was possible to trigger an assertion failure by 3874 sending a specially crafted large TCP DNS message. 3875 (CVE-2020-8620) [GL #1996] 3876 3877 5477. [bug] The idle timeout for connected TCP sockets, which was 3878 previously set to a high fixed value, is now derived 3879 from the client query processing timeout configured for 3880 a resolver. [GL #2024] 3881 3882 5476. [security] It was possible to trigger an assertion failure when 3883 verifying the response to a TSIG-signed request. 3884 (CVE-2020-8622) [GL #2028] 3885 3886 5475. [bug] Wildcard RPZ passthru rules could incorrectly be 3887 overridden by other rules that were loaded from RPZ 3888 zones which appeared later in the "response-policy" 3889 statement. This has been fixed. [GL #1619] 3890 3891 5474. [bug] dns_rdata_hip_next() failed to return ISC_R_NOMORE 3892 when it should have. [GL !3880] 3893 3894 5473. [func] The RBT hash table implementation has been changed 3895 to use a faster hash function (HalfSipHash2-4) and 3896 Fibonacci hashing for better distribution. Setting 3897 "max-cache-size" now preallocates a fixed-size hash 3898 table so that rehashing does not cause resolution 3899 brownouts while the hash table is grown. [GL #1775] 3900 3901 5472. [func] The statistics channel has been updated to use the 3902 new network manager. [GL #2022] 3903 3904 5471. [bug] The introduction of KASP support inadvertently caused 3905 the second field of "sig-validity-interval" to always be 3906 calculated in hours, even in cases when it should have 3907 been calculated in days. This has been fixed. (Thanks to 3908 Tony Finch.) [GL !3735] 3909 3910 5470. [port] gsskrb5_register_acceptor_identity() is now only called 3911 if gssapi_krb5.h is present. [GL #1995] 3912 3913 5469. [port] On illumos, a constant called SEC is already defined in 3914 <sys/time.h>, which conflicts with an identically named 3915 constant in libbind9. This conflict has been resolved. 3916 [GL #1993] 3917 3918 5468. [bug] Addressed potential double unlock in process_fd(). 3919 [GL #2005] 3920 3921 5467. [func] The control channel and the rndc utility have been 3922 updated to use the new network manager. To support 3923 this, the network manager was updated to enable 3924 the initiation of client TCP connections. Its 3925 internal reference counting has been refactored. 3926 3927 Note: As a side effect of this change, rndc cannot 3928 currently be used with UNIX-domain sockets, and its 3929 default timeout has changed from 60 seconds to 30. 3930 These will be addressed in a future release. 3931 [GL #1759] 3932 3933 5466. [bug] Addressed an error in recursive clients stats reporting. 3934 [GL #1719] 3935 3936 5465. [func] Added fallback to built-in trust-anchors, managed-keys, 3937 or trusted-keys if the bindkeys-file (bind.keys) cannot 3938 be parsed. [GL #1235] 3939 3940 5464. [bug] Requesting more than 128 files to be saved when rolling 3941 dnstap log files caused a buffer overflow. This has been 3942 fixed. [GL #1989] 3943 3944 5463. [placeholder] 3945 3946 5462. [bug] Move LMDB locking from LMDB itself to named. [GL #1976] 3947 3948 5461. [bug] The STALE rdataset header attribute was updated while 3949 the write lock was not being held, leading to incorrect 3950 statistics. The header attributes are now converted to 3951 use atomic operations. [GL #1475] 3952 3953 5460. [cleanup] tsig-keygen was previously an alias for 3954 ddns-confgen and was documented in the ddns-confgen 3955 man page. This has been reversed; tsig-keygen is 3956 now the primary name. [GL #1998] 3957 3958 5459. [bug] Fixed bad isc_mem_put() size when an invalid type was 3959 specified in an "update-policy" rule. [GL #1990] 3960 3961 .. code-block:: none 3962 3963 --- 9.17.3 released --- 3964 3965 5458. [bug] Prevent a theoretically possible NULL dereference caused 3966 by a data race between zone_maintenance() and 3967 dns_zone_setview_helper(). [GL #1627] 3968 3969 5457. [placeholder] 3970 3971 5456. [func] Added "primaries" as a synonym for "masters" in 3972 named.conf, and "primary-only" as a synonym for 3973 "master-only" in the parameters to "notify", to bring 3974 terminology up-to-date with RFC 8499. [GL #1948] 3975 3976 5455. [bug] named could crash when cleaning dead nodes in 3977 lib/dns/rbtdb.c that were being reused. [GL #1968] 3978 3979 5454. [bug] Address a startup crash that occurred when the server 3980 was under load and the root zone had not yet been 3981 loaded. [GL #1862] 3982 3983 5453. [bug] named crashed on shutdown when a new rndc connection was 3984 received during shutdown. [GL #1747] 3985 3986 5452. [bug] The "blackhole" ACL was accidentally disabled for client 3987 queries. [GL #1936] 3988 3989 5451. [func] Add 'rndc dnssec -status' command. [GL #1612] 3990 3991 5450. [placeholder] 3992 3993 5449. [bug] Fix a socket shutdown race in netmgr udp. [GL #1938] 3994 3995 5448. [bug] Fix a race condition in isc__nm_tcpdns_send(). 3996 [GL #1937] 3997 3998 5447. [bug] IPv6 addresses ending in "::" could break YAML 3999 parsing. A "0" is now appended to such addresses 4000 in YAML output from dig, mdig, delv, and dnstap-read. 4001 [GL #1952] 4002 4003 5446. [bug] The validator could fail to accept a properly signed 4004 RRset if an unsupported algorithm appeared earlier in 4005 the DNSKEY RRset than a supported algorithm. It could 4006 also stop if it detected a malformed public key. 4007 [GL #1689] 4008 4009 5445. [cleanup] Disable and disallow static linking. [GL #1933] 4010 4011 5444. [bug] 'rndc dnstap -roll <value>' did not limit the number of 4012 saved files to <value>. [GL !3728] 4013 4014 5443. [bug] The "primary" and "secondary" keywords, when used 4015 as parameters for "check-names", were not 4016 processed correctly and were being ignored. [GL #1949] 4017 4018 5442. [func] Add support for outgoing TCP connections in netmgr. 4019 [GL #1958] 4020 4021 5441. [placeholder] 4022 4023 5440. [placeholder] 4024 4025 5439. [bug] The DS RRset returned by dns_keynode_dsset() was used in 4026 a non-thread-safe manner. [GL #1926] 4027 4028 .. code-block:: none 4029 4030 --- 9.17.2 released --- 4031 4032 5438. [bug] Fix a race in TCP accepting code. [GL #1930] 4033 4034 5437. [bug] Fix a data race in lib/dns/resolver.c:log_formerr(). 4035 [GL #1808] 4036 4037 5436. [security] It was possible to trigger an INSIST when determining 4038 whether a record would fit into a TCP message buffer. 4039 (CVE-2020-8618) [GL #1850] 4040 4041 5435. [tests] Add RFC 4592 responses examples to the wildcard system 4042 test. [GL #1718] 4043 4044 5434. [security] It was possible to trigger an INSIST in 4045 lib/dns/rbtdb.c:new_reference() with a particular zone 4046 content and query patterns. (CVE-2020-8619) [GL #1111] 4047 [GL #1718] 4048 4049 5433. [placeholder] 4050 4051 5432. [bug] Check the question section when processing AXFR, IXFR, 4052 and SOA replies when transferring a zone in. [GL #1683] 4053 4054 5431. [func] Reject DS records at the zone apex when loading 4055 master files. Log but otherwise ignore attempts to 4056 add DS records at the zone apex via UPDATE. [GL #1798] 4057 4058 5430. [doc] Update docs - with netmgr, a separate listening socket 4059 is created for each IPv6 interface (just as with IPv4). 4060 [GL #1782] 4061 4062 5429. [cleanup] Move BIND binaries which are neither daemons nor 4063 administrative programs to $bindir. [GL #1724] 4064 4065 5428. [bug] Clean up GSSAPI resources in nsupdate only after taskmgr 4066 has been destroyed. Thanks to Petr Menk. [GL !3316] 4067 4068 5427. [placeholder] 4069 4070 5426. [bug] Don't abort() when setting SO_INCOMING_CPU on the socket 4071 fails. [GL #1911] 4072 4073 5425. [func] The default value of "max-stale-ttl" has been changed 4074 from 1 week to 12 hours. [GL #1877] 4075 4076 5424. [bug] With KASP, when creating a successor key, the "goal" 4077 state of the current active key (predecessor) was not 4078 changed and thus never removed from the zone. [GL #1846] 4079 4080 5423. [bug] Fix a bug in keymgr_key_has_successor(): it incorrectly 4081 returned true if any other key in the keyring had a 4082 successor. [GL #1845] 4083 4084 5422. [bug] When using dnssec-policy, print correct key timing 4085 metadata. [GL #1843] 4086 4087 5421. [bug] Fix a race that could cause named to crash when looking 4088 up the nodename of an RBT node if the tree was modified. 4089 [GL #1857] 4090 4091 5420. [bug] Add missing isc_{mutex,conditional}_destroy() calls 4092 that caused a memory leak on FreeBSD. [GL #1893] 4093 4094 5419. [func] Add new dig command line option, "+qid=<num>", which 4095 allows the query ID to be set to an arbitrary value. 4096 Add a new ./configure option, --enable-singletrace, 4097 which allows trace logging of a single query when QID is 4098 set to 0. [GL #1851] 4099 4100 5418. [bug] delv failed to parse deprecated trusted-keys-style 4101 trust anchors. [GL #1860] 4102 4103 5417. [cleanup] The code determining the advertised UDP buffer size in 4104 outgoing EDNS queries has been refactored to improve its 4105 clarity. [GL #1868] 4106 4107 5416. [bug] Fix a lock order inversion in lib/isc/unix/socket.c. 4108 [GL #1859] 4109 4110 5415. [test] Address race in dnssec system test that led to 4111 test failures. [GL #1852] 4112 4113 5414. [test] Adjust time allowed for journal truncation to occur 4114 in nsupdate system test to avoid test failure. 4115 [GL #1855] 4116 4117 5413. [test] Address race in autosign system test that led to 4118 test failures. [GL #1852] 4119 4120 5412. [bug] 'provide-ixfr no;' failed to return up-to-date responses 4121 when the serial was greater than or equal to the 4122 current serial. [GL #1714] 4123 4124 5411. [cleanup] TCP accept code has been refactored to use a single 4125 accept() and pass the accepted socket to child threads 4126 for processing. [GL !3320] 4127 4128 5410. [func] Add the ability to specify per-type record count limits, 4129 which are enforced when adding records via UPDATE, in an 4130 "update-policy" statement. [GL #1657] 4131 4132 5409. [performance] When looking up NSEC3 data in a zone database, skip the 4133 check for empty non-terminal nodes; the NSEC3 tree does 4134 not have any. [GL #1834] 4135 4136 5408. [protocol] Print Extended DNS Errors if present in OPT record. 4137 [GL #1835] 4138 4139 5407. [func] Zone timers are now exported via statistics channel. 4140 Thanks to Paul Frieden, Verizon Media. [GL #1232] 4141 4142 5406. [func] Add a new logging category, "rpz-passthru", which allows 4143 RPZ passthru actions to be logged in a separate channel. 4144 [GL #54] 4145 4146 5405. [bug] 'named-checkconf -p' could include spurious text in 4147 server-addresses statements due to an uninitialized DSCP 4148 value. [GL #1812] 4149 4150 5404. [bug] 'named-checkconf -z' could incorrectly indicate 4151 success if errors were found in one view but not in a 4152 subsequent one. [GL #1807] 4153 4154 5403. [func] Do not set UDP receive/send buffer sizes - use system 4155 defaults. [GL #1713] 4156 4157 5402. [bug] On FreeBSD, use SO_REUSEPORT_LB instead of SO_REUSEPORT. 4158 Enable use of SO_REUSEADDR on all platforms which 4159 support it. [GL !3365] 4160 4161 5401. [bug] The number of input queues allocated during dnstap 4162 initialization was too low, which could prevent some 4163 dnstap data from being logged. [GL #1795] 4164 4165 5400. [func] Add engine support to OpenSSL EdDSA implementation. 4166 [GL #1763] 4167 4168 5399. [func] Add engine support to OpenSSL ECDSA implementation. 4169 [GL #1534] 4170 4171 5398. [bug] Named could fail to restart if a zone with a double 4172 quote (") in its name was added with 'rndc addzone'. 4173 [GL #1695] 4174 4175 5397. [func] Update PKCS#11 EdDSA implementation to PKCS#11 v3.0. 4176 Thanks to Aaron Thompson. [GL !3326] 4177 4178 5396. [func] When necessary (i.e. in libuv >= 1.37), use the 4179 UV_UDP_RECVMMSG flag to enable recvmmsg() support in 4180 libuv. [GL #1797] 4181 4182 5395. [security] Further limit the number of queries that can be 4183 triggered from a request. Root and TLD servers 4184 are no longer exempt from max-recursion-queries. 4185 Fetches for missing name server address records 4186 are limited to 4 for any domain. (CVE-2020-8616) 4187 [GL #1388] 4188 4189 5394. [cleanup] Named formerly attempted to change the effective UID and 4190 GID in named_os_openfile(), which could trigger a 4191 spurious log message if they were already set to the 4192 desired values. This has been fixed. [GL #1042] 4193 [GL #1090] 4194 4195 5393. [cleanup] Unused and/or redundant APIs were removed from libirs. 4196 [GL #1758] 4197 4198 5392. [bug] It was possible for named to crash during shutdown 4199 or reconfiguration if an RPZ zone was still being 4200 updated. [GL #1779] 4201 4202 5391. [func] The BIND 9 build system has been changed to use a 4203 typical autoconf+automake+libtool stack. When building 4204 from the Git repository, run "autoreconf -fi" first. 4205 [GL #4] 4206 4207 5390. [security] Replaying a TSIG BADTIME response as a request could 4208 trigger an assertion failure. (CVE-2020-8617) 4209 [GL #1703] 4210 4211 5389. [bug] Finish PKCS#11 code cleanup, fix a couple of smaller 4212 bugs and use PKCS#11 v3.0 EdDSA macros and constants. 4213 Thanks to Aaron Thompson. [GL !3391] 4214 4215 5388. [func] Reject AXFR streams where the message ID is not 4216 consistent. [GL #1674] 4217 4218 5387. [placeholder] 4219 4220 5386. [cleanup] Address Coverity warnings in lib/dns/keymgr.c. 4221 [GL #1737] 4222 4223 5385. [func] Make ISC rwlock implementation the default again. 4224 [GL #1753] 4225 4226 5384. [bug] With "dnssec-policy" in effect, "inline-signing" was 4227 implicitly set to "yes". Now "inline-signing" is only 4228 set to "yes" if the zone is not dynamic. [GL #1709] 4229 4230 .. code-block:: none 4231 4232 --- 9.17.1 released --- 4233 4234 5383. [func] Add a quota attach function with a callback and clean up 4235 the isc_quota API. [GL !3280] 4236 4237 5382. [bug] Use clock_gettime() instead of gettimeofday() for 4238 isc_stdtime() function. [GL #1679] 4239 4240 5381. [bug] Fix logging API data race by adding rwlock and caching 4241 logging levels in stdatomic variables to restore 4242 performance to original levels. [GL #1675] [GL #1717] 4243 4244 5380. [contrib] Fix building MySQL DLZ modules against MySQL 8 4245 libraries. [GL #1678] 4246 4247 5379. [placeholder] 4248 4249 5378. [bug] Receiving invalid DNS data was triggering an assertion 4250 failure in nslookup. [GL #1652] 4251 4252 5377. [placeholder] 4253 4254 5376. [bug] Fix ineffective DNS rebinding protection when BIND is 4255 configured as a forwarding DNS server. Thanks to Tobias 4256 Klein. [GL #1574] 4257 4258 5375. [test] Fix timing issues in the "kasp" system test. [GL #1669] 4259 4260 5374. [bug] Statistics counters tracking recursive clients and 4261 active connections could underflow. [GL #1087] 4262 4263 5373. [bug] Collecting statistics for DNSSEC signing operations 4264 (change 5254) caused an array of significant size (over 4265 100 kB) to be allocated for each configured zone. Each 4266 of these arrays is tracking all possible key IDs; this 4267 could trigger an out-of-memory condition on servers with 4268 a high enough number of zones configured. Fixed by 4269 tracking up to four keys per zone and rotating counters 4270 when keys are replaced. This fixes the immediate problem 4271 of high memory usage, but should be improved in a future 4272 release by growing or shrinking the number of keys to 4273 track upon key rollover events. [GL #1179] 4274 4275 5372. [bug] Fix migration from existing DNSSEC key files 4276 ("auto-dnssec maintain") to "dnssec-policy". [GL #1706] 4277 4278 5371. [bug] Improve incremental updates of the RPZ summary 4279 database to reduce delays that could occur when 4280 a policy zone update included a large number of 4281 record deletions. [GL #1447] 4282 4283 5370. [bug] Deactivation of a netmgr handle associated with a 4284 socket could be skipped in some circumstances. 4285 Fixed by deactivating the netmgr handle before 4286 scheduling the asynchronous close routine. [GL #1700] 4287 4288 5369. [func] Add the ability to specify whether to wait for 4289 nameserver domain names to be looked up, with a new RPZ 4290 modifying directive 'nsdname-wait-recurse'. [GL #1138] 4291 4292 5368. [bug] Named failed to restart if 'rndc addzone' names 4293 contained special characters (e.g. '/'). [GL #1655] 4294 4295 5367. [placeholder] 4296 4297 .. code-block:: none 4298 4299 --- 9.17.0 released --- 4300 4301 5366. [bug] Fix a race condition with the keymgr when the same 4302 zone plus dnssec-policy is configured in multiple 4303 views. [GL #1653] 4304 4305 5365. [bug] Algorithm rollover was stuck on submitting DS 4306 because keymgr thought it would move to an invalid 4307 state. Fixed by checking the current key against 4308 the desired state, not the existing state. [GL #1626] 4309 4310 5364. [bug] Algorithm rollover waited too long before introducing 4311 zone signatures. It waited to make sure all signatures 4312 were regenerated, but when introducing a new algorithm, 4313 all signatures are regenerated immediately. Only 4314 add the sign delay if there is a predecessor key. 4315 [GL #1625] 4316 4317 5363. [bug] When changing a dnssec-policy, existing keys with 4318 properties that no longer match were not being retired. 4319 [GL #1624] 4320 4321 5362. [func] Limit the size of IXFR responses so that AXFR will 4322 be used instead if it would be smaller. This is 4323 controlled by the "max-ixfr-ratio" option, which 4324 is a percentage representing the ratio of IXFR size 4325 to the size of the entire zone. This value cannot 4326 exceed 100%, which is the default. [GL #1515] 4327 4328 5361. [bug] named might not accept new connections after 4329 hitting tcp-clients quota. [GL #1643] 4330 4331 5360. [bug] delv could fail to load trust anchors in DNSKEY 4332 format. [GL #1647] 4333 4334 5359. [func] "rndc nta -d" and "rndc secroots" now include 4335 "validate-except" entries when listing negative 4336 trust anchors. These are indicated by the keyword 4337 "permanent" in place of an expiry date. [GL #1532] 4338 4339 5358. [bug] Inline master zones whose master files were touched 4340 but otherwise unchanged and were subsequently reloaded 4341 may have stopped re-signing. [GL !3135] 4342 4343 5357. [bug] Newly added RRSIG records with expiry times before 4344 the previous earliest expiry times might not be 4345 re-signed in time. This was a side effect of 5315. 4346 [GL !3137] 4347 4348 5356. [func] Update dnssec-policy configuration statements: 4349 - Rename "zone-max-ttl" dnssec-policy option to 4350 "max-zone-ttl" for consistency with the existing 4351 zone option. 4352 - Allow for "lifetime unlimited" as a synonym for 4353 "lifetime PT0S". 4354 - Make "key-directory" optional. 4355 - Warn if specifying a key length does not make 4356 sense; fail if key length is out of range for 4357 the algorithm. 4358 - Allow use of mnemonics when specifying key 4359 algorithm (e.g. "rsasha256", "ecdsa384", etc.). 4360 - Make ISO 8601 durations case-insensitive. 4361 [GL #1598] 4362 4363 5355. [func] What was set with --with-tuning=large option in 4364 older BIND9 versions is now a default, and 4365 a --with-tuning=small option was added for small 4366 (e.g. OpenWRT) systems. [GL !2989] 4367 4368 5354. [bug] dnssec-policy created new KSK keys for zones in the 4369 initial stage of signing (with the DS not yet in the 4370 rumoured or omnipresent states). Fix by checking the 4371 key goals rather than the active state when determining 4372 whether new keys are needed. [GL #1593] 4373 4374 5353. [doc] Document port and dscp parameters in forwarders 4375 configuration option. [GL #914] 4376 4377 5352. [bug] Correctly handle catalog zone entries containing 4378 characters that aren't legal in filenames. [GL #1592] 4379 4380 5351. [bug] CDS / CDNSKEY consistency checks failed to handle 4381 removal records. [GL #1554] 4382 4383 5350. [bug] When a view was configured with class CHAOS, the 4384 server could crash while processing a query for a 4385 non-existent record. [GL #1540] 4386 4387 5349. [bug] Fix a race in task_pause/unpause. [GL #1571] 4388 4389 5348. [bug] dnssec-settime -Psync was not being honoured. 4390 Thanks to Tony Finch. [GL !2893] 4391 4392 .. code-block:: none 4393 4394 --- 9.15.8 released --- 4395 4396 5347. [bug] Fixed a bug that could cause an intermittent crash 4397 in validator.c when validating a negative cache 4398 entry. [GL #1561] 4399 4400 5346. [bug] Make hazard pointer array allocations dynamic, fixing 4401 a bug that caused named to crash on machines with more 4402 than 40 cores. [GL #1493] 4403 4404 5345. [func] Key-style trust anchors and DS-style trust anchors 4405 can now both be used for the same name. [GL #1237] 4406 4407 5344. [bug] Handle accept() errors properly in netmgr. [GL !2880] 4408 4409 5343. [func] Add statistics counters to the netmgr. [GL #1311] 4410 4411 5342. [bug] Disable pktinfo for IPv6 and bind to each interface 4412 explicitly instead, because libuv doesn't support 4413 pktinfo control messages. [GL #1558] 4414 4415 5341. [func] Simplify passing the bound TCP socket to child 4416 threads by using isc_uv_export/import functions. 4417 [GL !2825] 4418 4419 5340. [bug] Don't deadlock when binding to a TCP socket fails. 4420 [GL #1499] 4421 4422 5339. [bug] With some libmaxminddb versions, named could erroneously 4423 match an IP address not belonging to any subnet defined 4424 in a given GeoIP2 database to one of the existing 4425 entries in that database. [GL #1552] 4426 4427 5338. [bug] Fix line spacing in `rndc secroots`. 4428 Thanks to Tony Finch. [GL !2478] 4429 4430 5337. [func] 'named -V' now reports maxminddb and protobuf-c 4431 versions. [GL !2686] 4432 4433 .. code-block:: none 4434 4435 --- 9.15.7 released --- 4436 4437 5336. [bug] The TCP high-water statistic could report an 4438 incorrect value on startup. [GL #1392] 4439 4440 5335. [func] Make TCP listening code multithreaded. [GL !2659] 4441 4442 5334. [doc] Update documentation with dnssec-policy clarifications. 4443 Also change some defaults. [GL !2711] 4444 4445 5333. [bug] Fix duration printing on Solaris when value is not 4446 an ISO 8601 duration. [GL #1460] 4447 4448 5332. [func] Renamed "dnssec-keys" configuration statement 4449 to the more descriptive "trust-anchors". [GL !2702] 4450 4451 5331. [func] Use compiler-provided mechanisms for thread local 4452 storage, and make the requirement for such mechanisms 4453 explicit in configure. [GL #1444] 4454 4455 5330. [bug] 'configure --without-python' was ineffective if 4456 PYTHON was set in the environment. [GL #1434] 4457 4458 5329. [bug] Reconfiguring named caused memory to be leaked when any 4459 GeoIP2 database was in use. [GL #1445] 4460 4461 5328. [bug] rbtdb.c:rdataset_{get,set}ownercase failed to obtain 4462 a node lock. [GL #1417] 4463 4464 5327. [func] Added a statistics counter to track queries 4465 dropped because the recursive-clients quota was 4466 exceeded. [GL #1399] 4467 4468 5326. [bug] Add Python dependency on 'distutils.core' to configure. 4469 'distutils.core' is required for installation. 4470 [GL #1397] 4471 4472 5325. [bug] Addressed several issues with TCP connections in 4473 the netmgr: restored support for TCP connection 4474 timeouts, restored TCP backlog support, actively 4475 close all open sockets during shutdown. [GL #1312] 4476 4477 5324. [bug] Change the category of some log messages from general 4478 to the more appropriate catergory of xfer-in. [GL #1394] 4479 4480 5323. [bug] Fix a bug in DNSSEC trust anchor verification. 4481 [GL !2609] 4482 4483 5322. [placeholder] 4484 4485 5321. [bug] Obtain write lock before updating version->records 4486 and version->bytes. [GL #1341] 4487 4488 5320. [cleanup] Silence TSAN on header->count. [GL #1344] 4489 4490 .. code-block:: none 4491 4492 --- 9.15.6 released --- 4493 4494 5319. [func] Trust anchors can now be configured using DS 4495 format to represent a key digest, by using the 4496 new "initial-ds" or "static-ds" keywords in 4497 the "dnssec-keys" statement. 4498 4499 Note: DNSKEY-format and DS-format trust anchors 4500 cannot both be used for the same domain name. 4501 [GL #622] 4502 4503 5318. [cleanup] The DNSSEC validation code has been refactored 4504 for clarity and to reduce code duplication. 4505 [GL #622] 4506 4507 5317. [func] A new asynchronous network communications system 4508 based on libuv is now used for listening for 4509 incoming requests and responding to them. (The 4510 old isc_socket API remains in use for sending 4511 iterative queries and processing responses; this 4512 will be changed too in a later release.) 4513 4514 This change will make it easier to improve 4515 performance and implement new protocol layers 4516 (e.g., DNS over TLS) in the future. [GL #29] 4517 4518 5316. [func] A new "dnssec-policy" option has been added to 4519 named.conf to implement a key and signing policy 4520 (KASP) for zones. When this option is in use, 4521 named can generate new keys as needed and 4522 automatically roll both ZSK and KSK keys. (Note 4523 that the syntax for this statement differs from 4524 the dnssec policy used by dnssec-keymgr.) 4525 4526 See the ARM for configuration details. [GL #1134] 4527 4528 5315. [bug] Apply the initial RRSIG expiration spread fixed 4529 to all dynamically created records in the zone 4530 including NSEC3. Also fix the signature clusters 4531 when the server has been offline for prolonged 4532 period of times. [GL #1256] 4533 4534 5314. [func] Added a new statistics variable "tcp-highwater" 4535 that reports the maximum number of simultaneous TCP 4536 clients BIND has handled while running. [GL #1206] 4537 4538 5313. [bug] The default GeoIP2 database location did not match 4539 the ARM. 'named -V' now reports the default 4540 location. [GL #1301] 4541 4542 5312. [bug] Do not flush the cache for `rndc validation status`. 4543 Thanks to Tony Finch. [GL !2462] 4544 4545 5311. [cleanup] Include all views in output of `rndc validation status`. 4546 Thanks to Tony Finch. [GL !2461] 4547 4548 5310. [bug] TCP failures were affecting EDNS statistics. [GL #1059] 4549 4550 5309. [placeholder] 4551 4552 5308. [bug] Don't log DNS_R_UNCHANGED from sync_secure_journal() 4553 at ERROR level in receive_secure_serial(). [GL #1288] 4554 4555 5307. [bug] Fix hang when named-compilezone output is sent to pipe. 4556 Thanks to Tony Finch. [GL !2481] 4557 4558 5306. [security] Set a limit on number of simultaneous pipelined TCP 4559 queries. (CVE-2019-6477) [GL #1264] 4560 4561 5305. [bug] NSEC Aggressive Cache ("synth-from-dnssec") has been 4562 disabled by default because it was found to have 4563 a significant performance impact on the recursive 4564 service. [GL #1265] 4565 4566 5304. [bug] "dnskey-sig-validity 0;" was not being accepted. 4567 [GL #876] 4568 4569 5303. [placeholder] 4570 4571 5302. [bug] Fix checking that "dnstap-output" is defined when 4572 "dnstap" is specified in a view. [GL #1281] 4573 4574 5301. [bug] Detect partial prefixes / incomplete IPv4 address in 4575 acls. [GL #1143] 4576 4577 5300. [bug] dig/mdig/delv: Add a colon after EDNS option names, 4578 even when the option is empty, to improve 4579 readability and allow correct parsing of YAML 4580 output. [GL #1226] 4581 4582 .. code-block:: none 4583 4584 --- 9.15.5 released --- 4585 4586 5299. [security] A flaw in DNSSEC verification when transferring 4587 mirror zones could allow data to be incorrectly 4588 marked valid. (CVE-2019-6475) [GL #1252] 4589 4590 5298. [security] Named could assert if a forwarder returned a 4591 referral, rather than resolving the query, when QNAME 4592 minimization was enabled. (CVE-2019-6476) [GL #1051] 4593 4594 5297. [bug] Check whether a previous QNAME minimization fetch 4595 is still running before starting a new one; return 4596 SERVFAIL and log an error if so. [GL #1191] 4597 4598 5296. [placeholder] 4599 4600 5295. [cleanup] Split dns_name_copy() calls into dns_name_copy() and 4601 dns_name_copynf() for those calls that can potentially 4602 fail and those that should not fail respectively. 4603 [GL !2265] 4604 4605 5294. [func] Fallback to ACE name on output in locale, which does not 4606 support converting it to unicode. [GL #846] 4607 4608 5293. [bug] On Windows, named crashed upon any attempt to fetch XML 4609 statistics from it. [GL #1245] 4610 4611 5292. [bug] Queue 'rndc nsec3param' requests while signing inline 4612 zone changes. [GL #1205] 4613 4614 .. code-block:: none 4615 4616 --- 9.15.4 released --- 4617 4618 5291. [placeholder] 4619 4620 5290. [placeholder] 4621 4622 5289. [bug] Address NULL pointer dereference in rpz.c:rpz_detach. 4623 [GL #1210] 4624 4625 5288. [bug] dnssec-must-be-secure was not always honored. 4626 [GL #1209] 4627 4628 5287. [placeholder] 4629 4630 5286. [contrib] Address potential NULL pointer dereferences in 4631 dlz_mysqldyn_mod.c. [GL #1207] 4632 4633 5285. [port] win32: implement "-T maxudpXXX". [GL #837] 4634 4635 5284. [func] Added +unexpected command line option to dig. 4636 By default, dig won't accept a reply from a source 4637 other than the one to which it sent the query. 4638 Invoking dig with +unexpected argument will allow it 4639 to process replies from unexpected sources. 4640 4641 5283. [bug] When a response-policy zone expires, ensure that 4642 its policies are removed from the RPZ summary 4643 database. [GL #1146] 4644 4645 5282. [bug] Fixed a bug in searching for possible wildcard matches 4646 for query names in the RPZ summary database. [GL #1146] 4647 4648 5281. [cleanup] Don't escape commas when reporting named's command 4649 line. [GL #1189] 4650 4651 5280. [protocol] Add support for displaying EDNS option LLQ. [GL #1201] 4652 4653 5279. [bug] When loading, reject zones containing CDS or CDNSKEY 4654 RRsets at the zone apex if they would cause DNSSEC 4655 validation failures if published in the parent zone 4656 as the DS RRset. [GL #1187] 4657 4658 5278. [func] Add YAML output formats for dig, mdig and delv; 4659 use the "+yaml" option to enable. [GL #1145] 4660 4661 .. code-block:: none 4662 4663 --- 9.15.3 released --- 4664 4665 5277. [bug] Cache DB statistics could underflow when serve-stale 4666 was in use, because of a bug in counter maintenance 4667 when RRsets become stale. 4668 4669 Functions for dumping statistics have been updated 4670 to dump active, stale, and ancient statistic 4671 counters. Ancient RRset counters are prefixed 4672 with '~'; stale RRset counters are still prefixed 4673 with '#'. [GL #602] 4674 4675 5276. [func] DNSSEC Lookaside Validation (DLV) is now obsolete; 4676 all code enabling its use has been removed from the 4677 validator, "delv", and the DNSSEC tools. [GL #7] 4678 4679 5275. [bug] Mark DS records included in referral messages 4680 with trust level "pending" so that they can be 4681 validated and cached immediately, with no need to 4682 re-query. [GL #964] 4683 4684 5274. [bug] Address potential use after free race when shutting 4685 down rpz. [GL #1175] 4686 4687 5273. [bug] Check that bits [64..71] of a dns64 prefix are zero. 4688 [GL #1159] 4689 4690 5272. [cleanup] Remove isc-config.sh script as the BIND 9 libraries 4691 are now purely internal. [GL #1123] 4692 4693 5271. [func] The normal (non-debugging) output of dnssec-signzone 4694 and dnssec-verify tools now goes to stdout, instead of 4695 the combination of stderr and stdout. 4696 4697 5270. [bug] 'dig +expandaaaa +short' did not work. [GL #1152] 4698 4699 5269. [port] cygwin: can return ETIMEDOUT on connect() with a 4700 non-blocking socket. [GL #1133] 4701 4702 5268. [placeholder] 4703 4704 5267. [func] Allow statistics groups display to be toggle-able. 4705 [GL #1030] 4706 4707 5266. [bug] named-checkconf failed to report dnstap-output 4708 missing from named.conf when dnstap was specified. 4709 [GL #1136] 4710 4711 5265. [bug] DNS64 and RPZ nodata (CNAME *.) rules interacted badly 4712 [GL #1106] 4713 4714 5264. [func] New DNS Cookie algorithm - siphash24 - has been added 4715 to BIND 9, and the old HMAC-SHA DNS Cookie algorithms 4716 have been removed. [GL #605] 4717 4718 .. code-block:: none 4719 4720 --- 9.15.2 released --- 4721 4722 5263. [cleanup] Use atomics and isc_refcount_t wherever possible. 4723 [GL #1038] 4724 4725 5262. [func] Removed support for the legacy GeoIP API. [GL #1112] 4726 4727 5261. [cleanup] Remove SO_BSDCOMPAT socket option usage. 4728 4729 5260. [bug] dnstap-read was producing malformed output for large 4730 packets. [GL #1093] 4731 4732 5259. [func] New option '-i' for 'named-checkconf' to ignore 4733 warnings about deprecated options. [GL #1101] 4734 4735 5258. [func] Added support for the GeoIP2 API from MaxMind. This 4736 will be compiled in by default if the "libmaxminddb" 4737 library is found at compile time, but can be 4738 suppressed using "configure --disable-geoip". 4739 4740 Certain geoip ACL settings that were available with 4741 legacy GeoIP are not available when using GeoIP2. 4742 [GL #182] 4743 4744 5257. [bug] Some statistics data was not being displayed. 4745 Add shading to the zone tables. [GL #1030] 4746 4747 5256. [bug] Ensure that glue records are included in root 4748 priming responses if "minimal-responses" is not 4749 set to "yes". [GL #1092] 4750 4751 5255. [bug] Errors encountered while reloading inline-signing 4752 zones could be ignored, causing the zone content to 4753 be left in an incompletely updated state rather than 4754 reverted. [GL #1109] 4755 4756 5254. [func] Collect metrics to report to the statistics-channel 4757 DNSSEC signing operations (dnssec-sign) and refresh 4758 operations (dnssec-refresh) per zone and per keytag. 4759 [GL #513] 4760 4761 5253. [port] Support platforms that don't define ULLONG_MAX. 4762 [GL #1098] 4763 4764 5252. [func] Report if the last 'rndc reload/reconfig' failed in 4765 rndc status. [GL !2040] 4766 4767 5251. [bug] Statistics were broken in x86 Windows builds. 4768 [GL #1081] 4769 4770 5250. [func] The default size for RSA keys is now 2048 bits, 4771 for both ZSKs and KSKs. [GL #1097] 4772 4773 5249. [bug] Fix a possible underflow in recursion clients 4774 statistics when hitting recursive clients 4775 soft quota. [GL #1067] 4776 4777 .. code-block:: none 4778 4779 --- 9.15.1 released --- 4780 4781 5248. [func] To clarify the configuration of DNSSEC keys, 4782 the "managed-keys" and "trusted-keys" options 4783 have both been deprecated. The new "dnssec-keys" 4784 statement can now be used for all trust anchors, 4785 with the keywords "iniital-key" or "static-key" 4786 to indicate whether the configured trust anchor 4787 should be used for initialization of RFC 5011 key 4788 management, or as a permanent trust anchor. 4789 4790 The "static-key" keyword will generate a warning if 4791 used for the root zone. 4792 4793 Configurations using "trusted-keys" or "managed-keys" 4794 will continue to work with no changes, but will 4795 generate warnings in the log. In a future release, 4796 these options will be marked obsolete. [GL #6] 4797 4798 5247. [cleanup] The 'cleaning-interval' option has been removed. 4799 [GL !1731] 4800 4801 5246. [func] Log TSIG if appropriate in 'sending notify to' message. 4802 [GL #1058] 4803 4804 5245. [cleanup] Reduce logging level for IXFR up-to-date poll 4805 responses. [GL #1009] 4806 4807 5244. [security] Fixed a race condition in dns_dispatch_getnext() 4808 that could cause an assertion failure if a 4809 significant number of incoming packets were 4810 rejected. (CVE-2019-6471) [GL #942] 4811 4812 5243. [bug] Fix a possible race between dispatcher and socket 4813 code in a high-load cold-cache resolver scenario. 4814 [GL #943] 4815 4816 5242. [bug] In relaxed qname minimization mode, fall back to 4817 normal resolution when encountering a lame 4818 delegation, and use _.domain/A queries rather 4819 than domain/NS. [GL #1055] 4820 4821 5241. [bug] Fix Ed448 private and public key ASN.1 prefix blobs. 4822 [GL #225] 4823 4824 5240. [bug] Remove key id calculation for RSAMD5. [GL #996] 4825 4826 5239. [func] Change the json-c detection to pkg-config. [GL #855] 4827 4828 5238. [bug] Fix a possible deadlock in TCP code. [GL #1046] 4829 4830 5237. [bug] Recurse to find the root server list with 'dig +trace'. 4831 [GL #1028] 4832 4833 5236. [func] Add SipHash 2-4 implementation in lib/isc/siphash.c 4834 and switch isc_hash_function() to use SipHash 2-4. 4835 [GL #605] 4836 4837 5235. [cleanup] Refactor lib/isc/app.c to be thread-safe, unused 4838 parts of the API has been removed and the 4839 isc_appctx_t data type has been changed to be 4840 fully opaque. [GL #1023] 4841 4842 5234. [port] arm: just use the compiler's default support for 4843 yield. [GL #981] 4844 4845 .. code-block:: none 4846 4847 --- 9.15.0 released --- 4848 4849 5233. [bug] Negative trust anchors did not work with "forward only;" 4850 to validating resolvers. [GL #997] 4851 4852 5232. [placeholder] 4853 4854 5231. [protocol] Add support for displaying CLIENT-TAG and SERVER-TAG. 4855 [GL #960] 4856 4857 5230. [protocol] The SHA-1 hash algorithm is no longer used when 4858 generating DS and CDS records. [GL #1015] 4859 4860 5229. [protocol] Enforce known SSHFP fingerprint lengths. [GL #852] 4861 4862 5228. [func] If trusted-keys and managed-keys were configured 4863 simultaneously for the same name, the key could 4864 not be be rolled automatically. This is now 4865 a fatal configuration error. [GL #868] 4866 4867 5227. [placeholder] 4868 4869 5226. [placeholder] 4870 4871 5225. [func] Allow dig to print out AAAA record fully expanded. 4872 with +[no]expandaaaa. [GL #765] 4873 4874 5224. [bug] Only test provide-ixfr on TCP streams. [GL #991] 4875 4876 5223. [bug] Fixed a race in the filter-aaaa plugin accessing 4877 the hash table. [GL #1005] 4878 4879 5222. [bug] 'delv -t ANY' could leak memory. [GL #983] 4880 4881 5221. [test] Enable parallel execution of system tests on 4882 Windows. [GL !4101] 4883 4884 5220. [cleanup] Refactor the isc_stat structure to take advantage 4885 of stdatomic. [GL !1493] 4886 4887 5219. [bug] Fixed a race in the filter-aaaa plugin that could 4888 trigger a crash when returning an instance object 4889 to the memory pool. [GL #982] 4890 4891 5218. [bug] Conditionally include <dlfcn.h>. [GL #995] 4892 4893 5217. [bug] Restore key id calculation for RSAMD5. [GL #996] 4894 4895 5216. [bug] Fetches-per-zone counter wasn't updated correctly 4896 when doing qname minimization. [GL #992] 4897 4898 5215. [bug] Change #5124 was incomplete; named could still 4899 return FORMERR instead of SERVFAIL in some cases. 4900 [GL #990] 4901 4902 5214. [bug] win32: named now removes its lock file upon shutdown. 4903 [GL #979] 4904 4905 5213. [bug] win32: Eliminated a race which allowed named.exe running 4906 as a service to be killed prematurely during shutdown. 4907 [GL #978] 4908 4909 5212. [placeholder] 4910 4911 5211. [bug] Allow out-of-zone additional data to be included 4912 in authoritative responses if recursion is allowed 4913 and "minimal-responses" is disabled. This behavior 4914 was inadvertently removed in change #4605. [GL #817] 4915 4916 5210. [bug] When dnstap is enabled and recursion is not 4917 available, incoming queries are now logged 4918 as "auth". Previously, this depended on whether 4919 recursion was requested by the client, not on 4920 whether recursion was available. [GL #963] 4921 4922 5209. [bug] When update-check-ksk is true, add_sigs was not 4923 considering offline keys, leaving record sets signed 4924 with the incorrect type key. [GL #763] 4925 4926 5208. [test] Run valid rdata wire encodings through totext+fromtext 4927 and tofmttext+fromtext methods to check these methods. 4928 [GL #899] 4929 4930 5207. [test] Check delv and dig TTL values. [GL #965] 4931 4932 5206. [bug] Delv could print out bad TTLs. [GL #965] 4933 4934 5205. [bug] Enforce that a DS hash exists. [GL #899] 4935 4936 5204. [test] Check that dns_rdata_fromtext() produces a record that 4937 will be accepted by dns_rdata_fromwire(). [GL #852] 4938 4939 5203. [bug] Enforce whether key rdata exists or not in KEY, 4940 DNSKEY, CDNSKEY and RKEY. [GL #899] 4941 4942 5202. [bug] <dns/ecs.h> was missing ISC_LANG_ENDDECLS. [GL #976] 4943 4944 5201. [bug] Fix a possible deadlock in RPZ update code. [GL #973] 4945 4946 5200. [security] tcp-clients settings could be exceeded in some cases, 4947 which could lead to exhaustion of file descriptors. 4948 (CVE-2018-5743) [GL #615] 4949 4950 5199. [security] In certain configurations, named could crash 4951 if nxdomain-redirect was in use and a redirected 4952 query resulted in an NXDOMAIN from the cache. 4953 (CVE-2019-6467) [GL #880] 4954 4955 5198. [bug] If a fetch context was being shut down and, at the same 4956 time, we returned from qname minimization, an INSIST 4957 could be hit. [GL #966] 4958 4959 5197. [bug] dig could die in best effort mode on multiple SIG(0) 4960 records. Similarly on multiple OPT and multiple TSIG 4961 records. [GL #920] 4962 4963 5196. [bug] make install failed with --with-dlopen=no. [GL #955] 4964 4965 5195. [bug] "allow-update" and "allow-update-forwarding" were 4966 treated as configuration errors if used at the 4967 options or view level. [GL #913] 4968 4969 5194. [bug] Enforce non empty ZOMEMD hash. [GL #899] 4970 4971 5193. [bug] EID and NIMLOC failed to do multi-line output 4972 correctly. [GL #899] 4973 4974 5192. [placeholder] 4975 4976 5191. [placeholder] 4977 4978 5190. [bug] Ignore trust anchors using disabled algorithms. 4979 [GL #806] 4980 4981 5189. [cleanup] Remove revoked root DNSKEY from bind.keys. [GL #945] 4982 4983 5188. [func] The "dnssec-enable" option is deprecated and no 4984 longer has any effect; DNSSEC responses are 4985 always enabled. [GL #866] 4986 4987 5187. [test] Set time zone before running any tests in dnstap_test. 4988 [GL #940] 4989 4990 5186. [cleanup] More dnssec-keygen manual tidying. [GL !1678] 4991 4992 5185. [placeholder] 4993 4994 5184. [bug] Missing unlocks in sdlz.c. [GL #936] 4995 4996 5183. [bug] Reinitialize ECS data before reusing client 4997 structures. [GL #881] 4998 4999 5182. [bug] Fix a high-load race/crash in handling of 5000 isc_socket_close() in resolver. [GL #834] 5001 5002 5181. [func] Add a mechanism for a DLZ module to signal that 5003 the view's allow-transfer ACL should be used to 5004 determine whether transfers are allowed. [GL #803] 5005 5006 5180. [bug] delv now honors the operating system's preferred 5007 ephemeral port range. [GL #925] 5008 5009 5179. [cleanup] Replace some vague type declarations with the more 5010 specific dns_secalg_t and dns_dsdigest_t. 5011 Thanks to Tony Finch. [GL !1498] 5012 5013 5178. [bug] Handle EDQUOT (disk quota) and ENOSPC (disk full) 5014 errors when writing files. [GL #902] 5015 5016 5177. [func] Add the ability to specify in named.conf whether a 5017 response-policy zone's SOA record should be added 5018 to the additional section (add-soa yes/no). [GL #865] 5019 5020 5176. [tests] Remove a dependency on libxml in statschannel system 5021 test. [GL #926] 5022 5023 5175. [bug] Fixed a problem with file input in dnssec-keymgr, 5024 dnssec-coverage and dnssec-checkds when using 5025 python3. [GL #882] 5026 5027 5174. [doc] Tidy dnssec-keygen manual. [GL !1557] 5028 5029 5173. [bug] Fixed a race in socket code that could occur when 5030 accept, send, or recv were called from an event 5031 loop but the socket had been closed by another 5032 thread. [RT #874] 5033 5034 5172. [bug] nsupdate now honors the operating system's preferred 5035 ephemeral port range. [GL #905] 5036 5037 5171. [func] named plugins are now installed into a separate 5038 directory. Supplying a filename (a string without path 5039 separators) in a "plugin" configuration stanza now 5040 causes named to look for that plugin in that directory. 5041 [GL #878] 5042 5043 5170. [test] Added --with-dlz-filesystem to feature-test. [GL !1587] 5044 5045 5169. [bug] The presence of certain types in an otherwise 5046 empty node could cause a crash while processing a 5047 type ANY query. [GL #901] 5048 5049 5168. [bug] Do not crash on shutdown when RPZ fails to load. Also, 5050 keep previous version of the database if RPZ fails to 5051 load. [GL #813] 5052 5053 5167. [bug] nxdomain-redirect could sometimes lookup the wrong 5054 redirect name. [GL #892] 5055 5056 5166. [placeholder] 5057 5058 5165. [contrib] Removed SDB drivers from contrib; they're obsolete. 5059 [GL #428] 5060 5061 5164. [bug] Correct errno to result translation in dlz filesystem 5062 modules. [GL #884] 5063 5064 5163. [cleanup] Out-of-tree builds failed --enable-dnstap. [GL #836] 5065 5066 5162. [cleanup] Improve dnssec-keymgr manual. Thanks to Tony Finch. 5067 [GL !1518] 5068 5069 5161. [bug] Do not require the SEP bit to be set for mirror zone 5070 trust anchors. [GL #873] 5071 5072 5160. [contrib] Added DNAME support to the DLZ LDAP schema. Also 5073 fixed a compilation bug affecting several DLZ 5074 modules. [GL #872] 5075 5076 5159. [bug] dnssec-coverage was incorrectly ignoring 5077 names specified on the command line without 5078 trailing dots. [GL !1478] 5079 5080 5158. [protocol] Add support for AMTRELAY and ZONEMD. [GL #867] 5081 5082 5157. [bug] Nslookup now errors out if there are extra command 5083 line arguments. [GL #207] 5084 5085 5156. [doc] Extended and refined the section of the ARM describing 5086 mirror zones. [GL #774] 5087 5088 5155. [func] "named -V" now outputs the default paths to 5089 named.conf, rndc.conf, bind.keys, and other 5090 files used or created by named and other tools, so 5091 that the correct paths to these files can quickly be 5092 determined regardless of the configure settings 5093 used when BIND was built. [GL #859] 5094 5095 5154. [bug] dig: process_opt could be called twice on the same 5096 message leading to a assertion failure. [GL #860] 5097 5098 5153. [func] Zone transfer statistics (size, number of records, and 5099 number of messages) are now logged for outgoing 5100 transfers as well as incoming ones. [GL #513] 5101 5102 5152. [func] Improved logging of DNSSEC key events: 5103 - Zone signing and DNSKEY maintenance events are 5104 now logged to the "dnssec" category 5105 - Messages are now logged when DNSSEC keys are 5106 published, activated, inactivated, deleted, 5107 or revoked. 5108 [GL #714] 5109 5110 5151. [func] Options that have been been marked as obsolete in 5111 named.conf for a very long time are now fatal 5112 configuration errors. [GL #358] 5113 5114 5150. [cleanup] Remove the ability to compile BIND with assertions 5115 disabled. [GL #735] 5116 5117 5149. [func] "rndc dumpdb" now prints a line above a stale RRset 5118 indicating how long the data will be retained in the 5119 cache for emergency use. [GL #101] 5120 5121 5148. [bug] named did not sign the TKEY response. [GL #821] 5122 5123 5147. [bug] dnssec-keymgr: Add a five-minute margin to better 5124 handle key events close to 'now'. [GL #848] 5125 5126 5146. [placeholder] 5127 5128 5145. [func] Use atomics instead of locked variables for isc_quota 5129 and isc_counter. [GL !1389] 5130 5131 5144. [bug] dig now returns a non-zero exit code when a TCP 5132 connection is prematurely closed by a peer more than 5133 once for the same lookup. [GL #820] 5134 5135 5143. [bug] dnssec-keymgr and dnssec-coverage failed to find 5136 key files for zone names ending in ".". [GL #560] 5137 5138 5142. [cleanup] Removed "configure --disable-rpz-nsip" and 5139 "--disable-rpz-nsdname" options. "nsip-enable" 5140 and "nsdname-enable" both now default to yes, 5141 regardless of compile-time settings. [GL #824] 5142 5143 5141. [security] Zone transfer controls for writable DLZ zones were 5144 not effective as the allowzonexfr method was not being 5145 called for such zones. (CVE-2019-6465) [GL #790] 5146 5147 5140. [bug] Don't immediately mark existing keys as inactive and 5148 deleted when running dnssec-keymgr for the first 5149 time. [GL #117] 5150 5151 5139. [bug] If possible, don't use forwarders when priming. 5152 This ensures we can get root server IP addresses 5153 from priming query response glue, which may not 5154 be present if the forwarding server is returning 5155 minimal responses. [GL #752] 5156 5157 5138. [bug] Under some circumstances named could hit an assertion 5158 failure when doing qname minimization when using 5159 forwarders. [GL #797] 5160 5161 5137. [func] named now logs messages whenever a mirror zone becomes 5162 usable or unusable for resolution purposes. [GL #818] 5163 5164 5136. [cleanup] Check in named-checkconf that allow-update and 5165 allow-update-forwarding are not set at the 5166 view/options level; fix documentation. [GL #512] 5167 5168 5135. [port] sparc: Use smt_pause() instead of pause. [GL #816] 5169 5170 5134. [bug] win32: WSAStartup was not called before getservbyname 5171 was called. [GL #590] 5172 5173 5133. [bug] 'rndc managed-keys' didn't handle class and view 5174 correctly and failed to add new lines between each 5175 view. [GL !1327] 5176 5177 5132. [bug] Fix race condition in cleanup part of dns_dt_create(). 5178 [GL !1323] 5179 5180 5131. [cleanup] Address Coverity warnings. [GL #801] 5181 5182 5130. [cleanup] Remove support for l10n message catalogs. [GL #709] 5183 5184 5129. [contrib] sdlz_helper.c:build_querylist was not properly 5185 splitting the query string. [GL #798] 5186 5187 5128. [bug] Refreshkeytime was not being updated for managed 5188 keys zones. [GL #784] 5189 5190 5127. [bug] rcode.c:maybe_numeric failed to handle NUL in text 5191 regions. [GL #807] 5192 5193 5126. [bug] Named incorrectly accepted empty base64 and hex encoded 5194 fields when reading master files. [GL #807] 5195 5196 5125. [bug] Allow for up to 100 records or 64k of data when caching 5197 a negative response. [GL #804] 5198 5199 5124. [bug] Named could incorrectly return FORMERR rather than 5200 SERVFAIL. [GL #804] 5201 5202 5123. [bug] dig could hang indefinitely after encountering an error 5203 before creating a TCP socket. [GL #692] 5204 5205 5122. [bug] In a "forward first;" configuration, a forwarder 5206 timeout did not prevent that forwarder from being 5207 queried again after falling back to full recursive 5208 resolution. [GL #315] 5209 5210 5121. [contrib] dlz_stub_driver.c fails to return ISC_R_NOTFOUND on none 5211 matching zone names. [GL !1299] 5212 5213 5120. [placeholder] 5214 5215 5119. [placeholder] 5216 5217 5118. [security] Named could crash if it is managing a key with 5218 `managed-keys` and the authoritative zone is rolling 5219 the key to an unsupported algorithm. (CVE-2018-5745) 5220 [GL #780] 5221 5222 5117. [placeholder] 5223 5224 5116. [bug] Named/named-checkconf triggered a assertion when 5225 a mirror zone's name is bad. [GL #778] 5226 5227 5115. [bug] Allow unsupported algorithms in zone when not used for 5228 signing with dnssec-signzone. [GL #783] 5229 5230 5114. [func] Include a 'reconfig/reload in progress' status line 5231 in rndc status, use it in tests. 5232 5233 5113. [port] Fixed a Windows build error. 5234 5235 5112. [bug] Named/named-checkconf could dump core if there was 5236 a missing masters clause and a bad notify clause. 5237 [GL #779] 5238 5239 5111. [bug] Occluded DNSKEY records could make it into the 5240 delegating NSEC/NSEC3 bitmap. [GL #742] 5241 5242 5110. [security] Named leaked memory if there were multiple Key Tag 5243 EDNS options present. (CVE-2018-5744) [GL #772] 5244 5245 5109. [cleanup] Remove support for RSAMD5 algorithm. [GL #628] 5246 5247 .. code-block:: none 5248 5249 --- 9.13.5 released --- 5250 5251 5108. [bug] Named could fail to determine bottom of zone when 5252 removing out of date keys leading to invalid NSEC 5253 and NSEC3 records being added to the zone. [GL #771] 5254 5255 5107. [bug] 'host -U' did not work. [GL #769] 5256 5257 5106. [experimental] A new "plugin" mechanism has been added to allow 5258 extension of query processing functionality through 5259 the use of dynamically loadable libraries. A 5260 "filter-aaaa.so" plugin has been implemented, 5261 replacing the filter-aaaa feature that was formerly 5262 implemented as a native part of BIND. 5263 5264 The "filter-aaaa", "filter-aaaa-on-v4" and 5265 "filter-aaaa-on-v6" options can no longer be 5266 configured using native named.conf syntax. However, 5267 loading the filter-aaaa.so plugin and setting its 5268 parameters provides identical functionality. 5269 5270 Note that the plugin API is a work in progress and 5271 is likely to evolve as further plugins are 5272 implemented. [GL #15] 5273 5274 5105. [bug] Fix a race between process_fd and socketclose in 5275 unix socket code. [GL #744] 5276 5277 5104. [cleanup] Log clearer informational message when a catz zone 5278 is overridden by a zone in named.conf. 5279 Thanks to Tony Finch. [GL !1157] 5280 5281 5103. [bug] Add missing design by contract tests to dns_catz*. 5282 [GL #748] 5283 5284 5102. [bug] dnssec-coverage failed to use the default TTL when 5285 checking KSK deletion times leading to a exception. 5286 [GL #585] 5287 5288 5101. [bug] Fix default installation path for Python modules and 5289 remove the dnspython dependency accidentally introduced 5290 by change 4970. [GL #730] 5291 5292 5100. [func] Pin resolver tasks to specific task queues. [GL !1117] 5293 5294 5099. [func] Failed mutex and conditional creations are always 5295 fatal. [GL #674] 5296 5297 .. code-block:: none 5298 5299 --- 9.13.4 released --- 5300 5301 5098. [func] Failed memory allocations are now fatal. [GL #674] 5302 5303 5097. [cleanup] Remove embedded ATF unit testing framework 5304 from BIND source distribution. [GL !875] 5305 5306 5096. [func] Use multiple event loops in socket code, and 5307 make network threads CPU-affinitive. This 5308 significantly improves performance on large 5309 systems. [GL #666] 5310 5311 5095. [test] Converted all unit tests from ATF to CMocka; 5312 removed the source code for the ATF libraries. 5313 Build with "configure --with-cmocka" to enable 5314 unit testing. [GL #620] 5315 5316 5094. [func] Add 'dig -r' to disable reading of .digrc. [GL !970] 5317 5318 5093. [bug] Log lame qname-minimization servers only if they're 5319 really lame. [GL #671] 5320 5321 5092. [bug] Address memory leak on SIGTERM in nsupdate when using 5322 GSS-TSIG. [GL #558] 5323 5324 5091. [func] Two new global and per-view options min-cache-ttl 5325 and min-ncache-ttl [GL #613] 5326 5327 5090. [bug] dig and mdig failed to properly pre-parse dash value 5328 pairs when value was a separate argument and started 5329 with a dash. [GL #584] 5330 5331 5089. [bug] Restore localhost fallback in dig and host which is 5332 used when no nameserver addresses present in 5333 /etc/resolv.conf are usable due to the requested 5334 address family restrictions. [GL #433] 5335 5336 5088. [bug] dig/host/nslookup could crash when interrupted close to 5337 a query timeout. [GL #599] 5338 5339 5087. [test] Check that result tables are complete. [GL #676] 5340 5341 5086. [func] Log of RPZ now includes the QTYPE and QCLASS. [GL #623] 5342 5343 5085. [bug] win32: Restore looking up nameservers, search list, 5344 etc. [GL #186] 5345 5346 5084. [placeholder] 5347 5348 5083. [func] Add autoconf macro AX_POSIX_SHELL, so we 5349 can use POSIX-compatible shell features 5350 in the scripts. 5351 5352 5082. [bug] Fixed a race that could cause a crash in 5353 dig/host/nslookup. [GL #650] 5354 5355 5081. [func] Use per-worker queues in task manager, make task 5356 runners CPU-affine. [GL #659] 5357 5358 5080. [func] Improvements to "rndc nta" user interface: 5359 - catch and report invalid command line options 5360 - when removing an NTA from all views, do not 5361 abort with an error if the NTA was not found 5362 in one of the views 5363 - include the view name in "rndc nta -dump" 5364 output, for consistency with the add and remove 5365 actions 5366 Thanks to Tony Finch. [GL !816] 5367 5368 5079. [func] Disable IDN processing in dig and nslookup 5369 when not on a tty. [GL #653] 5370 5371 5078. [cleanup] Require python components to be explicitly disabled if 5372 python is not available on unix platforms. [GL #601] 5373 5374 5077. [cleanup] Remove ip6.int support (-i) from dig and mdig. 5375 [GL !969] 5376 5377 5076. [bug] "require-server-cookie" was not effective if 5378 "rate-limit" was configured. [GL #617] 5379 5380 5075. [bug] Refresh nameservers from cache when sending final 5381 query in qname minimization. [GL #16] 5382 5383 5074. [cleanup] Remove vector socket functions - isc_socket_recvv(), 5384 isc_socket_sendtov(), isc_socket_sendtov2(), 5385 isc_socket_sendv() - in order to simplify socket code. 5386 [GL #645] 5387 5388 5073. [bug] Destroy a task first when destroying rpzs and catzs. 5389 [GL #84] 5390 5391 5072. [bug] Add unit tests for isc_buffer_copyregion() and fix its 5392 behavior for auto-reallocated buffers. [GL #644] 5393 5394 5071. [bug] Comparison of NXT records was broken. [GL #631] 5395 5396 5070. [bug] Record types which support a empty rdata field were 5397 not handling the empty rdata field case. [GL #638] 5398 5399 5069. [bug] Fix a hang on in RPZ when named is shutdown during RPZ 5400 zone update. [GL !907] 5401 5402 5068. [bug] Fix a race in RPZ with min-update-interval set to 0. 5403 [GL #643] 5404 5405 5067. [bug] Don't minimize qname when sending the query 5406 to a forwarder. [GL #361] 5407 5408 5066. [cleanup] Allow unquoted strings to be used as a zone names 5409 in response-policy statements. [GL #641] 5410 5411 5065. [bug] Only set IPV6_USE_MIN_MTU on IPv6. [GL #553] 5412 5413 5064. [test] Initialize TZ environment variable before calling 5414 dns_test_begin in dnstap_test. [GL #624] 5415 5416 5063. [test] In statschannel test try a few times before failing 5417 when checking if the compressed output is the same as 5418 uncompressed. [GL !909] 5419 5420 5062. [func] Use non-crypto-secure PRNG to generate nonces for 5421 cookies. [GL !887] 5422 5423 5061. [protocol] Add support for EID and NIMLOC. [GL #626] 5424 5425 5060. [bug] GID, UID and UINFO could not be loaded using unknown 5426 record format. [GL #627] 5427 5428 5059. [bug] Display a per-view list of zones in the web interface. 5429 [GL #427] 5430 5431 5058. [func] Replace old message digest and hmac APIs with more 5432 generic isc_md and isc_hmac APIs, and convert their 5433 respective tests to cmocka. [GL #305] 5434 5435 5057. [protocol] Add support for ATMA. [GL #619] 5436 5437 5056. [placeholder] 5438 5439 5055. [func] A default list of primary servers for the root zone is 5440 now built into named, allowing the "masters" statement 5441 to be omitted when configuring an IANA root zone 5442 mirror. [GL #564] 5443 5444 5054. [func] Attempts to use mirror zones with recursion disabled 5445 are now considered a configuration error. [GL #564] 5446 5447 5053. [func] The only valid zone-level NOTIFY settings for mirror 5448 zones are now "notify no;" and "notify explicit;". 5449 [GL #564] 5450 5451 5052. [func] Mirror zones are now configured using "type mirror;" 5452 rather than "mirror yes;". [GL #564] 5453 5454 5051. [doc] Documentation incorrectly stated that the 5455 "server-addresses" static-stub zone option accepts 5456 custom port numbers. [GL #582] 5457 5458 5050. [bug] The libirs version of getaddrinfo() was unable to parse 5459 scoped IPv6 addresses present in /etc/resolv.conf. 5460 [GL #187] 5461 5462 5049. [cleanup] QNAME minimization has been deeply refactored. [GL #16] 5463 5464 5048. [func] Add configure option to enable and enforce FIPS mode 5465 in BIND 9. [GL #506] 5466 5467 5047. [bug] Messages logged for certain query processing failures 5468 now include a more specific error description if it is 5469 available. [GL #572] 5470 5471 5046. [bug] named could crash during shutdown if an RPZ 5472 reload was in progress. [RT #46210] 5473 5474 5045. [func] Remove support for DNSSEC algorithms 3 (DSA) 5475 and 6 (DSA-NSEC3-SHA1). [GL #22] 5476 5477 5044. [cleanup] If "dnssec-enable" is no, then "dnssec-validation" 5478 now also defaults to no. [GL #388] 5479 5480 5043. [bug] Fix creating and validating EdDSA signatures. [GL #579] 5481 5482 5042. [test] Make the chained delegations in reclimit behave 5483 like they would in a regular name server. [GL #578] 5484 5485 5041. [test] The chain test contains a incomplete delegation. 5486 [GL #568] 5487 5488 5040. [func] Extended dnstap so that it can log UPDATE requests 5489 and responses as separate message types. Thanks 5490 to Greg Rabil. [GL #570] 5491 5492 5039. [bug] Named could fail to preserve owner name case of new 5493 RRset. [GL #420] 5494 5495 5038. [bug] Chaosnet addresses were compared incorrectly. 5496 [GL #562] 5497 5498 5037. [func] "allow-recursion-on" and "allow-query-cache-on" 5499 each now default to the other if only one of them 5500 is set, in order to be more consistent with the way 5501 "allow-recursion" and "allow-query-cache" work. 5502 Also we now ensure that both query-cache ACLs are 5503 checked when determining cache access. [GL #319] 5504 5505 5036. [cleanup] Fixed a spacing/formatting error in some RPZ-related 5506 error messages in the log. [GL !805] 5507 5508 5035. [test] Fixed errors that prevented the DNSRPS subtests 5509 from running in the rpz and rpzrecurse system 5510 tests. [GL #503] 5511 5512 5034. [bug] A race between threads could prevent zone maintenance 5513 scheduled immediately after zone load from being 5514 performed. [GL #542] 5515 5516 5033. [bug] When adding NTAs to multiple views using "rndc nta", 5517 the text returned via rndc was incorrectly terminated 5518 after the first line, making it look as if only one 5519 NTA had been added. Also, it was not possible to 5520 differentiate between views with the same name but 5521 different classes; this has been corrected with the 5522 addition of a "-class" option. [GL #105] 5523 5524 5032. [func] Add krb5-selfsub and ms-selfsub update policy rules. 5525 [GL #511] 5526 5527 5031. [cleanup] Various defines in platform.h has been either dropped 5528 if always or never triggered on supported platforms 5529 or replaced with config.h equivalents if the defines 5530 didn't have any impact on public headers. Workarounds 5531 for LinuxThreads have been removed because NPTL is 5532 available since Linux kernel 2.6.0. [GL #525] 5533 5534 5030. [bug] Align CMSG buffers to a 64-bit boundary, fixes crash 5535 on architectures with strict alignment. [GL #521] 5536 5537 .. code-block:: none 5538 5539 --- 9.13.3 released --- 5540 5541 5029. [func] Workarounds for servers that misbehave when queried 5542 with EDNS have been removed, because these broken 5543 servers and the workarounds for their noncompliance 5544 cause unnecessary delays, increase code complexity, 5545 and prevent deployment of new DNS features. See 5546 https://dnsflagday.net for further details. [GL #150] 5547 5548 5028. [bug] Spread the initial RRSIG expiration times over the 5549 entire working sig-validity-interval when signing a 5550 zone in named to even out re-signing and transfer 5551 loads. [GL #418] 5552 5553 5027. [func] Set SO_SNDBUF size on sockets. [GL #74] 5554 5555 5026. [bug] rndc reconfig should not touch already loaded zones. 5556 [GL #276] 5557 5558 5025. [cleanup] Remove isc_keyboard family of functions. [GL #178] 5559 5560 5024. [func] Replace custom assembly for atomic operations with 5561 atomic support from the compiler. The code will now use 5562 C11 stdatomic, or __atomic, or __sync builtins with GCC 5563 or Clang compilers, and Interlocked functions with MSVC. 5564 [GL #10] 5565 5566 5023. [cleanup] Remove wrappers that try to fix broken or incomplete 5567 implementations of IPv6, pthreads and other core 5568 functionality required and used by BIND. [GL #192] 5569 5570 5022. [doc] Update ms-self, ms-subdomain, krb5-self, and 5571 krb5-subdomain documentation. [GL !708] 5572 5573 5021. [bug] dig returned a non-zero exit code when it received a 5574 reply over TCP after a retry. [GL #487] 5575 5576 5020. [func] RNG uses thread-local storage instead of locks, if 5577 supported by platform. [GL #496] 5578 5579 5019. [cleanup] A message is now logged when ixfr-from-differences is 5580 set at zone level for an inline-signed zone. [GL #470] 5581 5582 5018. [bug] Fix incorrect sizeof arguments in lib/isc/pk11.c. 5583 [GL !588] 5584 5585 5017. [bug] lib/isc/pk11.c failed to unlink the session before 5586 releasing the lock which is unsafe. [GL !589] 5587 5588 5016. [bug] Named could assert with overlapping filter-aaaa and 5589 dns64 acls. [GL #445] 5590 5591 5015. [bug] Reloading all zones caused zone maintenance to cease 5592 for inline-signed zones. [GL #435] 5593 5594 5014. [bug] Signatures loaded from the journal for the signed 5595 version of an inline-signed zone were not scheduled for 5596 refresh. [GL #482] 5597 5598 5013. [bug] A referral response with a non-empty ANSWER section was 5599 inadvertently being treated as an error. [GL #390] 5600 5601 5012. [bug] Fix lock order reversal in pk11_initialize. [GL !590] 5602 5603 5011. [func] Remove support for unthreaded named. [GL #478] 5604 5605 5010. [func] New "validate-except" option specifies a list of 5606 domains beneath which DNSSEC validation should not 5607 be performed. [GL #237] 5608 5609 5009. [bug] Upon an OpenSSL failure, the first error in the OpenSSL 5610 error queue was not logged. [GL #476] 5611 5612 5008. [bug] "rndc signing -nsec3param ..." requests were silently 5613 ignored for zones which were not yet loaded or 5614 transferred. [GL #468] 5615 5616 5007. [cleanup] Replace custom ISC boolean and integer data types 5617 with C99 stdint.h and stdbool.h types. [GL #9] 5618 5619 5006. [cleanup] Code preparing a delegation response was extracted from 5620 query_delegation() and query_zone_delegation() into a 5621 separate function in order to decrease code 5622 duplication. [GL #431] 5623 5624 5005. [bug] dnssec-verify, and dnssec-signzone at the verification 5625 step, failed on some validly signed zones. [GL #442] 5626 5627 5004. [bug] 'rndc reconfig' could cause inline zones to stop 5628 re-signing. [GL #439] 5629 5630 5003. [bug] dns_acl_isinsecure did not handle geoip elements. 5631 [GL #406] 5632 5633 5002. [bug] mdig: Handle malformed +ednsopt option, support 100 5634 +ednsopt options per query rather than 100 total and 5635 address memory leaks if +ednsopt was specified. 5636 [GL #410] 5637 5638 5001. [bug] Fix refcount errors on error paths. [GL !563] 5639 5640 5000. [bug] named_server_servestale() could leave the server in 5641 exclusive mode if an error occurred. [GL #441] 5642 5643 4999. [cleanup] Remove custom printf implementation in lib/isc/print.c. 5644 [GL #261] 5645 5646 4998. [test] Make resolver and cacheclean tests more civilized. 5647 5648 4997. [security] named could crash during recursive processing 5649 of DNAME records when "deny-answer-aliases" was 5650 in use. (CVE-2018-5740) [GL #387] 5651 5652 4996. [bug] dig: Handle malformed +ednsopt option. [GL #403] 5653 5654 4995. [test] Add tests for "tcp-self" update policy. [GL !282] 5655 5656 4994. [bug] Trust anchor telemetry queries were not being sent 5657 upstream for locally served zones. [GL #392] 5658 5659 4993. [cleanup] Remove support for silently ignoring 'no-change' deltas 5660 from BIND 8 when processing an IXFR stream. 'no-change' 5661 deltas will now trigger a fallback to AXFR as the 5662 recovery mechanism. [GL #369] 5663 5664 4992. [bug] The wrong address was being logged for trust anchor 5665 telemetry queries. [GL #379] 5666 5667 4991. [bug] "rndc reconfig" was incorrectly handling zones whose 5668 "mirror" setting was changed. [GL #381] 5669 5670 4990. [bug] Prevent a possible NULL reference in pkcs11-keygen. 5671 [GL #401] 5672 5673 4989. [cleanup] IDN support in dig has been reworked. IDNA2003 5674 fallbacks were removed in the process. [GL #384] 5675 5676 4988. [bug] Don't synthesize NXDOMAIN from NSEC for records under 5677 a DNAME. 5678 5679 .. code-block:: none 5680 5681 --- 9.13.2 released --- 5682 5683 4987. [cleanup] dns_rdataslab_tordataset() and its related 5684 dns_rdatasetmethods_t callbacks were removed as they 5685 were not being used by anything in BIND. [GL #371] 5686 5687 4986. [func] When built on Linux, BIND now requires the libcap 5688 library to set process privileges, unless capability 5689 support is explicitly overridden with "configure 5690 --disable-linux-caps". [GL #321] 5691 5692 4985. [func] Add a new slave zone option, "mirror", to enable 5693 serving a non-authoritative copy of a zone that 5694 is subject to DNSSEC validation before being 5695 used. For now, this option is only meant to 5696 facilitate deployment of an RFC 7706-style local 5697 copy of the root zone. [GL #33] 5698 5699 4984. [bug] Improve handling of very large incremental 5700 zone transfers to prevent journal corruption. [GL #339] 5701 5702 4983. [func] Add the ability to not return a DNS COOKIE option 5703 when one is present in the request (answer-cookie no;). 5704 [GL #173] 5705 5706 4982. [cleanup] Return FORMERR if the question section is empty 5707 and no COOKIE option is present; this restores 5708 older behavior except in the newly specified 5709 COOKIE case. [GL #260] 5710 5711 4981. [bug] Fix race in cmsg buffer usage in socket code. 5712 [GL #180] 5713 5714 4980. [bug] Named-checkconf failed to detect bad in-view targets. 5715 [GL #288] 5716 5717 4979. [placeholder] 5718 5719 4978. [test] Fix error handling and resolver configuration in the 5720 "rpz" system test. [GL #312] 5721 5722 4977. [func] When starting up, log the same details that 5723 would be reported by 'named -V'. [GL #247] 5724 5725 4976. [bug] Log the label with invalid prefix length correctly 5726 when loading RPZ zones. [GL #254] 5727 5728 4975. [bug] The server cookie computation for sha1 and sha256 did 5729 not match the method described in RFC 7873. [GL #356] 5730 5731 4974. [bug] Restore default rrset-order to random. [GL #336] 5732 5733 4973. [func] verifyzone() and the functions it uses were moved to 5734 libdns and refactored to prevent exit() from being 5735 called upon failure. A side effect of that is that 5736 dnssec-signzone and dnssec-verify now check for memory 5737 leaks upon shutdown. [GL #266] 5738 5739 4972. [func] Declare the 'rdata' argument for dns_rdata_tostruct() 5740 to be const. [GL #341] 5741 5742 4971. [bug] dnssec-signzone and dnssec-verify did not treat records 5743 below a DNAME as out-of-zone data. [GL #298] 5744 5745 4970. [func] Add QNAME minimization option to resolver. [GL #16] 5746 5747 4969. [cleanup] Refactor zone logging functions. [GL #269] 5748 5749 .. code-block:: none 5750 5751 --- 9.13.1 released --- 5752 5753 4968. [bug] If glue records are signed, attempt to validate them. 5754 [GL #209] 5755 5756 4967. [cleanup] Add "answer-cookie" to the parser, marked obsolete. 5757 5758 4966. [placeholder] 5759 5760 4965. [func] Add support for marking options as deprecated. 5761 [GL #322] 5762 5763 4964. [bug] Reduce the probability of double signature when deleting 5764 a DNSKEY by checking if the node is otherwise signed 5765 by the algorithm of the key to be deleted. [GL #240] 5766 5767 4963. [test] ifconfig.sh now uses "ip" instead of "ifconfig", 5768 if available, to configure the test interfaces on 5769 linux. [GL #302] 5770 5771 4962. [cleanup] Move 'named -T' processing to its own function. 5772 [GL #316] 5773 5774 4961. [protocol] Remove support for ECC-GOST (GOST R 34.11-94). 5775 [GL #295] 5776 5777 4960. [security] When recursion is enabled, but the "allow-recursion" 5778 and "allow-query-cache" ACLs are not specified, 5779 they should be limited to local networks, 5780 but were inadvertently set to match the default 5781 "allow-query", thus allowing remote queries. 5782 (CVE-2018-5738) [GL #309] 5783 5784 4959. [func] NSID logging (enabled by the "request-nsid" option) 5785 now has its own "nsid" category, instead of using the 5786 "resolver" category. [GL !332] 5787 5788 4958. [bug] Remove redundant space from NSEC3 record. [GL #281] 5789 5790 4957. [func] The default setting for "dnssec-validation" is now 5791 "auto", which activates DNSSEC validation using the 5792 IANA root key. (The default can be changed back to 5793 "yes", which activates DNSSEC validation only when keys 5794 are explicitly configured in named.conf, by building 5795 BIND with "configure --disable-auto-validation".) 5796 [GL #30] 5797 5798 4956. [func] Change isc_random() to be just PRNG using xoshiro128**, 5799 and add isc_nonce_buf() that uses CSPRNG. [GL #289] 5800 5801 4955. [cleanup] Silence cppcheck warnings in lib/dns/master.c. 5802 [GL #286] 5803 5804 4954. [func] Messages about serving of stale answers are now 5805 directed to the "serve-stale" logging category. 5806 Also clarified serve-stale documentation. [GL !323] 5807 5808 4953. [bug] Removed the option to build the red black tree 5809 database without a hash table; the non-hashing 5810 version was buggy and is not needed. [GL #184] 5811 5812 4952. [func] Authoritative server support in named for the 5813 EDNS CLIENT-SUBNET option (which was experimental 5814 and not practical to deploy) has been removed. 5815 5816 The ECS option is still supported in dig and mdig 5817 via the +subnet option, and can be parsed and logged 5818 when received by named, but it is no longer used 5819 for ACL processing. The "geoip-use-ecs" option 5820 is now obsolete; a warning will be logged if it is 5821 used in named.conf. "ecs" tags in an ACL definition 5822 are also obsolete and will cause the configuration 5823 to fail to load. [GL #32] 5824 5825 4951. [protocol] Add "HOME.ARPA" to list of built in empty zones as 5826 per RFC 8375. [GL #273] 5827 5828 .. code-block:: none 5829 5830 --- 9.13.0 released --- 5831 5832 4950. [bug] ISC_SOCKEVENTATTR_TRUNC was not be set. [GL #238] 5833 5834 4949. [placeholder] 5835 5836 4948. [bug] When request-nsid is turned on, EDNS NSID options 5837 should be logged at level info. Since change 3741 5838 they have been logged at debug(3) by mistake. 5839 [GL !290] 5840 5841 4947. [func] Replace all random functions with isc_random(), 5842 isc_random_buf() and isc_random_uniform() API. 5843 [GL #221] 5844 5845 4946. [bug] Additional glue was not being returned by resolver 5846 for unsigned zones since change 4596. [GL #209] 5847 5848 4945. [func] BIND can no longer be built without DNSSEC support. 5849 A cryptography provider (i.e., OpenSSL or a hardware 5850 service module with PKCS#11 support) must be 5851 available. [GL #244] 5852 5853 4944. [cleanup] Silence cppcheck portability warnings in 5854 lib/isc/tests/buffer_test.c. [GL #239] 5855 5856 4943. [bug] Change 4687 consumed too much memory when running 5857 system tests with --with-tuning=large. Reduced the 5858 hash table size to 512 entries for 'named -m record' 5859 restoring the previous memory footprint. [GL #248] 5860 5861 4942. [cleanup] Consolidate multiple instances of splitting of 5862 batchline in dig into a single function. [GL #196] 5863 5864 4941. [cleanup] Silence clang static analyzer warnings. [GL #196] 5865 5866 4940. [cleanup] Extract the loop in dns__zone_updatesigs() into 5867 separate functions to improve code readability. 5868 [GL #135] 5869 5870 4939. [test] Add basic unit tests for update_sigs(). [GL #135] 5871 5872 4938. [placeholder] 5873 5874 4937. [func] Remove support for OpenSSL < 1.0.0 [GL #191] 5875 5876 4936. [func] Always use OpenSSL or PKCS#11 random data providers, 5877 and remove the --{enable,disable}-crypto-rand configure 5878 options. [GL #165] 5879 5880 4935. [func] Add support for LibreSSL >= 2.7.0 (some OpenSSL 1.1.0 5881 call were added). [GL #191] 5882 5883 4934. [security] The serve-stale feature could cause an assertion failure 5884 in rbtdb.c even when stale-answer-enable was false. 5885 Simultaneous use of stale cache records and NSEC 5886 aggressive negative caching could trigger a recursion 5887 loop. (CVE-2018-5737) [GL #185] 5888 5889 4933. [bug] Not creating signing keys for an inline signed zone 5890 prevented changes applied to the raw zone from being 5891 reflected in the secure zone until signing keys were 5892 made available. [GL #159] 5893 5894 4932. [bug] Bumped signed serial of an inline signed zone was 5895 logged even when an error occurred while updating 5896 signatures. [GL #159] 5897 5898 4931. [func] Removed the "rbtdb64" database implementation. 5899 [GL #217] 5900 5901 4930. [bug] Remove a bogus check in nslookup command line 5902 argument processing. [GL #206] 5903 5904 4929. [func] Add the ability to set RA and TC in queries made by 5905 dig (+[no]raflag, +[no]tcflag). [GL #213] 5906 5907 4928. [func] The "dnskey-sig-validity" option allows 5908 "sig-validity-interval" to be overridden for signatures 5909 covering DNSKEY RRsets. [GL #145] 5910 5911 4927. [placeholder] 5912 5913 4926. [func] Add root key sentinel support. To disable, add 5914 'root-key-sentinel no;' to named.conf. [GL #37] 5915 5916 4925. [func] Several configuration options that define intervals 5917 can now take TTL value suffixes (for example, 2h or 1d) 5918 in addition to integer parameters. These include 5919 max-cache-ttl, max-ncache-ttl, max-policy-ttl, 5920 fstrm-set-reopen-interval, interface-interval, and 5921 min-update-interval. [GL #203] 5922 5923 4924. [cleanup] Clean up the isc_string_* namespace and leave 5924 only strlcpy and strlcat. [GL #178] 5925 5926 4923. [cleanup] Refactor socket and socket event options into 5927 enum types. [GL !135] 5928 5929 4922. [bug] dnstap: Log the destination address of client 5930 packets rather than the interface address. 5931 [GL #197] 5932 5933 4921. [cleanup] Add dns_fixedname_initname() and refactor the caller 5934 code to make usage of the new function, as a part of 5935 refactoring dns_fixedname_*() macros were turned into 5936 functions. [GL #183] 5937 5938 4920. [cleanup] Clean up libdns removing most of the backwards 5939 compatibility wrappers. 5940 5941 4919. [cleanup] Clean up the isc_hash_* namespace and leave only 5942 the FNV-1a hash implementation. [GL #178] 5943 5944 4918. [bug] Fix double free after keygen error in dnssec-keygen 5945 when OpenSSL >= 1.1.0 is used and RSA_generate_key_ex 5946 fails. [GL #109] 5947 5948 4917. [func] Support 64 RPZ policy zones by default. [GL #123] 5949 5950 4916. [func] Remove IDNA2003 support and the bundled idnkit-1.0 5951 library. 5952 5953 4915. [func] Implement IDNA2008 support in dig by adding support 5954 for libidn2. New dig option +idnin has been added, 5955 which allows to process invalid domain names much 5956 like dig without IDN support. libidn2 version 2.0 5957 or higher is needed for +idnout enabled by default. 5958 5959 4914. [security] A bug in zone database reference counting could lead to 5960 a crash when multiple versions of a slave zone were 5961 transferred from a master in close succession. 5962 (CVE-2018-5736) [GL #134] 5963 5964 4913. [test] Re-implemented older unit tests in bin/tests as ATF, 5965 removed the lib/tests unit testing library. [GL #115] 5966 5967 4912. [test] Improved the reliability of the 'cds' system test. 5968 [GL #136] 5969 5970 4911. [test] Improved the reliability of the 'mkeys' system test. 5971 [GL #128] 5972 5973 4910. [func] Update util/check-changes to work on release branches. 5974 [GL #113] 5975 5976 4909. [bug] named-checkconf did not detect in-view zone collisions. 5977 [GL #125] 5978 5979 4908. [test] Eliminated unnecessary waiting in the allow_query 5980 system test. Also changed its name to allow-query. 5981 [GL #81] 5982 5983 4907. [test] Improved the reliability of the 'notify' system 5984 test. [GL #59] 5985 5986 4906. [func] Replace getquad() with inet_pton(), completing 5987 change #4900. [GL #56] 5988 5989 4905. [bug] irs_resconf_load() ignored resolv.conf syntax errors 5990 when "domain" or "search" options were present in that 5991 file. [GL #110] 5992 5993 4904. [bug] Temporarily revert change #4859. [GL #124] 5994 5995 4903. [bug] "check-mx fail;" did not prevent MX records containing 5996 IP addresses from being added to a zone by a dynamic 5997 update. [GL #112] 5998 5999 4902. [test] Improved the reliability of the 'ixfr' system 6000 test. [GL #66] 6001 6002 4901. [func] "dig +nssearch" now lists the name servers 6003 for a domain that time out, as well as the servers 6004 that respond. [GL #64] 6005 6006 4900. [func] Remove all uses of inet_aton(). As a result of this 6007 change, IPv4 addresses are now only accepted in 6008 dotted-quad format. [GL #13] 6009 6010 4899. [test] Convert most of the remaining system tests to be able 6011 to run in parallel, continuing the work from change 6012 #4895. To take advantage of this, use "make -jN check", 6013 where N is the number of processors to use. [GL #91] 6014 6015 4898. [func] Remove libseccomp based system-call filtering. [GL #93] 6016 6017 4897. [test] Update to rpz system test so that it doesn't recurse. 6018 [GL #68] 6019 6020 4896. [test] cacheclean system test was not robust. [GL #82] 6021 6022 4895. [test] Allow some system tests to run in parallel. 6023 [RT #46602] 6024 6025 4894. [bug] named could crash while rolling a dnstap output file. 6026 [RT #46942] 6027 6028 4893. [bug] Address various issues reported by cppcheck. [GL #51] 6029 6030 4892. [bug] named could leak memory when "rndc reload" was invoked 6031 before all zone loading actions triggered by a previous 6032 "rndc reload" command were completed. [RT #47076] 6033 6034 4891. [placeholder] 6035 6036 4890. [func] Remove unused ondestroy callback from libisc. 6037 [isc-projects/bind9!3] 6038 6039 4889. [func] Warn about the use of old root keys without the new 6040 root key being present. Warn about dlv.isc.org's 6041 key being present. Warn about both managed and 6042 trusted root keys being present. [RT #43670] 6043 6044 4888. [test] Initialize sockets correctly in sample-update so 6045 that the nsupdate system test will run on Windows. 6046 [RT #47097] 6047 6048 4887. [test] Enable the rpzrecurse test to run on Windows. 6049 [RT #47093] 6050 6051 4886. [doc] Document dig -u in manpage. [RT #47150] 6052 6053 4885. [security] update-policy rules that otherwise ignore the name 6054 field now require that it be set to "." to ensure 6055 that any type list present is properly interpreted. 6056 [RT #47126] 6057 6058 4884. [bug] named could crash on shutdown due to a race between 6059 shutdown_server() and ns__client_request(). [RT #47120] 6060 6061 4883. [cleanup] Improved debugging output from dnssec-cds. [RT #47026] 6062 6063 4882. [bug] Address potential memory leak in 6064 dns_update_signaturesinc. [RT #47084] 6065 6066 4881. [bug] Only include dst_openssl.h when OpenSSL is required. 6067 [RT #47068] 6068 6069 4880. [bug] Named wasn't returning the target of a cross-zone 6070 CNAME between two served zones when recursion was 6071 desired and available (RD=1, RA=1). (When this is 6072 not the case, the CNAME target is deliberately 6073 withheld to prevent accidental cache poisoning.) 6074 [RT #47078] 6075 6076 4879. [bug] dns_rdata_caa:value_len field was too small. 6077 [RT #47086] 6078 6079 4878. [bug] List 'ply' as a requirement for the 'isc' python 6080 package. [RT #47065] 6081 6082 4877. [bug] Address integer overflow when exponentially 6083 backing off retry intervals. [RT #47041] 6084 6085 4876. [bug] Address deadlock with accessing a keytable. [RT #47000] 6086 6087 4875. [bug] Address compile failures on older systems. [RT #47015] 6088 6089 4874. [bug] Wrong time display when reporting new keywarntime. 6090 [RT #47042] 6091 6092 4873. [doc] Grammars for named.conf included in the ARM are now 6093 automatically generated by the configuration parser 6094 itself. As a side effect of the work needed to 6095 separate zone type grammars from each other, this 6096 also makes checking of zone statements in 6097 named-checkconf more correct and consistent. 6098 [RT #36957] 6099 6100 4872. [bug] Don't permit loading meta RR types such as TKEY 6101 from master files. [RT #47009] 6102 6103 4871. [bug] Fix configure glitch in detecting stdatomic.h 6104 support on systems with multiple compilers. 6105 [RT #46959] 6106 6107 4870. [test] Update included ATF library to atf-0.21 preserving 6108 the ATF tool. [RT #46967] 6109 6110 4869. [bug] Address some cases where NULL with zero length could 6111 be passed to memmove which is undefined behavior and 6112 can lead to bad optimization. [RT #46888] 6113 6114 4868. [func] dnssec-keygen can no longer generate HMAC keys. 6115 Use tsig-keygen instead. [RT #46404] 6116 6117 4867. [cleanup] Normalize rndc on/off commands (validation, 6118 querylog, serve-stale) so they all accept the 6119 same synonyms for on/off (yes/no, true/false, 6120 enable/disable). Thanks to Tony Finch. [RT #47022] 6121 6122 4866. [port] DST library initialization verifies MD5 (when MD5 6123 was not disabled) and SHA-1 hash and HMAC support. 6124 [RT #46764] 6125 6126 4865. [cleanup] Simplify handling isc_socket_sendto2() return values. 6127 [RT #46986] 6128 6129 4864. [bug] named acting as a slave for a catalog zone crashed if 6130 the latter contained a master definition without an IP 6131 address. [RT #45999] 6132 6133 4863. [bug] Fix various other bugs reported by Valgrind's 6134 memcheck tool. [RT #46978] 6135 6136 4862. [bug] The rdata flags for RRSIG were not being properly set 6137 when constructing a rdataslab. [RT #46978] 6138 6139 4861. [bug] The isc_crc64 unit test was not endian independent. 6140 [RT #46973] 6141 6142 4860. [bug] isc_int8_t should be signed char. [RT #46973] 6143 6144 4859. [bug] A loop was possible when attempting to validate 6145 unsigned CNAME responses from secure zones; 6146 this caused a delay in returning SERVFAIL and 6147 also increased the chances of encountering 6148 CVE-2017-3145. [RT #46839] 6149 6150 4858. [security] Addresses could be referenced after being freed 6151 in resolver.c, causing an assertion failure. 