forked from mnagy/bind-dynamic_db
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathCHANGES
11792 lines (8067 loc) · 386 KB
/
CHANGES
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
--- 9.9.5rc2 released ---
3710. [bug] Address double dns_zone_detach when switching to
using automatic empty zones from regular zones.
[RT #35177]
3709. [port] Use built-in versions of strptime() and timegm()
on all platforms to avoid portability issues.
[RT #35183]
3708. [bug] Address a portentry locking issue in dispatch.c.
[RT #35128]
3707. [bug] irs_resconf_load now returns ISC_R_FILENOTFOUND
on a missing resolv.conf file and initializes the
structure as if it had been configured with:
nameserver ::1
nameserver 127.0.0.1
Note: Callers will need to be updated to treat
ISC_R_FILENOTFOUND as a qualified success or else
they will leak memory. The following code fragment
will work with both old and new versions without
changing the behaviour of the existing code.
resconf = NULL;
result = irs_resconf_load(mctx, "/etc/resolv.conf",
&resconf);
if (result != ISC_SUCCESS) {
if (resconf != NULL)
irs_resconf_destroy(&resconf);
....
}
[RT #35194]
3706. [contrib] queryperf: Fixed a possible integer overflow when
printing results. [RT #35182]
3704. [protocol] Accept integer timestamps in RRSIG records. [RT #35185]
--- 9.9.5rc1 released ---
3701. [func] named-checkconf can now obscure shared secrets
when printing by specifying '-x'. [RT #34465]
3699. [bug] Improvements to statistics channel XSL stylesheet:
the stylesheet can now be cached by the browser;
section headers are omitted from the stats display
when there is no data in those sections to be
displayed; counters are now right-justified for
easier readability. (Only available with
configure --enable-newstats.) [RT #35117]
3698. [cleanup] Replaced all uses of memcpy() with memmove().
[RT #35120]
3697. [bug] Handle "." as a search list element when IDN support
is enabled. [RT #35133]
3696. [bug] dig failed to handle AXFR style IXFR responses which
span multiple messages. [RT #35137]
3695. [bug] Address a possible race in dispatch.c. [RT #35107]
3694. [bug] Warn when a key-directory is configured for a zone,
but does not exist or is not a directory. [RT #35108]
3693. [security] memcpy was incorrectly called with overlapping
ranges resulting in malformed names being generated
on some platforms. This could cause INSIST failures
when serving NSEC3 signed zones (CVE-2014-0591).
[RT #35120]
3692. [bug] Two calls to dns_db_getoriginnode were fatal if there
was no data at the node. [RT #35080]
3690. [bug] Iterative responses could be missed when the source
port for an upstream query was the same as the
listener port (53). [RT #34925]
3689. [bug] Fixed a bug causing an insecure delegation from one
static-stub zone to another to fail with a broken
trust chain. [RT #35081]
--- 9.9.5b1 released ---
3688. [bug] loadnode could return a freed node on out of memory.
[RT #35106]
3687. [bug] Address null pointer dereference in zone_xfrdone.
[RT #35042]
3686. [func] "dnssec-signzone -Q" drops signatures from keys
that are still published but no longer active.
[RT #34990]
3685. [bug] "rndc refresh" didn't work correctly with slave
zones using inline-signing. [RT #35105]
3683. [cleanup] Add a more detailed "not found" message to rndc
commands which specify a zone name. [RT #35059]
3682. [bug] Correct the behavior of rndc retransfer to allow
inline-signing slave zones to retain NSEC3 parameters
instead of reverting to NSEC. [RT #34745]
3681. [port] Update the Windows build system to support feature
selection and WIN64 builds. This is a work in
progress. [RT #34160]
3679. [bug] dig could fail to clean up TCP sockets still
waiting on connect(). [RT #35074]
3678. [port] Update config.guess and config.sub. [RT #35060]
3677. [bug] 'nsupdate' leaked memory if 'realm' was used multiple
times. [RT #35073]
3676. [bug] "named-checkconf -z" now checks zones of type
hint and redirect as well as master. [RT #35046]
3675. [misc] Provide a place for third parties to add version
information for their extensions in the version
file by setting the EXTENSIONS variable.
