-
Notifications
You must be signed in to change notification settings - Fork 6
/
Copy pathCHANGES
10926 lines (7483 loc) · 358 KB
/
CHANGES
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
--- 9.9.2-P1 released ---
3407. [security] Named could die on specific queries with dns64 enabled.
[Addressed in change #3388 for BIND 9.8.5 and 9.9.3.]
--- 9.9.2 released ---
3383. [security] A certain combination of records in the RBT could
cause named to hang while populating the additional
section of a response. [RT #31090]
3373. [bug] win32: open raw files in binary mode. [RT #30944]
3364. [security] Named could die on specially crafted record.
[RT #30416]
--- 9.9.2rc1 released ---
3370. [bug] Address use after free while shutting down. [RT #30241]
3369. [bug] nsupdate terminated unexpectedly in interactive mode
if built with readline support. [RT #29550]
3368. [bug] <dns/iptable.h>, <dns/private.h> and <dns/zone.h>
were not C++ safe.
3367. [bug] dns_dnsseckey_create() result was not being checked.
[RT #30685]
3366. [bug] Fixed Read-After-Write dependency violation for IA64
atomic operations. [RT #25181]
3365. [bug] Removed spurious newlines from log messages in
zone.c [RT #30675]
3363. [bug] Need to allow "forward" and "fowarders" options
in static-stub zones; this had been overlooked.
[RT #30482]
3362. [bug] Setting some option values to 0 in named.conf
could trigger an assertion failure on startup.
[RT #27730]
3361. [bug] "rndc signing -nsec3param" didn't work correctly
when salt was set to '-' (no salt). [RT #30099]
3360. [bug] 'host -w' could die. [RT #18723]
3359. [bug] An improperly-formed TSIG secret could cause a
memory leak. [RT #30607]
3357. [port] Add support for libxml2-2.8.x [RT #30440]
3356. [bug] Cap the TTL of signed RRsets when RRSIGs are
approaching their expiry, so they don't remain
in caches after expiry. [RT #26429]
3355. [port] Use more portable awk in verify system test.
3354. [func] Improve OpenSSL error logging. [RT #29932]
--- 9.9.2b1 released ---
3353. [bug] Use a single task for task exclusive operations.
[RT #29872]
3352. [bug] Ensure that learned server attributes timeout of the
adb cache. [RT #29856]
3351. [bug] isc_mem_put and isc_mem_putanddetach didn't report
caller if either ISC_MEM_DEBUGSIZE or ISC_MEM_DEBUGCTX
memory debugging flags are set. [RT #30243]
3350. [bug] Memory read overrun in isc___mem_reallocate if
ISC_MEM_DEBUGCTX memory debugging flag is set.
[RT #30240]
3349. [bug] Change #3345 was incomplete. [RT #30233]
3348. [bug] Prevent RRSIG data from being cached if a negative
record matching the covering type exists at a higher
trust level. Such data already can't be retrieved from
the cache since change 3218 -- this prevents it
being inserted into the cache as well. [RT #26809]
3347. [bug] dnssec-settime: Issue a warning when writing a new
private key file would cause a change in the
permissions of the existing file. [RT #27724]
3346. [security] Bad-cache data could be used before it was
initialized, causing an assert. [RT #30025]
3345. [bug] Addressed race condition when removing the last item
or inserting the first item in an ISC_QUEUE.
[RT #29539]
3344. [func] New "dnssec-checkds" command checks a zone to
determine which DS records should be published
in the parent zone, or which DLV records should be
published in a DLV zone, and queries the DNS to
ensure that it exists. (Note: This tool depends
on python; it will not be built or installed on
systems that do not have a python interpreter.)
[RT #28099]
3342. [bug] Change #3314 broke saving of stub zones to disk
resulting in excessive cpu usage in some cases.
[RT #29952]
3341. [func] New "dnssec-verify" command checks a signed zone
to ensure correctness of signatures and of NSEC/NSEC3
chains. [RT #23673]
3339. [func] Allow the maximum supported rsa exponent size to be
specified: "max-rsa-exponent-size <value>;" [RT #29228]
3338. [bug] Address race condition in units tests: asyncload_zone
and asyncload_zt. [RT #26100]
3337. [bug] Change #3294 broke support for the multiple keys
in controls. [RT #29694]
3335. [func] nslookup: return a nonzero exit code when unable
to get an answer. [RT #29492]
3334. [bug] Hold a zone table reference while performing a
asyncronous load of a zone. [RT #28326]
3333. [bug] Setting resolver-query-timeout too low can cause
named to not recover if it loses connectivity.