6152 (CVE-2017-3145) [RT #46839] 6153 6154 4857. [bug] Maintain attach/detach semantics for event->db, 6155 event->node, event->rdataset and event->sigrdataset 6156 in query.c. [RT #46891] 6157 6158 4856. [bug] 'rndc zonestatus' reported the wrong underlying type 6159 for a inline slave zone. [RT #46875] 6160 6161 4855. [bug] isc_time_formatshorttimestamp produced incorrect 6162 output. [RT #46938] 6163 6164 4854. [bug] query_synthcnamewildcard should stop generating the 6165 response if query_synthwildcard fails. [RT #46939] 6166 6167 4853. [bug] Add REQUIRE's and INSIST's to isc_time_formatISO8601L 6168 and isc_time_formatISO8601Lms. [RT #46916] 6169 6170 4852. [bug] Handle strftime() failing in isc_time_formatISO8601ms. 6171 Add REQUIRE's and INSIST's to isc_time_formattimestamp, 6172 isc_time_formathttptimestamp, isc_time_formatISO8601, 6173 isc_time_formatISO8601ms. [RT #46892] 6174 6175 4851. [port] Support using kyua as well as atf-run to run the unit 6176 tests. [RT #46853] 6177 6178 4850. [bug] Named failed to restart with multiple added zones in 6179 lmdb database. [RT #46889] 6180 6181 4849. [bug] Duplicate zones could appear in the .nzf file if 6182 addzone failed. [RT #46435] 6183 6184 4848. [func] Zone types "primary" and "secondary" can now be used 6185 as synonyms for "master" and "slave" in named.conf. 6186 [RT #46713] 6187 6188 4847. [bug] dnssec-dnskey-kskonly was not being honored for 6189 CDS and CDNSKEY. [RT #46755] 6190 6191 4846. [test] Adjust timing values in runtime system test. Address 6192 named.pid removal races in runtime system test. 6193 [RT #46800] 6194 6195 4845. [bug] Dig (non iOS) should exit on malformed names. 6196 [RT #46806] 6197 6198 4844. [test] Address memory leaks in libatf-c. [RT #46798] 6199 6200 4843. [bug] dnssec-signzone free hashlist on exit. [RT #46791] 6201 6202 4842. [bug] Conditionally compile opensslecdsa_link.c to avoid 6203 warnings about unused function. [RT #46790] 6204 6205 .. code-block:: none 6206 6207 --- 9.12.0rc1 released --- 6208 6209 4841. [bug] Address -fsanitize=undefined warnings. [RT #46786] 6210 6211 4840. [test] Add tests to cover fallback to using ZSK on inactive 6212 KSK. [RT #46787] 6213 6214 4839. [bug] zone.c:zone_sign was not properly determining 6215 if there were active KSK and ZSK keys for 6216 a algorithm when update-check-ksk is true 6217 (default) leaving records unsigned with one or 6218 more DNSKEY algorithms. [RT #46774] 6219 6220 4838. [bug] zone.c:add_sigs was not properly determining 6221 if there were active KSK and ZSK keys for 6222 a algorithm when update-check-ksk is true 6223 (default) leaving records unsigned with one or 6224 more DNSKEY algorithms. [RT #46754] 6225 6226 4837. [bug] dns_update_signatures{inc} (add_sigs) was not 6227 properly determining if there were active KSK and 6228 ZSK keys for a algorithm when update-check-ksk is 6229 true (default) leaving records unsigned when there 6230 were multiple DNSKEY algorithms for the zone. 6231 [RT #46743] 6232 6233 4836. [bug] Zones created using "rndc addzone" could 6234 temporarily fail to inherit an "allow-transfer" 6235 ACL that had been configured in the options 6236 statement. [RT #46603] 6237 6238 4835. [cleanup] Clean up and refactor LMDB-related code. [RT #46718] 6239 6240 4834. [port] Fix LMDB support on OpenBSD. [RT #46718] 6241 6242 4833. [bug] isc_event_free should check that the event is not 6243 linked when called. [RT #46725] 6244 6245 4832. [bug] Events were not being removed from zone->rss_events. 6246 [RT #46725] 6247 6248 4831. [bug] Convert the RRSIG expirytime to 64 bits for 6249 comparisons in diff.c:resign. [RT #46710] 6250 6251 4830. [bug] Failure to configure ATF when requested did not cause 6252 an error in top-level configure script. [RT #46655] 6253 6254 4829. [bug] isc_heap_delete did not zero the index value when 6255 the heap was created with a callback to do that. 6256 [RT #46709] 6257 6258 4828. [bug] Do not use thread-local storage for storing LMDB reader 6259 locktable slots. [RT #46556] 6260 6261 4827. [misc] Add a precommit check script util/checklibs.sh 6262 [RT #46215] 6263 6264 4826. [cleanup] Prevent potential build failures in bin/confgen/ and 6265 bin/named/ when using parallel make. [RT #46648] 6266 6267 4825. [bug] Prevent a bogus "error during managed-keys processing 6268 (no more)" warning from being logged. [RT #46645] 6269 6270 4824. [port] Add iOS hooks to dig. [RT #42011] 6271 6272 4823. [test] Refactor reclimit system test to improve its 6273 reliability and speed. [RT #46632] 6274 6275 4822. [bug] Use resign_sooner in dns_db_setsigningtime. [RT #46473] 6276 6277 4821. [bug] When resigning ensure that the SOA's expire time is 6278 always later that the resigning time of other records. 6279 [RT #46473] 6280 6281 4820. [bug] dns_db_subtractrdataset should transfer the resigning 6282 information to the new header. [RT #46473] 6283 6284 4819. [bug] Fully backout the transaction when adding a RRset 6285 to the resigning / removal heaps fails. [RT #46473] 6286 6287 4818. [test] The logfileconfig system test could intermittently 6288 report false negatives on some platforms. [RT #46615] 6289 6290 4817. [cleanup] Use DNS_NAME_INITABSOLUTE and DNS_NAME_INITNONABSOLUTE. 6291 [RT #45433] 6292 6293 4816. [bug] Don't use a common array for storing EDNS options 6294 in DiG as it could fill up. [RT #45611] 6295 6296 4815. [bug] rbt_test.c:insert_and_delete needed to call 6297 dns_rbt_addnode instead of dns_rbt_addname. [RT #46553] 6298 6299 4814. [cleanup] Use AS_HELP_STRING for consistent help text. [RT #46521] 6300 6301 4813. [bug] Address potential read after free errors from 6302 query_synthnodata, query_synthwildcard and 6303 query_synthnxdomain. [RT #46547] 6304 6305 4812. [bug] Minor improvements to stability and consistency of code 6306 handling managed keys. [RT #46468] 6307 6308 4811. [bug] Revert api changes to use <isc/buffer.h> inline 6309 macros. Provide a alternative mechanism to turn 6310 on the use of inline macros when building BIND. 6311 [RT #46520] 6312 6313 4810. [test] The chain system test failed if the IPv6 interfaces 6314 were not configured. [RT #46508] 6315 6316 .. code-block:: none 6317 6318 --- 9.12.0b2 released --- 6319 6320 4809. [port] Check at configure time whether -latomic is needed 6321 for stdatomic.h. [RT #46324] 6322 6323 4808. [bug] Properly test for zlib.h. [RT #46504] 6324 6325 4807. [cleanup] isc_rng_randombytes() returns a specified number of 6326 bytes from the PRNG; this is now used instead of 6327 calling isc_rng_random() multiple times. [RT #46230] 6328 6329 4806. [func] Log messages related to loading of zones are now 6330 directed to the "zoneload" logging category. 6331 [RT #41640] 6332 6333 4805. [bug] TCP4Active and TCP6Active weren't being updated 6334 correctly. [RT #46454] 6335 6336 4804. [port] win32: access() does not work on directories as 6337 required by POSIX. Supply a alternative in 6338 isc_file_isdirwritable. [RT #46394] 6339 6340 4803. [placeholder] 6341 6342 4802. [test] Refactor mkeys system test to make it quicker and more 6343 reliable. [RT #45293] 6344 6345 4801. [func] 'dnssec-lookaside auto;' and 'dnssec-lookaside . 6346 trust-anchor dlv.isc.org;' now elicit warnings rather 6347 than being fatal configuration errors. [RT #46410] 6348 6349 4800. [bug] When processing delzone, write one zone config per 6350 line to the NZF. [RT #46323] 6351 6352 4799. [cleanup] Improve clarity of keytable unit tests. [RT #46407] 6353 6354 4798. [func] Keys specified in "managed-keys" statements 6355 are tagged as "initializing" until they have been 6356 updated by a key refresh query. If initialization 6357 fails it will be visible from "rndc secroots". 6358 [RT #46267] 6359 6360 4797. [func] Removed "isc-hmac-fixup", as the versions of BIND that 6361 had the bug it worked around are long past end of 6362 life. [RT #46411] 6363 6364 4796. [bug] Increase the maximum configurable TCP keepalive 6365 timeout to 65535. [RT #44710] 6366 6367 4795. [func] A new statistics counter has been added to track 6368 priming queries. [RT #46313] 6369 6370 4794. [func] "dnssec-checkds -s" specifies a file from which 6371 to read a DS set rather than querying the parent. 6372 [RT #44667] 6373 6374 4793. [bug] nsupdate -[46] could overflow the array of server 6375 addresses. [RT #46402] 6376 6377 4792. [bug] Fix map file header correctness check. [RT #38418] 6378 6379 4791. [doc] Fixed outdated documentation about export libraries. 6380 [RT #46341] 6381 6382 4790. [bug] nsupdate could trigger a require when sending a 6383 update to the second address of the server. 6384 [RT #45731] 6385 6386 4789. [cleanup] Check writability of new-zones-directory. [RT #46308] 6387 6388 4788. [cleanup] When using "update-policy local", log a warning 6389 when an update matching the session key is received 6390 from a remote host. [RT #46213] 6391 6392 4787. [cleanup] Turn nsec3param_salt_totext() into a public function, 6393 dns_nsec3param_salttotext(), and add unit tests for it. 6394 [RT #46289] 6395 6396 4786. [func] The "filter-aaaa-on-v4" and "filter-aaaa-on-v6" 6397 options are no longer conditionally compiled. 6398 [RT #46340] 6399 6400 4785. [func] The hmac-md5 algorithm is no longer recommended for 6401 use with RNDC keys. The default in rndc-confgen 6402 is now hmac-sha256. [RT #42272] 6403 6404 4784. [func] The use of dnssec-keygen to generate HMAC keys is 6405 deprecated in favor of tsig-keygen. dnssec-keygen 6406 will print a warning when used for this purpose. 6407 All HMAC algorithms will be removed from 6408 dnssec-keygen in a future release. [RT #42272] 6409 6410 4783. [test] dnssec: 'check that NOTIFY is sent at the end of 6411 NSEC3 chain generation failed' required more time 6412 on some machines for the IXFR to complete. [RT #46388] 6413 6414 4782. [test] dnssec: 'checking positive and negative validation 6415 with negative trust anchors' required more time to 6416 complete on some machines. [RT #46386] 6417 6418 4781. [maint] B.ROOT-SERVERS.NET is now 199.9.14.201. [RT #45889] 6419 6420 4780. [bug] When answering ANY queries, don't include the NS 6421 RRset in the authority section if it was already 6422 in the answer section. [RT #44543] 6423 6424 4779. [bug] Expire NTA at the start of the second. Don't update 6425 the expiry value if the record has already expired 6426 after a successful check. [RT #46368] 6427 6428 4778. [test] Improve synth-from-dnssec testing. [RT #46352] 6429 6430 4777. [cleanup] Removed a redundant call to configure_view_acl(). 6431 [RT #46369] 6432 6433 4776. [bug] Improve portability of ht_test. [RT #46333] 6434 6435 4775. [bug] Address Coverity warnings in ht_test.c and mem_test.c 6436 [RT #46281] 6437 6438 4774. [bug] <isc/util.h> was incorrectly included in several 6439 header files. [RT #46311] 6440 6441 4773. [doc] Fixed generating Doxygen documentation for functions 6442 annotated using certain macros. Miscellaneous 6443 Doxygen-related cleanups. [RT #46276] 6444 6445 .. code-block:: none 6446 6447 --- 9.12.0b1 released --- 6448 6449 4772. [test] Expanded unit testing framework for libns, using 6450 hooks to interrupt query flow and inspect state 6451 at specified locations. [RT #46173] 6452 6453 4771. [bug] When sending RFC 5011 refresh queries, disregard 6454 cached DNSKEY rrsets. [RT #46251] 6455 6456 4770. [bug] Cache additional data from priming queries as glue. 6457 Previously they were ignored as unsigned 6458 non-answer data from a secure zone, and never 6459 actually got added to the cache, causing hints 6460 to be used frequently for root-server 6461 addresses, which triggered re-priming. [RT #45241] 6462 6463 4769. [func] The working directory and managed-keys directory has 6464 to be writeable (and seekable). [RT #46077] 6465 6466 4768. [func] By default, memory is no longer filled with tag values 6467 when it is allocated or freed; this improves 6468 performance but makes debugging of certain memory 6469 issues more difficult. "named -M fill" turns memory 6470 filling back on. (Building "configure 6471 --enable-developer", turns memory fill on by 6472 default again; it can then be disabled with 6473 "named -M nofill".) [RT #45123] 6474 6475 4767. [func] Add a new function, isc_buffer_printf(), which can be 6476 used to append a formatted string to the used region of 6477 a buffer. [RT #46201] 6478 6479 4766. [cleanup] Address Coverity warnings. [RT #46150] 6480 6481 4765. [bug] Address potential INSIST in dnssec-cds. [RT #46150] 6482 6483 4764. [bug] Address portability issues in cds system test. 6484 [RT #46214] 6485 6486 4763. [contrib] Improve compatibility when building MySQL DLZ 6487 module by using mysql_config if available. 6488 [RT #45558] 6489 6490 4762. [func] "update-policy local" is now restricted to updates 6491 from local addresses. (Previously, other addresses 6492 were allowed so long as updates were signed by the 6493 local session key.) [RT #45492] 6494 6495 4761. [protocol] Add support for DOA. [RT #45612] 6496 6497 4760. [func] Add glue cache statistics counters. [RT #46028] 6498 6499 4759. [func] Add logging channel "trust-anchor-telemetry" to 6500 record trust-anchor-telemetry in incoming requests. 6501 Both _ta-XXXX.<anchor>/NULL and EDNS KEY-TAG options 6502 are logged. [RT #46124] 6503 6504 4758. [doc] Remove documentation of unimplemented "topology". 6505 [RT #46161] 6506 6507 4757. [func] New "dnssec-cds" command creates a new parent DS 6508 RRset based on CDS or CDNSKEY RRsets found in 6509 a child zone, and generates either a dsset file 6510 or stream of nsupdate commands to update the 6511 parent. Thanks to Tony Finch. [RT #46090] 6512 6513 4756. [bug] Interrupting dig could lead to an INSIST failure after 6514 certain errors were encountered while querying a host 6515 whose name resolved to more than one address. Change 6516 4537 increased the odds of triggering this issue by 6517 causing dig to hang indefinitely when certain error 6518 paths were evaluated. dig now also retries TCP queries 6519 (once) if the server gracefully closes the connection 6520 before sending a response. [RT #42832, #45159] 6521 6522 4755. [cleanup] Silence unnecessary log message when NZF file doesn't 6523 exist. [RT #46186] 6524 6525 4754. [bug] dns_zone_setview needs a two stage commit to properly 6526 handle errors. [RT #45841] 6527 6528 4753. [contrib] Software obtainable from known upstream locations 6529 (i.e., zkt, nslint, query-loc) has been removed. 6530 Links to these and other packages can be found at 6531 https://www.isc.org/community/tools [RT #46182] 6532 6533 4752. [test] Add unit test for isc_net_pton. [RT #46171] 6534 6535 4751. [func] "dnssec-signzone -S" can now automatically add parent 6536 synchronization records (CDS and CDNSKEY) according 6537 to key metadata set using the -Psync and -Dsync 6538 options to dnssec-keygen and dnssec-settime. 6539 [RT #46149] 6540 6541 4750. [func] "rndc managed-keys destroy" shuts down RFC 5011 key 6542 maintenance and deletes the managed-keys database. 6543 If followed by "rndc reconfig" or a server restart, 6544 key maintenance is reinitialized from scratch. 6545 This is primarily intended for testing. [RT #32456] 6546 6547 4749. [func] The ISC DLV service has been shut down, and all 6548 DLV records have been removed from dlv.isc.org. 6549 - Removed references to ISC DLV in documentation 6550 - Removed DLV key from bind.keys 6551 - No longer use ISC DLV by default in delv 6552 - "dnssec-lookaside auto" and configuration of 6553 "dnssec-lookaide" with dlv.isc.org as the trust 6554 anchor are both now fatal errors. 6555 [RT #46155] 6556 6557 4748. [cleanup] Sprintf to snprintf coversions. [RT #46132] 6558 6559 4747. [func] Synthesis of responses from DNSSEC-verified records. 6560 Stage 3 - synthesize NODATA responses. [RT #40138] 6561 6562 4746. [cleanup] Add configured prefixes to configure summary 6563 output. [RT #46153] 6564 6565 4745. [test] Add color-coded pass/fail messages to system 6566 tests when running on terminals that support them. 6567 [RT #45977] 6568 6569 4744. [bug] Suppress trust-anchor-telemetry queries if 6570 validation is disabled. [RT #46131] 6571 6572 4743. [func] Exclude trust-anchor-telemetry queries from 6573 synth-from-dnssec processing. [RT #46123] 6574 6575 4742. [func] Synthesis of responses from DNSSEC-verified records. 6576 Stage 2 - synthesis of records from wildcard data. 6577 If the dns64 or filter-aaaa* is configured then the 6578 involved lookups are currently excluded. [RT #40138] 6579 6580 4741. [bug] Make isc_refcount_current() atomically read the 6581 counter value. [RT #46074] 6582 6583 4740. [cleanup] Avoid triggering format-truncated warnings. [RT #46107] 6584 6585 4739. [cleanup] Address clang static analysis warnings. [RT #45952] 6586 6587 4738. [port] win32: strftime mishandles %Z. [RT #46039] 6588 6589 4737. [cleanup] Address Coverity warnings. [RT #46012] 6590 6591 4736. [cleanup] (a) Added comments to NSEC3-related functions in 6592 lib/dns/zone.c. (b) Refactored NSEC3 salt formatting 6593 code. (c) Minor tweaks to lock and result handling. 6594 [RT #46053] 6595 6596 4735. [bug] Add @ISC_OPENSSL_LIBS@ to isc-config. [RT #46078] 6597 6598 4734. [contrib] Added sample configuration for DNS-over-TLS in 6599 contrib/dnspriv. 6600 6601 4733. [bug] Change #4706 introduced a bug causing TCP clients 6602 not be reused correctly, leading to unconstrained 6603 memory growth. [RT #46029] 6604 6605 4732. [func] Change default minimal-responses setting to 6606 no-auth-recursive. [RT #46016] 6607 6608 4731. [bug] Fix use after free when closing an LMDB. [RT #46000] 6609 6610 4730. [bug] Fix out of bounds access in DHCID totext() method. 6611 [RT #46001] 6612 6613 4729. [bug] Don't use memset() to wipe memory, as it may be 6614 removed by compiler optimizations when the 6615 memset() occurs on automatic stack allocation 6616 just before function return. [RT #45947] 6617 6618 4728. [func] Use C11's stdatomic.h instead of isc_atomic 6619 where available. [RT #40668] 6620 6621 4727. [bug] Retransferring an inline-signed slave using NSEC3 6622 around the time its NSEC3 salt was changed could result 6623 in an infinite signing loop. [RT #45080] 6624 6625 4726. [port] Prevent setsockopt() errors related to TCP_FASTOPEN 6626 from being logged on FreeBSD if the kernel does not 6627 support it. Notify the user when the kernel does 6628 support TCP_FASTOPEN, but it is disabled by sysctl. 6629 Add a new configure option, --disable-tcp-fastopen, to 6630 disable use of TCP_FASTOPEN altogether. [RT #44754] 6631 6632 4725. [bug] Nsupdate: "recvsoa" was incorrectly reported for 6633 failures in sending the update message. The correct 6634 location to be reported is "update_completed". 6635 [RT #46014] 6636 6637 4724. [func] By default, BIND now uses the random number 6638 functions provided by the crypto library (i.e., 6639 OpenSSL or a PKCS#11 provider) as a source of 6640 randomness rather than /dev/random. This is 6641 suitable for virtual machine environments 6642 which have limited entropy pools and lack 6643 hardware random number generators. 6644 6645 This can be overridden by specifying another 6646 entropy source via the "random-device" option 6647 in named.conf, or via the -r command line option; 6648 however, for functions requiring full cryptographic 6649 strength, such as DNSSEC key generation, this 6650 cannot be overridden. In particular, the -r 6651 command line option no longer has any effect on 6652 dnssec-keygen. 6653 6654 This can be disabled by building with 6655 "configure --disable-crypto-rand". 6656 [RT #31459] [RT #46047] 6657 6658 4723. [bug] Statistics counter DNSTAPdropped was misidentified 6659 as DNSSECdropped. [RT #46002] 6660 6661 4722. [cleanup] Clean up uses of strcpy() and strcat() in favor of 6662 strlcpy() and strlcat() for safety. [RT #45981] 6663 6664 4721. [func] 'dnssec-signzone -x' and 'dnssec-dnskey-kskonly' 6665 options now apply to CDNSKEY and DS records as well 6666 as DNSKEY. Thanks to Tony Finch. [RT #45689] 6667 6668 4720. [func] Added a statistics counter to track prefetch 6669 queries. [RT #45847] 6670 6671 4719. [bug] Address PVS static analyzer warnings. [RT #45946] 6672 6673 4718. [func] Avoid searching for a owner name compression pointer 6674 more than once when writing out a RRset. [RT #45802] 6675 6676 4717. [bug] Treat replies with QCOUNT=0 as truncated if TC=1, 6677 FORMERR if TC=0, and log the error correctly. 6678 [RT #45836] 6679 6680 4716. [placeholder] 6681 6682 .. code-block:: none 6683 6684 --- 9.12.0a1 released --- 6685 6686 4715. [bug] TreeMemMax was mis-identified as a second HeapMemMax 6687 in the Json cache statistics. [RT #45980] 6688 6689 4714. [port] openbsd/libressl: add support for building with 6690 --enable-openssl-hash. [RT #45982] 6691 6692 4713. [func] Added support for the DNS Response Policy Service 6693 (DNSRPS) API, which allows named to use an external 6694 response policy daemon when built with 6695 "configure --enable-dnsrps". Thanks to Farsight 6696 Security. [RT #43376] 6697 6698 4712. [bug] "dig +domain" and "dig +search" didn't retain the 6699 search domain when retrying with TCP. [RT #45547] 6700 6701 4711. [test] Some RR types were missing from genzones.sh. 6702 [RT #45782] 6703 6704 4710. [cleanup] Changed the --enable-openssl-hash default to yes. 6705 [RT #45019] 6706 6707 4709. [cleanup] Use dns_name_fullhash() to hash names for RRL. 6708 [RT #45435] 6709 6710 4708. [cleanup] Legacy Windows builds (i.e. for XP and earlier) 6711 are no longer supported. [RT #45186] 6712 6713 4707. [func] The lightweight resolver daemon and library (lwresd 6714 and liblwres) have been removed. [RT #45186] 6715 6716 4706. [func] Code implementing name server query processing has 6717 been moved from bin/named to a new library "libns". 6718 Functions remaining in bin/named are now prefixed 6719 with "named_" rather than "ns_". This will make it 6720 easier to write unit tests for name server code, or 6721 link name server functionality into new tools. 6722 [RT #45186] 6723 6724 4705. [placeholder] 6725 6726 4704. [cleanup] Silence Visual Studio compiler warnings. [RT #45898] 6727 6728 4703. [bug] BINDInstall.exe was missing some buffer length checks. 6729 [RT #45898] 6730 6731 4702. [func] Update function declarations to use 6732 dns_masterstyle_flags_t for style flags. [RT #45924] 6733 6734 4701. [cleanup] Refactored lib/dns/tsig.c to reduce code 6735 duplication and simplify the disabling of MD5. 6736 [RT #45490] 6737 6738 4700. [func] Serving of stale answers is now supported. This 6739 allows named to provide stale cached answers when 6740 the authoritative server is under attack. 6741 See max-stale-ttl, stale-answer-enable, 6742 stale-answer-ttl. [RT #44790] 6743 6744 4699. [func] Multiple cookie-secret clauses can now be specified. 6745 The first one specified is used to generate new 6746 server cookies. [RT #45672] 6747 6748 4698. [port] Add --with-python-install-dir configure option to allow 6749 specifying a nonstandard installation directory for 6750 Python modules. [RT #45407] 6751 6752 4697. [bug] Restore workaround for Microsoft Windows TSIG hash 6753 computation bug. [RT #45854] 6754 6755 4696. [port] Enable filter-aaaa support by default on Windows 6756 builds. [RT #45883] 6757 6758 4695. [bug] cookie-secrets were not being properly checked by 6759 named-checkconf. [RT #45886] 6760 6761 4694. [func] dnssec-keygen no longer uses RSASHA1 by default; 6762 the signing algorithm must be specified on 6763 the command line with the "-a" option. Signing 6764 scripts that rely on the existing default behavior 6765 will break; use "dnssec-keygen -a RSASHA1" to 6766 repair them. (The goal of this change is to make 6767 it easier to find scripts using RSASHA1 so they 6768 can be changed in the event of that algorithm 6769 being deprecated in the future.) [RT #44755] 6770 6771 4693. [func] Synthesis of responses from DNSSEC-verified records. 6772 Stage 1 covers NXDOMAIN synthesis from NSEC records. 6773 This is controlled by synth-from-dnssec and is enabled 6774 by default. [RT #40138] 6775 6776 4692. [bug] Fix build failures with libressl introduced in 4676. 6777 [RT #45879] 6778 6779 4691. [func] Add -4/-6 command line options to nsupdate and rndc. 6780 [RT #45632] 6781 6782 4690. [bug] Command line options -4/-6 were handled inconsistently 6783 between tools. [RT #45632] 6784 6785 4689. [cleanup] Turn on minimal responses for CDNSKEY and CDS in 6786 addition to DNSKEY and DS. Thanks to Tony Finch. 6787 [RT #45690] 6788 6789 4688. [protocol] Check and display EDNS KEY TAG options (RFC 8145) in 6790 messages. [RT #44804] 6791 6792 4687. [func] Refactor tracklines code. [RT #45126] 6793 6794 4686. [bug] dnssec-settime -p could print a bogus warning about 6795 key deletion scheduled before its inactivation when a 6796 key had an inactivation date set but no deletion date 6797 set. [RT #45807] 6798 6799 4685. [bug] dnssec-settime incorrectly calculated publication and 6800 activation dates for a successor key. [RT #45806] 6801 6802 4684. [bug] delv could send bogus DNS queries when an explicit 6803 server address was specified on the command line along 6804 with -4/-6. [RT #45804] 6805 6806 4683. [bug] Prevent nsupdate from immediately exiting on invalid 6807 user input in interactive mode. [RT #28194] 6808 6809 4682. [bug] Don't report errors on records below a DNAME. 6810 [RT #44880] 6811 6812 4681. [bug] Log messages from the validator now include the 6813 associated view unless the view is "_default/IN" 6814 or "_dnsclient/IN". [RT #45770] 6815 6816 4680. [bug] Fix failing over to another master server address when 6817 nsupdate is used with GSS-API. [RT #45380] 6818 6819 4679. [cleanup] Suggest using -o when dnssec-verify finds a SOA record 6820 not at top of zone and -o is not used. [RT #45519] 6821 6822 4678. [bug] geoip-use-ecs has the wrong type when geoip support 6823 is disabled at configure time. [RT #45763] 6824 6825 4677. [cleanup] Split up the main function in dig to better support 6826 the iOS app version. [RT #45508] 6827 6828 4676. [cleanup] Allow BIND to be built using OpenSSL 1.0.X with 6829 deprecated functions removed. [RT #45706] 6830 6831 4675. [cleanup] Don't use C++ keyword class. [RT #45726] 6832 6833 4674. [func] "dig +sigchase", and related options "+topdown" and 6834 "+trusted-keys", have been removed. Use "delv" for 6835 queries with DNSSEC validation. [RT #42793] 6836 6837 4673. [port] Silence GCC 7 warnings. [RT #45592] 6838 6839 4672. [placeholder] 6840 6841 4671. [bug] Fix a race condition that could cause the 6842 resolver to crash with assertion failure when 6843 chasing DS in specific conditions with a very 6844 short RTT to the upstream nameserver. [RT #45168] 6845 6846 4670. [cleanup] Ensure that a request MAC is never sent back 6847 in an XFR response unless the signature was 6848 verified. [RT #45494] 6849 6850 4669. [func] Iterative query logic in resolver.c has been 6851 refactored into smaller functions and commented, 6852 for improved readability, maintainability and 6853 testability. [RT #45362] 6854 6855 4668. [bug] Use localtime_r and gmtime_r for thread safety. 6856 [RT #45664] 6857 6858 4667. [cleanup] Refactor RDATA unit tests. [RT #45610] 6859 6860 4666. [bug] dnssec-keymgr: Domain names beginning with digits (0-9) 6861 could cause a parser error when reading the policy 6862 file. This now works correctly so long as the domain 6863 name is quoted. [RT #45641] 6864 6865 4665. [protocol] Added support for ED25519 and ED448 DNSSEC signing 6866 algorithms (RFC 8080). (Note: these algorithms 6867 depend on code currently in the development branch 6868 of OpenSSL which has not yet been released.) 6869 [RT #44696] 6870 6871 4664. [func] Add a "glue-cache" option to enable or disable the 6872 glue cache. The default is "yes". [RT #45125] 6873 6874 4663. [cleanup] Clarify error message printed by dnssec-dsfromkey. 6875 [RT #21731] 6876 6877 4662. [performance] Improve cache memory cleanup of zero TTL records 6878 by putting them at the tail of LRU header lists. 6879 [RT #45274] 6880 6881 4661. [bug] A race condition could occur if a zone was reloaded 6882 while resigning, triggering a crash in 6883 rbtdb.c:closeversion(). [RT #45276] 6884 6885 4660. [bug] Remove spurious "peer" from Windows socket log 6886 messages. [RT #45617] 6887 6888 4659. [bug] Remove spurious log message about lmdb-mapsize 6889 not being supported when parsing builtin 6890 configuration file. [RT #45618] 6891 6892 4658. [bug] Clean up build directory created by "setup.py install" 6893 immediately. [RT #45628] 6894 6895 4657. [bug] rrchecker system test result could be improperly 6896 determined. [RT #45602] 6897 6898 4656. [bug] Apply "port" and "dscp" values specified in catalog 6899 zone's "default-masters" option to the generated 6900 configuration of its member zones. [RT #45545] 6901 6902 4655. [bug] Lack of seccomp could be falsely reported. [RT #45599] 6903 6904 4654. [cleanup] Don't use C++ keywords delete, new and namespace. 6905 [RT #45538] 6906 6907 4653. [bug] Reorder includes to move @DST_OPENSSL_INC@ and 6908 @ISC_OPENSSL_INC@ after shipped include directories. 6909 [RT #45581] 6910 6911 4652. [bug] Nsupdate could attempt to use a zeroed address on 6912 server timeout. [RT #45417] 6913 6914 4651. [test] Silence coverity warnings in tsig_test.c. [RT #45528] 6915 6916 4650. [placeholder] 6917 6918 4649. [bug] The wrong zone was logged when a catalog zone is added. 6919 [RT #45520] 6920 6921 4648. [bug] "rndc reconfig" on a slave no longer causes all member 6922 zones of configured catalog zones to be removed from 6923 configuration. [RT #45310] 6924 6925 4647. [bug] Change 4643 broke verification of TSIG signed TCP 6926 message sequences where not all the messages contain 6927 TSIG records. These may be used in AXFR and IXFR 6928 responses. [RT #45509] 6929 6930 4646. [placeholder] 6931 6932 4645. [bug] Fix PKCS#11 RSA parsing when MD5 is disabled. 6933 [RT #45300] 6934 6935 4644. [placeholder] 6936 6937 4643. [security] An error in TSIG handling could permit unauthorized 6938 zone transfers or zone updates. (CVE-2017-3142) 6939 (CVE-2017-3143) [RT #45383] 6940 6941 4642. [cleanup] Add more logging of RFC 5011 events affecting the 6942 status of managed keys: newly observed keys, 6943 deletion of revoked keys, etc. [RT #45354] 6944 6945 4641. [cleanup] Parallel builds (make -j) could fail with --with-atf / 6946 --enable-developer. [RT #45373] 6947 6948 4640. [bug] If query_findversion failed in query_getdb due to 6949 memory failure the error status was incorrectly 6950 discarded. [RT #45331] 6951 6952 4639. [bug] Fix a regression in --with-tuning reporting introduced 6953 by change 4488. [RT #45396] 6954 6955 4638. [bug] Reloading or reconfiguring named could fail on 6956 some platforms when LMDB was in use. [RT #45203] 6957 6958 4637. [func] "nsec3hash -r" option ("rdata order") takes arguments 6959 in the same order as they appear in NSEC3 or 6960 NSEC3PARAM records, so that NSEC3 parameters can 6961 be cut and pasted from an existing record. Thanks 6962 to Tony Finch for the contribution. [RT #45183] 6963 6964 4636. [bug] Normalize rpz policy zone names when checking for 6965 existence. [RT #45358] 6966 6967 4635. [bug] Fix RPZ NSDNAME logging that was logging 6968 failures as NSIP. [RT #45052] 6969 6970 4634. [contrib] check5011.pl needs to handle optional space before 6971 semi-colon in +multi-line output. [RT #45352] 6972 6973 4633. [maint] Updated AAAA (2001:500:200::b) for B.ROOT-SERVERS.NET. 6974 6975 4632. [security] The BIND installer on Windows used an unquoted 6976 service path, which can enable privilege escalation. 6977 (CVE-2017-3141) [RT #45229] 6978 6979 4631. [security] Some RPZ configurations could go into an infinite 6980 query loop when encountering responses with TTL=0. 6981 (CVE-2017-3140) [RT #45181] 6982 6983 4630. [bug] "dyndb" is dependent on dlopen existing / being 6984 enabled. [RT #45291] 6985 6986 4629. [bug] dns_client_startupdate could not be called with a 6987 running client. [RT #45277] 6988 6989 4628. [bug] Fixed a potential reference leak in query_getdb(). 6990 [RT #45247] 6991 6992 4627. [placeholder] 6993 6994 4626. [test] Added more tests for handling of different record 6995 ordering in CNAME and DNAME responses. [QA #430] 6996 6997 4625. [bug] Running "rndc addzone" and "rndc delzone" at close 6998 to the same time could trigger a deadlock if using 6999 LMDB. [RT #45209] 7000 7001 4624. [placeholder] 7002 7003 4623. [bug] Use --with-protobuf-c and --with-libfstrm to find 7004 protoc-c and fstrm_capture. [RT #45187] 7005 7006 4622. [bug] Remove unnecessary escaping of semicolon in CAA and 7007 URI records. [RT #45216] 7008 7009 4621. [port] Force alignment of oid arrays to silence loader 7010 warnings. [RT #45131] 7011 7012 4620. [port] Handle EPFNOSUPPORT being returned when probing 7013 to see if a socket type is supported. [RT #45214] 7014 7015 4619. [bug] Call isc_mem_put instead of isc_mem_free in 7016 bin/named/server.c:setup_newzones. [RT #45202] 7017 7018 4618. [bug] Check isc_mem_strdup results in dns_view_setnewzones. 7019 Add logging for lmdb call failures. [RT #45204] 7020 7021 4617. [test] Update rndc system test to be more delay tolerant. 7022 [RT #45177] 7023 7024 4616. [bug] When using LMDB, zones deleted using "rndc delzone" 7025 were not correctly removed from the new-zone 7026 database. [RT #45185] 7027 7028 4615. [bug] AD could be set on truncated answer with no records 7029 present in the answer and authority sections. 7030 [RT #45140] 7031 7032 4614. [test] Fixed an error in the sockaddr unit test. [RT #45146] 7033 7034 4613. [func] By default, the maximum size of a zone journal file 7035 is now twice the size of the zone's contents (there 7036 is little benefit to a journal larger than this). 7037 This can be overridden by setting "max-journal-size" 7038 to "unlimited" or to an explicit value up to 2G. 7039 Thanks to Tony Finch. [RT #38324] 7040 7041 4612. [bug] Silence 'may be use uninitalised' warning and simplify 7042 the code in lwres/getaddinfo:process_answer. 7043 [RT #45158] 7044 7045 4611. [bug] The default LMDB mapsize was too low and caused 7046 errors after few thousand zones were added using 7047 rndc addzone. A new config option "lmdb-mapsize" 7048 has been introduced to configure the LMDB 7049 mapsize depending on operational needs. 7050 [RT #44954] 7051 7052 4610. [func] The "new-zones-directory" option specifies the 7053 location of NZF or NZD files for storing 7054 configuration of zones added by "rndc addzone". 7055 Thanks to Petr Menk. [RT #44853] 7056 7057 4609. [cleanup] Rearrange makefiles to enable parallel execution 7058 (i.e. "make -j"). [RT #45078] 7059 7060 4608. [func] DiG now warns about .local queries which are reserved 7061 for Multicast DNS. [RT #44783] 7062 7063 4607. [bug] The memory context's malloced and maxmalloced counters 7064 were being updated without the appropriate lock being 7065 held. [RT #44869] 7066 7067 4606. [port] Stop using experimental "Experimental keys on scalar" 7068 feature of perl as it has been removed. [RT #45012] 7069 7070 4605. [performance] Improve performance for delegation heavy answers 7071 and also general query performance. Removes the 7072 acache feature that didn't significantly improve 7073 performance. Adds a glue cache. Removes 7074 additional-from-cache and additional-from-auth 7075 features. Enables minimal-responses by 7076 default. Improves performance of compression 7077 code, owner case restoration, hash function, 7078 etc. Uses inline buffer implementation by 7079 default. Many other performance changes and fixes. 7080 [RT #44029] 7081 7082 4604. [bug] Don't use ERR_load_crypto_strings() when building 7083 with OpenSSL 1.1.0. [RT #45117] 7084 7085 4603. [doc] Automatically generate named.conf(5) man page 7086 from doc/misc/options. Thanks to Tony Finch. 7087 [RT #43525] 7088 7089 4602. [func] Threads are now set to human-readable 7090 names to assist debugging, when supported by 7091 the OS. [RT #43234] 7092 7093 4601. [bug] Reject incorrect RSA key lengths during key 7094 generation and and sign/verify context 7095 creation. [RT #45043] 7096 7097 4600. [bug] Adjust RPZ trigger counts only when the entry 7098 being deleted exists. [RT #43386] 7099 7100 4599. [bug] Fix inconsistencies in inline signing time 7101 comparison that were introduced with the 7102 introduction of rdatasetheader->resign_lsb. 7103 [RT #42112] 7104 7105 4598. [func] Update fuzzing code to (1) reply to a DNSKEY 7106 query from named with appropriate DNSKEY used in 7107 fuzzing; (2) patch the QTYPE correctly in 7108 resolver fuzzing; (3) comment things so the rest 7109 of us are able to understand how fuzzing is 7110 implemented in named; (4) Coding style changes, 7111 cleanup, etc. [RT #44787] 7112 7113 4597. [bug] The validator now ignores SHA-1 DS digest type 7114 when a DS record with SHA-384 digest type is 7115 present and is a supported digest type. 7116 [RT #45017] 7117 7118 4596. [bug] Validate glue before adding it to the additional 7119 section. This also fixes incorrect TTL capping 7120 when the RRSIG expired earlier than the TTL. 7121 [RT #45062] 7122 7123 4595. [func] dnssec-keygen will no longer generate RSA keys 7124 less than 1024 bits in length. dnssec-keymgr 7125 was similarly updated. [RT #36895] 7126 7127 4594. [func] "dnstap-read -x" prints a hex dump of the wire 7128 format of each logged DNS message. [RT #44816] 7129 7130 4593. [doc] Update README using markdown, remove outdated FAQ 7131 file in favor of the knowledge base. 7132 7133 4592. [bug] A race condition on shutdown could trigger an 7134 assertion failure in dispatch.c. [RT #43822] 7135 7136 4591. [port] Addressed some python 3 compatibility issues. 7137 Thanks to Ville Skytta. [RT #44955] [RT #44956] 7138 7139 4590. [bug] Support for PTHREAD_MUTEX_ADAPTIVE_NP was not being 7140 properly detected. [RT #44871] 7141 7142 4589. [cleanup] "configure -q" is now silent. [RT #44829] 7143 7144 4588. [bug] nsupdate could send queries for TKEY to the wrong 7145 server when using GSSAPI. Thanks to Tomas Hozza. 7146 [RT #39893] 7147 7148 4587. [bug] named-checkzone failed to handle occulted data below 7149 DNAMEs correctly. [RT #44877] 7150 7151 4586. [func] dig, host and nslookup now use TCP for ANY queries. 7152 [RT #44687] 7153 7154 4585. [port] win32: Set CompileAS value. [RT #42474] 7155 7156 4584. [bug] A number of memory usage statistics were not properly 7157 reported when they exceeded 4G. [RT #44750] 7158 7159 4583. [func] "host -A" returns most records for a name but 7160 omits RRSIG, NSEC and NSEC3. (Thanks to Tony Finch.) 7161 [RT #43032] 7162 7163 4582. [security] 'rndc ""' could trigger a assertion failure in named. 7164 (CVE-2017-3138) [RT #44924] 7165 7166 4581. [port] Linux: Add getpid and getrandom to the list of system 7167 calls named uses for seccomp. [RT #44883] 7168 7169 4580. [bug] 4578 introduced a regression when handling CNAME to 7170 referral below the current domain. [RT #44850] 7171 7172 4579. [func] Logging channels and dnstap output files can now 7173 be configured with a "suffix" option, set to 7174 either "increment" or "timestamp", indicating 7175 whether to use incrementing numbers or timestamps 7176 as the file suffix when rolling over a log file. 7177 [RT #42838] 7178 7179 4578. [security] Some chaining (CNAME or DNAME) responses to upstream 7180 queries could trigger assertion failures. 7181 (CVE-2017-3137) [RT #44734] 7182 7183 4577. [func] Make qtype of resolver fuzzing packet configurable 7184 via command line. [RT #43540] 7185 7186 4576. [func] The RPZ implementation has been substantially 7187 refactored for improved performance and reliability. 7188 [RT #43449] 7189 7190 4575. [security] DNS64 with "break-dnssec yes;" can result in an 7191 assertion failure. (CVE-2017-3136) [RT #44653] 7192 7193 4574. [bug] Dig leaked memory with multiple +subnet options. 7194 [RT #44683] 7195 7196 4573. [func] Query logic has been substantially refactored (e.g. 7197 query_find function has been split into smaller 7198 functions) for improved readability, maintainability 7199 and testability. [RT #43929] 7200 7201 4572. [func] The "dnstap-output" option can now take "size" and 7202 "versions" parameters to indicate the maximum size 7203 a dnstap log file can grow before rolling to a new 7204 file, and how many old files to retain. [RT #44502] 7205 7206 4571. [bug] Out-of-tree builds of backtrace_test failed. 7207 7208 4570. [cleanup] named did not correctly fall back to the built-in 7209 initializing keys if the bind.keys file was present 7210 but empty. [RT #44531] 7211 7212 4569. [func] Store both local and remote addresses in dnstap 7213 logging, and modify dnstap-read output format to 7214 print them. [RT #43595] 7215 7216 4568. [contrib] Added a --with-bind option to the dnsperf configure 7217 script to specify BIND prefix path. 7218 7219 4567. [port] Call getprotobyname and getservbyname prior to calling 7220 chroot so that shared libraries get loaded. [RT #44537] 7221 7222 4566. [func] Query logging now includes the ECS option if one 7223 was included in the query. [RT #44476] 7224 7225 4565. [cleanup] The inline macro versions of isc_buffer_put*() 7226 did not implement automatic buffer reallocation. 7227 [RT #44216] 7228 7229 4564. [maint] Update the built in managed keys to include the 7230 upcoming root KSK. [RT #44579] 7231 7232 4563. [bug] Modified zones would occasionally fail to reload. 7233 [RT #39424] 7234 7235 4562. [func] Add additional memory statistics currently malloced 7236 and maxmalloced per memory context. [RT #43593] 7237 7238 4561. [port] Silence a warning in strict C99 compilers. [RT #44414] 7239 7240 4560. [bug] mdig: add -m option to enable memory debugging rather 7241 than having it on all the time. [RT #44509] 7242 7243 4559. [bug] openssl_link.c didn't compile if ISC_MEM_TRACKLINES 7244 was turned off. [RT #44509] 7245 7246 4558. [bug] Synthesised CNAME before matching DNAME was still 7247 being cached when it should not have been. [RT #44318] 7248 7249 4557. [security] Combining dns64 and rpz can result in dereferencing 7250 a NULL pointer (read). (CVE-2017-3135) [RT#44434] 7251 7252 4556. [bug] Sending an EDNS Padding option using "dig 7253 +ednsopt" could cause a crash in dig. [RT #44462] 7254 7255 4555. [func] dig +ednsopt: EDNS options can now be specified by 7256 name in addition to numeric value. [RT #44461] 7257 7258 4554. [bug] Remove double unlock in dns_dispatchmgr_setudp. 7259 [RT #44336] 7260 7261 4553. [bug] Named could deadlock there were multiple changes to 7262 NSEC/NSEC3 parameters for a zone being processed at 7263 the same time. [RT #42770] 7264 7265 4552. [bug] Named could trigger a assertion when sending notify 7266 messages. [RT #44019] 7267 7268 4551. [test] Add system tests for integrity checks of MX and 7269 SRV records. [RT #43953] 7270 7271 4550. [cleanup] Increased the number of available master file 7272 output style flags from 32 to 64. [RT #44043] 7273 7274 4549. [func] Added support for the EDNS TCP Keepalive option 7275 (RFC 7828). [RT #42126] 7276 7277 4548. [func] Added support for the EDNS Padding option (RFC 7830). 7278 [RT #42094] 7279 7280 4547. [port] Add support for --enable-native-pkcs11 on the AEP 7281 Keyper HSM. [RT #42463] 7282 7283 4546. [func] Extend the use of const declarations. [RT #43379] 7284 7285 4545. [func] Expand YAML output from dnstap-read to include 7286 a detailed breakdown of the DNS message contents. 7287 [RT #43642] 7288 7289 4544. [bug] Add message/payload size to dnstap-read YAML output. 7290 [RT #43622] 7291 7292 4543. [bug] dns_client_startupdate now delays sending the update 7293 request until isc_app_ctxrun has been called. 7294 [RT #43976] 7295 7296 4542. [func] Allow rndc to manipulate redirect zones with using 7297 -redirect as the zone name (use "-redirect." to 7298 manipulate a zone named "-redirect"). [RT #43971] 7299 7300 4541. [bug] rndc addzone should properly reject non master/slave 7301 zones. [RT #43665] 7302 7303 4540. [bug] Correctly handle ecs entries in dns_acl_isinsecure. 7304 [RT #43601] 7305 7306 4539. [bug] Referencing a nonexistent zone with RPZ could lead 7307 to a assertion failure when configuring. [RT #43787] 7308 7309 4538. [bug] Call dns_client_startresolve from client->task. 7310 [RT #43896] 7311 7312 4537. [bug] Handle timeouts better in dig/host/nslookup. [RT #43576] 7313 7314 4536. [bug] ISC_SOCKEVENTATTR_USEMINMTU was not being cleared 7315 when reusing the event structure. [RT #43885] 7316 7317 4535. [bug] Address race condition in setting / testing of 7318 DNS_REQUEST_F_SENDING. [RT #43889] 7319 7320 4534. [bug] Only set RD, RA and CD in QUERY responses. [RT #43879] 7321 7322 4533. [bug] dns_client_update should terminate on prerequisite 7323 failures (NXDOMAIN, YXDOMAIN, NXRRSET, YXRRSET) 7324 and also on BADZONE. [RT #43865] 7325 7326 4532. [contrib] Make gen-data-queryperf.py python 3 compatible. 7327 [RT #43836] 7328 7329 4531. [security] 'is_zone' was not being properly updated by redirect2 7330 and subsequently preserved leading to an assertion 7331 failure. (CVE-2016-9778) [RT #43837] 7332 7333 4530. [bug] Change 4489 broke the handling of CNAME -> DNAME 7334 in responses resulting in SERVFAIL being returned. 7335 [RT #43779] 7336 7337 4529. [cleanup] Silence noisy log warning when DSCP probe fails 7338 due to firewall rules. [RT #43847] 7339 7340 4528. [bug] Only set the flag bits for the i/o we are waiting 7341 for on EPOLLERR or EPOLLHUP. [RT #43617] 7342 7343 4527. [doc] Support DocBook XSL Stylesheets v1.79.1. [RT #43831] 7344 7345 4526. [doc] Corrected errors and improved formatting of 7346 grammar definitions in the ARM. [RT #43739] 7347 7348 4525. [doc] Fixed outdated documentation on managed-keys. 7349 [RT #43810] 7350 7351 4524. [bug] The net zero test was broken causing IPv4 servers 7352 with addresses ending in .0 to be rejected. [RT #43776] 7353 7354 4523. [doc] Expand config doc for <querysource4> and 7355 <querysource6>. [RT #43768] 7356 7357 4522. [bug] Handle big gaps in log file version numbers better. 7358 [RT #38688] 7359 7360 4521. [cleanup] Log it as an error if an entropy source is not 7361 found and there is no fallback available. [RT #43659] 7362 7363 4520. [cleanup] Alphabetize more of the grammar when printing it 7364 out. Fix unbalanced indenting. [RT #43755] 7365 7366 4519. [port] win32: handle ERROR_MORE_DATA. [RT #43534] 7367 7368 4518. [func] The "print-time" option in the logging configuration 7369 can now take arguments "local", "iso8601" or 7370 "iso8601-utc" to indicate the format in which the 7371 date and time should be logged. For backward 7372 compatibility, "yes" is a synonym for "local". 7373 [RT #42585] 7374 7375 4517. [security] Named could mishandle authority sections that were 7376 missing RRSIGs triggering an assertion failure. 7377 (CVE-2016-9444) [RT # 43632] 7378 7379 4516. [bug] isc_socketmgr_renderjson was missing from the 7380 windows build. [RT #43602] 7381 7382 4515. [port] FreeBSD: Find readline headers when they are in 7383 edit/readline/ instead of readline/. [RT #43658] 7384 7385 4514. [port] NetBSD: strip -WL, from ld command line. [RT #43204] 7386 7387 4513. [cleanup] Minimum Python versions are now 2.7 and 3.2. 7388 [RT #43566] 7389 7390 4512. [bug] win32: @GEOIP_INC@ missing from delv.vcxproj.in. 7391 [RT #43556] 7392 7393 4511. [bug] win32: mdig.exe-BNFT was missing Configure. [RT #43554] 7394 7395 4510. [security] Named mishandled some responses where covering RRSIG 7396 records are returned without the requested data 7397 resulting in a assertion failure. (CVE-2016-9147) 7398 [RT #43548] 7399 7400 4509. [test] Make the rrl system test more reliable on slower 7401 machines by using mdig instead of dig. [RT #43280] 7402 7403 4508. [security] Named incorrectly tried to cache TKEY records which 7404 could trigger a assertion failure when there was 7405 a class mismatch. (CVE-2016-9131) [RT #43522] 7406 7407 4507. [bug] Named could incorrectly log 'allows updates by IP 7408 address, which is insecure' [RT #43432] 7409 7410 4506. [func] 'named-checkconf -l' will now list the zones found in 7411 named.conf. [RT #43154] 7412 7413 4505. [port] Use IP_PMTUDISC_OMIT if available. [RT #35494] 7414 7415 4504. [security] Allow the maximum number of records in a zone to 7416 be specified. This provides a control for issues 7417 raised in CVE-2016-6170. [RT #42143] 7418 7419 4503. [cleanup] "make uninstall" now removes files installed by 7420 BIND. (This currently excludes Python files 7421 due to lack of support in setup.py.) [RT #42192] 7422 7423 4502. [func] Report multiple and experimental options when printing 7424 grammar. [RT #43134] 7425 7426 4501. [placeholder] 7427 7428 4500. [bug] Support modifier I64 in isc__print_printf. [RT #43526] 7429 7430 4499. [port] MacOSX: silence deprecated function warning 7431 by using arc4random_stir() when available 7432 instead of arc4random_addrandom(). [RT #43503] 7433 7434 4498. [test] Simplify prerequisite checks in system tests. 7435 [RT #43516] 7436 7437 4497. [port] Add support for OpenSSL 1.1.0. [RT #41284] 7438 7439 4496. [func] dig: add +idnout to control whether labels are 7440 display in punycode or not. Requires idn support 7441 to be enabled at compile time. [RT #43398] 7442 7443 4495. [bug] A isc_mutex_init call was not being checked. 7444 [RT #43391] 7445 7446 4494. [bug] Look for <editline/readline.h>. [RT #43429] 7447 7448 4493. [bug] bin/tests/system/dyndb/driver/Makefile.in should use 7449 SO_TARGETS. [RT# 43336] 7450 7451 4492. [bug] irs_resconf_load failed to initialize sortlistnxt 7452 causing bad writes if resolv.conf contained a 7453 sortlist directive. [RT #43459] 7454 7455 4491. [bug] Improve message emitted when testing whether sendmsg 7456 works with TOS/TCLASS fails. [RT #43483] 7457 7458 4490. [maint] Added AAAA (2001:500:12::d0d) for G.ROOT-SERVERS.NET. 7459 7460 4489. [security] It was possible to trigger assertions when processing 7461 a response containing a DNAME answer. (CVE-2016-8864) 7462 [RT #43465] 7463 7464 4488. [port] Darwin: use -framework for Kerberos. [RT #43418] 7465 7466 4487. [test] Make system tests work on Windows. [RT #42931] 7467 7468 4486. [bug] Look in $prefix/lib/pythonX.Y/site-packages for 7469 the python modules we install. [RT #43330] 7470 7471 4485. [bug] Failure to find readline when requested should be 7472 fatal to configure. [RT #43328] 7473 7474 4484. [func] Check prefixes in acls to make sure the address and 7475 prefix lengths are consistent. Warn only in 7476 BIND 9.11 and earlier. [RT #43367] 7477 7478 4483. [bug] Address use before require check and remove extraneous 7479 dns_message_gettsigkey call in dns_tsig_sign. 7480 [RT #43374] 7481 7482 4482. [cleanup] Change #4455 was incomplete. [RT #43252] 7483 7484 4481. [func] dig: make +class, +crypto, +multiline, +rrcomments, 7485 +onesoa, +qr, +ttlid, +ttlunits and -u per lookup 7486 rather than global. [RT #42450] 7487 7488 4480. [placeholder] 7489 7490 4479. [placeholder] 7491 7492 4478. [func] Add +continue option to mdig, allow continue on socket 7493 errors. [RT #43281] 7494 7495 4477. [test] Fix mkeys test timing issues. [RT #41028] 7496 7497 4476. [test] Fix reclimit test on slower machines. [RT #43283] 7498 7499 4475. [doc] Update named-checkconf documentation. [RT #43153] 7500 7501 4474. [bug] win32: call WSAStartup in fromtext_in_wks so that 7502 getprotobyname and getservbyname work. [RT #43197] 7503 7504 4473. [bug] Only call fsync / _commit on regular files. [RT #43196] 7505 7506 4472. [bug] Named could fail to find the correct NSEC3 records when 7507 a zone was updated between looking for the answer and 7508 looking for the NSEC3 records proving nonexistence 7509 of the answer. [RT #43247] 7510 7511 .. code-block:: none 7512 7513 --- 9.11.0 released --- 7514 7515 .. code-block:: none 7516 7517 --- 9.11.0rc3 released --- 7518 7519 4471. [cleanup] Render client/query logging format consistent for 7520 ease of log file parsing. (Note that this affects 7521 "querylog" format: there is now an additional field 7522 indicating the client object address.) [RT #43238] 7523 7524 4470. [bug] Reset message with intent parse before 7525 calling dns_dispatch_getnext. [RT #43229] 7526 7527 4469. [placeholder] 7528 7529 .. code-block:: none 7530 7531 --- 9.11.0rc2 released --- 7532 7533 4468. [bug] Address ECS option handling issues. [RT #43191] 7534 7535 4467. [security] It was possible to trigger an assertion when 7536 rendering a message. (CVE-2016-2776) [RT #43139] 7537 7538 4466. [bug] Interface scanning didn't work on a Windows system 7539 without a non local IPv6 addresses. [RT #43130] 7540 7541 4465. [bug] Don't use "%z" as Windows doesn't support it. 7542 [RT #43131] 7543 7544 4464. [bug] Fix windows python support. [RT #43173] 7545 7546 4463. [bug] The dnstap system test failed on some systems. 7547 [RT #43129] 7548 7549 4462. [bug] Don't describe a returned EDNS COOKIE as "good" 7550 when there isn't a valid server cookie. [RT #43167] 7551 7552 4461. [bug] win32: not all external data was properly marked 7553 as external data for windows dll. [RT #43161] 7554 7555 .. code-block:: none 7556 7557 --- 9.11.0rc1 released --- 7558 7559 4460. [test] Add system test for dnstap using unix domain sockets. 7560 [RT #42926] 7561 7562 4459. [bug] TCP client objects created to handle pipeline queries 7563 were not cleaned up correctly, causing uncontrolled 7564 memory growth. [RT #43106] 7565 7566 4458. [cleanup] Update assertions to be more correct, and also remove 7567 use of a reserved word. [RT #43090] 7568 7569 4457. [maint] Added AAAA (2001:500:a8::e) for E.ROOT-SERVERS.NET. 7570 7571 4456. [doc] Add DOCTYPE and lang attribute to <html> tags. 7572 [RT #42587] 7573 7574 4455. [cleanup] Allow dyndb modules to correctly log the filename 7575 and line number when processing configuration text 7576 from named.conf. [RT #43050] 7577 7578 4454. [bug] 'rndc dnstap -reopen' had a race issue. [RT #43089] 7579 7580 4453. [bug] Prefetching of DS records failed to update their 7581 RRSIGs. [RT #42865] 7582 7583 4452. [bug] The default key manager policy file is now 7584 <sysdir>/dnssec-policy.conf (usually 7585 /etc/dnssec-policy.conf). [RT #43064] 7586 7587 4451. [cleanup] Log more useful information if a PKCS#11 provider 7588 library cannot be loaded. [RT #43076] 7589 7590 4450. [port] Provide more nuanced HSM support which better matches 7591 the specific PKCS11 providers capabilities. [RT #42458] 7592 7593 4449. [test] Fix catalog zones test on slower systems. [RT #42997] 7594 7595 4448. [bug] win32: ::1 was not being found when iterating 7596 interfaces. [RT #42993] 7597 7598 4447. [tuning] Allow the fstrm_iothr_init() options to be set using 7599 named.conf to control how dnstap manages the data 7600 flow. [RT #42974] 7601 7602 4446. [bug] The cache_find() and _findrdataset() functions 7603 could find rdatasets that had been marked stale. 7604 [RT #42853] 7605 7606 4445. [cleanup] isc_errno_toresult() can now be used to call the 7607 formerly private function isc__errno2result(). 7608 [RT #43050] 7609 7610 4444. [bug] Fixed some issues related to dyndb: A bug caused 7611 braces to be omitted when passing configuration text 7612 from named.conf to a dyndb driver, and there was a 7613 use-after-free in the sample dyndb driver. [RT #43050] 7614 7615 4443. [func] Set TCP_MAXSEG in addition to IPV6_USE_MIN_MTU on 7616 TCP sockets. [RT #42864] 7617 7618 4442. [bug] Fix RPZ CIDR tree insertion bug that corrupted 7619 tree data structure with overlapping networks 7620 (longest prefix match was ineffective). 7621 [RT #43035] 7622 7623 4441. [cleanup] Alphabetize host's help output. [RT #43031] 7624 7625 4440. [func] Enable TCP fast open support when available on the 7626 server side. [RT #42866] 7627 7628 4439. [bug] Address race conditions getting ownernames of nodes. 7629 [RT #43005] 7630 7631 4438. [func] Use LIFO rather than FIFO when processing startup 7632 notify and refresh queries. [RT #42825] 7633 7634 4437. [func] Minimal-responses now has two additional modes 7635 no-auth and no-auth-recursive which suppress 7636 adding the NS records to the authority section 7637 as well as the associated address records for the 7638 nameservers. [RT #42005] 7639 7640 4436. [func] Return TLSA records as additional data for MX and SRV 7641 lookups. [RT #42894] 7642 7643 4435. [tuning] Only set IPV6_USE_MIN_MTU for UDP when the message 7644 will not fit into a single IPv4 encapsulated IPv6 7645 UDP packet when transmitted over a Ethernet link. 7646 [RT #42871] 7647 7648 4434. [protocol] Return EDNS EXPIRE option for master zones in addition 7649 to slave zones. [RT #43008] 7650 7651 4433. [cleanup] Report an error when passing an invalid option or 7652 view name to "rndc dumpdb". [RT #42958] 7653 7654 4432. [test] Hide rndc output on expected failures in logfileconfig 7655 system test. [RT #27996] 7656 7657 4431. [bug] named-checkconf now checks the rate-limit clause. 7658 [RT #42970] 7659 7660 4430. [bug] Lwresd died if a search list was not defined. 7661 Found by 0x710DDDD At Alibaba Security. [RT #42895] 7662 7663 4429. [bug] Address potential use after free on fclose() error. 7664 [RT #42976] 7665 7666 4428. [bug] The "test dispatch getnext" unit test could fail 7667 in a threaded build. [RT #42979] 7668 7669 4427. [bug] The "query" and "response" parameters to the 7670 "dnstap" option had their functions reversed. 7671 7672 .. code-block:: none 7673 7674 --- 9.11.0b3 released --- 7675 7676 4426. [bug] Addressed Coverity warnings. [RT #42908] 7677 7678 4425. [bug] arpaname, dnstap-read and named-rrchecker were not 7679 being installed into ${prefix}/bin. Tidy up 7680 installation issues with CHANGE 4421. [RT #42910] 7681 7682 4424. [experimental] Named now sends _ta-XXXX.<trust-anchor>/NULL queries 7683 to provide feedback to the trust-anchor administrators 7684 about how key rollovers are progressing as per 7685 draft-ietf-dnsop-edns-key-tag-02. This can be 7686 disabled using 'trust-anchor-telemetry no;'. 7687 [RT #40583] 7688 7689 4423. [maint] Added missing IPv6 address 2001:500:84::b for 7690 B.ROOT-SERVERS.NET. [RT #42898] 7691 7692 4422. [port] Silence clang warnings in dig.c and dighost.c. 7693 [RT #42451] 7694 7695 4421. [func] When built with LMDB (Lightning Memory-mapped 7696 Database), named will now use a database to store 7697 the configuration for zones added by "rndc addzone" 7698 instead of using a flat NZF file. This improves 7699 performance of "rndc delzone" and "rndc modzone" 7700 significantly. Existing NZF files will 7701 automatically by converted to NZD databases. 7702 To view the contents of an NZD or to roll back to 7703 NZF format, use "named-nzd2nzf". To disable 7704 this feature, use "configure --without-lmdb". 7705 [RT #39837] 7706 7707 4420. [func] nslookup now looks for AAAA as well as A by default. 7708 [RT #40420] 7709 7710 4419. [bug] Don't cause undefined result if the label of an 7711 entry in catalog zone is changed. [RT #42708] 7712 7713 4418. [bug] Fix a compiler warning in GSSAPI code. [RT #42879] 7714 7715 4417. [bug] dnssec-keymgr could fail to create successor keys 7716 if the prepublication interval was set to a value 7717 smaller than the default. [RT #42820] 7718 7719 4416. [bug] dnssec-keymgr: Domain names in policy files could 7720 fail to match due to trailing dots. [RT #42807] 7721 7722 4415. [bug] dnssec-keymgr: Expired/deleted keys were not always 7723 excluded. [RT #42884] 7724 7725 4414. [bug] Corrected a bug in the MIPS implementation of 7726 isc_atomic_xadd(). [RT #41965] 7727 7728 4413. [bug] GSSAPI negotiation could fail if GSS_S_CONTINUE_NEEDED 7729 was returned. [RT #42733] 7730 7731 .. code-block:: none 7732 7733 --- 9.11.0b2 released --- 7734 7735 4412. [cleanup] Make fixes for GCC 6. ISC_OFFSET_MAXIMUM macro was 7736 removed. [RT #42721] 7737 7738 4411. [func] "rndc dnstap -roll" automatically rolls the 7739 dnstap output file; the previous version is 7740 saved with ".0" suffix, and earlier versions 7741 with ".1" and so on. An optional numeric argument 7742 indicates how many prior files to save. [RT #42830] 7743 7744 4410. [bug] Address use after free and memory leak with dnstap. 7745 [RT #42746] 7746 7747 4409. [bug] DNS64 should exclude mapped addresses by default when 7748 an exclude acl is not defined. [RT #42810] 7749 7750 4408. [func] Continue waiting for expected response when we the 7751 response we get does not match the request. [RT #41026] 7752 7753 4407. [performance] Use GCC builtin for clz in RPZ lookup code. 7754 [RT #42818] 7755 7756 4406. [security] getrrsetbyname with a non absolute name could 7757 trigger an infinite recursion bug in lwresd 7758 and named with lwres configured if when combined 7759 with a search list entry the resulting name is 7760 too long. (CVE-2016-2775) [RT #42694] 7761 7762 4405. [bug] Change 4342 introduced a regression where you could 7763 not remove a delegation in a NSEC3 signed zone using 7764 OPTOUT via nsupdate. [RT #42702] 7765 7766 4404. [misc] Allow krb5-config to be used when configuring gssapi. 7767 [RT #42580] 7768 7769 4403. [bug] Rename variables and arguments that shadow: basename, 7770 clone and gai_error. 7771 7772 4402. [bug] protoc-c is now a hard requirement for --enable-dnstap. 7773 7774 .. code-block:: none 7775 7776 --- 9.11.0b1 released --- 7777 7778 4401. [misc] Change LICENSE to MPL 2.0. 7779 7780 4400. [bug] ttl policy was not being inherited in policy.py. 7781 [RT #42718] 7782 7783 4399. [bug] policy.py 'ECCGOST', 'ECDSAP256SHA256', and 7784 'ECDSAP384SHA384' don't have settable keysize. 7785 [RT #42718] 7786 7787 4398. [bug] Correct spelling of ECDSAP256SHA256 in policy.py. 7788 [RT #42718] 7789 7790 4397. [bug] Update Windows python support. [RT #42538] 7791 7792 4396. [func] dnssec-keymgr now takes a '-r randomfile' option. 7793 [RT #42455] 7794 7795 4395. [bug] Improve out-of-tree installation of python modules. 7796 [RT #42586] 7797 7798 4394. [func] Add rndc command "dnstap-reopen" to close and 7799 reopen dnstap output files. [RT #41803] 7800 7801 4393. [bug] Address potential NULL pointer dereferences in 7802 dnstap code. 7803 7804 4392. [func] Collect statistics for RSSAC02v3 traffic-volume, 7805 traffic-sizes and rcode-volume reporting. [RT #41475] 7806 7807 4391. [contrib] Fix leaks in contrib DLZ code. [RT #42707] 7808 7809 4390. [doc] Description of masters with TSIG, allow-query and 7810 allow-transfer options in catalog zones. [RT #42692] 7811 7812 4389. [test] Rewritten test suite for catalog zones. [RT #42676] 7813 7814 4388. [func] Support for master entries with TSIG keys in catalog 7815 zones. [RT #42577] 7816 7817 4387. [bug] Change 4336 was not complete leading to SERVFAIL 7818 being return as NS records expired. [RT #42683] 7819 7820 4386. [bug] Remove shadowed overmem function/variable. [RT #42706] 7821 7822 4385. [func] Add support for allow-query and allow-transfer ACLs 7823 to catalog zones. [RT #42578] 7824 7825 4384. [bug] Change 4256 accidentally disabled logging of the 7826 rndc command. [RT #42654] 7827 7828 4383. [bug] Correct spelling error in stats channel description of 7829 "EDNS client subnet option received". [RT #42633] 7830 7831 4382. [bug] rndc {addzone,modzone,delzone,showzone} should all 7832 compare the zone name using a canonical format. 7833 [RT #42630] 7834 7835 4381. [bug] Missing "zone-directory" option in catalog zone 7836 definition caused BIND to crash. [RT #42579] 7837 7838 .. code-block:: none 7839 7840 --- 9.11.0a3 released --- 7841 7842 4380. [experimental] Added a "zone-directory" option to "catalog-zones" 7843 syntax, allowing local masterfiles for slaves 7844 that are provisioned by catalog zones to be stored 7845 in a directory other than the server's working 7846 directory. [RT #42527] 7847 7848 4379. [bug] An INSIST could be triggered if a zone contains 7849 RRSIG records with expiry fields that loop 7850 using serial number arithmetic. [RT #40571] 7851 7852 4378. [contrib] #include <isc/string.h> for strlcat in zone2ldap.c. 7853 [RT #42525] 7854 7855 4377. [bug] Don't reuse zero TTL responses beyond the current 7856 client set (excludes ANY/SIG/RRSIG queries). 7857 [RT #42142] 7858 7859 4376. [experimental] Added support for Catalog Zones, a new method for 7860 provisioning secondary servers in which a list of 7861 zones to be served is stored in a DNS zone and can 7862 be propagated to slaves via AXFR/IXFR. [RT #41581] 7863 7864 4375. [func] Add support for automatic reallocation of isc_buffer 7865 to isc_buffer_put* functions. [RT #42394] 7866 7867 4374. [bug] Use SAVE/RESTORE macros in query.c to reduce the 7868 probability of reference counting errors as seen 7869 in 4365. [RT #42405] 7870 7871 4373. [bug] Address undefined behavior in getaddrinfo. [RT #42479] 7872 7873 4372. [bug] Address undefined behavior in libt_api. [RT #42480] 7874 7875 4371. [func] New "minimal-any" option reduces the size of UDP 7876 responses for qtype ANY by returning a single 7877 arbitrarily selected RRset instead of all RRsets. 7878 Thanks to Tony Finch. [RT #41615] 7879 7880 4370. [bug] Address python3 compatibility issues with RNDC module. 7881 [RT #42499] [RT #42506] 7882 7883 .. code-block:: none 7884 7885 --- 9.11.0a2 released --- 7886 7887 4369. [bug] Fix 'make' and 'make install' out-of-tree python 7888 support. [RT #42484] 7889 7890 4368. [bug] Fix a crash when calling "rndc stats" on some 7891 Windows builds because some Visual Studio compilers 7892 generated crashing code for the "%z" printf() 7893 format specifier. [RT #42380] 7894 7895 4367. [bug] Remove unnecessary assignment of loadtime in 7896 zone_touched. [RT #42440] 7897 7898 4366. [bug] Address race condition when updating rbtnode bit 7899 fields. [RT #42379] 7900 7901 4365. [bug] Address zone reference counting errors involving 7902 nxdomain-redirect. [RT #42258] 7903 7904 4364. [port] freebsd: add -Wl,-E to loader flags [RT #41690] 7905 7906 4363. [port] win32: Disable explicit triggering UAC when running 7907 BINDInstall. 7908 7909 4362. [func] Changed rndc reconfig behavior so that newly added 7910 zones are loaded asynchronously and the loading does 7911 not block the server. [RT #41934] 7912 7913 4361. [cleanup] Where supported, file modification times returned 7914 by isc_file_getmodtime() are now accurate to the 7915 nanosecond. [RT #41968] 7916 7917 4360. [bug] Silence spurious 'bad key type' message when there is 7918 a existing TSIG key. [RT #42195] 7919 7920 4359. [bug] Inherited 'also-notify' lists were not being checked 7921 by named-checkconf. [RT #42174] 7922 7923 4358. [test] Added American Fuzzy Lop harness that allows 7924 feeding fuzzed packets into BIND. 7925 [RT #41723] 7926 7927 4357. [func] Add the python RNDC module. [RT #42093] 7928 7929 4356. [func] Add the ability to specify whether to wait for 7930 nameserver addresses to be looked up or not to 7931 RPZ with a new modifying directive 'nsip-wait-recurse'. 7932 [RT #35009] 7933 7934 4355. [func] "pkcs11-list" now displays the extractability 7935 attribute of private or secret keys stored in 7936 an HSM, as either "true", "false", or "never" 7937 Thanks to Daniel Stirnimann. [RT #36557] 7938 7939 4354. [bug] Check that the received HMAC length matches the 7940 expected length prior to check the contents on the 7941 control channel. This prevents a OOB read error. 7942 This was reported by Lian Yihan, <lianyihan (a] 360.cn>. 7943 [RT #42215] 7944 7945 4353. [cleanup] Update PKCS#11 header files. [RT #42175] 7946 7947 4352. [cleanup] The ISC DNSSEC Lookaside Validation (DLV) service 7948 is scheduled to be disabled in 2017. A warning is 7949 now logged when named is configured to use it, 7950 either explicitly or via "dnssec-lookaside auto;" 7951 [RT #42207] 7952 7953 4351. [bug] 'dig +noignore' didn't work. [RT #42273] 7954 7955 4350. [contrib] Declare result in dlz_filesystem_dynamic.c. 7956 7957 4349. [contrib] kasp2policy: A python script to create a DNSSEC 7958 policy file from an OpenDNSSEC KASP XML file. 7959 7960 4348. [func] dnssec-keymgr: A new python-based DNSSEC key 7961 management utility, which reads a policy definition 7962 file and can create or update DNSSEC keys as needed 7963 to ensure that a zone's keys match policy, roll over 7964 correctly on schedule, etc. Thanks to Sebastian 7965 Castro for assistance in development. [RT #39211] 7966 7967 4347. [port] Corrected a build error on x86_64 Solaris. [RT #42150] 7968 7969 4346. [bug] Fixed a regression introduced in change #4337 which 7970 caused signed domains with revoked KSKs to fail 7971 validation. [RT #42147] 7972 7973 4345. [contrib] perftcpdns mishandled the return values from 7974 clock_nanosleep. [RT #42131] 7975 7976 4344. [port] Address openssl version differences. [RT #42059] 7977 7978 4343. [bug] dns_dnssec_syncupdate mis-declared in <dns/dnssec.h>. 7979 [RT #42090] 7980 7981 4342. [bug] 'rndc flushtree' could fail to clean the tree if there 7982 wasn't a node at the specified name. [RT #41846] 7983 7984 .. code-block:: none 7985 7986 --- 9.11.0a1 released --- 7987 7988 4341. [bug] Correct the handling of ECS options with 7989 address family 0. [RT #41377] 7990 7991 4340. [performance] Implement adaptive read-write locks, reducing the 7992 overhead of locks that are only held briefly. 7993 [RT #37329] 7994 7995 4339. [test] Use "mdig" to test pipelined queries. [RT #41929] 7996 7997 4338. [bug] Reimplement change 4324 as it wasn't properly doing 7998 all the required book keeping. [RT #41941] 7999 8000 4337. [bug] The previous change exposed a latent flaw in 8001 key refresh queries for managed-keys when 8002 a cached DNSKEY had TTL 0. [RT #41986] 8003 8004 4336. [bug] Don't emit records with zero ttl unless the records 8005 were learnt with a zero ttl. [RT #41687] 8006 8007 4335. [bug] zone->view could be detached too early. [RT #41942] 8008 8009 4334. [func] 'named -V' now reports zlib version. [RT #41913] 8010 8011 4333. [maint] L.ROOT-SERVERS.NET is now 199.7.83.42 and 8012 2001:500:9f::42. 8013 8014 4332. [placeholder] 8015 8016 4331. [func] When loading managed signed zones detect if the 8017 RRSIG's inception time is in the future and regenerate 8018 the RRSIG immediately. [RT #41808] 8019 8020 4330. [protocol] Identify the PAD option as "PAD" when printing out 8021 a message. 8022 8023 4329. [func] Warn about a common misconfiguration when forwarding 8024 RFC 1918 zones. [RT #41441] 8025 8026 4328. [performance] Add dns_name_fromwire() benchmark test. [RT #41694] 8027 8028 4327. [func] Log query and depth counters during fetches when 8029 querytrace (./configure --enable-querytrace) is 8030 enabled (helps in diagnosing). [RT #41787] 8031 8032 4326. [protocol] Add support for AVC. [RT #41819] 8033 8034 4325. [func] Add a line to "rndc status" indicating the 8035 hostname and operating system details. [RT #41610] 8036 8037 4324. [bug] When deleting records from a zone database, interior 8038 nodes could be left empty but not deleted, damaging 8039 search performance afterward. [RT #40997] 8040 8041 4323. [bug] Improve HTTP header processing on statschannel. 8042 [RT #41674] 8043 8044 4322. [security] Duplicate EDNS COOKIE options in a response could 8045 trigger an assertion failure. (CVE-2016-2088) 8046 [RT #41809] 8047 8048 4321. [bug] Zones using mapped files containing out-of-zone data 8049 could return SERVFAIL instead of the expected NODATA 8050 or NXDOMAIN results. [RT #41596] 8051 8052 4320. [bug] Insufficient memory allocation when handling 8053 "none" ACL could cause an assertion failure in 8054 named when parsing ACL configuration. [RT #41745] 8055 8056 4319. [security] Fix resolver assertion failure due to improper 8057 DNAME handling when parsing fetch reply messages. 8058 (CVE-2016-1286) [RT #41753] 8059 8060 4318. [security] Malformed control messages can trigger assertions 8061 in named and rndc. (CVE-2016-1285) [RT #41666] 8062 8063 4317. [bug] Age all unused servers on fetch timeout. [RT #41597] 8064 8065 4316. [func] Add option to tools to print RRs in unknown 8066 presentation format [RT #41595]. 8067 8068 4315. [bug] Check that configured view class isn't a meta class. 8069 [RT #41572]. 8070 8071 4314. [contrib] Added 'dnsperf-2.1.0.0-1', a set of performance 8072 testing tools provided by Nominum, Inc. 8073 8074 4313. [bug] Handle ns_client_replace failures in test mode. 8075 [RT #41190] 8076 8077 4312. [bug] dig's unknown DNS and EDNS flags (MBZ value) logging 8078 was not consistent. [RT #41600] 8079 8080 4311. [bug] Prevent "rndc delzone" from being used on 8081 response-policy zones. [RT #41593] 8082 8083 4310. [performance] Use __builtin_expect() where available to annotate 8084 conditions with known behavior. [RT #41411] 8085 8086 4309. [cleanup] Remove the spurious "none" filename from log messages 8087 when processing built-in configuration. [RT #41594] 8088 8089 4308. [func] Added operating system details to "named -V" 8090 output. [RT #41452] 8091 8092 4307. [bug] "dig +subnet" and "mdig +subnet" could send 8093 incorrectly-formatted Client Subnet options 8094 if the prefix length was not divisible by 8. 8095 Also fixed a memory leak in "mdig". [RT #45178] 8096 8097 4306. [maint] Added a PKCS#11 openssl patch supporting 8098 version 1.0.2f [RT #38312] 8099 8100 4305. [bug] dnssec-signzone was not removing unnecessary rrsigs 8101 from the zone's apex. [RT #41483] 8102 8103 4304. [port] xfer system test failed as 'tail -n +value' is not 8104 portable. [RT #41315] 8105 8106 4303. [bug] "dig +subnet" was unable to send a prefix length of 8107 zero, as it was incorrectly changed to 32 for v4 8108 prefixes or 128 for v6 prefixes. In addition to 8109 fixing this, "dig +subnet=0" has been added as a 8110 short form for 0.0.0.0/0. The same changes have 8111 also been made in "mdig". [RT #41553] 8112 8113 4302. [port] win32: fixed a build error in VS 2015. [RT #41426] 8114 8115 4301. [bug] dnssec-settime -p [DP]sync was not working. [RT #41534] 8116 8117 4300. [bug] A flag could be set in the wrong field when setting 8118 up non-recursive queries; this could cause the 8119 SERVFAIL cache to cache responses it shouldn't. 8120 New querytrace logging has been added which 8121 identified this error. [RT #41155] 8122 8123 4299. [bug] Check that exactly totallen bytes are read when 8124 reading a RRset from raw files in both single read 8125 and incremental modes. [RT #41402] 8126 8127 4298. [bug] dns_rpz_add errors in loadzone were not being 8128 propagated up the call stack. [RT #41425] 8129 8130 4297. [test] Ensure delegations in RPZ zones fail robustly. 8131 [RT #41518] 8132 8133 4296. [bug] TCP packet sizes were calculated incorrectly in the 8134 stats channel; they could be counted in the wrong 8135 histogram bucket. [RT #40587] 8136 8137 4295. [bug] An unchecked result in dns_message_pseudosectiontotext() 8138 could allow incorrect text formatting of EDNS EXPIRE 8139 options. [RT #41437] 8140 8141 4294. [bug] Fixed a regression in which "rndc stop -p" failed 8142 to print the PID. [RT #41513] 8143 8144 4293. [bug] Address memory leak on priming query creation failure. 8145 [RT #41512] 8146 8147 4292. [placeholder] 8148 8149 4291. [cleanup] Added a required include to dns/forward.h. [RT #41474] 8150 8151 4290. [func] The timers returned by the statistics channel 8152 (indicating current time, server boot time, and 8153 most recent reconfiguration time) are now reported 8154 with millisecond accuracy. [RT #40082] 8155 8156 4289. [bug] The server could crash due to memory being used 8157 after it was freed if a zone transfer timed out. 8158 [RT #41297] 8159 8160 4288. [bug] Fixed a regression in resolver.c:possibly_mark() 8161 which caused known-bogus servers to be queried 8162 anyway. [RT #41321] 8163 8164 4287. [bug] Silence an overly noisy log message when message 8165 parsing fails. [RT #41374] 8166 8167 4286. [security] render_ecs errors were mishandled when printing out 8168 a OPT record resulting in a assertion failure. 8169 (CVE-2015-8705) [RT #41397] 8170 8171 4285. [security] Specific APL data could trigger a INSIST. 8172 (CVE-2015-8704) [RT #41396] 8173 8174 4284. [bug] Some GeoIP options were incorrectly documented 8175 using abbreviated forms which were not accepted by 8176 named. The code has been updated to allow both 8177 long and abbreviated forms. [RT #41381] 8178 8179 4283. [bug] OPENSSL_config is no longer re-callable. [RT #41348] 8180 8181 4282. [func] 'dig +[no]mapped' determine whether the use of mapped 8182 IPv4 addresses over IPv6 is permitted or not. The 8183 default is +mapped. [RT #41307] 8184 8185 4281. [bug] Teach dns_message_totext about BADCOOKIE. [RT #41257] 8186 8187 4280. [performance] Use optimal message sizes to improve compression 8188 in AXFRs. This reduces network traffic. [RT #40996] 8189 8190 4279. [test] Don't use fixed ports when unit testing. [RT #41194] 8191 8192 4278. [bug] 'delv +short +[no]split[=##]' didn't work as expected. 8193 [RT #41238] 8194 8195 4277. [performance] Improve performance of the RBT, the central zone 8196 datastructure: The aux hashtable was improved, 8197 hash function was updated to perform more 8198 uniform mapping, uppernode was added to 8199 dns_rbtnode, and other cleanups and performance 8200 improvements were made. [RT #41165] 8201 8202 4276. [protocol] Add support for SMIMEA. [RT #40513] 8203 8204 4275. [performance] Lazily initialize dns_compress->table only when 8205 compression is enabled. [RT #41189] 8206 8207 4274. [performance] Speed up typemap processing from text. [RT #41196] 8208 8209 4273. [bug] Only call dns_test_begin() and dns_test_end() once each 8210 in nsec3_test as it fails with GOST if called multiple 8211 times. 8212 8213 4272. [bug] dig: the +norrcomments option didn't work with +multi. 8214 [RT #41234] 8215 8216 4271. [test] Unit tests could deadlock in isc__taskmgr_pause(). 8217 [RT #41235] 8218 8219 4270. [security] Update allowed OpenSSL versions as named is 8220 potentially vulnerable to CVE-2015-3193. 8221 8222 4269. [bug] Zones using "map" format master files currently 8223 don't work as policy zones. This limitation has 8224 now been documented; attempting to use such zones 8225 in "response-policy" statements is now a 8226 configuration error. [RT #38321] 8227 8228 4268. [func] "rndc status" now reports the path to the 8229 configuration file. [RT #36470] 8230 8231 4267. [test] Check sdlz error handling. [RT #41142] 8232 8233 4266. [placeholder] 8234 8235 4265. [bug] Address unchecked isc_mem_get calls. [RT #41187] 8236 8237 4264. [bug] Check const of strchr/strrchr assignments match 8238 argument's const status. [RT #41150] 8239 8240 4263. [contrib] Address compiler warnings in mysqldyn module. 8241 [RT #41130] 8242 8243 4262. [bug] Fixed a bug in epoll socket code that caused 8244 sockets to not be registered for ready 8245 notification in some cases, causing named to not 8246 read from or write to them, resulting in what 8247 appear to the user as blocked connections. 8248 [RT #41067] 8249 8250 4261. [maint] H.ROOT-SERVERS.NET is 198.97.190.53 and 2001:500:1::53. 8251 [RT #40556] 8252 8253 4260. [security] Insufficient testing when parsing a message allowed 8254 records with an incorrect class to be be accepted, 8255 triggering a REQUIRE failure when those records 8256 were subsequently cached. (CVE-2015-8000) [RT #40987] 8257 8258 4259. [func] Add an option for non-destructive control channel 8259 access using a "read-only" clause. In such 8260 cases, a restricted set of rndc commands are 8261 allowed for querying information from named. 8262 [RT #40498] 8263 8264 4258. [bug] Limit rndc query message sizes to 32 KiB. This should 8265 not break any legitimate rndc commands, but will 8266 prevent a rogue rndc query from allocating too 8267 much memory. [RT #41073] 8268 8269 4257. [cleanup] Python scripts reported incorrect version. [RT #41080] 8270 8271 4256. [bug] Allow rndc command arguments to be quoted so as 8272 to allow spaces. [RT #36665] 8273 8274 4255. [performance] Add 'message-compression' option to disable DNS 8275 compression in responses. [RT #40726] 8276 8277 4254. [bug] Address missing lock when getting zone's serial. 8278 [RT #41072] 8279 8280 4253. [security] Address fetch context reference count handling error 8281 on socket error. (CVE-2015-8461) [RT#40945] 8282 8283 4252. [func] Add support for automating the generation CDS and 8284 CDNSKEY rrsets to named and dnssec-signzone. 8285 [RT #40424] 8286 8287 4251. [bug] NTAs were deleted when the server was reconfigured 8288 or reloaded. [RT #41058] 8289 8290 4250. [func] Log the TSIG key in use during inbound zone 8291 transfers. [RT #41075] 8292 8293 4249. [func] Improve error reporting of TSIG / SIG(0) records in 8294 the wrong location. [RT #41030] 8295 8296 4248. [performance] Add an isc_atomic_storeq() function, use it in 8297 stats counters to improve performance. 8298 [RT #39972] [RT #39979] 8299 8300 4247. [port] Require both HAVE_JSON and JSON_C_VERSION to be 8301 defined to report json library version. [RT #41045] 8302 8303 4246. [test] Ensure the statschannel system test runs when BIND 8304 is not built with libjson. [RT #40944] 8305 8306 4245. [placeholder] 8307 8308 4244. [bug] The parser was not reporting that use-ixfr is obsolete. 8309 [RT #41010] 8310 8311 4243. [func] Improved stats reporting from Timothe Litt. [RT #38941] 8312 8313 4242. [bug] Replace the client if not already replaced when 8314 prefetching. [RT #41001] 8315 8316 4241. [doc] Improved the TSIG, TKEY, and SIG(0) sections in 8317 the ARM. [RT #40955] 8318 8319 4240. [port] Fix LibreSSL compatibility. [RT #40977] 8320 8321 4239. [func] Changed default servfail-ttl value to 1 second from 10. 8322 Also, the maximum value is now 30 instead of 300. 8323 [RT #37556] 8324 8325 4238. [bug] Don't send to servers on net zero (0.0.0.0/8). 8326 [RT #40947] 8327 8328 4237. [doc] Upgraded documentation toolchain to use DocBook 5 8329 and dblatex. [RT #40766] 8330 8331 4236. [performance] On machines with 2 or more processors (CPU), the 8332 default value for the number of UDP listeners 8333 has been changed to the number of detected 8334 processors minus one. [RT #40761] 8335 8336 4235. [func] Added support in named for "dnstap", a fast method of 8337 capturing and logging DNS traffic, and a new command 8338 "dnstap-read" to read a dnstap log file. Use 8339 "configure --enable-dnstap" to enable this 8340 feature (note that this requires libprotobuf-c 8341 and libfstrm). See the ARM for configuration details. 8342 8343 Thanks to Robert Edmonds of Farsight Security. 8344 [RT #40211] 8345 8346 4234. [func] Add deflate compression in statistics channel HTTP 8347 server. [RT #40861] 8348 8349 4233. [test] Add tests for CDS and CDNSKEY with delegation-only. 8350 [RT #40597] 8351 8352 4232. [contrib] Address unchecked memory allocation calls in 8353 query-loc and zone2ldap. [RT #40789] 8354 8355 4231. [contrib] Address unchecked calloc call in dlz_mysqldyn_mod.c. 8356 [RT #40840] 8357 8358 4230. [contrib] dlz_wildcard_dynamic.c:dlz_create could return a 8359 uninitialized result. [RT #40839] 8360 8361 4229. [bug] A variable could be used uninitialized in 8362 dns_update_signaturesinc. [RT #40784] 8363 8364 4228. [bug] Address race condition in dns_client_destroyrestrans. 8365 [RT #40605] 8366 8367 4227. [bug] Silence static analysis warnings. [RT #40828] 8368 8369 4226. [bug] Address a theoretical shutdown race in 8370 zone.c:notify_send_queue(). [RT #38958] 8371 8372 4225. [port] freebsd/openbsd: Use '${CC} -shared' for building 8373 shared libraries. [RT #39557] 8374 8375 4224. [func] Added support for "dyndb", a new interface for loading 8376 zone data from an external database, developed by 8377 Red Hat for the FreeIPA project. 8378 8379 DynDB drivers fully implement the BIND database 8380 API, and are capable of significantly better 8381 performance and functionality than DLZ drivers, 8382 while taking advantage of advanced database 8383 features not available in BIND such as multi-master 8384 replication. 8385 8386 Thanks to Adam Tkac and Petr Spacek of Red Hat. 8387 [RT #35271] 8388 8389 4223. [func] Add support for setting max-cache-size to percentage 8390 of available physical memory, set default to 90%. 8391 [RT #38442] 8392 8393 4222. [func] Bias IPv6 servers when selecting the next server to 8394 query. [RT #40836] 8395 8396 4221. [bug] Resource leak on DNS_R_NXDOMAIN in fctx_create. 8397 [RT #40583] 8398 8399 4220. [doc] Improve documentation for zone-statistics. 8400 [RT #36955] 8401 8402 4219. [bug] Set event->result to ISC_R_WOULDBLOCK on EWOULDBLOCK, 8403 EGAIN when these soft error are not retried for 8404 isc_socket_send*(). 8405 8406 4218. [bug] Potential null pointer dereference on out of memory 8407 if mmap is not supported. [RT #40777] 8408 8409 4217. [protocol] Add support for CSYNC. [RT #40532] 8410 8411 4216. [cleanup] Silence static analysis warnings. [RT #40649] 8412 8413 4215. [bug] nsupdate: skip to next request on GSSTKEY create 8414 failure. [RT #40685] 8415 8416 4214. [protocol] Add support for TALINK. [RT #40544] 8417 8418 4213. [bug] Don't reuse a cache across multiple classes. 8419 [RT #40205] 8420 8421 4212. [func] Re-query if we get a bad client cookie returned over 8422 UDP. [RT #40748] 8423 8424 4211. [bug] Ensure that lwresd gets at least one task to work 8425 with if enabled. [RT #40652] 8426 8427 4210. [cleanup] Silence use after free false positive. [RT #40743] 8428 8429 4209. [bug] Address resource leaks in dlz modules. [RT #40654] 8430 8431 4208. [bug] Address null pointer dereferences on out of memory. 8432 [RT #40764] 8433 8434 4207. [bug] Handle class mismatches with raw zone files. 8435 [RT #40746] 8436 8437 4206. [bug] contrib: fixed a possible NULL dereference in 8438 DLZ wildcard module. [RT #40745] 8439 8440 4205. [bug] 'named-checkconf -p' could include unwanted spaces 8441 when printing tuples with unset optional fields. 8442 [RT #40731] 8443 8444 4204. [bug] 'dig +trace' failed to lookup the correct type if 8445 the initial root NS query was retried. [RT #40296] 8446 8447 4203. [test] The rrchecker system test now tests conversion 8448 to and from unknown-type format. [RT #40584] 8449 8450 4202. [bug] isccc_cc_fromwire() could return an incorrect 8451 result. [RT #40614] 8452 8453 4201. [func] The default preferred-glue is now the address record 8454 type of the transport the query was received 8455 over. [RT #40468] 8456 8457 4200. [cleanup] win32: update BINDinstall to be BIND release 8458 independent. [RT #38915] 8459 8460 4199. [protocol] Add support for NINFO, RKEY, SINK, TA. 8461 [RT #40545] [RT #40547] [RT #40561] [RT #40563] 8462 8463 4198. [placeholder] 8464 8465 4197. [bug] 'named-checkconf -z' didn't handle 'in-view' clauses. 8466 [RT #40603] 8467 8468 4196. [doc] Improve how "enum + other" types are documented. 8469 [RT #40608] 8470 8471 4195. [bug] 'max-zone-ttl unlimited;' was broken. [RT #40608] 8472 8473 4194. [bug] named-checkconf -p failed to properly print a port 8474 range. [RT #40634] 8475 8476 4193. [bug] Handle broken servers that return BADVERS incorrectly. 8477 [RT #40427] 8478 8479 4192. [bug] The default rrset-order of random was not always being 8480 applied. [RT #40456] 8481 8482 4191. [protocol] Accept DNS-SD non LDH PTR records in reverse zones 8483 as per RFC 6763. [RT #37889] 8484 8485 4190. [protocol] Accept Active Directory gc._msdcs.