3674. [bug] RPZ zeroed ttls if the query type was '*'. [RT #35026]
3672. [func] Local address can now be specified when using
dns_client API. [RT #34811]
3671. [bug] Don't allow dnssec-importkey overwrite a existing
non-imported private key.
3670. [bug] Address read after free in server side of
lwres_getrrsetbyname. [RT #29075]
3669. [port] freebsd: --with-gssapi needs -lhx509. [RT #35001]
3668. [bug] Fix cast in lex.c which could see 0xff treated as eof.
[RT #34993]
3667. [test] dig: add support to keep the TCP socket open between
successive queries (+[no]keepopen). [RT #34918]
3665. [bug] Failure to release lock on error in receive_secure_db.
[RT #34944]
3664. [bug] Updated OpenSSL PKCS#11 patches to fix active list
locking and other bugs. [RT #34855]
3663. [bug] Address bugs in dns_rdata_fromstruct and
dns_rdata_tostruct for WKS and ISDN types. [RT #34910]
3662. [bug] 'host' could die if a UDP query timed out. [RT #34870]
3661. [bug] Address lock order reversal deadlock with inline zones.
[RT #34856]
3660. [cleanup] Changed the name of "isc-config.sh" to "bind9-config".
[RT #23825]
3659. [port] solaris: don't add explict dependancies/rules for
python programs as make won't use the implicit rules.
[RT #34835]
3658. [port] linux: Address platform specific compilation issue
when libcap-devel is installed. [RT #34838]
3657. [port] Some readline clones don't accept NULL pointers when
calling add_history. [RT #34842]
3656. [security] Treat an all zero netmask as invalid when generating
the localnets acl. (The prior behavior could
allow unexpected matches when using some versions
of Winsock: CVE-2013-6320.) [RT #34687]
3655. [cleanup] Simplify TCP message processing when requesting a
zone transfer. [RT #34825]
3654. [bug] Address race condition with manual notify requests.
[RT #34806]
3653. [func] Create delegations for all "children" of empty zones
except "forward first". [RT #34826]
3651. [tuning] Adjust when a master server is deemed unreachable.
[RT #27075]
3650. [tuning] Use separate rate limiting queues for refresh and
notify requests. [RT #30589]
3649. [cleanup] Include a comment in .nzf files, giving the name of
the associated view. [RT #34765]
3648. [test] Updated the ATF test framework to version 0.17.
[RT #25627]
3647. [bug] Address a race condition when shutting down a zone.
[RT #34750]
3646. [bug] Journal filename string could be set incorrectly,
causing garbage in log messages. [RT #34738]
3645. [protocol] Use case sensitive compression when responding to
queries. [RT #34737]
3644. [protocol] Check that EDNS subnet client options are well formed.
[RT #34718]
3642. [func] Allow externally generated DNSKEY to be imported
into the DNSKEY management framework. A new tool
dnssec-importkey is used to do this. [RT #34698]
3641. [bug] Handle changes to sig-validity-interval settings
better. [RT #34625]
3640. [bug] ndots was not being checked when searching. Only
continue searching on NXDOMAIN responses. Add the
ability to specify ndots to nslookup. [RT #34711]
3639. [bug] Treat type 65533 (KEYDATA) as opaque except when used
in a key zone. [RT #34238]
--- 9.9.4 released ---
3643. [doc] Clarify RRL "slip" documentation.
3638. [cleanup] Add the ability to handle ENOPROTOOPT in case it is
encountered. [RT #34668]
--- 9.9.4rc2 released ---
3637. [bug] 'allow-query-on' was checking the source address
rather than the destination address. [RT #34590]
3636. [bug] Automatic empty zones now behave better with
forward only "zones" beneath them. [RT #34583]
3635. [bug] Signatures were not being removed from a zone with
only KSK keys for a algorithm. [RT #34439]
3634. [func] Report build-id in rndc status. Report build-id
when building from a git repository. [RT #20422]
3633. [cleanup] Refactor OPT processing in named to make it easier
to support new EDNS options. [RT #34414]
3632. [bug] Signature from newly inactive keys were not being
removed. [RT #32178]
3631. [bug] Remove spurious warning about missing signatures when
qtype is SIG. [RT #34600]
3630. [bug] Ensure correct ID computation for MD5 keys. [RT #33033]
3627. [bug] RPZ changes were not effective on slaves. [RT #34450]
3625. [bug] Don't send notify messages to machines outside of the
test setup.