[RT #29623]
3332. [bug] Re-use cached DS rrsets if possible. [RT #29446]
3331. [security] dns_rdataslab_fromrdataset could produce bad
rdataslabs. [RT #29644]
3330. [func] Fix missing signatures on NOERROR results despite
RPZ rewriting. Also
- add optional "recursive-only yes|no" to the
response-policy statement
- add optional "max-policy-ttl" to the response-policy
statement to limit the false data that
"recursive-only no" can introduce into
resolvers' caches
- add a RPZ performance test to bin/tests/system/rpz
when queryperf is available.
- the encoding of PASSTHRU action to "rpz-passthru".
(The old encoding is still accepted.)
[RT #26172]
3329. [bug] Handle RRSIG signer-name case consistently: We
generate RRSIG records with the signer-name in
lower case. We accept them with any case, but if
they fail to validate, we try again in lower case.
[RT #27451]
3328. [bug] Fixed inconsistent data checking in dst_parse.c.
[RT #29401]
3317. [func] Add ECDSA support (RFC 6605). [RT #21918]
--- 9.9.1 released ---
3318. [tuning] Reduce the amount of work performed while holding a
bucket lock when finshed with a fetch context.
[RT #29239]
3314. [bug] The masters list could be updated while refesh_callback
and stub_callback were using it. [RT #26732]
3313. [protocol] Add TLSA record type. [RT #28989]
3312. [bug] named-checkconf didn't detect a bad dns64 clients acl.
[RT #27631]
3311. [bug] Abort the zone dump if zone->db is NULL in
zone.c:zone_gotwritehandle. [RT #29028]
3310. [test] Increase table size for mutex profiling. [RT #28809]
3309. [bug] resolver.c:fctx_finddone() was not threadsafe.
[RT #27995]
3307. [bug] Add missing ISC_LANG_BEGINDECLS and ISC_LANG_ENDDECLS.
[RT #28956]
3306. [bug] Improve DNS64 reverse zone performance. [RT #28563]
3305. [func] Add wire format lookup method to sdb. [RT #28563]
3304. [bug] Use hmctx, not mctx when freeing rbtdb->heaps.
[RT #28571]
3303. [bug] named could die when reloading. [RT #28606]
3302. [bug] dns_dnssec_findmatchingkeys could fail to find
keys if the zone name contained character that
required special mappings. [RT #28600]
3301. [contrib] Update queryperf to build on darwin. Add -R flag
for non-recursive queries. [RT #28565]
3300. [bug] Named could die if gssapi was enabled in named.conf
but was not compiled in. [RT #28338]
3299. [bug] Make SDB handle errors from database drivers better.
[RT #28534]
3298. [bug] Named could dereference a NULL pointer in
zmgr_start_xfrin_ifquota if the zone was being removed.
[RT #28419]
3297. [bug] Named could die on a malformed master file. [RT #28467]
3296. [bug] Named could die with a INSIST failure in
client.c:exit_check. [RT #28346]
3295. [bug] Adjust isc_time_secondsastimet range check to be more
portable. [RT # 26542]
3294. [bug] isccc/cc.c:table_fromwire failed to free alist on
error. [RT #28265]
3291. [port] Fixed a build error on systems without ENOTSUP.
[RT #28200]
3290. [bug] <isc/hmacsha.h> was not being installed. [RT #28169]
3273. [bug] AAAA responses could be returned in the additional
section even when filter-aaaa-on-v4 was in use.
[RT #27292]
--- 9.9.0 released ---
--- 9.9.0rc4 released ---
3289. [bug] 'rndc retransfer' failed for inline zones. [RT #28036]
3288. [bug] dlz_destroy() function wasn't correctly registered
by the DLZ dlopen driver. [RT #28056]
3287. [port] Update ans.pl to work with Net::DNS 0.68. [RT #28028]
3286. [bug] Managed key maintenance timer could fail to start
after 'rndc reconfig'. [RT #26786]
--- 9.9.0rc3 released ---
3285. [bug] val-frdataset was incorrectly disassociated in
proveunsecure after calling startfinddlvsep.