<forest> name as 8486 valid with check-names. <forest> still needs to be 8487 LDH. [RT #40399] 8488 8489 4189. [cleanup] Don't exit on overly long tokens in named.conf. 8490 [RT #40418] 8491 8492 4188. [bug] Support HTTP/1.0 client properly on the statistics 8493 channel. [RT #40261] 8494 8495 4187. [func] When any RR type implementation doesn't 8496 implement totext() for the RDATA's wire 8497 representation and returns ISC_R_NOTIMPLEMENTED, 8498 such RDATA is now printed in unknown 8499 presentation format (RFC 3597). RR types affected 8500 include LOC(29) and APL(42). [RT #40317]. 8501 8502 4186. [bug] Fixed an RPZ bug where a QNAME would be matched 8503 against a policy RR with wildcard owner name 8504 (trigger) where the QNAME was the wildcard owner 8505 name's parent. For example, the bug caused a query 8506 with QNAME "example.com" to match a policy RR with 8507 "*.example.com" as trigger. [RT #40357] 8508 8509 4185. [bug] Fixed an RPZ bug where a policy RR with wildcard 8510 owner name (trigger) would prevent another policy RR 8511 with its parent owner name from being 8512 loaded. For example, the bug caused a policy RR 8513 with trigger "example.com" to not have any 8514 effect when a previous policy RR with trigger 8515 "*.example.com" existed in that RPZ zone. 8516 [RT #40357] 8517 8518 4184. [bug] Fixed a possible memory leak in name compression 8519 when rendering long messages. (Also, improved 8520 wire_test for testing such messages.) [RT #40375] 8521 8522 4183. [cleanup] Use timing-safe memory comparisons in cryptographic 8523 code. Also, the timing-safe comparison functions have 8524 been renamed to avoid possible confusion with 8525 memcmp(). Thanks to Loganaden Velvindron of 8526 AFRINIC. [RT #40148] 8527 8528 4182. [cleanup] Use mnemonics for RR class and type comparisons. 8529 [RT #40297] 8530 8531 4181. [bug] Queued notify messages could be dequeued from the 8532 wrong rate limiter queue. [RT #40350] 8533 8534 4180. [bug] Error responses in pipelined queries could 8535 cause a crash in client.c. [RT #40289] 8536 8537 4179. [bug] Fix double frees in getaddrinfo() in libirs. 8538 [RT #40209] 8539 8540 4178. [bug] Fix assertion failure in parsing UNSPEC(103) RR from 8541 text. [RT #40274] 8542 8543 4177. [bug] Fix assertion failure in parsing NSAP records from 8544 text. [RT #40285] 8545 8546 4176. [bug] Address race issues with lwresd. [RT #40284] 8547 8548 4175. [bug] TKEY with GSS-API keys needed bigger buffers. 8549 [RT #40333] 8550 8551 4174. [bug] "dnssec-coverage -r" didn't handle time unit 8552 suffixes correctly. [RT #38444] 8553 8554 4173. [bug] dig +sigchase was not properly matching the trusted 8555 key. [RT #40188] 8556 8557 4172. [bug] Named / named-checkconf didn't handle a view of CLASS0. 8558 [RT #40265] 8559 8560 4171. [bug] Fixed incorrect class checks in TSIG RR 8561 implementation. [RT #40287] 8562 8563 4170. [security] An incorrect boundary check in the OPENPGPKEY 8564 rdatatype could trigger an assertion failure. 8565 (CVE-2015-5986) [RT #40286] 8566 8567 4169. [test] Added a 'wire_test -d' option to read input as 8568 raw binary data, for use as a fuzzing harness. 8569 [RT #40312] 8570 8571 4168. [security] A buffer accounting error could trigger an 8572 assertion failure when parsing certain malformed 8573 DNSSEC keys. (CVE-2015-5722) [RT #40212] 8574 8575 4167. [func] Update rndc's usage output to include recently added 8576 commands. Thanks to Tony Finch for submitting a 8577 patch. [RT #40010] 8578 8579 4166. [func] Print informative output from rndc showzone when 8580 allow-new-zones is not enabled for a view. Thanks to 8581 Tony Finch for submitting a patch. [RT #40009] 8582 8583 4165. [security] A failure to reset a value to NULL in tkey.c could 8584 result in an assertion failure. (CVE-2015-5477) 8585 [RT #40046] 8586 8587 4164. [bug] Don't rename slave files and journals on out of memory. 8588 [RT #40033] 8589 8590 4163. [bug] Address compiler warnings. [RT #40024] 8591 8592 4162. [bug] httpdmgr->flags was not being initialized. [RT #40017] 8593 8594 4161. [test] Add JSON test for traffic size stats; also test 8595 for consistency between "rndc stats" and the XML 8596 and JSON statistics channel contents. [RT #38700] 8597 8598 4160. [placeholder] 8599 8600 4159. [cleanup] Alphabetize dig's help output. [RT #39966] 8601 8602 4158. [placeholder] 8603 8604 4157. [placeholder] 8605 8606 4156. [func] Added statistics counters to track the sizes 8607 of incoming queries and outgoing responses in 8608 histogram buckets, as specified in RSSAC002. 8609 [RT #39049] 8610 8611 4155. [func] Allow RPZ rewrite logging to be configured on a 8612 per-zone basis using a newly introduced log clause in 8613 the response-policy option. [RT #39754] 8614 8615 4154. [bug] A OPT record should be included with the FORMERR 8616 response when there is a malformed EDNS option. 8617 [RT #39647] 8618 8619 4153. [bug] Dig should zero non significant +subnet bits. Check 8620 that non significant ECS bits are zero on receipt. 8621 [RT #39647] 8622 8623 4152. [func] Implement DNS COOKIE option. This replaces the 8624 experimental SIT option of BIND 9.10. The following 8625 named.conf directives are available: send-cookie, 8626 cookie-secret, cookie-algorithm, nocookie-udp-size 8627 and require-server-cookie. The following dig options 8628 are available: +[no]cookie[=value] and +[no]badcookie. 8629 [RT #39928] 8630 8631 4151. [bug] 'rndc flush' could cause a deadlock. [RT #39835] 8632 8633 4150. [bug] win32: listen-on-v6 { any; }; was not working. Apply 8634 minimal fix. [RT #39667] 8635 8636 4149. [bug] Fixed a race condition in the getaddrinfo() 8637 implementation in libirs, which caused the delv 8638 utility to crash with an assertion failure when using 8639 the '@server' syntax with a hostname argument. 8640 [RT #39899] 8641 8642 4148. [bug] Fix a bug when printing zone names with '/' character 8643 in XML and JSON statistics output. [RT #39873] 8644 8645 4147. [bug] Filter-aaaa / filter-aaaa-on-v4 / filter-aaaa-on-v6 8646 was returning referrals rather than nodata responses 8647 when the AAAA records were filtered. [RT #39843] 8648 8649 4146. [bug] Address reference leak that could prevent a clean 8650 shutdown. [RT #37125] 8651 8652 4145. [bug] Not all unassociated adb entries where being printed. 8653 [RT #37125] 8654 8655 4144. [func] Add statistics counters for nxdomain redirections. 8656 [RT #39790] 8657 8658 4143. [placeholder] 8659 8660 4142. [bug] rndc addzone with view specified saved NZF config 8661 that could not be read back by named. This has now 8662 been fixed. [RT #39845] 8663 8664 4141. [bug] A formatting bug caused rndc zonestatus to print 8665 negative numbers for large serial values. This has 8666 now been fixed. [RT #39854] 8667 8668 4140. [cleanup] Remove redundant nzf_remove() call during delzone. 8669 [RT #39844] 8670 8671 4139. [doc] Fix rpz-client-ip documentation. [RT #39783] 8672 8673 4138. [security] An uninitialized value in validator.c could result 8674 in an assertion failure. (CVE-2015-4620) [RT #39795] 8675 8676 4137. [bug] Make rndc reconfig report configuration errors the 8677 same way rndc reload does. [RT #39635] 8678 8679 4136. [bug] Stale statistics counters with the leading 8680 '#' prefix (such as #NXDOMAIN) were not being 8681 updated correctly. This has been fixed. [RT #39141] 8682 8683 4135. [cleanup] Log expired NTA at startup. [RT #39680] 8684 8685 4134. [cleanup] Include client-ip rules when logging the number 8686 of RPZ rules of each type. [RT #39670] 8687 8688 4133. [port] Update how various json libraries are handled. 8689 [RT #39646] 8690 8691 4132. [cleanup] dig: added +rd as a synonym for +recurse, 8692 added +class as an unabbreviated alternative 8693 to +cl. [RT #39686] 8694 8695 4131. [bug] Addressed further problems with reloading RPZ 8696 zones. [RT #39649] 8697 8698 4130. [bug] The compatibility shim for *printf() misprinted some 8699 large numbers. [RT #39586] 8700 8701 4129. [port] Address API changes in OpenSSL 1.1.0. [RT #39532] 8702 8703 4128. [bug] Address issues raised by Coverity 7.6. [RT #39537] 8704 8705 4127. [protocol] CDS and CDNSKEY need to be signed by the key signing 8706 key as per RFC 7344, Section 4.1. [RT #37215] 8707 8708 4126. [bug] Addressed a regression introduced in change #4121. 8709 [RT #39611] 8710 8711 4125. [test] Added tests for dig, renamed delv test to digdelv. 8712 [RT #39490] 8713 8714 4124. [func] Log errors or warnings encountered when parsing the 8715 internal default configuration. Clarify the logging 8716 of errors and warnings encountered in rndc 8717 addzone or modzone parameters. [RT #39440] 8718 8719 4123. [port] Added %z (size_t) format options to the portable 8720 internal printf/sprintf implementation. [RT #39586] 8721 8722 4122. [bug] The server could match a shorter prefix than what was 8723 available in CLIENT-IP policy triggers, and so, an 8724 unexpected action could be taken. This has been 8725 corrected. [RT #39481] 8726 8727 4121. [bug] On servers with one or more policy zones 8728 configured as slaves, if a policy zone updated 8729 during regular operation (rather than at 8730 startup) using a full zone reload, such as via 8731 AXFR, a bug could allow the RPZ summary data to 8732 fall out of sync, potentially leading to an 8733 assertion failure in rpz.c when further 8734 incremental updates were made to the zone, such 8735 as via IXFR. [RT #39567] 8736 8737 4120. [bug] A bug in RPZ could cause the server to crash if 8738 policy zones were updated while recursion was 8739 pending for RPZ processing of an active query. 8740 [RT #39415] 8741 8742 4119. [test] Allow dig to set the message opcode. [RT #39550] 8743 8744 4118. [bug] Teach isc-config.sh about irs. [RT #39213] 8745 8746 4117. [protocol] Add EMPTY.AS112.ARPA as per RFC 7534. 8747 8748 4116. [bug] Fix a bug in RPZ that could cause some policy 8749 zones that did not specifically require 8750 recursion to be treated as if they did; 8751 consequently, setting qname-wait-recurse no; was 8752 sometimes ineffective. [RT #39229] 8753 8754 4115. [func] "rndc -r" now prints the result code (e.g., 8755 ISC_R_SUCCESS, ISC_R_TIMEOUT, etc) after 8756 running the requested command. [RT #38913] 8757 8758 4114. [bug] Fix a regression in radix tree implementation 8759 introduced by ECS code. This bug was never 8760 released, but it was reported by a user testing 8761 master. [RT #38983] 8762 8763 4113. [test] Check for Net::DNS is some system test 8764 prerequisites. [RT #39369] 8765 8766 4112. [bug] Named failed to load when "root-delegation-only" 8767 was used without a list of domains to exclude. 8768 [RT #39380] 8769 8770 4111. [doc] Alphabetize rndc man page. [RT #39360] 8771 8772 4110. [bug] Address memory leaks / null pointer dereferences 8773 on out of memory. [RT #39310] 8774 8775 4109. [port] linux: support reading the local port range from 8776 net.ipv4.ip_local_port_range. [RT # 39379] 8777 8778 4108. [func] An additional NXDOMAIN redirect method (option 8779 "nxdomain-redirect") has been added, allowing 8780 redirection to a specified DNS namespace instead 8781 of a single redirect zone. [RT #37989] 8782 8783 4107. [bug] Address potential deadlock when updating zone content. 8784 [RT #39269] 8785 8786 4106. [port] Improve readline support. [RT #38938] 8787 8788 4105. [port] Misc fixes for Microsoft Visual Studio 8789 2015 CTP6 in 64 bit mode. [RT #39308] 8790 8791 4104. [bug] Address uninitialized elements. [RT #39252] 8792 8793 4103. [port] Misc fixes for Microsoft Visual Studio 8794 2015 CTP6. [RT #39267] 8795 8796 4102. [bug] Fix a use after free bug introduced in change 8797 #4094. [RT #39281] 8798 8799 4101. [bug] dig: the +split and +rrcomments options didn't 8800 work with +short. [RT #39291] 8801 8802 4100. [bug] Inherited owernames on the line immediately following 8803 a $INCLUDE were not working. [RT #39268] 8804 8805 4099. [port] clang: make unknown commandline options hard errors 8806 when determining what options are supported. 8807 [RT #39273] 8808 8809 4098. [bug] Address use-after-free issue when using a 8810 predecessor key with dnssec-settime. [RT #39272] 8811 8812 4097. [func] Add additional logging about xfrin transfer status. 8813 [RT #39170] 8814 8815 4096. [bug] Fix a use after free of query->sendevent. 8816 [RT #39132] 8817 8818 4095. [bug] zone->options2 was not being properly initialized. 8819 [RT #39228] 8820 8821 4094. [bug] A race during shutdown or reconfiguration could 8822 cause an assertion in mem.c. [RT #38979] 8823 8824 4093. [func] Dig now learns the SIT value from truncated 8825 responses when it retries over TCP. [RT #39047] 8826 8827 4092. [bug] 'in-view' didn't work for zones beneath a empty zone. 8828 [RT #39173] 8829 8830 4091. [cleanup] Some cleanups in isc mem code. [RT #38896] 8831 8832 4090. [bug] Fix a crash while parsing malformed CAA RRs in 8833 presentation format, i.e., from text such as 8834 from master files. Thanks to John Van de 8835 Meulebrouck Brendgard for discovering and 8836 reporting this problem. [RT #39003] 8837 8838 4089. [bug] Send notifies immediately for slave zones during 8839 startup. [RT #38843] 8840 8841 4088. [port] Fixed errors when building with libressl. [RT #38899] 8842 8843 4087. [bug] Fix a crash due to use-after-free due to sequencing 8844 of tasks actions. [RT #38495] 8845 8846 4086. [bug] Fix out-of-srcdir build with native pkcs11. [RT #38831] 8847 8848 4085. [bug] ISC_PLATFORM_HAVEXADDQ could be inconsistently set. 8849 [RT #38828] 8850 8851 4084. [bug] Fix a possible race in updating stats counters. 8852 [RT #38826] 8853 8854 4083. [cleanup] Print the number of CPUs and UDP listeners 8855 consistently in the log and in "rndc status" 8856 output; indicate whether threads are supported 8857 in "named -V" output. [RT #38811] 8858 8859 4082. [bug] Incrementally sign large inline zone deltas. 8860 [RT #37927] 8861 8862 4081. [cleanup] Use dns_rdatalist_init consistently. [RT #38759] 8863 8864 4080. [func] Completed change #4022, adding a "lock-file" option 8865 to named.conf to override the default lock file, 8866 in addition to the "named -X <filename>" command 8867 line option. Setting the lock file to "none" 8868 using either method disables the check completely. 8869 [RT #37908] 8870 8871 4079. [func] Preserve the case of the owner name of records to 8872 the RRset level. [RT #37442] 8873 8874 4078. [bug] Handle the case where CMSG_SPACE(sizeof(int)) != 8875 CMSG_SPACE(sizeof(char)). [RT #38621] 8876 8877 4077. [test] Add static-stub regression test for DS NXDOMAIN 8878 return making the static stub disappear. [RT #38564] 8879 8880 4076. [bug] Named could crash on shutdown with outstanding 8881 reload / reconfig events. [RT #38622] 8882 8883 4075. [placeholder] 8884 8885 4074. [cleanup] Cleaned up more warnings from gcc -Wshadow. [RT #38708] 8886 8887 4073. [cleanup] Add libjson-c version number reporting to 8888 "named -V"; normalize version number formatting. 8889 [RT #38056] 8890 8891 4072. [func] Add a --enable-querytrace configure switch for 8892 very verbose query trace logging. (This option 8893 has a negative performance impact and should be 8894 used only for debugging.) [RT #37520] 8895 8896 4071. [cleanup] Initialize pthread mutex attrs just once, instead of 8897 doing it per mutex creation. [RT #38547] 8898 8899 4070. [bug] Fix a segfault in nslookup in a query such as 8900 "nslookup isc.org AMS.SNS-PB.ISC.ORG -all". 8901 [RT #38548] 8902 8903 4069. [doc] Reorganize options in the nsupdate man page. 8904 [RT #38515] 8905 8906 4068. [bug] Omit unknown serial number from JSON zone statistics. 8907 [RT #38604] 8908 8909 4067. [cleanup] Reduce noise from RRL when query logging is 8910 disabled. [RT #38648] 8911 8912 4066. [doc] Reorganize options in the dig man page. [RT #38516] 8913 8914 4065. [test] Additional RFC 5011 tests. [RT #38569] 8915 8916 4064. [contrib] dnssec-keyset.sh: Generates a specified number 8917 of DNSSEC keys with timing set to implement a 8918 pre-publication key rollover strategy. Thanks 8919 to Jeffry A. Spain. [RT #38459] 8920 8921 4063. [bug] Asynchronous zone loads were not handled 8922 correctly when the zone load was already in 8923 progress; this could trigger a crash in zt.c. 8924 [RT #37573] 8925 8926 4062. [bug] Fix an out-of-bounds read in RPZ code. If the 8927 read succeeded, it doesn't result in a bug 8928 during operation. If the read failed, named 8929 could segfault. [RT #38559] 8930 8931 4061. [bug] Handle timeout in legacy system test. [RT #38573] 8932 8933 4060. [bug] dns_rdata_freestruct could be called on a 8934 uninitialized structure when handling a error. 8935 [RT #38568] 8936 8937 4059. [bug] Addressed valgrind warnings. [RT #38549] 8938 8939 4058. [bug] UDP dispatches could use the wrong pseudorandom 8940 number generator context. [RT #38578] 8941 8942 4057. [bug] 'dnssec-dsfromkey -T 0' failed to add ttl field. 8943 [RT #38565] 8944 8945 4056. [bug] Expanded automatic testing of trust anchor 8946 management and fixed several small bugs including 8947 a memory leak and a possible loss of key state 8948 information. [RT #38458] 8949 8950 4055. [func] "rndc managed-keys" can be used to check status 8951 of trust anchors or to force keys to be refreshed, 8952 Also, the managed keys data file has easier-to-read 8953 comments. [RT #38458] 8954 8955 4054. [func] Added a new tool 'mdig', a lightweight clone of 8956 dig able to send multiple pipelined queries. 8957 [RT #38261] 8958 8959 4053. [security] Revoking a managed trust anchor and supplying 8960 an untrusted replacement could cause named 8961 to crash with an assertion failure. 8962 (CVE-2015-1349) [RT #38344] 8963 8964 4052. [bug] Fix a leak of query fetchlock. [RT #38454] 8965 8966 4051. [bug] Fix a leak of pthread_mutexattr_t. [RT #38454] 8967 8968 4050. [bug] RPZ could send spurious SERVFAILs in response 8969 to duplicate queries. [RT #38510] 8970 8971 4049. [bug] CDS and CDNSKEY had the wrong attributes. [RT #38491] 8972 8973 4048. [bug] adb hash table was not being grown. [RT #38470] 8974 8975 4047. [cleanup] "named -V" now reports the current running versions 8976 of OpenSSL and the libxml2 libraries, in addition to 8977 the versions that were in use at build time. 8978 8979 4046. [bug] Accounting of "total use" in memory context 8980 statistics was not correct. [RT #38370] 8981 8982 4045. [bug] Skip to next master on dns_request_createvia4 failure. 8983 [RT #25185] 8984 8985 4044. [bug] Change 3955 was not complete, resulting in an assertion 8986 failure if the timing was just right. [RT #38352] 8987 8988 4043. [func] "rndc modzone" can be used to modify the 8989 configuration of an existing zone, using similar 8990 syntax to "rndc addzone". [RT #37895] 8991 8992 4042. [bug] zone.c:iszonesecure was being called too late. 8993 [RT #38371] 8994 8995 4041. [func] TCP sockets can now be shared while connecting. 8996 (This will be used to enable client-side support 8997 of pipelined queries.) [RT #38231] 8998 8999 4040. [func] Added server-side support for pipelined TCP 9000 queries. Clients may continue sending queries via 9001 TCP while previous queries are being processed 9002 in parallel. (The new "keep-response-order" 9003 option allows clients to be specified for which 9004 the old behavior will still be used.) [RT #37821] 9005 9006 4039. [cleanup] Cleaned up warnings from gcc -Wshadow. [RT #37381] 9007 9008 4038. [bug] Add 'rpz' flag to node and use it to determine whether 9009 to call dns_rpz_delete. This should prevent unbalanced 9010 add / delete calls. [RT #36888] 9011 9012 4037. [bug] also-notify was ignoring the tsig key when checking 9013 for duplicates resulting in some expected notify 9014 messages not being sent. [RT #38369] 9015 9016 4036. [bug] Make call to open a temporary file name safe during 9017 NZF creation. [RT #38331] 9018 9019 4035. [bug] Close temporary and NZF FILE pointers before moving 9020 the former into the latter's place, as required on 9021 Windows. [RT #38332] 9022 9023 4034. [func] When added, negative trust anchors (NTA) are now 9024 saved to files (viewname.nta), in order to 9025 persist across restarts of the named server. 9026 [RT #37087] 9027 9028 4033. [bug] Missing out of memory check in request.c:req_send. 9029 [RT #38311] 9030 9031 4032. [bug] Built-in "empty" zones did not correctly inherit the 9032 "allow-transfer" ACL from the options or view. 9033 [RT #38310] 9034 9035 4031. [bug] named-checkconf -z failed to report a missing file 9036 with a hint zone. [RT #38294] 9037 9038 4030. [func] "rndc delzone" is now applicable to zones that were 9039 configured in named.conf, as well as zones that 9040 were added via "rndc addzone". (Note, however, that 9041 if named.conf is not also modified, the deleted zone 9042 will return when named is reloaded.) [RT #37887] 9043 9044 4029. [func] "rndc showzone" displays the current configuration 9045 of a specified zone. [RT #37887] 9046 9047 4028. [bug] $GENERATE with a zero step was not being caught as a 9048 error. A $GENERATE with a / but no step was not being 9049 caught as a error. [RT #38262] 9050 9051 4027. [port] Net::DNS 0.81 compatibility. [RT #38165] 9052 9053 4026. [bug] Fix RFC 3658 reference in dig +sigchase. [RT #38173] 9054 9055 4025. [port] bsdi: failed to build. [RT #38047] 9056 9057 4024. [bug] dns_rdata_opt_first, dns_rdata_opt_next, 9058 dns_rdata_opt_current, dns_rdata_txt_first, 9059 dns_rdata_txt_next and dns_rdata_txt_current were 9060 documented but not implemented. These have now been 9061 implemented. 9062 9063 dns_rdata_spf_first, dns_rdata_spf_next and 9064 dns_rdata_spf_current were documented but not 9065 implemented. The prototypes for these 9066 functions have been removed. [RT #38068] 9067 9068 4023. [bug] win32: socket handling with explicit ports and 9069 invoking named with -4 was broken for some 9070 configurations. [RT #38068] 9071 9072 4022. [func] Stop multiple spawns of named by limiting number of 9073 processes to 1. This is done by using a lockfile and 9074 checking whether we can listen on any configured 9075 TCP interfaces. [RT #37908] 9076 9077 4021. [bug] Adjust max-recursion-queries to accommodate 9078 the need for more queries when the cache is 9079 empty. [RT #38104] 9080 9081 4020. [bug] Change 3736 broke nsupdate's SOA MNAME discovery 9082 resulting in updates being sent to the wrong server. 9083 [RT #37925] 9084 9085 4019. [func] If named is not configured to validate the answer 9086 then allow fallback to plain DNS on timeout even 9087 when we know the server supports EDNS. [RT #37978] 9088 9089 4018. [placeholder] 9090 9091 4017. [test] Add system test to check lookups to legacy servers 9092 with broken DNS behavior. [RT #37965] 9093 9094 4016. [bug] Fix a dig segfault due to bad linked list usage. 9095 [RT #37591] 9096 9097 4015. [bug] Nameservers that are skipped due to them being 9098 CNAMEs were not being logged. They are now logged 9099 to category 'cname' as per BIND 8. [RT #37935] 9100 9101 4014. [bug] When including a master file origin_changed was 9102 not being properly set leading to a potentially 9103 spurious 'inherited owner' warning. [RT #37919] 9104 9105 4013. [func] Add a new tcp-only option to server (config) / 9106 peer (struct) to use TCP transport to send 9107 queries (in place of UDP transport with a 9108 TCP fallback on truncated (TC set) response). 9109 [RT #37800] 9110 9111 4012. [cleanup] Check returned status of OpenSSL digest and HMAC 9112 functions when they return one. Note this applies 9113 only to FIPS capable OpenSSL libraries put in 9114 FIPS mode and MD5. [RT #37944] 9115 9116 4011. [bug] master's list port and dscp inheritance was not 9117 properly implemented. [RT #37792] 9118 9119 4010. [cleanup] Clear the prefetchable state when initiating a 9120 prefetch. [RT #37399] 9121 9122 4009. [func] delv: added a +tcp option. [RT #37855] 9123 9124 4008. [contrib] Updated zkt to latest version (1.1.3). [RT #37886] 9125 9126 4007. [doc] Remove acl forward reference restriction. [RT #37772] 9127 9128 4006. [security] A flaw in delegation handling could be exploited 9129 to put named into an infinite loop. This has 9130 been addressed by placing limits on the number 9131 of levels of recursion named will allow (default 7), 9132 and the number of iterative queries that it will 9133 send (default 50) before terminating a recursive 9134 query (CVE-2014-8500). 9135 9136 The recursion depth limit is configured via the 9137 "max-recursion-depth" option, and the query limit 9138 via the "max-recursion-queries" option. [RT #37580] 9139 9140 4005. [func] The buffer used for returning text from rndc 9141 commands is now dynamically resizable, allowing 9142 arbitrarily large amounts of text to be sent back 9143 to the client. (Prior to this change, it was 9144 possible for the output of "rndc tsig-list" to be 9145 truncated.) [RT #37731] 9146 9147 4004. [bug] When delegations had AAAA glue but not A, a 9148 reference could be leaked causing an assertion 9149 failure on shutdown. [RT #37796] 9150 9151 4003. [security] When geoip-directory was reconfigured during 9152 named run-time, the previously loaded GeoIP 9153 data could remain, potentially causing wrong 9154 ACLs to be used or wrong results to be served 9155 based on geolocation (CVE-2014-8680). [RT #37720] 9156 9157 4002. [security] Lookups in GeoIP databases that were not 9158 loaded could cause an assertion failure 9159 (CVE-2014-8680). [RT #37679] 9160 9161 4001. [security] The caching of GeoIP lookups did not always 9162 handle address families correctly, potentially 9163 resulting in an assertion failure (CVE-2014-8680). 9164 [RT #37672] 9165 9166 4000. [bug] NXDOMAIN redirection incorrectly handled NXRRSET 9167 from the redirect zone. [RT #37722] 9168 9169 .. code-block:: none 9170 9171 3999. [func] "mkeys" and "nzf" files are now named after 9172 their corresponding views, unless the view name 9173 contains characters that would be incompatible 9174 with use in a filename (i.e., slash, backslash, 9175 or capital letters). If a view name does contain 9176 these characters, the files will still be named 9177 using a cryptographic hash of the view name. 9178 Regardless of this, if a file using the old name 9179 format is found to exist, it will continue to be 9180 used. [RT #37704] 9181 9182 3998. [bug] isc_radix_search was returning matches that were 9183 too precise. [RT #37680] 9184 9185 3997. [protocol] Add OPENGPGKEY record. [RT# 37671] 9186 9187 3996. [bug] Address use after free on out of memory error in 9188 keyring_add. [RT #37639] 9189 9190 3995. [bug] receive_secure_serial holds the zone lock for too 9191 long. [RT #37626] 9192 9193 3994. [func] Dig now supports setting the last unassigned DNS 9194 header flag bit (dig +zflag). [RT #37421] 9195 9196 3993. [func] Dig now supports EDNS negotiation by default. 9197 (dig +[no]ednsnegotiation). 9198 9199 Note: This is disabled by default in BIND 9.10 9200 and enabled by default in BIND 9.11. [RT #37604] 9201 9202 3992. [func] DiG can now send queries without questions 9203 (dig +header-only). [RT #37599] 9204 9205 3991. [func] Add the ability to buffer logging output by specifying 9206 "buffered yes;" when defining a channel. [RT #26561] 9207 9208 3990. [test] Add tests for unknown DNSSEC algorithm handling. 9209 [RT #37541] 9210 9211 3989. [cleanup] Remove redundant dns_db_resigned calls. [RT #35748] 9212 9213 3988. [func] Allow the zone serial of a dynamically updatable 9214 zone to be updated via "rndc signing -serial". 9215 [RT #37404] 9216 9217 3987. [port] Handle future Visual Studio 14 incompatible changes. 9218 [RT #37380] 9219 9220 3986. [doc] Add the BIND version number to page footers 9221 in the ARM. [RT #37398] 9222 9223 3985. [doc] Describe how +ndots and +search interact in dig. 9224 [RT #37529] 9225 9226 3984. [func] Accept 256 byte long PINs in native PKCS#11 9227 crypto. [RT #37410] 9228 9229 3983. [bug] Change #3940 was incomplete: negative trust anchors 9230 could be set to last up to a week, but the 9231 "nta-lifetime" and "nta-recheck" options were 9232 still limited to one day. [RT #37522] 9233 9234 3982. [doc] Include release notes in product documentation. 9235 [RT #37272] 9236 9237 3981. [bug] Cache DS/NXDOMAIN independently of other query types. 9238 [RT #37467] 9239 9240 3980. [bug] Improve --with-tuning=large by self tuning of SO_RCVBUF 9241 size. [RT #37187] 9242 9243 3979. [bug] Negative trust anchor fetches were not properly 9244 managed. [RT #37488] 9245 9246 3978. [test] Added a unit test for Diffie-Hellman key 9247 computation, completing change #3974. [RT #37477] 9248 9249 3977. [cleanup] "rndc secroots" reported a "not found" error when 9250 there were no negative trust anchors set. [RT #37506] 9251 9252 3976. [bug] When refreshing managed-key trust anchors, clear 9253 any cached trust so that they will always be 9254 revalidated with the current set of secure 9255 roots. [RT #37506] 9256 9257 3975. [bug] Don't populate or use the bad cache for queries that 9258 don't request or use recursion. [RT #37466] 9259 9260 3974. [bug] Handle DH_compute_key() failure correctly in 9261 openssldh_link.c. [RT #37477] 9262 9263 3973. [test] Added hooks for Google Performance Tools CPU profiler, 9264 including real-time/wall-clock profiling. Use 9265 "configure --with-gperftools-profiler" to enable. 9266 [RT #37339] 9267 9268 3972. [bug] Fix host's usage statement. [RT #37397] 9269 9270 3971. [bug] Reduce the cascading failures due to a bad $TTL line 9271 in named-checkconf / named-checkzone. [RT #37138] 9272 9273 3970. [contrib] Fixed a use after free bug in the SDB LDAP driver. 9274 [RT #37237] 9275 9276 3969. [test] Added 'delv' system test. [RT #36901] 9277 9278 3968. [bug] Silence spurious log messages when using 'named -[46]'. 9279 [RT #37308] 9280 9281 3967. [test] Add test for inlined signed zone in multiple views 9282 with different DNSKEY sets. [RT #35759] 9283 9284 3966. [bug] Missing dns_db_closeversion call in receive_secure_db. 9285 [RT #35746] 9286 9287 3965. [func] Log outgoing packets and improve packet logging to 9288 support logging the remote address. [RT #36624] 9289 9290 3964. [func] nsupdate now performs check-names processing. 9291 [RT #36266] 9292 9293 3963. [test] Added NXRRSET test cases to the "dlzexternal" 9294 system test. [RT #37344] 9295 9296 3962. [bug] 'dig +topdown +trace +sigchase' address unhandled error 9297 conditions. [RT #34663] 9298 9299 3961. [bug] Forwarding of SIG(0) signed UPDATE messages failed with 9300 BADSIG. [RT #37216] 9301 9302 3960. [bug] 'dig +sigchase' could loop forever. [RT #37220] 9303 9304 3959. [bug] Updates could be lost if they arrived immediately 9305 after a rndc thaw. [RT #37233] 9306 9307 3958. [bug] Detect when writeable files have multiple references 9308 in named.conf. [RT #37172] 9309 9310 3957. [bug] "dnssec-keygen -S" failed for ECCGOST, ECDSAP256SHA256 9311 and ECDSAP384SHA384. [RT #37183] 9312 9313 3956. [func] Notify messages are now rate limited by notify-rate and 9314 startup-notify-rate instead of serial-query-rate. 9315 [RT #24454] 9316 9317 3955. [bug] Notify messages due to changes are no longer queued 9318 behind startup notify messages. [RT #24454] 9319 9320 3954. [bug] Unchecked mutex init in dlz_dlopen_driver.c [RT #37112] 9321 9322 3953. [bug] Don't escape semi-colon in TXT fields. [RT #37159] 9323 9324 3952. [bug] dns_name_fullcompare failed to set *nlabelsp when the 9325 two name pointers were the same. [RT #37176] 9326 9327 3951. [func] Add the ability to set yet-to-be-defined EDNS flags 9328 to dig (+ednsflags=#). [RT #37142] 9329 9330 3950. [port] Changed the bin/python Makefile to work around a 9331 bmake bug in FreeBSD 10 and NetBSD 6. [RT #36993] 9332 9333 3949. [experimental] Experimental support for draft-andrews-edns1 by sending 9334 EDNS(1) queries (define DRAFT_ANDREWS_EDNS1 when 9335 building). Add support for limiting the EDNS version 9336 advertised to servers: server { edns-version 0; }; 9337 Log the EDNS version received in the query log. 9338 [RT #35864] 9339 9340 3948. [port] solaris: RCVBUFSIZE was too large on Solaris with 9341 --with-tuning=large. [RT #37059] 9342 9343 3947. [cleanup] Set the executable bit on libraries when using 9344 libtool. [RT #36786] 9345 9346 3946. [cleanup] Improved "configure" search for a python interpreter. 9347 [RT #36992] 9348 9349 3945. [bug] Invalid wildcard expansions could be incorrectly 9350 accepted by the validator. [RT #37093] 9351 9352 3944. [test] Added a regression test for "server-id". [RT #37057] 9353 9354 3943. [func] SERVFAIL responses can now be cached for a 9355 limited time (configured by "servfail-ttl", 9356 default 10 seconds, limit 30). This can reduce 9357 the frequency of retries when an authoritative 9358 server is known to be failing, e.g., due to 9359 ongoing DNSSEC validation problems. [RT #21347] 9360 9361 3942. [bug] Wildcard responses from a optout range should be 9362 marked as insecure. [RT #37072] 9363 9364 3941. [doc] Include the BIND version number in the ARM. [RT #37067] 9365 9366 3940. [func] "rndc nta" now allows negative trust anchors to be 9367 set for up to one week. [RT #37069] 9368 9369 3939. [func] Improve UPDATE forwarding performance by allowing TCP 9370 connections to be shared. [RT #37039] 9371 9372 3938. [func] Added quotas to be used in recursive resolvers 9373 that are under high query load for names in zones 9374 whose authoritative servers are nonresponsive or 9375 are experiencing a denial of service attack. 9376 9377 - "fetches-per-server" limits the number of 9378 simultaneous queries that can be sent to any 9379 single authoritative server. The configured 9380 value is a starting point; it is automatically 9381 adjusted downward if the server is partially or 9382 completely non-responsive. The algorithm used to 9383 adjust the quota can be configured via the 9384 "fetch-quota-params" option. 9385 - "fetches-per-zone" limits the number of 9386 simultaneous queries that can be sent for names 9387 within a single domain. (Note: Unlike 9388 "fetches-per-server", this value is not 9389 self-tuning.) 9390 - New stats counters have been added to count 9391 queries spilled due to these quotas. 9392 9393 See the ARM for details of these options. [RT #37125] 9394 9395 3937. [func] Added some debug logging to better indicate the 9396 conditions causing SERVFAILs when resolving. 9397 [RT #35538] 9398 9399 3936. [func] Added authoritative support for the EDNS Client 9400 Subnet (ECS) option. 9401 9402 ACLs can now include "ecs" elements which specify 9403 an address or network prefix; if an ECS option is 9404 included in a DNS query, then the address encoded 9405 in the option will be matched against "ecs" ACL 9406 elements. 9407 9408 Also, if an ECS address is included in a query, 9409 then it will be used instead of the client source 9410 address when matching "geoip" ACL elements. This 9411 behavior can be overridden with "geoip-use-ecs no;". 9412 (Note: to enable "geoip" ACLs, use "configure 9413 --with-geoip". This requires libGeoIP version 9414 1.5.0 or higher.) 9415 9416 When "ecs" or "geoip" ACL elements are used to 9417 select a view for a query, the response will include 9418 an ECS option to indicate which client network the 9419 answer is valid for. 9420 9421 (Thanks to Vincent Bernat.) [RT #36781] 9422 9423 3935. [bug] "geoip asnum" ACL elements would not match unless 9424 the full organization name was specified. They 9425 can now match against the AS number alone (e.g., 9426 AS1234). [RT #36945] 9427 9428 3934. [bug] Catch bad 'sit-secret' in named-checkconf. Improve 9429 sit-secret documentation. [RT #36980] 9430 9431 3933. [bug] Corrected the implementation of dns_rdata_casecompare() 9432 for the HIP rdata type. [RT #36911] 9433 9434 3932. [test] Improved named-checkconf tests. [RT #36911] 9435 9436 3931. [cleanup] Cleanup how dlz grammar is defined. [RT #36879] 9437 9438 3930. [bug] "rndc nta -r" could cause a server hang if the 9439 NTA was not found. [RT #36909] 9440 9441 3929. [bug] 'host -a' needed to clear idnoptions. [RT #36963] 9442 9443 3928. [test] Improve rndc system test. [RT #36898] 9444 9445 3927. [bug] dig: report PKCS#11 error codes correctly when 9446 compiled with --enable-native-pkcs11. [RT #36956] 9447 9448 3926. [doc] Added doc for geoip-directory. [RT #36877] 9449 9450 3925. [bug] DS lookup of RFC 1918 empty zones failed. [RT #36917] 9451 9452 3924. [bug] Improve 'rndc addzone' error reporting. [RT #35187] 9453 9454 3923. [bug] Sanity check the xml2-config output. [RT #22246] 9455 9456 3922. [bug] When resigning, dnssec-signzone was removing 9457 all signatures from delegation nodes. It now 9458 retains DS and (if applicable) NSEC signatures. 9459 [RT #36946] 9460 9461 3921. [bug] AD was inappropriately set on RPZ responses. [RT #36833] 9462 9463 3920. [doc] Added doc for masterfile-style. [RT #36823] 9464 9465 3919. [bug] dig: continue to next line if a address lookup fails 9466 in batch mode. [RT #36755] 9467 9468 3918. [doc] Update check-spf documentation. [RT #36910] 9469 9470 3917. [bug] dig, nslookup and host now continue on names that are 9471 too long after applying a search list elements. 9472 [RT #36892] 9473 9474 3916. [contrib] zone2sqlite checked wrong result code. Address 9475 compiler warnings. [RT #36931] 9476 9477 3915. [bug] Address a assertion if a route event arrived while 9478 shutting down. [RT #36887] 9479 9480 3914. [bug] Allow the URI target and CAA value fields to 9481 be zero length. [RT #36737] 9482 9483 3913. [bug] Address race issue in dispatch. [RT #36731] 9484 9485 3912. [bug] Address some unrecoverable lookup failures. [RT #36330] 9486 9487 3911. [func] Implement EDNS EXPIRE option client side, allowing 9488 a slave server to set the expiration timer correctly 9489 when transferring zone data from another slave 9490 server. [RT #35925] 9491 9492 3910. [bug] Fix races to free event during shutdown. [RT #36720] 9493 9494 3909. [bug] When computing the number of elements required for a 9495 acl count_acl_elements could have a short count leading 9496 to a assertion failure. Also zero out new acl elements 9497 in dns_acl_merge. [RT #36675] 9498 9499 3908. [bug] rndc now differentiates between a zone in multiple 9500 views and a zone that doesn't exist at all. [RT #36691] 9501 9502 3907. [cleanup] Alphabetize rndc help. [RT #36683] 9503 9504 3906. [protocol] Update URI record format to comply with 9505 draft-faltstrom-uri-08. [RT #36642] 9506 9507 3905. [bug] Address deadlock between view.c and adb.c. [RT #36341] 9508 9509 3904. [func] Add the RPZ SOA to the additional section. [RT36507] 9510 9511 3903. [bug] Improve the accuracy of DiG's reported round trip 9512 time. [RT 36611] 9513 9514 3902. [bug] liblwres wasn't handling link-local addresses in 9515 nameserver clauses in resolv.conf. [RT #36039] 9516 9517 3901. [protocol] Added support for CAA record type (RFC 6844). 9518 [RT #36625] 9519 9520 3900. [bug] Fix a crash in PostgreSQL DLZ driver. [RT #36637] 9521 9522 3899. [bug] "request-ixfr" is only applicable to slave and redirect 9523 zones. [RT #36608] 9524 9525 3898. [bug] Too small a buffer in tohexstr() calls in test code. 9526 [RT #36598] 9527 9528 3897. [bug] RPZ summary information was not properly being updated 9529 after a AXFR resulting in changes sometimes being 9530 ignored. [RT #35885] 9531 9532 3896. [bug] Address performance issues with DSCP code on some 9533 platforms. [RT #36534] 9534 9535 3895. [func] Add the ability to set the DSCP code point to dig. 9536 [RT #36546] 9537 9538 3894. [bug] Buffers in isc_print_vsnprintf were not properly 9539 initialized leading to potential overflows when 9540 printing out quad values. [RT #36505] 9541 9542 3893. [bug] Peer DSCP values could be returned without being set. 9543 [RT #36538] 9544 9545 3892. [bug] Setting '-t aaaa' in .digrc had unintended side 9546 effects. [RT #36452] 9547 9548 3891. [bug] Use ${INSTALL_SCRIPT} rather than ${INSTALL_PROGRAM} 9549 to install python programs. 9550 9551 3890. [bug] RRSIG sets that were not loaded in a single transaction 9552 at start up where not being correctly added to 9553 re-signing heaps. [RT #36302] 9554 9555 3889. [port] hurd: configure fixes as per: 9556 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=746540 9557 9558 3888. [func] 'rndc status' now reports the number of automatic 9559 zones. [RT #36015] 9560 9561 3887. [cleanup] Make all static symbols in rbtdb64 end in "64" so 9562 they are easier to use in a debugger. [RT #36373] 9563 9564 3886. [bug] rbtdb_write_header should use a once to initialize 9565 FILE_VERSION. [RT #36374] 9566 9567 3885. [port] Use 'open()' rather than 'file()' to open files in 9568 python. 9569 9570 3884. [protocol] Add CDS and CDNSKEY record types. [RT #36333] 9571 9572 3883. [placeholder] 9573 9574 3882. [func] By default, negative trust anchors will be tested 9575 periodically to see whether data below them can be 9576 validated, and if so, they will be allowed to 9577 expire early. The "rndc nta -force" option 9578 overrides this behavior. The default NTA lifetime 9579 and the recheck frequency can be configured by the 9580 "nta-lifetime" and "nta-recheck" options. [RT #36146] 9581 9582 3881. [bug] Address memory leak with UPDATE error handling. 9583 [RT #36303] 9584 9585 3880. [test] Update ans.pl to work with new TSIG support in 9586 Net::DNS; add additional Net::DNS version prerequisite 9587 checks. [RT #36327] 9588 9589 3879. [func] Add version printing option to various BIND utilities. 9590 [RT #10686] 9591 9592 3878. [bug] Using the incorrect filename for a DLZ module 9593 caused a segmentation fault on startup. [RT #36286] 9594 9595 3877. [bug] Inserting and deleting parent and child nodes 9596 in response policy zones could trigger an assertion 9597 failure. [RT #36272] 9598 9599 3876. [bug] Improve efficiency of DLZ redirect zones by 9600 suppressing unnecessary database lookups. [RT #35835] 9601 9602 3875. [cleanup] Clarify log message when unable to read private 9603 key files. [RT #24702] 9604 9605 3874. [test] Check that only "check-names master" is needed for 9606 updates to be accepted. 9607 9608 3873. [protocol] Only warn for SPF without TXT spf record. [RT #36210] 9609 9610 3872. [bug] Address issues found by static analysis. [RT #36209] 9611 9612 3871. [bug] Don't publish an activated key automatically before 9613 its publish time. [RT #35063] 9614 9615 3870. [func] Updated the random number generator used in 9616 the resolver to use the updated ChaCha based one 9617 (similar to OpenBSD's changes). Also moved the 9618 RNG to libisc and added unit tests for it. 9619 [RT #35942] 9620 9621 3869. [doc] Document that in-view zones cannot be used for 9622 response policy zones. [RT #35941] 9623 9624 3868. [bug] isc_mem_setwater incorrectly cleared hi_called 9625 potentially leaving over memory cleaner running. 9626 [RT #35270] 9627 9628 3867. [func] "rndc nta" can now be used to set a temporary 9629 negative trust anchor, which disables DNSSEC 9630 validation below a specified name for a specified 9631 period of time (not exceeding 24 hours). This 9632 can be used when validation for a domain is known 9633 to be failing due to a configuration error on 9634 the part of the domain owner rather than a 9635 spoofing attack. [RT #29358] 9636 9637 3866. [bug] Named could die on disk full in generate_session_key. 9638 [RT #36119] 9639 9640 3865. [test] Improved testability of the red-black tree 9641 implementation and added unit tests. [RT #35904] 9642 9643 3864. [bug] RPZ didn't work well when being used as forwarder. 9644 [RT #36060] 9645 9646 3863. [bug] The "E" flag was missing from the query log as a 9647 unintended side effect of code rearrangement to 9648 support EDNS EXPIRE. [RT #36117] 9649 9650 3862. [cleanup] Return immediately if we are not going to log the 9651 message in ns_client_dumpmessage. 9652 9653 3861. [security] Missing isc_buffer_availablelength check results 9654 in a REQUIRE assertion when printing out a packet 9655 (CVE-2014-3859). [RT #36078] 9656 9657 3860. [bug] ioctl(DP_POLL) array size needs to be determined 9658 at run time as it is limited to {OPEN_MAX}. 9659 [RT #35878] 9660 9661 3859. [placeholder] 9662 9663 3858. [bug] Disable GCC 4.9 "delete null pointer check". 9664 [RT #35968] 9665 9666 3857. [bug] Make it harder for a incorrect NOEDNS classification 9667 to be made. [RT #36020] 9668 9669 3856. [bug] Configuring libjson without also configuring libxml 9670 resulted in a REQUIRE assertion when retrieving 9671 statistics using json. [RT #36009] 9672 9673 3855. [bug] Limit smoothed round trip time aging to no more than 9674 once a second. [RT #32909] 9675 9676 3854. [cleanup] Report unrecognized options, if any, in the final 9677 configure summary. [RT #36014] 9678 9679 3853. [cleanup] Refactor dns_rdataslab_fromrdataset to separate out 9680 the handling of a rdataset with no records. [RT #35968] 9681 9682 3852. [func] Increase the default number of clients available 9683 for servicing lightweight resolver queries, and 9684 make them configurable via the "lwres-tasks" and 9685 "lwres-clients" options. (Thanks to Tomas Hozza.) 9686 [RT #35857] 9687 9688 3851. [func] Allow libseccomp based system-call filtering 9689 on Linux; use "configure --enable-seccomp" to 9690 turn it on. Thanks to Loganaden Velvindron 9691 of AFRINIC for the contribution. [RT #35347] 9692 9693 3850. [bug] Disabling forwarding could trigger a REQUIRE assertion. 9694 [RT #35979] 9695 9696 3849. [doc] Alphabetized dig's +options. [RT #35992] 9697 9698 3848. [bug] Adjust 'statistics-channels specified but not effective' 9699 error message to account for JSON support. [RT #36008] 9700 9701 3847. [bug] 'configure --with-dlz-postgres' failed to fail when 9702 there is not support available. 9703 9704 3846. [bug] "dig +notcp ixfr=<serial>" should result in a UDP 9705 ixfr query. [RT #35980] 9706 9707 3845. [placeholder] 9708 9709 3844. [bug] Use the x64 version of the Microsoft Visual C++ 9710 Redistributable when built for 64 bit Windows. 9711 [RT #35973] 9712 9713 3843. [protocol] Check EDNS EXPIRE option in dns_rdata_fromwire. 9714 [RT #35969] 9715 9716 3842. [bug] Adjust RRL log-only logging category. [RT #35945] 9717 9718 3841. [cleanup] Refactor zone.c:add_opt to use dns_message_buildopt. 9719 [RT #35924] 9720 9721 3840. [port] Check for arc4random_addrandom() before using it; 9722 it's been removed from OpenBSD 5.5. [RT #35907] 9723 9724 3839. [test] Use only posix-compatible shell in system tests. 9725 [RT #35625] 9726 9727 3838. [protocol] EDNS EXPIRE as been assigned a code point of 9. 9728 9729 3837. [security] A NULL pointer is passed to query_prefetch resulting 9730 a REQUIRE assertion failure when a fetch is actually 9731 initiated (CVE-2014-3214). [RT #35899] 9732 9733 3836. [bug] Address C++ keyword usage in header file. 9734 9735 3835. [bug] Geoip ACL elements didn't work correctly when 9736 referenced via named or nested ACLs. [RT #35879] 9737 9738 3834. [bug] The re-signing heaps were not being updated soon enough 9739 leading to multiple re-generations of the same RRSIG 9740 when a zone transfer was in progress. [RT #35273] 9741 9742 3833. [bug] Cross compiling was broken due to calling genrandom at 9743 build time. [RT #35869] 9744 9745 3832. [func] "named -L <filename>" causes named to send log 9746 messages to the specified file by default instead 9747 of to the system log. (Thanks to Tony Finch.) 9748 [RT #35845] 9749 9750 3831. [cleanup] Reduce logging noise when EDNS state changes occur. 9751 [RT #35843] 9752 9753 3830. [func] When query logging is enabled, log query errors at 9754 the same level ('info') as the queries themselves. 9755 [RT #35844] 9756 9757 3829. [func] "dig +ttlunits" causes dig to print TTL values 9758 with time-unit suffixes: w, d, h, m, s for 9759 weeks, days, hours, minutes, and seconds. (Thanks 9760 to Tony Finch.) [RT #35823] 9761 9762 3828. [func] "dnssec-signzone -N date" updates serial number 9763 to the current date in YYYYMMDDNN format. 9764 [RT #35800] 9765 9766 3827. [placeholder] 9767 9768 3826. [bug] Corrected bad INSIST logic in isc_radix_remove(). 9769 [RT #35870] 9770 9771 3825. [bug] Address sign extension bug in isc_regex_validate. 9772 [RT #35758] 9773 9774 3824. [bug] A collision between two flag values could cause 9775 problems with cache cleaning when SIT was enabled. 9776 [RT #35858] 9777 9778 3823. [func] Log the rpz cname target when rewriting. [RT #35667] 9779 9780 3822. [bug] Log the correct type of static-stub zones when 9781 removing them. [RT #35842] 9782 9783 3821. [contrib] Added a new "mysqldyn" DLZ module with dynamic 9784 update and transaction support. Thanks to Marty 9785 Lee for the contribution. [RT #35656] 9786 9787 3820. [func] The DLZ API doesn't pass the database version to 9788 the lookup() function; this can cause DLZ modules 9789 that allow dynamic updates to mishandle prerequisite 9790 checks. This has been corrected by adding a 9791 'dbversion' field to the dns_clientinfo_t 9792 structure. [RT #35656] 9793 9794 3819. [bug] NSEC3 hashes need to be able to be entered and 9795 displayed without padding. This is not a issue for 9796 currently defined algorithms but may be for future 9797 hash algorithms. [RT #27925] 9798 9799 3818. [bug] Stop lying to the optimizer that 'void *arg' is a 9800 constant in isc_event_allocate. 9801 9802 3817. [func] The "delve" command is now spelled "delv" to avoid 9803 a namespace collision with the Xapian project. 9804 [RT #35801] 9805 9806 3816. [func] "dig +qr" now reports query size. (Thanks to 9807 Tony Finch.) [RT #35822] 9808 9809 3815. [doc] Clarify "nsupdate -y" usage in man page. [RT #35808] 9810 9811 3814. [func] The "masterfile-style" zone option controls the 9812 formatting of dumped zone files. Options are 9813 "relative" (multiline format) and "full" (one 9814 record per line). The default is "relative". 9815 [RT #20798] 9816 9817 3813. [func] "host" now recognizes the "timeout", "attempts" and 9818 "debug" options when set in /etc/resolv.conf. 9819 (Thanks to Adam Tkac at RedHat.) [RT #21885] 9820 9821 3812. [func] Dig now supports sending arbitrary EDNS options from 9822 the command line (+ednsopt=code[:value]). [RT #35584] 9823 9824 3811. [func] "serial-update-method date;" sets serial number 9825 on dynamic update to today's date in YYYYMMDDNN 9826 format. (Thanks to Bradley Forschinger.) [RT #24903] 9827 9828 3810. [bug] Work around broken nameservers that fail to ignore 9829 unknown EDNS options. [RT #35766] 9830 9831 3809. [doc] Fix SIT and NSID documentation. 9832 9833 3808. [doc] Clean up "prefetch" documentation. [RT #35751] 9834 9835 3807. [bug] Fix sign extension bug in dns_name_fromtext when 9836 lowercase is set. [RT #35743] 9837 9838 3806. [test] Improved system test portability. [RT #35625] 9839 9840 3805. [contrib] Added contrib/perftcpdns, a performance testing tool 9841 for DNS over TCP. [RT #35710] 9842 9843 .. code-block:: none 9844 9845 --- 9.10.0rc1 released --- 9846 9847 3804. [bug] Corrected a race condition in dispatch.c in which 9848 portentry could be reset leading to an assertion 9849 failure in socket_search(). (Change #3708 9850 addressed the same issue but was incomplete.) 9851 [RT #35128] 9852 9853 3803. [bug] "named-checkconf -z" incorrectly rejected zones 9854 using alternate data sources for not having a "file" 9855 option. [RT #35685] 9856 9857 3802. [bug] Various header files were not being installed. 9858 9859 3801. [port] Fix probing for gssapi support on FreeBSD. [RT #35615] 9860 9861 3800. [bug] A pending event on the route socket could cause an 9862 assertion failure when shutting down named. [RT #35674] 9863 9864 3799. [bug] Improve named's command line error reporting. 9865 [RT #35603] 9866 9867 3798. [bug] 'rndc zonestatus' was reporting the wrong re-signing 9868 time. [RT #35659] 9869 9870 3797. [port] netbsd: geoip support probing was broken. [RT #35642] 9871 9872 3796. [bug] Register dns and pkcs#11 error codes. [RT #35629] 9873 9874 3795. [bug] Make named-checkconf detect raw masterfiles for 9875 hint zones and reject them. [RT #35268] 9876 9877 3794. [maint] Added AAAA for C.ROOT-SERVERS.NET. 9878 9879 3793. [bug] zone.c:save_nsec3param() could assert when out of 9880 memory. [RT #35621] 9881 9882 3792. [func] Provide links to the alternate statistics views when 9883 displaying in a browser. [RT #35605] 9884 9885 3791. [placeholder] 9886 9887 3790. [bug] Handle broken nameservers that send BADVERS in 9888 response to unknown EDNS options. Maintain 9889 statistics on BADVERS responses. 9890 9891 3789. [bug] Null pointer dereference on rbt creation failure. 9892 9893 3788. [bug] dns_peer_getrequestsit was returning request_nsid by 9894 mistake. 9895 9896 .. code-block:: none 9897 9898 --- 9.10.0b2 released --- 9899 9900 3787. [bug] The code that checks whether "auto-dnssec" is 9901 allowed was ignoring "allow-update" ACLs set at 9902 the options or view level. [RT #29536] 9903 9904 3786. [func] Provide more detailed error codes when using 9905 native PKCS#11. "pkcs11-tokens" now fails robustly 9906 rather than asserting when run against an HSM with 9907 an incomplete PKCS#11 API implementation. [RT #35479] 9908 9909 3785. [bug] Debugging code dumphex didn't accept arbitrarily long 9910 input (only compiled with -DDEBUG). [RT #35544] 9911 9912 3784. [bug] Using "rrset-order fixed" when it had not been 9913 enabled at compile time caused inconsistent 9914 results. It now works as documented, defaulting 9915 to cyclic mode. [RT #28104] 9916 9917 3783. [func] "tsig-keygen" is now available as an alternate 9918 command name for "ddns-confgen". It generates 9919 a TSIG key in named.conf format without comments. 9920 [RT #35503] 9921 9922 3782. [func] Specifying "auto" as the salt when using 9923 "rndc signing -nsec3param" causes named to 9924 generate a 64-bit salt at random. [RT #35322] 9925 9926 3781. [tuning] Use adaptive mutex locks when available; this 9927 has been found to improve performance under load 9928 on many systems. "configure --with-locktype=standard" 9929 restores conventional mutex locks. [RT #32576] 9930 9931 3780. [bug] $GENERATE handled negative numbers incorrectly. 9932 [RT #25528] 9933 9934 3779. [cleanup] Clarify the error message when using an option 9935 that was not enabled at compile time. [RT #35504] 9936 9937 3778. [bug] Log a warning when the wrong address family is 9938 used in "listen-on" or "listen-on-v6". [RT #17848] 9939 9940 3777. [bug] EDNS EXPIRE code could dump core when processing 9941 DLZ queries. [RT #35493] 9942 9943 3776. [func] "rndc -q" suppresses output from successful 9944 rndc commands. Errors are printed on stderr. 9945 [RT #21393] 9946 9947 3775. [bug] dlz_dlopen driver could return the wrong error 9948 code on API version mismatch, leading to a segfault. 9949 [RT #35495] 9950 9951 3774. [func] When using "request-nsid", log the NSID value in 9952 printable form as well as hex. [RT #20864] 9953 9954 3773. [func] "host", "nslookup" and "nsupdate" now have 9955 options to print the version number and exit. 9956 [RT #26057] 9957 9958 3772. [contrib] Added sqlite3 dynamically-loadable DLZ module. 9959 (Based in part on a contribution from Tim Tessier.) 9960 [RT #20822] 9961 9962 3771. [cleanup] Adjusted log level for "using built-in key" 9963 messages. [RT #24383] 9964 9965 3770. [bug] "dig +trace" could fail with an assertion when it 9966 needed to fall back to TCP due to a truncated 9967 response. [RT #24660] 9968 9969 3769. [doc] Improved documentation of "rndc signing -list". 9970 [RT #30652] 9971 9972 3768. [bug] "dnssec-checkds" was missing the SHA-384 digest 9973 algorithm. [RT #34000] 9974 9975 3767. [func] Log explicitly when using rndc.key to configure 9976 command channel. [RT #35316] 9977 9978 3766. [cleanup] Fixed problems with building outside the source 9979 tree when using native PKCS#11. [RT #35459] 9980 9981 3765. [bug] Fixed a bug in "rndc secroots" that could crash 9982 named when dumping an empty keynode. [RT #35469] 9983 9984 3764. [bug] The dnssec-keygen/settime -S and -i options 9985 (to set up a successor key and set the prepublication 9986 interval) were missing from dnssec-keyfromlabel. 9987 [RT #35394] 9988 9989 3763. [bug] delve: Cache DNSSEC records to avoid the need to 9990 re-fetch them when restarting validation. [RT #35476] 9991 9992 3762. [bug] Address build problems with --pkcs11-native + 9993 --with-openssl with ECDSA support. [RT #35467] 9994 9995 3761. [bug] Address dangling reference bug in dns_keytable_add. 9996 [RT #35471] 9997 9998 3760. [bug] Improve SIT with native PKCS#11 and on Windows. 9999 [RT #35433] 10000 10001 3759. [port] Enable delve on Windows. [RT #35441] 10002 10003 3758. [port] Enable export library APIs on Windows. [RT #35382] 10004 10005 3757. [port] Enable Python tools (dnssec-coverage, 10006 dnssec-checkds) to run on Windows. [RT #34355] 10007 10008 3756. [bug] GSSAPI Kerberos realm checking was broken in 10009 check_config leading to spurious messages being 10010 logged. [RT #35443] 10011 10012 .. code-block:: none 10013 10014 --- 9.10.0b1 released --- 10015 10016 3755. [func] Add stats counters for known EDNS options + others. 10017 [RT #35447] 10018 10019 3754. [cleanup] win32: Installer now places files in the 10020 Program Files area rather than system services. 10021 [RT #35361] 10022 10023 3753. [bug] allow-notify was ignoring keys. [RT #35425] 10024 10025 3752. [bug] Address potential REQUIRE failure if 10026 DNS_STYLEFLAG_COMMENTDATA is set when printing out 10027 a rdataset. 10028 10029 3751. [tuning] The default setting for the -U option (setting 10030 the number of UDP listeners per interface) has 10031 been adjusted to improve performance. [RT #35417] 10032 10033 3750. [experimental] Partially implement EDNS EXPIRE option as described 10034 in draft-andrews-dnsext-expire-00. Retrieval of 10035 the remaining time until expiry for slave zones 10036 is supported. 10037 10038 EXPIRE uses an experimental option code (65002), 10039 which is subject to change. [RT #35416] 10040 10041 3749. [func] "dig +subnet" sends an EDNS client subnet option 10042 containing the specified address/prefix when 10043 querying. (Thanks to Wilmer van der Gaast.) 10044 [RT #35415] 10045 10046 3748. [test] Use delve to test dns_client interfaces. [RT #35383] 10047 10048 3747. [bug] A race condition could lead to a core dump when 10049 destroying a resolver fetch object. [RT #35385] 10050 10051 3746. [func] New "max-zone-ttl" option enforces maximum 10052 TTLs for zones. If loading a zone containing a 10053 higher TTL, the load fails. DDNS updates with 10054 higher TTLs are accepted but the TTL is truncated. 10055 (Note: Currently supported for master zones only; 10056 inline-signing slaves will be added.) [RT #38405] 10057 10058 3745. [func] "configure --with-tuning=large" adjusts various 10059 compiled-in constants and default settings to 10060 values suited to large servers with abundant 10061 memory. [RT #29538] 10062 10063 3744. [experimental] SIT: send and process Source Identity Tokens 10064 (similar to DNS Cookies by Donald Eastlake 3rd), 10065 which are designed to help clients detect off-path 10066 spoofed responses and for servers to identify 10067 legitimate clients. 10068 10069 SIT uses an experimental EDNS option code (65001), 10070 which will be changed to an IANA-assigned value 10071 if the experiment is deemed a success. 10072 10073 SIT can be enabled via "configure --enable-sit" (or 10074 --enable-developer). It is enabled by default in 10075 Windows. 10076 10077 Servers can be configured to send smaller responses 10078 to clients that have not identified themselves via 10079 SIT. RRL processing has also been updated; 10080 legitimate clients are not subject to rate 10081 limiting. [RT #35389] 10082 10083 3743. [bug] delegation-only flag wasn't working in forward zone 10084 declarations despite being documented. This is 10085 needed to support turning off forwarding and turning 10086 on delegation only at the same name. [RT #35392] 10087 10088 3742. [port] linux: libcap support: declare curval at start of 10089 block. [RT #35387] 10090 10091 3741. [func] "delve" (domain entity lookup and validation engine): 10092 A new tool with dig-like semantics for performing DNS 10093 lookups, with internal DNSSEC validation, using the 10094 same resolver and validator logic as named. This 10095 allows easy validation of DNSSEC data in environments 10096 with untrustworthy resolvers, and assists with 10097 troubleshooting of DNSSEC problems. [RT #32406] 10098 10099 3740. [contrib] Minor fixes to configure --with-dlz-bdb, 10100 --with-dlz-postgres and --with-dlz-odbc. [RT #35340] 10101 10102 3739. [func] Added per-zone stats counters to track TCP and 10103 UDP queries. [RT #35375] 10104 10105 3738. [bug] --enable-openssl-hash failed to build. [RT #35343] 10106 10107 3737. [bug] 'rndc retransfer' could trigger a assertion failure 10108 with inline zones. [RT #35353] 10109 10110 3736. [bug] nsupdate: When specifying a server by name, 10111 fall back to alternate addresses if the first 10112 address for that name is not reachable. [RT #25784] 10113 10114 3735. [cleanup] Merged the libiscpk11 library into libisc 10115 to simplify dependencies. [RT #35205] 10116 10117 3734. [bug] Improve building with libtool. [RT #35314] 10118 10119 3733. [func] Improve interface scanning support. Interface 10120 information will be automatically updated if the 10121 OS supports routing sockets (MacOS, *BSD, Linux). 10122 Use "automatic-interface-scan no;" to disable. 10123 10124 Add "rndc scan" to trigger a scan. [RT #23027] 10125 10126 3732. [contrib] Fixed a type mismatch causing the ODBC DLZ 10127 driver to dump core on 64-bit systems. [RT #35324] 10128 10129 3731. [func] Added a "no-case-compress" ACL, which causes 10130 named to use case-insensitive compression 10131 (disabling change #3645) for specified 10132 clients. (This is useful when dealing 10133 with broken client implementations that 10134 use case-sensitive name comparisons, 10135 rejecting responses that fail to match the 10136 capitalization of the query that was sent.) 10137 [RT #35300] 10138 10139 3730. [cleanup] Added "never" as a synonym for "none" when 10140 configuring key event dates in the dnssec tools. 10141 [RT #35277] 10142 10143 3729. [bug] dnssec-keygen could set the publication date 10144 incorrectly when only the activation date was 10145 specified on the command line. [RT #35278] 10146 10147 3728. [doc] Expanded native-PKCS#11 documentation, 10148 specifically pkcs11: URI labels. [RT #35287] 10149 10150 3727. [func] The isc_bitstring API is no longer used and 10151 has been removed from libisc. [RT #35284] 10152 10153 3726. [cleanup] Clarified the error message when attempting 10154 to configure more than 32 response-policy zones. 10155 [RT #35283] 10156 10157 3725. [contrib] Updated zkt and nslint to newest versions, 10158 cleaned up and rearranged the contrib 10159 directory, and added a README. 10160 10161 .. code-block:: none 10162 10163 --- 9.10.0a2 released --- 10164 10165 3724. [bug] win32: Fixed a bug that prevented dig and 10166 host from exiting properly after completing 10167 a UDP query. [RT #35288] 10168 10169 3723. [cleanup] Imported keys are now handled the same way 10170 regardless of DNSSEC algorithm. [RT #35215] 10171 10172 3722. [bug] Using geoip ACLs in a blackhole statement 10173 could cause a segfault. [RT #35272] 10174 10175 3721. [doc] Improved documentation of the EDNS processing 10176 enhancements introduced in change #3593. [RT #35275] 10177 10178 3720. [bug] Address compiler warnings. [RT #35261] 10179 10180 3719. [bug] Address memory leak in in peer.c. [RT #35255] 10181 10182 3718. [bug] A missing ISC_LINK_INIT in log.c. [RT #35260] 10183 10184 3717. [port] hpux: Treat EOPNOTSUPP as a expected error code when 10185 probing to see if it is possible to set dscp values 10186 on a per packet basis. [RT #35252] 10187 10188 3716. [bug] The dns_request code was setting dcsp values when not 10189 requested. [RT #35252] 10190 10191 3715. [bug] The region and city databases could fail to 10192 initialize when using some versions of libGeoIP, 10193 causing assertion failures when named was 10194 configured to use them. [RT #35427] 10195 10196 3714. [test] System tests that need to test for cryptography 10197 support before running can now use a common 10198 "testcrypto.sh" script to do so. [RT #35213] 10199 10200 3713. [bug] Save memory by not storing "also-notify" addresses 10201 in zone objects that are configured not to send 10202 notify requests. [RT #35195] 10203 10204 3712. [placeholder] 10205 10206 3711. [placeholder] 10207 10208 3710. [bug] Address double dns_zone_detach when switching to 10209 using automatic empty zones from regular zones. 10210 [RT #35177] 10211 10212 3709. [port] Use built-in versions of strptime() and timegm() 10213 on all platforms to avoid portability issues. 10214 [RT #35183] 10215 10216 3708. [bug] Address a portentry locking issue in dispatch.c. 10217 [RT #35128] 10218 10219 3707. [bug] irs_resconf_load now returns ISC_R_FILENOTFOUND 10220 on a missing resolv.conf file and initializes the 10221 structure as if it had been configured with: 10222 10223 nameserver ::1 10224 nameserver 127.0.0.1 10225 10226 Note: Callers will need to be updated to treat 10227 ISC_R_FILENOTFOUND as a qualified success or else 10228 they will leak memory. The following code fragment 10229 will work with both old and new versions without 10230 changing the behaviour of the existing code. 10231 10232 resconf = NULL; 10233 result = irs_resconf_load(mctx, "/etc/resolv.conf", 10234 &resconf); 10235 if (result != ISC_SUCCESS) { 10236 if (resconf != NULL) 10237 irs_resconf_destroy(&resconf); 10238 .... 10239 } 10240 10241 [RT #35194] 10242 10243 3706. [contrib] queryperf: Fixed a possible integer overflow when 10244 printing results. [RT #35182] 10245 10246 3705. [func] "configure --enable-native-pkcs11" enables BIND 10247 to use the PKCS#11 API for all cryptographic 10248 functions, so that it can drive a hardware service 10249 module directly without the need to use a modified 10250 OpenSSL as intermediary (so long as the HSM's vendor 10251 provides a complete-enough implementation of the 10252 PKCS#11 interface). This has been tested successfully 10253 with the Thales nShield HSM and with SoftHSMv2 from 10254 the OpenDNSSEC project. [RT #29031] 10255 10256 3704. [protocol] Accept integer timestamps in RRSIG records. [RT #35185] 10257 10258 3703. [func] To improve recursive resolver performance, cache 10259 records which are still being requested by clients 10260 can now be automatically refreshed from the 10261 authoritative server before they expire, reducing 10262 or eliminating the time window in which no answer 10263 is available in the cache. See the "prefetch" option 10264 for more details. [RT #35041] 10265 10266 3702. [func] 'dnssec-coverage -l' option specifies a length 10267 of time to check for coverage; events further into 10268 the future are ignored. 'dnssec-coverage -z' 10269 checks only ZSK events, and 'dnssec-coverage -k' 10270 checks only KSK events. (Thanks to Peter Palfrader.) 10271 [RT #35168] 10272 10273 3701. [func] named-checkconf can now obscure shared secrets 10274 when printing by specifying '-x'. [RT #34465] 10275 10276 3700. [func] Allow access to subgroups of XML statistics via 10277 special URLs http://<server>:<port>/xml/v3/server, 10278 /zones, /net, /tasks, /mem, and /status. [RT #35115] 10279 10280 3699. [bug] Improvements to statistics channel XSL stylesheet: 10281 the stylesheet can now be cached by the browser; 10282 section headers are omitted from the stats display 10283 when there is no data in those sections to be 10284 displayed; counters are now right-justified for 10285 easier readability. [RT #35117] 10286 10287 3698. [cleanup] Replaced all uses of memcpy() with memmove(). 10288 [RT #35120] 10289 10290 3697. [bug] Handle "." as a search list element when IDN support 10291 is enabled. [RT #35133] 10292 10293 3696. [bug] dig failed to handle AXFR style IXFR responses which 10294 span multiple messages. [RT #35137] 10295 10296 3695. [bug] Address a possible race in dispatch.c. [RT #35107] 10297 10298 3694. [bug] Warn when a key-directory is configured for a zone, 10299 but does not exist or is not a directory. [RT #35108] 10300 10301 3693. [security] memcpy was incorrectly called with overlapping 10302 ranges resulting in malformed names being generated 10303 on some platforms. This could cause INSIST failures 10304 when serving NSEC3 signed zones (CVE-2014-0591). 10305 [RT #35120] 10306 10307 3692. [bug] Two calls to dns_db_getoriginnode were fatal if there 10308 was no data at the node. [RT #35080] 10309 10310 3691. [contrib] Address null pointer dereference in LDAP and 10311 MySQL DLZ modules. 10312 10313 3690. [bug] Iterative responses could be missed when the source 10314 port for an upstream query was the same as the 10315 listener port (53). [RT #34925] 10316 10317 3689. [bug] Fixed a bug causing an insecure delegation from one 10318 static-stub zone to another to fail with a broken 10319 trust chain. [RT #35081] 10320 10321 3688. [bug] loadnode could return a freed node on out of memory. 10322 [RT #35106] 10323 10324 3687. [bug] Address null pointer dereference in zone_xfrdone. 10325 [RT #35042] 10326 10327 3686. [func] "dnssec-signzone -Q" drops signatures from keys 10328 that are still published but no longer active. 10329 [RT #34990] 10330 10331 3685. [bug] "rndc refresh" didn't work correctly with slave 10332 zones using inline-signing. [RT #35105] 10333 10334 3684. [bug] The list of included files would grow on reload. 10335 [RT 35090] 10336 10337 3683. [cleanup] Add a more detailed "not found" message to rndc 10338 commands which specify a zone name. [RT #35059] 10339 10340 3682. [bug] Correct the behavior of rndc retransfer to allow 10341 inline-signing slave zones to retain NSEC3 parameters 10342 instead of reverting to NSEC. [RT #34745] 10343 10344 3681. [port] Update the Windows build system to support feature 10345 selection and WIN64 builds. This is a work in 10346 progress. [RT #34160] 10347 10348 3680. [bug] Ensure buffer space is available in "rndc zonestatus". 10349 [RT #35084] 10350 10351 3679. [bug] dig could fail to clean up TCP sockets still 10352 waiting on connect(). [RT #35074] 10353 10354 3678. [port] Update config.guess and config.sub. [RT #35060] 10355 10356 3677. [bug] 'nsupdate' leaked memory if 'realm' was used multiple 10357 times. [RT #35073] 10358 10359 3676. [bug] "named-checkconf -z" now checks zones of type 10360 hint and redirect as well as master. [RT #35046] 10361 10362 3675. [misc] Provide a place for third parties to add version 10363 information for their extensions in the version 10364 file by setting the EXTENSIONS variable. 10365 10366 .. code-block:: none 10367 10368 --- 9.10.0a1 released --- 10369 10370 3674. [bug] RPZ zeroed ttls if the query type was '*'. [RT #35026] 10371 10372 3673. [func] New "in-view" zone option allows direct sharing 10373 of zones between views. [RT #32968] 10374 10375 3672. [func] Local address can now be specified when using 10376 dns_client API. [RT #34811] 10377 10378 3671. [bug] Don't allow dnssec-importkey overwrite a existing 10379 non-imported private key. 10380 10381 3670. [bug] Address read after free in server side of 10382 lwres_getrrsetbyname. [RT #29075] 10383 10384 3669. [port] freebsd: --with-gssapi needs -lhx509. [RT #35001] 10385 10386 3668. [bug] Fix cast in lex.c which could see 0xff treated as eof. 10387 [RT #34993] 10388 10389 3667. [test] dig: add support to keep the TCP socket open between 10390 successive queries (+[no]keepopen). [RT #34918] 10391 10392 3666. [func] Add a tool, named-rrchecker, for checking the syntax 10393 of individual resource records. This tool is intended 10394 to be called by provisioning systems so that the front 10395 end does not need to be upgraded to support new DNS 10396 record types. [RT #34778] 10397 10398 3665. [bug] Failure to release lock on error in receive_secure_db. 10399 [RT #34944] 10400 10401 3664. [bug] Updated OpenSSL PKCS#11 patches to fix active list 10402 locking and other bugs. [RT #34855] 10403 10404 3663. [bug] Address bugs in dns_rdata_fromstruct and 10405 dns_rdata_tostruct for WKS and ISDN types. [RT #34910] 10406 10407 3662. [bug] 'host' could die if a UDP query timed out. [RT #34870] 10408 10409 3661. [bug] Address lock order reversal deadlock with inline zones. 10410 [RT #34856] 10411 10412 3660. [cleanup] Changed the name of "isc-config.sh" to "bind9-config". 10413 [RT #23825] 10414 10415 3659. [port] solaris: don't add explicit dependencies/rules for 10416 python programs as make won't use the implicit rules. 10417 [RT #34835] 10418 10419 3658. [port] linux: Address platform specific compilation issue 10420 when libcap-devel is installed. [RT #34838] 10421 10422 3657. [port] Some readline clones don't accept NULL pointers when 10423 calling add_history. [RT #34842] 10424 10425 3656. [security] Treat an all zero netmask as invalid when generating 10426 the localnets acl. (The prior behavior could 10427 allow unexpected matches when using some versions 10428 of Winsock: CVE-2013-6320.) [RT #34687] 10429 10430 3655. [cleanup] Simplify TCP message processing when requesting a 10431 zone transfer. [RT #34825] 10432 10433 3654. [bug] Address race condition with manual notify requests. 10434 [RT #34806] 10435 10436 3653. [func] Create delegations for all "children" of empty zones 10437 except "forward first". [RT #34826] 10438 10439 3652. [bug] Address bug with rpz-drop policy. [RT #34816] 10440 10441 3651. [tuning] Adjust when a master server is deemed unreachable. 10442 [RT #27075] 10443 10444 3650. [tuning] Use separate rate limiting queues for refresh and 10445 notify requests. [RT #30589] 10446 10447 3649. [cleanup] Include a comment in .nzf files, giving the name of 10448 the associated view. [RT #34765] 10449 10450 3648. [test] Updated the ATF test framework to version 0.17. 10451 [RT #25627] 10452 10453 3647. [bug] Address a race condition when shutting down a zone. 10454 [RT #34750] 10455 10456 3646. [bug] Journal filename string could be set incorrectly, 10457 causing garbage in log messages. [RT #34738] 10458 10459 3645. [protocol] Use case sensitive compression when responding to 10460 queries. [RT #34737] 10461 10462 3644. [protocol] Check that EDNS subnet client options are well formed. 10463 [RT #34718] 10464 10465 3643. [doc] Clarify RRL "slip" documentation. 10466 10467 3642. [func] Allow externally generated DNSKEY to be imported 10468 into the DNSKEY management framework. A new tool 10469 dnssec-importkey is used to do this. [RT #34698] 10470 10471 3641. [bug] Handle changes to sig-validity-interval settings 10472 better. [RT #34625] 10473 10474 3640. [bug] ndots was not being checked when searching. Only 10475 continue searching on NXDOMAIN responses. Add the 10476 ability to specify ndots to nslookup. [RT #34711] 10477 10478 3639. [bug] Treat type 65533 (KEYDATA) as opaque except when used 10479 in a key zone. [RT #34238] 10480 10481 3638. [cleanup] Add the ability to handle ENOPROTOOPT in case it is 10482 encountered. [RT #34668] 10483 10484 3637. [bug] 'allow-query-on' was checking the source address 10485 rather than the destination address. [RT #34590] 10486 10487 3636. [bug] Automatic empty zones now behave better with 10488 forward only "zones" beneath them. [RT #34583] 10489 10490 3635. [bug] Signatures were not being removed from a zone with 10491 only KSK keys for a algorithm. [RT #34439] 10492 10493 3634. [func] Report build-id in rndc status. Report build-id 10494 when building from a git repository. [RT #20422] 10495 10496 3633. [cleanup] Refactor OPT processing in named to make it easier 10497 to support new EDNS options. [RT #34414] 10498 10499 3632. [bug] Signature from newly inactive keys were not being 10500 removed. [RT #32178] 10501 10502 3631. [bug] Remove spurious warning about missing signatures when 10503 qtype is SIG. [RT #34600] 10504 10505 3630. [bug] Ensure correct ID computation for MD5 keys. [RT #33033] 10506 10507 3629. [func] Allow the printing of cryptographic fields in DNSSEC 10508 records by dig to be suppressed (dig +nocrypto). 10509 [RT #34534] 10510 10511 3628. [func] Report DNSKEY key id's when dumping the cache. 10512 [RT #34533] 10513 10514 3627. [bug] RPZ changes were not effective on slaves. [RT #34450] 10515 10516 3626. [func] dig: NSID output now easier to read. [RT #21160] 10517 10518 3625. [bug] Don't send notify messages to machines outside of the 10519 test setup. 10520 10521 3624. [bug] Look for 'json_object_new_int64' when looking for a 10522 the json library. [RT #34449] 10523 10524 3623. [placeholder] 10525 10526 3622. [tuning] Eliminate an unnecessary lock when incrementing 10527 cache statistics. [RT #34339] 10528 10529 3621. [security] Incorrect bounds checking on private type 'keydata' 10530 can lead to a remotely triggerable REQUIRE failure 10531 (CVE-2013-4854). [RT #34238] 10532 10533 3620. [func] Added "rpz-client-ip" policy triggers, enabling 10534 RPZ responses to be configured on the basis of 10535 the client IP address; this can be used, for 10536 example, to blacklist misbehaving recursive 10537 or stub resolvers. [RT #33605] 10538 10539 3619. [bug] Fixed a bug in RPZ with "recursive-only no;" 10540 [RT #33776] 10541 10542 3618. [func] "rndc reload" now checks modification times of 10543 include files as well as master files to determine 10544 whether to skip reloading a zone. [RT #33936] 10545 10546 3617. [bug] Named was failing to answer queries during 10547 "rndc reload" [RT #34098] 10548 10549 3616. [bug] Change #3613 was incomplete. [RT #34177] 10550 10551 3615. [cleanup] "configure" now finishes by printing a summary 10552 of optional BIND features and whether they are 10553 active or inactive. ("configure --enable-full-report" 10554 increases the verbosity of the summary.) [RT #31777] 10555 10556 3614. [port] Check for <linux/types.h>. [RT #34162] 10557 10558 3613. [bug] named could crash when deleting inline-signing 10559 zones with "rndc delzone". [RT #34066] 10560 10561 3612. [port] Check whether to use -ljson or -ljson-c. [RT #34115] 10562 10563 3611. [bug] Improved resistance to a theoretical authentication 10564 attack based on differential timing. [RT #33939] 10565 10566 3610. [cleanup] win32: Some executables had been omitted from the 10567 installer. [RT #34116] 10568 10569 3609. [bug] Corrected a possible deadlock in applications using 10570 the export version of the isc_app API. [RT #33967] 10571 10572 3608. [port] win32: added todos.pl script to ensure all text files 10573 the win32 build depends on are converted to DOS 10574 newline format. [RT #22067] 10575 10576 3607. [bug] dnssec-keygen had broken 'Invalid keyfile' error 10577 message. [RT #34045] 10578 10579 3606. [func] "rndc flushtree" now flushes matching 10580 records in the address database and bad cache 10581 as well as the DNS cache. (Previously only the 10582 DNS cache was flushed.) [RT #33970] 10583 10584 3605. [port] win32: Addressed several compatibility issues 10585 with newer versions of Visual Studio. [RT #33916] 10586 10587 3604. [bug] Fixed a compile-time error when building with 10588 JSON but not XML. [RT #33959] 10589 10590 3603. [bug] Install <isc/stat.h>. [RT #33956] 10591 10592 3602. [contrib] Added DLZ Perl module, allowing Perl scripts to 10593 integrate with named and serve DNS data. 10594 (Contributed by John Eaglesham of Yahoo.) 10595 10596 3601. [bug] Added to PKCS#11 openssl patches a value len 10597 attribute in DH derive key. [RT #33928] 10598 10599 3600. [cleanup] dig: Fixed a typo in the warning output when receiving 10600 an oversized response. [RT #33910] 10601 10602 3599. [tuning] Check for pointer equivalence in name comparisons. 10603 [RT #18125] 10604 10605 3598. [cleanup] Improved portability of map file code. [RT #33820] 10606 10607 3597. [bug] Ensure automatic-resigning heaps are reconstructed 10608 when loading zones in map format. [RT #33381] 10609 10610 3596. [port] Updated win32 build documentation, added 10611 dnssec-verify. [RT #22067] 10612 10613 3595. [port] win32: Fix build problems introduced by change #3550. 10614 [RT #33807] 10615 10616 3594. [maint] Update config.guess and config.sub. [RT #33816] 10617 10618 3593. [func] Update EDNS processing to better track remote server 10619 capabilities. [RT #30655] 10620 10621 3592. [doc] Moved documentation of rndc command options to the 10622 rndc man page. [RT #33506] 10623 10624 3591. [func] Use CRC-64 to detect map file corruption at load 10625 time. [RT #33746] 10626 10627 3590. [bug] When using RRL on recursive servers, defer 10628 rate-limiting until after recursion is complete; 10629 also, use correct rcode for slipped NXDOMAIN 10630 responses. [RT #33604] 10631 10632 3589. [func] Report serial numbers in when starting zone transfers. 10633 Report accepted NOTIFY requests including serial. 10634 [RT #33037] 10635 10636 3588. [bug] dig: addressed a memory leak in the sigchase code 10637 that could cause a shutdown crash. [RT #33733] 10638 10639 3587. [func] 'named -g' now checks the logging configuration but 10640 does not use it. [RT #33473] 10641 10642 3586. [bug] Handle errors in xmlDocDumpFormatMemoryEnc. [RT #33706] 10643 10644 3585. [func] "rndc delzone -clean" option removes zone files 10645 when deleting a zone. [RT #33570] 10646 10647 3584. [security] Caching data from an incompletely signed zone could 10648 trigger an assertion failure in resolver.c 10649 (CVE-2013-3919). [RT #33690] 10650 10651 3583. [bug] Address memory leak in GSS-API processing [RT #33574] 10652 10653 3582. [bug] Silence false positive warning regarding missing file 10654 directive for inline slave zones. [RT #33662] 10655 10656 3581. [bug] Changed the tcp-listen-queue default to 10. [RT #33029] 10657 10658 3580. [bug] Addressed a possible race in acache.c [RT #33602] 10659 10660 3579. [maint] Updates to PKCS#11 openssl patches, supporting 10661 versions 0.9.8y, 1.0.0k, 1.0.1e [RT #33463] 10662 10663 3578. [bug] 'rndc -c file' now fails if 'file' does not exist. 10664 [RT #33571] 10665 10666 3577. [bug] Handle zero TTL values better. [RT #33411] 10667 10668 3576. [bug] Address a shutdown race when validating. [RT #33573] 10669 10670 3575. [func] Changed the logging category for RRL events from 10671 'queries' to 'query-errors'. [RT #33540] 10672 10673 3574. [doc] The 'hostname' keyword was missing from server-id 10674 description in the named.conf man page. [RT #33476] 10675 10676 3573. [bug] "rndc addzone" and "rndc delzone" incorrectly handled 10677 zone names containing punctuation marks and other 10678 nonstandard characters. [RT #33419] 10679 10680 3572. [func] Threads are now enabled by default on most 10681 operating systems. [RT #25483] 10682 10683 3571. [bug] Address race condition in dns_client_startresolve(). 10684 [RT #33234] 10685 10686 3570. [bug] Check internal pointers are valid when loading map 10687 files. [RT #33403] 10688 10689 3569. [contrib] Ported mysql DLZ driver to dynamically-loadable 10690 module, and added multithread support. [RT #33394] 10691 10692 3568. [cleanup] Add a product description line to the version file, 10693 to be reported by named -v/-V. [RT #33366] 10694 10695 3567. [bug] Silence clang static analyzer warnings. [RT #33365] 10696 10697 3566. [func] Log when forwarding updates to master. [RT #33240] 10698 10699 3565. [placeholder] 10700 10701 3564. [bug] Improved handling of corrupted map files. [RT #33380] 10702 10703 3563. [contrib] zone2sqlite failed with some table names. [RT #33375] 10704 10705 3562. [func] Update map file header format to include a SHA-1 hash 10706 of the database content, so that corrupted map files 10707 can be rejected at load time. [RT #32459] 10708 10709 3561. [bug] dig: issue a warning if an EDNS query returns FORMERR 10710 or NOTIMP. Adjust usage message. [RT #33363] 10711 10712 3560. [bug] isc-config.sh did not honor includedir and libdir 10713 when set via configure. [RT #33345] 10714 10715 3559. [func] Check that both forms of Sender Policy Framework 10716 records exist or do not exist. [RT #33355] 10717 10718 3558. [bug] IXFR of a DLZ stored zone was broken. [RT #33331] 10719 10720 3557. [bug] Reloading redirect zones was broken. [RT #33292] 10721 10722 3556. [maint] Added AAAA for D.ROOT-SERVERS.NET. 10723 10724 3555. [bug] Address theoretical race conditions in acache.c 10725 (change #3553 was incomplete). [RT #33252] 10726 10727 3554. [bug] RRL failed to correctly rate-limit upward 10728 referrals and failed to count dropped error 10729 responses in the statistics. [RT #33225] 10730 10731 3553. [bug] Address suspected double free in acache. [RT #33252] 10732 10733 3552. [bug] Wrong getopt option string for 'nsupdate -r'. 10734 [RT #33280] 10735 10736 3551. [bug] resolver.querydscp[46] were uninitialized. [RT #32686] 10737 10738 3550. [func] Unified the internal and export versions of the 10739 BIND libraries, allowing external clients to use 10740 the same libraries as BIND. [RT #33131] 10741 10742 3549. [doc] Documentation for "request-nsid" was missing. 10743 [RT #33153] 10744 10745 3548. [bug] The NSID request code in resolver.c was broken 10746 resulting in invalid EDNS options being sent. 10747 [RT #33153] 10748 10749 3547. [bug] Some malformed unknown rdata records were not properly 10750 detected and rejected. [RT #33129] 10751 10752 3546. [func] Add EUI48 and EUI64 types. [RT #33082] 10753 10754 3545. [bug] RRL slip behavior was incorrect when set to 1. 10755 [RT #33111] 10756 10757 3544. [contrib] check5011.pl: Script to report the status of 10758 managed keys as recorded in managed-keys.bind. 10759 Contributed by Tony Finch <dot (a] dotat.at> 10760 10761 3543. [bug] Update socket structure before attaching to socket 10762 manager after accept. [RT #33084] 10763 10764 3542. [placeholder] 10765 10766 3541. [bug] Parts of libdns were not properly initialized when 10767 built in libexport mode. [RT #33028] 10768 10769 3540. [test] libt_api: t_info and t_assert were not thread safe. 10770 10771 3539. [port] win32: timestamp format didn't match other platforms. 