3623. [bug] zone-statistics was only effective in new statistics.
[RT #34466]
--- 9.9.4rc1 released ---
3621. [security] Incorrect bounds checking on private type 'keydata'
can lead to a remotely triggerable REQUIRE failure
(CVE-2013-4854). [RT #34238]
3617. [bug] Named was failing to answer queries during
"rndc reload" [RT #34098]
3616. [bug] Change #3613 was incomplete. [RT #34177]
3615. [cleanup] "configure" now finishes by printing a summary
of optional BIND features and whether they are
active or inactive. ("configure --enable-full-report"
increases the verbosity of the summary.) [RT #31777]
3614. [port] Check for <linux/types.h>. [RT #34162]
3613. [bug] named could crash when deleting inline-signing
zones with "rndc delzone". [RT #34066]
3611. [bug] Improved resistance to a theoretical authentication
attack based on differential timing. [RT #33939]
3610. [cleanup] win32: Some executables had been omitted from the
installer. [RT #34116]
3608. [port] win32: added todos.pl script to ensure all text files
the win32 build depends on are converted to DOS
newline format. [RT #22067]
3607. [bug] dnssec-keygen had broken 'Invalid keyfile' error
message. [RT #34045]
--- 9.9.4b1 released ---
3605. [port] win32: Addressed several compatibility issues
with newer versions of Visual Studio. [RT #33916]
3603. [bug] Install <isc/stat.h>. [RT #33956]
3601. [bug] Added to PKCS#11 openssl patches a value len
attribute in DH derive key. [RT #33928]
3600. [cleanup] dig: Fixed a typo in the warning output when receiving
an oversized response. [RT #33910]
3599. [tuning] Check for pointer equivalence in name comparisons.
[RT #18125]
3596. [port] Updated win32 build documentation, added
dnssec-verify. [RT #22067]
3594. [maint] Update config.guess and config.sub. [RT #33816]
3592. [doc] Moved documentation of rndc command options to the
rndc man page. [RT #33506]
3590. [bug] When using RRL on recursive servers, defer
rate-limiting until after recursion is complete;
also, use correct rcode for slipped NXDOMAIN
responses. [RT #33604]
3588. [bug] dig: addressed a memory leak in the sigchase code
that could cause a shutdown crash. [RT #33733]
3587. [func] 'named -g' now checks the logging configuration but
does not use it. [RT #33473]
3586. [bug] Handle errors in xmlDocDumpFormatMemoryEnc. [RT #33706]
3584. [security] Caching data from an incompletely signed zone could
trigger an assertion failure in resolver.c
(CVE-2013-3919). [RT #33690]
3583. [bug] Address memory leak in GSS-API processing [RT #33574]
3582. [bug] Silence false positive warning regarding missing file
directive for inline slave zones. [RT #33662]
3581. [bug] Changed the tcp-listen-queue default to 10. [RT #33029]
3580. [bug] Addressed a possible race in acache.c [RT #33602]
3579. [maint] Updates to PKCS#11 openssl patches, supporting
versions 0.9.8y, 1.0.0k, 1.0.1e [RT #33463]
3578. [bug] 'rndc -c file' now fails if 'file' does not exist.
[RT #33571]
3577. [bug] Handle zero TTL values better. [RT #33411]
3576. [bug] Address a shutdown race when validating. [RT #33573]
3575. [func] Changed the logging category for RRL events from
'queries' to 'query-errors'. [RT #33540]
3574. [doc] The 'hostname' keyword was missing from server-id
description in the named.conf man page. [RT #33476]
3573. [bug] "rndc addzone" and "rndc delzone" incorrectly handled
zone names containing punctuation marks and other
nonstandard characters. [RT #33419]
3571. [bug] Address race condition in dns_client_startresolve().
[RT #33234]
3566. [func] Log when forwarding updates to master. [RT #33240]
3554. [bug] RRL failed to correctly rate-limit upward
referrals and failed to count dropped error
responses in the statistics. [RT #33225]
3545. [bug] RRL slip behavior was incorrect when set to 1.