[RT #27928]
3284. [bug] Address race conditions with the handling of
rbtnode.deadlink. [RT #27738]
3283. [bug] Raw zones with with more than 512 records in a RRset
failed to load. [RT #27863]
3282. [bug] Restrict the TTL of NS RRset to no more than that
of the old NS RRset when replacing it.
[RT #27792] [RT #27884]
3281. [bug] SOA refresh queries could be treated as cancelled
despite succeeding over the loopback interface.
[RT #27782]
3280. [bug] Potential double free of a rdataset on out of memory
with DNS64. [RT #27762]
3279. [bug] Hold a internal reference to the zone while performing
a asynchronous load. Address potential memory leak
if the asynchronous is cancelled. [RT #27750]
3278. [bug] Make sure automatic key maintenance is started
when "auto-dnssec maintain" is turned on during
"rndc reconfig". [RT #26805]
3277. [bug] win32: isc_socket_dup is not implemented. [RT #27696]
3276. [bug] win32: ns_os_openfile failed to return NULL on
safe_open failure. [RT #27696]
3275. [bug] Corrected rndc -h output; the 'rndc sync -clean'
option had been misspelled as '-clear'. (To avoid
future confusion, both options now work.) [RT #27173]
3271. [port] darwin: mksymtbl is not always stable, loop several
times before giving up. mksymtbl was using non
portable perl to covert 64 bit hex strings. [RT #27653]
--- 9.9.0rc2 released ---
3270. [bug] "rndc reload" didn't reuse existing zones correctly
when inline-signing was in use. [RT #27650]
3269. [port] darwin 11 and later now built threaded by default.
3268. [bug] Convert RRSIG expiry times to 64 timestamps to work
out the earliest expiry time. [RT #23311]
3267. [bug] Memory allocation failures could be mis-reported as
unexpected error. New ISC_R_UNSET result code.
[RT #27336]
3266. [bug] The maximum number of NSEC3 iterations for a
DNSKEY RRset was not being properly computed.
[RT #26543]
3265. [bug] Corrected a problem with lock ordering in the
inline-signing code. [RT #27557]
3264. [bug] Automatic regeneration of signatures in an
inline-signing zone could stall when the server
was restarted. [RT #27344]
3263. [bug] "rndc sync" did not affect the unsigned side of an
inline-signing zone. [RT #27337]
3262. [bug] Signed responses were handled incorrectly by RPZ.
[RT #27316]
3261. [func] RRset ordering now defaults to random. [RT #27174]
3260. [bug] "rrset-order cyclic" could appear not to rotate
for some query patterns. [RT #27170/27185]
--- 9.9.0rc1 released ---
3259. [bug] named-compilezone: Suppress "dump zone to <file>"
message when writing to stdout. [RT #27109]
3258. [test] Add "forcing full sign with unreadable keys" test.
[RT #27153]
3257. [bug] Do not generate a error message when calling fsync()
in a pipe or socket. [RT #27109]
3256. [bug] Disable empty zones for lwresd -C. [RT #27139]
3255. [func] No longer require that a empty zones be explicitly
enabled or that a empty zone is disabled for
RFC 1918 empty zones to be configured. [RT #27139]
3254. [bug] Set isc_socket_ipv6only() on the IPv6 control channels.
[RT #22249]
3253. [bug] Return DNS_R_SYNTAX when the input to a text field is
too long. [RT #26956]
3252. [bug] When master zones using inline-signing were
updated while the server was offline, the source
zone could fall out of sync with the signed
copy. They can now resynchronize. [RT #26676]
3251. [bug] Enforce a upper bound (65535 bytes) on the amount of
memory dns_sdlz_putrr() can allocate per record to
prevent run away memory consumption on ISC_R_NOSPACE.
[RT #26956]
3250. [func] 'configure --enable-developer'; turn on various
configure options, normally off by default, that
we want developers to build and test with. [RT #27103]
3249. [bug] Update log message when saving slave zones files for
analysis after load failures. [RT #27087]
3248. [bug] Configure options --enable-fixed-rrset and
--enable-exportlib were incompatible with each
other. [RT #27087]
3247. [bug] 'raw' format zones failed to preserve load order
breaking 'fixed' sort order. [RT #27087]
3246. [bug] Named failed to start with a empty also-notify list.