10772 10773 3538. [test] Running "make test" now requires loopback interfaces 10774 to be set up. [RT #32452] 10775 10776 3537. [tuning] Slave zones, when updated, now send NOTIFY messages 10777 to peers before being dumped to disk rather than 10778 after. [RT #27242] 10779 10780 3536. [func] Add support for setting Differentiated Services Code 10781 Point (DSCP) values in named. Most configuration 10782 options which take a "port" option (e.g., 10783 listen-on, forwarders, also-notify, masters, 10784 notify-source, etc) can now also take a "dscp" 10785 option specifying a code point for use with 10786 outgoing traffic, if supported by the underlying 10787 OS. [RT #27596] 10788 10789 3535. [bug] Minor win32 cleanups. [RT #32962] 10790 10791 3534. [bug] Extra text after an embedded NULL was ignored when 10792 parsing zone files. [RT #32699] 10793 10794 3533. [contrib] query-loc-0.4.0: memory leaks. [RT #32960] 10795 10796 3532. [contrib] zkt: fixed buffer overrun, resource leaks. [RT #32960] 10797 10798 3531. [bug] win32: A uninitialized value could be returned on out 10799 of memory. [RT #32960] 10800 10801 3530. [contrib] Better RTT tracking in queryperf. [RT #30128] 10802 10803 3529. [func] Named now listens on both IPv4 and IPv6 interfaces 10804 by default. Named previously only listened on IPv4 10805 interfaces by default unless named was running in 10806 IPv6 only mode. [RT #32945] 10807 10808 3528. [func] New "dnssec-coverage" command scans the timing 10809 metadata for a set of DNSSEC keys and reports if a 10810 lapse in signing coverage has been scheduled 10811 inadvertently. (Note: This tool depends on python; 10812 it will not be built or installed on systems that 10813 do not have a python interpreter.) [RT #28098] 10814 10815 3527. [compat] Add a URI to allow applications to explicitly 10816 request a particular XML schema from the statistics 10817 channel, returning 404 if not supported. [RT #32481] 10818 10819 3526. [cleanup] Set up dependencies for unit tests correctly during 10820 build. [RT #32803] 10821 10822 3525. [func] Support for additional signing algorithms in rndc: 10823 hmac-sha1, -sha224, -sha256, -sha384, and -sha512. 10824 The -A option to rndc-confgen can be used to 10825 select the algorithm for the generated key. 10826 (The default is still hmac-md5; this may 10827 change in a future release.) [RT #20363] 10828 10829 3524. [func] Added an alternate statistics channel in JSON format, 10830 when the server is built with the json-c library: 10831 http://[address]:[port]/json. [RT #32630] 10832 10833 3523. [contrib] Ported filesystem and ldap DLZ drivers to 10834 dynamically-loadable modules, and added the 10835 "wildcard" module based on a contribution from 10836 Vadim Goncharov <vgoncharov (a] nic.ru>. [RT #23569] 10837 10838 3522. [bug] DLZ lookups could fail to return SERVFAIL when 10839 they ought to. [RT #32685] 10840 10841 3521. [bug] Address memory leak in opensslecdsa_link.c. [RT #32249] 10842 10843 3520. [bug] 'mctx' was not being referenced counted in some places 10844 where it should have been. [RT #32794] 10845 10846 3519. [func] Full replay protection via four-way handshake is 10847 now mandatory for rndc clients. Very old versions 10848 of rndc will no longer work. [RT #32798] 10849 10850 3518. [bug] Increase the size of dns_rrl_key.s.rtype by one bit 10851 so that all dns_rrl_rtype_t enum values fit regardless 10852 of whether it is treated as signed or unsigned by 10853 the compiler. [RT #32792] 10854 10855 3517. [bug] Reorder destruction to avoid shutdown race. [RT #32777] 10856 10857 3516. [placeholder] 10858 10859 3515. [port] '%T' is not portable in strftime(). [RT #32763] 10860 10861 3514. [bug] The ranges for valid key sizes in ddns-confgen and 10862 rndc-confgen were too constrained. Keys up to 512 10863 bits are now allowed for most algorithms, and up 10864 to 1024 bits for hmac-sha384 and hmac-sha512. 10865 [RT #32753] 10866 10867 3513. [func] "dig -u" prints times in microseconds rather than 10868 milliseconds. [RT #32704] 10869 10870 3512. [func] "rndc validation check" reports the current status 10871 of DNSSEC validation. [RT #21397] 10872 10873 3511. [doc] Improve documentation of redirect zones. [RT #32756] 10874 10875 3510. [func] "rndc status" and XML statistics channel now report 10876 server start and reconfiguration times. [RT #21048] 10877 10878 3509. [cleanup] Added a product line to version file to allow for 10879 easy naming of different products (BIND 10880 vs BIND ESV, for example). [RT #32755] 10881 10882 3508. [contrib] queryperf was incorrectly rejecting the -T option. 10883 [RT #32338] 10884 10885 3507. [bug] Statistics channel XSL had a glitch when attempting 10886 to chart query data before any queries had been 10887 received. [RT #32620] 10888 10889 3506. [func] When setting "max-cache-size" and "max-acache-size", 10890 the keyword "unlimited" is no longer defined as equal 10891 to 4 gigabytes (except on 32-bit platforms); it 10892 means literally unlimited. [RT #32358] 10893 10894 3505. [bug] When setting "max-cache-size" and "max-acache-size", 10895 larger values than 4 gigabytes could not be set 10896 explicitly, though larger sizes were available 10897 when setting cache size to 0. This has been 10898 corrected; the full range is now available. 10899 [RT #32358] 10900 10901 3504. [func] Add support for ACLs based on geographic location, 10902 using MaxMind GeoIP databases. Based on code 10903 contributed by Ken Brownfield <kb (a] slide.com>. 10904 [RT #30681] 10905 10906 3503. [doc] Clarify size_spec syntax. [RT #32449] 10907 10908 3502. [func] zone-statistics: "no" is now a synonym for "none", 10909 instead of "terse". [RT #29165] 10910 10911 3501. [func] zone-statistics now takes three options: full, 10912 terse, and none. "yes" and "no" are retained as 10913 synonyms for full and terse, respectively. [RT #29165] 10914 10915 3500. [security] Support NAPTR regular expression validation on 10916 all platforms without using libregex, which 10917 can be vulnerable to memory exhaustion attack 10918 (CVE-2013-2266). [RT #32688] 10919 10920 .. code-block:: none 10921 10922 3499. [doc] Corrected ARM documentation of built-in zones. 10923 [RT #32694] 10924 10925 3498. [bug] zone statistics for zones which matched a potential 10926 empty zone could have their zone-statistics setting 10927 overridden. 10928 10929 3497. [func] When deleting a slave/stub zone using 'rndc delzone' 10930 report the files that were being used so they can 10931 be cleaned up if desired. [RT #27899] 10932 10933 3496. [placeholder] 10934 10935 3495. [func] Support multiple response-policy zones (up to 32), 10936 while improving RPZ performance. "response-policy" 10937 syntax now includes a "min-ns-dots" clause, with 10938 default 1, to exclude top-level domains from 10939 NSIP and NSDNAME checking. --enable-rpz-nsip and 10940 --enable-rpz-nsdname are now the default. [RT #32251] 10941 10942 3494. [func] DNS RRL: Blunt the impact of DNS reflection and 10943 amplification attacks by rate-limiting substantially- 10944 identical responses. [RT #28130] 10945 10946 3493. [contrib] Added BDBHPT dynamically-loadable DLZ module, 10947 contributed by Mark Goldfinch. [RT #32549] 10948 10949 3492. [bug] Fixed a regression in zone loading performance 10950 due to lock contention. [RT #30399] 10951 10952 3491. [bug] Slave zones using inline-signing must specify a 10953 file name. [RT #31946] 10954 10955 3490. [bug] When logging RDATA during update, truncate if it's 10956 too long. [RT #32365] 10957 10958 3489. [bug] --enable-developer now turns on ISC_LIST_CHECKINIT. 10959 dns_dlzcreate() failed to properly initialize 10960 dlzdb.link. When cloning a rdataset do not copy 10961 the link contents. [RT #32651] 10962 10963 3488. [bug] Use after free error with DH generated keys. [RT #32649] 10964 10965 3487. [bug] Change 3444 was not complete. There was a additional 10966 place where the NOQNAME proof needed to be saved. 10967 [RT #32629] 10968 10969 3486. [bug] named could crash when using TKEY-negotiated keys 10970 that had been deleted and then recreated. [RT #32506] 10971 10972 3485. [cleanup] Only compile openssl_gostlink.c if we support GOST. 10973 10974 3484. [bug] Some statistics were incorrectly rendered in XML. 10975 [RT #32587] 10976 10977 3483. [placeholder] 10978 10979 3482. [func] dig +nssearch now prints name servers that don't 10980 have address records (missing AAAA or A, or the name 10981 doesn't exist). [RT #29348] 10982 10983 3481. [cleanup] Removed use of const const in atf. 10984 10985 3480. [bug] Silence logging noise when setting up zone 10986 statistics. [RT #32525] 10987 10988 3479. [bug] Address potential memory leaks in gssapi support 10989 code. [RT #32405] 10990 10991 3478. [port] Fix a build failure in strict C99 environments 10992 [RT #32475] 10993 10994 3477. [func] Expand logging when adding records via DDNS update 10995 [RT #32365] 10996 10997 3476. [bug] "rndc zonestatus" could report a spurious "not 10998 found" error on inline-signing zones. [RT #29226] 10999 11000 3475. [cleanup] Changed name of 'map' zone file format (previously 11001 'fast'). [RT #32458] 11002 11003 3474. [bug] nsupdate could assert when the local and remote 11004 address families didn't match. [RT #22897] 11005 11006 3473. [bug] dnssec-signzone/verify could incorrectly report 11007 an error condition due to an empty node above an 11008 opt-out delegation lacking an NSEC3. [RT #32072] 11009 11010 3472. [bug] The active-connections counter in the socket 11011 statistics could underflow. [RT #31747] 11012 11013 3471. [bug] The number of UDP dispatches now defaults to 11014 the number of CPUs even if -n has been set to 11015 a higher value. [RT #30964] 11016 11017 3470. [bug] Slave zones could fail to dump when successfully 11018 refreshing after an initial failure. [RT #31276] 11019 11020 3469. [bug] Handle DLZ lookup failures more gracefully. Improve 11021 backward compatibility between versions of DLZ dlopen 11022 API. [RT #32275] 11023 11024 3468. [security] RPZ rules to generate A records (but not AAAA records) 11025 could trigger an assertion failure when used in 11026 conjunction with DNS64 (CVE-2012-5689). [RT #32141] 11027 11028 3467. [bug] Added checks in dnssec-keygen and dnssec-settime 11029 to check for delete date < inactive date. [RT #31719] 11030 11031 3466. [contrib] Corrected the DNS_CLIENTINFOMETHODS_VERSION check 11032 in DLZ example driver. [RT #32275] 11033 11034 3465. [bug] Handle isolated reserved ports. [RT #31778] 11035 11036 3464. [maint] Updates to PKCS#11 openssl patches, supporting 11037 versions 0.9.8x, 1.0.0j, 1.0.1c [RT #29749] 11038 11039 3463. [doc] Clarify managed-keys syntax in ARM. [RT #32232] 11040 11041 3462. [doc] Clarify server selection behavior of dig when using 11042 -4 or -6 options. [RT #32181] 11043 11044 3461. [bug] Negative responses could incorrectly have AD=1 11045 set. [RT #32237] 11046 11047 3460. [bug] Only link against readline where needed. [RT #29810] 11048 11049 3459. [func] Added -J option to named-checkzone/named-compilezone 11050 to specify the path to the journal file. [RT #30958] 11051 11052 3458. [bug] Return FORMERR when presented with a overly long 11053 domain named in a request. [RT #29682] 11054 11055 3457. [protocol] Add ILNP records (NID, LP, L32, L64). [RT #31836] 11056 11057 3456. [port] g++47: ATF failed to compile. [RT #32012] 11058 11059 3455. [contrib] queryperf: fix getopt option list. [RT #32338] 11060 11061 3454. [port] sparc64: improve atomic support. [RT #25182] 11062 11063 3453. [bug] 'rndc addzone' of a zone with 'inline-signing yes;' 11064 failed. [RT #31960] 11065 11066 3452. [bug] Accept duplicate singleton records. [RT #32329] 11067 11068 3451. [port] Increase per thread stack size from 64K to 1M. 11069 [RT #32230] 11070 11071 3450. [bug] Stop logfileconfig system test spam system logs. 11072 [RT #32315] 11073 11074 3449. [bug] gen.c: use the pre-processor to construct format 11075 strings so that compiler can perform sanity checks; 11076 check the snprintf results. [RT #17576] 11077 11078 3448. [bug] The allow-query-on ACL was not processed correctly. 11079 [RT #29486] 11080 11081 3447. [port] Add support for libxml2-2.9.x [RT #32231] 11082 11083 3446. [port] win32: Add source ID (see change #3400) to build. 11084 [RT #31683] 11085 11086 3445. [bug] Warn about zone files with blank owner names 11087 immediately after $ORIGIN directives. [RT #31848] 11088 11089 3444. [bug] The NOQNAME proof was not being returned from cached 11090 insecure responses. [RT #21409] 11091 11092 3443. [bug] ddns-confgen: Some TSIG algorithms were incorrectly 11093 rejected when generating keys. [RT #31927] 11094 11095 3442. [port] Net::DNS 0.69 introduced a non backwards compatible 11096 change. [RT #32216] 11097 11098 3441. [maint] D.ROOT-SERVERS.NET is now 199.7.91.13. 11099 11100 3440. [bug] Reorder get_key_struct to not trigger a assertion when 11101 cleaning up due to out of memory error. [RT #32131] 11102 11103 3439. [placeholder] 11104 11105 3438. [bug] Don't accept unknown data escape in quotes. [RT #32031] 11106 11107 3437. [bug] isc_buffer_init -> isc_buffer_constinit to initialize 11108 buffers with constant data. [RT #32064] 11109 11110 3436. [bug] Check malloc/calloc return values. [RT #32088] 11111 11112 3435. [bug] Cross compilation support in configure was broken. 11113 [RT #32078] 11114 11115 3434. [bug] Pass client info to the DLZ findzone() entry 11116 point in addition to lookup(). This makes it 11117 possible for a database to answer differently 11118 whether it's authoritative for a name depending 11119 on the address of the client. [RT #31775] 11120 11121 3433. [bug] dlz_findzone() did not correctly handle 11122 ISC_R_NOMORE. [RT #31172] 11123 11124 3432. [func] Multiple DLZ databases can now be configured. 11125 DLZ databases are searched in the order configured, 11126 unless set to "search no", in which case a 11127 zone can be configured to be retrieved from a 11128 particular DLZ database by using a "dlz <name>" 11129 option in the zone statement. DLZ databases can 11130 support type "master" and "redirect" zones. 11131 [RT #27597] 11132 11133 3431. [bug] ddns-confgen: Some valid key algorithms were 11134 not accepted. [RT #31927] 11135 11136 3430. [bug] win32: isc_time_formatISO8601 was missing the 11137 'T' between the date and time. [RT #32044] 11138 11139 3429. [bug] dns_zone_getserial2 could a return success without 11140 returning a valid serial. [RT #32007] 11141 11142 3428. [cleanup] dig: Add timezone to date output. [RT #2269] 11143 11144 3427. [bug] dig +trace incorrectly displayed name server 11145 addresses instead of names. [RT #31641] 11146 11147 3426. [bug] dnssec-checkds: Clearer output when records are not 11148 found. [RT #31968] 11149 11150 3425. [bug] "acacheentry" reference counting was broken resulting 11151 in use after free. [RT #31908] 11152 11153 3424. [func] dnssec-dsfromkey now emits the hash without spaces. 11154 [RT #31951] 11155 11156 3423. [bug] "rndc signing -nsec3param" didn't accept the full 11157 range of possible values. Address portability issues. 11158 [RT #31938] 11159 11160 3422. [bug] Added a clear error message for when the SOA does not 11161 match the referral. [RT #31281] 11162 11163 3421. [bug] Named loops when re-signing if all keys are offline. 11164 [RT #31916] 11165 11166 3420. [bug] Address VPATH compilation issues. [RT #31879] 11167 11168 3419. [bug] Memory leak on validation cancel. [RT #31869] 11169 11170 3418. [func] New XML schema (version 3.0) for the statistics channel 11171 adds query type statistics at the zone level, and 11172 flattens the XML tree and uses compressed format to 11173 optimize parsing. Includes new XSL that permits 11174 charting via the Google Charts API on browsers that 11175 support javascript in XSL. The old XML schema has been 11176 deprecated. [RT #30023] 11177 11178 3417. [placeholder] 11179 11180 3416. [bug] Named could die on shutdown if running with 128 UDP 11181 dispatches per interface. [RT #31743] 11182 11183 3415. [bug] named could die with a REQUIRE failure if a validation 11184 was canceled. [RT #31804] 11185 11186 3414. [bug] Address locking issues found by Coverity. [RT #31626] 11187 11188 3413. [func] Record the number of DNS64 AAAA RRsets that have been 11189 synthesized. [RT #27636] 11190 11191 3412. [bug] Copy timeval structure from control message data. 11192 [RT #31548] 11193 11194 3411. [tuning] Use IPV6_USE_MIN_MTU or equivalent with TCP in addition 11195 to UDP. [RT #31690] 11196 11197 3410. [bug] Addressed Coverity warnings. [RT #31626] 11198 11199 3409. [contrib] contrib/dane/mkdane.sh: Tool to generate TLSA RR's 11200 from X.509 certificates, for use with DANE 11201 (DNS-based Authentication of Named Entities). 11202 [RT #30513] 11203 11204 3408. [bug] Some DNSSEC-related options (update-check-ksk, 11205 dnssec-loadkeys-interval, dnssec-dnskey-kskonly) 11206 are now legal in slave zones as long as 11207 inline-signing is in use. [RT #31078] 11208 11209 3407. [placeholder] 11210 11211 3406. [bug] mem.c: Fix compilation errors when building with 11212 ISC_MEM_TRACKLINES or ISC_MEMPOOL_NAMES disabled. 11213 Also, ISC_MEM_DEBUG is no longer optional. [RT #31559] 11214 11215 3405. [bug] Handle time going backwards in acache. [RT #31253] 11216 11217 3404. [bug] dnssec-signzone: When re-signing a zone, remove 11218 RRSIG and NSEC records from nodes that used to be 11219 in-zone but are now below a zone cut. [RT #31556] 11220 11221 3403. [bug] Silence noisy OpenSSL logging. [RT #31497] 11222 11223 3402. [test] The IPv6 interface numbers used for system 11224 tests were incorrect on some platforms. [RT #25085] 11225 11226 3401. [bug] Addressed Coverity warnings. [RT #31484] 11227 11228 3400. [cleanup] "named -V" can now report a source ID string, defined 11229 in the "srcid" file in the build tree and normally set 11230 to the most recent git hash. [RT #31494] 11231 11232 3399. [port] netbsd: rename 'bool' parameter to avoid namespace 11233 clash. [RT #31515] 11234 11235 3398. [bug] SOA parameters were not being updated with inline 11236 signed zones if the zone was modified while the 11237 server was offline. [RT #29272] 11238 11239 3397. [bug] dig crashed when using +nssearch with +tcp. [RT #25298] 11240 11241 3396. [bug] OPT records were incorrectly removed from signed, 11242 truncated responses. [RT #31439] 11243 11244 3395. [protocol] Add RFC 6598 reverse zones to built in empty zones 11245 list, 64.100.IN-ADDR.ARPA ... 127.100.IN-ADDR.ARPA. 11246 [RT #31336] 11247 11248 3394. [bug] Adjust 'successfully validated after lower casing 11249 signer' log level and category. [RT #31414] 11250 11251 3393. [bug] 'host -C' could core dump if REFUSED was received. 11252 [RT #31381] 11253 11254 3392. [func] Keep statistics on REFUSED responses. [RT #31412] 11255 11256 3391. [bug] A DNSKEY lookup that encountered a CNAME failed. 11257 [RT #31262] 11258 11259 3390. [bug] Silence clang compiler warnings. [RT #30417] 11260 11261 3389. [bug] Always return NOERROR (not 0) in TSIG. [RT #31275] 11262 11263 3388. [bug] Fixed several Coverity warnings. 11264 Note: This change includes a fix for a bug that 11265 was subsequently determined to be an exploitable 11266 security vulnerability, CVE-2012-5688: named could 11267 die on specific queries with dns64 enabled. 11268 [RT #30996] 11269 11270 3387. [func] DS digest can be disabled at runtime with 11271 disable-ds-digests. [RT #21581] 11272 11273 3386. [bug] Address locking violation when generating new NSEC / 11274 NSEC3 chains. [RT #31224] 11275 11276 3385. [bug] named-checkconf didn't detect missing master lists 11277 in also-notify clauses. [RT #30810] 11278 11279 3384. [bug] Improved logging of crypto errors. [RT #30963] 11280 11281 3383. [security] A certain combination of records in the RBT could 11282 cause named to hang while populating the additional 11283 section of a response. [RT #31090] 11284 11285 3382. [bug] SOA query from slave used use-v6-udp-ports range, 11286 if set, regardless of the address family in use. 11287 [RT #24173] 11288 11289 3381. [contrib] Update queryperf to support more RR types. 11290 [RT #30762] 11291 11292 3380. [bug] named could die if a nonexistent master list was 11293 referenced in a also-notify. [RT #31004] 11294 11295 3379. [bug] isc_interval_zero and isc_time_epoch should be 11296 "const (type)* const". [RT #31069] 11297 11298 3378. [bug] Handle missing 'managed-keys-directory' better. 11299 [RT #30625] 11300 11301 3377. [bug] Removed spurious newline from NSEC3 multiline 11302 output. [RT #31044] 11303 11304 3376. [bug] Lack of EDNS support was being recorded without a 11305 successful response. [RT #30811] 11306 11307 3375. [bug] 'rndc dumpdb' failed on empty caches. [RT #30808] 11308 11309 3374. [bug] isc_parse_uint32 failed to return a range error on 11310 systems with 64 bit longs. [RT #30232] 11311 11312 3373. [bug] win32: open raw files in binary mode. [RT #30944] 11313 11314 3372. [bug] Silence spurious "deleted from unreachable cache" 11315 messages. [RT #30501] 11316 11317 3371. [bug] AD=1 should behave like DO=1 when deciding whether to 11318 add NS RRsets to the additional section or not. 11319 [RT #30479] 11320 11321 3370. [bug] Address use after free while shutting down. [RT #30241] 11322 11323 3369. [bug] nsupdate terminated unexpectedly in interactive mode 11324 if built with readline support. [RT #29550] 11325 11326 3368. [bug] <dns/iptable.h>, <dns/private.h> and <dns/zone.h> 11327 were not C++ safe. 11328 11329 3367. [bug] dns_dnsseckey_create() result was not being checked. 11330 [RT #30685] 11331 11332 3366. [bug] Fixed Read-After-Write dependency violation for IA64 11333 atomic operations. [RT #25181] 11334 11335 3365. [bug] Removed spurious newlines from log messages in 11336 zone.c [RT #30675] 11337 11338 3364. [security] Named could die on specially crafted record. 11339 [RT #30416] 11340 11341 3363. [bug] Need to allow "forward" and "fowarders" options 11342 in static-stub zones; this had been overlooked. 11343 [RT #30482] 11344 11345 3362. [bug] Setting some option values to 0 in named.conf 11346 could trigger an assertion failure on startup. 11347 [RT #27730] 11348 11349 3361. [bug] "rndc signing -nsec3param" didn't work correctly 11350 when salt was set to '-' (no salt). [RT #30099] 11351 11352 3360. [bug] 'host -w' could die. [RT #18723] 11353 11354 3359. [bug] An improperly-formed TSIG secret could cause a 11355 memory leak. [RT #30607] 11356 11357 3358. [placeholder] 11358 11359 3357. [port] Add support for libxml2-2.8.x [RT #30440] 11360 11361 3356. [bug] Cap the TTL of signed RRsets when RRSIGs are 11362 approaching their expiry, so they don't remain 11363 in caches after expiry. [RT #26429] 11364 11365 3355. [port] Use more portable awk in verify system test. 11366 11367 3354. [func] Improve OpenSSL error logging. [RT #29932] 11368 11369 3353. [bug] Use a single task for task exclusive operations. 11370 [RT #29872] 11371 11372 3352. [bug] Ensure that learned server attributes timeout of the 11373 adb cache. [RT #29856] 11374 11375 3351. [bug] isc_mem_put and isc_mem_putanddetach didn't report 11376 caller if either ISC_MEM_DEBUGSIZE or ISC_MEM_DEBUGCTX 11377 memory debugging flags are set. [RT #30243] 11378 11379 3350. [bug] Memory read overrun in isc___mem_reallocate if 11380 ISC_MEM_DEBUGCTX memory debugging flag is set. 11381 [RT #30240] 11382 11383 3349. [bug] Change #3345 was incomplete. [RT #30233] 11384 11385 3348. [bug] Prevent RRSIG data from being cached if a negative 11386 record matching the covering type exists at a higher 11387 trust level. Such data already can't be retrieved from 11388 the cache since change 3218 -- this prevents it 11389 being inserted into the cache as well. [RT #26809] 11390 11391 3347. [bug] dnssec-settime: Issue a warning when writing a new 11392 private key file would cause a change in the 11393 permissions of the existing file. [RT #27724] 11394 11395 3346. [security] Bad-cache data could be used before it was 11396 initialized, causing an assert. [RT #30025] 11397 11398 3345. [bug] Addressed race condition when removing the last item 11399 or inserting the first item in an ISC_QUEUE. 11400 [RT #29539] 11401 11402 3344. [func] New "dnssec-checkds" command checks a zone to 11403 determine which DS records should be published 11404 in the parent zone, or which DLV records should be 11405 published in a DLV zone, and queries the DNS to 11406 ensure that it exists. (Note: This tool depends 11407 on python; it will not be built or installed on 11408 systems that do not have a python interpreter.) 11409 [RT #28099] 11410 11411 3343. [placeholder] 11412 11413 3342. [bug] Change #3314 broke saving of stub zones to disk 11414 resulting in excessive cpu usage in some cases. 11415 [RT #29952] 11416 11417 3341. [func] New "dnssec-verify" command checks a signed zone 11418 to ensure correctness of signatures and of NSEC/NSEC3 11419 chains. [RT #23673] 11420 11421 3340. [func] Added new 'map' zone file format, which is an image 11422 of a zone database that can be loaded directly into 11423 memory via mmap(), allowing much faster zone loading. 11424 (Note: Because of pointer sizes and other 11425 considerations, this file format is platform-dependent; 11426 'map' zone files cannot always be transferred from one 11427 server to another.) [RT #25419] 11428 11429 3339. [func] Allow the maximum supported rsa exponent size to be 11430 specified: "max-rsa-exponent-size <value>;" [RT #29228] 11431 11432 3338. [bug] Address race condition in units tests: asyncload_zone 11433 and asyncload_zt. [RT #26100] 11434 11435 3337. [bug] Change #3294 broke support for the multiple keys 11436 in controls. [RT #29694] 11437 11438 3336. [func] Maintain statistics for RRsets tagged as "stale". 11439 [RT #29514] 11440 11441 3335. [func] nslookup: return a nonzero exit code when unable 11442 to get an answer. [RT #29492] 11443 11444 3334. [bug] Hold a zone table reference while performing a 11445 asynchronous load of a zone. [RT #28326] 11446 11447 3333. [bug] Setting resolver-query-timeout too low can cause 11448 named to not recover if it loses connectivity. 11449 [RT #29623] 11450 11451 3332. [bug] Re-use cached DS rrsets if possible. [RT #29446] 11452 11453 3331. [security] dns_rdataslab_fromrdataset could produce bad 11454 rdataslabs. [RT #29644] 11455 11456 3330. [func] Fix missing signatures on NOERROR results despite 11457 RPZ rewriting. Also 11458 - add optional "recursive-only yes|no" to the 11459 response-policy statement 11460 - add optional "max-policy-ttl" to the response-policy 11461 statement to limit the false data that 11462 "recursive-only no" can introduce into 11463 resolvers' caches 11464 - add a RPZ performance test to bin/tests/system/rpz 11465 when queryperf is available. 11466 - the encoding of PASSTHRU action to "rpz-passthru". 11467 (The old encoding is still accepted.) 11468 [RT #26172] 11469 11470 11471 3329. [bug] Handle RRSIG signer-name case consistently: We 11472 generate RRSIG records with the signer-name in 11473 lower case. We accept them with any case, but if 11474 they fail to validate, we try again in lower case. 11475 [RT #27451] 11476 11477 3328. [bug] Fixed inconsistent data checking in dst_parse.c. 11478 [RT #29401] 11479 11480 3327. [func] Added 'filter-aaaa-on-v6' option; this is similar 11481 to 'filter-aaaa-on-v4' but applies to IPv6 11482 connections. (Use "configure --enable-filter-aaaa" 11483 to enable this option.) [RT #27308] 11484 11485 3326. [func] Added task list statistics: task model, worker 11486 threads, quantum, tasks running, tasks ready. 11487 [RT #27678] 11488 11489 3325. [func] Report cache statistics: memory use, number of 11490 nodes, number of hash buckets, hit and miss counts. 11491 [RT #27056] 11492 11493 3324. [test] Add better tests for ADB stats [RT #27057] 11494 11495 3323. [func] Report the number of buckets the resolver is using. 11496 [RT #27020] 11497 11498 3322. [func] Monitor the number of active TCP and UDP dispatches. 11499 [RT #27055] 11500 11501 3321. [func] Monitor the number of recursive fetches and the 11502 number of open sockets, and report these values in 11503 the statistics channel. [RT #27054] 11504 11505 3320. [func] Added support for monitoring of recursing client 11506 count. [RT #27009] 11507 11508 3319. [func] Added support for monitoring of ADB entry count and 11509 hash size. [RT #27057] 11510 11511 3318. [tuning] Reduce the amount of work performed while holding a 11512 bucket lock when finished with a fetch context. 11513 [RT #29239] 11514 11515 3317. [func] Add ECDSA support (RFC 6605). [RT #21918] 11516 11517 3316. [tuning] Improved locking performance when recursing. 11518 [RT #28836] 11519 11520 3315. [tuning] Use multiple dispatch objects for sending upstream 11521 queries; this can improve performance on busy 11522 multiprocessor systems by reducing lock contention. 11523 [RT #28605] 11524 11525 3314. [bug] The masters list could be updated while stub_callback 11526 or refresh_callback were using it. [RT #26732] 11527 11528 3313. [protocol] Add TLSA record type. [RT #28989] 11529 11530 3312. [bug] named-checkconf didn't detect a bad dns64 clients acl. 11531 [RT #27631] 11532 11533 3311. [bug] Abort the zone dump if zone->db is NULL in 11534 zone.c:zone_gotwritehandle. [RT #29028] 11535 11536 3310. [test] Increase table size for mutex profiling. [RT #28809] 11537 11538 3309. [bug] resolver.c:fctx_finddone() was not thread safe. 11539 [RT #27995] 11540 11541 3308. [placeholder] 11542 11543 3307. [bug] Add missing ISC_LANG_BEGINDECLS and ISC_LANG_ENDDECLS. 11544 [RT #28956] 11545 11546 3306. [bug] Improve DNS64 reverse zone performance. [RT #28563] 11547 11548 3305. [func] Add wire format lookup method to sdb. [RT #28563] 11549 11550 3304. [bug] Use hmctx, not mctx when freeing rbtdb->heaps. 11551 [RT #28571] 11552 11553 3303. [bug] named could die when reloading. [RT #28606] 11554 11555 3302. [bug] dns_dnssec_findmatchingkeys could fail to find 11556 keys if the zone name contained character that 11557 required special mappings. [RT #28600] 11558 11559 3301. [contrib] Update queryperf to build on darwin. Add -R flag 11560 for non-recursive queries. [RT #28565] 11561 11562 3300. [bug] Named could die if gssapi was enabled in named.conf 11563 but was not compiled in. [RT #28338] 11564 11565 3299. [bug] Make SDB handle errors from database drivers better. 11566 [RT #28534] 11567 11568 3298. [bug] Named could dereference a NULL pointer in 11569 zmgr_start_xfrin_ifquota if the zone was being removed. 11570 [RT #28419] 11571 11572 3297. [bug] Named could die on a malformed master file. [RT #28467] 11573 11574 3296. [bug] Named could die with a INSIST failure in 11575 client.c:exit_check. [RT #28346] 11576 11577 3295. [bug] Adjust isc_time_secondsastimet range check to be more 11578 portable. [RT # 26542] 11579 11580 3294. [bug] isccc/cc.c:table_fromwire failed to free alist on 11581 error. [RT #28265] 11582 11583 3293. [func] nsupdate: list supported type. [RT #28261] 11584 11585 3292. [func] Log messages in the axfr stream at debug 10. 11586 [RT #28040] 11587 11588 3291. [port] Fixed a build error on systems without ENOTSUP. 11589 [RT #28200] 11590 11591 3290. [bug] <isc/hmacsha.h> was not being installed. [RT #28169] 11592 11593 3289. [bug] 'rndc retransfer' failed for inline zones. [RT #28036] 11594 11595 3288. [bug] dlz_destroy() function wasn't correctly registered 11596 by the DLZ dlopen driver. [RT #28056] 11597 11598 3287. [port] Update ans.pl to work with Net::DNS 0.68. [RT #28028] 11599 11600 3286. [bug] Managed key maintenance timer could fail to start 11601 after 'rndc reconfig'. [RT #26786] 11602 11603 3285. [bug] val-frdataset was incorrectly disassociated in 11604 proveunsecure after calling startfinddlvsep. 11605 [RT #27928] 11606 11607 3284. [bug] Address race conditions with the handling of 11608 rbtnode.deadlink. [RT #27738] 11609 11610 3283. [bug] Raw zones with with more than 512 records in a RRset 11611 failed to load. [RT #27863] 11612 11613 3282. [bug] Restrict the TTL of NS RRset to no more than that 11614 of the old NS RRset when replacing it. 11615 [RT #27792] [RT #27884] 11616 11617 3281. [bug] SOA refresh queries could be treated as cancelled 11618 despite succeeding over the loopback interface. 11619 [RT #27782] 11620 11621 3280. [bug] Potential double free of a rdataset on out of memory 11622 with DNS64. [RT #27762] 11623 11624 3279. [bug] Hold a internal reference to the zone while performing 11625 a asynchronous load. Address potential memory leak 11626 if the asynchronous is cancelled. [RT #27750] 11627 11628 3278. [bug] Make sure automatic key maintenance is started 11629 when "auto-dnssec maintain" is turned on during 11630 "rndc reconfig". [RT #26805] 11631 11632 3277. [bug] win32: isc_socket_dup is not implemented. [RT #27696] 11633 11634 3276. [bug] win32: ns_os_openfile failed to return NULL on 11635 safe_open failure. [RT #27696] 11636 11637 3275. [bug] Corrected rndc -h output; the 'rndc sync -clean' 11638 option had been misspelled as '-clear'. (To avoid 11639 future confusion, both options now work.) [RT #27173] 11640 11641 3274. [placeholder] 11642 11643 3273. [bug] AAAA responses could be returned in the additional 11644 section even when filter-aaaa-on-v4 was in use. 11645 [RT #27292] 11646 11647 3272. [func] New "rndc zonestatus" command prints information 11648 about the specified zone. [RT #21671] 11649 11650 3271. [port] darwin: mksymtbl is not always stable, loop several 11651 times before giving up. mksymtbl was using non 11652 portable perl to covert 64 bit hex strings. [RT #27653] 11653 11654 .. code-block:: none 11655 11656 --- 9.9.0rc2 released --- 11657 11658 3270. [bug] "rndc reload" didn't reuse existing zones correctly 11659 when inline-signing was in use. [RT #27650] 11660 11661 3269. [port] darwin 11 and later now built threaded by default. 11662 11663 3268. [bug] Convert RRSIG expiry times to 64 timestamps to work 11664 out the earliest expiry time. [RT #23311] 11665 11666 3267. [bug] Memory allocation failures could be mis-reported as 11667 unexpected error. New ISC_R_UNSET result code. 11668 [RT #27336] 11669 11670 3266. [bug] The maximum number of NSEC3 iterations for a 11671 DNSKEY RRset was not being properly computed. 11672 [RT #26543] 11673 11674 3265. [bug] Corrected a problem with lock ordering in the 11675 inline-signing code. [RT #27557] 11676 11677 3264. [bug] Automatic regeneration of signatures in an 11678 inline-signing zone could stall when the server 11679 was restarted. [RT #27344] 11680 11681 3263. [bug] "rndc sync" did not affect the unsigned side of an 11682 inline-signing zone. [RT #27337] 11683 11684 3262. [bug] Signed responses were handled incorrectly by RPZ. 11685 [RT #27316] 11686 11687 3261. [func] RRset ordering now defaults to random. [RT #27174] 11688 11689 3260. [bug] "rrset-order cyclic" could appear not to rotate 11690 for some query patterns. [RT #27170/27185] 11691 11692 .. code-block:: none 11693 11694 --- 9.9.0rc1 released --- 11695 11696 3259. [bug] named-compilezone: Suppress "dump zone to <file>" 11697 message when writing to stdout. [RT #27109] 11698 11699 3258. [test] Add "forcing full sign with unreadable keys" test. 11700 [RT #27153] 11701 11702 3257. [bug] Do not generate a error message when calling fsync() 11703 in a pipe or socket. [RT #27109] 11704 11705 3256. [bug] Disable empty zones for lwresd -C. [RT #27139] 11706 11707 3255. [func] No longer require that a empty zones be explicitly 11708 enabled or that a empty zone is disabled for 11709 RFC 1918 empty zones to be configured. [RT #27139] 11710 11711 3254. [bug] Set isc_socket_ipv6only() on the IPv6 control channels. 11712 [RT #22249] 11713 11714 3253. [bug] Return DNS_R_SYNTAX when the input to a text field is 11715 too long. [RT #26956] 11716 11717 3252. [bug] When master zones using inline-signing were 11718 updated while the server was offline, the source 11719 zone could fall out of sync with the signed 11720 copy. They can now resynchronize. [RT #26676] 11721 11722 3251. [bug] Enforce a upper bound (65535 bytes) on the amount of 11723 memory dns_sdlz_putrr() can allocate per record to 11724 prevent run away memory consumption on ISC_R_NOSPACE. 11725 [RT #26956] 11726 11727 3250. [func] 'configure --enable-developer'; turn on various 11728 configure options, normally off by default, that 11729 we want developers to build and test with. [RT #27103] 11730 11731 3249. [bug] Update log message when saving slave zones files for 11732 analysis after load failures. [RT #27087] 11733 11734 3248. [bug] Configure options --enable-fixed-rrset and 11735 --enable-exportlib were incompatible with each 11736 other. [RT #27087] 11737 11738 3247. [bug] 'raw' format zones failed to preserve load order 11739 breaking 'fixed' sort order. [RT #27087] 11740 11741 3246. [bug] Named failed to start with a empty also-notify list. 11742 [RT #27087] 11743 11744 3245. [bug] Don't report a error unchanged serials unless there 11745 were other changes when thawing a zone with 11746 ixfr-fromdifferences. [RT #26845] 11747 11748 3244. [func] Added readline support to nslookup and nsupdate. 11749 Also simplified nsupdate syntax to make "update" 11750 and "prereq" optional. [RT #24659] 11751 11752 3243. [port] freebsd,netbsd,bsdi: the thread defaults were not 11753 being properly set. 11754 11755 3242. [func] Extended the header of raw-format master files to 11756 include the serial number of the zone from which 11757 they were generated, if different (as in the case 11758 of inline-signing zones). This is to be used in 11759 inline-signing zones, to track changes between the 11760 unsigned and signed versions of the zone, which may 11761 have different serial numbers. 11762 11763 (Note: raw zonefiles generated by this version of 11764 BIND are no longer compatible with prior versions. 11765 To generate a backward-compatible raw zonefile 11766 using dnssec-signzone or named-compilezone, specify 11767 output format "raw=0" instead of simply "raw".) 11768 [RT #26587] 11769 11770 3241. [bug] Address race conditions in the resolver code. 11771 [RT #26889] 11772 11773 3240. [bug] DNSKEY state change events could be missed. [RT #26874] 11774 11775 3239. [bug] dns_dnssec_findmatchingkeys needs to use a consistent 11776 timestamp. [RT #26883] 11777 11778 3238. [bug] keyrdata was not being reinitialized in 11779 lib/dns/rbtdb.c:iszonesecure. [RT #26913] 11780 11781 3237. [bug] dig -6 didn't work with +trace. [RT #26906] 11782 11783 3236. [bug] Backed out changes #3182 and #3202, related to 11784 EDNS(0) fallback behavior. [RT #26416] 11785 11786 3235. [func] dns_db_diffx, a extended dns_db_diff which returns 11787 the generated diff and optionally writes it to a 11788 journal. [RT #26386] 11789 11790 3234. [bug] 'make depend' produced invalid makefiles. [RT #26830] 11791 11792 3233. [bug] 'rndc freeze/thaw' didn't work for inline zones. 11793 [RT #26632] 11794 11795 3232. [bug] Zero zone->curmaster before return in 11796 dns_zone_setmasterswithkeys(). [RT #26732] 11797 11798 3231. [bug] named could fail to send a incompressible zone. 11799 [RT #26796] 11800 11801 3230. [bug] 'dig axfr' failed to properly handle a multi-message 11802 axfr with a serial of 0. [RT #26796] 11803 11804 3229. [bug] Fix local variable to struct var assignment 11805 found by CLANG warning. 11806 11807 3228. [tuning] Dynamically grow symbol table to improve zone 11808 loading performance. [RT #26523] 11809 11810 3227. [bug] Interim fix to make WKS's use of getprotobyname() 11811 and getservbyname() self thread safe. [RT #26232] 11812 11813 3226. [bug] Address minor resource leakages. [RT #26624] 11814 11815 3225. [bug] Silence spurious "setsockopt(517, IPV6_V6ONLY) failed" 11816 messages. [RT #26507] 11817 11818 3224. [bug] 'rndc signing' argument parsing was broken. [RT #26684] 11819 11820 3223. [bug] 'task_test privilege_drop' generated false positives. 11821 [RT #26766] 11822 11823 3222. [cleanup] Replace dns_journal_{get,set}_bitws with 11824 dns_journal_{get,set}_sourceserial. [RT #26634] 11825 11826 3221. [bug] Fixed a potential core dump on shutdown due to 11827 referencing fetch context after it's been freed. 11828 [RT #26720] 11829 11830 .. code-block:: none 11831 11832 --- 9.9.0b2 released --- 11833 11834 3220. [bug] Change #3186 was incomplete; dns_db_rpz_findips() 11835 could fail to set the database version correctly, 11836 causing an assertion failure. [RT #26180] 11837 11838 3219. [bug] Disable NOEDNS caching following a timeout. 11839 11840 3218. [security] Cache lookup could return RRSIG data associated with 11841 nonexistent records, leading to an assertion 11842 failure. [RT #26590] 11843 11844 3217. [cleanup] Fix build problem with --disable-static. [RT #26476] 11845 11846 3216. [bug] resolver.c:validated() was not thread-safe. [RT #26478] 11847 11848 3215. [bug] 'rndc recursing' could cause a core dump. [RT #26495] 11849 11850 3214. [func] Add 'named -U' option to set the number of UDP 11851 listener threads per interface. [RT #26485] 11852 11853 3213. [doc] Clarify ixfr-from-differences behavior. [RT #25188] 11854 11855 3212. [bug] rbtdb.c: failed to remove a node from the deadnodes 11856 list prior to adding a reference to it leading a 11857 possible assertion failure. [RT #23219] 11858 11859 3211. [func] dnssec-signzone: "-f -" prints to stdout; "-O full" 11860 option prints in single-line-per-record format. 11861 [RT #20287] 11862 11863 3210. [bug] Canceling the oldest query due to recursive-client 11864 overload could trigger an assertion failure. [RT #26463] 11865 11866 3209. [func] Add "dnssec-lookaside 'no'". [RT #24858] 11867 11868 3208. [bug] 'dig -y' handle unknown tsig algorithm better. 11869 [RT #25522] 11870 11871 3207. [contrib] Fixed build error in Berkeley DB DLZ module. [RT #26444] 11872 11873 3206. [cleanup] Add ISC information to log at start time. [RT #25484] 11874 11875 3205. [func] Upgrade dig's defaults to better reflect modern 11876 nameserver behavior. Enable "dig +adflag" and 11877 "dig +edns=0" by default. Enable "+dnssec" when 11878 running "dig +trace". [RT #23497] 11879 11880 3204. [bug] When a master server that has been marked as 11881 unreachable sends a NOTIFY, mark it reachable 11882 again. [RT #25960] 11883 11884 3203. [bug] Increase log level to 'info' for validation failures 11885 from expired or not-yet-valid RRSIGs. [RT #21796] 11886 11887 3202. [bug] NOEDNS caching on timeout was too aggressive. 11888 [RT #26416] 11889 11890 3201. [func] 'rndc querylog' can now be given an on/off parameter 11891 instead of only being used as a toggle. [RT #18351] 11892 11893 3200. [doc] Some rndc functions were undocumented or were 11894 missing from 'rndc -h' output. [RT #25555] 11895 11896 3199. [func] When logging client information, include the name 11897 being queried. [RT #25944] 11898 11899 3198. [doc] Clarified that dnssec-settime can alter keyfile 11900 permissions. [RT #24866] 11901 11902 3197. [bug] Don't try to log the filename and line number when 11903 the config parser can't open a file. [RT #22263] 11904 11905 3196. [bug] nsupdate: return nonzero exit code when target zone 11906 doesn't exist. [RT #25783] 11907 11908 3195. [cleanup] Silence "file not found" warnings when loading 11909 managed-keys zone. [RT #26340] 11910 11911 3194. [doc] Updated RFC references in the 'empty-zones-enable' 11912 documentation. [RT #25203] 11913 11914 3193. [cleanup] Changed MAXZONEKEYS to DNS_MAXZONEKEYS, moved to 11915 dnssec.h. [RT #26415] 11916 11917 3192. [bug] A query structure could be used after being freed. 11918 [RT #22208] 11919 11920 3191. [bug] Print NULL records using "unknown" format. [RT #26392] 11921 11922 3190. [bug] Underflow in error handling in isc_mutexblock_init. 11923 [RT #26397] 11924 11925 3189. [test] Added a summary report after system tests. [RT #25517] 11926 11927 3188. [bug] zone.c:zone_refreshkeys() could fail to detach 11928 references correctly when errors occurred, causing 11929 a hang on shutdown. [RT #26372] 11930 11931 3187. [port] win32: support for Visual Studio 2008. [RT #26356] 11932 11933 .. code-block:: none 11934 11935 --- 9.9.0b1 released --- 11936 11937 3186. [bug] Version/db mismatch in rpz code. [RT #26180] 11938 11939 3185. [func] New 'rndc signing' option for auto-dnssec zones: 11940 - 'rndc signing -list' displays the current 11941 state of signing operations 11942 - 'rndc signing -clear' clears the signing state 11943 records for keys that have fully signed the zone 11944 - 'rndc signing -nsec3param' sets the NSEC3 11945 parameters for the zone 11946 The 'rndc keydone' syntax is removed. [RT #23729] 11947 11948 3184. [bug] named had excessive cpu usage when a redirect zone was 11949 configured. [RT #26013] 11950 11951 3183. [bug] Added RTLD_GLOBAL flag to dlopen call. [RT #26301] 11952 11953 3182. [bug] Auth servers behind firewalls which block packets 11954 greater than 512 bytes may cause other servers to 11955 perform poorly. Now, adb retains edns information 11956 and caches noedns servers. [RT #23392/24964] 11957 11958 3181. [func] Inline-signing is now supported for master zones. 11959 [RT #26224] 11960 11961 3180. [func] Local copies of slave zones are now saved in raw 11962 format by default, to improve startup performance. 11963 'masterfile-format text;' can be used to override 11964 the default, if desired. [RT #25867] 11965 11966 3179. [port] kfreebsd: build issues. [RT #26273] 11967 11968 3178. [bug] A race condition introduced by change #3163 could 11969 cause an assertion failure on shutdown. [RT #26271] 11970 11971 3177. [func] 'rndc keydone', remove the indicator record that 11972 named has finished signing the zone with the 11973 corresponding key. [RT #26206] 11974 11975 3176. [doc] Corrected example code and added a README to the 11976 sample external DLZ module in contrib/dlz/example. 11977 [RT #26215] 11978 11979 3175. [bug] Fix how DNSSEC positive wildcard responses from a 11980 NSEC3 signed zone are validated. Stop sending a 11981 unnecessary NSEC3 record when generating such 11982 responses. [RT #26200] 11983 11984 3174. [bug] Always compute to revoked key tag from scratch. 11985 [RT #26186] 11986 11987 3173. [port] Correctly validate root DS responses. [RT #25726] 11988 11989 3172. [port] darwin 10.* and freebsd [89] are now built threaded by 11990 default. 11991 11992 3171. [bug] Exclusively lock the task when adding a zone using 11993 'rndc addzone'. [RT #25600] 11994 11995 .. code-block:: none 11996 11997 --- 9.9.0a3 released --- 11998 11999 3170. [func] RPZ update: 12000 - fix precedence among competing rules 12001 - improve ARM text including documenting rule precedence 12002 - try to rewrite CNAME chains until first hit 12003 - new "rpz" logging channel 12004 - RDATA for CNAME rules can include wildcards 12005 - replace "NO-OP" named.conf policy override with 12006 "PASSTHRU" and add "DISABLED" override ("NO-OP" 12007 is still recognized) 12008 [RT #25172] 12009 12010 3169. [func] Catch db/version mis-matches when calling dns_db_*(). 12011 [RT #26017] 12012 12013 3168. [bug] Nxdomain redirection could trigger an assert with 12014 a ANY query. [RT #26017] 12015 12016 3167. [bug] Negative answers from forwarders were not being 12017 correctly tagged making them appear to not be cached. 12018 [RT #25380] 12019 12020 3166. [bug] Upgrading a zone to support inline-signing failed. 12021 [RT #26014] 12022 12023 3165. [bug] dnssec-signzone could generate new signatures when 12024 resigning, even when valid signatures were already 12025 present. [RT #26025] 12026 12027 3164. [func] Enable DLZ modules to retrieve client information, 12028 so that responses can be changed depending on the 12029 source address of the query. [RT #25768] 12030 12031 3163. [bug] Use finer-grained locking in client.c to address 12032 concurrency problems with large numbers of threads. 12033 [RT #26044] 12034 12035 3162. [test] start.pl: modified to allow for "named.args" in 12036 ns*/ subdirectory to override stock arguments to 12037 named. Largely from RT #26044, but no separate ticket. 12038 12039 3161. [bug] zone.c:del_sigs failed to always reset rdata leading 12040 assertion failures. [RT #25880] 12041 12042 3160. [bug] When printing out a NSEC3 record in multiline form 12043 the newline was not being printed causing type codes 12044 to be run together. [RT #25873] 12045 12046 3159. [bug] On some platforms, named could assert on startup 12047 when running in a chrooted environment without 12048 /proc. [RT #25863] 12049 12050 3158. [bug] Recursive servers would prefer a particular UDP 12051 socket instead of using all available sockets. 12052 [RT #26038] 12053 12054 3157. [tuning] Reduce the time spent in "rndc reconfig" by parsing 12055 the config file before pausing the server. [RT #21373] 12056 12057 3156. [placeholder] 12058 12059 .. code-block:: none 12060 12061 --- 9.9.0a2 released --- 12062 12063 3155. [bug] Fixed a build failure when using contrib DLZ 12064 drivers (e.g., mysql, postgresql, etc). [RT #25710] 12065 12066 3154. [bug] Attempting to print an empty rdataset could trigger 12067 an assert. [RT #25452] 12068 12069 3153. [func] Extend request-ixfr to zone level and remove the 12070 side effect of forcing an AXFR. [RT #25156] 12071 12072 3152. [cleanup] Some versions of gcc and clang failed due to 12073 incorrect use of __builtin_expect. [RT #25183] 12074 12075 3151. [bug] Queries for type RRSIG or SIG could be handled 12076 incorrectly. [RT #21050] 12077 12078 3150. [func] Improved startup and reconfiguration time by 12079 enabling zones to load in multiple threads. [RT #25333] 12080 12081 3149. [placeholder] 12082 12083 3148. [bug] Processing of normal queries could be stalled when 12084 forwarding a UPDATE message. [RT #24711] 12085 12086 3147. [func] Initial inline signing support. [RT #23657] 12087 12088 .. code-block:: none 12089 12090 --- 9.9.0a1 released --- 12091 12092 3146. [test] Fixed gcc4.6.0 errors in ATF. [RT #25598] 12093 12094 3145. [test] Capture output of ATF unit tests in "./atf.out" if 12095 there were any errors while running them. [RT #25527] 12096 12097 3144. [bug] dns_dbiterator_seek() could trigger an assert when 12098 used with a nonexistent database node. [RT #25358] 12099 12100 3143. [bug] Silence clang compiler warnings. [RT #25174] 12101 12102 3142. [bug] NAPTR is class agnostic. [RT #25429] 12103 12104 3141. [bug] Silence spurious "zone serial (0) unchanged" messages 12105 associated with empty zones. [RT #25079] 12106 12107 3140. [func] New command "rndc flushtree <name>" clears the 12108 specified name from the server cache along with 12109 all names under it. [RT #19970] 12110 12111 3139. [test] Added tests from RFC 6234, RFC 2202, and RFC 1321 12112 for the hashing algorithms (md5, sha1 - sha512, and 12113 their hmac counterparts). [RT #25067] 12114 12115 3138. [bug] Address memory leaks and out-of-order operations when 12116 shutting named down. [RT #25210] 12117 12118 3137. [func] Improve hardware scalability by allowing multiple 12119 worker threads to process incoming UDP packets. 12120 This can significantly increase query throughput 12121 on some systems. [RT #22992] 12122 12123 3136. [func] Add RFC 1918 reverse zones to the list of built-in 12124 empty zones switched on by the 'empty-zones-enable' 12125 option. [RT #24990] 12126 12127 3135. [port] FreeBSD: workaround broken IPV6_USE_MIN_MTU processing. 12128 See http://www.freebsd.org/cgi/query-pr.cgi?pr=158307 12129 [RT #24950] 12130 12131 3134. [bug] Improve the accuracy of dnssec-signzone's signing 12132 statistics. [RT #16030] 12133 12134 3133. [bug] Change #3114 was incomplete. [RT #24577] 12135 12136 3132. [placeholder] 12137 12138 3131. [tuning] Improve scalability by allocating one zone task 12139 per 100 zones at startup time, rather than using a 12140 fixed-size task table. [RT #24406] 12141 12142 3130. [func] Support alternate methods for managing a dynamic 12143 zone's serial number. Two methods are currently 12144 defined using serial-update-method, "increment" 12145 (default) and "unixtime". [RT #23849] 12146 12147 3129. [bug] Named could crash on 'rndc reconfig' when 12148 allow-new-zones was set to yes and named ACLs 12149 were used. [RT #22739] 12150 12151 3128. [func] Inserting an NSEC3PARAM via dynamic update in an 12152 auto-dnssec zone that has not been signed yet 12153 will cause it to be signed with the specified NSEC3 12154 parameters when keys are activated. The 12155 NSEC3PARAM record will not appear in the zone until 12156 it is signed, but the parameters will be stored. 12157 [RT #23684] 12158 12159 3127. [bug] 'rndc thaw' will now remove a zone's journal file 12160 if the zone serial number has been changed and 12161 ixfr-from-differences is not in use. [RT #24687] 12162 12163 3126. [security] Using DNAME record to generate replacements caused 12164 RPZ to exit with a assertion failure. [RT #24766] 12165 12166 3125. [security] Using wildcard CNAME records as a replacement with 12167 RPZ caused named to exit with a assertion failure. 12168 [RT #24715] 12169 12170 3124. [bug] Use an rdataset attribute flag to indicate 12171 negative-cache records rather than using rrtype 0; 12172 this will prevent problems when that rrtype is 12173 used in actual DNS packets. [RT #24777] 12174 12175 3123. [security] Change #2912 exposed a latent flaw in 12176 dns_rdataset_totext() that could cause named to 12177 crash with an assertion failure. [RT #24777] 12178 12179 3122. [cleanup] dnssec-settime: corrected usage message. [RT #24664] 12180 12181 3121. [security] An authoritative name server sending a negative 12182 response containing a very large RRset could 12183 trigger an off-by-one error in the ncache code 12184 and crash named. [RT #24650] 12185 12186 3120. [bug] Named could fail to validate zones listed in a DLV 12187 that validated insecure without using DLV and had 12188 DS records in the parent zone. [RT #24631] 12189 12190 3119. [bug] When rolling to a new DNSSEC key, a private-type 12191 record could be created and never marked complete. 12192 [RT #23253] 12193 12194 3118. [bug] nsupdate could dump core on shutdown when using 12195 SIG(0) keys. [RT #24604] 12196 12197 3117. [cleanup] Remove doc and parser references to the 12198 never-implemented 'auto-dnssec create' option. 12199 [RT #24533] 12200 12201 3116. [func] New 'dnssec-update-mode' option controls updates 12202 of DNSSEC records in signed dynamic zones. Set to 12203 'no-resign' to disable automatic RRSIG regeneration 12204 while retaining the ability to sign new or changed 12205 data. [RT #24533] 12206 12207 3115. [bug] Named could fail to return requested data when 12208 following a CNAME that points into the same zone. 12209 [RT #24455] 12210 12211 3114. [bug] Retain expired RRSIGs in dynamic zones if key is 12212 inactive and there is no replacement key. [RT #23136] 12213 12214 3113. [doc] Document the relationship between serial-query-rate 12215 and NOTIFY messages. 12216 12217 3112. [doc] Add missing descriptions of the update policy name 12218 types "ms-self", "ms-subdomain", "krb5-self" and 12219 "krb5-subdomain", which allow machines to update 12220 their own records, to the BIND 9 ARM. 12221 12222 3111. [bug] Improved consistency checks for dnssec-enable and 12223 dnssec-validation, added test cases to the 12224 checkconf system test. [RT #24398] 12225 12226 3110. [bug] dnssec-signzone: Wrong error message could appear 12227 when attempting to sign with no KSK. [RT #24369] 12228 12229 3109. [func] The also-notify option now uses the same syntax 12230 as a zone's masters clause. This means it is 12231 now possible to specify a TSIG key to use when 12232 sending notifies to a given server, or to include 12233 an explicit named masters list in an also-notify 12234 statement. [RT #23508] 12235 12236 3108. [cleanup] dnssec-signzone: Clarified some error and 12237 warning messages; removed #ifdef ALLOW_KSKLESS_ZONES 12238 code (use -P instead). [RT #20852] 12239 12240 3107. [bug] dnssec-signzone: Report the correct number of ZSKs 12241 when using -x. [RT #20852] 12242 12243 3106. [func] When logging client requests, include the name of 12244 the TSIG key if any. [RT #23619] 12245 12246 3105. [bug] GOST support can be suppressed by "configure 12247 --without-gost" [RT #24367] 12248 12249 3104. [bug] Better support for cross-compiling. [RT #24367] 12250 12251 3103. [bug] Configuring 'dnssec-validation auto' in a view 12252 instead of in the options statement could trigger 12253 an assertion failure in named-checkconf. [RT #24382] 12254 12255 3102. [func] New 'dnssec-loadkeys-interval' option configures 12256 how often, in minutes, to check the key repository 12257 for updates when using automatic key maintenance. 12258 Default is every 60 minutes (formerly hard-coded 12259 to 12 hours). [RT #23744] 12260 12261 3101. [bug] Zones using automatic key maintenance could fail 12262 to check the key repository for updates. [RT #23744] 12263 12264 3100. [security] Certain response policy zone configurations could 12265 trigger an INSIST when receiving a query of type 12266 RRSIG. [RT #24280] 12267 12268 3099. [test] "dlz" system test now runs but gives R:SKIPPED if 12269 not compiled with --with-dlz-filesystem. [RT #24146] 12270 12271 3098. [bug] DLZ zones were answering without setting the AA bit. 12272 [RT #24146] 12273 12274 3097. [test] Add a tool to test handling of malformed packets. 12275 [RT #24096] 12276 12277 3096. [bug] Set KRB5_KTNAME before calling log_cred() in 12278 dst_gssapi_acceptctx(). [RT #24004] 12279 12280 3095. [bug] Handle isolated reserved ports in the port range. 12281 [RT #23957] 12282 12283 3094. [doc] Expand dns64 documentation. 12284 12285 3093. [bug] Fix gssapi/kerberos dependencies [RT #23836] 12286 12287 3092. [bug] Signatures for records at the zone apex could go 12288 stale due to an incorrect timer setting. [RT #23769] 12289 12290 3091. [bug] Fixed a bug in which zone keys that were published 12291 and then subsequently activated could fail to trigger 12292 automatic signing. [RT #22911] 12293 12294 3090. [func] Make --with-gssapi default [RT #23738] 12295 12296 3089. [func] dnssec-dsfromkey now supports reading keys from 12297 standard input "dnssec-dsfromkey -f -". [RT #20662] 12298 12299 3088. [bug] Remove bin/tests/system/logfileconfig/ns1/named.conf 12300 and add setup.sh in order to resolve changing 12301 named.conf issue. [RT #23687] 12302 12303 3087. [bug] DDNS updates using SIG(0) with update-policy match 12304 type "external" could cause a crash. [RT #23735] 12305 12306 3086. [bug] Running dnssec-settime -f on an old-style key will 12307 now force an update to the new key format even if no 12308 other change has been specified, using "-P now -A now" 12309 as default values. [RT #22474] 12310 12311 3085. [func] New '-R' option in dnssec-signzone forces removal 12312 of signatures which have not yet expired but 12313 were generated by a key that no longer exists. 12314 [RT #22471] 12315 12316 3084. [func] A new command "rndc sync" dumps pending changes in 12317 a dynamic zone to disk; "rndc sync -clean" also 12318 removes the journal file after syncing. Also, 12319 "rndc freeze" no longer removes journal files. 12320 [RT #22473] 12321 12322 3083. [bug] NOTIFY messages were not being sent when generating 12323 a NSEC3 chain incrementally. [RT #23702] 12324 12325 3082. [port] strtok_r is threads only. [RT #23747] 12326 12327 3081. [bug] Failure of DNAME substitution did not return 12328 YXDOMAIN. [RT #23591] 12329 12330 3080. [cleanup] Replaced compile time constant by STDTIME_ON_32BITS. 12331 [RT #23587] 12332 12333 3079. [bug] Handle isc_event_allocate failures in t_tasks. 12334 [RT #23572] 12335 12336 3078. [func] Added a new include file with function typedefs 12337 for the DLZ "dlopen" driver. [RT #23629] 12338 12339 3077. [bug] zone.c:zone_refreshkeys() incorrectly called 12340 dns_zone_attach(), use zone->irefs instead. [RT #23303] 12341 12342 3076. [func] New '-L' option in dnssec-keygen, dnsset-settime, and 12343 dnssec-keyfromlabel sets the default TTL of the 12344 key. When possible, automatic signing will use that 12345 TTL when the key is published. [RT #23304] 12346 12347 3075. [bug] dns_dnssec_findzonekeys{2} used a inconsistent 12348 timestamp when determining which keys are active. 12349 [RT #23642] 12350 12351 3074. [bug] Make the adb cache read through for zone data and 12352 glue learn for zone named is authoritative for. 12353 [RT #22842] 12354 12355 3073. [bug] managed-keys changes were not properly being recorded. 12356 [RT #20256] 12357 12358 3072. [bug] dns_dns64_aaaaok() potential NULL pointer dereference. 12359 [RT #20256] 12360 12361 3071. [bug] has_nsec could be used uninitialized in 12362 update.c:next_active. [RT #20256] 12363 12364 3070. [bug] dnssec-signzone potential NULL pointer dereference. 12365 [RT #20256] 12366 12367 3069. [cleanup] Silence warnings messages from clang static analysis. 12368 [RT #20256] 12369 12370 3068. [bug] Named failed to build with a OpenSSL without engine 12371 support. [RT #23473] 12372 12373 3067. [bug] ixfr-from-differences {master|slave}; failed to 12374 select the master/slave zones. [RT #23580] 12375 12376 3066. [func] The DLZ "dlopen" driver is now built by default, 12377 no longer requiring a configure option. To 12378 disable it, use "configure --without-dlopen". 12379 Driver also supported on win32. [RT #23467] 12380 12381 3065. [bug] RRSIG could have time stamps too far in the future. 12382 [RT #23356] 12383 12384 3064. [bug] powerpc: add sync instructions to the end of atomic 12385 operations. [RT #23469] 12386 12387 3063. [contrib] More verbose error reporting from DLZ LDAP. [RT #23402] 12388 12389 3062. [func] Made several changes to enhance human readability 12390 of DNSSEC data in dig output and in generated 12391 zone files: 12392 - DNSKEY record comments are more verbose, no 12393 longer used in multiline mode only 12394 - multiline RRSIG records reformatted 12395 - multiline output mode for NSEC3PARAM records 12396 - "dig +norrcomments" suppresses DNSKEY comments 12397 - "dig +split=X" breaks hex/base64 records into 12398 fields of width X; "dig +nosplit" disables this. 12399 [RT #22820] 12400 12401 3061. [func] New option "dnssec-signzone -D", only write out 12402 generated DNSSEC records. [RT #22896] 12403 12404 3060. [func] New option "dnssec-signzone -X <date>" allows 12405 specification of a separate expiration date 12406 for DNSKEY RRSIGs and other RRSIGs. [RT #22141] 12407 12408 3059. [test] Added a regression test for change #3023. 12409 12410 3058. [bug] Cause named to terminate at startup or rndc reconfig/ 12411 reload to fail, if a log file specified in the conf 12412 file isn't a plain file. [RT #22771] 12413 12414 3057. [bug] "rndc secroots" would abort after the first error 12415 and so could miss some views. [RT #23488] 12416 12417 3056. [func] Added support for URI resource record. [RT #23386] 12418 12419 3055. [placeholder] 12420 12421 3054. [bug] Added elliptic curve support check in 12422 GOST OpenSSL engine detection. [RT #23485] 12423 12424 3053. [bug] Under a sustained high query load with a finite 12425 max-cache-size, it was possible for cache memory 12426 to be exhausted and not recovered. [RT #23371] 12427 12428 3052. [test] Fixed last autosign test report. [RT #23256] 12429 12430 3051. [bug] NS records obscure DNAME records at the bottom of the 12431 zone if both are present. [RT #23035] 12432 12433 3050. [bug] The autosign system test was timing dependent. 12434 Wait for the initial autosigning to complete 12435 before running the rest of the test. [RT #23035] 12436 12437 3049. [bug] Save and restore the gid when creating creating 12438 named.pid at startup. [RT #23290] 12439 12440 3048. [bug] Fully separate view key management. [RT #23419] 12441 12442 3047. [bug] DNSKEY NODATA responses not cached fixed in 12443 validator.c. Tests added to dnssec system test. 12444 [RT #22908] 12445 12446 3046. [bug] Use RRSIG original TTL to compute validated RRset 12447 and RRSIG TTL. [RT #23332] 12448 12449 3045. [removed] Replaced by change #3050. 12450 12451 3044. [bug] Hold the socket manager lock while freeing the socket. 12452 [RT #23333] 12453 12454 3043. [test] Merged in the NetBSD ATF test framework (currently 12455 version 0.12) for development of future unit tests. 12456 Use configure --with-atf to build ATF internally 12457 or configure --with-atf=prefix to use an external 12458 copy. [RT #23209] 12459 12460 3042. [bug] dig +trace could fail attempting to use IPv6 12461 addresses on systems with only IPv4 connectivity. 12462 [RT #23297] 12463 12464 3041. [bug] dnssec-signzone failed to generate new signatures on 12465 ttl changes. [RT #23330] 12466 12467 3040. [bug] Named failed to validate insecure zones where a node 12468 with a CNAME existed between the trust anchor and the 12469 top of the zone. [RT #23338] 12470 12471 3039. [func] Redirect on NXDOMAIN support. [RT #23146] 12472 12473 3038. [bug] Install <dns/rpz.h>. [RT #23342] 12474 12475 3037. [doc] Update COPYRIGHT to contain all the individual 12476 copyright notices that cover various parts. 12477 12478 3036. [bug] Check built-in zone arguments to see if the zone 12479 is re-usable or not. [RT #21914] 12480 12481 3035. [cleanup] Simplify by using strlcpy. [RT #22521] 12482 12483 3034. [cleanup] nslookup: use strlcpy instead of safecopy. [RT #22521] 12484 12485 3033. [cleanup] Add two INSIST(bucket != DNS_ADB_INVALIDBUCKET). 12486 [RT #22521] 12487 12488 3032. [bug] rdatalist.c: add missing REQUIREs. [RT #22521] 12489 12490 3031. [bug] dns_rdataclass_format() handle a zero sized buffer. 12491 [RT #22521] 12492 12493 3030. [bug] dns_rdatatype_format() handle a zero sized buffer. 12494 [RT #22521] 12495 12496 3029. [bug] isc_netaddr_format() handle a zero sized buffer. 12497 [RT #22521] 12498 12499 3028. [bug] isc_sockaddr_format() handle a zero sized buffer. 12500 [RT #22521] 12501 12502 3027. [bug] Add documented REQUIREs to cfg_obj_asnetprefix() to 12503 catch NULL pointer dereferences before they happen. 12504 [RT #22521] 12505 12506 3026. [bug] lib/isc/httpd.c: check that we have enough space 12507 after calling grow_headerspace() and if not 12508 re-call grow_headerspace() until we do. [RT #22521] 12509 12510 3025. [bug] Fixed a possible deadlock due to zone resigning. 12511 [RT #22964] 12512 12513 3024. [func] RTT Banding removed due to minor security increase 12514 but major impact on resolver latency. [RT #23310] 12515 12516 3023. [bug] Named could be left in an inconsistent state when 12517 receiving multiple AXFR response messages that were 12518 not all TSIG-signed. [RT #23254] 12519 12520 3022. [bug] Fixed rpz SERVFAILs after failed zone transfers 12521 [RT #23246] 12522 12523 3021. [bug] Change #3010 was incomplete. [RT #22296] 12524 12525 3020. [bug] auto-dnssec failed to correctly update the zone when 12526 changing the DNSKEY RRset. [RT #23232] 12527 12528 3019. [test] Test: check apex NSEC3 records after adding DNSKEY 12529 record via UPDATE. [RT #23229] 12530 12531 3018. [bug] Named failed to check for the "none;" acl when deciding 12532 if a zone may need to be re-signed. [RT #23120] 12533 12534 3017. [doc] dnssec-keyfromlabel -I was not properly documented. 12535 [RT #22887] 12536 12537 3016. [bug] rndc usage missing '-b'. [RT #22937] 12538 12539 3015. [port] win32: fix IN6_IS_ADDR_LINKLOCAL and 12540 IN6_IS_ADDR_SITELOCAL macros. [RT #22724] 12541 12542 3014. [placeholder] 12543 12544 3013. [bug] The DNS64 ttl was not always being set as expected. 12545 [RT #23034] 12546 12547 3012. [bug] Remove DNSKEY TTL change pairs before generating 12548 signing records for any remaining DNSKEY changes. 12549 [RT #22590] 12550 12551 3011. [func] Change the default query timeout from 30 seconds 12552 to 10. Allow setting this in named.conf using the new 12553 'resolver-query-timeout' option, which specifies a max 12554 time in seconds. 0 means 'default' and anything longer 12555 than 30 will be silently set to 30. [RT #22852] 12556 12557 3010. [bug] Fixed a bug where "rndc reconfig" stopped the timer 12558 for refreshing managed-keys. [RT #22296] 12559 12560 3009. [bug] clients-per-query code didn't work as expected with 12561 particular query patterns. [RT #22972] 12562 12563 .. code-block:: none 12564 12565 --- 9.8.0b1 released --- 12566 12567 3008. [func] Response policy zones (RPZ) support. [RT #21726] 12568 12569 3007. [bug] Named failed to preserve the case of domain names in 12570 rdata which is not compressible when writing master 12571 files. [RT #22863] 12572 12573 3006. [func] Allow dynamically generated TSIG keys to be preserved 12574 across restarts of named. Initially this is for 12575 TSIG keys generated using GSSAPI. [RT #22639] 12576 12577 3005. [port] Solaris: Work around the lack of 12578 gsskrb5_register_acceptor_identity() by setting 12579 the KRB5_KTNAME environment variable to the 12580 contents of tkey-gssapi-keytab. Also fixed 12581 test errors on MacOSX. [RT #22853] 12582 12583 3004. [func] DNS64 reverse support. [RT #22769] 12584 12585 3003. [experimental] Added update-policy match type "external", 12586 enabling named to defer the decision of whether to 12587 allow a dynamic update to an external daemon. 12588 (Contributed by Andrew Tridgell.) [RT #22758] 12589 12590 3002. [bug] isc_mutex_init_errcheck() failed to destroy attr. 12591 [RT #22766] 12592 12593 3001. [func] Added a default trust anchor for the root zone, which 12594 can be switched on by setting "dnssec-validation auto;" 12595 in the named.conf options. [RT #21727] 12596 12597 3000. [bug] More TKEY/GSS fixes: 12598 - nsupdate can now get the default realm from 12599 the user's Kerberos principal 12600 - corrected gsstest compilation flags 12601 - improved documentation 12602 - fixed some NULL dereferences 12603 [RT #22795] 12604 12605 2999. [func] Add GOST support (RFC 5933). [RT #20639] 12606 12607 2998. [func] Add isc_task_beginexclusive and isc_task_endexclusive 12608 to the task api. [RT #22776] 12609 12610 2997. [func] named -V now reports the OpenSSL and libxml2 versions 12611 it was compiled against. [RT #22687] 12612 12613 2996. [security] Temporarily disable SO_ACCEPTFILTER support. 12614 [RT #22589] 12615 12616 2995. [bug] The Kerberos realm was not being correctly extracted 12617 from the signer's identity. [RT #22770] 12618 12619 2994. [port] NetBSD: use pthreads by default on NetBSD >= 5.0, and 12620 do not use threads on earlier versions. Also kill 12621 the unproven-pthreads, mit-pthreads, and ptl2 support. 12622 12623 2993. [func] Dynamically grow adb hash tables. [RT #21186] 12624 12625 2992. [contrib] contrib/check-secure-delegation.pl: A simple tool 12626 for looking at a secure delegation. [RT #22059] 12627 12628 2991. [contrib] contrib/zone-edit.sh: A simple zone editing tool for 12629 dynamic zones. [RT #22365] 12630 12631 2990. [bug] 'dnssec-settime -S' no longer tests prepublication 12632 interval validity when the interval is set to 0. 12633 [RT #22761] 12634 12635 2989. [func] Added support for writable DLZ zones. (Contributed 12636 by Andrew Tridgell of the Samba project.) [RT #22629] 12637 12638 2988. [experimental] Added a "dlopen" DLZ driver, allowing the creation 12639 of external DLZ drivers that can be loaded as 12640 shared objects at runtime rather than linked with 12641 named. Currently this is switched on via a 12642 compile-time option, "configure --with-dlz-dlopen". 12643 Note: the syntax for configuring DLZ zones 12644 is likely to be refined in future releases. 12645 (Contributed by Andrew Tridgell of the Samba 12646 project.) [RT #22629] 12647 12648 2987. [func] Improve ease of configuring TKEY/GSS updates by 12649 adding a "tkey-gssapi-keytab" option. If set, 12650 updates will be allowed with any key matching 12651 a principal in the specified keytab file. 12652 "tkey-gssapi-credential" is no longer required 12653 and is expected to be deprecated. (Contributed 12654 by Andrew Tridgell of the Samba project.) 12655 [RT #22629] 12656 12657 2986. [func] Add new zone type "static-stub". It's like a stub 12658 zone, but the nameserver names and/or their IP 12659 addresses are statically configured. [RT #21474] 12660 12661 2985. [bug] Add a regression test for change #2896. [RT #21324] 12662 12663 2984. [bug] Don't run MX checks when the target of the MX record 12664 is ".". [RT #22645] 12665 12666 2983. [bug] Include "loadkeys" in rndc help output. [RT #22493] 12667 12668 .. code-block:: none 12669 12670 --- 9.8.0a1 released --- 12671 12672 2982. [bug] Reference count dst keys. dst_key_attach() can be used 12673 increment the reference count. 12674 12675 Note: dns_tsigkey_createfromkey() callers should now 12676 always call dst_key_free() rather than setting it 12677 to NULL on success. [RT #22672] 12678 12679 2981. [func] Partial DNS64 support (AAAA synthesis). [RT #21991] 12680 12681 2980. [bug] named didn't properly handle UPDATES that changed the 12682 TTL of the NSEC3PARAM RRset. [RT #22363] 12683 12684 2979. [bug] named could deadlock during shutdown if two 12685 "rndc stop" commands were issued at the same 12686 time. [RT #22108] 12687 12688 2978. [port] hpux: look for <devpoll.h> [RT #21919] 12689 12690 2977. [bug] 'nsupdate -l' report if the session key is missing. 12691 [RT #21670] 12692 12693 2976. [bug] named could die on exit after negotiating a GSS-TSIG 12694 key. [RT #22573] 12695 12696 2975. [bug] rbtdb.c:cleanup_dead_nodes_callback() acquired the 12697 wrong lock which could lead to server deadlock. 12698 [RT #22614] 12699 12700 2974. [bug] Some valid UPDATE requests could fail due to a 12701 consistency check examining the existing version 12702 of the zone rather than the new version resulting 12703 from the UPDATE. [RT #22413] 12704 12705 2973. [bug] bind.keys.h was being removed by the "make clean" 12706 at the end of configure resulting in build failures 12707 where there is very old version of perl installed. 12708 Move it to "make maintainer-clean". [RT #22230] 12709 12710 2972. [bug] win32: address windows socket errors. [RT #21906] 12711 12712 2971. [bug] Fixed a bug that caused journal files not to be 12713 compacted on Windows systems as a result of 12714 non-POSIX-compliant rename() semantics. [RT #22434] 12715 12716 2970. [security] Adding a NO DATA negative cache entry failed to clear 12717 any matching RRSIG records. A subsequent lookup of 12718 of NO DATA cache entry could trigger a INSIST when the 12719 unexpected RRSIG was also returned with the NO DATA 12720 cache entry. 12721 12722 CVE-2010-3613, VU#706148. [RT #22288] 12723 12724 2969. [security] Fix acl type processing so that allow-query works 12725 in options and view statements. Also add a new 12726 set of tests to verify proper functioning. 12727 12728 CVE-2010-3615, VU#510208. [RT #22418] 12729 12730 2968. [security] Named could fail to prove a data set was insecure 12731 before marking it as insecure. One set of conditions 12732 that can trigger this occurs naturally when rolling 12733 DNSKEY algorithms. 12734 12735 CVE-2010-3614, VU#837744. [RT #22309] 12736 12737 2967. [bug] 'host -D' now turns on debugging messages earlier. 12738 [RT #22361] 12739 12740 2966. [bug] isc_print_vsnprintf() failed to check if there was 12741 space available in the buffer when adding a left 12742 justified character with a non zero width, 12743 (e.g. "%-1c"). [RT #22270] 12744 12745 2965. [func] Test HMAC functions using test data from RFC 2104 and 12746 RFC 4634. [RT #21702] 12747 12748 2964. [placeholder] 12749 12750 2963. [security] The allow-query acl was being applied instead of the 12751 allow-query-cache acl to cache lookups. [RT #22114] 12752 12753 2962. [port] win32: add more dependencies to BINDBuild.dsw. 12754 [RT #22062] 12755 12756 2961. [bug] Be still more selective about the non-authoritative 12757 answers we apply change 2748 to. [RT #22074] 12758 12759 2960. [func] Check that named accepts non-authoritative answers. 12760 [RT #21594] 12761 12762 2959. [func] Check that named starts with a missing masterfile. 12763 [RT #22076] 12764 12765 2958. [bug] named failed to start with a missing master file. 12766 [RT #22076] 12767 12768 2957. [bug] entropy_get() and entropy_getpseudo() failed to match 12769 the API for RAND_bytes() and RAND_pseudo_bytes() 12770 respectively. [RT #21962] 12771 12772 2956. [port] Enable atomic operations on the PowerPC64. [RT #21899] 12773 12774 2955. [func] Provide more detail in the recursing log. [RT #22043] 12775 12776 2954. [bug] contrib: dlz_mysql_driver.c bad error handling on 12777 build_sqldbinstance failure. [RT #21623] 12778 12779 2953. [bug] Silence spurious "expected covering NSEC3, got an 12780 exact match" message when returning a wildcard 12781 no data response. [RT #21744] 12782 12783 2952. [port] win32: named-checkzone and named-checkconf failed 12784 to initialize winsock. [RT #21932] 12785 12786 2951. [bug] named failed to generate a correct signed response 12787 in a optout, delegation only zone with no secure 12788 delegations. [RT #22007] 12789 12790 2950. [bug] named failed to perform a SOA up to date check when 12791 falling back to TCP on UDP timeouts when 12792 ixfr-from-differences was set. [RT #21595] 12793 12794 2949. [bug] dns_view_setnewzones() contained a memory leak if 12795 it was called multiple times. [RT #21942] 12796 12797 2948. [port] MacOS: provide a mechanism to configure the test 12798 interfaces at reboot. See bin/tests/system/README 12799 for details. 12800 12801 2947. [placeholder] 12802 12803 2946. [doc] Document the default values for the minimum and maximum 12804 zone refresh and retry values in the ARM. [RT #21886] 12805 12806 2945. [doc] Update empty-zones list in ARM. [RT #21772] 12807 12808 2944. [maint] Remove ORCHID prefix from built in empty zones. 12809 [RT #21772] 12810 12811 2943. [func] Add support to load new keys into managed zones 12812 without signing immediately with "rndc loadkeys". 12813 Add support to link keys with "dnssec-keygen -S" 12814 and "dnssec-settime -S". [RT #21351] 12815 12816 2942. [contrib] zone2sqlite failed to setup the entropy sources. 12817 [RT #21610] 12818 12819 2941. [bug] sdb and sdlz (dlz's zone database) failed to support 12820 DNAME at the zone apex. [RT #21610] 12821 12822 2940. [port] Remove connection aborted error message on 12823 Windows. [RT #21549] 12824 12825 2939. [func] Check that named successfully skips NSEC3 records 12826 that fail to match the NSEC3PARAM record currently 12827 in use. [RT #21868] 12828 12829 2938. [bug] When generating signed responses, from a signed zone 12830 that uses NSEC3, named would use a uninitialized 12831 pointer if it needed to skip a NSEC3 record because 12832 it didn't match the selected NSEC3PARAM record for 12833 zone. [RT #21868] 12834 12835 2937. [bug] Worked around an apparent race condition in over 12836 memory conditions. Without this fix a DNS cache DB or 12837 ADB could incorrectly stay in an over memory state, 12838 effectively refusing further caching, which 12839 subsequently made a BIND 9 caching server unworkable. 12840 This fix prevents this problem from happening by 12841 polling the state of the memory context, rather than 12842 making a copy of the state, which appeared to cause 12843 a race. This is a "workaround" in that it doesn't 12844 solve the possible race per se, but several experiments 12845 proved this change solves the symptom. Also, the 12846 polling overhead hasn't been reported to be an issue. 12847 This bug should only affect a caching server that 12848 specifies a finite max-cache-size. It's also quite 12849 likely that the bug happens only when enabling threads, 12850 but it's not confirmed yet. [RT #21818] 12851 12852 2936. [func] Improved configuration syntax and multiple-view 12853 support for addzone/delzone feature (see change 12854 #2930). Removed "new-zone-file" option, replaced 12855 with "allow-new-zones (yes|no)". The new-zone-file 12856 for each view is now created automatically, with 12857 a filename generated from a hash of the view name. 12858 It is no longer necessary to "include" the 12859 new-zone-file in named.conf; this happens 12860 automatically. Zones that were not added via 12861 "rndc addzone" can no longer be removed with 12862 "rndc delzone". [RT #19447] 12863 12864 2935. [bug] nsupdate: improve 'file not found' error message. 12865 [RT #21871] 12866 12867 2934. [bug] Use ANSI C compliant shift range in lib/isc/entropy.c. 12868 [RT #21871] 12869 12870 2933. [bug] 'dig +nsid' used stack memory after it went out of 12871 scope. This could potentially result in a unknown, 12872 potentially malformed, EDNS option being sent instead 12873 of the desired NSID option. [RT #21781] 12874 12875 2932. [cleanup] Corrected a numbering error in the "dnssec" test. 12876 [RT #21597] 12877 12878 2931. [bug] Temporarily and partially disable change 2864 12879 because it would cause infinite attempts of RRSIG 12880 queries. This is an urgent care fix; we'll 12881 revisit the issue and complete the fix later. 12882 [RT #21710] 12883 12884 2930. [experimental] New "rndc addzone" and "rndc delzone" commands 12885 allow dynamic addition and deletion of zones. 12886 To enable this feature, specify a "new-zone-file" 12887 option at the view or options level in named.conf. 12888 Zone configuration information for the new zones 12889 will be written into that file. To make the new 12890 zones persist after a restart, "include" the file 12891 into named.conf in the appropriate view. (Note: 12892 This feature is not yet documented, and its syntax 12893 is expected to change.) [RT #19447] 12894 12895 2929. [bug] Improved handling of GSS security contexts: 12896 - added LRU expiration for generated TSIGs 12897 - added the ability to use a non-default realm 12898 - added new "realm" keyword in nsupdate 12899 - limited lifetime of generated keys to 1 hour 12900 or the lifetime of the context (whichever is 12901 smaller) 12902 [RT #19737] 12903 12904 2928. [bug] Be more selective about the non-authoritative 12905 answer we apply change 2748 to. [RT #21594] 12906 12907 2927. [placeholder] 12908 12909 2926. [placeholder] 12910 12911 2925. [bug] Named failed to accept uncachable negative responses 12912 from insecure zones. [RT #21555] 12913 12914 2924. [func] 'rndc secroots' dump a combined summary of the 12915 current managed keys combined with trusted keys. 12916 [RT #20904] 12917 12918 2923. [bug] 'dig +trace' could drop core after "connection 12919 timeout". [RT #21514] 12920 12921 2922. [contrib] Update zkt to version 1.0. 12922 12923 2921. [bug] The resolver could attempt to destroy a fetch context 12924 too soon. [RT #19878] 12925 12926 2920. [func] Allow 'filter-aaaa-on-v4' to be applied selectively 12927 to IPv4 clients. New acl 'filter-aaaa' (default any). 12928 12929 2919. [func] Add autosign-ksk and autosign-zsk virtual time tests. 12930 [RT #20840] 12931 12932 2918. [maint] Add AAAA address for I.ROOT-SERVERS.NET. 12933 12934 2917. [func] Virtual time test framework. [RT #20801] 12935 12936 2916. [func] Add framework to use IPv6 in tests. 12937 fd92:7065:b8e:ffff::1 ... fd92:7065:b8e:ffff::7 12938 12939 2915. [cleanup] Be smarter about which objects we attempt to compile 12940 based on configure options. [RT #21444] 12941 12942 2914. [bug] Make the "autosign" system test more portable. 12943 [RT #20997] 12944 12945 2913. [func] Add pkcs#11 system tests. [RT #20784] 12946 12947 2912. [func] Windows clients don't like UPDATE responses that clear 12948 the zone section. [RT #20986] 12949 12950 2911. [bug] dnssec-signzone didn't handle out of zone records well. 12951 [RT #21367] 12952 12953 2910. [func] Sanity check Kerberos credentials. [RT #20986] 12954 12955 2909. [bug] named-checkconf -p could die if "update-policy local;" 12956 was specified in named.conf. [RT #21416] 12957 12958 2908. [bug] It was possible for re-signing to stop after removing 12959 a DNSKEY. [RT #21384] 12960 12961 2907. [bug] The export version of libdns had undefined references. 12962 [RT #21444] 12963 12964 2906. [bug] Address RFC 5011 implementation issues. [RT #20903] 12965 12966 2905. [port] aix: set use_atomic=yes with native compiler. 12967 [RT #21402] 12968 12969 2904. [bug] When using DLV, sub-zones of the zones in the DLV, 12970 could be incorrectly marked as insecure instead of 12971 secure leading to negative proofs failing. This was 12972 a unintended outcome from change 2890. [RT #21392] 12973 12974 2903. [bug] managed-keys-directory missing from namedconf.c. 12975 [RT #21370] 12976 12977 2902. [func] Add regression test for change 2897. [RT #21040] 12978 12979 2901. [port] Use AC_C_FLEXIBLE_ARRAY_MEMBER. [RT #21316] 12980 12981 2900. [bug] The placeholder negative caching element was not 12982 properly constructed triggering a INSIST in 12983 dns_ncache_towire(). [RT #21346] 12984 12985 2899. [port] win32: Support linking against OpenSSL 1.0.0. 12986 12987 2898. [bug] nslookup leaked memory when -domain=value was 12988 specified. [RT #21301] 12989 12990 2897. [bug] NSEC3 chains could be left behind when transitioning 12991 to insecure. [RT #21040] 12992 12993 2896. [bug] "rndc sign" failed to properly update the zone 12994 when adding a DNSKEY for publication only. [RT #21045] 12995 12996 2895. [func] genrandom: add support for the generation of multiple 12997 files. [RT #20917] 12998 12999 2894. [contrib] DLZ LDAP support now use '$' not '%'. [RT #21294] 13000 13001 2893. [bug] Improve managed keys support. New named.conf option 13002 managed-keys-directory. [RT #20924] 13003 13004 2892. [bug] Handle REVOKED keys better. [RT #20961] 13005 13006 2891. [maint] Update empty-zones list to match 13007 draft-ietf-dnsop-default-local-zones-13. [RT #21099] 13008 13009 2890. [bug] Handle the introduction of new trusted-keys and 13010 DS, DLV RRsets better. [RT #21097] 13011 13012 2889. [bug] Elements of the grammar where not properly reported. 13013 [RT #21046] 13014 13015 2888. [bug] Only the first EDNS option was displayed. [RT #21273] 13016 13017 2887. [bug] Report the keytag times in UTC in the .key file, 13018 local time is presented as a comment within the 13019 comment. [RT #21223] 13020 13021 2886. [bug] ctime() is not thread safe. [RT #21223] 13022 13023 2885. [bug] Improve -fno-strict-aliasing support probing in 13024 configure. [RT #21080] 13025 13026 2884. [bug] Insufficient validation in dns_name_getlabelsequence(). 13027 [RT #21283] 13028 13029 2883. [bug] 'dig +short' failed to handle really large datasets. 13030 [RT #21113] 13031 13032 2882. [bug] Remove memory context from list of active contexts 13033 before clearing 'magic'. [RT #21274] 13034 13035 2881. [bug] Reduce the amount of time the rbtdb write lock 13036 is held when closing a version. [RT #21198] 13037 13038 2880. [cleanup] Make the output of dnssec-keygen and dnssec-revoke 13039 consistent. [RT #21078] 13040 13041 2879. [contrib] DLZ bdbhpt driver fails to close correct cursor. 