/contrib/bind9/CHANGES

https://bitbucket.org/freebsd/freebsd-head/ · #! · 10494 lines · 7168 code · 3326 blank · 0 comment · 0 complexity · 0d8a88fa8200f197e8df62d75b4cddbc MD5 · raw file

Large files are truncated click here to view the full file

    

  1. --- 9.8.3-P4 released ---
    2. 

  2. 

  3. 3383.	[security]	A certain combination of records in the RBT could
    4. 

  4.                         cause named to hang while populating the additional
    5. 

  5.                         section of a response. [RT #31090]
    6. 

  6. 

  7. 	--- 9.8.3-P3 released ---
    8. 

  8. 

  9. 3364.	[security]	Named could die on specially crafted record.
    10. 

  10. 			[RT #30416]
    11. 

  11. 

  12. 	--- 9.8.3-P2 released ---
    13. 

  13. 

  14. 3346.	[security]	Bad-cache data could be used before it was
    15. 

  15. 			initialized, causing an assert. [RT #30025]
    16. 

  16. 

  17. 3342.	[bug]		Change #3314 broke saving of stub zones to disk
    18. 

  18. 			resulting in excessive cpu usage in some cases.
    19. 

  19. 			[RT #29952]
    20. 

  20. 

  21. 	--- 9.8.3-P1 released ---
    22. 

  22. 

  23. 3331.	[security]	dns_rdataslab_fromrdataset could produce bad
    24. 

  24. 			rdataslabs. [RT #29644]
    25. 

  25. 			
    26. 

  26. 	--- 9.8.3 released ---
    27. 

  27. 

  28. 3318.	[tuning]	Reduce the amount of work performed while holding a
    29. 

  29. 			bucket lock when finshed with a fetch context.
    30. 

  30. 			[RT #29239]
    31. 

  31. 

  32. 3314.	[bug]		The masters list could be updated while refesh_callback
    33. 

  33. 			and stub_callback were using it. [RT #26732]
    34. 

  34. 

  35. 3313.	[protocol]	Add TLSA record type. [RT #28989]
    36. 

  36. 

  37. 3312.	[bug]		named-checkconf didn't detect a bad dns64 clients acl.
    38. 

  38. 			[RT #27631]
    39. 

  39. 

  40. 3311.	[bug]		Abort the zone dump if zone->db is NULL in
    41. 

  41. 			zone.c:zone_gotwritehandle. [RT #29028]
    42. 

  42. 

  43. 3310.	[test]		Increase table size for mutex profiling. [RT #28809]
    44. 

  44. 

  45. 3309.	[bug]		resolver.c:fctx_finddone() was not threadsafe.
    46. 

  46. 			[RT #27995]
    47. 

  47. 

  48. 3307.	[bug]		Add missing ISC_LANG_BEGINDECLS and ISC_LANG_ENDDECLS.
    49. 

  49. 			[RT #28956]
    50. 

  50. 

  51. 3306.	[bug]		Improve DNS64 reverse zone performance. [RT #28563]
    52. 

  52. 

  53. 3305.	[func]		Add wire format lookup method to sdb. [RT #28563]
    54. 

  54. 

  55. 3304.	[bug]		Use hmctx, not mctx when freeing rbtdb->heaps.
    56. 

  56. 			[RT #28571]
    57. 

  57. 

  58. 3302.	[bug]		dns_dnssec_findmatchingkeys could fail to find
    59. 

  59. 			keys if the zone name contained character that
    60. 

  60. 			required special mappings. [RT #28600]
    61. 

  61. 

  62. 3301.	[contrib]	Update queryperf to build on darwin.  Add -R flag
    63. 

  63. 			for non-recursive queries. [RT #28565]
    64. 

  64. 

  65. 3300.	[bug]		Named could die if gssapi was enabled in named.conf
    66. 

  66. 			but was not compiled in. [RT #28338]
    67. 

  67. 

  68. 3299.	[bug]		Make SDB handle errors from database drivers better.
    69. 

  69. 			[RT #28534]
    70. 

  70. 

  71. 3232.	[bug]		Zero zone->curmaster before return in
    72. 

  72. 			dns_zone_setmasterswithkeys(). [RT #26732]
    73. 

  73. 

  74. 3183.	[bug]		Added RTLD_GLOBAL flag to dlopen call. [RT #26301]
    75. 

  75. 

  76. 3197.	[bug]		Don't try to log the filename and line number when
    77. 

  77. 			the config parser can't open a file. [RT #22263]
    78. 

    79. 

  79. 	--- 9.8.2 released ---
    80. 

  80. 

  81. 3298.	[bug]		Named could dereference a NULL pointer in
    82. 

  82. 			zmgr_start_xfrin_ifquota if the zone was being removed.
    83. 

  83. 			[RT #28419]
    84. 

  84. 

  85. 3297.	[bug]		Named could die on a malformed master file. [RT #28467]
    86. 

  86. 

  87. 3295.	[bug]		Adjust isc_time_secondsastimet range check to be more
    88. 

  88. 			portable. [RT # 26542]
    89. 

  89. 