[RT #33111]
3518. [bug] Increase the size of dns_rrl_key.s.rtype by one bit
so that all dns_rrl_rtype_t enum values fit regardless
of whether it is teated as signed or unsigned by
the compiler. [RT #32792]
3494. [func] DNS RRL: Blunt the impact of DNS reflection and
amplification attacks by rate-limiting substantially-
identical responses. To enable, use "configure
--enable-rrl". [RT #28130]
--- 9.9.3 released ---
3568. [cleanup] Add a product description line to the version file,
to be reported by named -v/-V. [RT #33366]
3567. [bug] Silence clang static analyzer warnings. [RT #33365]
3563. [contrib] zone2sqlite failed with some table names. [RT #33375]
3561. [bug] dig: issue a warning if an EDNS query returns FORMERR
or NOTIMP. Adjust usage message. [RT #33363]
--- 9.9.3rc2 released ---
3560. [bug] isc-config.sh did not honor includedir and libdir
when set via configure. [RT #33345]
3559. [func] Check that both forms of Sender Policy Framework
records exist or do not exist. [RT #33355]
3558. [bug] IXFR of a DLZ stored zone was broken. [RT #33331]
3557. [bug] Reloading redirect zones was broken. [RT #33292]
3556. [maint] Added AAAA for D.ROOT-SERVERS.NET.
3555. [bug] Address theoretical race conditions in acache.c
(change #3553 was incomplete). [RT #33252]
3553. [bug] Address suspected double free in acache. [RT #33252]
3552. [bug] Wrong getopt option string for 'nsupdate -r'.
[RT #33280]
3549. [doc] Documentation for "request-nsid" was missing.
[RT #33153]
3548. [bug] The NSID request code in resolver.c was broken
resulting in invalid EDNS options being sent.
[RT #33153]
3547. [bug] Some malformed unknown rdata records were not properly
detected and rejected. [RT #33129]
--- 9.9.3rc1 released ---
3546. [func] Add EUI48 and EUI64 types. [RT #33082]
3544. [contrib] check5011.pl: Script to report the status of
managed keys as recorded in managed-keys.bind.
Contributed by Tony Finch <[email protected]>
3543. [bug] Update socket structure before attaching to socket
manager after accept. [RT #33084]
3541. [bug] Parts of libdns were not properly initialized when
built in libexport mode. [RT #33028]
3540. [test] libt_api: t_info and t_assert were not thread safe.
3539. [port] win32: timestamp format didn't match other platforms.
3538. [test] Running "make test" now requires loopback interfaces
to be set up. [RT #32452]
3537. [tuning] Slave zones, when updated, now send NOTIFY messages
to peers before being dumped to disk rather than
after. [RT #27242]
3535. [bug] Minor win32 cleanups. [RT #32962]
3534. [bug] Extra text after an embedded NULL was ignored when
parsing zone files. [RT #32699]
3533. [contrib] query-loc-0.4.0: memory leaks. [RT #32960]
3532. [contrib] zkt: fixed buffer overrun, resource leaks. [RT #32960]
3531. [bug] win32: A uninitialized value could be returned on out
of memory. [RT #32960]
3530. [contrib] Better RTT tracking in queryperf. [RT #30128]
3528. [func] New "dnssec-coverage" command scans the timing
metadata for a set of DNSSEC keys and reports if a
lapse in signing coverage has been scheduled
inadvertently. (Note: This tool depends on python;
it will not be built or installed on systems that
do not have a python interpreter.) [RT #28098]
3527. [compat] Add a URI to allow applications to explicitly
request a particular XML schema from the statistics
channel, returning 404 if not supported. [RT #32481]
3526. [cleanup] Set up dependencies for unit tests correctly during
build. [RT #32803]
3521. [bug] Address memory leak in opensslecdsa_link.c. [RT #32249]
3520. [bug] 'mctx' was not being referenced counted in some places
where it should have been. [RT #32794]
--- 9.9.3b2 released ---
3517. [bug] Reorder destruction to avoid shutdown race. [RT #32777]
3515. [port] '%T' is not portable in strftime(). [RT #32763]
3514. [bug] The ranges for valid key sizes in ddns-confgen and
rndc-confgen were too constrained. Keys up to 512
bits are now allowed for most algorithms, and up
to 1024 bits for hmac-sha384 and hmac-sha512.