[RT #27087]
3245. [bug] Don't report a error unchanged serials unless there
were other changes when thawing a zone with
ixfr-fromdifferences. [RT #26845]
3244. [func] Added readline support to nslookup and nsupdate.
Also simplified nsupdate syntax to make "update"
and "prereq" optional. [RT #24659]
3243. [port] freebsd,netbsd,bsdi: the thread defaults were not
being properly set.
3242. [func] Extended the header of raw-format master files to
include the serial number of the zone from which
they were generated, if different (as in the case
of inline-signing zones). This is to be used in
inline-signing zones, to track changes between the
unsigned and signed versions of the zone, which may
have different serial numbers.
(Note: raw zonefiles generated by this version of
BIND are no longer compatble with prior versions.
To generate a backward-compatible raw zonefile
using dnssec-signzone or named-compilezone, specify
output format "raw=0" instead of simply "raw".)
[RT #26587]
3241. [bug] Address race conditions in the resolver code.
[RT #26889]
3240. [bug] DNSKEY state change events could be missed. [RT #26874]
3239. [bug] dns_dnssec_findmatchingkeys needs to use a consistent
timestamp. [RT #26883]
3238. [bug] keyrdata was not being reinitialized in
lib/dns/rbtdb.c:iszonesecure. [RT#26913]
3237. [bug] dig -6 didn't work with +trace. [RT #26906]
3236. [bug] Backed out changes #3182 and #3202, related to
EDNS(0) fallback behavior. [RT #26416]
3235. [func] dns_db_diffx, a extended dns_db_diff which returns
the generated diff and optionally writes it to a
journal. [RT #26386]
3234. [bug] 'make depend' produced invalid makefiles. [RT #26830]
3233. [bug] 'rndc freeze/thaw' didn't work for inline zones.
[RT #26632]
3232. [bug] Zero zone->curmaster before return in
dns_zone_setmasterswithkeys(). [RT #26732]
3231. [bug] named could fail to send a uncompressable zone.
[RT #26796]
3230. [bug] 'dig axfr' failed to properly handle a multi-message
axfr with a serial of 0. [RT #26796]
3229. [bug] Fix local variable to struct var assignment
found by CLANG warning.
3228. [tuning] Dynamically grow symbol table to improve zone
loading performance. [RT #26523]
3227. [bug] Interim fix to make WKS's use of getprotobyname()
and getservbyname() self thread safe. [RT #26232]
3226. [bug] Address minor resource leakages. [RT #26624]
3225. [bug] Silence spurious "setsockopt(517, IPV6_V6ONLY) failed"
messages. [RT #26507]
3224. [bug] 'rndc signing' argument parsing was broken. [RT #26684]
3223. [bug] 'task_test privilege_drop' generated false positives.
[RT #26766]
3222. [cleanup] Replace dns_journal_{get,set}_bitws with
dns_journal_{get,set}_sourceserial. [RT #26634]
3221. [bug] Fixed a potential coredump on shutdown due to
referencing fetch context after it's been freed.
[RT #26720]
--- 9.9.0b2 released ---
3220. [bug] Change #3186 was incomplete; dns_db_rpz_findips()
could fail to set the database version correctly,
causing an assertion failure. [RT #26180]
3219. [bug] Disable NOEDNS caching following a timeout.
3218. [security] Cache lookup could return RRSIG data associated with
nonexistent records, leading to an assertion
failure. [RT #26590]
3217. [cleanup] Fix build problem with --disable-static. [RT #26476]
3216. [bug] resolver.c:validated() was not thread-safe. [RT #26478]
3215. [bug] 'rndc recursing' could cause a core dump. [RT #26495]
3214. [func] Add 'named -U' option to set the number of UDP
listener threads per interface. [RT #26485]
3213. [doc] Clarify ixfr-from-differences behavior. [RT #25188]
3212. [bug] rbtdb.c: failed to remove a node from the deadnodes
list prior to adding a reference to it leading a
possible assertion failure. [RT #23219]
3211. [func] dnssec-signzone: "-f -" prints to stdout; "-O full"
option prints in single-line-per-record format.
[RT #20287]
3210. [bug] Canceling the oldest query due to recursive-client
overload could trigger an assertion failure. [RT #26463]
3209. [func] Add "dnssec-lookaside 'no'". [RT #24858]
3208. [bug] 'dig -y' handle unknown tsig alorithm better.