  90. 3294.	[bug]		isccc/cc.c:table_fromwire failed to free alist on
    91. 

  91. 			error. [RT #28265]
    92. 

  92. 

  93. 3291.	[port]		Fixed a build error on systems without ENOTSUP.
    94. 

  94. 			[RT #28200]
    95. 

  95. 

  96. 3290.	[bug]		<isc/hmacsha.h> was not being installed. [RT #28169]
    97. 

  97. 

  98. 3288.	[bug]		dlz_destroy() function wasn't correctly registered
    99. 

  99. 			by the DLZ dlopen driver. [RT #28056]
    100. 

  100. 

  101. 3287.	[port]		Update ans.pl to work with Net::DNS 0.68. [RT #28028]
    102. 

  102. 

  103. 3286.	[bug]		Managed key maintenance timer could fail to start
    104. 

  104. 			after 'rndc reconfig'. [RT #26786]
    105. 

  105. 

  106. 	--- 9.8.2rc2 released ---
    107. 

  107. 

  108. 3285.	[bug]		val-frdataset was incorrectly disassociated in
    109. 

  109. 			proveunsecure after calling startfinddlvsep.
    110. 

  110. 			[RT #27928]
    111. 

  111. 

  112. 3284.	[bug]		Address race conditions with the handling of
    113. 

  113. 			rbtnode.deadlink. [RT #27738]
    114. 

  114. 

  115. 3283.	[bug]		Raw zones with with more than 512 records in a RRset
    116. 

  116. 			failed to load. [RT #27863]
    117. 

  117. 

  118. 3282.	[bug]		Restrict the TTL of NS RRset to no more than that
    119. 

  119. 			of the old NS RRset when replacing it.
    120. 

  120. 			[RT #27792] [RT #27884]
    121. 

  121. 

  122. 3281.	[bug]		SOA refresh queries could be treated as cancelled
    123. 

  123. 			despite succeeding over the loopback interface.
    124. 

  124. 			[RT #27782]
    125. 

  125. 

  126. 3280.	[bug]		Potential double free of a rdataset on out of memory
    127. 

  127. 			with DNS64. [RT #27762]
    128. 

  128. 

  129. 3278.	[bug]		Make sure automatic key maintenance is started
    130. 

  130. 			when "auto-dnssec maintain" is turned on during
    131. 

  131. 			"rndc reconfig". [RT #26805]
    132. 

  132. 

  133. 3276.	[bug]		win32: ns_os_openfile failed to return NULL on
    134. 

  134. 			safe_open failure. [RT #27696]
    135. 

  135. 

  136. 3274.	[bug]		Log when a zone is not reusable.  Only set loadtime
    137. 

  137. 			on successful loads.  [RT #27650]
    138. 

  138. 

  139. 3273.	[bug]		AAAA responses could be returned in the additional
    140. 

  140. 			section even when filter-aaaa-on-v4 was in use.
    141. 

  141. 			[RT #27292]
    142. 

  142. 

  143. 3271.	[port]		darwin: mksymtbl is not always stable, loop several
    144. 

  144. 			times before giving up.  mksymtbl was using non
    145. 

  145. 			portable perl to covert 64 bit hex strings. [RT #27653]
    146. 

  146. 

  147. 3268.	[bug]		Convert RRSIG expiry times to 64 timestamps to work
    148. 

  148. 			out the earliest expiry time. [RT #23311]
    149. 

  149. 

  150. 3267.	[bug]		Memory allocation failures could be mis-reported as
    151. 

  151. 			unexpected error.  New ISC_R_UNSET result code.
    152. 

  152. 			[RT #27336]
    153. 

  153. 

  154. 3266.	[bug]		The maximum number of NSEC3 iterations for a
    155. 

  155. 			DNSKEY RRset was not being properly computed.
    156. 

  156. 			[RT #26543]
    157. 

  157. 

  158. 3262.	[bug]		Signed responses were handled incorrectly by RPZ.
    159. 

  159. 			[RT #27316]
    160. 

  160. 

  161. 	--- 9.8.2rc1 released ---
    162. 

  162. 

  163. 3260.	[bug]		"rrset-order cyclic" could appear not to rotate
    164. 

  164. 			for some query patterns.  [RT #27170/27185]
    165. 

  165. 

  166. 3259.	[bug]		named-compilezone: Suppress "dump zone to <file>"
    167. 

  167. 			message when writing to stdout. [RT #27109]
    168. 

  168. 

  169. 3258.	[test]		Add "forcing full sign with unreadable keys" test.
    170. 

  170. 			[RT #27153]
    171. 

  171. 

  172. 3257.	[bug]		Do not generate a error message when calling fsync()
    173. 

  173. 			in a pipe or socket. [RT #27109]
    174. 

  174. 

  175. 3256.	[bug]		Disable empty zones for lwresd -C. [RT #27139]
    176. 

  176. 

  177. 3254.	[bug]		Set isc_socket_ipv6only() on the IPv6 control channels.
    178. 

  178. 			[RT #22249]
    179. 

  179. 

  180. 3253.	[bug]		Return DNS_R_SYNTAX when the input to a text field is
    181. 

  181. 			too long. [RT #26956]
    182. 