[RT #32753]
3511. [doc] Improve documentation of redirect zones. [RT #32756]
3509. [cleanup] Added a product line to version file to allow for
easy naming of different products (BIND
vs BIND ESV, for example). [RT #32755]
3508. [contrib] queryperf was incorrectly rejecting the -T option.
[RT #32338]
3507. [bug] Statistics channel XSL (when built with
--enable-newstats) had a glitch when attempting
to chart query data before any queries had been
received. [RT #32620]
3505. [bug] When setting "max-cache-size" and "max-acache-size",
larger values than 4 gigabytes could not be set
explicitly, though larger sizes were available
when setting cache size to 0. This has been
corrected; the full range is now available.
[RT #32358]
3503. [doc] Clarify size_spec syntax. [RT #32449]
3501. [func] zone-statistics now takes three options: full,
terse, and none. "yes" and "no" are retained as
synonyms for full and terse, respectively. [RT #29165]
3500. [security] Support NAPTR regular expression validation on
all platforms without using libregex, which
can be vulnerable to memory exhaustion attack
(CVE-2013-2266). [RT #32688]
3499. [doc] Corrected ARM documentation of built-in zones.
[RT #32694]
3498. [bug] zone statistics for zones which matched a potential
empty zone could have their zone-statistics setting
overridden.
3496. [func] Improvements to RPZ performance. The "response-policy"
syntax now includes a "min-ns-dots" clause, with
default 1, to exclude top-level domains from
NSIP and NSDNAME checking. --enable-rpz-nsip and
--enable-rpz-nsdname are now the default. [RT #32251]
3493. [contrib] Added BDBHPT dynamically-lodable DLZ module,
contributed by Mark Goldfinch. [RT #32549]
3492. [bug] Fixed a regression in zone loading performance
due to lock contention. [RT #30399]
3491. [bug] Slave zones using inline-signing must specify a
file name. [RT #31946]
3489. [bug] --enable-developer now turns on ISC_LIST_CHECKINIT.
When cloning a rdataset do not copy the link contents.
[RT #32651]
3488. [bug] Use after free error with DH generated keys. [RT #32649]
3487. [bug] Change 3444 was not complete. There was a additional
place where the NOQNAME proof needed to be saved.
[RT #32629]
3486. [bug] named could crash when using TKEY-negotiated keys
that had been deleted and then recreated. [RT #32506]
3485. [cleanup] Only compile openssl_gostlink.c if we support GOST.
3483. [bug] Corrected XSL code in use with --enable-newstats.
[RT #32587]
3481. [cleanup] Removed use of const const in atf.
3480. [bug] Silence logging noise when setting up zone
statistics. [RT #32525]
3479. [bug] Address potential memory leaks in gssapi support
code. [RT #32405]
3478. [port] Fix a build failure in strict C99 environments
[RT #32475]
3474. [bug] nsupdate could assert when the local and remote
address families didn't match. [RT #22897]
3473. [bug] dnssec-signzone/verify could incorrectly report
an error condition due to an empty node above an
opt-out delegation lacking an NSEC3. [RT #32072]
3471. [bug] The number of UDP dispatches now defaults to
the number of CPUs even if -n has been set to
a higher value. [RT #30964]
3470. [bug] Slave zones could fail to dump when successfully
refreshing after an initial failure. [RT #31276]
--- 9.9.3b1 released ---
3468. [security] RPZ rules to generate A records (but not AAAA records)
could trigger an assertion failure when used in
conjunction with DNS64 (CVE-2012-5689). [RT #32141]
3467. [bug] Added checks in dnssec-keygen and dnssec-settime
to check for delete date < inactive date. [RT #31719]
3466. [contrib] Corrected the DNS_CLIENTINFOMETHODS_VERSION check
in DLZ example driver. [RT #32275]
3465. [bug] Handle isolated reserved ports. [RT #31778]
3464. [maint] Updates to PKCS#11 openssl patches, supporting
versions 0.9.8x, 1.0.0j, 1.0.1c [RT #29749]
3463. [doc] Clarify managed-keys syntax in ARM. [RT #32232]
3462. [doc] Clarify server selection behavior of dig when using
-4 or -6 options. [RT #32181]
3461. [bug] Negative responses could incorrectly have AD=1
set. [RT #32237]
3460. [bug] Only link against readline where needed. [RT #29810]
3458. [bug] Return FORMERR when presented with a overly long
domain named in a request. [RT #29682]
3457. [protocol] Add ILNP records (NID, LP, L32, L64). [RT #31836]
3456. [port] g++47: ATF failed to compile. [RT #32012]
3455. [contrib] queryperf: fix getopt option list. [RT #32338]
3454. [port] sparc64: improve atomic support. [RT #25182]
3453. [bug] 'rndc addzone' of a zone with 'inline-signing yes;'
failed. [RT #31960]
3452. [bug] Accept duplicate singleton records. [RT #32329]
3451. [port] Increase per thread stack size from 64K to 1M.