[RT #25522]
3207. [contrib] Fixed build error in Berkeley DB DLZ module. [RT #26444]
3206. [cleanup] Add ISC information to log at start time. [RT #25484]
3205. [func] Upgrade dig's defaults to better reflect modern
nameserver behaviour. Enable "dig +adflag" and
"dig +edns=0" by default. Enable "+dnssec" when
running "dig +trace". [RT #23497]
3204. [bug] When a master server that has been marked as
unreachable sends a NOTIFY, mark it reachable
again. [RT #25960]
3203. [bug] Increase log level to 'info' for validation failures
from expired or not-yet-valid RRSIGs. [RT #21796]
3202. [bug] NOEDNS caching on timeout was too agressive.
[RT #26416]
3201. [func] 'rndc querylog' can now be given an on/off parameter
instead of only being used as a toggle. [RT #18351]
3200. [doc] Some rndc functions were undocumented or were
missing from 'rndc -h' output. [RT #25555]
3199. [func] When logging client information, include the name
being queried. [RT #25944]
3198. [doc] Clarified that dnssec-settime can alter keyfile
permissions. [RT #24866]
3197. [bug] Don't try to log the filename and line number when
the config parser can't open a file. [RT #22263]
3196. [bug] nsupdate: return nonzero exit code when target zone
doesn't exist. [RT #25783]
3195. [cleanup] Silence "file not found" warnings when loading
managed-keys zone. [RT #26340]
3194. [doc] Updated RFC references in the 'empty-zones-enable'
documentation. [RT #25203]
3193. [cleanup] Changed MAXZONEKEYS to DNS_MAXZONEKEYS, moved to
dnssec.h. [RT #26415]
3192. [bug] A query structure could be used after being freed.
[RT #22208]
3191. [bug] Print NULL records using "unknown" format. [RT #26392]
3190. [bug] Underflow in error handling in isc_mutexblock_init.
[RT #26397]
3189. [test] Added a summary report after system tests. [RT #25517]
3188. [bug] zone.c:zone_refreshkeys() could fail to detach
references correctly when errors occurred, causing
a hang on shutdown. [RT #26372]
3187. [port] win32: support for Visual Studio 2008. [RT #26356]
--- 9.9.0b1 released ---
3186. [bug] Version/db mis-match in rpz code. [RT #26180]
3185. [func] New 'rndc signing' option for auto-dnssec zones:
- 'rndc signing -list' displays the current
state of signing operations
- 'rndc signing -clear' clears the signing state
records for keys that have fully signed the zone
- 'rndc signing -nsec3param' sets the NSEC3
parameters for the zone
The 'rndc keydone' syntax is removed. [RT #23729]
3184. [bug] named had excessive cpu usage when a redirect zone was
configured. [RT #26013]
3183. [bug] Added RTLD_GLOBAL flag to dlopen call. [RT #26301]
3182. [bug] Auth servers behind firewalls which block packets
greater than 512 bytes may cause other servers to
perform poorly. Now, adb retains edns information
and caches noedns servers. [RT #23392/24964]
3181. [func] Inline-signing is now supported for master zones.
[RT #26224]
3180. [func] Local copies of slave zones are now saved in raw
format by default, to improve startup performance.
'masterfile-format text;' can be used to override
the default, if desired. [RT #25867]
3179. [port] kfreebsd: build issues. [RT #26273]
3178. [bug] A race condition introduced by change #3163 could
cause an assertion failure on shutdown. [RT #26271]
3177. [func] 'rndc keydone', remove the indicator record that
named has finished signing the zone with the
corresponding key. [RT #26206]
3176. [doc] Corrected example code and added a README to the
sample external DLZ module in contrib/dlz/example.
[RT #26215]
3175. [bug] Fix how DNSSEC positive wildcard responses from a
NSEC3 signed zone are validated. Stop sending a
unnecessary NSEC3 record when generating such
responses. [RT #26200]
3174. [bug] Always compute to revoked key tag from scratch.
[RT #26186]
3173. [port] Correctly validate root DS responses. [RT #25726]
3172. [port] darwin 10.* and freebsd [89] are now built threaded by
default.