  182. 

  183. 3251.	[bug]		Enforce a upper bound (65535 bytes) on the amount of
    184. 

  184. 			memory dns_sdlz_putrr() can allocate per record to
    185. 

  185. 			prevent run away memory consumption on ISC_R_NOSPACE.
    186. 

  186. 			[RT #26956]
    187. 

  187. 

  188. 3250.	[func]		'configure --enable-developer'; turn on various
    189. 

  189. 			configure options, normally off by default, that
    190. 

  190. 			we want developers to build and test with. [RT #27103]
    191. 

  191. 

  192. 3249.	[bug]		Update log message when saving slave zones files for
    193. 

  193. 			analysis after load failures. [RT #27087]
    194. 

  194. 

  195. 3248.	[bug]		Configure options --enable-fixed-rrset and
    196. 

  196. 			--enable-exportlib were incompatible with each
    197. 

  197. 			other. [RT #27087]
    198. 

  198. 

  199. 3247.	[bug]		'raw' format zones failed to preserve load order
    200. 

  200. 			breaking 'fixed' sort order. [RT #27087]
    201. 

  201. 

  202. 3243.	[port]		netbsd,bsdi: the thread defaults were not being
    203. 

  203. 			properly set.
    204. 

  204. 

  205. 3241.	[bug]		Address race conditions in the resolver code.
    206. 

  206. 			[RT #26889]
    207. 

  207. 

  208. 3240.	[bug]		DNSKEY state change events could be missed. [RT #26874]
    209. 

  209. 

  210. 3239.	[bug]		dns_dnssec_findmatchingkeys needs to use a consistent
    211. 

  211. 			timestamp. [RT #26883]
    212. 

  212. 

  213. 3238.	[bug]		keyrdata was not being reinitialized in
    214. 

  214. 			lib/dns/rbtdb.c:iszonesecure. [RT#26913]
    215. 

  215. 

  216. 3237.	[bug]		dig -6 didn't work with +trace. [RT #26906]
    217. 

    218. 

  218. 	--- 9.8.2b1 released ---
    219. 

  219. 

  220. 3234.	[bug]		'make depend' produced invalid makefiles. [RT #26830]
    221. 

  221. 

  222. 3231.	[bug]		named could fail to send a uncompressable zone.
    223. 

  223. 			[RT #26796]
    224. 

  224. 

  225. 3230.	[bug]		'dig axfr' failed to properly handle a multi-message
    226. 

  226. 			axfr with a serial of 0. [RT #26796]
    227. 

  227. 

  228. 3229.	[bug]		Fix local variable to struct var assignment
    229. 

  229. 			found by CLANG warning.
    230. 

  230. 

  231. 3228.	[tuning]	Dynamically grow symbol table to improve zone
    232. 

  232. 			loading performance. [RT #26523]
    233. 

  233. 

  234. 3227.	[bug]		Interim fix to make WKS's use of getprotobyname()
    235. 

  235. 			and getservbyname() self thread safe. [RT #26232]
    236. 

  236. 

  237. 3226.	[bug]		Address minor resource leakages. [RT #26624]
    238. 

  238. 

  239. 3221.	[bug]		Fixed a potential coredump on shutdown due to
    240. 

  240. 			referencing fetch context after it's been freed.
    241. 

  241. 			[RT #26720]
    242. 

  242. 

  243. 3220.	[bug]		Change #3186 was incomplete; dns_db_rpz_findips()
    244. 

  244. 			could fail to set the database version correctly,
    245. 

  245. 			causing an assertion failure. [RT #26180]
    246. 

  246. 

  247. 3218.	[security]	Cache lookup could return RRSIG data associated with
    248. 

  248. 			nonexistent records, leading to an assertion
    249. 

  249. 			failure. [RT #26590]
    250. 

  250. 

  251. 3217.	[cleanup]	Fix build problem with --disable-static. [RT #26476]
    252. 

  252. 

  253. 3216.	[bug]		resolver.c:validated() was not thread-safe. [RT #26478]
    254. 

  254. 

  255. 3213.	[doc]		Clarify ixfr-from-differences behavior. [RT #25188]
    256. 

  256. 

  257. 3212.	[bug]		rbtdb.c: failed to remove a node from the deadnodes
    258. 

  258. 			list prior to adding a reference to it leading a
    259. 

  259. 			possible assertion failure. [RT #23219]
    260. 

  260. 

  261. 3209.	[func]		Add "dnssec-lookaside 'no'".  [RT #24858]
    262. 

  262. 

  263. 3208.	[bug]		'dig -y' handle unknown tsig alorithm better.
    264. 

  264. 			[RT #25522]
    265. 

  265. 

  266. 3207.	[contrib]	Fixed build error in Berkeley DB DLZ module. [RT #26444]
    267. 

  267. 

  268. 3206.	[cleanup]	Add ISC information to log at start time. [RT #25484]
    269. 

  269. 

  270. 3204.	[bug]		When a master server that has been marked as
    271. 

  271. 			unreachable sends a NOTIFY, mark it reachable
    272. 

  272. 			again. [RT #25960]
    273. 