[RT #32230]
3450. [bug] Stop logfileconfig system test spam system logs.
[RT #32315]
3449. [bug] gen.c: use the pre-processor to construct format
strings so that compiler can perform sanity checks;
check the snprintf results. [RT #17576]
3448. [bug] The allow-query-on ACL was not processed correctly.
[RT #29486]
3447. [port] Add support for libxml2-2.9.x [RT #32231]
3446. [port] win32: Add source ID (see change #3400) to build.
[RT #31683]
3445. [bug] Warn about zone files with blank owner names
immediately after $ORIGIN directives. [RT #31848]
3444. [bug] The NOQNAME proof was not being returned from cached
insecure responses. [RT #21409]
3443. [bug] ddns-confgen: Some TSIG algorithms were incorrectly
rejected when generating keys. [RT #31927]
3442. [port] Net::DNS 0.69 introduced a non backwards compatible
change. [RT #32216]
3441. [maint] D.ROOT-SERVERS.NET is now 199.7.91.13.
3440. [bug] Reorder get_key_struct to not trigger a assertion when
cleaning up due to out of memory error. [RT #32131]
3439. [bug] contrib/dlz error checking fixes. [RT #32102]
3438. [bug] Don't accept unknown data escape in quotes. [RT #32031]
3437. [bug] isc_buffer_init -> isc_buffer_constinit to initialize
buffers with constant data. [RT #32064]
3436. [bug] Check malloc/calloc return values. [RT #32088]
3435. [bug] Cross compilation support in configure was broken.
[RT #32078]
3431. [bug] ddns-confgen: Some valid key algorithms were
not accepted. [RT #31927]
3430. [bug] win32: isc_time_formatISO8601 was missing the
'T' between the date and time. [RT #32044]
3429. [bug] dns_zone_getserial2 could a return success without
returning a valid serial. [RT #32007]
3428. [cleanup] dig: Add timezone to date output. [RT #2269]
3427. [bug] dig +trace incorrectly displayed name server
addresses instead of names. [RT #31641]
3426. [bug] dnssec-checkds: Clearer output when records are not
found. [RT #31968]
3425. [bug] "acacheentry" reference counting was broken resulting
in use after free. [RT #31908]
3424. [func] dnssec-dsfromkey now emits the hash without spaces.
[RT #31951]
3423. [bug] "rndc signing -nsec3param" didn't accept the full
range of possible values. Address portability issues.
[RT #31938]
3422. [bug] Added a clear error message for when the SOA does not
match the referral. [RT #31281]
3421. [bug] Named loops when re-signing if all keys are offline.
[RT #31916]
3420. [bug] Address VPATH compilation issues. [RT #31879]
3419. [bug] Memory leak on validation cancel. [RT #31869]
3417. [func] Optional new XML schema (version 3.0) for the
statistics channel adds query type statistics at the
zone level, and flattens the XML tree and uses
compressed format to optimize parsing. Includes new XSL
that permits charting via the Google Charts API on
browsers that support javascript in XSL. To enable,
build with "configure --enable-newstats". [RT #30023]
3416. [bug] Named could die on shutdown if running with 128 UDP
dispatches per interface. [RT #31743]
3415. [bug] named could die with a REQUIRE failure if a validation
was canceled. [RT #31804]
3414. [bug] Address locking issues found by Coverity. [RT #31626]
3412. [bug] Copy timeval structure from control message data.
[RT #31548]
3411. [tuning] Use IPV6_USE_MIN_MTU or equivalent with TCP in addition
to UDP. [RT #31690]
3410. [bug] Addressed Coverity warnings. [RT #31626]
3409. [contrib] contrib/dane/mkdane.sh: Tool to generate TLSA RR's
from X.509 certificates, for use with DANE
(DNS-based Authentication of Named Entities).