3171. [bug] Exclusively lock the task when adding a zone using
'rndc addzone'. [RT #25600]
--- 9.9.0a3 released ---
3170. [func] RPZ update:
- fix precedence among competing rules
- improve ARM text including documenting rule precedence
- try to rewrite CNAME chains until first hit
- new "rpz" logging channel
- RDATA for CNAME rules can include wildcards
- replace "NO-OP" named.conf policy override with
"PASSTHRU" and add "DISABLED" override ("NO-OP"
is still recognized)
[RT #25172]
3169. [func] Catch db/version mis-matches when calling dns_db_*().
[RT #26017]
3168. [bug] Nxdomain redirection could trigger an assert with
a ANY query. [RT #26017]
3167. [bug] Negative answers from forwarders were not being
correctly tagged making them appear to not be cached.
[RT #25380]
3166. [bug] Upgrading a zone to support inline-signing failed.
[RT #26014]
3165. [bug] dnssec-signzone could generate new signatures when
resigning, even when valid signatures were already
present. [RT #26025]
3164. [func] Enable DLZ modules to retrieve client information,
so that responses can be changed depending on the
source address of the query. [RT #25768]
3163. [bug] Use finer-grained locking in client.c to address
concurrency problems with large numbers of threads.
[RT #26044]
3162. [test] start.pl: modified to allow for "named.args" in
ns*/ subdirectory to override stock arguments to
named. Largely from RT#26044, but no separate ticket.
3161. [bug] zone.c:del_sigs failed to always reset rdata leading
assertion failures. [RT #25880]
3160. [bug] When printing out a NSEC3 record in multiline form
the newline was not being printed causing type codes
to be run together. [RT #25873]
3159. [bug] On some platforms, named could assert on startup
when running in a chrooted environment without
/proc. [RT #25863]
3158. [bug] Recursive servers would prefer a particular UDP
socket instead of using all available sockets.
[RT #26038]
3157. [tuning] Reduce the time spent in "rndc reconfig" by parsing
the config file before pausing the server. [RT #21373]
3156. [placeholder]
--- 9.9.0a2 released ---
3155. [bug] Fixed a build failure when using contrib DLZ
drivers (e.g., mysql, postgresql, etc). [RT #25710]
3154. [bug] Attempting to print an empty rdataset could trigger
an assert. [RT #25452]
3153. [func] Extend request-ixfr to zone level and remove the
side effect of forcing an AXFR. [RT #25156]
3152. [cleanup] Some versions of gcc and clang failed due to
incorrect use of __builtin_expect. [RT #25183]
3151. [bug] Queries for type RRSIG or SIG could be handled
incorrectly. [RT #21050]
3150. [func] Improved startup and reconfiguration time by
enabling zones to load in multiple threads. [RT #25333]
3149. [placeholder]
3148. [bug] Processing of normal queries could be stalled when
forwarding a UPDATE message. [RT #24711]
3147. [func] Initial inline signing support. [RT #23657]
--- 9.9.0a1 released ---
3146. [test] Fixed gcc4.6.0 errors in ATF. [RT #25598]
3145. [test] Capture output of ATF unit tests in "./atf.out" if
there were any errors while running them. [RT #25527]
3144. [bug] dns_dbiterator_seek() could trigger an assert when
used with a nonexistent database node. [RT #25358]
3143. [bug] Silence clang compiler warnings. [RT #25174]
3142. [bug] NAPTR is class agnostic. [RT #25429]
3141. [bug] Silence spurious "zone serial (0) unchanged" messages
associated with empty zones. [RT #25079]
3140. [func] New command "rndc flushtree <name>" clears the
specified name from the server cache along with
all names under it. [RT #19970]
3139. [test] Added tests from RFC 6234, RFC 2202, and RFC 1321
for the hashing algorithms (md5, sha1 - sha512, and
their hmac counterparts). [RT #25067]
3138. [bug] Address memory leaks and out-of-order operations when
shutting named down. [RT #25210]
3137. [func] Improve hardware scalability by allowing multiple
worker threads to process incoming UDP packets.
This can significantly increase query throughput
on some systems. [RT #22992]
3136. [func] Add RFC 1918 reverse zones to the list of built-in
empty zones switched on by the 'empty-zones-enable'
option. [RT #24990]
3135. [port] FreeBSD: workaround broken IPV6_USE_MIN_MTU processing.