  273. 

  274. 3203.	[bug]		Increase log level to 'info' for validation failures
    275. 

  275. 			from expired or not-yet-valid RRSIGs. [RT #21796]
    276. 

  276. 

  277. 3200.	[doc]		Some rndc functions were undocumented or were
    278. 

  278. 			missing from 'rndc -h' output. [RT #25555]
    279. 

  279. 

  280. 3198.	[doc]		Clarified that dnssec-settime can alter keyfile
    281. 

  281. 			permissions. [RT #24866]
    282. 

  282. 

  283. 3196.	[bug]		nsupdate: return nonzero exit code when target zone
    284. 

  284. 			doesn't exist. [RT #25783]
    285. 

    286. 

  286. 3195.	[cleanup]	Silence "file not found" warnings when loading
    287. 

  287. 			managed-keys zone. [RT #26340]
    288. 

  288. 

  289. 3194.	[doc]		Updated RFC references in the 'empty-zones-enable'
    290. 

  290. 			documentation. [RT #25203]
    291. 

  291. 

  292. 3193.	[cleanup]	Changed MAXZONEKEYS to DNS_MAXZONEKEYS, moved to
    293. 

  293. 			dnssec.h. [RT #26415]
    294. 

  294. 

  295. 3192.	[bug]		A query structure could be used after being freed.
    296. 

  296. 			[RT #22208]
    297. 

  297. 

  298. 3191.	[bug]		Print NULL records using "unknown" format. [RT #26392]
    299. 

  299. 

  300. 3190.	[bug]		Underflow in error handling in isc_mutexblock_init.
    301. 

  301. 			[RT #26397]
    302. 

  302. 

  303. 3189.	[test]		Added a summary report after system tests. [RT #25517]
    304. 

  304. 

  305. 3188.	[bug]		zone.c:zone_refreshkeys() could fail to detach
    306. 

  306. 			references correctly when errors occurred, causing
    307. 

  307. 			a hang on shutdown. [RT #26372]
    308. 

  308. 

  309. 3187.	[port]		win32: support for Visual Studio 2008.  [RT #26356]
    310. 

  310. 

  311. 3186.	[bug]		Version/db mis-match in rpz code. [RT #26180]
    312. 

  312. 

  313. 3179.	[port]		kfreebsd: build issues. [RT #26273]
    314. 

  314. 

  315. 3175.	[bug]		Fix how DNSSEC positive wildcard responses from a
    316. 

  316. 			NSEC3 signed zone are validated.  Stop sending a
    317. 

  317. 			unnecessary NSEC3 record when generating such
    318. 

  318. 			responses. [RT #26200]
    319. 

  319. 

  320. 3174.	[bug]		Always compute to revoked key tag from scratch.
    321. 

  321. 			[RT #26186]
    322. 

  322. 

  323. 3173.	[port]		Correctly validate root DS responses. [RT #25726]
    324. 

  324. 

  325. 3171.	[bug]		Exclusively lock the task when adding a zone using
    326. 

  326. 			'rndc addzone'.  [RT #25600]
    327. 

  327. 

  328. 3170.	[func]		RPZ update:
    329. 

  329. 			- fix precedence among competing rules
    330. 

  330. 			- improve ARM text including documenting rule precedence
    331. 

  331. 			- try to rewrite CNAME chains until first hit
    332. 

  332. 			- new "rpz" logging channel
    333. 

  333. 			- RDATA for CNAME rules can include wildcards
    334. 

  334. 			- replace "NO-OP" named.conf policy override with
    335. 

  335. 			  "PASSTHRU" and add "DISABLED" override ("NO-OP"
    336. 

  336. 			  is still recognized)
    337. 

  337. 			[RT #25172]
    338. 

  338. 

  339. 3169.	[func]		Catch db/version mis-matches when calling dns_db_*().
    340. 

  340. 			[RT #26017]
    341. 

  341. 

  342. 3167.	[bug]		Negative answers from forwarders were not being
    343. 

  343. 			correctly tagged making them appear to not be cached.
    344. 

  344. 			[RT #25380]
    345. 

  345. 

  346. 3162.	[test]		start.pl: modified to allow for "named.args" in
    347. 

  347. 			ns*/ subdirectory to override stock arguments to
    348. 

  348. 			named. Largely from RT#26044, but no separate ticket.
    349. 

  349. 

  350. 3161.	[bug]		zone.c:del_sigs failed to always reset rdata leading
    351. 

  351. 			assertion failures. [RT #25880]
    352. 

  352. 

  353. 3157.	[tuning]	Reduce the time spent in "rndc reconfig" by parsing
    354. 

  354. 			the config file before pausing the server. [RT #21373]
    355. 

  355. 

  356. 3155.	[bug]		Fixed a build failure when using contrib DLZ
    357. 

  357. 			drivers (e.g., mysql, postgresql, etc). [RT #25710]
    358. 

  358. 

  359. 3154.	[bug]		Attempting to print an empty rdataset could trigger
    360. 

  360. 			an assert. [RT #25452]
    361. 

  361. 

  362. 3152.	[cleanup]	Some versions of gcc and clang failed due to
    363. 