[RT #30513]
3408. [bug] Some DNSSEC-related options (update-check-ksk,
dnssec-loadkeys-interval, dnssec-dnskey-kskonly)
are now legal in slave zones as long as
inline-signing is in use. [RT #31078]
3406. [bug] mem.c: Fix compilation errors when building with
ISC_MEM_TRACKLINES or ISC_MEMPOOL_NAMES disabled.
Also, ISC_MEM_DEBUG is no longer optional. [RT #31559]
3405. [bug] Handle time going backwards in acache. [RT #31253]
3404. [bug] dnssec-signzone: When re-signing a zone, remove
RRSIG and NSEC records from nodes that used to be
in-zone but are now below a zone cut. [RT #31556]
3403. [bug] Silence noisy OpenSSL logging. [RT #31497]
3402. [test] The IPv6 interface numbers used for system
tests were incorrect on some platforms. [RT #25085]
3401. [bug] Addressed Coverity warnings. [RT #31484]
3400. [cleanup] "named -V" can now report a source ID string, defined
in the "srcid" file in the build tree and normally set
to the most recent git hash. [RT #31494]
3399. [port] netbsd: rename 'bool' parameter to avoid namespace
clash. [RT #31515]
3398. [bug] SOA parameters were not being updated with inline
signed zones if the zone was modified while the
server was offline. [RT #29272]
3397. [bug] dig crashed when using +nssearch with +tcp. [RT #25298]
3396. [bug] OPT records were incorrectly removed from signed,
truncated responses. [RT #31439]
3395. [protocol] Add RFC 6598 reverse zones to built in empty zones
list, 64.100.IN-ADDR.ARPA ... 127.100.IN-ADDR.ARPA.
[RT #31336]
3394. [bug] Adjust 'successfully validated after lower casing
signer' log level and category. [RT #31414]
3393. [bug] 'host -C' could core dump if REFUSED was received.
[RT #31381]
3391. [bug] A DNSKEY lookup that encountered a CNAME failed.
[RT #31262]
3390. [bug] Silence clang compiler warnings. [RT #30417]
3389. [bug] Always return NOERROR (not 0) in TSIG. [RT #31275]
3388. [bug] Fixed several Coverity warnings.
Note: This change includes a fix for a bug that
was subsequently determined to be an exploitable
security vulnerability, CVE-2012-5688: named could
die on specific queries with dns64 enabled.
[RT #30996]
3386. [bug] Address locking violation when generating new NSEC /
NSEC3 chains. [RT #31224]
3385. [bug] named-checkconf didn't detect missing master lists
in also-notify clauses. [RT #30810]
3384. [bug] Improved logging of crypto errors. [RT #30963]
3382. [bug] SOA query from slave used use-v6-udp-ports range,
if set, regardless of the address family in use.
[RT #24173]
3381. [contrib] Update queryperf to support more RR types.
[RT #30762]
3380. [bug] named could die if a nonexistent master list was
referenced in a also-notify. [RT #31004]
3379. [bug] isc_interval_zero and isc_time_epoch should be
"const (type)* const". [RT #31069]
3378. [bug] Handle missing 'managed-keys-directory' better.
[RT #30625]
3377. [bug] Removed spurious newline from NSEC3 multiline
output. [RT #31044]
3376. [bug] Lack of EDNS support was being recorded without a
successful response. [RT #30811]
3375. [func] Check that 'rndc dumpdb' works on a empty cache.
[RT #30808]
3374. [bug] isc_parse_uint32 failed to return a range error on
systems with 64 bit longs. [RT #30232]
3372. [bug] Silence spurious "deleted from unreachable cache"
messages. [RT #30501]
3371. [bug] AD=1 should behave like DO=1 when deciding whether to
add NS RRsets to the additional section or not.
[RT #30479]
3316. [tuning] Improved locking performance when recursing.
[RT #28836]
3315. [tuning] Use multiple dispatch objects for sending upstream
queries; this can improve performance on busy
multiprocessor systems by reducing lock contention.