See http://www.freebsd.org/cgi/query-pr.cgi?pr=158307
[RT #24950]
3134. [bug] Improve the accuracy of dnssec-signzone's signing
statistics. [RT #16030]
3133. [bug] Change #3114 was incomplete. [RT #24577]
3132. [placeholder]
3131. [tuning] Improve scalability by allocating one zone task
per 100 zones at startup time, rather than using a
fixed-size task table. [RT #24406]
3130. [func] Support alternate methods for managing a dynamic
zone's serial number. Two methods are currently
defined using serial-update-method, "increment"
(default) and "unixtime". [RT #23849]
3129. [bug] Named could crash on 'rndc reconfig' when
allow-new-zones was set to yes and named ACLs
were used. [RT #22739]
3128. [func] Inserting an NSEC3PARAM via dynamic update in an
auto-dnssec zone that has not been signed yet
will cause it to be signed with the specified NSEC3
parameters when keys are activated. The
NSEC3PARAM record will not appear in the zone until
it is signed, but the parameters will be stored.
[RT #23684]
3127. [bug] 'rndc thaw' will now remove a zone's journal file
if the zone serial number has been changed and
ixfr-from-differences is not in use. [RT #24687]
3126. [security] Using DNAME record to generate replacements caused
RPZ to exit with a assertion failure. [RT #24766]
3125. [security] Using wildcard CNAME records as a replacement with
RPZ caused named to exit with a assertion failure.
[RT #24715]
3124. [bug] Use an rdataset attribute flag to indicate
negative-cache records rather than using rrtype 0;
this will prevent problems when that rrtype is
used in actual DNS packets. [RT #24777]
3123. [security] Change #2912 exposed a latent flaw in
dns_rdataset_totext() that could cause named to
crash with an assertion failure. [RT #24777]
3122. [cleanup] dnssec-settime: corrected usage message. [RT #24664]
3121. [security] An authoritative name server sending a negative
response containing a very large RRset could
trigger an off-by-one error in the ncache code
and crash named. [RT #24650]
3120. [bug] Named could fail to validate zones listed in a DLV
that validated insecure without using DLV and had
DS records in the parent zone. [RT #24631]
3119. [bug] When rolling to a new DNSSEC key, a private-type
record could be created and never marked complete.
[RT #23253]
3118. [bug] nsupdate could dump core on shutdown when using
SIG(0) keys. [RT #24604]
3117. [cleanup] Remove doc and parser references to the
never-implemented 'auto-dnssec create' option.
[RT #24533]
3116. [func] New 'dnssec-update-mode' option controls updates
of DNSSEC records in signed dynamic zones. Set to
'no-resign' to disable automatic RRSIG regeneration
while retaining the ability to sign new or changed
data. [RT #24533]
3115. [bug] Named could fail to return requested data when
following a CNAME that points into the same zone.
[RT #24455]
3114. [bug] Retain expired RRSIGs in dynamic zones if key is
inactive and there is no replacement key. [RT #23136]
3113. [doc] Document the relationship between serial-query-rate
and NOTIFY messages.
3112. [doc] Add missing descriptions of the update policy name
types "ms-self", "ms-subdomain", "krb5-self" and
"krb5-subdomain", which allow machines to update
their own records, to the BIND 9 ARM.
3111. [bug] Improved consistency checks for dnssec-enable and
dnssec-validation, added test cases to the
checkconf system test. [RT #24398]
3110. [bug] dnssec-signzone: Wrong error message could appear
when attempting to sign with no KSK. [RT #24369]
3109. [func] The also-notify option now uses the same syntax
as a zone's masters clause. This means it is
now possible to specify a TSIG key to use when
sending notifies to a given server, or to include
an explicit named masters list in an also-notfiy
statement. [RT #23508]
3108. [cleanup] dnssec-signzone: Clarified some error and
warning messages; removed #ifdef ALLOW_KSKLESS_ZONES
code (use -P instead). [RT #20852]
3107. [bug] dnssec-signzone: Report the correct number of ZSKs
when using -x. [RT #20852]
3106. [func] When logging client requests, include the name of
the TSIG key if any. [RT #23619]
3105. [bug] GOST support can be suppressed by "configure
--without-gost" [RT #24367]
3104. [bug] Better support for cross-compiling. [RT #24367]
3103. [bug] Configuring 'dnssec-validation auto' in a view
instead of in the options statement could trigger
an assertion failure in named-checkconf. [RT #24382]
3102. [func] New 'dnssec-loadkeys-interval' option configures
how often, in minutes, to check the key repository
for updates when using automatic key maintenance.