13042 [RT #21106] 13043 13044 2878. [func] Incrementally write the master file after performing 13045 a AXFR. [RT #21010] 13046 13047 2877. [bug] The validator failed to skip obviously mismatching 13048 RRSIGs. [RT #21138] 13049 13050 2876. [bug] Named could return SERVFAIL for negative responses 13051 from unsigned zones. [RT #21131] 13052 13053 2875. [bug] dns_time64_fromtext() could accept non digits. 13054 [RT #21033] 13055 13056 2874. [bug] Cache lack of EDNS support only after the server 13057 successfully responds to the query using plain DNS. 13058 [RT #20930] 13059 13060 2873. [bug] Canceling a dynamic update via the dns/client module 13061 could trigger an assertion failure. [RT #21133] 13062 13063 2872. [bug] Modify dns/client.c:dns_client_createx() to only 13064 require one of IPv4 or IPv6 rather than both. 13065 [RT #21122] 13066 13067 2871. [bug] Type mismatch in mem_api.c between the definition and 13068 the header file, causing build failure with 13069 --enable-exportlib. [RT #21138] 13070 13071 2870. [maint] Add AAAA address for L.ROOT-SERVERS.NET. 13072 13073 2869. [bug] Fix arguments to dns_keytable_findnextkeynode() call. 13074 [RT #20877] 13075 13076 2868. [cleanup] Run "make clean" at the end of configure to ensure 13077 any changes made by configure are integrated. 13078 Use --with-make-clean=no to disable. [RT #20994] 13079 13080 2867. [bug] Don't set GSS_C_SEQUENCE_FLAG as Windows DNS servers 13081 don't like it. [RT #20986] 13082 13083 2866. [bug] Windows does not like the TSIG name being compressed. 13084 [RT #20986] 13085 13086 2865. [bug] memset to zero event.data. [RT #20986] 13087 13088 2864. [bug] Direct SIG/RRSIG queries were not handled correctly. 13089 [RT #21050] 13090 13091 2863. [port] linux: disable IPv6 PMTUD and use network minimum MTU. 13092 [RT #21056] 13093 13094 2862. [bug] nsupdate didn't default to the parent zone when 13095 updating DS records. [RT #20896] 13096 13097 2861. [doc] dnssec-settime man pages didn't correctly document the 13098 inactivation time. [RT #21039] 13099 13100 2860. [bug] named-checkconf's usage was out of date. [RT #21039] 13101 13102 2859. [bug] When canceling validation it was possible to leak 13103 memory. [RT #20800] 13104 13105 2858. [bug] RTT estimates were not being adjusted on ICMP errors. 13106 [RT #20772] 13107 13108 2857. [bug] named-checkconf did not fail on a bad trusted key. 13109 [RT #20705] 13110 13111 2856. [bug] The size of a memory allocation was not always properly 13112 recorded. [RT #20927] 13113 13114 2855. [func] nsupdate will now preserve the entered case of domain 13115 names in update requests it sends. [RT #20928] 13116 13117 2854. [func] dig: allow the final soa record in a axfr response to 13118 be suppressed, dig +onesoa. [RT #20929] 13119 13120 2853. [bug] add_sigs() could run out of scratch space. [RT #21015] 13121 13122 2852. [bug] Handle broken DNSSEC trust chains better. [RT #15619] 13123 13124 2851. [doc] nslookup.1, removed <informalexample> from the docbook 13125 source as it produced bad nroff. [RT #21007] 13126 13127 2850. [bug] If isc_heap_insert() failed due to memory shortage 13128 the heap would have corrupted entries. [RT #20951] 13129 13130 2849. [bug] Don't treat errors from the xml2 library as fatal. 13131 [RT #20945] 13132 13133 2848. [doc] Moved README.dnssec, README.libdns, README.pkcs11 and 13134 README.rfc5011 into the ARM. [RT #20899] 13135 13136 2847. [cleanup] Corrected usage message in dnssec-settime. [RT #20921] 13137 13138 2846. [bug] EOF on unix domain sockets was not being handled 13139 correctly. [RT #20731] 13140 13141 2845. [bug] RFC 5011 client could crash on shutdown. [RT #20903] 13142 13143 2844. [doc] notify-delay default in ARM was wrong. It should have 13144 been five (5) seconds. 13145 13146 2843. [func] Prevent dnssec-keygen and dnssec-keyfromlabel from 13147 creating key files if there is a chance that the new 13148 key ID will collide with an existing one after 13149 either of the keys has been revoked. (To override 13150 this in the case of dnssec-keyfromlabel, use the -y 13151 option. dnssec-keygen will simply create a 13152 different, non-colliding key, so an override is 13153 not necessary.) [RT #20838] 13154 13155 2842. [func] Added "smartsign" and improved "autosign" and 13156 "dnssec" regression tests. [RT #20865] 13157 13158 2841. [bug] Change 2836 was not complete. [RT #20883] 13159 13160 2840. [bug] Temporary fixed pkcs11-destroy usage check. 13161 [RT #20760] 13162 13163 2839. [bug] A KSK revoked by named could not be deleted. 13164 [RT #20881] 13165 13166 2838. [placeholder] 13167 13168 2837. [port] Prevent Linux spurious warnings about fwrite(). 13169 [RT #20812] 13170 13171 2836. [bug] Keys that were scheduled to become active could 13172 be delayed. [RT #20874] 13173 13174 2835. [bug] Key inactivity dates were inadvertently stored in 13175 the private key file with the outdated tag 13176 "Unpublish" rather than "Inactive". This has been 13177 fixed; however, any existing keys that had Inactive 13178 dates set will now need to have them reset, using 13179 'dnssec-settime -I'. [RT #20868] 13180 13181 2834. [bug] HMAC-SHA* keys that were longer than the algorithm 13182 digest length were used incorrectly, leading to 13183 interoperability problems with other DNS 13184 implementations. This has been corrected. 13185 (Note: If an oversize key is in use, and 13186 compatibility is needed with an older release of 13187 BIND, the new tool "isc-hmac-fixup" can convert 13188 the key secret to a form that will work with all 13189 versions.) [RT #20751] 13190 13191 2833. [cleanup] Fix usage messages in dnssec-keygen and dnssec-settime. 13192 [RT #20851] 13193 13194 2832. [bug] Modify "struct stat" in lib/export/samples/nsprobe.c 13195 to avoid redefinition in some OSs [RT 20831] 13196 13197 2831. [security] Do not attempt to validate or cache 13198 out-of-bailiwick data returned with a secure 13199 answer; it must be re-fetched from its original 13200 source and validated in that context. [RT #20819] 13201 13202 2830. [bug] Changing the OPTOUT setting could take multiple 13203 passes. [RT #20813] 13204 13205 2829. [bug] Fixed potential node inconsistency in rbtdb.c. 13206 [RT #20808] 13207 13208 2828. [security] Cached CNAME or DNAME RR could be returned to clients 13209 without DNSSEC validation. [RT #20737] 13210 13211 2827. [security] Bogus NXDOMAIN could be cached as if valid. [RT #20712] 13212 13213 2826. [bug] NSEC3->NSEC transitions could fail due to a lock not 13214 being released. [RT #20740] 13215 13216 2825. [bug] Changing the setting of OPTOUT in a NSEC3 chain that 13217 was in the process of being created was not properly 13218 recorded in the zone. [RT #20786] 13219 13220 2824. [bug] "rndc sign" was not being run by the correct task. 13221 [RT #20759] 13222 13223 2823. [bug] rbtdb.c:getsigningtime() was missing locks. [RT #20781] 13224 13225 2822. [bug] rbtdb.c:loadnode() could return the wrong result. 13226 [RT #20802] 13227 13228 2821. [doc] Add note that named-checkconf doesn't automatically 13229 read rndc.key and bind.keys [RT #20758] 13230 13231 2820. [func] Handle read access failure of OpenSSL configuration 13232 file more user friendly (PKCS#11 engine patch). 13233 [RT #20668] 13234 13235 2819. [cleanup] Removed unnecessary DNS_POINTER_MAXHOPS define. 13236 [RT #20771] 13237 13238 2818. [cleanup] rndc could return an incorrect error code 13239 when a zone was not found. [RT #20767] 13240 13241 2817. [cleanup] Removed unnecessary isc_task_endexclusive() calls. 13242 [RT #20768] 13243 13244 2816. [bug] previous_closest_nsec() could fail to return 13245 data for NSEC3 nodes [RT #29730] 13246 13247 2815. [bug] Exclusively lock the task when freezing a zone. 13248 [RT #19838] 13249 13250 2814. [func] Provide a definitive error message when a master 13251 zone is not loaded. [RT #20757] 13252 13253 2813. [bug] Better handling of unreadable DNSSEC key files. 13254 [RT #20710] 13255 13256 2812. [bug] Make sure updates can't result in a zone with 13257 NSEC-only keys and NSEC3 records. [RT #20748] 13258 13259 2811. [cleanup] Add "rndc sign" to list of commands in rndc usage 13260 output. [RT #20733] 13261 13262 2810. [doc] Clarified the process of transitioning an NSEC3 zone 13263 to insecure. [RT #20746] 13264 13265 2809. [cleanup] Restored accidentally-deleted text in usage output 13266 in dnssec-settime and dnssec-revoke [RT #20739] 13267 13268 2808. [bug] Remove the attempt to install atomic.h from lib/isc. 13269 atomic.h is correctly installed by the architecture 13270 specific subdirectories. [RT #20722] 13271 13272 2807. [bug] Fixed a possible ASSERT when reconfiguring zone 13273 keys. [RT #20720] 13274 13275 .. code-block:: none 13276 13277 --- 9.7.0rc1 released --- 13278 13279 2806. [bug] "rdnc sign" could delay re-signing the DNSKEY 13280 when it had changed. [RT #20703] 13281 13282 2805. [bug] Fixed namespace problems encountered when building 13283 external programs using non-exported BIND9 libraries 13284 (i.e., built without --enable-exportlib). [RT #20679] 13285 13286 2804. [bug] Send notifies when a zone is signed with "rndc sign" 13287 or as a result of a scheduled key change. [RT #20700] 13288 13289 2803. [port] win32: Install named-journalprint, nsec3hash, arpaname 13290 and genrandom under windows. [RT #20670] 13291 13292 2802. [cleanup] Rename journalprint to named-journalprint. [RT #20670] 13293 13294 2801. [func] Detect and report records that are different according 13295 to DNSSEC but are semantically equal according to plain 13296 DNS. Apply plain DNS comparisons rather than DNSSEC 13297 comparisons when processing UPDATE requests. 13298 dnssec-signzone now removes such semantically duplicate 13299 records prior to signing the RRset. 13300 13301 named-checkzone -r {ignore|warn|fail} (default warn) 13302 named-compilezone -r {ignore|warn|fail} (default warn) 13303 13304 named.conf: check-dup-records {ignore|warn|fail}; 13305 13306 2800. [func] Reject zones which have NS records which refer to 13307 CNAMEs, DNAMEs or don't have address record (class IN 13308 only). Reject UPDATEs which would cause the zone 13309 to fail the above checks if committed. [RT #20678] 13310 13311 2799. [cleanup] Changed the "secure-to-insecure" option to 13312 "dnssec-secure-to-insecure", and "dnskey-ksk-only" 13313 to "dnssec-dnskey-kskonly", for clarity. [RT #20586] 13314 13315 2798. [bug] Addressed bugs in managed-keys initialization 13316 and rollover. [RT #20683] 13317 13318 2797. [bug] Don't decrement the dispatch manager's maxbuffers. 13319 [RT #20613] 13320 13321 2796. [bug] Missing dns_rdataset_disassociate() call in 13322 dns_nsec3_delnsec3sx(). [RT #20681] 13323 13324 2795. [cleanup] Add text to differentiate "update with no effect" 13325 log messages. [RT #18889] 13326 13327 2794. [bug] Install <isc/namespace.h>. [RT #20677] 13328 13329 2793. [func] Add "autosign" and "metadata" tests to the 13330 automatic tests. [RT #19946] 13331 13332 2792. [func] "filter-aaaa-on-v4" can now be set in view 13333 options (if compiled in). [RT #20635] 13334 13335 2791. [bug] The installation of isc-config.sh was broken. 13336 [RT #20667] 13337 13338 2790. [bug] Handle DS queries to stub zones. [RT #20440] 13339 13340 2789. [bug] Fixed an INSIST in dispatch.c [RT #20576] 13341 13342 2788. [bug] dnssec-signzone could sign with keys that were 13343 not requested [RT #20625] 13344 13345 2787. [bug] Spurious log message when zone keys were 13346 dynamically reconfigured. [RT #20659] 13347 13348 2786. [bug] Additional could be promoted to answer. [RT #20663] 13349 13350 .. code-block:: none 13351 13352 --- 9.7.0b3 released --- 13353 13354 2785. [bug] Revoked keys could fail to self-sign [RT #20652] 13355 13356 2784. [bug] TC was not always being set when required glue was 13357 dropped. [RT #20655] 13358 13359 2783. [func] Return minimal responses to EDNS/UDP queries with a UDP 13360 buffer size of 512 or less. [RT #20654] 13361 13362 2782. [port] win32: use getaddrinfo() for hostname lookups. 13363 [RT #20650] 13364 13365 2781. [bug] Inactive keys could be used for signing. [RT #20649] 13366 13367 2780. [bug] dnssec-keygen -A none didn't properly unset the 13368 activation date in all cases. [RT #20648] 13369 13370 2779. [bug] Dynamic key revocation could fail. [RT #20644] 13371 13372 2778. [bug] dnssec-signzone could fail when a key was revoked 13373 without deleting the unrevoked version. [RT #20638] 13374 13375 2777. [contrib] DLZ MYSQL auto reconnect support discovery was wrong. 13376 13377 2776. [bug] Change #2762 was not correct. [RT #20647] 13378 13379 2775. [bug] Accept RSASHA256 and RSASHA512 as NSEC3 compatible 13380 in dnssec-keyfromlabel. [RT #20643] 13381 13382 2774. [bug] Existing cache DB wasn't being reused after 13383 reconfiguration. [RT #20629] 13384 13385 2773. [bug] In autosigned zones, the SOA could be signed 13386 with the KSK. [RT #20628] 13387 13388 2772. [security] When validating, track whether pending data was from 13389 the additional section or not and only return it if 13390 validates as secure. [RT #20438] 13391 13392 2771. [bug] dnssec-signzone: DNSKEY records could be 13393 corrupted when importing from key files [RT #20624] 13394 13395 2770. [cleanup] Add log messages to resolver.c to indicate events 13396 causing FORMERR responses. [RT #20526] 13397 13398 2769. [cleanup] Change #2742 was incomplete. [RT #19589] 13399 13400 2768. [bug] dnssec-signzone: -S no longer implies -g [RT #20568] 13401 13402 2767. [bug] named could crash on startup if a zone was 13403 configured with auto-dnssec and there was no 13404 key-directory. [RT #20615] 13405 13406 2766. [bug] isc_socket_fdwatchpoke() should only update the 13407 socketmgr state if the socket is not pending on a 13408 read or write. [RT #20603] 13409 13410 2765. [bug] Skip masters for which the TSIG key cannot be found. 13411 [RT #20595] 13412 13413 2764. [bug] "rndc-confgen -a" could trigger a REQUIRE. [RT #20610] 13414 13415 2763. [bug] "rndc sign" didn't create an NSEC chain. [RT #20591] 13416 13417 2762. [bug] DLV validation failed with a local slave DLV zone. 13418 [RT #20577] 13419 13420 2761. [cleanup] Enable internal symbol table for backtrace only for 13421 systems that are known to work. Currently, BSD 13422 variants, Linux and Solaris are supported. [RT #20202] 13423 13424 2760. [cleanup] Corrected named-compilezone usage summary. [RT #20533] 13425 13426 2759. [doc] Add information about .jbk/.jnw files to 13427 the ARM. [RT #20303] 13428 13429 2758. [bug] win32: Added a workaround for a windows 2008 bug 13430 that could cause the UDP client handler to shut 13431 down. [RT #19176] 13432 13433 2757. [bug] dig: assertion failure could occur in connect 13434 timeout. [RT #20599] 13435 13436 2756. [bug] Fixed corrupt logfile message in update.c. [RT #20597] 13437 13438 2755. [placeholder] 13439 13440 2754. [bug] Secure-to-insecure transitions failed when zone 13441 was signed with NSEC3. [RT #20587] 13442 13443 2753. [bug] Removed an unnecessary warning that could appear when 13444 building an NSEC chain. [RT #20589] 13445 13446 2752. [bug] Locking violation. [RT #20587] 13447 13448 2751. [bug] Fixed a memory leak in dnssec-keyfromlabel. [RT #20588] 13449 13450 2750. [bug] dig: assertion failure could occur when a server 13451 didn't have an address. [RT #20579] 13452 13453 2749. [bug] ixfr-from-differences generated a non-minimal ixfr 13454 for NSEC3 signed zones. [RT #20452] 13455 13456 2748. [func] Identify bad answers from GTLD servers and treat them 13457 as referrals. [RT #18884] 13458 13459 2747. [bug] Journal roll forwards failed to set the re-signing 13460 time of RRSIGs correctly. [RT #20541] 13461 13462 2746. [port] hpux: address signed/unsigned expansion mismatch of 13463 dns_rbtnode_t.nsec. [RT #20542] 13464 13465 2745. [bug] configure script didn't probe the return type of 13466 gai_strerror(3) correctly. [RT #20573] 13467 13468 2744. [func] Log if a query was over TCP. [RT #19961] 13469 13470 2743. [bug] RRSIG could be incorrectly set in the NSEC3 record 13471 for a insecure delegation. 13472 13473 .. code-block:: none 13474 13475 --- 9.7.0b2 released --- 13476 13477 2742. [cleanup] Clarify some DNSSEC-related log messages in 13478 validator.c. [RT #19589] 13479 13480 2741. [func] Allow the dnssec-keygen progress messages to be 13481 suppressed (dnssec-keygen -q). Automatically 13482 suppress the progress messages when stdin is not 13483 a tty. [RT #20474] 13484 13485 2740. [placeholder] 13486 13487 2739. [cleanup] Clean up API for initializing and clearing trust 13488 anchors for a view. [RT #20211] 13489 13490 2738. [func] Add RSASHA256 and RSASHA512 tests to the dnssec system 13491 test. [RT #20453] 13492 13493 2737. [func] UPDATE requests can leak existence information. 13494 [RT #17261] 13495 13496 2736. [func] Improve the performance of NSEC signed zones with 13497 more than a normal amount of glue below a delegation. 13498 [RT #20191] 13499 13500 2735. [bug] dnssec-signzone could fail to read keys 13501 that were specified on the command line with 13502 full paths, but weren't in the current 13503 directory. [RT #20421] 13504 13505 2734. [port] cygwin: arpaname did not compile. [RT #20473] 13506 13507 2733. [cleanup] Clean up coding style in pkcs11-* tools. [RT #20355] 13508 13509 2732. [func] Add optional filter-aaaa-on-v4 option, available 13510 if built with './configure --enable-filter-aaaa'. 13511 Filters out AAAA answers to clients connecting 13512 via IPv4. (This is NOT recommended for general 13513 use.) [RT #20339] 13514 13515 2731. [func] Additional work on change 2709. The key parser 13516 will now ignore unrecognized fields when the 13517 minor version number of the private key format 13518 has been increased. It will reject any key with 13519 the major version number increased. [RT #20310] 13520 13521 2730. [func] Have dnssec-keygen display a progress indication 13522 a la 'openssl genrsa' on standard error. Note 13523 when the first '.' is followed by a long stop 13524 one has the choice between slow generation vs. 13525 poor random quality, i.e., '-r /dev/urandom'. 13526 [RT #20284] 13527 13528 2729. [func] When constructing a CNAME from a DNAME use the DNAME 13529 TTL. [RT #20451] 13530 13531 2728. [bug] dnssec-keygen, dnssec-keyfromlabel and 13532 dnssec-signzone now warn immediately if asked to 13533 write into a nonexistent directory. [RT #20278] 13534 13535 2727. [func] The 'key-directory' option can now specify a relative 13536 path. [RT #20154] 13537 13538 2726. [func] Added support for SHA-2 DNSSEC algorithms, 13539 RSASHA256 and RSASHA512. [RT #20023] 13540 13541 2725. [doc] Added information about the file "managed-keys.bind" 13542 to the ARM. [RT #20235] 13543 13544 2724. [bug] Updates to a existing node in secure zone using NSEC 13545 were failing. [RT #20448] 13546 13547 2723. [bug] isc_base32_totext(), isc_base32hex_totext(), and 13548 isc_base64_totext(), didn't always mark regions of 13549 memory as fully consumed after conversion. [RT #20445] 13550 13551 2722. [bug] Ensure that the memory associated with the name of 13552 a node in a rbt tree is not altered during the life 13553 of the node. [RT #20431] 13554 13555 2721. [port] Have dst__entropy_status() prime the random number 13556 generator. [RT #20369] 13557 13558 2720. [bug] RFC 5011 trust anchor updates could trigger an 13559 assert if the DNSKEY record was unsigned. [RT #20406] 13560 13561 2719. [func] Skip trusted/managed keys for unsupported algorithms. 13562 [RT #20392] 13563 13564 2718. [bug] The space calculations in opensslrsa_todns() were 13565 incorrect. [RT #20394] 13566 13567 2717. [bug] named failed to update the NSEC/NSEC3 record when 13568 the last private type record was removed as a result 13569 of completing the signing the zone with a key. 13570 [RT #20399] 13571 13572 2716. [bug] nslookup debug mode didn't return the ttl. [RT #20414] 13573 13574 .. code-block:: none 13575 13576 --- 9.7.0b1 released --- 13577 13578 2715. [bug] Require OpenSSL support to be explicitly disabled. 13579 [RT #20288] 13580 13581 2714. [port] aix/powerpc: 'asm("ics");' needs non standard assembler 13582 flags. 13583 13584 2713. [bug] powerpc: atomic operations missing asm("ics") / 13585 __isync() calls. 13586 13587 2712. [func] New 'auto-dnssec' zone option allows zone signing 13588 to be fully automated in zones configured for 13589 dynamic DNS. 'auto-dnssec allow;' permits a zone 13590 to be signed by creating keys for it in the 13591 key-directory and using 'rndc sign <zone>'. 13592 'auto-dnssec maintain;' allows that too, plus it 13593 also keeps the zone's DNSSEC keys up to date 13594 according to their timing metadata. [RT #19943] 13595 13596 2711. [port] win32: Add the bin/pkcs11 tools into the full 13597 build. [RT #20372] 13598 13599 2710. [func] New 'dnssec-signzone -x' flag and 'dnskey-ksk-only' 13600 zone option cause a zone to be signed with only KSKs 13601 signing the DNSKEY RRset, not ZSKs. This reduces 13602 the size of a DNSKEY answer. [RT #20340] 13603 13604 2709. [func] Added some data fields, currently unused, to the 13605 private key file format, to allow implementation 13606 of explicit key rollover in a future release 13607 without impairing backward or forward compatibility. 13608 [RT #20310] 13609 13610 2708. [func] Insecure to secure and NSEC3 parameter changes via 13611 update are now fully supported and no longer require 13612 defines to enable. We now no longer overload the 13613 NSEC3PARAM flag field, nor the NSEC OPT bit at the 13614 apex. Secure to insecure changes are controlled by 13615 by the named.conf option 'secure-to-insecure'. 13616 13617 Warning: If you had previously enabled support by 13618 adding defines at compile time to BIND 9.6 you should 13619 ensure that all changes that are in progress have 13620 completed prior to upgrading to BIND 9.7. BIND 9.7 13621 is not backwards compatible. 13622 13623 2707. [func] dnssec-keyfromlabel no longer require engine name 13624 to be specified in the label if there is a default 13625 engine or the -E option has been used. Also, it 13626 now uses default algorithms as dnssec-keygen does 13627 (i.e., RSASHA1, or NSEC3RSASHA1 if -3 is used). 13628 [RT #20371] 13629 13630 2706. [bug] Loading a zone with a very large NSEC3 salt could 13631 trigger an assert. [RT #20368] 13632 13633 2705. [placeholder] 13634 13635 2704. [bug] Serial of dynamic and stub zones could be inconsistent 13636 with their SOA serial. [RT #19387] 13637 13638 2703. [func] Introduce an OpenSSL "engine" argument with -E 13639 for all binaries which can take benefit of 13640 crypto hardware. [RT #20230] 13641 13642 2702. [func] Update PKCS#11 tools (bin/pkcs11) [RT #20225 & all] 13643 13644 2701. [doc] Correction to ARM: hmac-md5 is no longer the only 13645 supported TSIG key algorithm. [RT #18046] 13646 13647 2700. [doc] The match-mapped-addresses option is discouraged. 13648 [RT #12252] 13649 13650 2699. [bug] Missing lock in rbtdb.c. [RT #20037] 13651 13652 2698. [placeholder] 13653 13654 2697. [port] win32: ensure that S_IFMT, S_IFDIR, S_IFCHR and 13655 S_IFREG are defined after including <isc/stat.h>. 13656 [RT #20309] 13657 13658 2696. [bug] named failed to successfully process some valid 13659 acl constructs. [RT #20308] 13660 13661 2695. [func] DHCP/DDNS - update fdwatch code for use by 13662 DHCP. Modify the api to isc_sockfdwatch_t (the 13663 callback function for isc_socket_fdwatchcreate) 13664 to include information about the direction (read 13665 or write) and add isc_socket_fdwatchpoke. 13666 [RT #20253] 13667 13668 2694. [bug] Reduce default NSEC3 iterations from 100 to 10. 13669 [RT #19970] 13670 13671 2693. [port] Add some noreturn attributes. [RT #20257] 13672 13673 2692. [port] win32: 32/64 bit cleanups. [RT #20335] 13674 13675 2691. [func] dnssec-signzone: retain the existing NSEC or NSEC3 13676 chain when re-signing a previously-signed zone. 13677 Use -u to modify NSEC3 parameters or switch 13678 between NSEC and NSEC3. [RT #20304] 13679 13680 2690. [bug] win32: fix isc_thread_key_getspecific() prototype. 13681 [RT #20315] 13682 13683 2689. [bug] Correctly handle snprintf result. [RT #20306] 13684 13685 2688. [bug] Use INTERFACE_F_POINTTOPOINT, not IFF_POINTOPOINT, 13686 to decide to fetch the destination address. [RT #20305] 13687 13688 2687. [bug] Fixed dnssec-signzone -S handling of revoked keys. 13689 Also, added warnings when revoking a ZSK, as this is 13690 not defined by protocol (but is legal). [RT #19943] 13691 13692 2686. [bug] dnssec-signzone should clean the old NSEC chain when 13693 signing with NSEC3 and vice versa. [RT #20301] 13694 13695 2685. [contrib] Update contrib/zkt to version 0.99c. [RT #20054] 13696 13697 2684. [cleanup] dig: formalize +ad and +cd as synonyms for 13698 +adflag and +cdflag. [RT #19305] 13699 13700 2683. [bug] dnssec-signzone should clean out old NSEC3 chains when 13701 the NSEC3 parameters used to sign the zone change. 13702 [RT #20246] 13703 13704 2682. [bug] "configure --enable-symtable=all" failed to 13705 build. [RT #20282] 13706 13707 2681. [bug] IPSECKEY RR of gateway type 3 was not correctly 13708 decoded. [RT #20269] 13709 13710 2680. [func] Move contrib/pkcs11-keygen to bin/pkcs11. [RT #20067] 13711 13712 2679. [func] dig -k can now accept TSIG keys in named.conf 13713 format. [RT #20031] 13714 13715 2678. [func] Treat DS queries as if "minimal-response yes;" 13716 was set. [RT #20258] 13717 13718 2677. [func] Changes to key metadata behavior: 13719 - Keys without "publish" or "active" dates set will 13720 no longer be used for smart signing. However, 13721 those dates will be set to "now" by default when 13722 a key is created; to generate a key but not use 13723 it yet, use dnssec-keygen -G. 13724 - New "inactive" date (dnssec-keygen/settime -I) 13725 sets the time when a key is no longer used for 13726 signing but is still published. 13727 - The "unpublished" date (-U) is deprecated in 13728 favor of "deleted" (-D). 13729 [RT #20247] 13730 13731 2676. [bug] --with-export-installdir should have been 13732 --with-export-includedir. [RT #20252] 13733 13734 2675. [bug] dnssec-signzone could crash if the key directory 13735 did not exist. [RT #20232] 13736 13737 .. code-block:: none 13738 13739 --- 9.7.0a3 released --- 13740 13741 2674. [bug] "dnssec-lookaside auto;" crashed if named was built 13742 without openssl. [RT #20231] 13743 13744 2673. [bug] The managed-keys.bind zone file could fail to 13745 load due to a spurious result from sync_keyzone() 13746 [RT #20045] 13747 13748 2672. [bug] Don't enable searching in 'host' when doing reverse 13749 lookups. [RT #20218] 13750 13751 2671. [bug] Add support for PKCS#11 providers not returning 13752 the public exponent in RSA private keys 13753 (OpenCryptoki for instance) in 13754 dnssec-keyfromlabel. [RT #19294] 13755 13756 2670. [bug] Unexpected connect failures failed to log enough 13757 information to be useful. [RT #20205] 13758 13759 2669. [func] Update PKCS#11 support to support Keyper HSM. 13760 Update PKCS#11 patch to be against openssl-0.9.8i. 13761 13762 2668. [func] Several improvements to dnssec-* tools, including: 13763 - dnssec-keygen and dnssec-settime can now set key 13764 metadata fields 0 (to unset a value, use "none") 13765 - dnssec-revoke sets the revocation date in 13766 addition to the revoke bit 13767 - dnssec-settime can now print individual metadata 13768 fields instead of always printing all of them, 13769 and can print them in unix epoch time format for 13770 use by scripts 13771 [RT #19942] 13772 13773 2667. [func] Add support for logging stack backtrace on assertion 13774 failure (not available for all platforms). [RT #19780] 13775 13776 2666. [func] Added an 'options' argument to dns_name_fromstring() 13777 (API change from 9.7.0a2). [RT #20196] 13778 13779 2665. [func] Clarify syntax for managed-keys {} statement, add 13780 ARM documentation about RFC 5011 support. [RT #19874] 13781 13782 2664. [bug] create_keydata() and minimal_update() in zone.c 13783 didn't properly check return values for some 13784 functions. [RT #19956] 13785 13786 2663. [func] win32: allow named to run as a service using 13787 "NT AUTHORITY\LocalService" as the account. [RT #19977] 13788 13789 2662. [bug] lwres_getipnodebyname() and lwres_getipnodebyaddr() 13790 returned a misleading error code when lwresd was 13791 down. [RT #20028] 13792 13793 2661. [bug] Check whether socket fd exceeds FD_SETSIZE when 13794 creating lwres context. [RT #20029] 13795 13796 2660. [func] Add a new set of DNS libraries for non-BIND9 13797 applications. See README.libdns. [RT #19369] 13798 13799 2659. [doc] Clarify dnssec-keygen doc: key name must match zone 13800 name for DNSSEC keys. [RT #19938] 13801 13802 2658. [bug] dnssec-settime and dnssec-revoke didn't process 13803 key file paths correctly. [RT #20078] 13804 13805 2657. [cleanup] Lower "journal file <path> does not exist, creating it" 13806 log level to debug 1. [RT #20058] 13807 13808 2656. [func] win32: add a "tools only" check box to the installer 13809 which causes it to only install dig, host, nslookup, 13810 nsupdate and relevant DLLs. [RT #19998] 13811 13812 2655. [doc] Document that key-directory does not affect 13813 bind.keys, rndc.key or session.key. [RT #20155] 13814 13815 2654. [bug] Improve error reporting on duplicated names for 13816 deny-answer-xxx. [RT #20164] 13817 13818 2653. [bug] Treat ENGINE_load_private_key() failures as key 13819 not found rather than out of memory. [RT #18033] 13820 13821 2652. [func] Provide more detail about what record is being 13822 deleted. [RT #20061] 13823 13824 2651. [bug] Dates could print incorrectly in K*.key files on 13825 64-bit systems. [RT #20076] 13826 13827 2650. [bug] Assertion failure in dnssec-signzone when trying 13828 to read keyset-* files. [RT #20075] 13829 13830 2649. [bug] Set the domain for forward only zones. [RT #19944] 13831 13832 2648. [port] win32: isc_time_seconds() was broken. [RT #19900] 13833 13834 2647. [bug] Remove unnecessary SOA updates when a new KSK is 13835 added. [RT #19913] 13836 13837 2646. [bug] Incorrect cleanup on error in socket.c. [RT #19987] 13838 13839 2645. [port] "gcc -m32" didn't work on amd64 and x86_64 platforms 13840 which default to 64 bits. [RT #19927] 13841 13842 .. code-block:: none 13843 13844 --- 9.7.0a2 released --- 13845 13846 2644. [bug] Change #2628 caused a regression on some systems; 13847 named was unable to write the PID file and would 13848 fail on startup. [RT #20001] 13849 13850 2643. [bug] Stub zones interacted badly with NSEC3 support. 13851 [RT #19777] 13852 13853 2642. [bug] nsupdate could dump core on solaris when reading 13854 improperly formatted key files. [RT #20015] 13855 13856 2641. [bug] Fixed an error in parsing update-policy syntax, 13857 added a regression test to check it. [RT #20007] 13858 13859 2640. [security] A specially crafted update packet will cause named 13860 to exit. [RT #20000] 13861 13862 2639. [bug] Silence compiler warnings in gssapi code. [RT #19954] 13863 13864 2638. [bug] Install arpaname. [RT #19957] 13865 13866 2637. [func] Rationalize dnssec-signzone's signwithkey() calling. 13867 [RT #19959] 13868 13869 2636. [func] Simplify zone signing and key maintenance with the 13870 dnssec-* tools. Major changes: 13871 - all dnssec-* tools now take a -K option to 13872 specify a directory in which key files will be 13873 stored 13874 - DNSSEC can now store metadata indicating when 13875 they are scheduled to be published, activated, 13876 revoked or removed; these values can be set by 13877 dnssec-keygen or overwritten by the new 13878 dnssec-settime command 13879 - dnssec-signzone -S (for "smart") option reads key 13880 metadata and uses it to determine automatically 13881 which keys to publish to the zone, use for 13882 signing, revoke, or remove from the zone 13883 [RT #19816] 13884 13885 2635. [bug] isc_inet_ntop() incorrectly handled 0.0/16 addresses. 13886 [RT #19716] 13887 13888 2634. [port] win32: Add support for libxml2, enable 13889 statschannel. [RT #19773] 13890 13891 2633. [bug] Handle 15 bit rand() functions. [RT #19783] 13892 13893 2632. [func] util/kit.sh: warn if documentation appears to be out of 13894 date. [RT #19922] 13895 13896 2631. [bug] Handle "//", "/./" and "/../" in mkdirpath(). 13897 [RT #19926 ] 13898 13899 2630. [func] Improved syntax for DDNS autoconfiguration: use 13900 "update-policy local;" to switch on local DDNS in a 13901 zone. (The "ddns-autoconf" option has been removed.) 13902 [RT #19875] 13903 13904 2629. [port] Check for seteuid()/setegid(), use setresuid()/ 13905 setresgid() if not present. [RT #19932] 13906 13907 2628. [port] linux: Allow /var/run/named/named.pid to be opened 13908 at startup with reduced capabilities in operation. 13909 [RT #19884] 13910 13911 2627. [bug] Named aborted if the same key was included in 13912 trusted-keys more than once. [RT #19918] 13913 13914 2626. [bug] Multiple trusted-keys could trigger an assertion 13915 failure. [RT #19914] 13916 13917 2625. [bug] Missing UNLOCK in rbtdb.c. [RT #19865] 13918 13919 2624. [func] 'named-checkconf -p' will print out the parsed 13920 configuration. [RT #18871] 13921 13922 2623. [bug] Named started searches for DS non-optimally. [RT #19915] 13923 13924 2622. [bug] Printing of named.conf grammar was broken. [RT #19919] 13925 13926 2621. [doc] Made copyright boilerplate consistent. [RT #19833] 13927 13928 2620. [bug] Delay thawing the zone until the reload of it has 13929 completed successfully. [RT #19750] 13930 13931 2619. [func] Add support for RFC 5011, automatic trust anchor 13932 maintenance. The new "managed-keys" statement can 13933 be used in place of "trusted-keys" for zones which 13934 support this protocol. (Note: this syntax is 13935 expected to change prior to 9.7.0 final.) [RT #19248] 13936 13937 2618. [bug] The sdb and sdlz db_interator_seek() methods could 13938 loop infinitely. [RT #19847] 13939 13940 2617. [bug] ifconfig.sh failed to emit an error message when 13941 run from the wrong location. [RT #19375] 13942 13943 2616. [bug] 'host' used the nameservers from resolv.conf even 13944 when a explicit nameserver was specified. [RT #19852] 13945 13946 2615. [bug] "__attribute__((unused))" was in the wrong place 13947 for ia64 gcc builds. [RT #19854] 13948 13949 2614. [port] win32: 'named -v' should automatically be executed 13950 in the foreground. [RT #19844] 13951 13952 2613. [placeholder] 13953 13954 .. code-block:: none 13955 13956 --- 9.7.0a1 released --- 13957 13958 2612. [func] Add default values for the arguments to 13959 dnssec-keygen. Without arguments, it will now 13960 generate a 1024-bit RSASHA1 zone-signing key, 13961 or with the -f KSK option, a 2048-bit RSASHA1 13962 key-signing key. [RT #19300] 13963 13964 2611. [func] Add -l option to dnssec-dsfromkey to generate 13965 DLV records instead of DS records. [RT #19300] 13966 13967 2610. [port] sunos: Change #2363 was not complete. [RT #19796] 13968 13969 2609. [func] Simplify the configuration of dynamic zones: 13970 - add ddns-confgen command to generate 13971 configuration text for named.conf 13972 - add zone option "ddns-autoconf yes;", which 13973 causes named to generate a TSIG session key 13974 and allow updates to the zone using that key 13975 - add '-l' (localhost) option to nsupdate, which 13976 causes nsupdate to connect to a locally-running 13977 named process using the session key generated 13978 by named 13979 [RT #19284] 13980 13981 2608. [func] Perform post signing verification checks in 13982 dnssec-signzone. These can be disabled with -P. 13983 13984 The post sign verification test ensures that for each 13985 algorithm in use there is at least one non revoked 13986 self signed KSK key. That all revoked KSK keys are 13987 self signed. That all records in the zone are signed 13988 by the algorithm. [RT #19653] 13989 13990 2607. [bug] named could incorrectly delete NSEC3 records for 13991 empty nodes when processing a update request. 13992 [RT #19749] 13993 13994 2606. [bug] "delegation-only" was not being accepted in 13995 delegation-only type zones. [RT #19717] 13996 13997 2605. [bug] Accept DS responses from delegation only zones. 13998 [RT # 19296] 13999 14000 2604. [func] Add support for DNS rebinding attack prevention through 14001 new options, deny-answer-addresses and 14002 deny-answer-aliases. Based on contributed code from 14003 JD Nurmi, Google. [RT #18192] 14004 14005 2603. [port] win32: handle .exe extension of named-checkzone and 14006 named-comilezone argv[0] names under windows. 14007 [RT #19767] 14008 14009 2602. [port] win32: fix debugging command line build of libisccfg. 14010 [RT #19767] 14011 14012 2601. [doc] Mention file creation mode mask in the 14013 named manual page. 14014 14015 2600. [doc] ARM: miscellaneous reformatting for different 14016 page widths. [RT #19574] 14017 14018 2599. [bug] Address rapid memory growth when validation fails. 14019 [RT #19654] 14020 14021 2598. [func] Reserve the -F flag. [RT #19657] 14022 14023 2597. [bug] Handle a validation failure with a insecure delegation 14024 from a NSEC3 signed master/slave zone. [RT #19464] 14025 14026 2596. [bug] Stale tree nodes of cache/dynamic rbtdb could stay 14027 long, leading to inefficient memory usage or rejecting 14028 newer cache entries in the worst case. [RT #19563] 14029 14030 2595. [bug] Fix unknown extended rcodes in dig. [RT #19625] 14031 14032 2594. [func] Have rndc warn if using its default configuration 14033 file when the key file also exists. [RT #19424] 14034 14035 2593. [bug] Improve a corner source of SERVFAILs [RT #19632] 14036 14037 2592. [bug] Treat "any" as a type in nsupdate. [RT #19455] 14038 14039 2591. [bug] named could die when processing a update in 14040 removed_orphaned_ds(). [RT #19507] 14041 14042 2590. [func] Report zone/class of "update with no effect". 14043 [RT #19542] 14044 14045 2589. [bug] dns_db_unregister() failed to clear '*dbimp'. 14046 [RT #19626] 14047 14048 2588. [bug] SO_REUSEADDR could be set unconditionally after failure 14049 of bind(2) call. This should be rare and mostly 14050 harmless, but may cause interference with other 14051 processes that happen to use the same port. [RT #19642] 14052 14053 2587. [func] Improve logging by reporting serial numbers for 14054 when zone serial has gone backwards or unchanged. 14055 [RT #19506] 14056 14057 2586. [bug] Missing cleanup of SIG rdataset in searching a DLZ DB 14058 or SDB. [RT #19577] 14059 14060 2585. [bug] Uninitialized socket name could be referenced via a 14061 statistics channel, triggering an assertion failure in 14062 XML rendering. [RT #19427] 14063 14064 2584. [bug] alpha: gcc optimization could break atomic operations. 14065 [RT #19227] 14066 14067 2583. [port] netbsd: provide a control to not add the compile 14068 date to the version string, -DNO_VERSION_DATE. 14069 14070 2582. [bug] Don't emit warning log message when we attempt to 14071 remove non-existent journal. [RT #19516] 14072 14073 2581. [contrib] dlz/mysql set MYSQL_OPT_RECONNECT option on connection. 14074 Requires MySQL 5.0.19 or later. [RT #19084] 14075 14076 2580. [bug] UpdateRej statistics counter could be incremented twice 14077 for one rejection. [RT #19476] 14078 14079 2579. [bug] DNSSEC lookaside validation failed to handle unknown 14080 algorithms. [RT #19479] 14081 14082 2578. [bug] Changed default sig-signing-type to 65534, because 14083 65535 turns out to be reserved. [RT #19477] 14084 14085 2577. [doc] Clarified some statistics counters. [RT #19454] 14086 14087 2576. [bug] NSEC record were not being correctly signed when 14088 a zone transitions from insecure to secure. 14089 Handle such incorrectly signed zones. [RT #19114] 14090 14091 2575. [func] New functions dns_name_fromstring() and 14092 dns_name_tostring(), to simplify conversion 14093 of a string to a dns_name structure and vice 14094 versa. [RT #19451] 14095 14096 2574. [doc] Document nsupdate -g and -o. [RT #19351] 14097 14098 2573. [bug] Replacing a non-CNAME record with a CNAME record in a 14099 single transaction in a signed zone failed. [RT #19397] 14100 14101 2572. [func] Simplify DLV configuration, with a new option 14102 "dnssec-lookaside auto;" This is the equivalent 14103 of "dnssec-lookaside . trust-anchor dlv.isc.org;" 14104 plus setting a trusted-key for dlv.isc.org. 14105 14106 Note: The trusted key is hard-coded into named, 14107 but is also stored in (and can be overridden 14108 by) $sysconfdir/bind.keys. As the ISC DLV key 14109 rolls over it can be kept up to date by replacing 14110 the bind.keys file with a key downloaded from 14111 https://www.isc.org/solutions/dlv. [RT #18685] 14112 14113 2571. [func] Add a new tool "arpaname" which translates IP addresses 14114 to the corresponding IN-ADDR.ARPA or IP6.ARPA name. 14115 [RT #18976] 14116 14117 2570. [func] Log the destination address the query was sent to. 14118 [RT #19209] 14119 14120 2569. [func] Move journalprint, nsec3hash, and genrandom 14121 commands from bin/tests into bin/tools; 14122 "make install" will put them in $sbindir. [RT #19301] 14123 14124 2568. [bug] Report when the write to indicate a otherwise 14125 successful start fails. [RT #19360] 14126 14127 2567. [bug] dst__privstruct_writefile() could miss write errors. 14128 write_public_key() could miss write errors. 14129 dnssec-dsfromkey could miss write errors. 14130 [RT #19360] 14131 14132 2566. [cleanup] Clarify logged message when an insecure DNSSEC 14133 response arrives from a zone thought to be secure: 14134 "insecurity proof failed" instead of "not 14135 insecure". [RT #19400] 14136 14137 2565. [func] Add support for HIP record. Includes new functions 14138 dns_rdata_hip_first(), dns_rdata_hip_next() 14139 and dns_rdata_hip_current(). [RT #19384] 14140 14141 2564. [bug] Only take EDNS fallback steps when processing timeouts. 14142 [RT #19405] 14143 14144 2563. [bug] Dig could leak a socket causing it to wait forever 14145 to exit. [RT #19359] 14146 14147 2562. [doc] ARM: miscellaneous improvements, reorganization, 14148 and some new content. 14149 14150 2561. [doc] Add isc-config.sh(1) man page. [RT #16378] 14151 14152 2560. [bug] Add #include <config.h> to iptable.c. [RT #18258] 14153 14154 2559. [bug] dnssec-dsfromkey could compute bad DS records when 14155 reading from a K* files. [RT #19357] 14156 14157 2558. [func] Set the ownership of missing directories created 14158 for pid-file if -u has been specified on the command 14159 line. [RT #19328] 14160 14161 2557. [cleanup] PCI compliance: 14162 * new libisc log module file 14163 * isc_dir_chroot() now also changes the working 14164 directory to "/". 14165 * additional INSISTs 14166 * additional logging when files can't be removed. 14167 14168 2556. [port] Solaris: mkdir(2) on tmpfs filesystems does not do the 14169 error checks in the correct order resulting in the 14170 wrong error code sometimes being returned. [RT #19249] 14171 14172 2555. [func] dig: when emitting a hex dump also display the 14173 corresponding characters. [RT #19258] 14174 14175 2554. [bug] Validation of uppercase queries from NSEC3 zones could 14176 fail. [RT #19297] 14177 14178 2553. [bug] Reference leak on DNSSEC validation errors. [RT #19291] 14179 14180 2552. [bug] zero-no-soa-ttl-cache was not being honored. 14181 [RT #19340] 14182 14183 2551. [bug] Potential Reference leak on return. [RT #19341] 14184 14185 2550. [bug] Check --with-openssl=<path> finds <openssl/opensslv.h>. 14186 [RT #19343] 14187 14188 2549. [port] linux: define NR_OPEN if not currently defined. 14189 [RT #19344] 14190 14191 2548. [bug] Install iterated_hash.h. [RT #19335] 14192 14193 2547. [bug] openssl_link.c:mem_realloc() could reference an 14194 out-of-range area of the source buffer. New public 14195 function isc_mem_reallocate() was introduced to address 14196 this bug. [RT #19313] 14197 14198 2546. [func] Add --enable-openssl-hash configure flag to use 14199 OpenSSL (in place of internal routine) for hash 14200 functions (MD5, SHA[12] and HMAC). [RT #18815] 14201 14202 2545. [doc] ARM: Legal hostname checking (check-names) is 14203 for SRV RDATA too. [RT #19304] 14204 14205 2544. [cleanup] Removed unused structure members in adb.c. [RT #19225] 14206 14207 2543. [contrib] Update contrib/zkt to version 0.98. [RT #19113] 14208 14209 2542. [doc] Update the description of dig +adflag. [RT #19290] 14210 14211 2541. [bug] Conditionally update dispatch manager statistics. 14212 [RT #19247] 14213 14214 2540. [func] Add a nibble mode to $GENERATE. [RT #18872] 14215 14216 2539. [security] Update the interaction between recursion, allow-query, 14217 allow-query-cache and allow-recursion. [RT #19198] 14218 14219 2538. [bug] cache/ADB memory could grow over max-cache-size, 14220 especially with threads and smaller max-cache-size 14221 values. [RT #19240] 14222 14223 2537. [func] Added more statistics counters including those on socket 14224 I/O events and query RTT histograms. [RT #18802] 14225 14226 2536. [cleanup] Silence some warnings when -Werror=format-security is 14227 specified. [RT #19083] 14228 14229 2535. [bug] dig +showsearch and +trace interacted badly. [RT #19091] 14230 14231 2534. [func] Check NAPTR records regular expressions and 14232 replacement strings to ensure they are syntactically 14233 valid and consistent. [RT #18168] 14234 14235 2533. [doc] ARM: document @ (at-sign). [RT #17144] 14236 14237 2532. [bug] dig: check the question section of the response to 14238 see if it matches the asked question. [RT #18495] 14239 14240 2531. [bug] Change #2207 was incomplete. [RT #19098] 14241 14242 2530. [bug] named failed to reject insecure to secure transitions 14243 via UPDATE. [RT #19101] 14244 14245 2529. [cleanup] Upgrade libtool to silence complaints from recent 14246 version of autoconf. [RT #18657] 14247 14248 2528. [cleanup] Silence spurious configure warning about 14249 --datarootdir [RT #19096] 14250 14251 2527. [placeholder] 14252 14253 2526. [func] New named option "attach-cache" that allows multiple 14254 views to share a single cache to save memory and 14255 improve lookup efficiency. Based on contributed code 14256 from Barclay Osborn, Google. [RT #18905] 14257 14258 2525. [func] New logging category "query-errors" to provide detailed 14259 internal information about query failures, especially 14260 about server failures. [RT #19027] 14261 14262 2524. [port] sunos: dnssec-signzone needs strtoul(). [RT #19129] 14263 14264 2523. [bug] Random type rdata freed by dns_nsec_typepresent(). 14265 [RT #19112] 14266 14267 2522. [security] Handle -1 from DSA_do_verify() and EVP_VerifyFinal(). 14268 14269 2521. [bug] Improve epoll cross compilation support. [RT #19047] 14270 14271 2520. [bug] Update xml statistics version number to 2.0 as change 14272 #2388 made the schema incompatible to the previous 14273 version. [RT #19080] 14274 14275 2519. [bug] dig/host with -4 or -6 didn't work if more than two 14276 nameserver addresses of the excluded address family 14277 preceded in resolv.conf. [RT #19081] 14278 14279 2518. [func] Add support for the new CERT types from RFC 4398. 14280 [RT #19077] 14281 14282 2517. [bug] dig +trace with -4 or -6 failed when it chose a 14283 nameserver address of the excluded address type. 14284 [RT #18843] 14285 14286 2516. [bug] glue sort for responses was performed even when not 14287 needed. [RT #19039] 14288 14289 2515. [port] win32: build dnssec-dsfromkey and dnssec-keyfromlabel. 14290 [RT #19063] 14291 14292 2514. [bug] dig/host failed with -4 or -6 when resolv.conf contains 14293 a nameserver of the excluded address family. 14294 [RT #18848] 14295 14296 2513. [bug] Fix windows cli build. [RT #19062] 14297 14298 2512. [func] Print a summary of the cached records which make up 14299 the negative response. [RT #18885] 14300 14301 2511. [cleanup] dns_rdata_tofmttext() add const to linebreak. 14302 [RT #18885] 14303 14304 2510. [bug] "dig +sigchase" could trigger REQUIRE failures. 14305 [RT #19033] 14306 14307 2509. [bug] Specifying a fixed query source port was broken. 14308 [RT #19051] 14309 14310 2508. [placeholder] 14311 14312 2507. [func] Log the recursion quota values when killing the 14313 oldest query or refusing to recurse due to quota. 14314 [RT #19022] 14315 14316 2506. [port] solaris: Check at configure time if 14317 hack_shutup_pthreadonceinit is needed. [RT #19037] 14318 14319 2505. [port] Treat amd64 similarly to x86_64 when determining 14320 atomic operation support. [RT #19031] 14321 14322 2504. [bug] Address race condition in the socket code. [RT #18899] 14323 14324 2503. [port] linux: improve compatibility with Linux Standard 14325 Base. [RT #18793] 14326 14327 2502. [cleanup] isc_radix: Improve compliance with coding style, 14328 document function in <isc/radix.h>. [RT #18534] 14329 14330 2501. [func] $GENERATE now supports all rdata types. Multi-field 14331 rdata types need to be quoted. See the ARM for 14332 details. [RT #18368] 14333 14334 2500. [contrib] contrib/sdb/pgsql/zonetodb.c called non-existent 14335 function. [RT #18582] 14336 14337 2499. [port] solaris: lib/lwres/getaddrinfo.c namespace clash. 14338 [RT #18837] 14339 14340 .. code-block:: none 14341 14342 --- 9.6.0rc1 released --- 14343 14344 2498. [bug] Removed a bogus function argument used with 14345 ISC_SOCKET_USE_POLLWATCH: it could cause compiler 14346 warning or crash named with the debug 1 level 14347 of logging. [RT #18917] 14348 14349 2497. [bug] Don't add RRSIG bit to NSEC3 bit map for insecure 14350 delegation. 14351 14352 2496. [bug] Add sanity length checks to NSID option. [RT #18813] 14353 14354 2495. [bug] Tighten RRSIG checks. [RT #18795] 14355 14356 2494. [bug] isc/radix.h, dns/sdlz.h and dns/dlz.h were not being 14357 installed. [RT #18826] 14358 14359 2493. [bug] The linux capabilities code was not correctly cleaning 14360 up after itself. [RT #18767] 14361 14362 2492. [func] Rndc status now reports the number of cpus discovered 14363 and the number of worker threads when running 14364 multi-threaded. [RT #18273] 14365 14366 2491. [func] Attempt to re-use a local port if we are already using 14367 the port. [RT #18548] 14368 14369 2490. [port] aix: work around a kernel bug where IPV6_RECVPKTINFO 14370 is cleared when IPV6_V6ONLY is set. [RT #18785] 14371 14372 2489. [port] solaris: Workaround Solaris's kernel bug about 14373 /dev/poll: 14374 http://bugs.opensolaris.org/view_bug.do?bug_id=6724237 14375 Define ISC_SOCKET_USE_POLLWATCH at build time to enable 14376 this workaround. [RT #18870] 14377 14378 2488. [func] Added a tool, dnssec-dsfromkey, to generate DS records 14379 from keyset and .key files. [RT #18694] 14380 14381 2487. [bug] Give TCP connections longer to complete. [RT #18675] 14382 14383 2486. [func] The default locations for named.pid and lwresd.pid 14384 are now /var/run/named/named.pid and 14385 /var/run/lwresd/lwresd.pid respectively. 14386 14387 This allows the owner of the containing directory 14388 to be set, for "named -u" support, and allows there 14389 to be a permanent symbolic link in the path, for 14390 "named -t" support. [RT #18306] 14391 14392 2485. [bug] Change update's the handling of obscured RRSIG 14393 records. Not all orphaned DS records were being 14394 removed. [RT #18828] 14395 14396 2484. [bug] It was possible to trigger a REQUIRE failure when 14397 adding NSEC3 proofs to the response in 14398 query_addwildcardproof(). [RT #18828] 14399 14400 2483. [port] win32: chroot() is not supported. [RT #18805] 14401 14402 2482. [port] libxml2: support versions 2.7.* in addition 14403 to 2.6.*. [RT #18806] 14404 14405 .. code-block:: none 14406 14407 --- 9.6.0b1 released --- 14408 14409 2481. [bug] rbtdb.c:matchparams() failed to handle NSEC3 chain 14410 collisions. [RT #18812] 14411 14412 2480. [bug] named could fail to emit all the required NSEC3 14413 records. [RT #18812] 14414 14415 2479. [bug] xfrout:covers was not properly initialized. [RT #18801] 14416 14417 2478. [bug] 'addresses' could be used uninitialized in 14418 configure_forward(). [RT #18800] 14419 14420 2477. [bug] dig: the global option to print the command line is 14421 +cmd not print_cmd. Update the output to reflect 14422 this. [RT #17008] 14423 14424 2476. [doc] ARM: improve documentation for max-journal-size and 14425 ixfr-from-differences. [RT #15909] [RT #18541] 14426 14427 2475. [bug] LRU cache cleanup under overmem condition could purge 14428 particular entries more aggressively. [RT #17628] 14429 14430 2474. [bug] ACL structures could be allocated with insufficient 14431 space, causing an array overrun. [RT #18765] 14432 14433 2473. [port] linux: raise the limit on open files to the possible 14434 maximum value before spawning threads; 'files' 14435 specified in named.conf doesn't seem to work with 14436 threads as expected. [RT #18784] 14437 14438 2472. [port] linux: check the number of available cpu's before 14439 calling chroot as it depends on "/proc". [RT #16923] 14440 14441 2471. [bug] named-checkzone was not reporting missing mandatory 14442 glue when sibling checks were disabled. [RT #18768] 14443 14444 2470. [bug] Elements of the isc_radix_node_t could be incorrectly 14445 overwritten. [RT #18719] 14446 14447 2469. [port] solaris: Work around Solaris's select() limitations. 14448 [RT #18769] 14449 14450 2468. [bug] Resolver could try unreachable servers multiple times. 14451 [RT #18739] 14452 14453 2467. [bug] Failure of fcntl(F_DUPFD) wasn't logged. [RT #18740] 14454 14455 2466. [doc] ARM: explain max-cache-ttl 0 SERVFAIL issue. 14456 [RT #18302] 14457 14458 2465. [bug] Adb's handling of lame addresses was different 14459 for IPv4 and IPv6. [RT #18738] 14460 14461 2464. [port] linux: check that a capability is present before 14462 trying to set it. [RT #18135] 14463 14464 2463. [port] linux: POSIX doesn't include the IPv6 Advanced Socket 14465 API and glibc hides parts of the IPv6 Advanced Socket 14466 API as a result. This is stupid as it breaks how the 14467 two halves (Basic and Advanced) of the IPv6 Socket API 14468 were designed to be used but we have to live with it. 14469 Define _GNU_SOURCE to pull in the IPv6 Advanced Socket 14470 API. [RT #18388] 14471 14472 2462. [doc] Document -m (enable memory usage debugging) 14473 option for dig. [RT #18757] 14474 14475 2461. [port] sunos: Change #2363 was not complete. [RT #17513] 14476 14477 .. code-block:: none 14478 14479 --- 9.6.0a1 released --- 14480 14481 2460. [bug] Don't call dns_db_getnsec3parameters() on the cache. 14482 [RT #18697] 14483 14484 2459. [contrib] Import dnssec-zkt to contrib/zkt. [RT #18448] 14485 14486 2458. [doc] ARM: update and correction for max-cache-size. 14487 [RT #18294] 14488 14489 2457. [tuning] max-cache-size is reverted to 0, the previous 14490 default. It should be safe because expired cache 14491 entries are also purged. [RT #18684] 14492 14493 2456. [bug] In ACLs, ::/0 and 0.0.0.0/0 would both match any 14494 address, regardless of family. They now correctly 14495 distinguish IPv4 from IPv6. [RT #18559] 14496 14497 2455. [bug] Stop metadata being transferred via axfr/ixfr. 14498 [RT #18639] 14499 14500 2454. [func] nsupdate: you can now set a default ttl. [RT #18317] 14501 14502 2453. [bug] Remove NULL pointer dereference in dns_journal_print(). 14503 [RT #18316] 14504 14505 2452. [func] Improve bin/test/journalprint. [RT #18316] 14506 14507 2451. [port] solaris: handle runtime linking better. [RT #18356] 14508 14509 2450. [doc] Fix lwresd docbook problem for manual page. 14510 [RT #18672] 14511 14512 2449. [placeholder] 14513 14514 2448. [func] Add NSEC3 support. [RT #15452] 14515 14516 2447. [cleanup] libbind has been split out as a separate product. 14517 14518 2446. [func] Add a new log message about build options on startup. 14519 A new command-line option '-V' for named is also 14520 provided to show this information. [RT #18645] 14521 14522 2445. [doc] ARM out-of-date on empty reverse zones (list includes 14523 RFC1918 address, but these are not yet compiled in). 14524 [RT #18578] 14525 14526 2444. [port] Linux, FreeBSD, AIX: Turn off path mtu discovery 14527 (clear DF) for UDP responses and requests. 14528 14529 2443. [bug] win32: UDP connect() would not generate an event, 14530 and so connected UDP sockets would never clean up. 14531 Fix this by doing an immediate WSAConnect() rather 14532 than an io completion port type for UDP. 14533 14534 2442. [bug] A lock could be destroyed twice. [RT #18626] 14535 14536 2441. [bug] isc_radix_insert() could copy radix tree nodes 14537 incompletely. [RT #18573] 14538 14539 2440. [bug] named-checkconf used an incorrect test to determine 14540 if an ACL was set to none. 14541 14542 2439. [bug] Potential NULL dereference in dns_acl_isanyornone(). 14543 [RT #18559] 14544 14545 2438. [bug] Timeouts could be logged incorrectly under win32. 14546 14547 2437. [bug] Sockets could be closed too early, leading to 14548 inconsistent states in the socket module. [RT #18298] 14549 14550 2436. [security] win32: UDP client handler can be shutdown. [RT #18576] 14551 14552 2435. [bug] Fixed an ACL memory leak affecting win32. 14553 14554 2434. [bug] Fixed a minor error-reporting bug in 14555 lib/isc/win32/socket.c. 14556 14557 2433. [tuning] Set initial timeout to 800ms. 14558 14559 2432. [bug] More Windows socket handling improvements. Stop 14560 using I/O events and use IO Completion Ports 14561 throughout. Rewrite the receive path logic to make 14562 it easier to support multiple simultaneous 14563 requesters in the future. Add stricter consistency 14564 checking as a compile-time option (define 14565 ISC_SOCKET_CONSISTENCY_CHECKS; defaults to off). 14566 14567 2431. [bug] Acl processing could leak memory. [RT #18323] 14568 14569 2430. [bug] win32: isc_interval_set() could round down to 14570 zero if the input was less than NS_INTERVAL 14571 nanoseconds. Round up instead. [RT #18549] 14572 14573 2429. [doc] nsupdate should be in section 1 of the man pages. 14574 [RT #18283] 14575 14576 2428. [bug] dns_iptable_merge() mishandled merges of negative 14577 tables. [RT #18409] 14578 14579 2427. [func] Treat DNSKEY queries as if "minimal-response yes;" 14580 was set. [RT #18528] 14581 14582 2426. [bug] libbind: inet_net_pton() can sometimes return the 14583 wrong value if excessively large net masks are 14584 supplied. [RT #18512] 14585 14586 2425. [bug] named didn't detect unavailable query source addresses 14587 at load time. [RT #18536] 14588 14589 2424. [port] configure now probes for a working epoll 14590 implementation. Allow the use of kqueue, 14591 epoll and /dev/poll to be selected at compile 14592 time. [RT #18277] 14593 14594 2423. [security] Randomize server selection on queries, so as to 14595 make forgery a little more difficult. Instead of 14596 always preferring the server with the lowest RTT, 14597 pick a server with RTT within the same 128 14598 millisecond band. [RT #18441] 14599 14600 2422. [bug] Handle the special return value of a empty node as 14601 if it was a NXRRSET in the validator. [RT #18447] 14602 14603 2421. [func] Add new command line option '-S' for named to specify 14604 the max number of sockets. [RT #18493] 14605 Use caution: this option may not work for some 14606 operating systems without rebuilding named. 14607 14608 2420. [bug] Windows socket handling cleanup. Let the io 14609 completion event send out canceled read/write 14610 done events, which keeps us from writing to memory 14611 we no longer have ownership of. Add debugging 14612 socket_log() function. Rework TCP socket handling 14613 to not leak sockets. 14614 14615 2419. [cleanup] Document that isc_socket_create() and isc_socket_open() 14616 should not be used for isc_sockettype_fdwatch sockets. 14617 [RT #18521] 14618 14619 2418. [bug] AXFR request on a DLZ could trigger a REQUIRE failure 14620 [RT #18430] 14621 14622 2417. [bug] Connecting UDP sockets for outgoing queries could 14623 unexpectedly fail with an 'address already in use' 14624 error. [RT #18411] 14625 14626 2416. [func] Log file descriptors that cause exceeding the 14627 internal maximum. [RT #18460] 14628 14629 2415. [bug] 'rndc dumpdb' could trigger various assertion failures 14630 in rbtdb.c. [RT #18455] 14631 14632 2414. [bug] A masterdump context held the database lock too long, 14633 causing various troubles such as dead lock and 14634 recursive lock acquisition. [RT #18311, #18456] 14635 14636 2413. [bug] Fixed an unreachable code path in socket.c. [RT #18442] 14637 14638 2412. [bug] win32: address a resource leak. [RT #18374] 14639 14640 2411. [bug] Allow using a larger number of sockets than FD_SETSIZE 14641 for select(). To enable this, set ISC_SOCKET_MAXSOCKETS 14642 at compilation time. [RT #18433] 14643 14644 Note: with changes #2469 and #2421 above, there is no 14645 need to tweak ISC_SOCKET_MAXSOCKETS at compilation time 14646 any more. 14647 14648 2410. [bug] Correctly delete m_versionInfo. [RT #18432] 14649 14650 2409. [bug] Only log that we disabled EDNS processing if we were 14651 subsequently successful. [RT #18029] 14652 14653 2408. [bug] A duplicate TCP dispatch event could be sent, which 14654 could then trigger an assertion failure in 14655 resquery_response(). [RT #18275] 14656 14657 2407. [port] hpux: test for sys/dyntune.h. [RT #18421] 14658 14659 2406. [placeholder] 14660 14661 2405. [cleanup] The default value for dnssec-validation was changed to 14662 "yes" in 9.5.0-P1 and all subsequent releases; this 14663 was inadvertently omitted from CHANGES at the time. 14664 14665 2404. [port] hpux: files unlimited support. 14666 14667 2403. [bug] TSIG context leak. [RT #18341] 14668 14669 2402. [port] Support Solaris 2.11 and over. [RT #18362] 14670 14671 2401. [bug] Expect to get E[MN]FILE errno internal_accept() 14672 (from accept() or fcntl() system calls). [RT #18358] 14673 14674 2400. [bug] Log if kqueue()/epoll_create()/open(/dev/poll) fails. 14675 [RT #18297] 14676 14677 2399. [placeholder] 14678 14679 2398. [bug] Improve file descriptor management. New, 14680 temporary, named.conf option reserved-sockets, 14681 default 512. [RT #18344] 14682 14683 2397. [bug] gssapi_functions had too many elements. [RT #18355] 14684 14685 2396. [bug] Don't set SO_REUSEADDR for randomized ports. 14686 [RT #18336] 14687 14688 2395. [port] Avoid warning and no effect from "files unlimited" 14689 on Linux when running as root. [RT #18335] 14690 14691 2394. [bug] Default configuration options set the limit for 14692 open files to 'unlimited' as described in the 14693 documentation. [RT #18331] 14694 14695 2393. [bug] nested acls containing keys could trigger an 14696 assertion in acl.c. [RT #18166] 14697 14698 2392. [bug] remove 'grep -q' from acl test script, some platforms 14699 don't support it. [RT #18253] 14700 14701 2391. [port] hpux: cover additional recvmsg() error codes. 14702 [RT #18301] 14703 14704 2390. [bug] dispatch.c could make a false warning on 'odd socket'. 14705 [RT #18301]. 14706 14707 2389. [bug] Move the "working directory writable" check to after 14708 the ns_os_changeuser() call. [RT #18326] 14709 14710 2388. [bug] Avoid using tables for layout purposes in 14711 statistics XSL [RT #18159]. 14712 14713 2387. [bug] Silence compiler warnings in lib/isc/radix.c. 14714 [RT #18147] [RT #18258] 14715 14716 2386. [func] Add warning about too small 'open files' limit. 14717 [RT #18269] 14718 14719 2385. [bug] A condition variable in socket.c could leak in 14720 rare error handling [RT #17968]. 14721 14722 2384. [security] Fully randomize UDP query ports to improve 14723 forgery resilience. [RT #17949, #18098] 14724 14725 2383. [bug] named could double queries when they resulted in 14726 SERVFAIL due to overkilling EDNS0 failure detection. 14727 [RT #18182] 14728 14729 2382. [doc] Add descriptions of DHCID, IPSECKEY, SPF and SSHFP 14730 to ARM. 14731 14732 2381. [port] dlz/mysql: support multiple install layouts for 14733 mysql. <prefix>/include/{,mysql/}mysql.h and 14734 <prefix>/lib/{,mysql/}. [RT #18152] 14735 14736 2380. [bug] dns_view_find() was not returning NXDOMAIN/NXRRSET 14737 proofs which, in turn, caused validation failures 14738 for insecure zones immediately below a secure zone 14739 the server was authoritative for. [RT #18112] 14740 14741 2379. [contrib] queryperf/gen-data-queryperf.py: removed redundant 14742 TLDs and supported RRs with TTLs [RT #17972] 14743 14744 2378. [bug] gssapi_functions{} had a redundant member in BIND 9.5. 14745 [RT #18169] 14746 14747 2377. [bug] Address race condition in dnssec-signzone. [RT #18142] 14748 14749 2376. [bug] Change #2144 was not complete. 14750 14751 2375. [placeholder] 14752 14753 2374. [bug] "blackhole" ACLs could cause named to segfault due 14754 to some uninitialized memory. [RT #18095] 14755 14756 2373. [bug] Default values of zone ACLs were re-parsed each time a 14757 new zone was configured, causing an overconsumption 14758 of memory. [RT #18092] 14759 14760 2372. [bug] Fixed incorrect TAG_HMACSHA256_BITS value [RT #18047] 14761 14762 2371. [doc] Add +nsid option to dig man page. [RT #18039] 14763 14764 2370. [bug] "rndc freeze" could trigger an assertion in named 14765 when called on a nonexistent zone. [RT #18050] 14766 14767 2369. [bug] libbind: Array bounds overrun on read in bitncmp(). 14768 [RT #18054] 14769 14770 2368. [port] Linux: use libcap for capability management if 14771 possible. [RT #18026] 14772 14773 2367. [bug] Improve counting of dns_resstatscounter_retry 14774 [RT #18030] 14775 14776 2366. [bug] Adb shutdown race. [RT #18021] 14777 14778 2365. [bug] Fix a bug that caused dns_acl_isany() to return 14779 spurious results. [RT #18000] 14780 14781 2364. [bug] named could trigger a assertion when serving a 14782 malformed signed zone. [RT #17828] 14783 14784 2363. [port] sunos: pre-set "lt_cv_sys_max_cmd_len=4096;". 14785 [RT #17513] 14786 14787 2362. [cleanup] Make "rrset-order fixed" a compile-time option. 14788 settable by "./configure --enable-fixed-rrset". 14789 Disabled by default. [RT #17977] 14790 14791 2361. [bug] "recursion" statistics counter could be counted 14792 multiple times for a single query. [RT #17990] 14793 14794 2360. [bug] Fix a condition where we release a database version 14795 (which may acquire a lock) while holding the lock. 14796 14797 2359. [bug] Fix NSID bug. [RT #17942] 14798 14799 2358. [doc] Update host's default query description. [RT #17934] 14800 14801 2357. [port] Don't use OpenSSL's engine support in versions before 14802 OpenSSL 0.9.7f. [RT #17922] 14803 14804 2356. [bug] Built in mutex profiler was not scalable enough. 14805 [RT #17436] 14806 14807 2355. [func] Extend the number statistics counters available. 14808 [RT #17590] 14809 14810 2354. [bug] Failed to initialize some rdatasetheader_t elements. 14811 [RT #17927] 14812 14813 2353. [func] Add support for Name Server ID (RFC 5001). 14814 'dig +nsid' requests NSID from server. 14815 'request-nsid yes;' causes recursive server to send 14816 NSID requests to upstream servers. Server responds 14817 to NSID requests with the string configured by 14818 'server-id' option. [RT #17091] 14819 14820 2352. [bug] Various GSS_API fixups. [RT #17729] 14821 14822 2351. [bug] convertxsl.pl generated very long lines. [RT #17906] 14823 14824 2350. [port] win32: IPv6 support. [RT #17797] 14825 14826 2349. [func] Provide incremental re-signing support for secure 14827 dynamic zones. [RT #1091] 14828 14829 2348. [func] Use the EVP interface to OpenSSL. Add PKCS#11 support. 14830 Documentation is in the new README.pkcs11 file. 14831 New tool, dnssec-keyfromlabel, which takes the 14832 label of a key pair in a HSM and constructs a DNS 14833 key pair for use by named and dnssec-signzone. 14834 [RT #16844] 14835 14836 2347. [bug] Delete now traverses the RB tree in the canonical 14837 order. [RT #17451] 14838 14839 2346. [func] Memory statistics now cover all active memory contexts 14840 in increased detail. [RT #17580] 14841 14842 2345. [bug] named-checkconf failed to detect when forwarders 14843 were set at both the options/view level and in 14844 a root zone. [RT #17671] 14845 14846 2344. [bug] Improve "logging{ file ...; };" documentation. 14847 [RT #17888] 14848 14849 2343. [bug] (Seemingly) duplicate IPv6 entries could be 14850 created in ADB. [RT #17837] 14851 14852 2342. [func] Use getifaddrs() if available under Linux. [RT #17224] 14853 14854 2341. [bug] libbind: add missing -I../include for off source 14855 tree builds. [RT #17606] 14856 14857 2340. [port] openbsd: interface configuration. [RT #17700] 14858 14859 2339. [port] tru64: support for libbind. [RT #17589] 14860 14861 2338. [bug] check_ds() could be called with a non DS rdataset. 14862 [RT #17598] 14863 14864 2337. [bug] BUILD_LDFLAGS was not being correctly set. [RT #17614] 14865 14866 2336. [func] If "named -6" is specified then listen on all IPv6 14867 interfaces if there are not listen-on-v6 clauses in 14868 named.conf. [RT #17581] 14869 14870 2335. [port] sunos: libbind and *printf() support for long long. 14871 [RT #17513] 14872 14873 2334. [bug] Bad REQUIRES in fromstruct_in_naptr(), off by one 14874 bug in fromstruct_txt(). [RT #17609] 14875 14876 2333. [bug] Fix off by one error in isc_time_nowplusinterval(). 14877 [RT #17608] 14878 14879 2332. [contrib] query-loc-0.4.0. [RT #17602] 14880 14881 2331. [bug] Failure to regenerate any signatures was not being 14882 reported nor being past back to the UPDATE client. 14883 [RT #17570] 14884 14885 2330. [bug] Remove potential race condition when handling 14886 over memory events. [RT #17572] 14887 14888 WARNING: API CHANGE: over memory callback 14889 function now needs to call isc_mem_waterack(). 14890 See <isc/mem.h> for details. 14891 14892 2329. [bug] Clearer help text for dig's '-x' and '-i' options. 14893 14894 2328. [maint] Add AAAA addresses for A.ROOT-SERVERS.NET, 14895 F.ROOT-SERVERS.NET, H.ROOT-SERVERS.NET, 14896 J.ROOT-SERVERS.NET, K.ROOT-SERVERS.NET and 14897 M.ROOT-SERVERS.NET. 14898 14899 2327. [bug] It was possible to dereference a NULL pointer in 14900 rbtdb.c. Implement dead node processing in zones as 14901 we do for caches. [RT #17312] 14902 14903 2326. [bug] It was possible to trigger a INSIST in the acache 14904 processing. 14905 14906 2325. [port] Linux: use capset() function if available. [RT #17557] 14907 14908 2324. [bug] Fix IPv6 matching against "any;". [RT #17533] 14909 14910 2323. [port] tru64: namespace clash. [RT #17547] 14911 14912 2322. [port] MacOS: work around the limitation of setrlimit() 14913 for RLIMIT_NOFILE. [RT #17526] 14914 14915 2321. [placeholder] 14916 14917 2320. [func] Make statistics counters thread-safe for platforms 14918 that support certain atomic operations. [RT #17466] 14919 14920 2319. [bug] Silence Coverity warnings in 14921 lib/dns/rdata/in_1/apl_42.c. [RT #17469] 14922 14923 2318. [port] sunos fixes for libbind. [RT #17514] 14924 14925 2317. [bug] "make distclean" removed bind9.xsl.h. [RT #17518] 14926 14927 2316. [port] Missing #include <isc/print.h> in lib/dns/gssapictx.c. 14928 [RT #17513] 14929 14930 2315. [bug] Used incorrect address family for mapped IPv4 14931 addresses in acl.c. [RT #17519] 14932 14933 2314. [bug] Uninitialized memory use on error path in 14934 bin/named/lwdnoop.c. [RT #17476] 14935 14936 2313. [cleanup] Silence Coverity warnings. Handle private stacks. 14937 [RT #17447] [RT #17478] 14938 14939 2312. [cleanup] Silence Coverity warning in lib/isc/unix/socket.c. 14940 [RT #17458] 14941 14942 2311. [bug] IPv6 addresses could match IPv4 ACL entries and 14943 vice versa. [RT #17462] 14944 14945 2310. [bug] dig, host, nslookup: flush stdout before emitting 14946 debug/fatal messages. [RT #17501] 14947 14948 2309. [cleanup] Fix Coverity warnings in lib/dns/acl.c and iptable.c. 14949 [RT #17455] 14950 14951 2308. [cleanup] Silence Coverity warning in bin/named/controlconf.c. 14952 [RT #17495] 14953 14954 2307. [bug] Remove infinite loop from lib/dns/sdb.c. [RT #17496] 14955 14956 2306. [bug] Remove potential race from lib/dns/resolver.c. 14957 [RT #17470] 14958 14959 2305. [security] inet_network() buffer overflow. CVE-2008-0122. 14960 14961 2304. [bug] Check returns from all dns_rdata_tostruct() calls. 14962 [RT #17460] 14963 14964 2303. [bug] Remove unnecessary code from bin/named/lwdgnba.c. 14965 [RT #17471] 14966 14967 2302. [bug] Fix memset() calls in lib/tests/t_api.c. [RT #17472] 14968 14969 2301. [bug] Remove resource leak and fix error messages in 14970 bin/tests/system/lwresd/lwtest.c. [RT #17474] 14971 14972 2300. [bug] Fixed failure to close open file in 14973 bin/tests/names/t_names.c. [RT #17473] 14974 14975 2299. [bug] Remove unnecessary NULL check in 14976 bin/nsupdate/nsupdate.c. [RT #17475] 14977 14978 2298. [bug] isc_mutex_lock() failure not caught in 14979 bin/tests/timers/t_timers.c. [RT #17468] 14980 14981 2297. [bug] isc_entropy_createfilesource() failure not caught in 14982 bin/tests/dst/t_dst.c. [RT #17467] 14983 14984 2296. [port] Allow docbook stylesheet location to be specified to 14985 configure. [RT #17457] 14986 14987 2295. [bug] Silence static overrun error in bin/named/lwaddr.c. 14988 [RT #17459] 14989 14990 2294. [func] Allow the experimental statistics channels to have 14991 multiple connections and ACL. 14992 Note: the stats-server and stats-server-v6 options 14993 available in the previous beta releases are replaced 14994 with the generic statistics-channels statement. 14995 14996 2293. [func] Add ACL regression test. [RT #17375] 14997 14998 2292. [bug] Log if the working directory is not writable. 14999 [RT #17312] 15000 15001 2291. [bug] PR_SET_DUMPABLE may be set too late. Also report 15002 failure to set PR_SET_DUMPABLE. [RT #17312] 15003 15004 2290. [bug] Let AD in the query signal that the client wants AD 15005 set in the response. [RT #17301] 15006 15007 2289. [func] named-checkzone now reports the out-of-zone CNAME 15008 found. [RT #17309] 15009 15010 2288. [port] win32: mark service as running when we have finished 15011 loading. [RT #17441] 15012 15013 2287. [bug] Use 'volatile' if the compiler supports it. [RT #17413] 15014 15015 2286. [func] Allow a TCP connection to be used as a weak 15016 authentication method for reverse zones. 15017 New update-policy methods tcp-self and 6to4-self. 15018 [RT #17378] 15019 15020 2285. [func] Test framework for client memory context management. 15021 [RT #17377] 15022 15023 2284. [bug] Memory leak in UPDATE prerequisite processing. 15024 [RT #17377] 15025 15026 2283. [bug] TSIG keys were not attaching to the memory 15027 context. TSIG keys should use the rings 15028 memory context rather than the clients memory 15029 context. [RT #17377] 15030 15031 2282. [bug] Acl code fixups. [RT #17346] [RT #17374] 15032 15033 2281. [bug] Attempts to use undefined acls were not being logged. 15034 [RT #17307] 15035 15036 2280. [func] Allow the experimental http server to be reached 15037 over IPv6 as well as IPv4. [RT #17332] 15038 15039 2279. [bug] Use setsockopt(SO_NOSIGPIPE), when available, 15040 to protect applications from receiving spurious 15041 SIGPIPE signals when using the resolver. 15042 15043 2278. [bug] win32: handle the case where Windows returns no 15044 search list or DNS suffix. [RT #17354] 15045 15046 2277. [bug] Empty zone names were not correctly being caught at 15047 in the post parse checks. [RT #17357] 15048 15049 2276. [bug] Install <dst/gssapi.h>. [RT #17359] 15050 15051 2275. [func] Add support to dig to perform IXFR queries over UDP. 15052 [RT #17235] 15053 15054 2274. [func] Log zone transfer statistics. [RT #17336] 15055 15056 2273. [bug] Adjust log level to WARNING when saving inconsistent 15057 stub/slave master and journal files. [RT #17279] 15058 15059 2272. [bug] Handle illegal dnssec-lookaside trust-anchor names. 15060 [RT #17262] 15061 15062 2271. [bug] Fix a memory leak in http server code [RT #17100] 15063 15064 2270. [bug] dns_db_closeversion() version->writer could be reset 15065 before it is tested. [RT #17290] 15066 15067 2269. [contrib] dbus memory leaks and missing va_end calls. [RT #17232] 15068 15069 2268. [bug] 0.IN-ADDR.ARPA was missing from the empty zones 15070 list. 15071 15072 .. code-block:: none 15073 15074 --- 9.5.0b1 released --- 15075 15076 2267. [bug] Radix tree node_num value could be set incorrectly, 15077 causing positive ACL matches to look like negative 15078 ones. [RT #17311] 15079 15080 2266. [bug] client.c:get_clientmctx() returned the same mctx 15081 once the pool of mctx's was filled. [RT #17218] 15082 15083 2265. [bug] Test that the memory context's basic_table is non NULL 15084 before freeing. [RT #17265] 15085 15086 2264. [bug] Server prefix length was being ignored. [RT #17308] 15087 15088 2263. [bug] "named-checkconf -z" failed to set default value 15089 for "check-integrity". [RT #17306] 15090 15091 2262. [bug] Error status from all but the last view could be 15092 lost. [RT #17292] 15093 15094 2261. [bug] Fix memory leak with "any" and "none" ACLs [RT #17272] 15095 15096 2260. [bug] Reported wrong clients-per-query when increasing the 15097 value. [RT #17236] 15098 15099 2259. [placeholder] 15100 15101 .. code-block:: none 15102 15103 --- 9.5.0a7 released --- 15104 15105 2258. [bug] Fallback from IXFR/TSIG to SOA/AXFR/TSIG broken. 15106 [RT #17241] 15107 15108 2257. [bug] win32: Use the full path to vcredist_x86.exe when 15109 calling it. [RT #17222] 15110 15111 2256. [bug] win32: Correctly register the installation location of 15112 bindevt.dll. [RT #17159] 15113 15114 2255. [maint] L.ROOT-SERVERS.NET is now 199.7.83.42. 15115 15116 2254. [bug] timer.c:dispatch() failed to lock timer->lock 15117 when reading timer->idle allowing it to see 15118 intermediate values as timer->idle was reset by 15119 isc_timer_touch(). [RT #17243] 15120 15121 2253. [func] "max-cache-size" defaults to 32M. 15122 "max-acache-size" defaults to 16M. 15123 15124 2252. [bug] Fixed errors in sortlist code [RT #17216] 15125 15126 2251. [placeholder] 15127 15128 2250. [func] New flag 'memstatistics' to state whether the 15129 memory statistics file should be written or not. 15130 Additionally named's -m option will cause the 15131 statistics file to be written. [RT #17113] 15132 15133 2249. [bug] Only set Authentic Data bit if client requested 15134 DNSSEC, per RFC 3655 [RT #17175] 15135 15136 2248. [cleanup] Fix several errors reported by Coverity. [RT #17160] 15137 15138 2247. [doc] Sort doc/misc/options. [RT #17067] 15139 15140 2246. [bug] Make the startup of test servers (ans.pl) more 15141 robust. [RT #17147] 15142 15143 2245. [bug] Validating lack of DS records at trust anchors wasn't 15144 working. [RT #17151] 15145 15146 2244. [func] Allow the check of nameserver names against the 15147 SOA MNAME field to be disabled by specifying 15148 'notify-to-soa yes;'. [RT #17073] 15149 15150 2243. [func] Configuration files without a newline at the end now 15151 parse without error. [RT #17120] 15152 15153 2242. [bug] nsupdate: GSS-TSIG support using the Heimdal Kerberos 15154 library could require a source of random data. 15155 [RT #17127] 15156 15157 2241. [func] nsupdate: add a interactive 'help' command. [RT #17099] 15158 15159 2240. [bug] Cleanup nsupdates GSS-TSIG support. Convert 15160 a number of INSIST()s into plain fatal() errors 15161 which report the triggering result code. 15162 The 'key' command wasn't disabling GSS-TSIG. 15163 [RT #17099] 15164 15165 2239. [func] Ship a pre built bin/named/bind9.xsl.h. [RT #17114] 15166 15167 2238. [bug] It was possible to trigger a REQUIRE when a 15168 validation was canceled. [RT #17106] 15169 15170 2237. [bug] libbind: res_init() was not thread aware. [RT #17123] 15171 15172 2236. [bug] dnssec-signzone failed to preserve the case of 15173 of wildcard owner names. [RT #17085] 15174 15175 2235. [bug] <isc/atomic.h> was not being installed. [RT #17135] 15176 15177 2234. [port] Correct some compiler warnings on SCO OSr5 [RT #17134] 15178 15179 2233. [func] Add support for O(1) ACL processing, based on 15180 radix tree code originally written by Kevin 15181 Brintnall. [RT #16288] 15182 15183 2232. [bug] dns_adb_findaddrinfo() could fail and return 15184 ISC_R_SUCCESS. [RT #17137] 15185 15186 2231. [bug] Building dlzbdb (contrib/dlz/bin/dlzbdb) was broken. 15187 [RT #17088] 15188 15189 2230. [bug] We could INSIST reading a corrupted journal. 15190 [RT #17132] 15191 15192 2229. [bug] Null pointer dereference on query pool creation 15193 failure. [RT #17133] 15194 15195 2228. [contrib] contrib: Change 2188 was incomplete. 15196 15197 2227. [cleanup] Tidied up the FAQ. [RT #17121] 15198 15199 2226. [placeholder] 15200 15201 2225. [bug] More support for systems with no IPv4 addresses. 15202 [RT #17111] 15203 15204 2224. [bug] Defer journal compaction if a xfrin is in progress. 15205 [RT #17119] 15206 15207 2223. [bug] Make a new journal when compacting. [RT #17119] 15208 15209 2222. [func] named-checkconf now checks server key references. 15210 [RT #17097] 15211 15212 2221. [bug] Set the event result code to reflect the actual 15213 record turned to caller when a cache update is 15214 rejected due to a more credible answer existing. 15215 [RT #17017] 15216 15217 2220. [bug] win32: Address a race condition in final shutdown of 15218 the Windows socket code. [RT #17028] 15219 15220 2219. [bug] Apply zone consistency checks to additions, not 15221 removals, when updating. [RT #17049] 15222 15223 2218. [bug] Remove unnecessary REQUIRE from dns_validator_create(). 15224 [RT #16976] 15225 15226 2217. [func] Adjust update log levels. [RT #17092] 15227 15228 2216. [cleanup] Fix a number of errors reported by Coverity. 15229 [RT #17094] 15230 15231 2215. [bug] Bad REQUIRE check isc_hmacsha1_verify(). [RT #17094] 15232 15233 2214. [bug] Deregister OpenSSL lock callback when cleaning 15234 up. Reorder OpenSSL cleanup so that RAND_cleanup() 15235 is called before the locks are destroyed. [RT #17098] 15236 15237 2213. [bug] SIG0 diagnostic failure messages were looking at the 15238 wrong status code. [RT #17101] 15239 15240 2212. [func] 'host -m' now causes memory statistics and active 15241 memory to be printed at exit. [RT 17028] 15242 15243 2211. [func] Update "dynamic update temporarily disabled" message. 15244 [RT #17065] 15245 15246 2210. [bug] Deleting class specific records via UPDATE could 15247 fail. [RT #17074] 15248 15249 2209. [port] osx: linking against user supplied static OpenSSL 15250 libraries failed as the system ones were still being 15251 found. [RT #17078] 15252 15253 2208. [port] win32: make sure both build methods produce the 15254 same output. [RT #17058] 15255 15256 2207. [port] Some implementations of getaddrinfo() fail to set 15257 ai_canonname correctly. [RT #17061] 15258 15259 .. code-block:: none 15260 15261 --- 9.5.0a6 released --- 15262 15263 2206. [security] "allow-query-cache" and "allow-recursion" now 15264 cross inherit from each other. 15265 15266 If allow-query-cache is not set in named.conf then 15267 allow-recursion is used if set, otherwise allow-query 15268 is used if set, otherwise the default (localnets; 15269 localhost;) is used. 15270 15271 If allow-recursion is not set in named.conf then 15272 allow-query-cache is used if set, otherwise allow-query 15273 is used if set, otherwise the default (localnets; 15274 localhost;) is used. 15275 15276 [RT #16987] 15277 15278 2205. [bug] libbind: change #2119 broke thread support. [RT #16982] 15279 15280 2204. [bug] "rndc flushname name unknown-view" caused named 15281 to crash. [RT #16984] 15282 15283 2203. [security] Query id generation was cryptographically weak. 15284 [RT # 16915] 15285 15286 2202. [security] The default acls for allow-query-cache and 15287 allow-recursion were not being applied. [RT #16960] 15288 15289 2201. [bug] The build failed in a separate object directory. 15290 [RT #16943] 15291 15292 2200. [bug] The search for cached NSEC records was stopping to 15293 early leading to excessive DLV queries. [RT #16930] 15294 15295 2199. [bug] win32: don't call WSAStartup() while loading dlls. 15296 [RT #16911] 15297 15298 2198. [bug] win32: RegCloseKey() could be called when 15299 RegOpenKeyEx() failed. [RT #16911] 15300 15301 2197. [bug] Add INSIST to catch negative responses which are 15302 not setting the event result code appropriately. 15303 [RT #16909] 15304 15305 2196. [port] win32: yield processor while waiting for once to 15306 to complete. [RT #16958] 15307 15308 2195. [func] dnssec-keygen now defaults to nametype "ZONE" 15309 when generating DNSKEYs. [RT #16954] 15310 15311 2194. [bug] Close journal before calling 'done' in xfrin.c. 15312 15313 .. code-block:: none 15314 15315 --- 9.5.0a5 released --- 15316 15317 2193. [port] win32: BINDInstall.exe is now linked statically. 15318 [RT #16906] 15319 15320 2192. [port] win32: use vcredist_x86.exe to install Visual 15321 Studio's redistributable dlls if building with 15322 Visual Stdio 2005 or later. 15323 15324 2191. [func] named-checkzone now allows dumping to stdout (-). 15325 named-checkconf now has -h for help. 15326 named-checkzone now has -h for help. 15327 rndc now has -h for help. 15328 Better handling of '-?' for usage summaries. 15329 [RT #16707] 15330 15331 2190. [func] Make fallback to plain DNS from EDNS due to timeouts 15332 more visible. New logging category "edns-disabled". 15333 [RT #16871] 15334 15335 2189. [bug] Handle socket() returning EINTR. [RT #15949] 15336 15337 2188. [contrib] queryperf: autoconf changes to make the search for 15338 libresolv or libbind more robust. [RT #16299] 15339 15340 2187. [bug] query_addds(), query_addwildcardproof() and 15341 query_addnxrrsetnsec() should take a version 15342 argument. [RT #16368] 15343 15344 2186. [port] cygwin: libbind: check for struct sockaddr_storage 15345 independently of IPv6. [RT #16482] 15346 15347 2185. [port] sunos: libbind: check for ssize_t, memmove() and 15348 memchr(). [RT #16463] 15349 15350 2184. [bug] bind9.xsl.h didn't build out of the source tree. 15351 [RT #16830] 15352 15353 2183. [bug] dnssec-signzone didn't handle offline private keys 15354 well. [RT #16832] 15355 15356 2182. [bug] dns_dispatch_createtcp() and dispatch_createudp() 15357 could return ISC_R_SUCCESS when they ran out of 15358 memory. [RT #16365] 15359 15360 2181. [port] sunos: libbind: add paths.h from BIND 8. [RT #16462] 15361 15362 2180. [cleanup] Remove bit test from 'compress_test' as they 15363 are no longer needed. [RT #16497] 15364 15365 2179. [func] 'rndc command zone' will now find 'zone' if it is 15366 unique to all the views. [RT #16821] 15367 15368 2178. [bug] 'rndc reload' of a slave or stub zone resulted in 15369 a reference leak. [RT #16867] 15370 15371 2177. [bug] Array bounds overrun on read (rcodetext) at 15372 debug level 10+. [RT #16798] 15373 15374 2176. [contrib] dbus update to handle race condition during 15375 initialization (Bugzilla 235809). [RT #16842] 15376 15377 2175. [bug] win32: windows broadcast condition variable support 15378 was broken. [RT #16592] 15379 15380 2174. [bug] I/O errors should always be fatal when reading 15381 master files. [RT #16825] 15382 15383 2173. [port] win32: When compiling with MSVS 2005 SP1 we also 15384 need to ship Microsoft.VC80.MFCLOC. 