[RT #28605]
--- 9.9.2 released ---
3383. [security] A certain combination of records in the RBT could
cause named to hang while populating the additional
section of a response. [RT #31090]
3373. [bug] win32: open raw files in binary mode. [RT #30944]
3364. [security] Named could die on specially crafted record.
[RT #30416]
--- 9.9.2rc1 released ---
3370. [bug] Address use after free while shutting down. [RT #30241]
3369. [bug] nsupdate terminated unexpectedly in interactive mode
if built with readline support. [RT #29550]
3368. [bug] <dns/iptable.h>, <dns/private.h> and <dns/zone.h>
were not C++ safe.
3367. [bug] dns_dnsseckey_create() result was not being checked.
[RT #30685]
3366. [bug] Fixed Read-After-Write dependency violation for IA64
atomic operations. [RT #25181]
3365. [bug] Removed spurious newlines from log messages in
zone.c [RT #30675]
3363. [bug] Need to allow "forward" and "fowarders" options
in static-stub zones; this had been overlooked.
[RT #30482]
3362. [bug] Setting some option values to 0 in named.conf
could trigger an assertion failure on startup.
[RT #27730]
3361. [bug] "rndc signing -nsec3param" didn't work correctly
when salt was set to '-' (no salt). [RT #30099]
3360. [bug] 'host -w' could die. [RT #18723]
3359. [bug] An improperly-formed TSIG secret could cause a
memory leak. [RT #30607]
3357. [port] Add support for libxml2-2.8.x [RT #30440]
3356. [bug] Cap the TTL of signed RRsets when RRSIGs are
approaching their expiry, so they don't remain
in caches after expiry. [RT #26429]
3355. [port] Use more portable awk in verify system test.
3354. [func] Improve OpenSSL error logging. [RT #29932]
--- 9.9.2b1 released ---
3353. [bug] Use a single task for task exclusive operations.
[RT #29872]
3352. [bug] Ensure that learned server attributes timeout of the
adb cache. [RT #29856]
3351. [bug] isc_mem_put and isc_mem_putanddetach didn't report
caller if either ISC_MEM_DEBUGSIZE or ISC_MEM_DEBUGCTX
memory debugging flags are set. [RT #30243]
3350. [bug] Memory read overrun in isc___mem_reallocate if
ISC_MEM_DEBUGCTX memory debugging flag is set.
[RT #30240]
3349. [bug] Change #3345 was incomplete. [RT #30233]
3348. [bug] Prevent RRSIG data from being cached if a negative
record matching the covering type exists at a higher
trust level. Such data already can't be retrieved from
the cache since change 3218 -- this prevents it
being inserted into the cache as well. [RT #26809]
3347. [bug] dnssec-settime: Issue a warning when writing a new
private key file would cause a change in the
permissions of the existing file. [RT #27724]
3346. [security] Bad-cache data could be used before it was
initialized, causing an assert. [RT #30025]
3345. [bug] Addressed race condition when removing the last item
or inserting the first item in an ISC_QUEUE.
[RT #29539]
3344. [func] New "dnssec-checkds" command checks a zone to
determine which DS records should be published
in the parent zone, or which DLV records should be
published in a DLV zone, and queries the DNS to
ensure that it exists. (Note: This tool depends
on python; it will not be built or installed on
systems that do not have a python interpreter.)
[RT #28099]
3342. [bug] Change #3314 broke saving of stub zones to disk
resulting in excessive cpu usage in some cases.
[RT #29952]
3341. [func] New "dnssec-verify" command checks a signed zone
to ensure correctness of signatures and of NSEC/NSEC3
chains. [RT #23673]
3339. [func] Allow the maximum supported rsa exponent size to be
specified: "max-rsa-exponent-size <value>;" [RT #29228]
3338. [bug] Address race condition in units tests: asyncload_zone
and asyncload_zt. [RT #26100]
3337. [bug] Change #3294 broke support for the multiple keys
in controls. [RT #29694]
3335. [func] nslookup: return a nonzero exit code when unable
to get an answer. [RT #29492]
3334. [bug] Hold a zone table reference while performing a
asynchronous load of a zone. [RT #28326]
3333. [bug] Setting resolver-query-timeout too low can cause
named to not recover if it loses connectivity.
[RT #29623]
3332. [bug] Re-use cached DS rrsets if possible. [RT #29446]