  363. 			incorrect use of __builtin_expect. [RT #25183]
    364. 

  364. 

  365. 3151.	[bug]		Queries for type RRSIG or SIG could be handled
    366. 

  366. 			incorrectly.  [RT #21050]
    367. 

  367. 

  368. 3148.	[bug]		Processing of normal queries could be stalled when
    369. 

  369. 			forwarding a UPDATE message. [RT #24711]
    370. 

  370. 

  371. 3146.	[test]		Fixed gcc4.6.0 errors in ATF. [RT #25598]
    372. 

  372. 

  373. 3145.	[test]		Capture output of ATF unit tests in "./atf.out" if
    374. 

  374. 			there were any errors while running them. [RT #25527]
    375. 

  375. 

  376. 3144.	[bug]		dns_dbiterator_seek() could trigger an assert when
    377. 

  377. 			used with a nonexistent database node. [RT #25358]
    378. 

  378. 

  379. 3143.	[bug]		Silence clang compiler warnings. [RT #25174]
    380. 

  380. 

  381. 3139.	[test]		Added tests from RFC 6234, RFC 2202, and RFC 1321
    382. 

  382. 			for the hashing algorithms (md5, sha1 - sha512, and
    383. 

  383. 			their hmac counterparts).  [RT #25067]
    384. 

  384. 

  385. 	--- 9.8.1 released ---
    386. 

  386. 

  387. 	--- 9.8.1rc1 released ---
    388. 

  388. 

  389. 3141.	[bug]		Silence spurious "zone serial (0) unchanged" messages
    390. 

  390. 			associated with empty zones. [RT #25079]
    391. 

  391. 

  392. 3138.	[bug]		Address memory leaks and out-of-order operations when
    393. 

  393. 			shutting named down. [RT #25210]
    394. 

  394. 

  395. 3136.	[func]		Add RFC 1918 reverse zones to the list of built-in
    396. 

  396. 			empty zones switched on by the 'empty-zones-enable'
    397. 

  397. 			option. [RT #24990]
    398. 

  398. 

  399. 			Note: empty-zones-enable must be "yes;" or a empty
    400. 

  400. 			zone needs to be disabled in named.conf for RFC 1918
    401. 

  401. 			zones to be activated.  This requirement may be
    402. 

  402. 			removed in future releases.
    403. 

  403. 

  404. 3135.	[port]		FreeBSD: workaround broken IPV6_USE_MIN_MTU processing.
    405. 

  405. 			See http://www.freebsd.org/cgi/query-pr.cgi?pr=158307
    406. 

  406. 			[RT #24950]
    407. 

  407. 

  408. 3134.	[bug]		Improve the accuracy of dnssec-signzone's signing
    409. 

  409. 			statistics. [RT #16030]
    410. 

  410. 

  411. 	--- 9.8.1b3 released ---
    412. 

  412. 

  413. 3133.	[bug]		Change #3114 was incomplete. [RT #24577]
    414. 

  414. 

  415. 3131.	[tuning]	Improve scalability by allocating one zone task
    416. 

  416. 			per 100 zones at startup time, rather than using a
    417. 

  417. 			fixed-size task table. [RT #24406]
    418. 

  418. 

  419. 3129.	[bug]		Named could crash on 'rndc reconfig' when
    420. 

  420. 			allow-new-zones was set to yes and named ACLs
    421. 

  421. 			were used. [RT #22739]
    422. 

  422. 

  423. 	--- 9.8.1b2 released ---
    424. 

  424. 

  425. 3126.	[security]	Using DNAME record to generate replacements caused
    426. 

  426. 			RPZ to exit with a assertion failure. [RT #24766]
    427. 

  427. 

  428. 3125.	[security]	Using wildcard CNAME records as a replacement with
    429. 

  429. 			RPZ caused named to exit with a assertion failure.
    430. 

  430. 			[RT #24715]
    431. 

  431. 

  432. 3124.	[bug]		Use an rdataset attribute flag to indicate
    433. 

  433. 			negative-cache records rather than using rrtype 0;
    434. 

  434. 			this will prevent problems when that rrtype is
    435. 

  435. 			used in actual DNS packets. [RT #24777]
    436. 

  436. 

  437. 3123.	[security]	Change #2912 exposed a latent flaw in
    438. 

  438. 			dns_rdataset_totext() that could cause named to
    439. 

  439. 			crash with an assertion failure. [RT #24777]
    440. 

  440. 

  441. 3122.	[cleanup]	dnssec-settime: corrected usage message. [RT #24664]
    442. 

  442. 

  443. 3121.	[security]	An authoritative name server sending a negative
    444. 

  444. 			response containing a very large RRset could
    445. 

  445. 			trigger an off-by-one error in the ncache code
    446. 

  446. 			and crash named. [RT #24650]
    447. 

  447. 

  448. 3120.	[bug]		Named could fail to validate zones listed in a DLV
    449. 

  449. 			that validated insecure without using DLV and had
    450. 

  450. 			DS records in the parent zone. [RT #24631]
    451. 

  451. 

  452. 3119.	[bug]		When rolling to a new DNSSEC key, a private-type
    453. 