15385 15386 .. code-block:: none 15387 15388 --- 9.5.0a4 released --- 15389 15390 2172. [bug] query_addsoa() was being called with a non zone db. 15391 [RT #16834] 15392 15393 2171. [bug] Handle breaks in DNSSEC trust chains where the parent 15394 servers are not DS aware (DS queries to the parent 15395 return a referral to the child). 15396 15397 2170. [func] Add acache processing to test suite. [RT #16711] 15398 15399 2169. [bug] host, nslookup: when reporting NXDOMAIN report the 15400 given name and not the last name searched for. 15401 [RT #16763] 15402 15403 2168. [bug] nsupdate: in non-interactive mode treat syntax errors 15404 as fatal errors. [RT #16785] 15405 15406 2167. [bug] When re-using a automatic zone named failed to 15407 attach it to the new view. [RT #16786] 15408 15409 .. code-block:: none 15410 15411 --- 9.5.0a3 released --- 15412 15413 2166. [bug] When running in batch mode, dig could misinterpret 15414 a server address as a name to be looked up, causing 15415 unexpected output. [RT #16743] 15416 15417 2165. [func] Allow the destination address of a query to determine 15418 if we will answer the query or recurse. 15419 allow-query-on, allow-recursion-on and 15420 allow-query-cache-on. [RT #16291] 15421 15422 2164. [bug] The code to determine how named-checkzone / 15423 named-compilezone was called failed under windows. 15424 [RT #16764] 15425 15426 2163. [bug] If only one of query-source and query-source-v6 15427 specified a port the query pools code broke (change 15428 2129). [RT #16768] 15429 15430 2162. [func] Allow "rrset-order fixed" to be disabled at compile 15431 time. [RT #16665] 15432 15433 2161. [bug] Fix which log messages are emitted for 'rndc flush'. 15434 [RT #16698] 15435 15436 2160. [bug] libisc wasn't handling NULL ifa_addr pointers returned 15437 from getifaddrs(). [RT #16708] 15438 15439 .. code-block:: none 15440 15441 --- 9.5.0a2 released --- 15442 15443 2159. [bug] Array bounds overrun in acache processing. [RT #16710] 15444 15445 2158. [bug] ns_client_isself() failed to initialize key 15446 leading to a REQUIRE failure. [RT #16688] 15447 15448 2157. [func] dns_db_transfernode() created. [RT #16685] 15449 15450 2156. [bug] Fix node reference leaks in lookup.c:lookup_find(), 15451 resolver.c:validated() and resolver.c:cache_name(). 15452 Fix a memory leak in rbtdb.c:free_noqname(). 15453 Make lookup.c:lookup_find() robust against 15454 event leaks. [RT #16685] 15455 15456 2155. [contrib] SQLite sdb module from jaboydjr (a] netwalk.com. 15457 [RT #16694] 15458 15459 2154. [func] Scoped (e.g. IPv6 link-local) addresses may now be 15460 matched in acls by omitting the scope. [RT #16599] 15461 15462 2153. [bug] nsupdate could leak memory. [RT #16691] 15463 15464 2152. [cleanup] Use sizeof(buf) instead of fixed number in 15465 dighost.c:get_trusted_key(). [RT #16678] 15466 15467 2151. [bug] Missing newline in usage message for journalprint. 15468 [RT #16679] 15469 15470 2150. [bug] 'rrset-order cyclic' uniformly distribute the 15471 starting point for the first response for a given 15472 RRset. [RT #16655] 15473 15474 2149. [bug] isc_mem_checkdestroyed() failed to abort on 15475 if there were still active memory contexts. 15476 [RT #16672] 15477 15478 2148. [func] Add positive logging for rndc commands. [RT #14623] 15479 15480 2147. [bug] libbind: remove potential buffer overflow from 15481 hmac_link.c. [RT #16437] 15482 15483 2146. [cleanup] Silence Linux's spurious "obsolete setsockopt 15484 SO_BSDCOMPAT" message. [RT #16641] 15485 15486 2145. [bug] Check DS/DLV digest lengths for known digests. 15487 [RT #16622] 15488 15489 2144. [cleanup] Suppress logging of SERVFAIL from forwarders. 15490 [RT #16619] 15491 15492 2143. [bug] We failed to restart the IPv6 client when the 15493 kernel failed to return the destination the 15494 packet was sent to. [RT #16613] 15495 15496 2142. [bug] Handle master files with a modification time that 15497 matches the epoch. [RT #16612] 15498 15499 2141. [bug] dig/host should not be setting IDN_ASCCHECK (IDN 15500 equivalent of LDH checks). [RT #16609] 15501 15502 2140. [bug] libbind: missing unlock on pthread_key_create() 15503 failures. [RT #16654] 15504 15505 2139. [bug] dns_view_find() was being called with wrong type 15506 in adb.c. [RT #16670] 15507 15508 2138. [bug] Lock order reversal in resolver.c. [RT #16653] 15509 15510 2137. [port] Mips little endian and/or mips 64 bit are now 15511 supported for atomic operations. [RT #16648] 15512 15513 2136. [bug] nslookup/host looped if there was no search list 15514 and the host didn't exist. [RT #16657] 15515 15516 2135. [bug] Uninitialized rdataset in sdlz.c. [RT #16656] 15517 15518 2134. [func] Additional statistics support. [RT #16666] 15519 15520 2133. [port] powerpc: Support both IBM and MacOS Power PC 15521 assembler syntaxes. [RT #16647] 15522 15523 2132. [bug] Missing unlock on out of memory in 15524 dns_dispatchmgr_setudp(). 15525 15526 2131. [contrib] dlz/mysql: AXFR was broken. [RT #16630] 15527 15528 2130. [func] Log if CD or DO were set. [RT #16640] 15529 15530 2129. [func] Provide a pool of UDP sockets for queries to be 15531 made over. See use-queryport-pool, queryport-pool-ports 15532 and queryport-pool-updateinterval. [RT #16415] 15533 15534 2128. [doc] xsltproc --nonet, update DTD versions. [RT #16635] 15535 15536 2127. [port] Improved OpenSSL 0.9.8 support. [RT #16563] 15537 15538 2126. [security] Serialize validation of type ANY responses. [RT #16555] 15539 15540 2125. [bug] dns_zone_getzeronosoattl() REQUIRE failure if DLZ 15541 was defined. [RT #16574] 15542 15543 2124. [security] It was possible to dereference a freed fetch 15544 context. [RT #16584] 15545 15546 .. code-block:: none 15547 15548 --- 9.5.0a1 released --- 15549 15550 2123. [func] Use Doxygen to generate internal documentation. 15551 [RT #11398] 15552 15553 2122. [func] Experimental http server and statistics support 15554 for named via xml. 15555 15556 2121. [func] Add a 10 slot dead masters cache (LRU) with a 600 15557 second timeout. [RT #16553] 15558 15559 2120. [doc] Fix markup on nsupdate man page. [RT #16556] 15560 15561 2119. [compat] libbind: allow res_init() to succeed enough to 15562 return the default domain even if it was unable 15563 to allocate memory. 15564 15565 2118. [bug] Handle response with long chains of domain name 15566 compression pointers which point to other compression 15567 pointers. [RT #16427] 15568 15569 2117. [bug] DNSSEC fixes: named could fail to cache NSEC records 15570 which could lead to validation failures. named didn't 15571 handle negative DS responses that were in the process 15572 of being validated. Check CNAME bit before accepting 15573 NODATA proof. To be able to ignore a child NSEC there 15574 must be SOA (and NS) set in the bitmap. [RT #16399] 15575 15576 2116. [bug] 'rndc reload' could cause the cache to continually 15577 be cleaned. [RT #16401] 15578 15579 2115. [bug] 'rndc reconfig' could trigger a INSIST if the 15580 number of masters for a zone was reduced. [RT #16444] 15581 15582 2114. [bug] dig/host/nslookup: searches for names with multiple 15583 labels were failing. [RT #16447] 15584 15585 2113. [bug] nsupdate: if a zone is specified it should be used 15586 for server discover. [RT #16455] 15587 15588 2112. [security] Warn if weak RSA exponent is used. [RT #16460] 15589 15590 2111. [bug] Fix a number of errors reported by Coverity. 15591 [RT #16507] 15592 15593 2110. [bug] "minimal-responses yes;" interacted badly with BIND 8 15594 priming queries. [RT #16491] 15595 15596 2109. [port] libbind: silence aix 5.3 compiler warnings. [RT #16502] 15597 15598 2108. [func] DHCID support. [RT #16456] 15599 15600 2107. [bug] dighost.c: more cleanup of buffers. [RT #16499] 15601 15602 2106. [func] 'rndc status' now reports named's version. [RT #16426] 15603 15604 2105. [func] GSS-TSIG support (RFC 3645). 15605 15606 2104. [port] Fix Solaris SMF error message. 15607 15608 2103. [port] Add /usr/sfw to list of locations for OpenSSL 15609 under Solaris. 15610 15611 2102. [port] Silence Solaris 10 warnings. 15612 15613 2101. [bug] OpenSSL version checks were not quite right. 15614 [RT #16476] 15615 15616 2100. [port] win32: copy libeay32.dll to Build\Debug. 15617 Copy Debug\named-checkzone to Debug\named-compilezone. 15618 15619 2099. [port] win32: more manifest issues. 15620 15621 2098. [bug] Race in rbtdb.c:no_references(), which occasionally 15622 triggered an INSIST failure about the node lock 15623 reference. [RT #16411] 15624 15625 2097. [bug] named could reference a destroyed memory context 15626 after being reloaded / reconfigured. [RT #16428] 15627 15628 2096. [bug] libbind: handle applications that fail to detect 15629 res_init() failures better. 15630 15631 2095. [port] libbind: always prototype inet_cidr_ntop_ipv6() and 15632 net_cidr_ntop_ipv6(). [RT #16388] 15633 15634 2094. [contrib] Update named-bootconf. [RT #16404] 15635 15636 2093. [bug] named-checkzone -s was broken. 15637 15638 2092. [bug] win32: dig, host, nslookup. Use registry config 15639 if resolv.conf does not exist or no nameservers 15640 listed. [RT #15877] 15641 15642 2091. [port] dighost.c: race condition on cleanup. [RT #16417] 15643 15644 2090. [port] win32: Visual C++ 2005 command line manifest support. 15645 [RT #16417] 15646 15647 2089. [security] Raise the minimum safe OpenSSL versions to 15648 OpenSSL 0.9.7l and OpenSSL 0.9.8d. Versions 15649 prior to these have known security flaws which 15650 are (potentially) exploitable in named. [RT #16391] 15651 15652 2088. [security] Change the default RSA exponent from 3 to 65537. 15653 [RT #16391] 15654 15655 2087. [port] libisc failed to compile on OS's w/o a vsnprintf. 15656 [RT #16382] 15657 15658 2086. [port] libbind: FreeBSD now has get*by*_r() functions. 15659 [RT #16403] 15660 15661 2085. [doc] win32: added index.html and README to zip. [RT #16201] 15662 15663 2084. [contrib] dbus update for 9.3.3rc2. 15664 15665 2083. [port] win32: Visual C++ 2005 support. 15666 15667 2082. [doc] Document 'cache-file' as a test only option. 15668 15669 2081. [port] libbind: minor 64-bit portability fix in memcluster.c. 15670 [RT #16360] 15671 15672 2080. [port] libbind: res_init.c did not compile on older versions 15673 of Solaris. [RT #16363] 15674 15675 2079. [bug] The lame cache was not handling multiple types 15676 correctly. [RT #16361] 15677 15678 2078. [bug] dnssec-checkzone output style "default" was badly 15679 named. It is now called "relative". [RT #16326] 15680 15681 2077. [bug] 'dnssec-signzone -O raw' wasn't outputting the 15682 complete signed zone. [RT #16326] 15683 15684 2076. [bug] Several files were missing #include <config.h> 15685 causing build failures on OSF. [RT #16341] 15686 15687 2075. [bug] The spillat timer event handler could leak memory. 15688 [RT #16357] 15689 15690 2074. [bug] dns_request_createvia2(), dns_request_createvia3(), 15691 dns_request_createraw2() and dns_request_createraw3() 15692 failed to send multiple UDP requests. [RT #16349] 15693 15694 2073. [bug] Incorrect semantics check for update policy "wildcard". 15695 [RT #16353] 15696 15697 2072. [bug] We were not generating valid HMAC SHA digests. 15698 [RT #16320] 15699 15700 2071. [port] Test whether gcc accepts -fno-strict-aliasing. 15701 [RT #16324] 15702 15703 2070. [bug] The remote address was not always displayed when 15704 reporting dispatch failures. [RT #16315] 15705 15706 2069. [bug] Cross compiling was not working. [RT #16330] 15707 15708 2068. [cleanup] Lower incremental tuning message to debug 1. 15709 [RT #16319] 15710 15711 2067. [bug] 'rndc' could close the socket too early triggering 15712 a INSIST under Windows. [RT #16317] 15713 15714 2066. [security] Handle SIG queries gracefully. [RT #16300] 15715 15716 2065. [bug] libbind: probe for HPUX prototypes for 15717 endprotoent_r() and endservent_r(). [RT 16313] 15718 15719 2064. [bug] libbind: silence AIX compiler warnings. [RT #16218] 15720 15721 2063. [bug] Change #1955 introduced a bug which caused the first 15722 'rndc flush' call to not free memory. [RT #16244] 15723 15724 2062. [bug] 'dig +nssearch' was reusing a buffer before it had 15725 been returned by the socket code. [RT #16307] 15726 15727 2061. [bug] Accept expired wildcard message reversed. [RT #16296] 15728 15729 2060. [bug] Enabling DLZ support could leave views partially 15730 configured. [RT #16295] 15731 15732 2059. [bug] Search into cache rbtdb could trigger an INSIST 15733 failure while cleaning up a stale rdataset. 15734 [RT #16292] 15735 15736 2058. [bug] Adjust how we calculate rtt estimates in the presence 15737 of authoritative servers that drop EDNS and/or CD 15738 requests. Also fallback to EDNS/512 and plain DNS 15739 faster for zones with less than 3 servers. [RT #16187] 15740 15741 2057. [bug] Make setting "ra" dependent on both allow-query-cache 15742 and allow-recursion. [RT #16290] 15743 15744 2056. [bug] dig: ixfr= was not being treated case insensitively 15745 at all times. [RT #15955] 15746 15747 2055. [bug] Missing goto after dropping multicast query. 15748 [RT #15944] 15749 15750 2054. [port] freebsd: do not explicitly link against -lpthread. 15751 [RT #16170] 15752 15753 2053. [port] netbsd:libbind: silence compiler warnings. [RT #16220] 15754 15755 2052. [bug] 'rndc' improve connect failed message to report 15756 the failing address. [RT #15978] 15757 15758 2051. [port] More strtol() fixes. [RT #16249] 15759 15760 2050. [bug] Parsing of NSAP records was not case insensitive. 15761 [RT #16287] 15762 15763 2049. [bug] Restore SOA before AXFR when falling back from 15764 a attempted IXFR when transferring in a zone. 15765 Allow a initial SOA query before attempting 15766 a AXFR to be requested. [RT #16156] 15767 15768 2048. [bug] It was possible to loop forever when using 15769 avoid-v4-udp-ports / avoid-v6-udp-ports when 15770 the OS always returned the same local port. 15771 [RT #16182] 15772 15773 2047. [bug] Failed to initialize the interface flags to zero. 15774 [RT #16245] 15775 15776 2046. [bug] rbtdb.c:rdataset_setadditional() could cause duplicate 15777 cleanup [RT #16247]. 15778 15779 2045. [func] Use lock buckets for acache entries to limit memory 15780 consumption. [RT #16183] 15781 15782 2044. [port] Add support for atomic operations for Itanium. 15783 [RT #16179] 15784 15785 2043. [port] nsupdate/nslookup: Force the flushing of the prompt 15786 for interactive sessions. [RT #16148] 15787 15788 2042. [bug] named-checkconf was incorrectly rejecting the 15789 logging category "config". [RT #16117] 15790 15791 2041. [bug] "configure --with-dlz-bdb=yes" produced a bad 15792 set of libraries to be linked. [RT #16129] 15793 15794 2040. [bug] rbtdb no_references() could trigger an INSIST 15795 failure with --enable-atomic. [RT #16022] 15796 15797 2039. [func] Check that all buffers passed to the socket code 15798 have been retrieved when the socket event is freed. 15799 [RT #16122] 15800 15801 2038. [bug] dig/nslookup/host was unlinking from wrong list 15802 when handling errors. [RT #16122] 15803 15804 2037. [func] When unlinking the first or last element in a list 15805 check that the list head points to the element to 15806 be unlinked. [RT #15959] 15807 15808 2036. [bug] 'rndc recursing' could cause trigger a REQUIRE. 15809 [RT #16075] 15810 15811 2035. [func] Make falling back to TCP on UDP refresh failure 15812 optional. Default "try-tcp-refresh yes;" for BIND 8 15813 compatibility. [RT #16123] 15814 15815 2034. [bug] gcc: set -fno-strict-aliasing. [RT #16124] 15816 15817 2033. [bug] We weren't creating multiple client memory contexts 15818 on demand as expected. [RT #16095] 15819 15820 2032. [bug] Remove a INSIST in query_addadditional2(). [RT #16074] 15821 15822 2031. [bug] Emit a error message when "rndc refresh" is called on 15823 a non slave/stub zone. [RT # 16073] 15824 15825 2030. [bug] We were being overly conservative when disabling 15826 openssl engine support. [RT #16030] 15827 15828 2029. [bug] host printed out the server multiple times when 15829 specified on the command line. [RT #15992] 15830 15831 2028. [port] linux: socket.c compatibility for old systems. 15832 [RT #16015] 15833 15834 2027. [port] libbind: Solaris x86 support. [RT #16020] 15835 15836 2026. [bug] Rate limit the two recursive client exceeded messages. 15837 [RT #16044] 15838 15839 2025. [func] Update "zone serial unchanged" message. [RT #16026] 15840 15841 2024. [bug] named emitted spurious "zone serial unchanged" 15842 messages on reload. [RT #16027] 15843 15844 2023. [bug] "make install" should create ${localstatedir}/run and 15845 ${sysconfdir} if they do not exist. [RT #16033] 15846 15847 2022. [bug] If dnssec validation is disabled only assert CD if 15848 CD was requested. [RT #16037] 15849 15850 2021. [bug] dnssec-enable no; triggered a REQUIRE. [RT #16037] 15851 15852 2020. [bug] rdataset_setadditional() could leak memory. [RT #16034] 15853 15854 2019. [tuning] Reduce the amount of work performed per quantum 15855 when cleaning the cache. [RT #15986] 15856 15857 2018. [bug] Checking if the HMAC MD5 private file was broken. 15858 [RT #15960] 15859 15860 2017. [bug] allow-query default was not correct. [RT #15946] 15861 15862 2016. [bug] Return a partial answer if recursion is not 15863 allowed but requested and we had the answer 15864 to the original qname. [RT #15945] 15865 15866 2015. [cleanup] use-additional-cache is now acache-enable for 15867 consistency. Default acache-enable off in BIND 9.4 15868 as it requires memory usage to be configured. 15869 It may be enabled by default in BIND 9.5 once we 15870 have more experience with it. 15871 15872 2014. [func] Statistics about acache now recorded and sent 15873 to log. [RT #15976] 15874 15875 2013. [bug] Handle unexpected TSIGs on unsigned AXFR/IXFR 15876 responses more gracefully. [RT #15941] 15877 15878 2012. [func] Don't insert new acache entries if acache is full. 15879 [RT #15970] 15880 15881 2011. [func] dnssec-signzone can now update the SOA record of 15882 the signed zone, either as an increment or as the 15883 system time(). [RT #15633] 15884 15885 2010. [placeholder] rt15958 15886 15887 2009. [bug] libbind: Coverity fixes. [RT #15808] 15888 15889 2008. [func] It is now possible to enable/disable DNSSEC 15890 validation from rndc. This is useful for the 15891 mobile hosts where the current connection point 15892 breaks DNSSEC (firewall/proxy). [RT #15592] 15893 15894 rndc validation newstate [view] 15895 15896 2007. [func] It is now possible to explicitly enable DNSSEC 15897 validation. default dnssec-validation no; to 15898 be changed to yes in 9.5.0. [RT #15674] 15899 15900 2006. [security] Allow-query-cache and allow-recursion now default 15901 to the built in acls "localnets" and "localhost". 15902 15903 This is being done to make caching servers less 15904 attractive as reflective amplifying targets for 15905 spoofed traffic. This still leave authoritative 15906 servers exposed. 15907 15908 The best fix is for full BCP 38 deployment to 15909 remove spoofed traffic. 15910 15911 2005. [bug] libbind: Retransmission timeouts should be 15912 based on which attempt it is to the nameserver 15913 and not the nameserver itself. [RT #13548] 15914 15915 2004. [bug] dns_tsig_sign() could pass a NULL pointer to 15916 dst_context_destroy() when cleaning up after a 15917 error. [RT #15835] 15918 15919 2003. [bug] libbind: The DNS name/address lookup functions could 15920 occasionally follow a random pointer due to 15921 structures not being completely zeroed. [RT #15806] 15922 15923 2002. [bug] libbind: tighten the constraints on when 15924 struct addrinfo._ai_pad exists. [RT #15783] 15925 15926 2001. [func] Check the KSK flag when updating a secure dynamic zone. 15927 New zone option "update-check-ksk yes;". [RT #15817] 15928 15929 2000. [bug] memmove()/strtol() fix was incomplete. [RT #15812] 15930 15931 1999. [func] Implement "rrset-order fixed". [RT #13662] 15932 15933 1998. [bug] Restrict handling of fifos as sockets to just SunOS. 15934 This allows named to connect to entropy gathering 15935 daemons that use fifos instead of sockets. [RT #15840] 15936 15937 1997. [bug] Named was failing to replace negative cache entries 15938 when a positive one for the type was learnt. 15939 [RT #15818] 15940 15941 1996. [bug] nsupdate: if a zone has been specified it should 15942 appear in the output of 'show'. [RT #15797] 15943 15944 1995. [bug] 'host' was reporting multiple "is an alias" messages. 15945 [RT #15702] 15946 15947 1994. [port] OpenSSL 0.9.8 support. [RT #15694] 15948 15949 1993. [bug] Log messages, via syslog, were missing the space 15950 after the timestamp if "print-time yes" was specified. 15951 [RT #15844] 15952 15953 1992. [bug] Not all incoming zone transfer messages included the 15954 view. [RT #15825] 15955 15956 1991. [cleanup] The configuration data, once read, should be treated 15957 as read only. Expand the use of const to enforce this 15958 at compile time. [RT #15813] 15959 15960 1990. [bug] libbind: isc's override of broken gettimeofday() 15961 implementations was not always effective. 15962 [RT #15709] 15963 15964 1989. [bug] win32: don't check the service password when 15965 re-installing. [RT #15882] 15966 15967 1988. [bug] Remove a bus error from the SHA256/SHA512 support. 15968 [RT #15878] 15969 15970 1987. [func] DS/DLV SHA256 digest algorithm support. [RT #15608] 15971 15972 1986. [func] Report when a zone is removed. [RT #15849] 15973 15974 1985. [protocol] DLV has now been assigned a official type code of 15975 32769. [RT #15807] 15976 15977 Note: care should be taken to ensure you upgrade 15978 both named and dnssec-signzone at the same time for 15979 zones with DLV records where named is the master 15980 server for the zone. Also any zones that contain 15981 DLV records should be removed when upgrading a slave 15982 zone. You do not however have to upgrade all 15983 servers for a zone with DLV records simultaneously. 15984 15985 1984. [func] dig, nslookup and host now advertise a 4096 byte 15986 EDNS UDP buffer size by default. [RT #15855] 15987 15988 1983. [func] Two new update policies. "selfsub" and "selfwild". 15989 [RT #12895] 15990 15991 1982. [bug] DNSKEY was being accepted on the parent side of 15992 a delegation. KEY is still accepted there for 15993 RFC 3007 validated updates. [RT #15620] 15994 15995 1981. [bug] win32: condition.c:wait() could fail to reattain 15996 the mutex lock. 15997 15998 1980. [func] dnssec-signzone: output the SOA record as the 15999 first record in the signed zone. [RT #15758] 16000 16001 1979. [port] linux: allow named to drop core after changing 16002 user ids. [RT #15753] 16003 16004 1978. [port] Handle systems which have a broken recvmsg(). 16005 [RT #15742] 16006 16007 1977. [bug] Silence noisy log message. [RT #15704] 16008 16009 1976. [bug] Handle systems with no IPv4 addresses. [RT #15695] 16010 16011 1975. [bug] libbind: isc_gethexstring() could misparse multi-line 16012 hex strings with comments. [RT #15814] 16013 16014 1974. [doc] List each of the zone types and associated zone 16015 options separately in the ARM. 16016 16017 1973. [func] TSIG HMACSHA1, HMACSHA224, HMACSHA256, HMACSHA384 and 16018 HMACSHA512 support. [RT #13606] 16019 16020 1972. [contrib] DBUS dynamic forwarders integration from 16021 Jason Vas Dias <jvdias (a] redhat.com>. 16022 16023 1971. [port] linux: make detection of missing IF_NAMESIZE more 16024 robust. [RT #15443] 16025 16026 1970. [bug] nsupdate: adjust UDP timeout when falling back to 16027 unsigned SOA query. [RT #15775] 16028 16029 1969. [bug] win32: the socket code was freeing the socket 16030 structure too early. [RT #15776] 16031 16032 1968. [bug] Missing lock in resolver.c:validated(). [RT #15739] 16033 16034 1967. [func] dig/nslookup/host: warn about missing "QR". [RT #15779] 16035 16036 1966. [bug] Don't set CD when we have fallen back to plain DNS. 16037 [RT #15727] 16038 16039 1965. [func] Suppress spurious "recursion requested but not 16040 available" warning with 'dig +qr'. [RT #15780]. 16041 16042 1964. [func] Separate out MX and SRV to CNAME checks. [RT #15723] 16043 16044 1963. [port] Tru64 4.0E doesn't support send() and recv(). 16045 [RT #15586] 16046 16047 1962. [bug] Named failed to clear old update-policy when it 16048 was removed. [RT #15491] 16049 16050 1961. [bug] Check the port and address of responses forwarded 16051 to dispatch. [RT #15474] 16052 16053 1960. [bug] Update code should set NSEC ttls from SOA MINIMUM. 16054 [RT #15465] 16055 16056 1959. [func] Control the zeroing of the negative response TTL to 16057 a soa query. Defaults "zero-no-soa-ttl yes;" and 16058 "zero-no-soa-ttl-cache no;". [RT #15460] 16059 16060 1958. [bug] Named failed to update the zone's secure state 16061 until the zone was reloaded. [RT #15412] 16062 16063 1957. [bug] Dig mishandled responses to class ANY queries. 16064 [RT #15402] 16065 16066 1956. [bug] Improve cross compile support, 'gen' is now built 16067 by native compiler. See README for additional 16068 cross compile support information. [RT #15148] 16069 16070 1955. [bug] Pre-allocate the cache cleaning iterator. [RT #14998] 16071 16072 1954. [func] Named now falls back to advertising EDNS with a 16073 512 byte receive buffer if the initial EDNS queries 16074 fail. [RT #14852] 16075 16076 1953. [func] The maximum EDNS UDP response named will send can 16077 now be set in named.conf (max-udp-size). This is 16078 independent of the advertised receive buffer 16079 (edns-udp-size). [RT #14852] 16080 16081 1952. [port] hpux: tell the linker to build a runtime link 16082 path "-Wl,+b:". [RT #14816]. 16083 16084 1951. [security] Drop queries from particular well known ports. 16085 Don't return FORMERR to queries from particular 16086 well known ports. [RT #15636] 16087 16088 1950. [port] Solaris 2.5.1 and earlier cannot bind() then connect() 16089 a TCP socket. This prevents the source address being 16090 set for TCP connections. [RT #15628] 16091 16092 1949. [func] Addition memory leakage checks. [RT #15544] 16093 16094 1948. [bug] If was possible to trigger a REQUIRE failure in 16095 xfrin.c:maybe_free() if named ran out of memory. 16096 [RT #15568] 16097 16098 1947. [func] It is now possible to configure named to accept 16099 expired RRSIGs. Default "dnssec-accept-expired no;". 16100 Setting "dnssec-accept-expired yes;" leaves named 16101 vulnerable to replay attacks. [RT #14685] 16102 16103 1946. [bug] resume_dslookup() could trigger a REQUIRE failure 16104 when using forwarders. [RT #15549] 16105 16106 1945. [cleanup] dnssec-keygen: RSA (RSAMD5) is no longer recommended. 16107 To generate a RSAMD5 key you must explicitly request 16108 RSAMD5. [RT #13780] 16109 16110 1944. [cleanup] isc_hash_create() does not need a read/write lock. 16111 [RT #15522] 16112 16113 1943. [bug] Set the loadtime after rolling forward the journal. 16114 [RT #15647] 16115 16116 1942. [bug] If the name of a DNSKEY match that of one in 16117 trusted-keys do not attempt to validate the DNSKEY 16118 using the parents DS RRset. [RT #15649] 16119 16120 1941. [bug] ncache_adderesult() should set eresult even if no 16121 rdataset is passed to it. [RT #15642] 16122 16123 1940. [bug] Fixed a number of error conditions reported by 16124 Coverity. 16125 16126 1939. [bug] The resolver could dereference a null pointer after 16127 validation if all the queries have timed out. 16128 [RT #15528] 16129 16130 1938. [bug] The validator was not correctly handling unsecure 16131 negative responses at or below a SEP. [RT #15528] 16132 16133 1937. [bug] sdlz doesn't handle RRSIG records. [RT #15564] 16134 16135 1936. [bug] The validator could leak memory. [RT #15544] 16136 16137 1935. [bug] 'acache' was DO sensitive. [RT #15430] 16138 16139 1934. [func] Validate pending NS RRsets, in the authority section, 16140 prior to returning them if it can be done without 16141 requiring DNSKEYs to be fetched. [RT #15430] 16142 16143 1933. [bug] dump_rdataset_raw() had a incorrect INSIST. [RT #15534] 16144 16145 1932. [bug] hpux: LDFLAGS was getting corrupted. [RT #15530] 16146 16147 1931. [bug] Per-client mctx could require a huge amount of memory, 16148 particularly for a busy caching server. [RT #15519] 16149 16150 1930. [port] HPUX: ia64 support. [RT #15473] 16151 16152 1929. [port] FreeBSD: extend use of PTHREAD_SCOPE_SYSTEM. 16153 16154 1928. [bug] Race in rbtdb.c:currentversion(). [RT #15517] 16155 16156 1927. [bug] Access to soanode or nsnode in rbtdb violated the 16157 lock order rule and could cause a dead lock. 16158 [RT #15518] 16159 16160 1926. [bug] The Windows installer did not check for empty 16161 passwords. BINDinstall was being installed in 16162 the wrong place. [RT #15483] 16163 16164 1925. [port] All outer level AC_TRY_RUNs need cross compiling 16165 defaults. [RT #15469] 16166 16167 1924. [port] libbind: hpux ia64 support. [RT #15473] 16168 16169 1923. [bug] ns_client_detach() called too early. [RT #15499] 16170 16171 1922. [bug] check-tool.c:setup_logging() missing call to 16172 dns_log_setcontext(). 16173 16174 1921. [bug] Client memory contexts were not using internal 16175 malloc. [RT #15434] 16176 16177 1920. [bug] The cache rbtdb lock array was too small to 16178 have the desired performance characteristics. 16179 [RT #15454] 16180 16181 1919. [contrib] queryperf: a set of new features: collecting/printing 16182 response delays, printing intermediate results, and 16183 adjusting query rate for the "target" qps. 16184 16185 1918. [bug] Memory leak when checking acls. [RT #15391] 16186 16187 1917. [doc] funcsynopsisinfo wasn't being treated as verbatim 16188 when generating man pages. [RT #15385] 16189 16190 1916. [func] Integrate contributed IDN code from JPNIC. [RT #15383] 16191 16192 1915. [bug] dig +ndots was broken. [RT #15215] 16193 16194 1914. [protocol] DS is required to accept mnemonic algorithms 16195 (RFC 4034). Still emit numeric algorithms for 16196 compatibility with RFC 3658. [RT #15354] 16197 16198 1913. [func] Integrate contributed DLZ code into named. [RT #11382] 16199 16200 1912. [port] aix: atomic locking for powerpc. [RT #15020] 16201 16202 1911. [bug] Update windows socket code. [RT #14965] 16203 16204 1910. [bug] dig's +sigchase code overhauled. [RT #14933] 16205 16206 1909. [bug] The DLV code has been re-worked to make no longer 16207 query order sensitive. [RT #14933] 16208 16209 1908. [func] dig now warns if 'RA' is not set in the answer when 16210 'RD' was set in the query. host/nslookup skip servers 16211 that fail to set 'RA' when 'RD' is set unless a server 16212 is explicitly set. [RT #15005] 16213 16214 1907. [func] host/nslookup now continue (default)/fail on SERVFAIL. 16215 [RT #15006] 16216 16217 1906. [func] dig now has a '-q queryname' and '+showsearch' options. 16218 [RT #15034] 16219 16220 1905. [bug] Strings returned from cfg_obj_asstring() should be 16221 treated as read-only. The prototype for 16222 cfg_obj_asstring() has been updated to reflect this. 16223 [RT #15256] 16224 16225 1904. [func] Automatic empty zone creation for D.F.IP6.ARPA and 16226 friends. Note: RFC 1918 zones are not yet covered by 16227 this but are likely to be in a future release. 16228 16229 New options: empty-server, empty-contact, 16230 empty-zones-enable and disable-empty-zone. 16231 16232 1903. [func] ISC string copy API. 16233 16234 1902. [func] Attempt to make the amount of work performed in a 16235 iteration self tuning. The covers nodes clean from 16236 the cache per iteration, nodes written to disk when 16237 rewriting a master file and nodes destroyed per 16238 iteration when destroying a zone or a cache. 16239 [RT #14996] 16240 16241 1901. [cleanup] Don't add DNSKEY records to the additional section. 16242 16243 1900. [bug] ixfr-from-differences failed to ensure that the 16244 serial number increased. [RT #15036] 16245 16246 1899. [func] named-checkconf now validates update-policy entries. 16247 [RT #14963] 16248 16249 1898. [bug] Extend ISC_SOCKADDR_FORMATSIZE and 16250 ISC_NETADDR_FORMATSIZE to allow for scope details. 16251 16252 1897. [func] x86 and x86_64 now have separate atomic locking 16253 implementations. 16254 16255 1896. [bug] Recursive clients soft quota support wasn't working 16256 as expected. [RT #15103] 16257 16258 1895. [bug] A escaped character is, potentially, converted to 16259 the output character set too early. [RT #14666] 16260 16261 1894. [doc] Review ARM for BIND 9.4. 16262 16263 1893. [port] Use uintptr_t if available. [RT #14606] 16264 16265 1892. [func] Support for SPF rdata type. [RT #15033] 16266 16267 1891. [port] freebsd: pthread_mutex_init can fail if it runs out 16268 of memory. [RT #14995] 16269 16270 1890. [func] Raise the UDP receive buffer size to 32k if it is 16271 less than 32k. [RT #14953] 16272 16273 1889. [port] sunos: non blocking i/o support. [RT #14951] 16274 16275 1888. [func] Support for IPSECKEY rdata type. [RT #14967] 16276 16277 1887. [bug] The cache could delete expired records too fast for 16278 clients with a virtual time in the past. [RT #14991] 16279 16280 1886. [bug] fctx_create() could return success even though it 16281 failed. [RT #14993] 16282 16283 1885. [func] dig: report the number of extra bytes still left in 16284 the packet after processing all the records. 16285 16286 1884. [cleanup] dighost.c: move external declarations into <dig/dig.h>. 16287 16288 1883. [bug] dnssec-signzone, dnssec-keygen: handle negative debug 16289 levels. [RT #14962] 16290 16291 1882. [func] Limit the number of recursive clients that can be 16292 waiting for a single query (<qname,qtype,qclass>) to 16293 resolve. New options clients-per-query and 16294 max-clients-per-query. 16295 16296 1881. [func] Add a system test for named-checkconf. [RT #14931] 16297 16298 1880. [func] The lame cache is now done on a <qname,qclass,qtype> 16299 basis as some servers only appear to be lame for 16300 certain query types. [RT #14916] 16301 16302 1879. [func] "USE INTERNAL MALLOC" is now runtime selectable. 16303 [RT #14892] 16304 16305 1878. [func] Detect duplicates of UDP queries we are recursing on 16306 and drop them. New stats category "duplicate". 16307 [RT #2471] 16308 16309 1877. [bug] Fix unreasonably low quantum on call to 16310 dns_rbt_destroy2(). Remove unnecessary unhash_node() 16311 call. [RT #14919] 16312 16313 1876. [func] Additional memory debugging support to track size 16314 and mctx arguments. [RT #14814] 16315 16316 1875. [bug] process_dhtkey() was using the wrong memory context 16317 to free some memory. [RT #14890] 16318 16319 1874. [port] sunos: portability fixes. [RT #14814] 16320 16321 1873. [port] win32: isc__errno2result() now reports its caller. 16322 [RT #13753] 16323 16324 1872. [port] win32: Handle ERROR_NETNAME_DELETED. [RT #13753] 16325 16326 1871. [placeholder] 16327 16328 1870. [func] Added framework for handling multiple EDNS versions. 16329 [RT #14873] 16330 16331 1869. [func] dig can now specify the EDNS version when making 16332 a query. [RT #14873] 16333 16334 1868. [func] edns-udp-size can now be overridden on a per 16335 server basis. [RT #14851] 16336 16337 1867. [bug] It was possible to trigger a INSIST in 16338 dlv_validatezonekey(). [RT #14846] 16339 16340 1866. [bug] resolv.conf parse errors were being ignored by 16341 dig/host/nslookup. [RT #14841] 16342 16343 1865. [bug] Silently ignore nameservers in /etc/resolv.conf with 16344 bad addresses. [RT #14841] 16345 16346 1864. [bug] Don't try the alternative transfer source if you 16347 got a answer / transfer with the main source 16348 address. [RT #14802] 16349 16350 1863. [bug] rrset-order "fixed" error messages not complete. 16351 16352 1862. [func] Add additional zone data constancy checks. 16353 named-checkzone has extended checking of NS, MX and 16354 SRV record and the hosts they reference. 16355 named has extended post zone load checks. 16356 New zone options: check-mx and integrity-check. 16357 [RT #4940] 16358 16359 1861. [bug] dig could trigger a INSIST on certain malformed 16360 responses. [RT #14801] 16361 16362 1860. [port] solaris 2.8: hack_shutup_pthreadmutexinit was 16363 incorrectly set. [RT #14775] 16364 16365 1859. [func] Add support for CH A record. [RT #14695] 16366 16367 1858. [bug] The flush-zones-on-shutdown option wasn't being 16368 parsed. [RT #14686] 16369 16370 1857. [bug] named could trigger a INSIST() if reconfigured / 16371 reloaded too fast. [RT #14673] 16372 16373 1856. [doc] Switch Docbook toolchain from DSSSL to XSL. 16374 [RT #11398] 16375 16376 1855. [bug] ixfr-from-differences was failing to detect changes 16377 of ttl due to dns_diff_subtract() was ignoring the ttl 16378 of records. [RT #14616] 16379 16380 1854. [bug] lwres also needs to know the print format for 16381 (long long). [RT #13754] 16382 16383 1853. [bug] Rework how DLV interacts with proveunsecure(). 16384 [RT #13605] 16385 16386 1852. [cleanup] Remove last vestiges of dnssec-signkey and 16387 dnssec-makekeyset (removed from Makefile years ago). 16388 16389 1851. [doc] Doxygen comment markup. [RT #11398] 16390 16391 1850. [bug] Memory leak in lwres_getipnodebyaddr(). [RT #14591] 16392 16393 1849. [doc] All forms of the man pages (docbook, man, html) should 16394 have consistent copyright dates. 16395 16396 1848. [bug] Improve SMF integration. [RT #13238] 16397 16398 1847. [bug] isc_ondestroy_init() is called too late in 16399 dns_rbtdb_create()/dns_rbtdb64_create(). 16400 [RT #13661] 16401 16402 1846. [contrib] query-loc-0.3.0 from Stephane Bortzmeyer 16403 <bortzmeyer (a] nic.fr>. 16404 16405 1845. [bug] Improve error reporting to distinguish between 16406 accept()/fcntl() and socket()/fcntl() errors. 16407 [RT #13745] 16408 16409 1844. [bug] inet_pton() accepted more that 4 hexadecimal digits 16410 for each 16 bit piece of the IPv6 address. The text 16411 representation of a IPv6 address has been tightened 16412 to disallow this (draft-ietf-ipv6-addr-arch-v4-02.txt). 16413 [RT #5662] 16414 16415 1843. [cleanup] CINCLUDES takes precedence over CFLAGS. This helps 16416 when CFLAGS contains "-I /usr/local/include" 16417 resulting in old header files being used. 16418 16419 1842. [port] cmsg_len() could produce incorrect results on 16420 some platform. [RT #13744] 16421 16422 1841. [bug] "dig +nssearch" now makes a recursive query to 16423 find the list of nameservers to query. [RT #13694] 16424 16425 1840. [func] dnssec-signzone can now randomize signature end times 16426 (dnssec-signzone -j jitter). [RT #13609] 16427 16428 1839. [bug] <isc/hash.h> was not being installed. 16429 16430 1838. [cleanup] Don't allow Linux capabilities to be inherited. 16431 [RT #13707] 16432 16433 1837. [bug] Compile time option ISC_FACILITY was not effective 16434 for 'named -u <user>'. [RT #13714] 16435 16436 1836. [cleanup] Silence compiler warnings in hash_test.c. 16437 16438 1835. [bug] Update dnssec-signzone's usage message. [RT #13657] 16439 16440 1834. [bug] Bad memset in rdata_test.c. [RT #13658] 16441 16442 1833. [bug] Race condition in isc_mutex_lock_profile(). [RT #13660] 16443 16444 1832. [bug] named fails to return BADKEY on unknown TSIG algorithm. 16445 [RT #13620] 16446 16447 1831. [doc] Update named-checkzone documentation. [RT #13604] 16448 16449 1830. [bug] adb lame cache has sense of test reversed. [RT #13600] 16450 16451 1829. [bug] win32: "pid-file none;" broken. [RT #13563] 16452 16453 1828. [bug] isc_rwlock_init() failed to properly cleanup if it 16454 encountered a error. [RT #13549] 16455 16456 1827. [bug] host: update usage message for '-a'. [RT #37116] 16457 16458 1826. [bug] Missing DESTROYLOCK() in isc_mem_createx() on out 16459 of memory error. [RT #13537] 16460 16461 1825. [bug] Missing UNLOCK() on out of memory error from in 16462 rbtdb.c:subtractrdataset(). [RT #13519] 16463 16464 1824. [bug] Memory leak on dns_zone_setdbtype() failure. 16465 [RT #13510] 16466 16467 1823. [bug] Wrong macro used to check for point to point interface. 16468 [RT #13418] 16469 16470 1822. [bug] check-names test for RT was reversed. [RT #13382] 16471 16472 1821. [placeholder] 16473 16474 1820. [bug] Gracefully handle acl loops. [RT #13659] 16475 16476 1819. [bug] The validator needed to check both the algorithm and 16477 digest types of the DS to determine if it could be 16478 used to introduce a secure zone. [RT #13593] 16479 16480 1818. [bug] 'named-checkconf -z' triggered an INSIST. [RT #13599] 16481 16482 1817. [func] Add support for additional zone file formats for 16483 improving loading performance. The masterfile-format 16484 option in named.conf can be used to specify a 16485 non-default format. A separate command 16486 named-compilezone was provided to generate zone files 16487 in the new format. Additionally, the -I and -O options 16488 for dnssec-signzone specify the input and output 16489 formats. 16490 16491 1816. [port] UnixWare: failed to compile lib/isc/unix/net.c. 16492 [RT #13597] 16493 16494 1815. [bug] nsupdate triggered a REQUIRE if the server was set 16495 without also setting the zone and it encountered 16496 a CNAME and was using TSIG. [RT #13086] 16497 16498 1814. [func] UNIX domain controls are now supported. 16499 16500 1813. [func] Restructured the data locking framework using 16501 architecture dependent atomic operations (when 16502 available), improving response performance on 16503 multi-processor machines significantly. 16504 x86, x86_64, alpha, powerpc, and mips are currently 16505 supported. 16506 16507 1812. [port] win32: IN6_IS_ADDR_UNSPECIFIED macro is incorrect. 16508 [RT #13453] 16509 16510 1811. [func] Preserve the case of domain names in rdata during 16511 zone transfers. [RT #13547] 16512 16513 1810. [bug] configure, lib/bind/configure make different default 16514 decisions about whether to do a threaded build. 16515 [RT #13212] 16516 16517 1809. [bug] "make distclean" failed for libbind if the platform 16518 is not supported. 16519 16520 1808. [bug] zone.c:notify_zone() contained a race condition, 16521 zone->db could change underneath it. [RT #13511] 16522 16523 1807. [bug] When forwarding (forward only) set the active domain 16524 from the forward zone name. [RT #13526] 16525 16526 1806. [bug] The resolver returned the wrong result when a CNAME / 16527 DNAME was encountered when fetching glue from a 16528 secure namespace. [RT #13501] 16529 16530 1805. [bug] Pending status was not being cleared when DLV was 16531 active. [RT #13501] 16532 16533 1804. [bug] Ensure that if we are queried for glue that it fits 16534 in the additional section or TC is set to tell the 16535 client to retry using TCP. [RT #10114] 16536 16537 1803. [bug] dnssec-signzone sometimes failed to remove old 16538 RRSIGs. [RT #13483] 16539 16540 1802. [bug] Handle connection resets better. [RT #11280] 16541 16542 1801. [func] Report differences between hints and real NS rrset 16543 and associated address records. 16544 16545 1800. [bug] Changes #1719 allowed a INSIST to be triggered. 16546 [RT #13428] 16547 16548 1799. [bug] 'rndc flushname' failed to flush negative cache 16549 entries. [RT #13438] 16550 16551 1798. [func] The server syntax has been extended to support a 16552 range of servers. [RT #11132] 16553 16554 1797. [func] named-checkconf now check acls to verify that they 16555 only refer to existing acls. [RT #13101] 16556 16557 1796. [func] "rndc freeze/thaw" now freezes/thaws all zones. 16558 16559 1795. [bug] "rndc dumpdb" was not fully documented. Minor 16560 formatting issues with "rndc dumpdb -all". [RT #13396] 16561 16562 1794. [func] Named and named-checkzone can now both check for 16563 non-terminal wildcard records. 16564 16565 1793. [func] Extend adjusting TTL warning messages. [RT #13378] 16566 16567 1792. [func] New zone option "notify-delay". Specify a minimum 16568 delay between sets of NOTIFY messages. 16569 16570 1791. [bug] 'host -t a' still printed out AAAA and MX records. 16571 [RT #13230] 16572 16573 1790. [cleanup] Move lib/dns/sec/dst up into lib/dns. This should 16574 allow parallel make to succeed. 16575 16576 1789. [bug] Prerequisite test for tkey and dnssec could fail 16577 with "configure --with-libtool". 16578 16579 1788. [bug] libbind9.la/libbind9.so needs to link against 16580 libisccfg.la/libisccfg.so. 16581 16582 1787. [port] HPUX: both "cc" and "gcc" need -Wl,+vnocompatwarnings. 16583 16584 1786. [port] AIX: libt_api needs to be taught to look for 16585 T_testlist in the main executable (--with-libtool). 16586 [RT #13239] 16587 16588 1785. [bug] libbind9.la/libbind9.so needs to link against 16589 libisc.la/libisc.so. 16590 16591 1784. [cleanup] "libtool -allow-undefined" is the default. 16592 Leave hooks in configure to allow it to be set 16593 if needed in the future. 16594 16595 1783. [cleanup] We only need one copy of libtool.m4, ltmain.sh in the 16596 source tree. 16597 16598 1782. [port] OSX: --with-libtool + --enable-libbind broke on 16599 __evOptMonoTime. [RT #13219] 16600 16601 1781. [port] FreeBSD 5.3: set PTHREAD_SCOPE_SYSTEM. [RT #12810] 16602 16603 1780. [bug] Update libtool to 1.5.10. 16604 16605 1779. [port] OSF 5.1: libtool didn't handle -pthread correctly. 16606 16607 1778. [port] HUX 11.11: fix broken IN6ADDR_ANY_INIT and 16608 IN6ADDR_LOOPBACK_INIT macros. 16609 16610 1777. [port] OSF 5.1: fix broken IN6ADDR_ANY_INIT and 16611 IN6ADDR_LOOPBACK_INIT macros. 16612 16613 1776. [port] Solaris 2.9: fix broken IN6ADDR_ANY_INIT and 16614 IN6ADDR_LOOPBACK_INIT macros. 16615 16616 1775. [bug] Only compile getnetent_r.c when threaded. [RT #13205] 16617 16618 1774. [port] Aix: Silence compiler warnings / build failures. 16619 [RT #13154] 16620 16621 1773. [bug] Fast retry on host / net unreachable. [RT #13153] 16622 16623 1772. [placeholder] 16624 16625 1771. [placeholder] 16626 16627 1770. [bug] named-checkconf failed to report missing a missing 16628 file clause for rbt{64} master/hint zones. [RT #13009] 16629 16630 1769. [port] win32: change compiler flags /MTd ==> /MDd, 16631 /MT ==> /MD. 16632 16633 1768. [bug] nsecnoexistnodata() could be called with a non-NSEC 16634 rdataset. [RT #12907] 16635 16636 1767. [port] Builds on IPv6 platforms without IPv6 Advanced API 16637 support for (struct in6_pktinfo) failed. [RT #13077] 16638 16639 1766. [bug] Update the master file timestamp on successful refresh 16640 as well as the journal's timestamp. [RT #13062] 16641 16642 1765. [bug] configure --with-openssl=auto failed. [RT #12937] 16643 16644 1764. [bug] dns_zone_replacedb failed to emit a error message 16645 if there was no SOA record in the replacement db. 16646 [RT #13016] 16647 16648 1763. [func] Perform sanity checks on NS records which refer to 16649 'in zone' names. [RT #13002] 16650 16651 1762. [bug] isc_interfaceiter_create() could return ISC_R_SUCCESS 16652 even when it failed. [RT #12995] 16653 16654 1761. [bug] 'rndc dumpdb' didn't report unassociated entries. 16655 [RT #12971] 16656 16657 1760. [bug] Host / net unreachable was not penalising rtt 16658 estimates. [RT #12970] 16659 16660 1759. [bug] Named failed to startup if the OS supported IPv6 16661 but had no IPv6 interfaces configured. [RT #12942] 16662 16663 1758. [func] Don't send notify messages to self. [RT #12933] 16664 16665 1757. [func] host now can turn on memory debugging flags with '-m'. 16666 16667 1756. [func] named-checkconf now checks the logging configuration. 16668 [RT #12352] 16669 16670 1755. [func] allow-update is now settable at the options / view 16671 level. [RT #6636] 16672 16673 1754. [bug] We weren't always attempting to query the parent 16674 server for the DS records at the zone cut. 16675 [RT #12774] 16676 16677 1753. [bug] Don't serve a slave zone which has no NS records. 16678 [RT #12894] 16679 16680 1752. [port] Move isc_app_start() to after ns_os_daemonise() 16681 as some fork() implementations unblock the signals 16682 that are blocked by isc_app_start(). [RT #12810] 16683 16684 1751. [bug] --enable-getifaddrs failed under linux. [RT #12867] 16685 16686 1750. [port] lib/bind/make/rules.in:subdirs was not bash friendly. 16687 [RT #12864] 16688 16689 .. code-block:: none 16690 16691 1749. [bug] 'check-names response ignore;' failed to ignore. 16692 [RT #12866] 16693 16694 1748. [func] dig now returns the byte count for axfr/ixfr. 16695 16696 1747. [bug] BIND 8 compatibility: named/named-checkconf failed 16697 to parse "host-statistics-max" in named.conf. 16698 16699 1746. [func] Make public the function to read a key file, 16700 dst_key_read_public(). [RT #12450] 16701 16702 1745. [bug] Dig/host/nslookup accept replies from link locals 16703 regardless of scope if no scope was specified when 16704 query was sent. [RT #12745] 16705 16706 1744. [bug] If tuple2msgname() failed to convert a tuple to 16707 a name a REQUIRE could be triggered. [RT #12796] 16708 16709 1743. [bug] If isc_taskmgr_create() was not able to create the 16710 requested number of worker threads then destruction 16711 of the manager would trigger an INSIST() failure. 16712 [RT #12790] 16713 16714 1742. [bug] Deleting all records at a node then adding a 16715 previously existing record, in a single UPDATE 16716 transaction, failed to leave / regenerate the 16717 associated RRSIG records. [RT #12788] 16718 16719 1741. [bug] Deleting all records at a node in a secure zone 16720 using a update-policy grant failed. [RT #12787] 16721 16722 1740. [bug] Replace rbt's hash algorithm as it performed badly 16723 with certain zones. [RT #12729] 16724 16725 NOTE: a hash context now needs to be established 16726 via isc_hash_create() if the application was not 16727 already doing this. 16728 16729 1739. [bug] dns_rbt_deletetree() could incorrectly return 16730 ISC_R_QUOTA. [RT #12695] 16731 16732 1738. [bug] Enable overrun checking by default. [RT #12695] 16733 16734 1737. [bug] named failed if more than 16 masters were specified. 16735 [RT #12627] 16736 16737 1736. [bug] dst_key_fromnamedfile() could fail to read a 16738 public key. [RT #12687] 16739 16740 1735. [bug] 'dig +sigtrace' could die with a REQUIRE failure. 16741 [RE #12688] 16742 16743 1734. [cleanup] 'rndc-confgen -a -t' remove extra '/' in path. 16744 [RT #12588] 16745 16746 1733. [bug] Return non-zero exit status on initial load failure. 16747 [RT #12658] 16748 16749 1732. [bug] 'rrset-order name "*"' wasn't being applied to ".". 16750 [RT #12467] 16751 16752 1731. [port] darwin: relax version test in ifconfig.sh. 16753 [RT #12581] 16754 16755 1730. [port] Determine the length type used by the socket API. 16756 [RT #12581] 16757 16758 1729. [func] Improve check-names error messages. 16759 16760 1728. [doc] Update check-names documentation. 16761 16762 1727. [bug] named-checkzone: check-names support didn't match 16763 documentation. 16764 16765 1726. [port] aix5: add support for aix5. 16766 16767 1725. [port] linux: update error message on interaction of threads, 16768 capabilities and setuid support (named -u). [RT #12541] 16769 16770 1724. [bug] Look for DNSKEY records with "dig +sigtrace". 16771 [RT #12557] 16772 16773 1723. [cleanup] Silence compiler warnings from t_tasks.c. [RT #12493] 16774 16775 1722. [bug] Don't commit the journal on malformed ixfr streams. 16776 [RT #12519] 16777 16778 1721. [bug] Error message from the journal processing were not 16779 always identifying the relevant journal. [RT #12519] 16780 16781 1720. [bug] 'dig +chase' did not terminate on a RFC 2308 Type 1 16782 negative response. [RT #12506] 16783 16784 1719. [bug] named was not correctly caching a RFC 2308 Type 1 16785 negative response. [RT #12506] 16786 16787 1718. [bug] nsupdate was not handling RFC 2308 Type 3 negative 16788 responses when looking for the zone / master server. 16789 [RT #12506] 16790 16791 1717. [port] solaris: ifconfig.sh did not support Solaris 10. 16792 "ifconfig.sh down" didn't work for Solaris 9. 16793 16794 1716. [doc] named.conf(5) was being installed in the wrong 16795 location. [RT #12441] 16796 16797 1715. [func] 'dig +trace' now randomly selects the next servers 16798 to try. Report if there is a bad delegation. 16799 16800 1714. [bug] dig/host/nslookup were only trying the first 16801 address when a nameserver was specified by name. 16802 [RT #12286] 16803 16804 1713. [port] linux: extend capset failure message to say: 16805 please ensure that the capset kernel module is 16806 loaded. see insmod(8) 16807 16808 1712. [bug] Missing FULLCHECK for "trusted-key" in dig. 16809 16810 1711. [func] 'rndc unfreeze' has been deprecated by 'rndc thaw'. 16811 16812 1710. [func] 'rndc notify zone [class [view]]' resend the NOTIFY 16813 messages for the specified zone. [RT #9479] 16814 16815 1709. [port] solaris: add SMF support from Sun. 16816 16817 1708. [cleanup] Replaced dns_fullname_hash() with dns_name_fullhash() 16818 for conformance to the name space convention. Binary 16819 backward compatibility to the old function name is 16820 provided. [RT #12376] 16821 16822 1707. [contrib] sdb/ldap updated to version 1.0-beta. 16823 16824 1706. [bug] 'rndc stop' failed to cause zones to be flushed 16825 sometimes. [RT #12328] 16826 16827 1705. [func] Allow the journal's name to be changed via named.conf. 16828 16829 1704. [port] lwres needed a snprintf() implementation for 16830 platforms without snprintf(). Add missing 16831 "#include <isc/print.h>". [RT #12321] 16832 16833 1703. [bug] named would loop sending NOTIFY messages when it 16834 failed to receive a response. [RT #12322] 16835 16836 1702. [bug] also-notify should not be applied to built in zones. 16837 [RT #12323] 16838 16839 1701. [doc] A minimal named.conf man page. 16840 16841 1700. [func] nslookup is no longer to be treated as deprecated. 16842 Remove "deprecated" warning message. Add man page. 16843 16844 1699. [bug] dnssec-signzone can generate "not exact" errors 16845 when resigning. [RT #12281] 16846 16847 1698. [doc] Use reserved IPv6 documentation prefix. 16848 16849 1697. [bug] xxx-source{,-v6} was not effective when it 16850 specified one of listening addresses and a 16851 different port than the listening port. [RT #12257] 16852 16853 1696. [bug] dnssec-signzone failed to clean out nodes that 16854 consisted of only NSEC and RRSIG records. 16855 [RT #12154] 16856 16857 1695. [bug] DS records when forwarding require special handling. 16858 [RT #12133] 16859 16860 1694. [bug] Report if the builtin views of "_default" / "_bind" 16861 are defined in named.conf. [RT #12023] 16862 16863 1693. [bug] max-journal-size was not effective for master zones 16864 with ixfr-from-differences set. [RT #12024] 16865 16866 1692. [bug] Don't set -I, -L and -R flags when libcrypto is in 16867 /usr/lib. [RT #11971] 16868 16869 1691. [bug] sdb's attachversion was not complete. [RT #11990] 16870 16871 1690. [bug] Delay detaching view from the client until UPDATE 16872 processing completes when shutting down. [RT #11714] 16873 16874 1689. [bug] DNS_NAME_TOREGION() and DNS_NAME_SPLIT() macros 16875 contained gratuitous semicolons. [RT #11707] 16876 16877 1688. [bug] LDFLAGS was not supported. 16878 16879 1687. [bug] Race condition in dispatch. [RT #10272] 16880 16881 1686. [bug] Named sent a extraneous NOTIFY when it received a 16882 redundant UPDATE request. [RT #11943] 16883 16884 1685. [bug] Change #1679 loop tests weren't quite right. 16885 16886 1684. [func] ixfr-from-differences now takes master and slave in 16887 addition to yes and no at the options and view levels. 16888 16889 1683. [bug] dig +sigchase could leak memory. [RT #11445] 16890 16891 1682. [port] Update configure test for (long long) printf format. 16892 [RT #5066] 16893 16894 1681. [bug] Only set SO_REUSEADDR when a port is specified in 16895 isc_socket_bind(). [RT #11742] 16896 16897 1680. [func] rndc: the source address can now be specified. 16898 16899 1679. [bug] When there was a single nameserver with multiple 16900 addresses for a zone not all addresses were tried. 16901 [RT #11706] 16902 16903 1678. [bug] RRSIG should use TYPEXXXXX for unknown types. 16904 16905 1677. [bug] dig: +aaonly didn't work, +aaflag undocumented. 16906 16907 1676. [func] New option "allow-query-cache". This lets 16908 allow-query be used to specify the default zone 16909 access level rather than having to have every 16910 zone override the global value. allow-query-cache 16911 can be set at both the options and view levels. 16912 If allow-query-cache is not set allow-query applies. 16913 16914 1675. [bug] named would sometimes add extra NSEC records to 16915 the authority section. 16916 16917 1674. [port] linux: increase buffer size used to scan 16918 /proc/net/if_inet6. 16919 16920 1673. [port] linux: issue a error messages if IPv6 interface 16921 scans fails. 16922 16923 1672. [cleanup] Tests which only function in a threaded build 16924 now return R:THREADONLY (rather than R:UNTESTED) 16925 in a non-threaded build. 16926 16927 1671. [contrib] queryperf: add NAPTR to the list of known types. 16928 16929 1670. [func] Log UPDATE requests to slave zones without an acl as 16930 "disabled" at debug level 3. [RT #11657] 16931 16932 1669. [placeholder] 16933 16934 1668. [bug] DIG_SIGCHASE was making bin/dig/host dump core. 16935 16936 1667. [port] linux: not all versions have IF_NAMESIZE. 16937 16938 1666. [bug] The optional port on hostnames in dual-stack-servers 16939 was being ignored. 16940 16941 1665. [func] rndc now allows addresses to be set in the 16942 server clauses. 16943 16944 1664. [bug] nsupdate needed KEY for SIG(0), not DNSKEY. 16945 16946 1663. [func] Look for OpenSSL by default. 16947 16948 1662. [bug] Change #1658 failed to change one use of 'type' 16949 to 'keytype'. 16950 16951 1661. [bug] Restore dns_name_concatenate() call in 16952 adb.c:set_target(). [RT #11582] 16953 16954 1660. [bug] win32: connection_reset_fix() was being called 16955 unconditionally. [RT #11595] 16956 16957 1659. [cleanup] Cleanup some messages that were referring to KEY vs 16958 DNSKEY, NXT vs NSEC and SIG vs RRSIG. 16959 16960 1658. [func] Update dnssec-keygen to default to KEY for HMAC-MD5 16961 and DH. Tighten which options apply to KEY and 16962 DNSKEY records. 16963 16964 1657. [doc] ARM: document query log output. 16965 16966 1656. [doc] Update DNSSEC description in ARM to cover DS, NSEC 16967 DNSKEY and RRSIG. [RT #11542] 16968 16969 1655. [bug] Logging multiple versions w/o a size was broken. 16970 [RT #11446] 16971 16972 1654. [bug] isc_result_totext() contained array bounds read 16973 error. 16974 16975 1653. [func] Add key type checking to dst_key_fromfilename(), 16976 DST_TYPE_KEY should be used to read TSIG, TKEY and 16977 SIG(0) keys. 16978 16979 1652. [bug] TKEY still uses KEY. 16980 16981 1651. [bug] dig: process multiple dash options. 16982 16983 1650. [bug] dig, nslookup: flush standard out after each command. 16984 16985 1649. [bug] Silence "unexpected non-minimal diff" message. 16986 [RT #11206] 16987 16988 1648. [func] Update dnssec-lookaside named.conf syntax to support 16989 multiple dnssec-lookaside namespaces (not yet 16990 implemented). 16991 16992 1647. [bug] It was possible trigger a INSIST when chasing a DS 16993 record that required walking back over a empty node. 16994 [RT #11445] 16995 16996 1646. [bug] win32: logging file versions didn't work with 16997 non-UNC filenames. [RT #11486] 16998 16999 1645. [bug] named could trigger a REQUIRE failure if multiple 17000 masters with keys are specified. 17001 17002 1644. [bug] Update the journal modification time after a 17003 successful refresh query. [RT #11436] 17004 17005 1643. [bug] dns_db_closeversion() could leak memory / node 17006 references. [RT #11163] 17007 17008 1642. [port] Support OpenSSL implementations which don't have 17009 DSA support. [RT #11360] 17010 17011 1641. [bug] Update the check-names description in ARM. [RT #11389] 17012 17013 1640. [bug] win32: isc_socket_cancel(ISC_SOCKCANCEL_ACCEPT) was 17014 incorrectly closing the socket. [RT #11291] 17015 17016 1639. [func] Initial dlv system test. 17017 17018 1638. [bug] "ixfr-from-differences" could generate a REQUIRE 17019 failure if the journal open failed. [RT #11347] 17020 17021 1637. [bug] Node reference leak on error in addnoqname(). 17022 17023 1636. [bug] The dump done callback could get ISC_R_SUCCESS even if 17024 a error had occurred. The database version no longer 17025 matched the version of the database that was dumped. 17026 17027 1635. [bug] Memory leak on error in query_addds(). 17028 17029 1634. [bug] named didn't supply a useful error message when it 17030 detected duplicate views. [RT #11208] 17031 17032 1633. [bug] named should return NOTIMP to update requests to a 17033 slaves without a allow-update-forwarding acl specified. 17034 [RT #11331] 17035 17036 1632. [bug] nsupdate failed to send prerequisite only UPDATE 17037 messages. [RT #11288] 17038 17039 1631. [bug] dns_journal_compact() could sometimes corrupt the 17040 journal. [RT #11124] 17041 17042 1630. [contrib] queryperf: add support for IPv6 transport. 17043 17044 1629. [func] dig now supports IPv6 scoped addresses with the 17045 extended format in the local-server part. [RT #8753] 17046 17047 1628. [bug] Typo in Compaq Trucluster support. [RT #11264] 17048 17049 1627. [bug] win32: sockets were not being closed when the 17050 last external reference was removed. [RT #11179] 17051 17052 1626. [bug] --enable-getifaddrs was broken. [RT #11259] 17053 17054 1625. [bug] named failed to load/transfer RFC2535 signed zones 17055 which contained CNAMES. [RT #11237] 17056 17057 1624. [bug] zonemgr_putio() call should be locked. [RT #11163] 17058 17059 1623. [bug] A serial number of zero was being displayed in the 17060 "sending notifies" log message when also-notify was 17061 used. [RT #11177] 17062 17063 1622. [func] probe the system to see if IPV6_(RECV)PKTINFO is 17064 available, and suppress wildcard binding if not. 17065 17066 1621. [bug] match-destinations did not work for IPv6 TCP queries. 17067 [RT #11156] 17068 17069 1620. [func] When loading a zone report if it is signed. [RT #11149] 17070 17071 1619. [bug] Missing ISC_LIST_UNLINK in end_reserved_dispatches(). 17072 [RT #11118] 17073 17074 1618. [bug] Fencepost errors in dns_name_ishostname() and 17075 dns_name_ismailbox() could trigger a INSIST(). 17076 17077 1617. [port] win32: VC++ 6.0 support. 17078 17079 1616. [compat] Ensure that named's version is visible in the core 17080 dump. [RT #11127] 17081 17082 1615. [port] Define ISC_SOCKADDR_LEN_T based on _BSD_SOCKLEN_T_ if 17083 it is defined. 17084 17085 1614. [port] win32: silence resource limit messages. [RT #11101] 17086 17087 1613. [bug] Builds would fail on machines w/o a if_nametoindex(). 17088 Missing #ifdef ISC_PLATFORM_HAVEIFNAMETOINDEX/#endif. 17089 [RT #11119] 17090 17091 1612. [bug] check-names at the option/view level could trigger 17092 an INSIST. [RT #11116] 17093 17094 1611. [bug] solaris: IPv6 interface scanning failed to cope with 17095 no active IPv6 interfaces. 17096 17097 1610. [bug] On dual stack machines "dig -b" failed to set the 17098 address type to be looked up with "@server". 17099 [RT #11069] 17100 17101 1609. [func] dig now has support to chase DNSSEC signature chains. 17102 Requires -DDIG_SIGCHASE=1 to be set in STD_CDEFINES. 17103 17104 DNSSEC validation code in dig coded by Olivier Courtay 17105 (olivier.courtay (a] irisa.fr) for the IDsA project 17106 (http://idsa.irisa.fr). 17107 17108 1608. [func] dig and host now accept -4/-6 to select IP transport 17109 to use when making queries. 17110 17111 1607. [bug] dig, host and nslookup were still using random() 17112 to generate query ids. [RT #11013] 17113 17114 1606. [bug] DLV insecurity proof was failing. 17115 17116 1605. [func] New dns_db_find() option DNS_DBFIND_COVERINGNSEC. 17117 17118 1604. [bug] A xfrout_ctx_create() failure would result in 17119 xfrout_ctx_destroy() being called with a 17120 partially initialized structure. 17121 17122 1603. [bug] nsupdate: set interactive based on isatty(). 17123 [RT #10929] 17124 17125 1602. [bug] Logging to a file failed unless a size was specified. 17126 [RT #10925] 17127 17128 1601. [bug] Silence spurious warning 'both "recursion no;" and 17129 "allow-recursion" active' warning from view "_bind". 17130 [RT #10920] 17131 17132 1600. [bug] Duplicate zone pre-load checks were not case 17133 insensitive. 17134 17135 1599. [bug] Fix memory leak on error path when checking named.conf. 17136 17137 1598. [func] Specify that certain parts of the namespace must 17138 be secure (dnssec-must-be-secure). 17139 17140 1597. [func] Allow notify-source and query-source to be specified 17141 on a per server basis similar to transfer-source. 17142 [RT #6496] 17143 17144 1596. [func] Accept 'notify-source' style syntax for query-source. 17145 17146 1595. [func] New notify type 'master-only'. Enable notify for 17147 master zones only. 17148 17149 1594. [bug] 'rndc dumpdb' could prevent named from answering 17150 queries while the dump was in progress. [RT #10565] 17151 17152 1593. [bug] rndc should return "unknown command" to unknown 17153 commands. [RT #10642] 17154 17155 1592. [bug] configure_view() could leak a dispatch. [RT #10675] 17156 17157 1591. [bug] libbind: updated to BIND 8.4.5. 17158 17159 1590. [port] netbsd: update thread support. 17160 17161 1589. [func] DNSSEC lookaside validation. 17162 17163 1588. [bug] win32: TCP sockets could become blocked. [RT #10115] 17164 17165 1587. [bug] dns_message_settsigkey() failed to clear existing key. 17166 [RT #10590] 17167 17168 1586. [func] "check-names" is now implemented. 17169 17170 1585. [placeholder] 17171 17172 1584. [bug] "make test" failed with a read only source tree. 17173 [RT #10461] 17174 17175 1583. [bug] Records add via UPDATE failed to get the correct trust 17176 level. [RT #10452] 17177 17178 1582. [bug] rrset-order failed to work on RRsets with more 17179 than 32 elements. [RT #10381] 17180 17181 1581. [func] Disable DNSSEC support by default. To enable 17182 DNSSEC specify "dnssec-enable yes;" in named.conf. 17183 17184 1580. [bug] Zone destruction on final detach takes a long time. 17185 [RT #3746] 17186 17187 1579. [bug] Multiple task managers could not be created. 17188 17189 1578. [bug] Don't use CLASS E IPv4 addresses when resolving. 17190 [RT #10346] 17191 17192 1577. [bug] Use isc_uint32_t in ultrasparc optimizer bug 17193 workaround code. [RT #10331] 17194 17195 1576. [bug] Race condition in dns_dispatch_addresponse(). 17196 [RT #10272] 17197 17198 1575. [func] Log TSIG name on TSIG verify failure. [RT #4404] 17199 17200 1574. [bug] Don't attempt to open the controls socket(s) when 17201 running tests. [RT #9091] 17202 17203 1573. [port] linux: update to libtool 1.5.2 so that 17204 "make install DESTDIR=/xx" works with 17205 "configure --with-libtool". [RT #9941] 17206 17207 1572. [bug] nsupdate: sign the soa query to find the enclosing 17208 zone if the server is specified. [RT #10148] 17209 17210 1571. [bug] rbt:hash_node() could fail leaving the hash table 17211 in an inconsistent state. [RT #10208] 17212 17213 1570. [bug] nsupdate failed to handle classes other than IN. 17214 New keyword 'class' which sets the default class. 17215 [RT #10202] 17216 17217 1569. [func] nsupdate new command 'answer' which displays the 17218 complete answer message to the last update. 17219 17220 1568. [bug] nsupdate now reports that the update failed in 17221 interactive mode. [RT #10236] 17222 17223 1567. [maint] B.ROOT-SERVERS.NET is now 192.228.79.201. 17224 17225 1566. [port] Support for the cmsg framework on Solaris and HP/UX. 17226 This also solved the problem that match-destinations 17227 for IPv6 addresses did not work on these systems. 17228 [RT #10221] 17229 17230 1565. [bug] CD flag should be copied to outgoing queries unless 17231 the query is under a secure entry point in which case 17232 CD should be set. 17233 17234 1564. [func] Attempt to provide a fallback entropy source to be 17235 used if named is running chrooted and named is unable 17236 to open entropy source within the chroot area. 17237 [RT #10133] 17238 17239 1563. [bug] Gracefully fail when unable to obtain neither an IPv4 17240 nor an IPv6 dispatch. [RT #10230] 17241 17242 1562. [bug] isc_socket_create() and isc_socket_accept() could 17243 leak memory under error conditions. [RT #10230] 17244 17245 1561. [bug] It was possible to release the same name twice if 17246 named ran out of memory. [RT #10197] 17247 17248 1560. [port] FreeBSD: work around FreeBSD 5.2 mapping EAI_NODATA 17249 and EAI_NONAME to the same value. 17250 17251 1559. [port] named should ignore SIGFSZ. 17252 17253 1558. [func] New DNSSEC 'disable-algorithms'. Support entry into 17254 child zones for which we don't have a supported 17255 algorithm. Such child zones are treated as unsigned. 17256 17257 1557. [func] Implement missing DNSSEC tests for 17258 * NOQNAME proof with wildcard answers. 17259 * NOWILDARD proof with NXDOMAIN. 17260 Cache and return NOQNAME with wildcard answers. 17261 17262 1556. [bug] nsupdate now treats all names as fully qualified. 17263 [RT #6427] 17264 17265 1555. [func] 'rrset-order cyclic' no longer has a random starting 17266 point per query. [RT #7572] 17267 17268 1554. [bug] dig, host, nslookup failed when no nameservers 17269 were specified in /etc/resolv.conf. [RT #8232] 17270 17271 1553. [bug] The windows socket code could stop accepting 17272 connections. [RT #10115] 17273 17274 1552. [bug] Accept NOTIFY requests from mapped masters if 17275 matched-mapped is set. [RT #10049] 17276 17277 1551. [port] Open "/dev/null" before calling chroot(). 17278 17279 1550. [port] Call tzset(), if available, before calling chroot(). 17280 17281 1549. [func] named-checkzone can now write out the zone contents 17282 in a easily parsable format (-D and -o). 17283 17284 1548. [bug] When parsing APL records it was possible to silently 17285 accept out of range ADDRESSFAMILY values. [RT #9979] 17286 17287 1547. [bug] Named wasted memory recording duplicate lame zone 17288 entries. [RT #9341] 17289 17290 1546. [bug] We were rejecting valid secure CNAME to negative 17291 answers. 17292 17293 1545. [bug] It was possible to leak memory if named was unable to 17294 bind to the specified transfer source and TSIG was 17295 being used. [RT #10120] 17296 17297 1544. [bug] Named would logged a single entry to a file despite it 17298 being over the specified size limit. 17299 17300 1543. [bug] Logging using "versions unlimited" did not work. 17301 17302 1542. [placeholder] 17303 17304 1541. [func] NSEC now uses new bitmap format. 17305 17306 1540. [bug] "rndc reload <dynamiczone>" was silently accepted. 17307 [RT #8934] 17308 17309 1539. [bug] Open UDP sockets for notify-source and transfer-source 17310 that use reserved ports at startup. [RT #9475] 17311 17312 1538. [placeholder] rt9997 17313 17314 1537. [func] New option "querylog". If set specify whether query 17315 logging is to be enabled or disabled at startup. 17316 17317 1536. [bug] Windows socket code failed to log a error description 17318 when returning ISC_R_UNEXPECTED. [RT #9998] 17319 17320 1535. [placeholder] 17321 17322 1534. [bug] Race condition when priming cache. [RT #9940] 17323 17324 1533. [func] Warn if both "recursion no;" and "allow-recursion" 17325 are active. [RT #4389] 17326 17327 1532. [port] netbsd: the configure test for <sys/sysctl.h> 17328 requires <sys/param.h>. 17329 17330 1531. [port] AIX more libtool fixes. 17331 17332 1530. [bug] It was possible to trigger a INSIST() failure if a 17333 slave master file was removed at just the correct 17334 moment. [RT #9462] 17335 17336 1529. [bug] "notify explicit;" failed to log that NOTIFY messages 17337 were being sent for the zone. [RT #9442] 17338 17339 1528. [cleanup] Simplify some dns_name_ functions based on the 17340 deprecation of bitstring labels. 17341 17342 1527. [cleanup] Reduce the number of gettimeofday() calls without 17343 losing necessary timer granularity. 17344 17345 1526. [func] Implemented "additional section caching (or acache)", 17346 an internal cache framework for additional section 17347 content to improve response performance. Several 17348 configuration options were provided to control the 17349 behavior. 17350 17351 1525. [bug] dns_cache_create() could trigger a REQUIRE 17352 failure in isc_mem_put() during error cleanup. 17353 [RT #9360] 17354 17355 1524. [port] AIX needs to be able to resolve all symbols when 17356 creating shared libraries (--with-libtool). 17357 17358 1523. [bug] Fix race condition in rbtdb. [RT #9189] 17359 17360 1522. [bug] dns_db_findnode() relax the requirements on 'name'. 17361 [RT #9286] 17362 17363 1521. [bug] dns_view_createresolver() failed to check the 17364 result from isc_mem_create(). [RT #9294] 17365 17366 1520. [protocol] Add SSHFP (SSH Finger Print) type. 17367 17368 1519. [bug] dnssec-signzone:nsec_setbit() computed the wrong 17369 length of the new bitmap. 17370 17371 1518. [bug] dns_nsec_buildrdata(), and hence dns_nsec_build(), 17372 contained a off-by-one error when working out the 17373 number of octets in the bitmap. 17374 17375 1517. [port] Support for IPv6 interface scanning on HP/UX and 17376 TrueUNIX 5.1. 17377 17378 1516. [func] Roll the DNSSEC types to RRSIG, NSEC and DNSKEY. 17379 17380 1515. [func] Allow transfer source to be set in a server statement. 17381 [RT #6496] 17382 17383 1514. [bug] named: isc_hash_destroy() was being called too early. 17384 [RT #9160] 17385 17386 1513. [doc] Add "US" to root-delegation-only exclude list. 17387 17388 1512. [bug] Extend the delegation-only logging to return query 17389 type, class and responding nameserver. 17390 17391 1511. [bug] delegation-only was generating false positives 17392 on negative answers from sub-zones. 17393 17394 1510. [func] New view option "root-delegation-only". Apply 17395 delegation-only check to all TLDs and root. 17396 Note there are some TLDs that are NOT delegation 17397 only (e.g. DE, LV, US and MUSEUM) these can be excluded 17398 from the checks by using exclude. 17399 17400 root-delegation-only exclude { 17401 "DE"; "LV"; "US"; "MUSEUM"; 17402 }; 17403 17404 1509. [bug] Hint zones should accept delegation-only. Forward 17405 zone should not accept delegation-only. 17406 17407 1508. [bug] Don't apply delegation-only checks to answers from 17408 forwarders. 17409 17410 1507. [bug] Handle BIND 8 style returns to NS queries to parents 17411 when making delegation-only checks. 17412 17413 1506. [bug] Wrong return type for dns_view_isdelegationonly(). 17414 17415 1505. [bug] Uninitialized rdataset in sdb. [RT #8750] 17416 17417 1504. [func] New zone type "delegation-only". 17418 17419 1503. [port] win32: install libeay32.dll outside of system32. 17420 17421 1502. [bug] nsupdate: adjust timeouts for UPDATE requests over TCP. 17422 17423 1501. [func] Allow TCP queue length to be specified via 17424 named.conf, tcp-listen-queue. 17425 17426 1500. [bug] host failed to lookup MX records. Also look up 17427 AAAA records. 17428 17429 .. code-block:: none 17430 17431 1499. [bug] isc_random need to be seeded better if arc4random() 17432 is not used. 17433 17434 1498. [port] bsdos: 5.x support. 17435 17436 1497. [placeholder] 17437 17438 1496. [port] test for pthread_attr_setstacksize(). 17439 17440 1495. [cleanup] Replace hash functions with universal hash. 17441 17442 1494. [security] Turn on RSA BLINDING as a precaution. 17443 17444 1493. [placeholder] 17445 17446 1492. [cleanup] Preserve rwlock quota context when upgrading / 17447 downgrading. [RT #5599] 17448 17449 1491. [bug] dns_master_dump*() would produce extraneous $ORIGIN 17450 lines. [RT #6206] 17451 17452 1490. [bug] Accept reading state as well as working state in 17453 ns_client_next(). [RT #6813] 17454 17455 1489. [compat] Treat 'allow-update' on slave zones as a warning. 17456 [RT #3469] 17457 17458 1488. [bug] Don't override trust levels for glue addresses. 17459 [RT #5764] 17460 17461 1487. [bug] A REQUIRE() failure could be triggered if a zone was 17462 queued for transfer and the zone was then removed. 17463 [RT #6189] 17464 17465 1486. [bug] isc_print_snprintf() '%%' consumed one too many format 17466 characters. [RT #8230] 17467 17468 1485. [bug] gen failed to handle high type values. [RT #6225] 17469 17470 1484. [bug] The number of records reported after a AXFR was wrong. 17471 [RT #6229] 17472 17473 1483. [bug] dig axfr failed if the message id in the answer failed 17474 to match that in the request. Only the id in the first 17475 message is required to match. [RT #8138] 17476 17477 1482. [bug] named could fail to start if the kernel supports 17478 IPv6 but no interfaces are configured. Similarly 17479 for IPv4. [RT #6229] 17480 17481 1481. [bug] Refresh and stub queries failed to use masters keys 17482 if specified. [RT #7391] 17483 17484 1480. [bug] Provide replay protection for rndc commands. Full 17485 replay protection requires both rndc and named to 17486 be updated. Partial replay protection (limited 17487 exposure after restart) is provided if just named 17488 is updated. 17489 17490 1479. [bug] cfg_create_tuple() failed to handle out of 17491 memory cleanup. parse_list() would leak memory 17492 on syntax errors. 17493 17494 1478. [port] ifconfig.sh didn't account for other virtual 17495 interfaces. It now takes a optional argument 17496 to specify the first interface number. [RT #3907] 17497 17498 1477. [bug] memory leak using stub zones and TSIG. 17499 17500 1476. [placeholder] 17501 17502 1475. [port] Probe for old sprintf(). 17503 17504 1474. [port] Provide strtoul() and memmove() for platforms 17505 without them. 17506 17507 1473. [bug] create_map() and create_string() failed to handle out 17508 of memory cleanup. [RT #6813] 17509 17510 1472. [contrib] idnkit-1.0 from JPNIC, replaces mdnkit. 17511 17512 1471. [bug] libbind: updated to BIND 8.4.0. 17513 17514 1470. [bug] Incorrect length passed to snprintf. [RT #5966] 17515 17516 1469. [func] Log end of outgoing zone transfer at same level 17517 as the start of transfer is logged. [RT #4441] 17518 17519 1468. [func] Internal zones are no longer counted for 17520 'rndc status'. [RT #4706] 17521 17522 1467. [func] $GENERATES now supports optional class and ttl. 17523 17524 1466. [bug] lwresd configuration errors resulted in memory 17525 and lock leaks. [RT #5228] 17526 17527 1465. [bug] isc_base64_decodestring() and isc_base64_tobuffer() 17528 failed to check that trailing bits were zero allowing 17529 some invalid base64 strings to be accepted. [RT #5397] 17530 17531 1464. [bug] Preserve "out of zone" data for outgoing zone 17532 transfers. [RT #5192] 17533 17534 1463. [bug] dns_rdata_from{wire,struct}() failed to catch bad 17535 NXT bit maps. [RT #5577] 17536 17537 1462. [bug] parse_sizeval() failed to check the token type. 17538 [RT #5586] 17539 17540 1461. [bug] Remove deadlock from rbtdb code. [RT #5599] 17541 17542 1460. [bug] inet_pton() failed to reject certain malformed 17543 IPv6 literals. 17544 17545 1459. [placeholder] 17546 17547 1458. [cleanup] sprintf() -> snprintf(). 17548 17549 1457. [port] Provide strlcat() and strlcpy() for platforms without 17550 them. 17551 17552 1456. [contrib] gen-data-queryperf.py from Stephane Bortzmeyer. 17553 17554 1455. [bug] <netaddr> missing from server grammar in 17555 doc/misc/options. [RT #5616] 17556 17557 1454. [port] Use getifaddrs() if available for interface scanning. 17558 --disable-getifaddrs to override. Glibc currently 17559 has a getifaddrs() that does not support IPv6. 17560 Use --enable-getifaddrs=glibc to force the use of 17561 this version under linux machines. 17562 17563 1453. [doc] ARM: $GENERATE example wasn't accurate. [RT #5298] 17564 17565 1452. [placeholder] 17566 17567 1451. [bug] rndc-confgen didn't exit with a error code for all 17568 failures. [RT #5209] 17569 17570 1450. [bug] Fetching expired glue failed under certain 17571 circumstances. [RT #5124] 17572 17573 1449. [bug] query_addbestns() didn't handle running out of memory 17574 gracefully. 17575 17576 1448. [bug] Handle empty wildcards labels. 17577 17578 1447. [bug] We were casting (unsigned int) to and from (void *). 17579 rdataset->private4 is now rdataset->privateuint4 17580 to reflect a type change. 17581 17582 1446. [func] Implemented undocumented alternate transfer sources 17583 from BIND 8. See use-alt-transfer-source, 17584 alt-transfer-source and alt-transfer-source-v6. 17585 17586 SECURITY: use-alt-transfer-source is ENABLED unless 17587 you are using views. This may cause a security risk 17588 resulting in accidental disclosure of wrong zone 17589 content if the master supplying different source 17590 content based on IP address. If you are not certain 17591 ISC recommends setting use-alt-transfer-source no; 17592 17593 1445. [bug] DNS_ADBFIND_STARTATROOT broke stub zones. This has 17594 been replaced with DNS_ADBFIND_STARTATZONE which 17595 causes the search to start using the closest zone. 17596 17597 1444. [func] dns_view_findzonecut2() allows you to specify if the 17598 cache should be searched for zone cuts. 17599 17600 1443. [func] Masters lists can now be specified and referenced 17601 in zone masters clauses and other masters lists. 17602 17603 1442. [func] New functions for manipulating port lists: 17604 dns_portlist_create(), dns_portlist_add(), 17605 dns_portlist_remove(), dns_portlist_match(), 17606 dns_portlist_attach() and dns_portlist_detach(). 17607 17608 1441. [func] It is now possible to tell dig to bind to a specific 17609 source port. 17610 17611 1440. [func] It is now possible to tell named to avoid using 17612 certain source ports (avoid-v4-udp-ports, 17613 avoid-v6-udp-ports). 17614 17615 1439. [bug] Named could return NOERROR with certain NOTIFY 17616 failures. Return NOTAUTH if the NOTIFY zone is 17617 not being served. 17618 17619 1438. [func] Log TSIG (if any) when logging NOTIFY requests. 17620 17621 1437. [bug] Leave space for stdio to work in. [RT #5033] 17622 17623 1436. [func] dns_zonemgr_resumexfrs() can be used to restart 17624 stalled transfers. 17625 17626 1435. [bug] zmgr_resume_xfrs() was being called read locked 17627 rather than write locked. zmgr_resume_xfrs() 17628 was not being called if the zone was being 17629 shutdown. 17630 17631 1434. [bug] "rndc reconfig" failed to initiate the initial 17632 zone transfer of new slave zones. 17633 17634 1433. [bug] named could trigger a REQUIRE failure if it could 17635 not get a file descriptor when attempting to write 17636 a master file. [RT #4347] 17637 17638 1432. [func] The advertised EDNS UDP buffer size can now be set 17639 via named.conf (edns-udp-size). 17640 17641 1431. [bug] isc_print_snprintf() "%s" with precision could walk off 17642 end of argument. [RT #5191] 17643 17644 1430. [port] linux: IPv6 interface scanning support. 17645 17646 1429. [bug] Prevent the cache getting locked to old servers. 17647 17648 1428. [placeholder] 17649 17650 1427. [bug] Race condition in adb with threaded build. 17651 17652 1426. [placeholder] 17653 17654 1425. [port] linux/libbind: define __USE_MISC when testing *_r() 17655 function prototypes in netdb.h. [RT #4921] 17656 17657 1424. [bug] EDNS version not being correctly printed. 17658 17659 1423. [contrib] queryperf: added A6 and SRV. 17660 17661 1422. [func] Log name/type/class when denying a query. [RT #4663] 17662 17663 1421. [func] Differentiate updates that don't succeed due to 17664 prerequisites (unsuccessful) vs other reasons 17665 (failed). 17666 17667 1420. [port] solaris: work around gcc optimizer bug. 17668 17669 1419. [port] openbsd: use /dev/arandom. [RT #4950] 17670 17671 1418. [bug] 'rndc reconfig' did not cause new slaves to load. 17672 17673 1417. [func] ID.SERVER/CHAOS is now a built in zone. 17674 See "server-id" for how to configure. 17675 17676 1416. [bug] Empty node should return NOERROR NODATA, not NXDOMAIN. 17677 [RT #4715] 17678 17679 1415. [func] DS TTL now derived from NS ttl. NXT TTL now derived 17680 from SOA MINIMUM. 17681 17682 1414. [func] Support for KSK flag. 17683 17684 1413. [func] Explicitly request the (re-)generation of DS records 17685 from keysets (dnssec-signzone -g). 17686 17687 1412. [func] You can now specify servers to be tried if a nameserver 17688 has IPv6 address and you only support IPv4 or the 17689 reverse. See dual-stack-servers. 17690 17691 1411. [bug] empty nodes should stop wildcard matches. [RT #4802] 17692 17693 1410. [func] Handle records that live in the parent zone, e.g. DS. 17694 17695 1409. [bug] DS should have attribute DNS_RDATATYPEATTR_DNSSEC. 17696 17697 1408. [bug] "make distclean" was not complete. [RT #4700] 17698 17699 1407. [bug] lfsr incorrectly implements the shift register. 17700 [RT #4617] 17701 17702 1406. [bug] dispatch initializes one of the LFSR's with a incorrect 17703 polynomial. [RT #4617] 17704 17705 1405. [func] Use arc4random() if available. 17706 17707 1404. [bug] libbind: ns_name_ntol() could overwrite a zero length 17708 buffer. 17709 17710 1403. [func] dnssec-signzone, dnssec-keygen, dnssec-makekeyset 17711 dnssec-signkey now report their version in the 17712 usage message. 17713 17714 1402. [cleanup] A6 has been moved to experimental and is no longer 17715 fully supported. 17716 17717 1401. [bug] adb wasn't clearing state when the timer expired. 17718 17719 1400. [bug] Block the addition of wildcard NS records by IXFR 17720 or UPDATE. [RT #3502] 17721 17722 1399. [bug] Use serial number arithmetic when testing SIG 17723 timestamps. [RT #4268] 17724 17725 1398. [doc] ARM: notify-also should have been also-notify. 17726 [RT #4345] 17727 17728 1397. [maint] J.ROOT-SERVERS.NET is now 192.58.128.30. 17729 17730 1396. [func] dnssec-signzone: adjust the default signing time by 17731 1 hour to allow for clock skew. 17732 17733 1395. [port] OpenSSL 0.9.7 defines CRYPTO_LOCK_ENGINE but doesn't 17734 have a working implementation. [RT #4079] 17735 17736 1394. [func] It is now possible to check if a particular element is 17737 in a acl. Remove duplicate entries from the localnets 17738 acl. 17739 17740 1393. [port] Bind to individual IPv6 interfaces if IPV6_IPV6ONLY 17741 is not available in the kernel to prevent accidentally 17742 listening on IPv4 interfaces. 17743 17744 1392. [bug] named-checkzone: update usage. 17745 17746 1391. [func] Add support for IPv6 scoped addresses in named. 