Default is every 60 minutes (formerly hard-coded
to 12 hours). [RT #23744]
3101. [bug] Zones using automatic key maintenance could fail
to check the key repository for updates. [RT #23744]
3100. [security] Certain response policy zone configurations could
trigger an INSIST when receiving a query of type
RRSIG. [RT #24280]
3099. [test] "dlz" system test now runs but gives R:SKIPPED if
not compiled with --with-dlz-filesystem. [RT #24146]
3098. [bug] DLZ zones were answering without setting the AA bit.
[RT #24146]
3097. [test] Add a tool to test handling of malformed packets.
[RT #24096]
3096. [bug] Set KRB5_KTNAME before calling log_cred() in
dst_gssapi_acceptctx(). [RT #24004]
3095. [bug] Handle isolated reserved ports in the port range.
[RT #23957]
3094. [doc] Expand dns64 documentation.
3093. [bug] Fix gssapi/kerberos dependencies [RT #23836]
3092. [bug] Signatures for records at the zone apex could go
stale due to an incorrect timer setting. [RT #23769]
3091. [bug] Fixed a bug in which zone keys that were published
and then subsequently activated could fail to trigger
automatic signing. [RT #22911]
3090. [func] Make --with-gssapi default [RT #23738]
3089. [func] dnssec-dsfromkey now supports reading keys from
standard input "dnssec-dsfromkey -f -". [RT# 20662]
3088. [bug] Remove bin/tests/system/logfileconfig/ns1/named.conf
and add setup.sh in order to resolve changing
named.conf issue. [RT #23687]
3087. [bug] DDNS updates using SIG(0) with update-policy match
type "external" could cause a crash. [RT #23735]
3086. [bug] Running dnssec-settime -f on an old-style key will
now force an update to the new key format even if no
other change has been specified, using "-P now -A now"
as default values. [RT #22474]
3085. [func] New '-R' option in dnssec-signzone forces removal
of signatures which have not yet expired but
were generated by a key that no longer exists.
[RT #22471]
3084. [func] A new command "rndc sync" dumps pending changes in
a dynamic zone to disk; "rndc sync -clean" also
removes the journal file after syncing. Also,
"rndc freeze" no longer removes journal files.
[RT #22473]
3083. [bug] NOTIFY messages were not being sent when generating
a NSEC3 chain incrementally. [RT #23702]
3082. [port] strtok_r is threads only. [RT #23747]
3081. [bug] Failure of DNAME substitution did not return
YXDOMAIN. [RT #23591]
3080. [cleanup] Replaced compile time constant by STDTIME_ON_32BITS.
[RT #23587]
3079. [bug] Handle isc_event_allocate failures in t_tasks.
[RT #23572]
3078. [func] Added a new include file with function typedefs
for the DLZ "dlopen" driver. [RT #23629]
3077. [bug] zone.c:zone_refreshkeys() incorrectly called
dns_zone_attach(), use zone->irefs instead. [RT #23303]
3076. [func] New '-L' option in dnssec-keygen, dnsset-settime, and
dnssec-keyfromlabel sets the default TTL of the
key. When possible, automatic signing will use that
TTL when the key is published. [RT #23304]
3075. [bug] dns_dnssec_findzonekeys{2} used a inconsistant
timestamp when determining which keys are active.
[RT #23642]
3074. [bug] Make the adb cache read through for zone data and
glue learn for zone named is authoritative for.
[RT #22842]
3073. [bug] managed-keys changes were not properly being recorded.
[RT #20256]
3072. [bug] dns_dns64_aaaaok() potential NULL pointer dereference.
[RT #20256]
3071. [bug] has_nsec could be used unintialised in
update.c:next_active. [RT #20256]
3070. [bug] dnssec-signzone potential NULL pointer dereference.
[RT #20256]
3069. [cleanup] Silence warnings messages from clang static analysis.
[RT #20256]
3068. [bug] Named failed to build with a OpenSSL without engine
support. [RT #23473]
3067. [bug] ixfr-from-differences {master|slave}; failed to
select the master/slave zones. [RT #23580]