  453. 			record could be created and never marked complete.
    454. 

  454. 			[RT #23253]
    455. 

  455. 

  456. 3118.	[bug]		nsupdate could dump core on shutdown when using
    457. 

  457. 			SIG(0) keys. [RT #24604]
    458. 

  458. 

  459. 3117.	[cleanup]	Remove doc and parser references to the
    460. 

  460. 			never-implemented 'auto-dnssec create' option.
    461. 

  461. 			[RT #24533]
    462. 

  462. 

  463. 3115.	[bug]		Named could fail to return requested data when
    464. 

  464. 			following a CNAME that points into the same zone.
    465. 

  465. 			[RT #24455]
    466. 

  466. 

  467. 3114.	[bug]		Retain expired RRSIGs in dynamic zones if key is
    468. 

  468. 			inactive and there is no replacement key. [RT #23136]
    469. 

  469. 

  470. 3113.	[doc]		Document the relationship between serial-query-rate
    471. 

  471. 			and NOTIFY messages.
    472. 

  472. 

  473. 	--- 9.8.1b1 released ---
    474. 

  474. 

  475. 3112.	[doc]		Add missing descriptions of the update policy name
    476. 

  476. 			types "ms-self", "ms-subdomain", "krb5-self" and
    477. 

  477. 			"krb5-subdomain", which allow machines to update
    478. 

  478. 			their own records, to the BIND 9 ARM.
    479. 

  479. 

  480. 3111.	[bug]		Improved consistency checks for dnssec-enable and
    481. 

  481. 			dnssec-validation, added test cases to the
    482. 

  482. 			checkconf system test. [RT #24398]
    483. 

  483. 

  484. 3110.	[bug]		dnssec-signzone: Wrong error message could appear
    485. 

  485. 			when attempting to sign with no KSK. [RT #24369]
    486. 

  486. 

  487. 3107.	[bug]		dnssec-signzone: Report the correct number of ZSKs
    488. 

  488. 			when using -x. [RT #20852]
    489. 

  489. 

  490. 3105.	[bug]		GOST support can be suppressed by "configure
    491. 

  491. 			--without-gost" [RT #24367]
    492. 

    493. 

  493. 3104.	[bug]		Better support for cross-compiling. [RT #24367]
    494. 

  494. 

  495. 3103.	[bug]		Configuring 'dnssec-validation auto' in a view
    496. 

  496. 			instead of in the options statement could trigger
    497. 

  497. 			an assertion failure in named-checkconf. [RT #24382]
    498. 

  498. 

  499. 3101.	[bug]		Zones using automatic key maintenance could fail
    500. 

  500. 			to check the key repository for updates. [RT #23744]
    501. 

  501. 

  502. 3100.	[security]	Certain response policy zone configurations could
    503. 

  503. 			trigger an INSIST when receiving a query of type
    504. 

  504. 			RRSIG. [RT #24280]
    505. 

  505. 

  506. 3099.	[test]		"dlz" system test now runs but gives R:SKIPPED if
    507. 

  507. 			not compiled with --with-dlz-filesystem.  [RT #24146]
    508. 

  508. 

  509. 3098.	[bug]		DLZ zones were answering without setting the AA bit.
    510. 

  510. 			[RT #24146]
    511. 

  511. 

  512. 3097.	[test]		Add a tool to test handling of malformed packets.
    513. 

  513. 			[RT #24096]
    514. 

  514. 

  515. 3096.	[bug]		Set KRB5_KTNAME before calling log_cred() in
    516. 

  516. 			dst_gssapi_acceptctx(). [RT #24004]
    517. 

  517. 

  518. 3095.	[bug]		Handle isolated reserved ports in the port range.
    519. 

  519. 			[RT #23957]
    520. 

  520. 

  521. 3094.	[doc]		Expand dns64 documentation.
    522. 

  522. 

  523. 3093.	[bug]		Fix gssapi/kerberos dependencies [RT #23836]
    524. 

  524. 

  525. 3092.	[bug]		Signatures for records at the zone apex could go
    526. 

  526. 			stale due to an incorrect timer setting. [RT #23769]
    527. 

  527. 

  528. 3091.	[bug]		Fixed a bug in which zone keys that were published
    529. 

  529. 			and then subsequently activated could fail to trigger
    530. 

  530. 			automatic signing. [RT #22911]
    531. 

  531. 

  532. 3090.	[func]		Make --with-gssapi default [RT #23738]
    533. 

  533. 

  534. 3088.	[bug]		Remove bin/tests/system/logfileconfig/ns1/named.conf
    535. 

  535. 			and add setup.sh in order to resolve changing
    536. 

  536. 			named.conf issue.  [RT #23687]
    537. 

  537. 

  538. 3087.	[bug]		DDNS updates using SIG(0) with update-policy match
    539. 

  539. 			type "external" could cause a crash. [RT #23735]
    540. 

  540. 

  541. 3086.	[bug]		Running dnssec-settime -f on an old-style key will
    542. 

  542. 			now force an update to the new key format even if no
    543. 

  543. 			other change has been specified, using "-P now -A now"
    544. 