17747 17748 1390. [func] host now supports ixfr. 17749 17750 1389. [bug] named could fail to rotate long log files. [RT #3666] 17751 17752 1388. [port] irix: check for sys/sysctl.h and NET_RT_IFLIST before 17753 defining HAVE_IFLIST_SYSCTL. [RT #3770] 17754 17755 1387. [bug] named could crash due to an access to invalid memory 17756 space (which caused an assertion failure) in 17757 incremental cleaning. [RT #3588] 17758 17759 1386. [bug] named-checkzone -z stopped on errors in a zone. 17760 [RT #3653] 17761 17762 1385. [bug] Setting serial-query-rate to 10 would trigger a 17763 REQUIRE failure. 17764 17765 1384. [bug] host was incompatible with BIND 8 in its exit code and 17766 in the output with the -l option. [RT #3536] 17767 17768 1383. [func] Track the serial number in a IXFR response and log if 17769 a mismatch occurs. This is a more specific error than 17770 "not exact". [RT #3445] 17771 17772 1382. [bug] make install failed with --enable-libbind. [RT #3656] 17773 17774 1381. [bug] named failed to correctly process answers that 17775 contained DNAME records where the resulting CNAME 17776 resulted in a negative answer. 17777 17778 1380. [func] 'rndc recursing' dump recursing queries to 17779 'recursing-file = "named.recursing";'. 17780 17781 1379. [func] 'rndc status' now reports tcp and recursion quota 17782 states. 17783 17784 1378. [func] Improved positive feedback for 'rndc {reload|refresh}. 17785 17786 1377. [func] dns_zone_load{new}() now reports if the zone was 17787 loaded, queued for loading to up to date. 17788 17789 1376. [func] New function dns_zone_logc() to log to specified 17790 category. 17791 17792 1375. [func] 'rndc dumpdb' now dumps the adb cache along with the 17793 data cache. 17794 17795 1374. [func] dns_adb_dump() now logs the lame zones associated 17796 with each server. 17797 17798 1373. [bug] Recovery from expired glue failed under certain 17799 circumstances. 17800 17801 1372. [bug] named crashes with an assertion failure on exit when 17802 sharing the same port for listening and querying, and 17803 changing listening addresses several times. [RT #3509] 17804 17805 1371. [bug] notify-source-v6, transfer-source-v6 and 17806 query-source-v6 with explicit addresses and using the 17807 same ports as named was listening on could interfere 17808 with named's ability to answer queries sent to those 17809 addresses. 17810 17811 1370. [bug] dig '+[no]recurse' was incorrectly documented. 17812 17813 1369. [bug] Adding an NS record as the lexicographically last 17814 record in a secure zone didn't work. 17815 17816 1368. [func] remove support for bitstring labels. 17817 17818 1367. [func] Use response times to select forwarders. 17819 17820 1366. [contrib] queryperf usage was incomplete. Add '-h' for help. 17821 17822 1365. [func] "localhost" and "localnets" acls now include IPv6 17823 addresses / prefixes. 17824 17825 1364. [func] Log file name when unable to open memory statistics 17826 and dump database files. [RT #3437] 17827 17828 1363. [func] Listen-on-v6 now supports specific addresses. 17829 17830 1362. [bug] remove IFF_RUNNING test when scanning interfaces. 17831 17832 1361. [func] log the reason for rejecting a server when resolving 17833 queries. 17834 17835 1360. [bug] --enable-libbind would fail when not built in the 17836 source tree for certain OS's. 17837 17838 1359. [security] Support patches OpenSSL libraries. 17839 http://www.cert.org/advisories/CA-2002-23.html 17840 17841 1358. [bug] It was possible to trigger a INSIST when debugging 17842 large dynamic updates. [RT #3390] 17843 17844 1357. [bug] nsupdate was extremely wasteful of memory. 17845 17846 1356. [tuning] Reduce the number of events / quantum for zone tasks. 17847 17848 1355. [bug] Fix DNSSEC wildcard proof for CNAME/DNAME. 17849 17850 1354. [doc] lwres man pages had illegal nroff. 17851 17852 1353. [contrib] sdb/ldap to version 0.9. 17853 17854 1352. [bug] dig, host, nslookup when falling back to TCP use the 17855 current search entry (if any). [RT #3374] 17856 17857 1351. [bug] lwres_getipnodebyname() returned the wrong name 17858 when given a IPv4 literal, af=AF_INET6 and AI_MAPPED 17859 was set. 17860 17861 1350. [bug] dns_name_fromtext() failed to handle too many labels 17862 gracefully. 17863 17864 1349. [security] Minimum OpenSSL version now 0.9.6e (was 0.9.5a). 17865 http://www.cert.org/advisories/CA-2002-23.html 17866 17867 1348. [port] win32: Rewrote code to use I/O Completion Ports 17868 in socket.c and eliminating a host of socket 17869 errors. Performance is enhanced. 17870 17871 1347. [placeholder] 17872 17873 1346. [placeholder] 17874 17875 1345. [port] Use a explicit -Wformat with gcc. Not all versions 17876 include it in -Wall. 17877 17878 1344. [func] Log if the serial number on the master has gone 17879 backwards. 17880 If you have multiple machines specified in the masters 17881 clause you may want to set 'multi-master yes;' to 17882 suppress this warning. 17883 17884 1343. [func] Log successful notifies received (info). Adjust log 17885 level for failed notifies to notice. 17886 17887 1342. [func] Log remote address with TCP dispatch failures. 17888 17889 1341. [func] Allow a rate limiter to be stalled. 17890 17891 1340. [bug] Delay and spread out the startup refresh load. 17892 17893 1339. [func] dig, host and nslookup now use IP6.ARPA for nibble 17894 lookups. Bit string lookups are no longer attempted. 17895 17896 1338. [placeholder] 17897 17898 1337. [placeholder] 17899 17900 1336. [func] Nibble lookups under IP6.ARPA are now supported by 17901 dns_byaddr_create(). dns_byaddr_createptrname() is 17902 deprecated, use dns_byaddr_createptrname2() instead. 17903 17904 1335. [bug] When performing a nonexistence proof, the validator 17905 should discard parent NXTs from higher in the DNS. 17906 17907 1334. [bug] When signing/verifying rdatasets, duplicate rdatas 17908 need to be suppressed. 17909 17910 1333. [contrib] queryperf now reports a summary of returned 17911 rcodes (-c), rcodes are printed in mnemonic form (-v). 17912 17913 1332. [func] Report the current serial with periodic commits when 17914 rolling forward the journal. 17915 17916 1331. [func] Generate DNSSEC wildcard proofs. 17917 17918 1330. [bug] When processing events (non-threaded) only allow 17919 the task one chance to use to use its quantum. 17920 17921 1329. [func] named-checkzone will now check if nameservers that 17922 appear to be IP addresses. Available modes "fail", 17923 "warn" (default) and "ignore" the results of the 17924 check. 17925 17926 1328. [bug] The validator could incorrectly verify an invalid 17927 negative proof. 17928 17929 1327. [bug] The validator would incorrectly mark data as insecure 17930 when seeing a bogus signature before a correct 17931 signature. 17932 17933 1326. [bug] DNAME/CNAME signatures were not being cached when 17934 validation was not being performed. [RT #3284] 17935 17936 1325. [bug] If the tcpquota was exhausted it was possible to 17937 to trigger a INSIST() failure. 17938 17939 1324. [port] darwin: ifconfig.sh now supports darwin. 17940 17941 1323. [port] linux: Slackware 4.0 needs <asm/unistd.h>. [RT #3205] 17942 17943 1322. [bug] dnssec-signzone usage message was misleading. 17944 17945 1321. [bug] If the last RRset in a zone is glue, dnssec-signzone 17946 would incorrectly duplicate its output and sign it. 17947 17948 1320. [doc] query-source-v6 was missing from options section. 17949 [RT #3218] 17950 17951 1319. [func] libbind: log attempts to exploit #1318. 17952 17953 1318. [bug] libbind: Remote buffer overrun. 17954 17955 1317. [port] libbind: TrueUNIX 5.1 does not like __align as a 17956 element name. 17957 17958 1316. [bug] libbind: gethostans() could get out of sync parsing 17959 the response if there was a very long CNAME chain. 17960 17961 1315. [bug] Options should apply to the internal _bind view. 17962 17963 1314. [port] Handle ECONNRESET from sendmsg() [unix]. 17964 17965 1313. [func] Query log now says if the query was signed (S) or 17966 if EDNS was used (E). 17967 17968 1312. [func] Log TSIG key used w/ outgoing zone transfers. 17969 17970 1311. [bug] lwres_getrrsetbyname leaked memory. [RT #3159] 17971 17972 1310. [bug] 'rndc stop' failed to cause zones to be flushed 17973 sometimes. [RT #3157] 17974 17975 1309. [func] Log that a zone transfer was covered by a TSIG. 17976 17977 1308. [func] DS (delegation signer) support. 17978 17979 1307. [bug] nsupdate: allow white space base64 key data. 17980 17981 1306. [bug] Badly encoded LOC record when the size, horizontal 17982 precision or vertical precision was 0.1m. 17983 17984 1305. [bug] Document that internal zones are included in the 17985 rndc status results. 17986 17987 1304. [func] New function: dns_zone_name(). 17988 17989 1303. [func] Option 'flush-zones-on-shutdown <boolean>;'. 17990 17991 1302. [func] Extended rndc dumpdb to support dumping of zones and 17992 view selection: 'dumpdb [-all|-zones|-cache] [view]'. 17993 17994 1301. [func] New category 'update-security'. 17995 17996 1300. [port] Compaq Trucluster support. 17997 17998 1299. [bug] Set AI_ADDRCONFIG when looking up addresses 17999 via getaddrinfo() (affects dig, host, nslookup, rndc 18000 and nsupdate). 18001 18002 1298. [bug] The CINCLUDES macro in lib/dns/sec/dst/Makefile 18003 could be left with a trailing "\" after configure 18004 has been run. 18005 18006 1297. [port] linux: make handling EINVAL from socket() no longer 18007 conditional on #ifdef LINUX. 18008 18009 1296. [bug] isc_log_closefilelogs() needed to lock the log 18010 context. 18011 18012 1295. [bug] isc_log_setdebuglevel() needed to lock the log 18013 context. 18014 18015 1294. [func] libbind: no longer attempts bit string labels for 18016 IPv6 reverse resolution. Try IP6.ARPA then IP6.INT 18017 for nibble style resolution. 18018 18019 1293. [func] Entropy can now be retrieved from EGDs. [RT #2438] 18020 18021 1292. [func] Enable IPv6 support when using ioctl style interface 18022 scanning and OS supports SIOCGLIFADDR using struct 18023 if_laddrreq. 18024 18025 1291. [func] Enable IPv6 support when using sysctl style interface 18026 scanning. 18027 18028 1290. [func] "dig axfr" now reports the number of messages 18029 as well as the number of records. 18030 18031 1289. [port] See if -ldl is required for OpenSSL? [RT #2672] 18032 18033 1288. [bug] Adjusted REQUIRE's in lib/dns/name.c to better 18034 reflect written requirements. 18035 18036 1287. [bug] REQUIRE that DNS_DBADD_MERGE only be set when adding 18037 a rdataset to a zone db in the rbtdb implementation of 18038 addrdataset. 18039 18040 1286. [bug] dns_name_downcase() enforce requirement that 18041 target != NULL or name->buffer != NULL. 18042 18043 1285. [func] lwres: probe the system to see what address families 18044 are currently in use. 18045 18046 1284. [bug] The RTT estimate on unused servers was not aged. 18047 [RT #2569] 18048 18049 1283. [func] Use "dataready" accept filter if available. 18050 18051 1282. [port] libbind: hpux 11.11 interface scanning. 18052 18053 1281. [func] Log zone when unable to get private keys to update 18054 zone. Log zone when NXT records are missing from 18055 secure zone. 18056 18057 1280. [bug] libbind: escape '(' and ')' when converting to 18058 presentation form. 18059 18060 1279. [port] Darwin uses (unsigned long) for size_t. [RT #2590] 18061 18062 1278. [func] dig: now supports +[no]cl +[no]ttlid. 18063 18064 1277. [func] You can now create your own customized printing 18065 styles: dns_master_stylecreate() and 18066 dns_master_styledestroy(). 18067 18068 1276. [bug] libbind: const pointer conflicts in res_debug.c. 18069 18070 1275. [port] libbind: hpux: treat all hpux systems as BIG_ENDIAN. 18071 18072 1274. [bug] Memory leak in lwres_gnbarequest_parse(). 18073 18074 1273. [port] libbind: solaris: 64 bit binary compatibility. 18075 18076 1272. [contrib] Berkeley DB 4.0 sdb implementation from 18077 Nuno Miguel Rodrigues <nmr (a] co.sapo.pt>. 18078 18079 1271. [bug] "recursion available: {denied,approved}" was too 18080 confusing. 18081 18082 1270. [bug] Check that system inet_pton() and inet_ntop() support 18083 AF_INET6. 18084 18085 1269. [port] Openserver: ifconfig.sh support. 18086 18087 1268. [port] Openserver: the value FD_SETSIZE depends on whether 18088 <sys/param.h> is included or not. Be consistent. 18089 18090 1267. [func] isc_file_openunique() now creates file using mode 18091 0666 rather than 0600. 18092 18093 1266. [bug] ISC_LINK_INIT, ISC_LINK_UNLINK, ISC_LIST_DEQUEUE, 18094 __ISC_LINK_UNLINKUNSAFE and __ISC_LIST_DEQUEUEUNSAFE 18095 are not C++ compatible, use *_TYPE versions instead. 18096 18097 1265. [bug] libbind: LINK_INIT and UNLINK were not compatible with 18098 C++, use LINK_INIT_TYPE and UNLINK_TYPE instead. 18099 18100 1264. [placeholder] 18101 18102 1263. [bug] Reference after free error if dns_dispatchmgr_create() 18103 failed. 18104 18105 1262. [bug] ns_server_destroy() failed to set *serverp to NULL. 18106 18107 1261. [func] libbind: ns_sign2() and ns_sign_tcp() now provide 18108 support for compressed TSIG owner names. 18109 18110 1260. [func] libbind: res_update can now update IPv6 servers, 18111 new function res_findzonecut2(). 18112 18113 1259. [bug] libbind: get_salen() IPv6 support was broken for OSs 18114 w/o sa_len. 18115 18116 1258. [bug] libbind: res_nametotype() and res_nametoclass() were 18117 broken. 18118 18119 1257. [bug] Failure to write pid-file should not be fatal on 18120 reload. [RT #2861] 18121 18122 1256. [contrib] 'queryperf' now has EDNS (-e) + DNSSEC DO (-D) support. 18123 18124 1255. [bug] When verifying that an NXT proves nonexistence, check 18125 the rcode of the message and only do the matching NXT 18126 check. That is, for NXDOMAIN responses, check that 18127 the name is in the range between the NXT owner and 18128 next name, and for NOERROR NODATA responses, check 18129 that the type is not present in the NXT bitmap. 18130 18131 1254. [func] preferred-glue option from BIND 8.3. 18132 18133 1253. [bug] The dnssec system test failed to remove the correct 18134 files. 18135 18136 1252. [bug] Dig, host and nslookup were not checking the address 18137 the answer was coming from against the address it was 18138 sent to. [RT #2692] 18139 18140 1251. [port] win32: a make file contained absolute version specific 18141 references. 18142 18143 1250. [func] Nsupdate will report the address the update was 18144 sent to. 18145 18146 .. code-block:: none 18147 18148 1249. [bug] Missing masters clause was not handled gracefully. 18149 [RT #2703] 18150 18151 1248. [bug] DESTDIR was not being propagated between makes. 18152 18153 1247. [bug] Don't reset the interface index for link/site local 18154 addresses. [RT #2576] 18155 18156 1246. [func] New functions isc_sockaddr_issitelocal(), 18157 isc_sockaddr_islinklocal(), isc_netaddr_issitelocal() 18158 and isc_netaddr_islinklocal(). 18159 18160 1245. [bug] Treat ENOBUFS, ENOMEM and ENFILE as soft errors for 18161 accept(). 18162 18163 1244. [bug] Receiving a TCP message from a blackhole address would 18164 prevent further messages being received over that 18165 interface. 18166 18167 1243. [bug] It was possible to trigger a REQUIRE() in 18168 dns_message_findtype(). [RT #2659] 18169 18170 1242. [bug] named-checkzone failed if a journal existed. [RT #2657] 18171 18172 1241. [bug] Drop received UDP messages with a zero source port 18173 as these are invariably forged. [RT #2621] 18174 18175 1240. [bug] It was possible to leak zone references by 18176 specifying an incorrect zone to rndc. 18177 18178 1239. [bug] Under certain circumstances named could continue to 18179 use a name after it had been freed triggering 18180 INSIST() failures. [RT #2614] 18181 18182 1238. [bug] It is possible to lockup the server when shutting down 18183 if notifies were being processed. [RT #2591] 18184 18185 1237. [bug] nslookup: "set q=type" failed. 18186 18187 1236. [bug] dns_rdata{class,type}_fromtext() didn't handle non 18188 NULL terminated text regions. [RT #2588] 18189 18190 1235. [func] Report 'out of memory' errors from openssl. 18191 18192 1234. [bug] contrib/sdb: 'zonetodb' failed to call 18193 dns_result_register(). DNS_R_SEENINCLUDE should not 18194 be fatal. 18195 18196 1233. [bug] The flags field of a KEY record can be expressed in 18197 hex as well as decimal. 18198 18199 1232. [bug] unix/errno2result() didn't handle EADDRNOTAVAIL. 18200 18201 1231. [port] HPUX 11.11 recvmsg() can return spurious EADDRNOTAVAIL. 18202 18203 1230. [bug] isccc_cc_isreply() and isccc_cc_isack() were broken. 18204 18205 1229. [bug] named would crash if it received a TSIG signed 18206 query as part of an AXFR response. [RT #2570] 18207 18208 1228. [bug] 'make install' did not depend on 'make all'. [RT #2559] 18209 18210 1227. [bug] dns_lex_getmastertoken() now returns ISC_R_BADNUMBER 18211 if a number was expected and some other token was 18212 found. [RT #2532] 18213 18214 1226. [func] Use EDNS for zone refresh queries. [RT #2551] 18215 18216 1225. [func] dns_message_setopt() no longer requires that 18217 dns_message_renderbegin() to have been called. 18218 18219 1224. [bug] 'rrset-order' and 'sortlist' should be additive 18220 not exclusive. 18221 18222 1223. [func] 'rrset-order' partially works 'cyclic' and 'random' 18223 are supported. 18224 18225 1222. [bug] Specifying 'port *' did not always result in a system 18226 selected (non-reserved) port being used. [RT #2537] 18227 18228 1221. [bug] Zone types 'master', 'slave' and 'stub' were not being 18229 compared case insensitively. [RT #2542] 18230 18231 1220. [func] Support for APL rdata type. 18232 18233 1219. [func] Named now reports the TSIG extended error code when 18234 signature verification fails. [RT #1651] 18235 18236 1218. [bug] Named incorrectly returned SERVFAIL rather than 18237 NOTAUTH when there was a TSIG BADTIME error. [RT #2519] 18238 18239 1217. [func] Report locations of previous key definition when a 18240 duplicate is detected. 18241 18242 1216. [bug] Multiple server clauses for the same server were not 18243 reported. [RT #2514] 18244 18245 1215. [port] solaris: add support to ifconfig.sh for x86 2.5.1 18246 18247 1214. [bug] Win32: isc_file_renameunique() could leave zero length 18248 files behind. 18249 18250 1213. [func] Report view associated with client if it is not a 18251 standard view (_default or _bind). 18252 18253 1212. [port] libbind: 64k answer buffers were causing stack space 18254 to be exceeded for certain OS. Use heap space instead. 18255 18256 1211. [bug] dns_name_fromtext() incorrectly handled certain 18257 valid octal bitlabels. [RT #2483] 18258 18259 1210. [bug] libbind: getnameinfo() failed to lookup IPv4 mapped / 18260 compatible addresses. [RT #2461] 18261 18262 1209. [bug] Dig, host, nslookup were not checking the message ids 18263 on the responses. [RT #2454] 18264 18265 1208. [bug] dns_master_load*() failed to log a error message if 18266 an error was detected when parsing the owner name of 18267 a record. [RT #2448] 18268 18269 1207. [bug] libbind: getaddrinfo() could call freeaddrinfo() with 18270 an invalid pointer. 18271 18272 1206. [bug] SERVFAIL and NOTIMP responses to an EDNS query should 18273 trigger a non-EDNS retry. 18274 18275 1205. [bug] OPT, TSIG and TKEY cannot be used to set the "class" 18276 of the message. [RT #2449] 18277 18278 1204. [bug] libbind: res_nupdate() failed to update the name 18279 server addresses before sending the update. 18280 18281 1203. [func] Report locations of previous acl and zone definitions 18282 when a duplicate is detected. 18283 18284 1202. [func] New functions: cfg_obj_line() and cfg_obj_file(). 18285 18286 1201. [bug] Require that if 'callbacks' is passed to 18287 dns_rdata_fromtext(), callbacks->error and 18288 callbacks->warn are initialized. 18289 18290 1200. [bug] Log 'errno' that we are unable to convert to 18291 isc_result_t. [RT #2404] 18292 18293 1199. [doc] ARM reference to RFC 2157 should have been RFC 1918. 18294 [RT #2436] 18295 18296 1198. [bug] OPT printing style was not consistent with the way the 18297 header fields are printed. The DO bit was not reported 18298 if set. Report if any of the MBZ bits are set. 18299 18300 1197. [bug] Attempts to define the same acl multiple times were not 18301 detected. 18302 18303 1196. [contrib] update mdnkit to 2.2.3. 18304 18305 1195. [bug] Attempts to redefine builtin acls should be caught. 18306 [RT #2403] 18307 18308 1194. [bug] Not all duplicate zone definitions were being detected 18309 at the named.conf checking stage. [RT #2431] 18310 18311 1193. [bug] dig +besteffort parsing didn't handle packet 18312 truncation. dns_message_parse() has new flag 18313 DNS_MESSAGE_IGNORETRUNCATION. 18314 18315 1192. [bug] The seconds fields in LOC records were restricted 18316 to three decimal places. More decimal places should 18317 be allowed but warned about. 18318 18319 1191. [bug] A dynamic update removing the last non-apex name in 18320 a secure zone would fail. [RT #2399] 18321 18322 1190. [func] Add the "rndc freeze" and "rndc unfreeze" commands. 18323 [RT #2394] 18324 18325 1189. [bug] On some systems, malloc(0) returns NULL, which 18326 could cause the caller to report an out of memory 18327 error. [RT #2398] 18328 18329 1188. [bug] Dynamic updates of a signed zone would fail if 18330 some of the zone private keys were unavailable. 18331 18332 1187. [bug] named was incorrectly returning DNSSEC records 18333 in negative responses when the DO bit was not set. 18334 18335 1186. [bug] isc_hex_tobuffer(,,length = 0) failed to unget the 18336 EOL token when reading to end of line. 18337 18338 1185. [bug] libbind: don't assume statp->_u._ext.ext is valid 18339 unless RES_INIT is set when calling res_*init(). 18340 18341 1184. [bug] libbind: call res_ndestroy() if RES_INIT is set 18342 when res_*init() is called. 18343 18344 1183. [bug] Handle ENOSR error when writing to the internal 18345 control pipe. [RT #2395] 18346 18347 1182. [bug] The server could throw an assertion failure when 18348 constructing a negative response packet. 18349 18350 1181. [func] Add the "key-directory" configuration statement, 18351 which allows the server to look for online signing 18352 keys in alternate directories. 18353 18354 1180. [func] dnssec-keygen should always generate keys with 18355 protocol 3 (DNSSEC), since it's less confusing 18356 that way. 18357 18358 1179. [func] Add SIG(0) support to nsupdate. 18359 18360 1178. [bug] Follow and cache (if appropriate) A6 and other 18361 data chains to completion in the additional section. 18362 18363 1177. [func] Report view when loading zones if it is not a 18364 standard view (_default or _bind). [RT #2270] 18365 18366 1176. [doc] Document that allow-v6-synthesis is only performed 18367 for clients that are supplied recursive service. 18368 [RT #2260] 18369 18370 1175. [bug] named-checkzone and named-checkconf failed to call 18371 dns_result_register() at startup which could 18372 result in runtime exceptions when printing 18373 "out of memory" errors. [RT #2335] 18374 18375 1174. [bug] Win32: add WSAECONNRESET to the expected errors 18376 from connect(). [RT #2308] 18377 18378 1173. [bug] Potential memory leaks in isc_log_create() and 18379 isc_log_settag(). [RT #2336] 18380 18381 1172. [doc] Add CERT, GPOS, KX, NAPTR, NSAP, PX and TXT to 18382 table of RR types in ARM. 18383 18384 1171. [func] Added function isc_region_compare(), updated files in 18385 lib/dns to use this function instead of local one. 18386 18387 1170. [bug] Don't attempt to print the token when a I/O error 18388 occurs when parsing named.conf. [RT #2275] 18389 18390 1169. [func] Identify recursive queries in the query log. 18391 18392 1168. [bug] Empty also-notify clauses were not handled. [RT #2309] 18393 18394 1167. [contrib] nslint-2.1a3 (from author). 18395 18396 1166. [bug] "Not Implemented" should be reported as NOTIMP, 18397 not NOTIMPL. [RT #2281] 18398 18399 1165. [bug] We were rejecting notify-source{-v6} in zone clauses. 18400 18401 1164. [bug] Empty masters clauses in slave / stub zones were not 18402 handled gracefully. [RT #2262] 18403 18404 1163. [func] isc_time_formattimestamp() now includes the year. 18405 18406 1162. [bug] The allow-notify option was not accepted in slave 18407 zone statements. 18408 18409 1161. [bug] named-checkzone looped on unbalanced brackets. 18410 [RT #2248] 18411 18412 1160. [bug] Generating Diffie-Hellman keys longer than 1024 18413 bits could fail. [RT #2241] 18414 18415 1159. [bug] MD and MF are not permitted to be loaded by RFC1123. 18416 18417 1158. [func] Report the client's address when logging notify 18418 messages. 18419 18420 1157. [func] match-clients and match-destinations now accept 18421 keys. [RT #2045] 18422 18423 1156. [port] The configure test for strsep() incorrectly 18424 succeeded on certain patched versions of 18425 AIX 4.3.3. [RT #2190] 18426 18427 1155. [func] Recover from master files being removed from under 18428 us. 18429 18430 1154. [bug] Don't attempt to obtain the netmask of a interface 18431 if there is no address configured. [RT #2176] 18432 18433 1153. [func] 'rndc {stop|halt} -p' now reports the process id 18434 of the instance of named being shutdown. 18435 18436 1152. [bug] libbind: read buffer overflows. 18437 18438 1151. [bug] nslookup failed to check that the arguments to 18439 the port, timeout, and retry options were 18440 valid integers and in range. [RT #2099] 18441 18442 1150. [bug] named incorrectly accepted TTL values 18443 containing plus or minus signs, such as 18444 1d+1h-1s. 18445 18446 1149. [func] New function isc_parse_uint32(). 18447 18448 1148. [func] 'rndc-confgen -a' now provides positive feedback. 18449 18450 1147. [func] Set IPV6_V6ONLY on IPv6 sockets if supported by 18451 the OS. listen-on-v6 { any; }; should no longer 18452 result in IPv4 queries be accepted. Similarly 18453 control { inet :: ... }; should no longer result 18454 in IPv4 connections being accepted. This can be 18455 overridden at compile time by defining 18456 ISC_ALLOW_MAPPED=1. 18457 18458 1146. [func] Allow IPV6_IPV6ONLY to be set/cleared on a socket if 18459 supported by the OS by a new function 18460 isc_socket_ipv6only(). 18461 18462 1145. [func] "host" no longer reports a NOERROR/NODATA response 18463 by printing nothing. [RT #2065] 18464 18465 1144. [bug] rndc-confgen would crash if both the -a and -t 18466 options were specified. [RT #2159] 18467 18468 1143. [bug] When a trusted-keys statement was present and named 18469 was built without crypto support, it would leak memory. 18470 18471 1142. [bug] dnssec-signzone would fail to delete temporary files 18472 in some failure cases. [RT #2144] 18473 18474 1141. [bug] When named rejected a control message, it would 18475 leak a file descriptor and memory. It would also 18476 fail to respond, causing rndc to hang. 18477 [RT #2139, #2164] 18478 18479 1140. [bug] rndc-confgen did not accept IPv6 addresses as arguments 18480 to the -s option. [RT #2138] 18481 18482 1139. [func] It is now possible to flush a given name from the 18483 cache(s) via 'rndc flushname name [view]'. [RT #2051] 18484 18485 1138. [func] It is now possible to flush a given name from the 18486 cache by calling the new function 18487 dns_cache_flushname(). 18488 18489 1137. [func] It is now possible to flush a given name from the 18490 ADB by calling the new function dns_adb_flushname(). 18491 18492 1136. [bug] CNAME records synthesized from DNAMEs did not 18493 have a TTL of zero as required by RFC2672. 18494 [RT #2129] 18495 18496 1135. [func] You can now override the default syslog() facility for 18497 named/lwresd at compile time. [RT #1982] 18498 18499 1134. [bug] Multi-threaded servers could deadlock in ferror() 18500 when reloading zone files. [RT #1951, #1998] 18501 18502 1133. [bug] IN6_IS_ADDR_LOOPBACK was not portably defined on 18503 platforms without IN6_IS_ADDR_LOOPBACK. [RT #2106] 18504 18505 1132. [func] Improve UPDATE prerequisite failure diagnostic messages. 18506 18507 1131. [bug] The match-destinations view option did not work with 18508 IPv6 destinations. [RT #2073, #2074] 18509 18510 1130. [bug] Log messages reporting an out-of-range serial number 18511 did not include the out-of-range number but the 18512 following token. [RT #2076] 18513 18514 1129. [bug] Multi-threaded servers could crash under heavy 18515 resolution load due to a race condition. [RT #2018] 18516 18517 1128. [func] sdb drivers can now provide RR data in either text 18518 or wire format, the latter using the new functions 18519 dns_sdb_putrdata() and dns_sdb_putnamedrdata(). 18520 18521 1127. [func] rndc: If the server to contact has multiple addresses, 18522 try all of them. 18523 18524 1126. [bug] The server could access a freed event if shut 18525 down while a client start event was pending 18526 delivery. [RT #2061] 18527 18528 1125. [bug] rndc: -k option was missing from usage message. 18529 [RT #2057] 18530 18531 1124. [doc] dig: +[no]dnssec, +[no]besteffort and +[no]fail 18532 are now documented. [RT #2052] 18533 18534 1123. [bug] dig +[no]fail did not match description. [RT #2052] 18535 18536 1122. [tuning] Resolution timeout reduced from 90 to 30 seconds. 18537 [RT #2046] 18538 18539 1121. [bug] The server could attempt to access a NULL zone 18540 table if shut down while resolving. 18541 [RT #1587, #2054] 18542 18543 1120. [bug] Errors in options were not fatal. [RT #2002] 18544 18545 1119. [func] Added support in Win32 for NTFS file/directory ACL's 18546 for access control. 18547 18548 1118. [bug] On multi-threaded servers, a race condition 18549 could cause an assertion failure in resolver.c 18550 during resolver shutdown. [RT #2029] 18551 18552 1117. [port] The configure check for in6addr_loopback incorrectly 18553 succeeded on AIX 4.3 when compiling with -O2 18554 because the test code was optimized away. 18555 [RT #2016] 18556 18557 1116. [bug] Setting transfers in a server clause, transfers-in, 18558 or transfers-per-ns to a value greater than 18559 2147483647 disabled transfers. [RT #2002] 18560 18561 1115. [func] Set maximum values for cleaning-interval, 18562 heartbeat-interval, interface-interval, 18563 max-transfer-idle-in, max-transfer-idle-out, 18564 max-transfer-time-in, max-transfer-time-out, 18565 statistics-interval of 28 days and 18566 sig-validity-interval of 3660 days. [RT #2002] 18567 18568 1114. [port] Ignore more accept() errors. [RT #2021] 18569 18570 1113. [bug] The allow-update-forwarding option was ignored 18571 when specified in a view. [RT #2014] 18572 18573 1112. [placeholder] 18574 18575 1111. [bug] Multi-threaded servers could deadlock processing 18576 recursive queries due to a locking hierarchy 18577 violation in adb.c. [RT #2017] 18578 18579 1110. [bug] dig should only accept valid abbreviations of +options. 18580 [RT #2003] 18581 18582 1109. [bug] nsupdate accepted illegal ttl values. 18583 18584 1108. [bug] On Win32, rndc was hanging when named was not running 18585 due to failure to select for exceptional conditions 18586 in select(). [RT #1870] 18587 18588 1107. [bug] nsupdate could catch an assertion failure if an 18589 invalid domain name was given as the argument to 18590 the "zone" command. 18591 18592 1106. [bug] After seeing an out of range TTL, nsupdate would 18593 treat all TTLs as out of range. [RT #2001] 18594 18595 1105. [port] OpenUNIX 8 enable threads by default. [RT #1970] 18596 18597 1104. [bug] Invalid arguments to the transfer-format option 18598 could cause an assertion failure. [RT #1995] 18599 18600 1103. [port] OpenUNIX 8 support (ifconfig.sh). [RT #1970] 18601 18602 1102. [doc] Note that query logging is enabled by directing the 18603 queries category to a channel. 18604 18605 1101. [bug] Array bounds read error in lwres_gai_strerror. 18606 18607 1100. [bug] libbind: DNSSEC key ids were computed incorrectly. 18608 18609 1099. [cleanup] libbind: defining REPORT_ERRORS in lib/bind/dst caused 18610 compile time errors. 18611 18612 1098. [bug] libbind: HMAC-MD5 key files are now mode 0600. 18613 18614 1097. [func] libbind: RES_PRF_TRUNC for dig. 18615 18616 1096. [func] libbind: "DNSSEC OK" (DO) support. 18617 18618 1095. [func] libbind: resolver option: no-tld-query. disables 18619 trying unqualified as a tld. no_tld_query is also 18620 supported for FreeBSD compatibility. 18621 18622 1094. [func] libbind: add support gcc's format string checking. 18623 18624 1093. [doc] libbind: miscellaneous nroff fixes. 18625 18626 1092. [bug] libbind: get*by*() failed to check if res_init() had 18627 been called. 18628 18629 1091. [bug] libbind: misplaced va_end(). 18630 18631 1090. [bug] libbind: dns_ho.c:add_hostent() was not returning 18632 the amount of memory consumed resulting in garbage 18633 address being returned. Alignment calculations were 18634 wasting space. We weren't suppressing duplicate 18635 addresses. 18636 18637 1089. [func] libbind: inet_{cidr,net}_{pton,ntop}() now have IPv6 18638 support. 18639 18640 1088. [port] libbind: MPE/iX C.70 (incomplete) 18641 18642 1087. [bug] libbind: struct __res_state too large on 64 bit arch. 18643 18644 1086. [port] libbind: sunos: old sprintf. 18645 18646 1085. [port] libbind: solaris: sys_nerr and sys_errlist do not 18647 exist when compiling in 64 bit mode. 18648 18649 1084. [cleanup] libbind: gai_strerror() rewritten. 18650 18651 1083. [bug] The default control channel listened on the 18652 wildcard address, not the loopback as documented. 18653 [RT #1975] 18654 18655 1082. [bug] The -g option to named incorrectly caused logging 18656 to be sent to syslog in addition to stderr. 18657 [RT #1974] 18658 18659 1081. [bug] Multicast queries were incorrectly identified 18660 based on the source address, not the destination 18661 address. 18662 18663 1080. [bug] BIND 8 compatibility: accept bare IP prefixes 18664 as the second element of a two-element top level 18665 sort list statement. [RT #1964] 18666 18667 1079. [bug] BIND 8 compatibility: accept bare elements at top 18668 level of sort list treating them as if they were 18669 a single element list. [RT #1963] 18670 18671 1078. [bug] We failed to correct bad tv_usec values in one case. 18672 [RT #1966] 18673 18674 1077. [func] Do not accept further recursive clients when 18675 the total number of recursive lookups being 18676 processed exceeds max-recursive-clients, even 18677 if some of the lookups are internally generated. 18678 [RT #1915, #1938] 18679 18680 1076. [bug] A badly defined global key could trigger an assertion 18681 on load/reload if views were used. [RT #1947] 18682 18683 1075. [bug] Out-of-range network prefix lengths were not 18684 reported. [RT #1954] 18685 18686 1074. [bug] Running out of memory in dump_rdataset() could 18687 cause an assertion failure. [RT #1946] 18688 18689 1073. [bug] The ADB cache cleaning should also be space driven. 18690 [RT #1915, #1938] 18691 18692 1072. [bug] The TCP client quota could be exceeded when 18693 recursion occurred. [RT #1937] 18694 18695 1071. [bug] Sockets listening for TCP DNS connections 18696 specified an excessive listen backlog. [RT #1937] 18697 18698 1070. [bug] Copy DNSSEC OK (DO) to response as specified by 18699 draft-ietf-dnsext-dnssec-okbit-03.txt. 18700 18701 1069. [placeholder] 18702 18703 1068. [bug] errno could be overwritten by catgets(). [RT #1921] 18704 18705 1067. [func] Allow quotas to be soft, isc_quota_soft(). 18706 18707 1066. [bug] Provide a thread safe wrapper for strerror(). 18708 [RT #1689] 18709 18710 1065. [func] Runtime support to select new / old style interface 18711 scanning using ioctls. 18712 18713 1064. [bug] Do not shut down active network interfaces if we 18714 are unable to scan the interface list. [RT #1921] 18715 18716 1063. [bug] libbind: "make install" was failing on IRIX. 18717 [RT #1919] 18718 18719 1062. [bug] If the control channel listener socket was shut 18720 down before server exit, the listener object could 18721 be freed twice. [RT #1916] 18722 18723 1061. [bug] If periodic cache cleaning happened to start 18724 while cleaning due to reaching the configured 18725 maximum cache size was in progress, the server 18726 could catch an assertion failure. [RT #1912] 18727 18728 1060. [func] Move refresh, stub and notify UDP retry processing 18729 into dns_request. 18730 18731 1059. [func] dns_request now support will now retry UDP queries, 18732 dns_request_createvia2() and dns_request_createraw2(). 18733 18734 1058. [func] Limited lifetime ticker timers are now available, 18735 isc_timertype_limited. 18736 18737 1057. [bug] Reloading the server after adding a "file" clause 18738 to a zone statement could cause the server to 18739 crash due to a typo in change 1016. 18740 18741 1056. [bug] Rndc could catch an assertion failure on SIGINT due 18742 to an uninitialized variable. [RT #1908] 18743 18744 1055. [func] Version and hostname queries can now be disabled 18745 using "version none;" and "hostname none;", 18746 respectively. 18747 18748 1054. [bug] On Win32, cfg_categories and cfg_modules need to be 18749 exported from the libisccfg DLL. 18750 18751 1053. [bug] Dig did not increase its timeout when receiving 18752 AXFRs unless the +time option was used. [RT #1904] 18753 18754 1052. [bug] Journals were not being created in binary mode 18755 resulting in "journal format not recognized" error 18756 under Win32. [RT #1889] 18757 18758 1051. [bug] Do not ignore a network interface completely just 18759 because it has a noncontiguous netmask. Instead, 18760 omit it from the localnets ACL and issue a warning. 18761 [RT #1891] 18762 18763 1050. [bug] Log messages reporting malformed IP addresses in 18764 address lists such as that of the forwarders option 18765 failed to include the correct error code, file 18766 name, and line number. [RT #1890] 18767 18768 1049. [func] "pid-file none;" will disable writing a pid file. 18769 [RT #1848] 18770 18771 1048. [bug] Servers built with -DISC_MEM_USE_INTERNAL_MALLOC=1 18772 didn't work. 18773 18774 1047. [bug] named was incorrectly refusing all requests signed 18775 with a TSIG key derived from an unsigned TKEY 18776 negotiation with a NOERROR response. [RT #1886] 18777 18778 1046. [bug] The help message for the --with-openssl configure 18779 option was inaccurate. [RT #1880] 18780 18781 1045. [bug] It was possible to skip saving glue for a nameserver 18782 for a stub zone. 18783 18784 1044. [bug] Specifying allow-transfer, notify-source, or 18785 notify-source-v6 in a stub zone was not treated 18786 as an error. 18787 18788 1043. [bug] Specifying a transfer-source or transfer-source-v6 18789 option in the zone statement for a master zone was 18790 not treated as an error. [RT #1876] 18791 18792 1042. [bug] The "config" logging category did not work properly. 18793 [RT #1873] 18794 18795 1041. [bug] Dig/host/nslookup could catch an assertion failure 18796 on SIGINT due to an uninitialized variable. [RT #1867] 18797 18798 1040. [bug] Multiple listen-on-v6 options with different ports 18799 were not accepted. [RT #1875] 18800 18801 1039. [bug] Negative responses with CNAMEs in the answer section 18802 were cached incorrectly. [RT #1862] 18803 18804 1038. [bug] In servers configured with a tkey-domain option, 18805 TKEY queries with an owner name other than the root 18806 could cause an assertion failure. [RT #1866, #1869] 18807 18808 1037. [bug] Negative responses whose authority section contain 18809 SOA or NS records whose owner names are not equal 18810 equal to or parents of the query name should be 18811 rejected. [RT #1862] 18812 18813 1036. [func] Silently drop requests received via multicast as 18814 long as there is no final multicast DNS standard. 18815 18816 1035. [bug] If we respond to multicast queries (which we 18817 currently do not), respond from a unicast address 18818 as specified in RFC 1123. [RT #137] 18819 18820 1034. [bug] Ignore the RD bit on multicast queries as specified 18821 in RFC 1123. [RT #137] 18822 18823 1033. [bug] Always respond to requests with an unsupported opcode 18824 with NOTIMP, even if we don't have a matching view 18825 or cannot determine the class. 18826 18827 1032. [func] hostname.bind/txt/chaos now returns the name of 18828 the machine hosting the nameserver. This is useful 18829 in diagnosing problems with anycast servers. 18830 18831 1031. [bug] libbind.a: isc__gettimeofday() infinite recursion. 18832 [RT #1858] 18833 18834 1030. [bug] On systems with no resolv.conf file, nsupdate 18835 exited with an error rather than defaulting 18836 to using the loopback address. [RT #1836] 18837 18838 1029. [bug] Some named.conf errors did not cause the loading 18839 of the configuration file to return a failure 18840 status even though they were logged. [RT #1847] 18841 18842 1028. [bug] On Win32, dig/host/nslookup looked for resolv.conf 18843 in the wrong directory. [RT #1833] 18844 18845 1027. [bug] RRs having the reserved type 0 should be rejected. 18846 [RT #1471] 18847 18848 1026. [placeholder] 18849 18850 1025. [bug] Don't use multicast addresses to resolve iterative 18851 queries. [RT #101] 18852 18853 1024. [port] Compilation failed on HP-UX 11.11 due to 18854 incompatible use of the SIOCGLIFCONF macro 18855 name. [RT #1831] 18856 18857 1023. [func] Accept hints without TTLs. 18858 18859 1022. [bug] Don't report empty root hints as "extra data". 18860 [RT #1802] 18861 18862 1021. [bug] On Win32, log message timestamps were one month 18863 later than they should have been, and the server 18864 would exhibit unspecified behavior in December. 18865 18866 1020. [bug] IXFR log messages did not distinguish between 18867 true IXFRs, AXFR-style IXFRs, and mere version 18868 polls. [RT #1811] 18869 18870 1019. [bug] The value of the lame-ttl option was limited to 18000 18871 seconds, not 1800 seconds as documented. [RT #1803] 18872 18873 1018. [bug] The default log channel was not always initialized 18874 correctly. [RT #1813] 18875 18876 1017. [bug] When specifying TSIG keys to dig and nsupdate using 18877 the -k option, they must be HMAC-MD5 keys. [RT #1810] 18878 18879 1016. [bug] Slave zones with no backup file were re-transferred 18880 on every server reload. 18881 18882 1015. [bug] Log channels that had a "versions" option but no 18883 "size" option failed to create numbered log 18884 files. [RT #1783] 18885 18886 1014. [bug] Some queries would cause statistics counters to 18887 increment more than once or not at all. [RT #1321] 18888 18889 1013. [bug] It was possible to cancel a query twice when marking 18890 a server as bogus or by having a blackhole acl. 18891 [RT #1776] 18892 18893 1012. [bug] The -p option to named did not behave as documented. 18894 18895 1011. [cleanup] Removed isc_dir_current(). 18896 18897 1010. [bug] The server could attempt to execute a command channel 18898 command after initiating server shutdown, causing 18899 an assertion failure. [RT #1766] 18900 18901 1009. [port] OpenUNIX 8 support. [RT #1728] 18902 18903 1008. [port] libtool.m4, ltmain.sh from libtool-1.4.2. 18904 18905 1007. [port] config.guess, config.sub from autoconf-2.52. 18906 18907 1006. [bug] If a KEY RR was found missing during DNSSEC validation, 18908 an assertion failure could subsequently be triggered 18909 in the resolver. [RT #1763] 18910 18911 1005. [bug] Don't copy nonzero RCODEs from request to response. 18912 [RT #1765] 18913 18914 1004. [port] Deal with recvfrom() returning EHOSTDOWN. [RT #1770] 18915 18916 1003. [func] Add the +retry option to dig. 18917 18918 1002. [bug] When reporting an unknown class name in named.conf, 18919 including the file name and line number. [RT #1759] 18920 18921 1001. [bug] win32 socket code doio_recv was not catching a 18922 WSACONNRESET error when a client was timing out 18923 the request and closing its socket. [RT #1745] 18924 18925 1000. [bug] BIND 8 compatibility: accept "HESIOD" as an alias 18926 for class "HS". [RT #1759] 18927 18928 999. [func] "rndc retransfer zone [class [view]]" added. 18929 [RT #1752] 18930 18931 998. [func] named-checkzone now has arguments to specify the 18932 chroot directory (-t) and working directory (-w). 18933 [RT #1755] 18934 18935 997. [func] Add support for RSA-SHA1 keys (RFC3110). 18936 18937 996. [func] Issue warning if the configuration filename contains 18938 the chroot path. 18939 18940 995. [bug] dig, host, nslookup: using a raw IPv6 address as a 18941 target address should be fatal on a IPv4 only system. 18942 18943 994. [func] Treat non-authoritative responses to queries for type 18944 NS as referrals even if the NS records are in the 18945 answer section, because BIND 8 servers incorrectly 18946 send them that way. This is necessary for DNSSEC 18947 validation of the NS records of a secure zone to 18948 succeed when the parent is a BIND 8 server. [RT #1706] 18949 18950 993. [func] dig: -v now reports the version. 18951 18952 992. [doc] dig: ~/.digrc is now documented. 18953 18954 991. [func] Lower UDP refresh timeout messages to level 18955 debug 1. 18956 18957 990. [bug] The rndc-confgen man page was not installed. 18958 18959 989. [bug] Report filename if $INCLUDE fails for file related 18960 errors. [RT #1736] 18961 18962 988. [bug] 'additional-from-auth no;' did not work reliably 18963 in the case of queries answered from the cache. 18964 [RT #1436] 18965 18966 987. [bug] "dig -help" didn't show "+[no]stats". 18967 18968 986. [bug] "dig +noall" failed to clear stats and command 18969 printing. 18970 18971 985. [func] Consider network interfaces to be up iff they have 18972 a nonzero IP address rather than based on the 18973 IFF_UP flag. [RT #1160] 18974 18975 984. [bug] Multi-threading should be enabled by default on 18976 Solaris 2.7 and newer, but it wasn't. 18977 18978 983. [func] The server now supports generating IXFR difference 18979 sequences for non-dynamic zones by comparing zone 18980 versions, when enabled using the new config 18981 option "ixfr-from-differences". [RT #1727] 18982 18983 982. [func] If "memstatistics-file" is set in options the memory 18984 statistics will be written to it. 18985 18986 981. [func] The dnssec tools can now take multiple '-r randomfile' 18987 arguments. 18988 18989 980. [bug] Incoming zone transfers restarting after an error 18990 could trigger an assertion failure. [RT #1692] 18991 18992 979. [func] Incremental master file dumping. dns_master_dumpinc(), 18993 dns_master_dumptostreaminc(), dns_dumpctx_attach(), 18994 dns_dumpctx_detach(), dns_dumpctx_cancel(), 18995 dns_dumpctx_db() and dns_dumpctx_version(). 18996 18997 978. [bug] dns_db_attachversion() had an invalid REQUIRE() 18998 condition. 18999 19000 977. [bug] Improve "not at top of zone" error message. 19001 19002 976. [func] named-checkconf can now test load master zones 19003 (named-checkconf -z). [RT #1468] 19004 19005 975. [bug] "max-cache-size default;" as a view option 19006 caused an assertion failure. 19007 19008 974. [bug] "max-cache-size unlimited;" as a global option 19009 was not accepted. 19010 19011 973. [bug] Failed to log the question name when logging: 19012 "bad zone transfer request: non-authoritative zone 19013 (NOTAUTH)". 19014 19015 972. [bug] The file modification time code in zone.c was using the 19016 wrong epoch. [RT #1667] 19017 19018 971. [placeholder] 19019 19020 970. [func] 'max-journal-size' can now be used to set a target 19021 size for a journal. 19022 19023 969. [func] dig now supports the undocumented dig 8 feature 19024 of allowing arbitrary labels, not just dotted 19025 decimal quads, with the -x option. This can be 19026 used to conveniently look up RFC2317 names as in 19027 "dig -x 10.0.0.0-127". [RT #827, #1576, #1598] 19028 19029 968. [bug] On win32, the isc_time_now() function was unnecessarily 19030 calling strtime(). [RT #1671] 19031 19032 967. [bug] On win32, the link for bindevt was not including the 19033 required resource file to enable the event viewer 19034 to interpret the error messages in the event log, 19035 [RT #1668] 19036 19037 966. [placeholder] 19038 19039 965. [bug] Including data other than root server NS and A 19040 records in the root hint file could cause a rbtdb 19041 node reference leak. [RT #1581, #1618] 19042 19043 964. [func] Warn if data other than root server NS and A records 19044 are found in the root hint file. [RT #1581, #1618] 19045 19046 963. [bug] Bad ISC_LANG_ENDDECLS. [RT #1645] 19047 19048 962. [bug] libbind: bad "#undef", don't attempt to install 19049 non-existent nlist.h. [RT #1640] 19050 19051 961. [bug] Tried to use a IPV6 feature when ISC_PLATFORM_HAVEIPV6 19052 was not defined. [RT #1482] 19053 19054 960. [port] liblwres failed to build on systems with support for 19055 getrrsetbyname() in the OS. [RT #1592] 19056 19057 959. [port] On FreeBSD, determine the number of CPUs by calling 19058 sysctlbyname(). [RT #1584] 19059 19060 958. [port] ssize_t is not available on all platforms. [RT #1607] 19061 19062 957. [bug] sys/select.h inclusion was broken on older platforms. 19063 [RT #1607] 19064 19065 956. [bug] ns_g_autorndcfile changed to ns_g_keyfile 19066 in named/win32/os.c due to code changes in 19067 change #953. win32 .make file for rndc-confgen 19068 updated to add include path for os.h header. 19069 19070 .. code-block:: none 19071 19072 --- 9.2.0rc1 released --- 19073 19074 955. [bug] When using views, the zone's class was not being 19075 inherited from the view's class. [RT #1583] 19076 19077 954. [bug] When requesting AXFRs or IXFRs using dig, host, or 19078 nslookup, the RD bit should not be set as zone 19079 transfers are inherently non-recursive. [RT #1575] 19080 19081 953. [func] The /var/run/named.key file from change #843 19082 has been replaced by /etc/rndc.key. Both 19083 named and rndc will look for this file and use 19084 it to configure a default control channel key 19085 if not already configured using a different 19086 method (rndc.conf / controls). Unlike 19087 named.key, rndc.key is not created automatically; 19088 it must be created by manually running 19089 "rndc-confgen -a". 19090 19091 952. [bug] The server required manual intervention to serve the 19092 affected zones if it died between creating a journal 19093 and committing the first change to it. 19094 19095 951. [bug] CFLAGS was not passed to the linker when 19096 linking some of the test programs under 19097 bin/tests. [RT #1555]. 19098 19099 950. [bug] Explicit TTLs did not properly override $TTL 19100 due to a bug in change 834. [RT #1558] 19101 19102 949. [bug] host was unable to print records larger than 512 19103 bytes. [RT #1557] 19104 19105 .. code-block:: none 19106 19107 --- 9.2.0b2 released --- 19108 19109 948. [port] Integrated support for building on Windows NT / 19110 Windows 2000. 19111 19112 947. [bug] dns_rdata_soa_t had a badly named element "mname" which 19113 was really the RNAME field from RFC1035. To avoid 19114 confusion and silent errors that would occur it the 19115 "origin" and "mname" elements were given their correct 19116 names "mname" and "rname" respectively, the "mname" 19117 element is renamed to "contact". 19118 19119 946. [cleanup] doc/misc/options is now machine-generated from the 19120 configuration parser syntax tables, and therefore 19121 more likely to be correct. 19122 19123 945. [func] Add the new view-specific options 19124 "match-destinations" and "match-recursive-only". 19125 19126 944. [func] Check for expired signatures on load. 19127 19128 943. [bug] The server could crash when receiving a command 19129 via rndc if the configuration file listed only 19130 nonexistent keys in the controls statement. [RT #1530] 19131 19132 942. [port] libbind: GETNETBYADDR_ADDR_T was not correctly 19133 defined on some platforms. 19134 19135 941. [bug] The configuration checker crashed if a slave 19136 zone didn't contain a masters statement. [RT #1514] 19137 19138 940. [bug] Double zone locking failure on error path. [RT #1510] 19139 19140 .. code-block:: none 19141 19142 --- 9.2.0b1 released --- 19143 19144 939. [port] Add the --disable-linux-caps option to configure for 19145 systems that manage capabilities outside of named. 19146 [RT #1503] 19147 19148 938. [placeholder] 19149 19150 937. [bug] A race when shutting down a zone could trigger a 19151 INSIST() failure. [RT #1034] 19152 19153 936. [func] Warn about IPv4 addresses that are not complete 19154 dotted quads. [RT #1084] 19155 19156 935. [bug] inet_pton failed to reject leading zeros. 19157 19158 934. [port] Deal with systems where accept() spuriously returns 19159 ECONNRESET. 19160 19161 933. [bug] configure failed doing libbind on platforms not 19162 supported by BIND 8. [RT #1496] 19163 19164 .. code-block:: none 19165 19166 --- 9.2.0a3 released --- 19167 19168 932. [bug] Use INSTALL_SCRIPT, not INSTALL_PROGRAM, 19169 when installing isc-config.sh. 19170 [RT #198, #1466] 19171 19172 931. [bug] The controls statement only attempted to verify 19173 messages using the first key in the key list. 19174 (9.2.0a1/a2 only). 19175 19176 930. [func] Query performance testing tool added as 19177 contrib/queryperf. 19178 19179 929. [placeholder] 19180 19181 928. [bug] nsupdate would send empty update packets if the 19182 send (or empty line) command was run after 19183 another send but before any new updates or 19184 prerequisites were specified. It should simply 19185 ignore this command. 19186 19187 927. [bug] Don't hold the zone lock for the entire dump to disk. 19188 [RT #1423] 19189 19190 926. [bug] The resolver could deadlock with the ADB when 19191 shutting down (multi-threaded builds only). 19192 [RT #1324] 19193 19194 925. [cleanup] Remove openssl from the distribution; require that 19195 --with-openssl be specified if DNSSEC is needed. 19196 19197 924. [port] Extend support for pre-RFC2133 IPv6 implementation. 19198 [RT #987] 19199 19200 923. [bug] Multiline TSIG secrets (and other multiline strings) 19201 were not accepted in named.conf. [RT #1469] 19202 19203 922. [func] Added two new lwres_getrrsetbyname() result codes, 19204 ERR_NONAME and ERR_NODATA. 19205 19206 921. [bug] lwres returned an incorrect error code if it received 19207 a truncated message. 19208 19209 920. [func] Increase the lwres receive buffer size to 16K. 19210 [RT #1451] 19211 19212 919. [placeholder] 19213 19214 918. [func] In nsupdate, TSIG errors are no longer treated as 19215 fatal errors. 19216 19217 917. [func] New nsupdate command 'key', allowing TSIG keys to 19218 be specified in the nsupdate command stream rather 19219 than the command line. 19220 19221 916. [bug] Specifying type ixfr to dig without specifying 19222 a serial number failed in unexpected ways. 19223 19224 915. [func] The named-checkconf and named-checkzone programs 19225 now have a '-v' option for printing their version. 19226 [RT #1151] 19227 19228 914. [bug] Global 'server' statements were rejected when 19229 using views, even though they were accepted 19230 in 9.1. [RT #1368] 19231 19232 913. [bug] Cache cleaning was not sufficiently aggressive. 19233 [RT #1441, #1444] 19234 19235 912. [bug] Attempts to set the 'additional-from-cache' or 19236 'additional-from-auth' option to 'no' in a 19237 server with recursion enabled will now 19238 be ignored and cause a warning message. 19239 [RT #1145] 19240 19241 911. [placeholder] 19242 19243 910. [port] Some pre-RFC2133 IPv6 implementations do not define 19244 IN6ADDR_ANY_INIT. [RT #1416] 19245 19246 909. [placeholder] 19247 19248 908. [func] New program, rndc-confgen, to simplify setting up rndc. 19249 19250 907. [func] The ability to get entropy from either the 19251 random device, a user-provided file or from 19252 the keyboard was migrated from the DNSSEC tools 19253 to libisc as isc_entropy_usebestsource(). 19254 19255 906. [port] Separated the system independent portion of 19256 lib/isc/unix/entropy.c into lib/isc/entropy.c 19257 and added lib/isc/win32/entropy.c. 19258 19259 905. [bug] Configuring a forward "zone" for the root domain 19260 did not work. [RT #1418] 19261 19262 904. [bug] The server would leak memory if attempting to use 19263 an expired TSIG key. [RT #1406] 19264 19265 903. [bug] dig should not crash when receiving a TCP packet 19266 of length 0. 19267 19268 902. [bug] The -d option was ignored if both -t and -g were also 19269 specified. 19270 19271 901. [placeholder] 19272 19273 900. [bug] A config.guess update changed the system identification 19274 string of FreeBSD systems; configure and 19275 bin/tests/system/ifconfig.sh now recognize the new 19276 string. 19277 19278 .. code-block:: none 19279 19280 --- 9.2.0a2 released --- 19281 19282 899. [bug] lib/dns/soa.c failed to compile on many platforms 19283 due to inappropriate use of a void value. 19284 [RT #1372, #1373, #1386, #1387, #1395] 19285 19286 898. [bug] "dig" failed to set a nonzero exit status 19287 on UDP query timeout. [RT #1323] 19288 19289 897. [bug] A config.guess update changed the system identification 19290 string of UnixWare systems; configure now recognizes 19291 the new string. 19292 19293 896. [bug] If a configuration file is set on named's command line 19294 and it has a relative pathname, the current directory 19295 (after any possible jailing resulting from named -t) 19296 will be prepended to it so that reloading works 19297 properly even when a directory option is present. 19298 19299 895. [func] New function, isc_dir_current(), akin to POSIX's 19300 getcwd(). 19301 19302 894. [bug] When using the DNSSEC tools, a message intended to warn 19303 when the keyboard was being used because of the lack 19304 of a suitable random device was not being printed. 19305 19306 893. [func] Removed isc_file_test() and added isc_file_exists() 19307 for the basic functionality that was being added 19308 with isc_file_test(). 19309 19310 892. [placeholder] 19311 19312 891. [bug] Return an error when a SIG(0) signed response to 19313 an unsigned query is seen. This should actually 19314 do the verification, but it's not currently 19315 possible. [RT #1391] 19316 19317 890. [cleanup] The man pages no longer require the mandoc macros 19318 and should now format cleanly using most versions of 19319 nroff, and HTML versions of the man pages have been 19320 added. Both are generated from DocBook source. 19321 19322 889. [port] Eliminated blank lines before .TH in nroff man 19323 pages since they cause problems with some versions 19324 of nroff. [RT #1390] 19325 19326 888. [bug] Don't die when using TKEY to delete a nonexistent 19327 TSIG key. [RT #1392] 19328 19329 887. [port] Detect broken compilers that can't call static 19330 functions from inline functions. [RT #1212] 19331 19332 886. [placeholder] 19333 19334 885. [placeholder] 19335 19336 884. [placeholder] 19337 19338 883. [placeholder] 19339 19340 882. [placeholder] 19341 19342 881. [placeholder] 19343 19344 880. [placeholder] 19345 19346 879. [placeholder] 19347 19348 878. [placeholder] 19349 19350 877. [placeholder] 19351 19352 876. [placeholder] 19353 19354 875. [placeholder] 19355 19356 874. [placeholder] 19357 19358 873. [placeholder] 19359 19360 872. [placeholder] 19361 19362 871. [placeholder] 19363 19364 870. [placeholder] 19365 19366 869. [placeholder] 19367 19368 868. [placeholder] 19369 19370 867. [placeholder] 19371 19372 866. [func] Close debug only file channels when debug is set to 19373 zero. [RT #1246] 19374 19375 865. [bug] The new configuration parser did not allow 19376 the optional debug level in a "severity debug" 19377 clause of a logging channel to be omitted. 19378 This is now allowed and treated as "severity 19379 debug 1;" like it does in BIND 8.2.4, not as 19380 "severity debug 0;" like it did in BIND 9.1. 19381 [RT #1367] 19382 19383 864. [cleanup] Multi-threading is now enabled by default on 19384 OSF1, Solaris 2.7 and newer, AIX, IRIX, and HP-UX. 19385 19386 863. [bug] If an error occurred while an outgoing zone transfer 19387 was starting up, the server could access a domain 19388 name that had already been freed when logging a 19389 message saying that the transfer was starting. 19390 [RT #1383] 19391 19392 862. [bug] Use after realloc(), non portable pointer arithmetic in 19393 grmerge(). 19394 19395 861. [port] Add support for Mac OS X, by making it equivalent 19396 to Darwin. This was derived from the config.guess 19397 file shipped with Mac OS X. [RT #1355] 19398 19399 860. [func] Drop cross class glue in zone transfers. 19400 19401 859. [bug] Cache cleaning now won't swamp the CPU if there 19402 is a persistent over limit condition. 19403 19404 858. [func] isc_mem_setwater() no longer requires that when the 19405 callback function is non-NULL then its hi_water 19406 argument must be greater than its lo_water argument 19407 (they can now be equal) or that they be non-zero. 19408 19409 857. [cleanup] Use ISC_MAGIC() to define all magic numbers for 19410 structs, for our friends in EBCDIC-land. 19411 19412 856. [func] Allow partial rdatasets to be returned in answer and 19413 authority sections to help non-TCP capable clients 19414 recover from truncation. [RT #1301] 19415 19416 855. [bug] Stop spurious "using RFC 1035 TTL semantics" warnings. 19417 19418 854. [bug] The config parser didn't properly handle config 19419 options that were specified in units of time other 19420 than seconds. [RT #1372] 19421 19422 853. [bug] configure_view_acl() failed to detach existing acls. 19423 [RT #1374] 19424 19425 852. [bug] Handle responses from servers which do not know 19426 about IXFR. 19427 19428 851. [cleanup] The obsolete support-ixfr option was not properly 19429 ignored. 19430 19431 .. code-block:: none 19432 19433 --- 9.2.0a1 released --- 19434 19435 850. [bug] dns_rbt_findnode() would not find nodes that were 19436 split on a bitstring label somewhere other than in 19437 the last label of the node. [RT #1351] 19438 19439 849. [func] <isc/net.h> will ensure INADDR_LOOPBACK is defined. 19440 19441 848. [func] A minimum max-cache-size of two megabytes is enforced 19442 by the cache cleaner. 19443 19444 847. [func] Added isc_file_test(), which currently only has 19445 some very basic functionality to test for the 19446 existence of a file, whether a pathname is absolute, 19447 or whether a pathname is the fundamental representation 19448 of the current directory. It is intended that this 19449 function can be expanded to test other things a 19450 programmer might want to know about a file. 19451 19452 846. [func] A non-zero 'param' to dst_key_generate() when making an 19453 hmac-md5 key means that good entropy is not required. 19454 19455 845. [bug] The access rights on the public file of a symmetric 19456 key are now restricted as soon as the file is opened, 19457 rather than after it has been written and closed. 19458 19459 844. [func] <isc/net.h> will ensure INADDR_LOOPBACK is defined, 19460 just as <lwres/net.h> does. 19461 19462 843. [func] If no controls statement is present in named.conf, 19463 or if any inet phrase of a controls statement is 19464 lacking a keys clause, then a key will be automatically 19465 generated by named and an rndc.conf-style file 19466 named named.key will be written that uses it. rndc 19467 will use this file only if its normal configuration 19468 file, or one provided on the command line, does not 19469 exist. 19470 19471 842. [func] 'rndc flush' now takes an optional view. 19472 19473 841. [bug] When sdb modules were not declared threadsafe, their 19474 create and destroy functions were not serialized. 19475 19476 840. [bug] The config file parser could print the wrong file 19477 name if an error was detected after an included file 19478 was parsed. [RT #1353] 19479 19480 839. [func] Dump packets for which there was no view or that the 19481 class could not be determined to category "unmatched". 19482 19483 838. [port] UnixWare 7.x.x is now supported by 19484 bin/tests/system/ifconfig.sh. 19485 19486 837. [cleanup] Multi-threading is now enabled by default only on 19487 OSF1, Solaris 2.7 and newer, and AIX. 19488 19489 836. [func] Upgraded libtool to 1.4. 19490 19491 835. [bug] The dispatcher could enter a busy loop if 19492 it got an I/O error receiving on a UDP socket. 19493 [RT #1293] 19494 19495 834. [func] Accept (but warn about) master files beginning with 19496 an SOA record without an explicit TTL field and 19497 lacking a $TTL directive, by using the SOA MINTTL 19498 as a default TTL. This is for backwards compatibility 19499 with old versions of BIND 8, which accepted such 19500 files without warning although they are illegal 19501 according to RFC1035. 19502 19503 833. [cleanup] Moved dns_soa_*() from <dns/journal.h> to 19504 <dns/soa.h>, and extended them to support 19505 all the integer-valued fields of the SOA RR. 19506 19507 832. [bug] The default location for named.conf in named-checkconf 19508 should depend on --sysconfdir like it does in named. 19509 [RT #1258] 19510 19511 831. [placeholder] 19512 19513 830. [func] Implement 'rndc status'. 19514 19515 829. [bug] The DNS_R_ZONECUT result code should only be returned 19516 when an ANY query is made with DNS_DBFIND_GLUEOK set. 19517 In all other ANY query cases, returning the delegation 19518 is better. 19519 19520 828. [bug] The errno value from recvfrom() could be overwritten 19521 by logging code. [RT #1293] 19522 19523 827. [bug] When an IXFR protocol error occurs, the slave 19524 should retry with AXFR. 19525 19526 826. [bug] Some IXFR protocol errors were not detected. 19527 19528 825. [bug] zone.c:ns_query() detached from the wrong zone 19529 reference. [RT #1264] 19530 19531 824. [bug] Correct line numbers reported by dns_master_load(). 19532 [RT #1263] 19533 19534 823. [func] The output of "dig -h" now goes to stdout so that it 19535 can easily be piped through "more". [RT #1254] 19536 19537 822. [bug] Sending nxrrset prerequisites would crash nsupdate. 19538 [RT #1248] 19539 19540 821. [bug] The program name used when logging to syslog should 19541 be stripped of leading path components. 19542 [RT #1178, #1232] 19543 19544 820. [bug] Name server address lookups failed to follow 19545 A6 chains into the glue of local authoritative 19546 zones. 19547 19548 819. [bug] In certain cases, the resolver's attempts to 19549 restart an address lookup at the root could cause 19550 the fetch to deadlock (with itself) instead of 19551 restarting. [RT #1225] 19552 19553 818. [bug] Certain pathological responses to ANY queries could 19554 cause an assertion failure. [RT #1218] 19555 19556 817. [func] Adjust timeouts for dialup zone queries. 19557 19558 816. [bug] Report potential problems with log file accessibility 19559 at configuration time, since such problems can't 19560 reliably be reported at the time they actually occur. 19561 19562 815. [bug] If a log file was specified with a path separator 19563 character (i.e. "/") in its name and the directory 19564 did not exist, the log file's name was treated as 19565 though it were the directory name. [RT #1189] 19566 19567 814. [bug] Socket objects left over from accept() failures 19568 were incorrectly destroyed, causing corruption 19569 of socket manager data structures. 19570 19571 813. [bug] File descriptors exceeding FD_SETSIZE were handled 19572 badly. [RT #1192] 19573 19574 812. [bug] dig sometimes printed incomplete IXFR responses 19575 due to an uninitialized variable. [RT #1188] 19576 19577 811. [bug] Parentheses were not quoted in zone dumps. [RT #1194] 19578 19579 810. [bug] The signer name in SIG records was not properly 19580 down-cased when signing/verifying records. [RT #1186] 19581 19582 809. [bug] Configuring a non-local address as a transfer-source 19583 could cause an assertion failure during load. 19584 19585 808. [func] Add 'rndc flush' to flush the server's cache. 19586 19587 807. [bug] When setting up TCP connections for incoming zone 19588 transfers, the transfer-source port was not 19589 ignored like it should be. 19590 19591 806. [bug] DNS_R_SEENINCLUDE was failing to propagate back up 19592 the calling stack to the zone maintenance level, 19593 causing zones to not reload when an included file was 19594 touched but the top-level zone file was not. 19595 19596 805. [bug] When using "forward only", missing root hints should 19597 not cause queries to fail. [RT #1143] 19598 19599 804. [bug] Attempting to obtain entropy could fail in some 19600 situations. This would be most common on systems 19601 with user-space threads. [RT #1131] 19602 19603 803. [bug] Treat all SIG queries as if they have the CD bit set, 19604 otherwise no data will be returned [RT #749] 19605 19606 802. [bug] DNSSEC key tags were computed incorrectly in almost 19607 all cases. [RT #1146] 19608 19609 801. [bug] nsupdate should treat lines beginning with ';' as 19610 comments. [RT #1139] 19611 19612 800. [bug] dnssec-signzone produced incorrect statistics for 19613 large zones. [RT #1133] 19614 19615 799. [bug] The ADB didn't find AAAA glue in a zone unless A6 19616 glue was also present. 19617 19618 798. [bug] nsupdate should be able to reject bad input lines 19619 and continue. [RT #1130] 19620 19621 797. [func] Issue a warning if the 'directory' option contains 19622 a relative path. [RT #269] 19623 19624 796. [func] When a size limit is associated with a log file, 19625 only roll it when the size is reached, not every 19626 time the log file is opened. [RT #1096] 19627 19628 795. [func] Add the +multiline option to dig. [RT #1095] 19629 19630 794. [func] Implement the "port" and "default-port" statements 19631 in rndc.conf. 19632 19633 793. [cleanup] The DNSSEC tools could create filenames that were 19634 illegal or contained shell meta-characters. They 19635 now use a different text encoding of names that 19636 doesn't have these problems. [RT #1101] 19637 19638 792. [cleanup] Replace the OMAPI command channel protocol with a 19639 simpler one. 19640 19641 791. [bug] The command channel now works over IPv6. 19642 19643 790. [bug] Wildcards created using dynamic update or IXFR 19644 could fail to match. [RT #1111] 19645 19646 789. [bug] The "localhost" and "localnets" ACLs did not match 19647 when used as the second element of a two-element 19648 sortlist item. 19649 19650 788. [func] Add the "match-mapped-addresses" option, which 19651 causes IPv6 v4mapped addresses to be treated as 19652 IPv4 addresses for the purpose of acl matching. 19653 19654 787. [bug] The DNSSEC tools failed to downcase domain 19655 names when mapping them into file names. 19656 19657 786. [bug] When DNSSEC signing/verifying data, owner names were 19658 not properly down-cased. 19659 19660 785. [bug] A race condition in the resolver could cause 19661 an assertion failure. [RT #673, #872, #1048] 19662 19663 784. [bug] nsupdate and other programs would not quit properly 19664 if some signals were blocked by the caller. [RT #1081] 19665 19666 783. [bug] Following CNAMEs could cause an assertion failure 19667 when either using an sdb database or under very 19668 rare conditions. 19669 19670 782. [func] Implement the "serial-query-rate" option. 19671 19672 781. [func] Avoid error packet loops by dropping duplicate FORMERR 19673 responses. [RT #1006] 19674 19675 780. [bug] Error handling code dealing with out of memory or 19676 other rare errors could lead to assertion failures 19677 by calling functions on uninitialized names. [RT #1065] 19678 19679 779. [func] Added the "minimal-responses" option. 19680 19681 778. [bug] When starting cache cleaning, cleaning_timer_action() 19682 returned without first pausing the iterator, which 19683 could cause deadlock. [RT #998] 19684 19685 777. [bug] An empty forwarders list in a zone failed to override 19686 global forwarders. [RT #995] 19687 19688 776. [func] Improved error reporting in denied messages. [RT #252] 19689 19690 775. [placeholder] 19691 19692 774. [func] max-cache-size is implemented. 19693 19694 773. [func] Added isc_rwlock_trylock() to attempt to lock without 19695 blocking. 19696 19697 772. [bug] Owner names could be incorrectly omitted from cache 19698 dumps in the presence of negative caching entries. 19699 [RT #991] 19700 19701 771. [cleanup] TSIG errors related to unsynchronized clocks 19702 are logged better. [RT #919] 19703 19704 770. [func] Add the "edns yes_or_no" statement to the server 19705 clause. [RT #524] 19706 19707 769. [func] Improved error reporting when parsing rdata. [RT #740] 19708 19709 768. [bug] The server did not emit an SOA when a CNAME 19710 or DNAME chain ended in NXDOMAIN in an 19711 authoritative zone. 19712 19713 767. [placeholder] 19714 19715 766. [bug] A few cases in query_find() could leak fname. 19716 This would trigger the mpctx->allocated == 0 19717 assertion when the server exited. 19718 [RT #739, #776, #798, #812, #818, #821, #845, 19719 #892, #935, #966] 19720 19721 765. [func] ACL names are once again case insensitive, like 19722 in BIND 8. [RT #252] 19723 19724 764. [func] Configuration files now allow "include" directives 19725 in more places, such as inside the "view" statement. 19726 [RT #377, #728, #860] 19727 19728 763. [func] Configuration files no longer have reserved words. 19729 [RT #731, #753] 19730 19731 762. [cleanup] The named.conf and rndc.conf file parsers have 19732 been completely rewritten. 19733 19734 761. [bug] _REENTRANT was still defined when building with 19735 --disable-threads. 19736 19737 760. [contrib] Significant enhancements to the pgsql sdb driver. 19738 19739 759. [bug] The resolver didn't turn off "avoid fetches" mode 19740 when restarting, possibly causing resolution 19741 to fail when it should not. This bug only affected 19742 platforms which support both IPv4 and IPv6. [RT #927] 19743 19744 758. [bug] The "avoid fetches" code did not treat negative 19745 cache entries correctly, causing fetches that would 19746 be useful to be avoided. This bug only affected 19747 platforms which support both IPv4 and IPv6. [RT #927] 19748 19749 757. [func] Log zone transfers. 19750 19751 756. [bug] dns_zone_load() could "return" success when no master 19752 file was configured. 19753 19754 755. [bug] Fix incorrectly formatted log messages in zone.c. 19755 19756 754. [bug] Certain failure conditions sending UDP packets 19757 could cause the server to retry the transmission 19758 indefinitely. [RT #902] 19759 19760 753. [bug] dig, host, and nslookup would fail to contact a 19761 remote server if getaddrinfo() returned an IPv6 19762 address on a system that doesn't support IPv6. 19763 [RT #917] 19764 19765 752. [func] Correct bad tv_usec elements returned by 19766 gettimeofday(). 19767 19768 751. [func] Log successful zone loads / transfers. [RT #898] 19769 19770 750. [bug] A query should not match a DNAME whose trust level 19771 is pending. [RT #916] 19772 19773 749. [bug] When a query matched a DNAME in a secure zone, the 19774 server did not return the signature of the DNAME. 19775 [RT #915] 19776 19777 748. [doc] List supported RFCs in doc/misc/rfc-compliance. 19778 [RT #781] 19779 19780 747. [bug] The code to determine whether an IXFR was possible 19781 did not properly check for a database that could 19782 not have a journal. [RT #865, #908] 19783 19784 746. [bug] The sdb didn't clone rdatasets properly, causing 19785 a crash when the server followed delegations. [RT #905] 19786 19787 745. [func] Report the owner name of records that fail 19788 semantic checks while loading. 19789 19790 744. [bug] When returning DNS_R_CNAME or DNS_R_DNAME as the 19791 result of an ANY or SIG query, the resolver failed 19792 to setup the return event's rdatasets, causing an 19793 assertion failure in the query code. [RT #881] 19794 19795 743. [bug] Receiving a large number of certain malformed 19796 answers could cause named to stop responding. 19797 [RT #861] 19798 19799 742. [placeholder] 19800 19801 741. [port] Support openssl-engine. [RT #709] 19802 19803 740. [port] Handle openssl library mismatches slightly better. 19804 19805 739. [port] Look for /dev/random in configure, rather than 19806 assuming it will be there for only a predefined 19807 set of OSes. 19808 19809 738. [bug] If a non-threadsafe sdb driver supported AXFR and 19810 received an AXFR request, it would deadlock or die 19811 with an assertion failure. [RT #852] 19812 19813 737. [port] stdtime.c failed to compile on certain platforms. 19814 19815 736. [func] New functions isc_task_{begin,end}exclusive(). 19816 19817 735. [doc] Add BIND 4 migration notes. 19818 19819 734. [bug] An attempt to re-lock the zone lock could occur if 19820 the server was shutdown during a zone transfer. 19821 [RT #830] 19822 19823 733. [bug] Reference counts of dns_acl_t objects need to be 19824 locked but were not. [RT #801, #821] 19825 19826 732. [bug] Glue with 0 TTL could also cause SERVFAIL. [RT #828] 19827 19828 731. [bug] Certain zone errors could cause named-checkzone to 19829 fail ungracefully. [RT #819] 19830 19831 730. [bug] lwres_getaddrinfo() returns the correct result when 19832 it fails to contact a server. [RT #768] 19833 19834 729. [port] pthread_setconcurrency() needs to be called on Solaris. 19835 19836 728. [bug] Fix comment processing on master file directives. 19837 [RT #757] 19838 19839 727. [port] Work around OS bug where accept() succeeds but 19840 fails to fill in the peer address of the accepted 19841 connection, by treating it as an error rather than 19842 an assertion failure. [RT #809] 19843 19844 726. [func] Implement the "trace" and "notrace" commands in rndc. 19845 19846 725. [bug] Installing man pages could fail. 19847 19848 724. [func] New libisc functions isc_netaddr_any(), 19849 isc_netaddr_any6(). 19850 19851 723. [bug] Referrals whose NS RRs had a 0 TTL caused the resolver 19852 to return DNS_R_SERVFAIL. [RT #783] 19853 19854 722. [func] Allow incremental loads to be canceled. 19855 19856 721. [cleanup] Load manager and dns_master_loadfilequota() are no 19857 more. 19858 19859 720. [bug] Server could enter infinite loop in 19860 dispatch.c:do_cancel(). [RT #733] 19861 19862 719. [bug] Rapid reloads could trigger an assertion failure. 19863 [RT #743, #763] 19864 19865 718. [cleanup] "internal" is no longer a reserved word in named.conf. 19866 [RT #753, #731] 19867 19868 717. [bug] Certain TKEY processing failure modes could 19869 reference an uninitialized variable, causing the 19870 server to crash. [RT #750] 19871 19872 716. [bug] The first line of a $INCLUDE master file was lost if 19873 an origin was specified. [RT #744] 19874 19875 715. [bug] Resolving some A6 chains could cause an assertion 19876 failure in adb.c. [RT #738] 19877 19878 714. [bug] Preserve interval timers across reloads unless changed. 19879 [RT #729] 19880 19881 713. [func] named-checkconf takes '-t directory' similar to named. 19882 [RT #726] 19883 19884 712. [bug] Sending a large signed update message caused an 19885 assertion failure. [RT #718] 19886 19887 711. [bug] The libisc and liblwres implementations of 19888 inet_ntop contained an off by one error. 19889 19890 710. [func] The forwarders statement now takes an optional 19891 port. [RT #418] 19892 19893 709. [bug] ANY or SIG queries for data with a TTL of 0 19894 would return SERVFAIL. [RT #620] 19895 19896 708. [bug] When building with --with-openssl, the openssl headers 19897 included with BIND 9 should not be used. [RT #702] 19898 19899 707. [func] The "filename" argument to named-checkzone is no 19900 longer optional, to reduce confusion. [RT #612] 19901 19902 706. [bug] Zones with an explicit "allow-update { none; };" 19903 were considered dynamic and therefore not reloaded 19904 on SIGHUP or "rndc reload". 19905 19906 705. [port] Work out resource limit type for use where rlim_t is 19907 not available. [RT #695] 19908 19909 704. [port] RLIMIT_NOFILE is not available on all platforms. 19910 [RT #695] 19911 19912 703. [port] sys/select.h is needed on older platforms. [RT #695] 19913 19914 702. [func] If the address 0.0.0.0 is seen in resolv.conf, 19915 use 127.0.0.1 instead. [RT #693] 19916 19917 701. [func] Root hints are now fully optional. Class IN 19918 views use compiled-in hints by default, as 19919 before. Non-IN views with no root hints now 19920 provide authoritative service but not recursion. 19921 A warning is logged if a view has neither root 19922 hints nor authoritative data for the root. [RT #696] 19923 19924 700. [bug] $GENERATE range check was wrong. [RT #688] 19925 19926 699. [bug] The lexer mishandled empty quoted strings. [RT #694] 19927 19928 698. [bug] Aborting nsupdate with ^C would lead to several 19929 race conditions. 19930 19931 697. [bug] nsupdate was not compatible with the undocumented 19932 BIND 8 behavior of ignoring TTLs in "update delete" 19933 commands. [RT #693] 19934 19935 696. [bug] lwresd would die with an assertion failure when passed 19936 a zero-length name. [RT #692] 19937 19938 695. [bug] If the resolver attempted to query a blackholed or 19939 bogus server, the resolution would fail immediately. 19940 19941 694. [bug] $GENERATE did not produce the last entry. 19942 [RT #682, #683] 19943 19944 693. [bug] An empty lwres statement in named.conf caused 19945 the server to crash while loading. 19946 19947 692. [bug] Deal with systems that have getaddrinfo() but not 19948 gai_strerror(). [RT #679] 19949 19950 691. [bug] Configuring per-view forwarders caused an assertion 19951 failure. [RT #675, #734] 19952 19953 690. [func] $GENERATE now supports DNAME. [RT #654] 19954 19955 689. [doc] man pages are now installed. [RT #210] 19956 19957 688. [func] "make tags" now works on systems with the 19958 "Exuberant Ctags" etags. 19959 19960 687. [bug] Only say we have IPv6, with sufficient functionality, 19961 if it has actually been tested. [RT #586] 19962 19963 686. [bug] dig and nslookup can now be properly aborted during 19964 blocking operations. [RT #568] 19965 19966 685. [bug] nslookup should use the search list/domain options 19967 from resolv.conf by default. [RT #405, #630] 19968 19969 684. [bug] Memory leak with view forwarders. [RT #656] 19970 19971 683. [bug] File descriptor leak in isc_lex_openfile(). 19972 19973 682. [bug] nslookup displayed SOA records incorrectly. [RT #665] 19974 19975 681. [bug] $GENERATE specifying output format was broken. [RT #653] 19976 19977 680. [bug] dns_rdata_fromstruct() mishandled options bigger 19978 than 255 octets. 19979 19980 679. [bug] $INCLUDE could leak memory and file descriptors on 19981 reload. [RT #639] 19982 19983 678. [bug] "transfer-format one-answer;" could trigger an assertion 19984 failure. [RT #646] 19985 19986 677. [bug] dnssec-signzone would occasionally use the wrong ttl 19987 for database operations and fail. [RT #643] 19988 19989 676. [bug] Log messages about lame servers to category 19990 'lame-servers' rather than 'resolver', so as not 19991 to be gratuitously incompatible with BIND 8. 19992 19993 675. [bug] TKEY queries could cause the server to leak 19994 memory. 19995 19996 674. [func] Allow messages to be TSIG signed / verified using 19997 a offset from the current time. 19998 19999 673. [func] The server can now convert RFC1886-style recursive 20000 lookup requests into RFC2874-style lookups, when 20001 enabled using the new option "allow-v6-synthesis". 20002 20003 672. [bug] The wrong time was in the "time signed" field when 20004 replying with BADTIME error. 20005 20006 671. [bug] The message code was failing to parse a message with 20007 no question section and a TSIG record. [RT #628] 20008 20009 670. [bug] The lwres replacements for getaddrinfo and 20010 getipnodebyname didn't properly check for the 20011 existence of the sockaddr sa_len field. 20012 20013 669. [bug] dnssec-keygen now makes the public key file 20014 non-world-readable for symmetric keys. [RT #403] 20015 20016 668. [func] named-checkzone now reports multiple errors in master 20017 files. 20018 20019 667. [bug] On Linux, running named with the -u option and a 20020 non-world-readable configuration file didn't work. 20021 [RT #626] 20022 20023 666. [bug] If a request sent by dig is longer than 512 bytes, 20024 use TCP. 20025 20026 665. [bug] Signed responses were not sent when the size of the 20027 TSIG + question exceeded the maximum message size. 20028 [RT #628] 20029 20030 664. [bug] The t_tasks and t_timers module tests are now skipped 20031 when building without threads, since they require 20032 threads. 20033 20034 663. [func] Accept a size_spec, not just an integer, in the 20035 (unimplemented and ignored) max-ixfr-log-size option 20036 for compatibility with recent versions of BIND 8. 20037 [RT #613] 20038 20039 662. [bug] dns_rdata_fromtext() failed to log certain errors. 20040 20041 661. [bug] Certain UDP IXFR requests caused an assertion failure 20042 (mpctx->allocated == 0). [RT #355, #394, #623] 20043 20044 660. [port] Detect multiple CPUs on HP-UX and IRIX. 20045 20046 659. [performance] Rewrite the name compression code to be much faster. 20047 20048 658. [cleanup] Remove all vestiges of 16 bit global compression. 20049 20050 657. [bug] When a listen-on statement in an lwres block does not 20051 specify a port, use 921, not 53. Also update the 20052 listen-on documentation. [RT #616] 20053 20054 656. [func] Treat an unescaped newline in a quoted string as 20055 an error. This means that TXT records with missing 20056 close quotes should have meaningful errors printed. 20057 20058 655. [bug] Improve error reporting on unexpected eof when loading 20059 zones. [RT #611] 20060 20061 654. [bug] Origin was being forgotten in TCP retries in dig. 20062 [RT #574] 20063 20064 653. [bug] +defname option in dig was reversed in sense. 20065 [RT #549] 20066 20067 652. [bug] zone_saveunique() did not report the new name. 20068 20069 651. [func] The AD bit in responses now has the meaning 20070 specified in <draft-ietf-dnsext-ad-is-secure>. 20071 20072 650. [bug] SIG(0) records were being generated and verified 20073 incorrectly. [RT #606] 20074 20075 649. [bug] It was possible to join to an already running fctx 20076 after it had "cloned" its events, but before it sent 20077 them. In this case, the event of the newly joined 20078 fetch would not contain the answer, and would 20079 trigger the INSIST() in fctx_sendevents(). In 20080 BIND 9.0, this bug did not trigger an INSIST(), but 20081 caused the fetch to fail with a SERVFAIL result. 20082 [RT #588, #597, #605, #607] 20083 20084 648. [port] Add support for pre-RFC2133 IPv6 implementations. 20085 20086 647. [bug] Resolver queries sent after following multiple 20087 referrals had excessively long retransmission 20088 timeouts due to incorrectly counting the referrals 20089 as "restarts". 20090 20091 646. [bug] The UnixWare ISC_PLATFORM_FIXIN6INADDR fix in isc/net.h 20092 didn't _cleanly_ fix the problem it was trying to fix. 20093 20094 645. [port] BSD/OS 3.0 needs pthread_init(). [RT #603] 20095 20096 644. [bug] #622 needed more work. [RT #562] 20097 20098 643. [bug] xfrin error messages made more verbose, added class 20099 of the zone. [RT #599] 20100 20101 642. [bug] Break the exit_check() race in the zone module. 