  544. 			as default values.  [RT #22474]
    545. 

  545. 

  546. 3083.	[bug]		NOTIFY messages were not being sent when generating
    547. 

  547. 			a NSEC3 chain incrementally. [RT #23702]
    548. 

  548. 

  549. 3082.	[port]		strtok_r is threads only. [RT #23747]
    550. 

  550. 

  551. 3081.	[bug]		Failure of DNAME substitution did not return
    552. 

  552. 			YXDOMAIN. [RT #23591]
    553. 

  553. 

  554. 3080.	[cleanup]	Replaced compile time constant by STDTIME_ON_32BITS.
    555. 

  555. 			[RT #23587]
    556. 

  556. 

  557. 3079.	[bug]		Handle isc_event_allocate failures in t_tasks.
    558. 

  558. 			[RT #23572]
    559. 

  559. 

  560. 3078.	[func]		Added a new include file with function typedefs
    561. 

  561. 			for the DLZ "dlopen" driver. [RT #23629]
    562. 

  562. 

  563. 3077.	[bug]		zone.c:zone_refreshkeys() incorrectly called
    564. 

  564. 			dns_zone_attach(), use zone->irefs instead. [RT #23303]
    565. 

  565. 

  566. 3075.	[bug]		dns_dnssec_findzonekeys{2} used a inconsistant
    567. 

  567. 			timestamp when determining which keys are active.
    568. 

  568. 			[RT #23642]
    569. 

  569. 

  570. 3074.	[bug]		Make the adb cache read through for zone data and
    571. 

  571. 			glue learn for zone named is authoritative for.
    572. 

  572. 			[RT #22842]
    573. 

  573. 

  574. 3073.	[bug]		managed-keys changes were not properly being recorded.
    575. 

  575. 			[RT #20256]
    576. 

  576. 

  577. 3072.	[bug]		dns_dns64_aaaaok() potential NULL pointer dereference.
    578. 

  578. 			[RT #20256]
    579. 

  579. 

  580. 3071.	[bug]		has_nsec could be used unintialised in
    581. 

  581. 			update.c:next_active. [RT #20256]
    582. 

  582. 

  583. 3070.	[bug]		dnssec-signzone potential NULL pointer dereference.
    584. 

  584. 			[RT #20256]
    585. 

  585. 

  586. 3069.	[cleanup]	Silence warnings messages from clang static analysis.
    587. 

  587. 			[RT #20256]
    588. 

  588. 

  589. 3068.	[bug]		Named failed to build with a OpenSSL without engine
    590. 

  590. 			support. [RT #23473]
    591. 

  591. 

  592. 3067.	[bug]		ixfr-from-differences {master|slave}; failed to
    593. 

  593. 			select the master/slave zones.  [RT #23580]
    594. 

  594. 

  595. 3066.	[func]		The DLZ "dlopen" driver is now built by default,
    596. 

  596. 			no longer requiring a configure option.  To
    597. 

  597. 			disable it, use "configure --without-dlopen".
    598. 

  598. 			(Note: driver not supported on win32.) [RT #23467]
    599. 

  599. 

  600. 3065.	[bug]		RRSIG could have time stamps too far in the future.
    601. 

  601. 			[RT #23356]
    602. 

  602. 

  603. 3064.	[bug]		powerpc: add sync instructions to the end of atomic
    604. 

  604. 			operations. [RT #23469]
    605. 

  605. 

  606. 3063.	[contrib]	More verbose error reporting from DLZ LDAP. [RT #23402]
    607. 

  607. 

  608. 3059.	[test]		Added a regression test for change #3023.
    609. 

  609. 

  610. 3058.	[bug]		Cause named to terminate at startup or rndc reconfig/
    611. 

  611. 			reload to fail, if a log file specified in the conf
    612. 

  612. 			file isn't a plain file. [RT #22771]
    613. 

    614. 

  614. 3057.	[bug]		"rndc secroots" would abort after the first error
    615. 

  615. 			and so could miss some views. [RT #23488]
    616. 

  616. 

  617. 3054.	[bug]		Added elliptic curve support check in
    618. 

  618. 			GOST OpenSSL engine detection. [RT #23485]
    619. 

  619. 

  620. 3053.	[bug]		Under a sustained high query load with a finite
    621. 

  621. 			max-cache-size, it was possible for cache memory
    622. 

  622. 			to be exhausted and not recovered. [RT #23371]
    623. 

  623. 

  624. 3052.	[test]		Fixed last autosign test report. [RT #23256]
    625. 

  625. 

  626. 3051.	[bug]		NS records obsure DNAME records at the bottom of the
    627. 

  627. 			zone if both are present. [RT #23035]
    628. 

  628. 

  629. 3050.	[bug]		The autosign system test was timing dependent.
    630. 

  630. 			Wait for the initial autosigning to complete
    631. 

  631. 			before running the rest of the test. [RT #23035]
    632. 

  632. 

  633. 3049.	[bug]		Save and restore the gid when creating creating
    634. 

  634. 			named.pid at startup. [RT #23290]
    635. 

  635. 

  636. 3048.	[bug]		Fully separate view key mangement. [RT #23419]
    637. 