20102 [RT #598] 20103 20104 .. code-block:: none 20105 20106 --- 9.1.0b2 released --- 20107 20108 641. [bug] $GENERATE caused a uninitialized link to be used. 20109 [RT #595] 20110 20111 640. [bug] Memory leak in error path could cause 20112 "mpctx->allocated == 0" failure. [RT #584] 20113 20114 639. [bug] Reading entropy from the keyboard would sometimes fail. 20115 [RT #591] 20116 20117 638. [port] lib/isc/random.c needed to explicitly include time.h 20118 to get a prototype for time() when pthreads was not 20119 being used. [RT #592] 20120 20121 637. [port] Use isc_u?int64_t instead of (unsigned) long long in 20122 lib/isc/print.c. Also allow lib/isc/print.c to 20123 be compiled even if the platform does not need it. 20124 [RT #592] 20125 20126 636. [port] Shut up MSVC++ about a possible loss of precision 20127 in the ISC__BUFFER_PUTUINT*() macros. [RT #592] 20128 20129 635. [bug] Reloading a server with a configured blackhole list 20130 would cause an assertion. [RT #590] 20131 20132 634. [bug] A log file will completely stop being written when 20133 it reaches the maximum size in all cases, not just 20134 when versioning is also enabled. [RT #570] 20135 20136 633. [port] Cope with rlim_t missing on BSD/OS systems. [RT #575] 20137 20138 632. [bug] The index array of the journal file was 20139 corrupted as it was written to disk. 20140 20141 631. [port] Build without thread support on systems without 20142 pthreads. 20143 20144 630. [bug] Locking failure in zone code. [RT #582] 20145 20146 629. [bug] 9.1.0b1 dereferenced a null pointer and crashed 20147 when responding to a UDP IXFR request. 20148 20149 628. [bug] If the root hints contained only AAAA addresses, 20150 named would be unable to perform resolution. 20151 20152 627. [bug] The EDNS0 blackhole detection code of change 324 20153 waited for three retransmissions to each server, 20154 which takes much too long when a domain has many 20155 name servers and all of them drop EDNS0 queries. 20156 Now we retry without EDNS0 after three consecutive 20157 timeouts, even if they are all from different 20158 servers. [RT #143] 20159 20160 626. [bug] The lightweight resolver daemon no longer crashes 20161 when asked for a SIG rrset. [RT #558] 20162 20163 625. [func] Zones now inherit their class from the enclosing view. 20164 20165 624. [bug] The zone object could get timer events after it had 20166 been destroyed, causing a server crash. [RT #571] 20167 20168 623. [func] Added "named-checkconf" and "named-checkzone" program 20169 for syntax checking named.conf files and zone files, 20170 respectively. 20171 20172 622. [bug] A canceled request could be destroyed before 20173 dns_request_destroy() was called. [RT #562] 20174 20175 621. [port] Disable IPv6 at runtime if IPv6 sockets are unusable. 20176 This mostly affects Red Hat Linux 7.0, which has 20177 conflicts between libc and the kernel. 20178 20179 620. [bug] dns_master_load*inc() now require 'task' and 'load' 20180 to be non-null. Also 'done' will not be called if 20181 dns_master_load*inc() fails immediately. [RT #565] 20182 20183 619. [placeholder] 20184 20185 618. [bug] Queries to a signed zone could sometimes cause 20186 an assertion failure. 20187 20188 617. [bug] When using dynamic update to add a new RR to an 20189 existing RRset with a different TTL, the journal 20190 entries generated from the update did not include 20191 explicit deletions and re-additions of the existing 20192 RRs to update their TTL to the new value. 20193 20194 616. [func] dnssec-signzone -t output now includes performance 20195 statistics. 20196 20197 615. [bug] dnssec-signzone did not like child keysets signed 20198 by multiple keys. 20199 20200 614. [bug] Checks for uninitialized link fields were prone 20201 to false positives, causing assertion failures. 20202 The checks are now disabled by default and may 20203 be re-enabled by defining ISC_LIST_CHECKINIT. 20204 20205 613. [bug] "rndc reload zone" now reloads primary zones. 20206 It previously only updated slave and stub zones, 20207 if an SOA query indicated an out of date serial. 20208 20209 612. [cleanup] Shutup a ridiculously noisy HP-UX compiler that 20210 complains relentlessly about how its treatment 20211 of 'const' has changed as well as how casting 20212 sometimes tightens alignment constraints. 20213 20214 611. [func] allow-notify can be used to permit processing of 20215 notify messages from hosts other than a slave's 20216 masters. 20217 20218 610. [func] rndc dumpdb is now supported. 20219 20220 609. [bug] getrrsetbyname() would crash lwresd if the server 20221 found more SIGs than answers. [RT #554] 20222 20223 608. [func] dnssec-signzone now adds a comment to the zone 20224 with the time the file was signed. 20225 20226 607. [bug] nsupdate would fail if it encountered a CNAME or 20227 DNAME in a response to an SOA query. [RT #515] 20228 20229 606. [bug] Compiling with --disable-threads failed due 20230 to isc_thread_self() being incorrectly defined 20231 as an integer rather than a function. 20232 20233 605. [func] New function isc_lex_getlasttokentext(). 20234 20235 604. [bug] The named.conf parser could print incorrect line 20236 numbers when long comments were present. 20237 20238 603. [bug] Make dig handle multiple types or classes on the same 20239 query more correctly. 20240 20241 602. [func] Cope automatically with UnixWare's broken 20242 IN6_IS_ADDR_* macros. [RT #539] 20243 20244 601. [func] Return a non-zero exit code if an update fails 20245 in nsupdate. 20246 20247 600. [bug] Reverse lookups sometimes failed in dig, etc... 20248 20249 599. [func] Added four new functions to the libisc log API to 20250 support i18n messages. isc_log_iwrite(), 20251 isc_log_ivwrite(), isc_log_iwrite1() and 20252 isc_log_ivwrite1() were added. 20253 20254 598. [bug] An update-policy statement would cause the server 20255 to assert while loading. [RT #536] 20256 20257 597. [func] dnssec-signzone is now multi-threaded. 20258 20259 596. [bug] DNS_RDATASLAB_FORCE and DNS_RDATASLAB_EXACT are 20260 not mutually exclusive. 20261 20262 595. [port] On Linux 2.2, socket() returns EINVAL when it 20263 should return EAFNOSUPPORT. Work around this. 20264 [RT #531] 20265 20266 594. [func] sdb drivers are now assumed to not be thread-safe 20267 unless the DNS_SDBFLAG_THREADSAFE flag is supplied. 20268 20269 593. [bug] If a secure zone was missing all its NXTs and 20270 a dynamic update was attempted, the server entered 20271 an infinite loop. 20272 20273 592. [bug] The sig-validity-interval option now specifies a 20274 number of days, not seconds. This matches the 20275 documentation. [RT #529] 20276 20277 .. code-block:: none 20278 20279 --- 9.1.0b1 released --- 20280 20281 591. [bug] Work around non-reentrancy in openssl by disabling 20282 pre-computation in keys. 20283 20284 590. [doc] There are now man pages for the lwres library in 20285 doc/man/lwres. 20286 20287 589. [bug] The server could deadlock if a zone was updated 20288 while being transferred out. 20289 20290 588. [bug] ctx->in_use was not being correctly initialized when 20291 when pushing a file for $INCLUDE. [RT #523] 20292 20293 587. [func] A warning is now printed if the "allow-update" 20294 option allows updates based on the source IP 20295 address, to alert users to the fact that this 20296 is insecure and becoming increasingly so as 20297 servers capable of update forwarding are being 20298 deployed. 20299 20300 586. [bug] multiple views with the same name were fatal. [RT #516] 20301 20302 585. [func] dns_db_addrdataset() and dns_rdataslab_merge() 20303 now support 'exact' additions in a similar manner to 20304 dns_db_subtractrdataset() and dns_rdataslab_subtract(). 20305 20306 584. [func] You can now say 'notify explicit'; to suppress 20307 notification of the servers listed in NS records 20308 and notify only those servers listed in the 20309 'also-notify' option. 20310 20311 583. [func] "rndc querylog" will now toggle logging of 20312 queries, like "ndc querylog" in BIND 8. 20313 20314 582. [bug] dns_zone_idetach() failed to lock the zone. 20315 [RT #199, #463] 20316 20317 581. [bug] log severity was not being correctly processed. 20318 [RT #485] 20319 20320 580. [func] Ignore trailing garbage on incoming DNS packets, 20321 for interoperability with broken server 20322 implementations. [RT #491] 20323 20324 579. [bug] nsupdate did not take a filename to read update from. 20325 [RT #492] 20326 20327 578. [func] New config option "notify-source", to specify the 20328 source address for notify messages. 20329 20330 577. [func] Log illegal RDATA combinations. e.g. multiple 20331 singleton types, cname and other data. 20332 20333 576. [doc] isc_log_create() description did not match reality. 20334 20335 575. [bug] isc_log_create() was not setting internal state 20336 correctly to reflect the default channels created. 20337 20338 574. [bug] TSIG signed queries sent by the resolver would fail to 20339 have their responses validated and would leak memory. 20340 20341 573. [bug] The journal files of IXFRed slave zones were 20342 inadvertently discarded on server reload, causing 20343 "journal out of sync with zone" errors on subsequent 20344 reloads. [RT #482] 20345 20346 572. [bug] Quoted strings were not accepted as key names in 20347 address match lists. 20348 20349 571. [bug] It was possible to create an rdataset of singleton 20350 type which had more than one rdata. [RT #154] 20351 [RT #279] 20352 20353 570. [bug] rbtdb.c allowed zones containing nodes which had 20354 both a CNAME and "other data". [RT #154] 20355 20356 569. [func] The DNSSEC AD bit will not be set on queries which 20357 have not requested a DNSSEC response. 20358 20359 568. [func] Add sample simple database drivers in contrib/sdb. 20360 20361 567. [bug] Setting the zone transfer timeout to zero caused an 20362 assertion failure. [RT #302] 20363 20364 566. [func] New public function dns_timer_setidle(). 20365 20366 565. [func] Log queries more like BIND 8: query logging is now 20367 done to category "queries", level "info". [RT #169] 20368 20369 564. [func] Add sortlist support to lwresd. 20370 20371 563. [func] New public functions dns_rdatatype_format() and 20372 dns_rdataclass_format(), for convenient formatting 20373 of rdata type/class mnemonics in log messages. 20374 20375 562. [cleanup] Moved lib/dns/*conf.c to bin/named where they belong. 20376 20377 561. [func] The 'datasize', 'stacksize', 'coresize' and 'files' 20378 clauses of the options{} statement are now implemented. 20379 20380 560. [bug] dns_name_split did not properly the resulting prefix 20381 when a maximal length bitstring label was split which 20382 was preceded by another bitstring label. [RT #429] 20383 20384 559. [bug] dns_name_split did not properly create the suffix 20385 when splitting within a maximal length bitstring label. 20386 20387 558. [func] New functions, isc_resource_getlimit and 20388 isc_resource_setlimit. 20389 20390 557. [func] Symbolic constants for libisc integral types. 20391 20392 556. [func] The DNSSEC OK bit in the EDNS extended flags 20393 is now implemented. Responses to queries without 20394 this bit set will not contain any DNSSEC records. 20395 20396 555. [bug] A slave server attempting a zone transfer could 20397 crash with an assertion failure on certain 20398 malformed responses from the master. [RT #457] 20399 20400 554. [bug] In some cases, not all of the dnssec tools were 20401 properly installed. 20402 20403 553. [bug] Incoming zone transfers deferred due to quota 20404 were not started when quota was increased but 20405 only when a transfer in progress finished. [RT #456] 20406 20407 552. [bug] We were not correctly detecting the end of all c-style 20408 comments. [RT #455] 20409 20410 551. [func] Implemented the 'sortlist' option. 20411 20412 550. [func] Support unknown rdata types and classes. 20413 20414 549. [bug] "make" did not immediately abort the build when a 20415 subdirectory make failed [RT #450]. 20416 20417 548. [func] The lexer now ungets tokens more correctly. 20418 20419 547. [placeholder] 20420 20421 546. [func] Option 'lame-ttl' is now implemented. 20422 20423 545. [func] Name limit and counting options removed from dig; 20424 they didn't work properly, and cannot be correctly 20425 implemented without significant changes. 20426 20427 544. [func] Add statistics option, enable statistics-file option, 20428 add RNDC option "dump-statistics" to write out a 20429 query statistics file. 20430 20431 543. [doc] The 'port' option is now documented. 20432 20433 542. [func] Add support for update forwarding as required for 20434 full compliance with RFC2136. It is turned off 20435 by default and can be enabled using the 20436 'allow-update-forwarding' option. 20437 20438 541. [func] Add bogus server support. 20439 20440 540. [func] Add dialup support. 20441 20442 539. [func] Support the blackhole option. 20443 20444 538. [bug] fix buffer overruns by 1 in lwres_getnameinfo(). 20445 20446 537. [placeholder] 20447 20448 536. [func] Use transfer-source{-v6} when sending refresh queries. 20449 Transfer-source{-v6} now take a optional port 20450 parameter for setting the UDP source port. The port 20451 parameter is ignored for TCP. 20452 20453 535. [func] Use transfer-source{-v6} when forwarding update 20454 requests. 20455 20456 534. [func] Ancestors have been removed from RBT chains. Ancestor 20457 information can be discerned via node parent pointers. 20458 20459 533. [func] Incorporated name hashing into the RBT database to 20460 improve search speed. 20461 20462 532. [func] Implement DNS UPDATE pseudo records using 20463 DNS_RDATA_UPDATE flag. 20464 20465 531. [func] Rdata really should be initialized before being assigned 20466 to (dns_rdata_fromwire(), dns_rdata_fromtext(), 20467 dns_rdata_clone(), dns_rdata_fromregion()), 20468 check that it is. 20469 20470 530. [func] New function dns_rdata_invalidate(). 20471 20472 529. [bug] 521 contained a bug which caused zones to always 20473 reload. [RT #410] 20474 20475 528. [func] The ISC_LIST_XXXX macros now perform sanity checks 20476 on their arguments. ISC_LIST_XXXXUNSAFE can be use 20477 to skip the checks however use with caution. 20478 20479 527. [func] New function dns_rdata_clone(). 20480 20481 526. [bug] nsupdate incorrectly refused to add RRs with a TTL 20482 of 0. 20483 20484 525. [func] New arguments 'options' for dns_db_subtractrdataset(), 20485 and 'flags' for dns_rdataslab_subtract() allowing you 20486 to request that the RR's must exist prior to deletion. 20487 DNS_R_NOTEXACT is returned if the condition is not met. 20488 20489 524. [func] The 'forward' and 'forwarders' statement in 20490 non-forward zones should work now. 20491 20492 523. [doc] The source to the Administrator Reference Manual is 20493 now an XML file using the DocBook DTD, and is included 20494 in the distribution. The plain text version of the 20495 ARM is temporarily unavailable while we figure out 20496 how to generate readable plain text from the XML. 20497 20498 522. [func] The lightweight resolver daemon can now use 20499 a real configuration file, and its functionality 20500 can be provided by a name server. Also, the -p and -P 20501 options to lwresd have been reversed. 20502 20503 521. [bug] Detect master files which contain $INCLUDE and always 20504 reload. [RT #196] 20505 20506 520. [bug] Upgraded libtool to 1.3.5, which makes shared 20507 library builds almost work on AIX (and possibly 20508 others). 20509 20510 519. [bug] dns_name_split() would improperly split some bitstring 20511 labels, zeroing a few of the least significant bits in 20512 the prefix part. When such an improperly created 20513 prefix was returned to the RBT database, the bogus 20514 label was dutifully stored, corrupting the tree. 20515 [RT #369] 20516 20517 518. [bug] The resolver did not realize that a DNAME which was 20518 "the answer" to the client's query was "the answer", 20519 and such queries would fail. [RT #399] 20520 20521 517. [bug] The resolver's DNAME code would trigger an assertion 20522 if there was more than one DNAME in the chain. 20523 [RT #399] 20524 20525 516. [bug] Cache lookups which had a NULL node pointer, e.g. 20526 those by dns_view_find(), and which would match a 20527 DNAME, would trigger an INSIST(!search.need_cleanup) 20528 assertion. [RT #399] 20529 20530 515. [bug] The ssu table was not being attached / detached 20531 by dns_zone_[sg]etssutable. [RT #397] 20532 20533 514. [func] Retry refresh and notify queries if they timeout. 20534 [RT #388] 20535 20536 513. [func] New functionality added to rdnc and server to allow 20537 individual zones to be refreshed or reloaded. 20538 20539 512. [bug] The zone transfer code could throw an exception with 20540 an invalid IXFR stream. 20541 20542 511. [bug] The message code could throw an assertion on an 20543 out of memory failure. [RT #392] 20544 20545 510. [bug] Remove spurious view notify warning. [RT #376] 20546 20547 509. [func] Add support for write of zone files on shutdown. 20548 20549 508. [func] dns_message_parse() can now do a best-effort 20550 attempt, which should allow dig to print more invalid 20551 messages. 20552 20553 507. [func] New functions dns_zone_flush(), dns_zt_flushanddetach() 20554 and dns_view_flushanddetach(). 20555 20556 506. [func] Do not fail to start on errors in zone files. 20557 20558 505. [bug] nsupdate was printing "unknown result code". [RT #373] 20559 20560 504. [bug] The zone was not being marked as dirty when updated via 20561 IXFR. 20562 20563 503. [bug] dumptime was not being set along with 20564 DNS_ZONEFLG_NEEDDUMP. 20565 20566 502. [func] On a SERVFAIL reply, DiG will now try the next server 20567 in the list, unless the +fail option is specified. 20568 20569 501. [bug] Incorrect port numbers were being displayed by 20570 nslookup. [RT #352] 20571 20572 500. [func] Nearly useless +details option removed from DiG. 20573 20574 499. [func] In DiG, specifying a class with -c or type with -t 20575 changes command-line parsing so that classes and 20576 types are only recognized if following -c or -t. 20577 This allows hosts with the same name as a class or 20578 type to be looked up. 20579 20580 498. [doc] There is now a man page for "dig" 20581 in doc/man/bin/dig.1. 20582 20583 497. [bug] The error messages printed when an IP match list 20584 contained a network address with a nonzero host 20585 part where not sufficiently detailed. [RT #365] 20586 20587 496. [bug] named didn't sanity check numeric parameters. [RT #361] 20588 20589 495. [bug] nsupdate was unable to handle large records. [RT #368] 20590 20591 494. [func] Do not cache NXDOMAIN responses for SOA queries. 20592 20593 493. [func] Return non-cachable (ttl = 0) NXDOMAIN responses 20594 for SOA queries. This makes it easier to locate 20595 the containing zone without polluting intermediate 20596 caches. 20597 20598 492. [bug] attempting to reload a zone caused the server fail 20599 to shutdown cleanly. [RT #360] 20600 20601 491. [bug] nsupdate would segfault when sending certain 20602 prerequisites with empty RDATA. [RT #356] 20603 20604 490. [func] When a slave/stub zone has not yet successfully 20605 obtained an SOA containing the zone's configured 20606 retry time, perform the SOA query retries using 20607 exponential backoff. [RT #337] 20608 20609 489. [func] The zone manager now has a "i/o" queue. 20610 20611 488. [bug] Locks weren't properly destroyed in some cases. 20612 20613 487. [port] flockfile() is not defined on all systems. 20614 20615 486. [bug] nslookup: "set all" and "server" commands showed 20616 the incorrect port number if a port other than 53 20617 was specified. [RT #352] 20618 20619 485. [func] When dig had more than one server to query, it would 20620 send all of the messages at the same time. Add 20621 rate limiting of the transmitted messages. 20622 20623 484. [bug] When the server was reloaded after removing addresses 20624 from the named.conf "listen-on" statement, sockets 20625 were still listening on the removed addresses due 20626 to reference count loops. [RT #325] 20627 20628 483. [bug] nslookup: "set all" showed a "search" option but it 20629 was not settable. 20630 20631 482. [bug] nslookup: a plain "server" or "lserver" should be 20632 treated as a lookup. 20633 20634 481. [bug] nslookup:get_next_command() stack size could exceed 20635 per thread limit. 20636 20637 480. [bug] strtok() is not thread safe. [RT #349] 20638 20639 479. [func] The test suite can now be run by typing "make check" 20640 or "make test" at the top level. 20641 20642 478. [bug] "make install" failed if the directory specified with 20643 --prefix did not already exist. 20644 20645 477. [bug] The the isc-config.sh script could be installed before 20646 its directory was created. [RT #324] 20647 20648 476. [bug] A zone could expire while a zone transfer was in 20649 progress triggering a INSIST failure. [RT #329] 20650 20651 475. [bug] query_getzonedb() sometimes returned a non-null version 20652 on failure. This caused assertion failures when 20653 generating query responses where names subject to 20654 additional section processing pointed to a zone 20655 to which access had been denied by means of the 20656 allow-query option. [RT #336] 20657 20658 474. [bug] The mnemonic of the CHAOS class is CH according to 20659 RFC1035, but it was printed and read only as CHAOS. 20660 We now accept both forms as input, and print it 20661 as CH. [RT #305] 20662 20663 473. [bug] nsupdate overran the end of the list of name servers 20664 when no servers could be reached, typically causing 20665 it to print the error message "dns_request_create: 20666 not implemented". 20667 20668 472. [bug] Off-by-one error caused isc_time_add() to sometimes 20669 produce invalid time values. 20670 20671 471. [bug] nsupdate didn't compile on HP/UX 10.20 20672 20673 470. [func] $GENERATE is now supported. See also 20674 doc/misc/migration. 20675 20676 469. [bug] "query-source address * port 53;" now works. 20677 20678 468. [bug] dns_master_load*() failed to report file and line 20679 number in certain error conditions. 20680 20681 467. [bug] dns_master_load*() failed to log an error if 20682 pushfile() failed. 20683 20684 466. [bug] dns_master_load*() could return success when it failed. 20685 20686 465. [cleanup] Allow 0 to be set as an omapi_value_t value by 20687 omapi_value_storeint(). 20688 20689 464. [cleanup] Build with openssl's RSA code instead of dnssafe. 20690 20691 463. [bug] nsupdate sent malformed SOA queries to the second 20692 and subsequent name servers in resolv.conf if the 20693 query sent to the first one failed. 20694 20695 462. [bug] --disable-ipv6 should work now. 20696 20697 461. [bug] Specifying an unknown key in the "keys" clause of the 20698 "controls" statement caused a NULL pointer dereference. 20699 [RT #316] 20700 20701 460. [bug] Much of the DNSSEC code only worked with class IN. 20702 20703 459. [bug] Nslookup processed the "set" command incorrectly. 20704 20705 458. [bug] Nslookup didn't properly check class and type values. 20706 [RT #305] 20707 20708 457. [bug] Dig/host/hslookup didn't properly handle connect 20709 timeouts in certain situations, causing an 20710 unnecessary warning message to be printed. 20711 20712 456. [bug] Stub zones were not resetting the refresh and expire 20713 counters, loadtime or clearing the DNS_ZONE_REFRESH 20714 (refresh in progress) flag upon successful update. 20715 This disabled further refreshing of the stub zone, 20716 causing it to eventually expire. [RT #300] 20717 20718 455. [doc] Document IPv4 prefix notation does not require a 20719 dotted decimal quad but may be just dotted decimal. 20720 20721 454. [bug] Enforce dotted decimal and dotted decimal quad where 20722 documented as such in named.conf. [RT #304, RT #311] 20723 20724 453. [bug] Warn if the obsolete option "maintain-ixfr-base" 20725 is specified in named.conf. [RT #306] 20726 20727 452. [bug] Warn if the unimplemented option "statistics-file" 20728 is specified in named.conf. [RT #301] 20729 20730 451. [func] Update forwarding implemented. 20731 20732 450. [func] New function ns_client_sendraw(). 20733 20734 449. [bug] isc_bitstring_copy() only works correctly if the 20735 two bitstrings have the same lsb0 value, but this 20736 requirement was not documented, nor was there a 20737 REQUIRE for it. 20738 20739 448. [bug] Host output formatting change, to match v8. [RT #255] 20740 20741 447. [bug] Dig didn't properly retry in TCP mode after 20742 a truncated reply. [RT #277] 20743 20744 446. [bug] Confusing notify log message. [RT #298] 20745 20746 445. [bug] Doing a 0 bit isc_bitstring_copy() of an lsb0 20747 bitstring triggered a REQUIRE statement. The REQUIRE 20748 statement was incorrect. [RT #297] 20749 20750 444. [func] "recursion denied" messages are always logged at 20751 debug level 1, now, rather than sometimes at ERROR. 20752 This silences these warnings in the usual case, where 20753 some clients set the RD bit in all queries. 20754 20755 443. [bug] When loading a master file failed because of an 20756 unrecognized RR type name, the error message 20757 did not include the file name and line number. 20758 [RT #285] 20759 20760 442. [bug] TSIG signed messages that did not match any view 20761 crashed the server. [RT #290] 20762 20763 441. [bug] Nodes obscured by a DNAME were inaccessible even 20764 when DNS_DBFIND_GLUEOK was set. 20765 20766 440. [func] New function dns_zone_forwardupdate(). 20767 20768 439. [func] New function dns_request_createraw(). 20769 20770 438. [func] New function dns_message_getrawmessage(). 20771 20772 437. [func] Log NOTIFY activity to the notify channel. 20773 20774 436. [bug] If recvmsg() returned EHOSTUNREACH or ENETUNREACH, 20775 which sometimes happens on Linux, named would enter 20776 a busy loop. Also, unexpected socket errors were 20777 not logged at a high enough logging level to be 20778 useful in diagnosing this situation. [RT #275] 20779 20780 435. [bug] dns_zone_dump() overwrote existing zone files 20781 rather than writing to a temporary file and 20782 renaming. This could lead to empty or partial 20783 zone files being left around in certain error 20784 conditions involving the initial transfer of a 20785 slave zone, interfering with subsequent server 20786 startup. [RT #282] 20787 20788 434. [func] New function isc_file_isabsolute(). 20789 20790 433. [func] isc_base64_decodestring() now accepts newlines 20791 within the base64 data. This makes it possible 20792 to break up the key data in a "trusted-keys" 20793 statement into multiple lines. [RT #284] 20794 20795 432. [func] Added refresh/retry jitter. The actual refresh/ 20796 retry time is now a random value between 75% and 20797 100% of the configured value. 20798 20799 431. [func] Log at ISC_LOG_INFO when a zone is successfully 20800 loaded. 20801 20802 430. [bug] Rewrote the lightweight resolver client management 20803 code to handle shutdown correctly and general 20804 cleanup. 20805 20806 429. [bug] The space reserved for a TSIG record in a response 20807 was 2 bytes too short, leading to message 20808 generation failures. 20809 20810 428. [bug] rbtdb.c:find_closest_nxt() erroneously returned 20811 DNS_R_BADDB for nodes which had neither NXT nor SIG NXT 20812 (e.g. glue). This could cause SERVFAILs when 20813 generating negative responses in a secure zone. 20814 20815 427. [bug] Avoid going into an infinite loop when the validator 20816 gets a negative response to a key query where the 20817 records are signed by the missing key. 20818 20819 426. [bug] Attempting to generate an oversized RSA key could 20820 cause dnssec-keygen to dump core. 20821 20822 425. [bug] Warn about the auth-nxdomain default value change 20823 if there is no auth-nxdomain statement in the 20824 config file. [RT #287] 20825 20826 424. [bug] notify_createmessage() could trigger an assertion 20827 failure when creating the notify message failed, 20828 e.g. due to corrupt zones with multiple SOA records. 20829 [RT #279] 20830 20831 423. [bug] When responding to a recursive query, errors that occur 20832 after following a CNAME should cause the query to fail. 20833 [RT #274] 20834 20835 422. [func] get rid of isc_random_t, and make isc_random_get() 20836 and isc_random_jitter() use rand() internally 20837 instead of local state. Note that isc_random_*() 20838 functions are only for weak, non-critical "randomness" 20839 such as timing jitter and such. 20840 20841 421. [bug] nslookup would exit when given a blank line as input. 20842 20843 420. [bug] nslookup failed to implement the "exit" command. 20844 20845 419. [bug] The certificate type PKIX was misspelled as SKIX. 20846 20847 418. [bug] At debug levels >= 10, getting an unexpected 20848 socket receive error would crash the server 20849 while trying to log the error message. 20850 20851 417. [func] Add isc_app_block() and isc_app_unblock(), which 20852 allow an application to handle signals while 20853 blocking. 20854 20855 416. [bug] Slave zones with no master file tried to use a 20856 NULL pointer for a journal file name when they 20857 received an IXFR. [RT #273] 20858 20859 415. [bug] The logging code leaked file descriptors. 20860 20861 414. [bug] Server did not shut down until all incoming zone 20862 transfers were finished. 20863 20864 413. [bug] Notify could attempt to use the zone database after 20865 it had been unloaded. [RT #267] 20866 20867 412. [bug] named -v didn't print the version. 20868 20869 411. [bug] A typo in the HS A code caused an assertion failure. 20870 20871 410. [bug] lwres_gethostbyname() and company set lwres_h_errno 20872 to a random value on success. 20873 20874 409. [bug] If named was shut down early in the startup 20875 process, ns_omapi_shutdown() would attempt to lock 20876 an uninitialized mutex. [RT #262] 20877 20878 408. [bug] stub zones could leak memory and reference counts if 20879 all the masters were unreachable. 20880 20881 407. [bug] isc_rwlock_lock() would needlessly block 20882 readers when it reached the read quota even 20883 if no writers were waiting. 20884 20885 406. [bug] Log messages were occasionally lost or corrupted 20886 due to a race condition in isc_log_doit(). 20887 20888 405. [func] Add support for selective forwarding (forward zones) 20889 20890 404. [bug] The request library didn't completely work with IPv6. 20891 20892 403. [bug] "host" did not use the search list. 20893 20894 402. [bug] Treat undefined acls as errors, rather than 20895 warning and then later throwing an assertion. 20896 [RT #252] 20897 20898 401. [func] Added simple database API. 20899 20900 400. [bug] SIG(0) signing and verifying was done incorrectly. 20901 [RT #249] 20902 20903 .. code-block:: none 20904 20905 399. [bug] When reloading the server with a config file 20906 containing a syntax error, it could catch an 20907 assertion failure trying to perform zone 20908 maintenance on, or sending notifies from, 20909 tentatively created zones whose views were 20910 never fully configured and lacked an address 20911 database and request manager. 20912 20913 398. [bug] "dig" sometimes caught an assertion failure when 20914 using TSIG, depending on the key length. 20915 20916 397. [func] Added utility functions dns_view_gettsig() and 20917 dns_view_getpeertsig(). 20918 20919 396. [doc] There is now a man page for "nsupdate" 20920 in doc/man/bin/nsupdate.8. 20921 20922 395. [bug] nslookup printed incorrect RR type mnemonics 20923 for RRs of type >= 21 [RT #237]. 20924 20925 394. [bug] Current name was not propagated via $INCLUDE. 20926 20927 393. [func] Initial answer while loading (awl) support. 20928 Entry points: dns_master_loadfileinc(), 20929 dns_master_loadstreaminc(), dns_master_loadbufferinc(). 20930 Note: calls to dns_master_load*inc() should be rate 20931 be rate limited so as to not use up all file 20932 descriptors. 20933 20934 392. [func] Add ISC_R_FAMILYNOSUPPORT. Returned when OS does 20935 not support the given address family requested. 20936 20937 391. [clarity] ISC_R_FAMILY -> ISC_R_FAMILYMISMATCH. 20938 20939 390. [func] The function dns_zone_setdbtype() now takes 20940 an argc/argv style vector of words and sets 20941 both the zone database type and its arguments, 20942 making the functions dns_zone_adddbarg() 20943 and dns_zone_cleardbargs() unnecessary. 20944 20945 389. [bug] Attempting to send a request over IPv6 using 20946 dns_request_create() on a system without IPv6 20947 support caused an assertion failure [RT #235]. 20948 20949 388. [func] dig and host can now do reverse ipv6 lookups. 20950 20951 387. [func] Add dns_byaddr_createptrname(), which converts 20952 an address into the name used by a PTR query. 20953 20954 386. [bug] Missing strdup() of ACL name caused random 20955 ACL matching failures [RT #228]. 20956 20957 385. [cleanup] Removed functions dns_zone_equal(), dns_zone_print(), 20958 and dns_zt_print(). 20959 20960 384. [bug] nsupdate was incorrectly limiting TTLs to 65535 instead 20961 of 2147483647. 20962 20963 383. [func] When writing a master file, print the SOA and NS 20964 records (and their SIGs) before other records. 20965 20966 382. [bug] named -u failed on many Linux systems where the 20967 libc provided kernel headers do not match 20968 the current kernel. 20969 20970 381. [bug] Check for IPV6_RECVPKTINFO and use it instead of 20971 IPV6_PKTINFO if found. [RT #229] 20972 20973 380. [bug] nsupdate didn't work with IPv6. 20974 20975 379. [func] New library function isc_sockaddr_anyofpf(). 20976 20977 378. [func] named and lwresd will log the command line arguments 20978 they were started with in the "starting ..." message. 20979 20980 377. [bug] When additional data lookups were refused due to 20981 "allow-query", the databases were still being 20982 attached causing reference leaks. 20983 20984 376. [bug] The server should always use good entropy when 20985 performing cryptographic functions needing entropy. 20986 20987 375. [bug] Per-zone "allow-query" did not properly override the 20988 view/global one for CNAME targets and additional 20989 data [RT #220]. 20990 20991 374. [bug] SOA in authoritative negative responses had wrong TTL. 20992 20993 373. [func] nslookup is now installed by "make install". 20994 20995 372. [bug] Deal with Microsoft DNS servers appending two bytes of 20996 garbage to zone transfer requests. 20997 20998 371. [bug] At high debug levels, doing an outgoing zone transfer 20999 of a very large RRset could cause an assertion failure 21000 during logging. 21001 21002 370. [bug] The error messages for roll-forward failures were 21003 overly terse. 21004 21005 369. [func] Support new named.conf options, view and zone 21006 statements: 21007 21008 max-retry-time, min-retry-time, 21009 max-refresh-time, min-refresh-time. 21010 21011 368. [func] Restructure the internal ".bind" view so that more 21012 zones can be added to it. 21013 21014 367. [bug] Allow proper selection of server on nslookup command 21015 line. 21016 21017 366. [func] Allow use of '-' batch file in dig for stdin. 21018 21019 365. [bug] nsupdate -k leaked memory. 21020 21021 364. [func] Added additional-from-{cache,auth} 21022 21023 363. [placeholder] 21024 21025 362. [bug] rndc no longer aborts if the configuration file is 21026 missing an options statement. [RT #209] 21027 21028 361. [func] When the RBT find or chain functions set the name and 21029 origin for a node that stores the root label 21030 the name is now set to an empty name, instead of ".", 21031 to simplify later use of the name and origin by 21032 dns_name_concatenate(), dns_name_totext() or 21033 dns_name_format(). 21034 21035 360. [func] dns_name_totext() and dns_name_format() now allow 21036 an empty name to be passed, which is formatted as "@". 21037 21038 359. [bug] dnssec-signzone occasionally signed glue records. 21039 21040 358. [cleanup] Rename the intermediate files used by the dnssec 21041 programs. 21042 21043 357. [bug] The zone file parser crashed if the argument 21044 to $INCLUDE was a quoted string. 21045 21046 356. [cleanup] isc_task_send no longer requires event->sender to 21047 be non-null. 21048 21049 355. [func] Added isc_dir_createunique(), similar to mkdtemp(). 21050 21051 354. [doc] Man pages for the dnssec tools are now included in 21052 the distribution, in doc/man/dnssec. 21053 21054 353. [bug] double increment in lwres/gethost.c:copytobuf(). 21055 [RT #187] 21056 21057 352. [bug] Race condition in dns_client_t startup could cause 21058 an assertion failure. 21059 21060 351. [bug] Constructing a response with rcode SERVFAIL to a TSIG 21061 signed query could crash the server. 21062 21063 350. [bug] Also-notify lists specified in the global options 21064 block were not correctly reference counted, causing 21065 a memory leak. 21066 21067 349. [bug] Processing a query with the CD bit set now works 21068 as expected. 21069 21070 348. [func] New boolean named.conf options 'additional-from-auth' 21071 and 'additional-from-cache' now supported in view and 21072 global options statement. 21073 21074 347. [bug] Don't crash if an argument is left off options in dig. 21075 21076 346. [placeholder] 21077 21078 345. [bug] Large-scale changes/cleanups to dig: 21079 * Significantly improve structure handling 21080 * Don't pre-load entire batch files 21081 * Add name/rr counting/limiting 21082 * Fix SIGINT handling 21083 * Shorten timeouts to match v8's behavior 21084 21085 344. [bug] When shutting down, lwresd sometimes tried 21086 to shut down its client tasks twice, 21087 triggering an assertion. 21088 21089 343. [bug] Although zone maintenance SOA queries and 21090 notify requests were signed with TSIG keys 21091 when configured for the server in case, 21092 the TSIG was not verified on the response. 21093 21094 342. [bug] The wrong name was being passed to 21095 dns_name_dup() when generating a TSIG 21096 key using TKEY. 21097 21098 341. [func] Support 'key' clause in named.conf zone masters 21099 statement to allow authentication via TSIG keys: 21100 21101 masters { 21102 10.0.0.1 port 5353 key "foo"; 21103 10.0.0.2 ; 21104 }; 21105 21106 340. [bug] The top-level COPYRIGHT file was missing from 21107 the distribution. 21108 21109 339. [bug] DNSSEC validation of the response to an ANY 21110 query at a name with a CNAME RR in a secure 21111 zone triggered an assertion failure. 21112 21113 338. [bug] lwresd logged to syslog as named, not lwresd. 21114 21115 337. [bug] "dig" did not recognize "nsap-ptr" as an RR type 21116 on the command line. 21117 21118 336. [bug] "dig -f" used 64 k of memory for each line in 21119 the file. It now uses much less, though still 21120 proportionally to the file size. 21121 21122 335. [bug] named would occasionally attempt recursion when 21123 it was disallowed or undesired. 21124 21125 334. [func] Added hmac-md5 to libisc. 21126 21127 333. [bug] The resolver incorrectly accepted referrals to 21128 domains that were not parents of the query name, 21129 causing assertion failures. 21130 21131 332. [func] New function dns_name_reset(). 21132 21133 331. [bug] Only log "recursion denied" if RD is set. [RT #178] 21134 21135 330. [bug] Many debugging messages were partially formatted 21136 even when debugging was turned off, causing a 21137 significant decrease in query performance. 21138 21139 329. [func] omapi_auth_register() now takes a size_t argument for 21140 the length of a key's secret data. Previously 21141 OMAPI only stored secrets up to the first NUL byte. 21142 21143 328. [func] Added isc_base64_decodestring(). 21144 21145 327. [bug] rndc.conf parser wasn't correctly recognizing an IP 21146 address where a host specification was required. 21147 21148 326. [func] 'keys' in an 'inet' control statement is now 21149 required and must have at least one item in it. 21150 A "not supported" warning is now issued if a 'unix' 21151 control channel is defined. 21152 21153 325. [bug] isc_lex_gettoken was processing octal strings when 21154 ISC_LEXOPT_CNUMBER was not set. 21155 21156 324. [func] In the resolver, turn EDNS0 off if there is no 21157 response after a number of retransmissions. 21158 This is to allow queries some chance of succeeding 21159 even if all the authoritative servers of a zone 21160 silently discard EDNS0 requests instead of 21161 sending an error response like they ought to. 21162 21163 323. [bug] dns_rbt_findname() did not ignore empty rbt nodes. 21164 Because of this, servers authoritative for a parent 21165 and grandchild zone but not authoritative for the 21166 intervening child zone did not correctly issue 21167 referrals to the servers of the child zone. 21168 21169 322. [bug] Queries for KEY RRs are now sent to the parent 21170 server before the authoritative one, making 21171 DNSSEC insecurity proofs work in many cases 21172 where they previously didn't. 21173 21174 321. [bug] When synthesizing a CNAME RR for a DNAME 21175 response, query_addcname() failed to initialize 21176 the type and class of the CNAME dns_rdata_t, 21177 causing random failures. 21178 21179 320. [func] Multiple rndc changes: parses an rndc.conf file, 21180 uses authentication to talk to named, command 21181 line syntax changed. This will all be described 21182 in the ARM. 21183 21184 319. [func] The named.conf "controls" statement is now used 21185 to configure the OMAPI command channel. 21186 21187 318. [func] dns_c_ndcctx_destroy() could never return anything 21188 except ISC_R_SUCCESS; made it have void return instead. 21189 21190 317. [func] Use callbacks from libomapi to determine if a 21191 new connection is valid, and if a key requested 21192 to be used with that connection is valid. 21193 21194 316. [bug] Generate a warning if we detect an unexpected <eof> 21195 but treat as <eol><eof>. 21196 21197 315. [bug] Handle non-empty blanks lines. [RT #163] 21198 21199 314. [func] The named.conf controls statement can now have 21200 more than one key specified for the inet clause. 21201 21202 313. [bug] When parsing resolv.conf, don't terminate on an 21203 error. Instead, parse as much as possible, but 21204 still return an error if one was found. 21205 21206 312. [bug] Increase the number of allowed elements in the 21207 resolv.conf search path from 6 to 8. If there 21208 are more than this, ignore the remainder rather 21209 than returning a failure in lwres_conf_parse. 21210 21211 311. [bug] lwres_conf_parse failed when the first line of 21212 resolv.conf was empty or a comment. 21213 21214 310. [func] Changes to named.conf "controls" statement (inet 21215 subtype only) 21216 21217 - support "keys" clause 21218 21219 controls { 21220 inet * port 1024 21221 allow { any; } keys { "foo"; } 21222 } 21223 21224 - allow "port xxx" to be left out of statement, 21225 in which case it defaults to omapi's default port 21226 of 953. 21227 21228 309. [bug] When sending a referral, the server did not look 21229 for name server addresses as glue in the zone 21230 holding the NS RRset in the case where this zone 21231 was not the same as the one where it looked for 21232 name server addresses as authoritative data. 21233 21234 308. [bug] Treat a SOA record not at top of zone as an error 21235 when loading a zone. [RT #154] 21236 21237 307. [bug] When canceling a query, the resolver didn't check for 21238 isc_socket_sendto() calls that did not yet have their 21239 completion events posted, so it could (rarely) end up 21240 destroying the query context and then want to use 21241 it again when the send event posted, triggering an 21242 assertion as it tried to cancel an already-canceled 21243 query. [RT #77] 21244 21245 306. [bug] Reading HMAC-MD5 private key files didn't work. 21246 21247 305. [bug] When reloading the server with a config file 21248 containing a syntax error, it could catch an 21249 assertion failure trying to perform zone 21250 maintenance on tentatively created zones whose 21251 views were never fully configured and lacked 21252 an address database. 21253 21254 304. [bug] If more than LWRES_CONFMAXNAMESERVERS servers 21255 are listed in resolv.conf, silently ignore them 21256 instead of returning failure. 21257 21258 303. [bug] Add additional sanity checks to differentiate a AXFR 21259 response vs a IXFR response. [RT #157] 21260 21261 302. [bug] In dig, host, and nslookup, MXNAME should be large 21262 enough to hold any legal domain name in presentation 21263 format + terminating NULL. 21264 21265 301. [bug] Uninitialized pointer in host:printmessage(). [RT #159] 21266 21267 300. [bug] Using both <isc/net.h> and <lwres/net.h> didn't work 21268 on platforms lacking IPv6 because each included their 21269 own ipv6 header file for the missing definitions. Now 21270 each library's ipv6.h defines the wrapper symbol of 21271 the other (ISC_IPV6_H and LWRES_IPV6_H). 21272 21273 299. [cleanup] Get the user and group information before changing the 21274 root directory, so the administrator does not need to 21275 keep a copy of the user and group databases in the 21276 chroot'ed environment. Suggested by Hakan Olsson. 21277 21278 298. [bug] A mutex deadlock occurred during shutdown of the 21279 interface manager under certain conditions. 21280 Digital Unix systems were the most affected. 21281 21282 297. [bug] Specifying a key name that wasn't fully qualified 21283 in certain parts of the config file could cause 21284 an assertion failure. 21285 21286 296. [bug] "make install" from a separate build directory 21287 failed unless configure had been run in the source 21288 directory, too. 21289 21290 295. [bug] When invoked with type==CNAME and a message 21291 not constructed by dns_message_parse(), 21292 dns_message_findname() failed to find anything 21293 due to checking for attribute bits that are set 21294 only in dns_message_parse(). This caused an 21295 infinite loop when constructing the response to 21296 an ANY query at a CNAME in a secure zone. 21297 21298 294. [bug] If we run out of space in while processing glue 21299 when reading a master file and commit "current name" 21300 reverts to "name_current" instead of staying as 21301 "name_glue". 21302 21303 293. [port] Add support for FreeBSD 4.0 system tests. 21304 21305 292. [bug] Due to problems with the way some operating systems 21306 handle simultaneous listening on IPv4 and IPv6 21307 addresses, the server no longer listens on IPv6 21308 addresses by default. To revert to the previous 21309 behavior, specify "listen-on-v6 { any; };" in 21310 the config file. 21311 21312 291. [func] Caching servers no longer send outgoing queries 21313 over TCP just because the incoming recursive query 21314 was a TCP one. 21315 21316 290. [cleanup] +twiddle option to dig (for testing only) removed. 21317 21318 289. [cleanup] dig is now installed in $bindir instead of $sbindir. 21319 host is now installed in $bindir. (Be sure to remove 21320 any $sbindir/dig from a previous release.) 21321 21322 288. [func] rndc is now installed by "make install" into $sbindir. 21323 21324 287. [bug] rndc now works again as "rndc 127.1 reload" (for 21325 only that task). Parsing its configuration file and 21326 using digital signatures for authentication has been 21327 disabled until named supports the "controls" statement, 21328 post-9.0.0. 21329 21330 286. [bug] On Solaris 2, when named inherited a signal state 21331 where SIGHUP had the SIG_IGN action, SIGHUP would 21332 be ignored rather than causing the server to reload 21333 its configuration. 21334 21335 285. [bug] A change made to the dst API for beta4 inadvertently 21336 broke OMAPI's creation of a dst key from an incoming 21337 message, causing an assertion to be triggered. Fixed. 21338 21339 284. [func] The DNSSEC key generation and signing tools now 21340 generate randomness from keyboard input on systems 21341 that lack /dev/random. 21342 21343 283. [cleanup] The 'lwresd' program is now a link to 'named'. 21344 21345 282. [bug] The lexer now returns ISC_R_RANGE if parsed integer is 21346 too big for an unsigned long. 21347 21348 281. [bug] Fixed list of recognized config file category names. 21349 21350 280. [func] Add isc-config.sh, which can be used to more 21351 easily build applications that link with 21352 our libraries. 21353 21354 279. [bug] Private omapi function symbols shared between 21355 two or more files in libomapi.a were not namespace 21356 protected using the ISC convention of starting with 21357 the library name and two underscores ("omapi__"...) 21358 21359 278. [bug] bin/named/logconf.c:category_fromconf() didn't take 21360 note of when isc_log_categorybyname() wasn't able 21361 to find the category name and would then apply the 21362 channel list of the unknown category to all categories. 21363 21364 277. [bug] isc_log_categorybyname() and isc_log_modulebyname() 21365 would fail to find the first member of any category 21366 or module array apart from the internal defaults. 21367 Thus, for example, the "notify" category was improperly 21368 configured by named. 21369 21370 276. [bug] dig now supports maximum sized TCP messages. 21371 21372 275. [bug] The definition of lwres_gai_strerror() was missing 21373 the lwres_ prefix. 21374 21375 274. [bug] TSIG AXFR verify failed when talking to a BIND 8 21376 server. 21377 21378 273. [func] The default for the 'transfer-format' option is 21379 now 'many-answers'. This will break zone transfers 21380 to BIND 4.9.5 and older unless there is an explicit 21381 'one-answer' configuration. 21382 21383 272. [bug] The sending of large TCP responses was canceled 21384 in mid-transmission due to a race condition 21385 caused by the failure to set the client object's 21386 "newstate" variable correctly when transitioning 21387 to the "working" state. 21388 21389 271. [func] Attempt to probe the number of cpus in named 21390 if unspecified rather than defaulting to 1. 21391 21392 270. [func] Allow maximum sized TCP answers. 21393 21394 269. [bug] Failed DNSSEC validations could cause an assertion 21395 failure by causing clone_results() to be called with 21396 with hevent->node == NULL. 21397 21398 268. [doc] A plain text version of the Administrator 21399 Reference Manual is now included in the distribution, 21400 as doc/arm/Bv9ARM.txt. 21401 21402 267. [func] Nsupdate is now provided in the distribution. 21403 21404 266. [bug] zone.c:save_nsrrset() node was not initialized. 21405 21406 265. [bug] dns_request_create() now works for TCP. 21407 21408 264. [func] Dispatch can not take TCP sockets in connecting 21409 state. Set DNS_DISPATCHATTR_CONNECTED when calling 21410 dns_dispatch_createtcp() for connected TCP sockets 21411 or call dns_dispatch_starttcp() when the socket is 21412 connected. 21413 21414 263. [func] New logging channel type 'stderr' 21415 21416 channel some-name { 21417 stderr; 21418 severity error; 21419 } 21420 21421 262. [bug] 'master' was not initialized in zone.c:stub_callback(). 21422 21423 261. [func] Add dns_zone_markdirty(). 21424 21425 260. [bug] Running named as a non-root user failed on Linux 21426 kernels new enough to support retaining capabilities 21427 after setuid(). 21428 21429 259. [func] New random-device and random-seed-file statements 21430 for global options block of named.conf. Both accept 21431 a single string argument. 21432 21433 258. [bug] Fixed printing of lwres_addr_t.address field. 21434 21435 257. [bug] The server detached the last zone manager reference 21436 too early, while it could still be in use by queries. 21437 This manifested itself as assertion failures during the 21438 shutdown process for busy name servers. [RT #133] 21439 21440 256. [func] isc_ratelimiter_t now has attach/detach semantics, and 21441 isc_ratelimiter_shutdown guarantees that the rate 21442 limiter is detached from its task. 21443 21444 255. [func] New function dns_zonemgr_attach(). 21445 21446 254. [bug] Suppress "query denied" messages on additional data 21447 lookups. 21448 21449 .. code-block:: none 21450 21451 --- 9.0.0b4 released --- 21452 21453 253. [func] resolv.conf parser now recognizes ';' and '#' as 21454 comments (anywhere in line, not just as the beginning). 21455 21456 252. [bug] resolv.conf parser mishandled masks on sortlists. 21457 It also aborted when an unrecognized keyword was seen, 21458 now it silently ignores the entire line. 21459 21460 251. [bug] lwresd caught an assertion failure on startup. 21461 21462 250. [bug] fixed handling of size+unit when value would be too 21463 large for internal representation. 21464 21465 249. [cleanup] max-cache-size config option now takes a size-spec 21466 like 'datasize', except 'default' is not allowed. 21467 21468 248. [bug] global lame-ttl option was not being printed when 21469 config structures were written out. 21470 21471 247. [cleanup] Rename cache-size config option to max-cache-size. 21472 21473 246. [func] Rename global option cachesize to cache-size and 21474 add corresponding option to view statement. 21475 21476 245. [bug] If an uncompressed name will take more than 255 21477 bytes and the buffer is sufficiently long, 21478 dns_name_fromwire should return DNS_R_FORMERR, 21479 not ISC_R_NOSPACE. This bug caused cause the 21480 server to catch an assertion failure when it 21481 received a query for a name longer than 255 21482 bytes. 21483 21484 244. [bug] empty named.conf file and empty options statement are 21485 now parsed properly. 21486 21487 243. [func] new cachesize option for named.conf 21488 21489 242. [cleanup] fixed incorrect warning about auth-nxdomain usage. 21490 21491 241. [cleanup] nscount and soacount have been removed from the 21492 dns_master_*() argument lists. 21493 21494 240. [func] databases now come in three flavours: zone, cache 21495 and stub. 21496 21497 239. [func] If ISC_MEM_DEBUG is enabled, the variable 21498 isc_mem_debugging controls whether messages 21499 are printed or not. 21500 21501 238. [cleanup] A few more compilation warnings have been quieted: 21502 + missing sigwait prototype on BSD/OS 4.0/4.0.1. 21503 + PTHREAD_ONCE_INIT unbraced initializer warnings on 21504 Solaris 2.8. 21505 + IN6ADDR_ANY_INIT unbraced initializer warnings on 21506 BSD/OS 4.*, Linux and Solaris 2.8. 21507 21508 237. [bug] If connect() returned ENOBUFS when the resolver was 21509 initiating a TCP query, the socket didn't get 21510 destroyed, and the server did not shut down cleanly. 21511 21512 236. [func] Added new listen-on-v6 config file statement. 21513 21514 235. [func] Consider it a config file error if a listen-on 21515 statement has an IPv6 address in it, or a 21516 listen-on-v6 statement has an IPv4 address in it. 21517 21518 234. [bug] Allow a trusted-key's first field (domain-name) be 21519 either a quoted or an unquoted string, instead of 21520 requiring a quoted string. 21521 21522 233. [cleanup] Convert all config structure integer values to unsigned 21523 integer (isc_uint32_t) to match grammar. 21524 21525 232. [bug] Allow slave zones to not have a file. 21526 21527 231. [func] Support new 'port' clause in config file options 21528 section. Causes 'listen-on', 'masters' and 21529 'also-notify' statements to use its value instead of 21530 default (53). 21531 21532 230. [func] Replace the dst sign/verify API with a cleaner one. 21533 21534 229. [func] Support config file sig-validity-interval statement 21535 in options, views and zone statements (master 21536 zones only). 21537 21538 228. [cleanup] Logging messages in config module stripped of 21539 trailing period. 21540 21541 227. [cleanup] The enumerated identifiers dns_rdataclass_*, 21542 dns_rcode_*, dns_opcode_*, and dns_trust_* are 21543 also now cast to their appropriate types, as with 21544 dns_rdatatype_* in item number 225 below. 21545 21546 226. [func] dns_name_totext() now always prints the root name as 21547 '.', even when omit_final_dot is true. 21548 21549 225. [cleanup] The enumerated dns_rdatatype_* identifiers are now 21550 cast to dns_rdatatype_t via macros of their same name 21551 so that they are of the proper integral type wherever 21552 a dns_rdatatype_t is needed. 21553 21554 224. [cleanup] The entire project builds cleanly with gcc's 21555 -Wcast-qual and -Wwrite-strings warnings enabled, 21556 which is now the default when using gcc. (Warnings 21557 from confparser.c, because of yacc's code, are 21558 unfortunately to be expected.) 21559 21560 223. [func] Several functions were re-prototyped to qualify one 21561 or more of their arguments with "const". Similarly, 21562 several functions that return pointers now have 21563 those pointers qualified with const. 21564 21565 222. [bug] The global 'also-notify' option was ignored. 21566 21567 221. [bug] An uninitialized variable was sometimes passed to 21568 dns_rdata_freestruct() when loading a zone, causing 21569 an assertion failure. 21570 21571 220. [cleanup] Set the default outgoing port in the view, and 21572 set it in sockaddrs returned from the ADB. 21573 [31-May-2000 explorer] 21574 21575 219. [bug] Signed truncated messages more correctly follow 21576 the respective specs. 21577 21578 218. [func] When an rdataset is signed, its ttl is normalized 21579 based on the signature validity period. 21580 21581 217. [func] Also-notify and trusted-keys can now be used in 21582 the 'view' statement. 21583 21584 216. [func] The 'max-cache-ttl' and 'max-ncache-ttl' options 21585 now work. 21586 21587 215. [bug] Failures at certain points in request processing 21588 could cause the assertion INSIST(client->lockview 21589 == NULL) to be triggered. 21590 21591 214. [func] New public function isc_netaddr_format(), for 21592 formatting network addresses in log messages. 21593 21594 213. [bug] Don't leak memory when reloading the zone if 21595 an update-policy clause was present in the old zone. 21596 21597 212. [func] Added dns_message_get/settsigkey, to make TSIG 21598 key management reasonable. 21599 21600 211. [func] The 'key' and 'server' statements can now occur 21601 inside 'view' statements. 21602 21603 210. [bug] The 'allow-transfer' option was ignored for slave 21604 zones, and the 'transfers-per-ns' option was 21605 was ignored for all zones. 21606 21607 209. [cleanup] Upgraded openssl files to new version 0.9.5a 21608 21609 208. [func] Added ISC_OFFSET_MAXIMUM for the maximum value 21610 of an isc_offset_t. 21611 21612 207. [func] The dnssec tools properly use the logging subsystem. 21613 21614 206. [cleanup] dst now stores the key name as a dns_name_t, not 21615 a char *. 21616 21617 205. [cleanup] On IRIX, turn off the mostly harmless warnings 1692 21618 ("prototyped function redeclared without prototype") 21619 and 1552 ("variable ... set but not used") when 21620 compiling in the lib/dns/sec/{dnssafe,openssl} 21621 directories, which contain code imported from outside 21622 sources. 21623 21624 204. [cleanup] On HP/UX, pass +vnocompatwarnings to the linker 21625 to quiet the warnings that "The linked output may not 21626 run on a PA 1.x system." 21627 21628 203. [func] notify and zone soa queries are now tsig signed when 21629 appropriate. 21630 21631 202. [func] isc_lex_getsourceline() changed from returning int 21632 to returning unsigned long, the type of its underlying 21633 counter. 21634 21635 201. [cleanup] Removed the test/sdig program, it has been 21636 replaced by bin/dig/dig. 21637 21638 .. code-block:: none 21639 21640 --- 9.0.0b3 released --- 21641 21642 200. [bug] Failures in sending query responses to clients 21643 (e.g., running out of network buffers) were 21644 not logged. 21645 21646 199. [bug] isc_heap_delete() sometimes violated the heap 21647 invariant, causing timer events not to be posted 21648 when due. 21649 21650 198. [func] Dispatch managers hold memory pools which 21651 any managed dispatcher may use. This allows 21652 us to avoid dipping into the memory context for 21653 most allocations. [19-May-2000 explorer] 21654 21655 197. [bug] When an incoming AXFR or IXFR completes, the 21656 zone's internal state is refreshed from the 21657 SOA data. [19-May-2000 explorer] 21658 21659 196. [func] Dispatchers can be shared easily between views 21660 and/or interfaces. [19-May-2000 explorer] 21661 21662 195. [bug] Including the NXT record of the root domain 21663 in a negative response caused an assertion 21664 failure. 21665 21666 194. [doc] The PDF version of the Administrator's Reference 21667 Manual is no longer included in the ISC BIND9 21668 distribution. 21669 21670 193. [func] changed dst_key_free() prototype. 21671 21672 192. [bug] Zone configuration validation is now done at end 21673 of config file parsing, and before loading 21674 callbacks. 21675 21676 191. [func] Patched to compile on UnixWare 7.x. This platform 21677 is not directly supported by the ISC. 21678 21679 190. [cleanup] The DNSSEC tools have been moved to a separate 21680 directory dnssec/ and given the following new, 21681 more descriptive names: 21682 21683 dnssec-keygen 21684 dnssec-signzone 21685 dnssec-signkey 21686 dnssec-makekeyset 21687 21688 Their command line arguments have also been changed to 21689 be more consistent. dnssec-keygen now prints the 21690 name of the generated key files (sans extension) 21691 on standard output to simplify its use in automated 21692 scripts. 21693 21694 189. [func] isc_time_secondsastimet(), a new function, will ensure 21695 that the number of seconds in an isc_time_t does not 21696 exceed the range of a time_t, or return ISC_R_RANGE. 21697 Similarly, isc_time_now(), isc_time_nowplusinterval(), 21698 isc_time_add() and isc_time_subtract() now check the 21699 range for overflow/underflow. In the case of 21700 isc_time_subtract, this changed a calling requirement 21701 (ie, something that could generate an assertion) 21702 into merely a condition that returns an error result. 21703 isc_time_add() and isc_time_subtract() were void- 21704 valued before but now return isc_result_t. 21705 21706 188. [func] Log a warning message when an incoming zone transfer 21707 contains out-of-zone data. 21708 21709 187. [func] isc_ratelimiter_enqueue() has an additional argument 21710 'task'. 21711 21712 186. [func] dns_request_getresponse() has an additional argument 21713 'preserve_order'. 21714 21715 185. [bug] Fixed up handling of ISC_MEMCLUSTER_LEGACY. Several 21716 public functions did not have an isc__ prefix, and 21717 referred to functions that had previously been 21718 renamed. 21719 21720 184. [cleanup] Variables/functions which began with two leading 21721 underscores were made to conform to the ANSI/ISO 21722 standard, which says that such names are reserved. 21723 21724 183. [func] ISC_LOG_PRINTTAG option for log channels. Useful 21725 for logging the program name or other identifier. 21726 21727 182. [cleanup] New command-line parameters for dnssec tools 21728 21729 181. [func] Added dst_key_buildfilename and dst_key_parsefilename 21730 21731 180. [func] New isc_result_t ISC_R_RANGE. Supersedes DNS_R_RANGE. 21732 21733 179. [func] options named.conf statement *must* now come 21734 before any zone or view statements. 21735 21736 178. [func] Post-load of named.conf check verifies a slave zone 21737 has non-empty list of masters defined. 21738 21739 177. [func] New per-zone boolean: 21740 21741 enable-zone yes | no ; 21742 21743 intended to let a zone be disabled without having 21744 to comment out the entire zone statement. 21745 21746 176. [func] New global and per-view option: 21747 21748 max-cache-ttl number 21749 21750 175. [func] New global and per-view option: 21751 21752 additional-data internal | minimal | maximal; 21753 21754 174. [func] New public function isc_sockaddr_format(), for 21755 formatting socket addresses in log messages. 21756 21757 173. [func] Keep a queue of zones waiting for zone transfer 21758 quota so that a new transfer can be dispatched 21759 immediately whenever quota becomes available. 21760 21761 172. [bug] $TTL directive was sometimes missing from dumped 21762 master files because totext_ctx_init() failed to 21763 initialize ctx->current_ttl_valid. 21764 21765 171. [cleanup] On NetBSD systems, the mit-pthreads or 21766 unproven-pthreads library is now always used 21767 unless --with-ptl2 is explicitly specified on 21768 the configure command line. The 21769 --with-mit-pthreads option is no longer needed 21770 and has been removed. 21771 21772 170. [cleanup] Remove inter server consistency checks from zone, 21773 these should return as a separate module in 9.1. 21774 dns_zone_checkservers(), dns_zone_checkparents(), 21775 dns_zone_checkchildren(), dns_zone_checkglue(). 21776 21777 Remove dns_zone_setadb(), dns_zone_setresolver(), 21778 dns_zone_setrequestmgr() these should now be found 21779 via the view. 21780 21781 169. [func] ratelimiter can now process N events per interval. 21782 21783 168. [bug] include statements in named.conf caused syntax errors 21784 due to not consuming the semicolon ending the include 21785 statement before switching input streams. 21786 21787 167. [bug] Make lack of masters for a slave zone a soft error. 21788 21789 166. [bug] Keygen was overwriting existing keys if key_id 21790 conflicted, now it will retry, and non-null keys 21791 with key_id == 0 are not generated anymore. Key 21792 was not able to generate NOAUTHCONF DSA key, 21793 increased RSA key size to 2048 bits. 21794 21795 165. [cleanup] Silence "end-of-loop condition not reached" warnings 21796 from Solaris compiler. 21797 21798 164. [func] Added functions isc_stdio_open(), isc_stdio_close(), 21799 isc_stdio_seek(), isc_stdio_read(), isc_stdio_write(), 21800 isc_stdio_flush(), isc_stdio_sync(), isc_file_remove() 21801 to encapsulate nonportable usage of errno and sync. 21802 21803 163. [func] Added result codes ISC_R_FILENOTFOUND and 21804 ISC_R_FILEEXISTS. 21805 21806 162. [bug] Ensure proper range for arguments to ctype.h functions. 21807 21808 161. [cleanup] error in yyparse prototype that only HPUX caught. 21809 21810 160. [cleanup] getnet*() are not going to be implemented at this 21811 stage. 21812 21813 159. [func] Redefinition of config file elements is now an 21814 error (instead of a warning). 21815 21816 158. [bug] Log channel and category list copy routines 21817 weren't assigning properly to output parameter. 21818 21819 157. [port] Fix missing prototype for getopt(). 21820 21821 156. [func] Support new 'database' statement in zone. 21822 21823 database "quoted-string"; 21824 21825 155. [bug] ns_notify_start() was not detaching the found zone. 21826 21827 154. [func] The signer now logs libdns warnings to stderr even when 21828 not verbose, and in a nicer format. 21829 21830 153. [func] dns_rdata_tostruct() 'mctx' is now optional. If 'mctx' 21831 is NULL then you need to preserve the 'rdata' until 21832 you have finished using the structure as there may be 21833 references to the associated memory. If 'mctx' is 21834 non-NULL it is guaranteed that there are no references 21835 to memory associated with 'rdata'. 21836 21837 dns_rdata_freestruct() must be called if 'mctx' was 21838 non-NULL and may safely be called if 'mctx' was NULL. 21839 21840 152. [bug] keygen dumped core if domain name argument was omitted 21841 from command line. 21842 21843 151. [func] Support 'disabled' statement in zone config (causes 21844 zone to be parsed and then ignored). Currently must 21845 come after the 'type' clause. 21846 21847 150. [func] Support optional ports in masters and also-notify 21848 statements: 21849 21850 masters [ port xxx ] { y.y.y.y [ port zzz ] ; } 21851 21852 149. [cleanup] Removed unused argument 'olist' from 21853 dns_c_view_unsetordering(). 21854 21855 148. [cleanup] Stop issuing some warnings about some configuration 21856 file statements that were not implemented, but now are. 21857 21858 147. [bug] Changed yacc union size to be smaller for yaccs that 21859 put yacc-stack on the real stack. 21860 21861 146. [cleanup] More general redundant header file cleanup. Rather 21862 than continuing to itemize every header which changed, 21863 this changelog entry just notes that if a header file 21864 did not need another header file that it was including 21865 in order to provide its advertised functionality, the 21866 inclusion of the other header file was removed. See 21867 util/check-includes for how this was tested. 21868 21869 145. [cleanup] Added <isc/lang.h> and ISC_LANG_BEGINDECLS/ 21870 ISC_LANG_ENDDECLS to header files that had function 21871 prototypes, and removed it from those that did not. 21872 21873 144. [cleanup] libdns header files too numerous to name were made 21874 to conform to the same style for multiple inclusion 21875 protection. 21876 21877 143. [func] Added function dns_rdatatype_isknown(). 21878 21879 142. [cleanup] <isc/stdtime.h> does not need <time.h> or 21880 <isc/result.h>. 21881 21882 141. [bug] Corrupt requests with multiple questions could 21883 cause an assertion failure. 21884 21885 140. [cleanup] <isc/time.h> does not need <time.h> or <isc/result.h>. 21886 21887 139. [cleanup] <isc/net.h> now includes <isc/types.h> instead of 21888 <isc/int.h> and <isc/result.h>. 21889 21890 138. [cleanup] isc_strtouq moved from str.[ch] to string.[ch] and 21891 renamed isc_string_touint64. isc_strsep moved from 21892 strsep.c to string.c and renamed isc_string_separate. 21893 21894 137. [cleanup] <isc/commandline.h>, <isc/mem.h>, <isc/print.h> 21895 <isc/serial.h>, <isc/string.h> and <isc/offset.h> 21896 made to conform to the same style for multiple 21897 inclusion protection. 21898 21899 136. [cleanup] <isc/commandline.h>, <isc/interfaceiter.h>, 21900 <isc/net.h> and Win32's <isc/thread.h> needed 21901 ISC_LANG_BEGINDECLS/ISC_LANG_ENDDECLS. 21902 21903 135. [cleanup] Win32's <isc/condition.h> did not need <isc/result.h> 21904 or <isc/boolean.h>, now uses <isc/types.h> in place 21905 of <isc/time.h>, and needed ISC_LANG_BEGINDECLS 21906 and ISC_LANG_ENDDECLS. 21907 21908 134. [cleanup] <isc/dir.h> does not need <limits.h>. 21909 21910 133. [cleanup] <isc/ipv6.h> needs <isc/platform.h>. 21911 21912 132. [cleanup] <isc/app.h> does not need <isc/task.h>, but does 21913 need <isc/eventclass.h>. 21914 21915 131. [cleanup] <isc/mutex.h> and <isc/util.h> need <isc/result.h> 21916 for ISC_R_* codes used in macros. 21917 21918 130. [cleanup] <isc/condition.h> does not need <pthread.h> or 21919 <isc/boolean.h>, and now includes <isc/types.h> 21920 instead of <isc/time.h>. 21921 21922 129. [bug] The 'default_debug' log channel was not set up when 21923 'category default' was present in the config file 21924 21925 128. [cleanup] <isc/dir.h> had ISC_LANG_BEGINDECLS instead of 21926 ISC_LANG_ENDDECLS at end of header. 21927 21928 127. [cleanup] The contracts for the comparison routines 21929 dns_name_fullcompare(), dns_name_compare(), 21930 dns_name_rdatacompare(), and dns_rdata_compare() now 21931 specify that the order value returned is < 0, 0, or > 0 21932 instead of -1, 0, or 1. 21933 21934 126. [cleanup] <isc/quota.h> and <isc/taskpool.h> need <isc/lang.h>. 21935 21936 125. [cleanup] <isc/eventclass.h>, <isc/ipv6.h>, <isc/magic.h>, 21937 <isc/mutex.h>, <isc/once.h>, <isc/region.h>, and 21938 <isc/resultclass.h> do not need <isc/lang.h>. 21939 21940 124. [func] signer now imports parent's zone key signature 21941 and creates null keys/sets zone status bit for 21942 children when necessary 21943 21944 123. [cleanup] <isc/event.h> does not need <stddef.h>. 21945 21946 122. [cleanup] <isc/task.h> does not need <isc/mem.h> or 21947 <isc/result.h>. 21948 21949 121. [cleanup] <isc/symtab.h> does not need <isc/mem.h> or 21950 <isc/result.h>. Multiple inclusion protection 21951 symbol fixed from ISC_SYMBOL_H to ISC_SYMTAB_H. 21952 isc_symtab_t moved to <isc/types.h>. 21953 21954 120. [cleanup] <isc/socket.h> does not need <isc/boolean.h>, 21955 <isc/bufferlist.h>, <isc/task.h>, <isc/mem.h> or 21956 <isc/net.h>. 21957 21958 119. [cleanup] structure definitions for generic rdata structures do 21959 not have _generic_ in their names. 21960 21961 118. [cleanup] libdns.a is now namespace-clean, on NetBSD, excepting 21962 YACC crust (yyparse, etc) [2000-apr-27 explorer] 21963 21964 117. [cleanup] libdns.a changes: 21965 dns_zone_clearnotify() and dns_zone_addnotify() 21966 are replaced by dns_zone_setnotifyalso(). 21967 dns_zone_clearmasters() and dns_zone_addmaster() 21968 are replaced by dns_zone_setmasters(). 21969 21970 116. [func] Added <isc/offset.h> for isc_offset_t (aka off_t 21971 on Unix systems). 21972 21973 115. [port] Shut up the -Wmissing-declarations warning about 21974 <stdio.h>'s __sputaux on BSD/OS pre-4.1. 21975 21976 114. [cleanup] <isc/sockaddr.h> does not need <isc/buffer.h> or 21977 <isc/list.h>. 21978 21979 113. [func] Utility programs dig and host added. 21980 21981 112. [cleanup] <isc/serial.h> does not need <isc/boolean.h>. 21982 21983 111. [cleanup] <isc/rwlock.h> does not need <isc/result.h> or 21984 <isc/mutex.h>. 21985 21986 110. [cleanup] <isc/result.h> does not need <isc/boolean.h> or 21987 <isc/list.h>. 21988 21989 109. [bug] "make depend" did nothing for 21990 bin/tests/{db,mem,sockaddr,tasks,timers}/. 21991 21992 108. [cleanup] DNS_SETBIT/DNS_GETBIT/DNS_CLEARBIT moved from 21993 <dns/types.h> to <dns/bit.h> and renamed to 21994 DNS_BIT_SET/DNS_BIT_GET/DNS_BIT_CLEAR. 21995 21996 107. [func] Add keysigner and keysettool. 21997 21998 106. [func] Allow dnssec verifications to ignore the validity 21999 period. Used by several of the dnssec tools. 22000 22001 105. [doc] doc/dev/coding.html expanded with other 22002 implicit conventions the developers have used. 22003 22004 104. [bug] Made compress_add and compress_find static to 22005 lib/dns/compress.c. 22006 22007 103. [func] libisc buffer API changes for <isc/buffer.h>: 22008 Added: 22009 isc_buffer_base(b) (pointer) 22010 isc_buffer_current(b) (pointer) 22011 isc_buffer_active(b) (pointer) 22012 isc_buffer_used(b) (pointer) 22013 isc_buffer_length(b) (int) 22014 isc_buffer_usedlength(b) (int) 22015 isc_buffer_consumedlength(b) (int) 22016 isc_buffer_remaininglength(b) (int) 22017 isc_buffer_activelength(b) (int) 22018 isc_buffer_availablelength(b) (int) 22019 Removed: 22020 ISC_BUFFER_USEDCOUNT(b) 22021 ISC_BUFFER_AVAILABLECOUNT(b) 22022 isc_buffer_type(b) 22023 Changed names: 22024 isc_buffer_used(b, r) -> 22025 isc_buffer_usedregion(b, r) 22026 isc_buffer_available(b, r) -> 22027 isc_buffer_available_region(b, r) 22028 isc_buffer_consumed(b, r) -> 22029 isc_buffer_consumedregion(b, r) 22030 isc_buffer_active(b, r) -> 22031 isc_buffer_activeregion(b, r) 22032 isc_buffer_remaining(b, r) -> 22033 isc_buffer_remainingregion(b, r) 22034 22035 Buffer types were removed, so the ISC_BUFFERTYPE_* 22036 macros are no more, and the type argument to 22037 isc_buffer_init and isc_buffer_allocate were removed. 22038 isc_buffer_putstr is now void (instead of isc_result_t) 22039 and requires that the caller ensure that there 22040 is enough available buffer space for the string. 22041 22042 102. [port] Correctly detect inet_aton, inet_pton and inet_ptop 22043 on BSD/OS 4.1. 22044 22045 101. [cleanup] Quieted EGCS warnings from lib/isc/print.c. 22046 22047 100. [cleanup] <isc/random.h> does not need <isc/int.h> or 22048 <isc/mutex.h>. isc_random_t moved to <isc/types.h>. 22049 22050 99. [cleanup] Rate limiter now has separate shutdown() and 22051 destroy() functions, and it guarantees that all 22052 queued events are delivered even in the shutdown case. 22053 22054 98. [cleanup] <isc/print.h> does not need <stdarg.h> or <stddef.h> 22055 unless ISC_PLATFORM_NEEDVSNPRINTF is defined. 22056 22057 97. [cleanup] <isc/ondestroy.h> does not need <stddef.h> or 22058 <isc/event.h>. 22059 22060 96. [cleanup] <isc/mutex.h> does not need <isc/result.h>. 22061 22062 95. [cleanup] <isc/mutexblock.h> does not need <isc/result.h>. 22063 22064 94. [cleanup] Some installed header files did not compile as C++. 22065 22066 93. [cleanup] <isc/msgcat.h> does not need <isc/result.h>. 22067 22068 92. [cleanup] <isc/mem.h> does not need <stddef.h>, <isc/boolean.h>, 22069 or <isc/result.h>. 22070 22071 91. [cleanup] <isc/log.h> does not need <sys/types.h> or 22072 <isc/result.h>. 22073 22074 90. [cleanup] Removed unneeded ISC_LANG_BEGINDECLS/ISC_LANG_ENDDECLS 22075 from <named/listenlist.h>. 22076 22077 89. [cleanup] <isc/lex.h> does not need <stddef.h>. 22078 22079 88. [cleanup] <isc/interfaceiter.h> does not need <isc/result.h> or 22080 <isc/mem.h>. isc_interface_t and isc_interfaceiter_t 22081 moved to <isc/types.h>. 22082 22083 87. [cleanup] <isc/heap.h> does not need <isc/boolean.h>, 22084 <isc/mem.h> or <isc/result.h>. 22085 22086 86. [cleanup] isc_bufferlist_t moved from <isc/bufferlist.h> to 22087 <isc/types.h>. 22088 22089 85. [cleanup] <isc/bufferlist.h> does not need <isc/buffer.h>, 22090 <isc/list.h>, <isc/mem.h>, <isc/region.h> or 22091 <isc/int.h>. 22092 22093 84. [func] allow-query ACL checks now apply to all data 22094 added to a response. 22095 22096 83. [func] If the server is authoritative for both a 22097 delegating zone and its (nonsecure) delegatee, and 22098 a query is made for a KEY RR at the top of the 22099 delegatee, then the server will look for a KEY 22100 in the delegator if it is not found in the delegatee. 22101 22102 82. [cleanup] <isc/buffer.h> does not need <isc/list.h>. 22103 22104 81. [cleanup] <isc/int.h> and <isc/boolean.h> do not need 22105 <isc/lang.h>. 22106 22107 80. [cleanup] <isc/print.h> does not need <stdio.h> or <stdlib.h>. 22108 22109 79. [cleanup] <dns/callbacks.h> does not need <stdio.h>. 22110 22111 78. [cleanup] lwres_conftest renamed to lwresconf_test for 22112 consistency with other *_test programs. 22113 22114 77. [cleanup] typedef of isc_time_t and isc_interval_t moved from 22115 <isc/time.h> to <isc/types.h>. 22116 22117 76. [cleanup] Rewrote keygen. 22118 22119 75. [func] Don't load a zone if its database file is older 22120 than the last time the zone was loaded. 22121 22122 74. [cleanup] Removed mktemplate.o and ufile.o from libisc.a, 22123 subsumed by file.o. 22124 22125 73. [func] New "file" API in libisc, including new function 22126 isc_file_getmodtime, isc_mktemplate renamed to 22127 isc_file_mktemplate and isc_ufile renamed to 22128 isc_file_openunique. By no means an exhaustive API, 22129 it is just what's needed for now. 22130 22131 72. [func] DNS_RBTFIND_NOPREDECESSOR and DNS_RBTFIND_NOOPTIONS 22132 added for dns_rbt_findnode, the former to disable the 22133 setting of the chain to the predecessor, and the 22134 latter to make clear when no options are set. 22135 22136 71. [cleanup] Made explicit the implicit REQUIREs of 22137 isc_time_seconds, isc_time_nanoseconds, and 22138 isc_time_subtract. 22139 22140 70. [func] isc_time_set() added. 22141 22142 69. [bug] The zone object's master and also-notify lists grew 22143 longer with each server reload. 22144 22145 68. [func] Partial support for SIG(0) on incoming messages. 22146 22147 67. [performance] Allow use of alternate (compile-time supplied) 22148 OpenSSL libraries/headers. 22149 22150 66. [func] Data in authoritative zones should have a trust level 22151 beyond secure. 22152 22153 65. [cleanup] Removed obsolete typedef of dns_zone_callbackarg_t 22154 from <dns/types.h>. 22155 22156 64. [func] The RBT, DB, and zone table APIs now allow the 22157 caller find the most-enclosing superdomain of 22158 a name. 22159 22160 63. [func] Generate NOTIFY messages. 22161 22162 62. [func] Add UDP refresh support. 22163 22164 61. [cleanup] Use single quotes consistently in log messages. 22165 22166 60. [func] Catch and disallow singleton types on message 22167 parse. 22168 22169 59. [bug] Cause net/host unreachable to be a hard error 22170 when sending and receiving. 22171 22172 58. [bug] bin/named/query.c could sometimes trigger the 22173 (client->query.attributes & NS_QUERYATTR_NAMEBUFUSED) 22174 == 0 assertion in query_newname(). 22175 22176 57. [func] Added dns_nxt_typepresent() 22177 22178 56. [bug] SIG records were not properly returned in cached 22179 negative answers. 22180 22181 55. [bug] Responses containing multiple names in the authority 22182 section were not negatively cached. 22183 22184 54. [bug] If a fetch with sigrdataset==NULL joined one with 22185 sigrdataset!=NULL or vice versa, the resolver 22186 could catch an assertion or lose signature data, 22187 respectively. 22188 22189 53. [port] freebsd 4.0: lib/isc/unix/socket.c requires 22190 <sys/param.h>. 22191 22192 52. [bug] rndc: taskmgr and socketmgr were not initialized 22193 to NULL. 22194 22195 51. [cleanup] dns/compress.h and dns/zt.h did not need to include 22196 dns/rbt.h; it was needed only by compress.c and zt.c. 22197 22198 50. [func] RBT deletion no longer requires a valid chain to work, 22199 and dns_rbt_deletenode was added. 22200 22201 49. [func] Each cache now has its own mctx. 22202 22203 48. [func] isc_task_create() no longer takes an mctx. 22204 isc_task_mem() has been eliminated. 22205 22206 47. [func] A number of modules now use memory context reference 22207 counting. 22208 22209 46. [func] Memory contexts are now reference counted. 22210 Added isc_mem_inuse() and isc_mem_preallocate(). 22211 Renamed isc_mem_destroy_check() to 22212 isc_mem_setdestroycheck(). 22213 22214 45. [bug] The trusted-key statement incorrectly loaded keys. 22215 22216 44. [bug] Don't include authority data if it would force us 22217 to unset the AD bit in the message. 22218 22219 43. [bug] DNSSEC verification of cached rdatasets was failing. 22220 22221 42. [cleanup] Simplified logging of messages with embedded domain 22222 names by introducing a new convenience function 22223 dns_name_format(). 22224 22225 41. [func] Use PR_SET_KEEPCAPS on Linux 2.3.99-pre3 and later 22226 to allow 'named' to run as a non-root user while 22227 retaining the ability to bind() to privileged 22228 ports. 22229 22230 40. [func] Introduced new logging category "dnssec" and 22231 logging module "dns/validator". 22232 22233 39. [cleanup] Moved the typedefs for isc_region_t, isc_textregion_t, 22234 and isc_lex_t to <isc/types.h>. 22235 22236 38. [bug] TSIG signed incoming zone transfers work now. 22237 22238 37. [bug] If the first RR in an incoming zone transfer was 22239 not an SOA, the server died with an assertion failure 22240 instead of just reporting an error. 22241 22242 36. [cleanup] Change DNS_R_SUCCESS (and others) to ISC_R_SUCCESS 22243 22244 35. [performance] Log messages which are of a level too high to be 22245 logged by any channel in the logging configuration 22246 will not cause the log mutex to be locked. 22247 22248 34. [bug] Recursion was allowed even with 'recursion no'. 22249 22250 33. [func] The RBT now maintains a parent pointer at each node. 22251 22252 32. [cleanup] bin/lwresd/client.c needs <string.h> for memset() 22253 prototype. 22254 22255 31. [bug] Use ${LIBTOOL} to compile bin/named/main.@O@. 22256 22257 30. [func] config file grammar change to support optional 22258 class type for a view. 22259 22260 29. [func] support new config file view options: 22261 22262 auth-nxdomain recursion query-source 22263 query-source-v6 transfer-source 22264 transfer-source-v6 max-transfer-time-out 22265 max-transfer-idle-out transfer-format 22266 request-ixfr provide-ixfr cleaning-interval 22267 fetch-glue notify rfc2308-type1 lame-ttl 22268 max-ncache-ttl min-roots 22269 22270 28. [func] support lame-ttl, min-roots and serial-queries 22271 config global options. 22272 22273 27. [bug] Only include <netinet6/in6.h> on BSD/OS 4.[01]*. 22274 Including it on other platforms (eg, NetBSD) can 22275 cause a forced #error from the C preprocessor. 22276 22277 26. [func] new match-clients statement in config file view. 22278 22279 25. [bug] make install failed to install <isc/log.h> and 22280 <isc/ondestroy.h>. 22281 22282 24. [cleanup] Eliminate some unnecessary #includes of header 22283 files from header files. 22284 22285 23. [cleanup] Provide more context in log messages about client 22286 requests, using a new function ns_client_log(). 22287 22288 22. [bug] SIGs weren't returned in the answer section when 22289 the query resulted in a fetch. 22290 22291 21. [port] Look at STD_CINCLUDES after CINCLUDES during 22292 compilation, so additional system include directories 22293 can be searched but header files in the bind9 source 22294 tree with conflicting names take precedence. This 22295 avoids issues with installed versions of dnssafe and 22296 openssl. 22297 22298 20. [func] Configuration file post-load validation of zones 22299 failed if there were no zones. 22300 22301 19. [bug] dns_zone_notifyreceive() failed to unlock the zone 22302 lock in certain error cases. 22303 22304 18. [bug] Use AC_TRY_LINK rather than AC_TRY_COMPILE in 22305 configure.in to check for presence of in6addr_any. 22306 22307 17. [func] Do configuration file post-load validation of zones. 22308 22309 16. [bug] put quotes around key names on config file 22310 output to avoid possible keyword clashes. 22311 22312 15. [func] Add dns_name_dupwithoffsets(). This function is 22313 improves comparison performance for duped names. 22314 22315 14. [bug] free_rbtdb() could have 'put' unallocated memory in 22316 an unlikely error path. 22317 22318 13. [bug] lib/dns/master.c and lib/dns/xfrin.c didn't ignore 22319 out-of-zone data. 22320 22321 12. [bug] Fixed possible uninitialized variable error. 22322 22323 11. [bug] axfr_rrstream_first() didn't check the result code of 22324 db_rr_iterator_first(), possibly causing an assertion 22325 to be triggered later. 22326 22327 10. [bug] A bug in the code which makes EDNS0 OPT records in 22328 bin/named/client.c and lib/dns/resolver.c could 22329 trigger an assertion. 22330 22331 9. [cleanup] replaced bit-setting code in confctx.c and replaced 22332 repeated code with macro calls. 22333 22334 8. [bug] Shutdown of incoming zone transfer accessed 22335 freed memory. 22336 22337 7. [cleanup] removed 'listen-on' from view statement. 22338 22339 6. [bug] quote RR names when generating config file to 22340 prevent possible clash with config file keywords 22341 (such as 'key'). 22342 22343 5. [func] syntax change to named.conf file: new ssu grant/deny 22344 statements must now be enclosed by an 'update-policy' 22345 block. 22346 22347 4. [port] bin/named/unix/os.c didn't compile on systems with 22348 linux 2.3 kernel includes due to conflicts between 22349 C library includes and the kernel includes. We now 22350 get only what we need from <linux/capability.h>, and 22351 avoid pulling in other linux kernel .h files. 22352 22353 3. [bug] TKEYs go in the answer section of responses, not 22354 the additional section. 22355 22356 2. [bug] Generating cryptographic randomness failed on 22357 systems without /dev/random. 22358 22359 1. [bug] The installdirs rule in 22360 lib/isc/unix/include/isc/Makefile.in had a typo which 22361 prevented the isc directory from being created if it 22362 didn't exist. 22363 22364 .. code-block:: none 22365 22366 --- 9.0.0b2 released --- 22367 22368
Indexes created Wed May 06 00:24:28 UTC 2026