  637. 

  638. 3047.	[bug]		DNSKEY NODATA responses not cached fixed in
    639. 

  639. 			validator.c. Tests added to dnssec system test.
    640. 

  640. 			[RT #22908]
    641. 

  641. 

  642. 3046.	[bug]		Use RRSIG original TTL to compute validated RRset
    643. 

  643. 			and RRSIG TTL. [RT #23332]
    644. 

  644. 

  645. 3044.	[bug]		Hold the socket manager lock while freeing the socket.
    646. 

  646. 			[RT #23333]
    647. 

  647. 

  648. 3043.	[test]		Merged in the NetBSD ATF test framework (currently
    649. 

  649. 			version 0.12) for development of future unit tests.
    650. 

  650. 			Use configure --with-atf to build ATF internally
    651. 

  651. 			or configure --with-atf=prefix to use an external
    652. 

  652. 			copy.  [RT #23209]
    653. 

  653. 

  654. 3042.	[bug]		dig +trace could fail attempting to use IPv6
    655. 

  655. 			addresses on systems with only IPv4 connectivity.
    656. 

  656. 			[RT #23297]
    657. 

  657. 

  658. 3041.	[bug]		dnssec-signzone failed to generate new signatures on
    659. 

  659. 			ttl changes. [RT #23330]
    660. 

  660. 

  661. 3040.	[bug]		Named failed to validate insecure zones where a node
    662. 

  662. 			with a CNAME existed between the trust anchor and the
    663. 

  663. 			top of the zone. [RT #23338]
    664. 

  664. 

  665. 3038.	[bug]		Install <dns/rpz.h>.  [RT #23342]
    666. 

  666. 

  667. 3037.	[doc]		Update COPYRIGHT to contain all the individual
    668. 

  668. 			copyright notices that cover various parts.
    669. 

  669. 

  670. 3036.	[bug]		Check built-in zone arguments to see if the zone
    671. 

  671. 			is re-usable or not. [RT #21914]
    672. 

  672. 

  673. 3035.	[cleanup]	Simplify by using strlcpy. [RT #22521]
    674. 

  674. 

  675. 3034.	[cleanup]	nslookup: use strlcpy instead of safecopy. [RT #22521]
    676. 

  676. 

  677. 3033.	[cleanup]	Add two INSIST(bucket != DNS_ADB_INVALIDBUCKET).
    678. 

  678. 			[RT #22521]
    679. 

  679. 

  680. 3032.	[bug]		rdatalist.c: add missing REQUIREs. [RT #22521]
    681. 

  681. 

  682. 3031.	[bug]		dns_rdataclass_format() handle a zero sized buffer.
    683. 

  683. 			[RT #22521]
    684. 

  684. 

  685. 3030.	[bug]		dns_rdatatype_format() handle a zero sized buffer.
    686. 

  686. 			[RT #22521]
    687. 

  687. 

  688. 3029.	[bug]		isc_netaddr_format() handle a zero sized buffer.
    689. 

  689. 			[RT #22521]
    690. 

  690. 

  691. 3028.	[bug]		isc_sockaddr_format() handle a zero sized buffer.
    692. 

  692. 			[RT #22521]
    693. 

  693. 

  694. 3027.	[bug]		Add documented REQUIREs to cfg_obj_asnetprefix() to
    695. 

  695. 			catch NULL pointer dereferences before they happen.
    696. 

  696. 			[RT #22521]
    697. 

  697. 

  698. 3026.	[bug]		lib/isc/httpd.c: check that we have enough space
    699. 

  699. 			after calling grow_headerspace() and if not
    700. 

  700. 			re-call grow_headerspace() until we do. [RT #22521]
    701. 

  701. 

  702. 	--- 9.8.0 released ---
    703. 

  703. 

  704. 3025.	[bug]		Fixed a possible deadlock due to zone resigning.
    705. 

  705. 			[RT #22964]
    706. 

  706. 

  707. 3024.	[func]		RTT Banding removed due to minor security increase
    708. 

  708. 			but major impact on resolver latency. [RT #23310]
    709. 

  709. 

  710. 3023.	[bug]		Named could be left in an inconsistent state when
    711. 

  711. 			receiving multiple AXFR response messages that were
    712. 

  712. 			not all TSIG-signed. [RT #23254]
    713. 

  713. 

  714. 3022.	[bug]		Fixed rpz SERVFAILs after failed zone transfers
    715. 

  715. 			[RT #23246]
    716. 

  716. 

  717. 3021.	[bug]		Change #3010 was incomplete. [RT #22296]
    718. 

  718. 

  719. 3020.	[bug]		auto-dnssec failed to correctly update the zone when
    720. 

  720. 			changing the DNSKEY RRset. [RT #23232]
    721. 

  721. 

  722. 3019.	[test]		Test: check apex NSEC3 records after adding DNSKEY
    723. 

  723. 			record via UPDATE. [RT #23229]
    724. 

  724. 

  725. 	--- 9.8.0rc1 released ---
    726. 

  726. 

  727. 3018.	[bug]		Named failed to check for the "none;" acl when deciding
    728. 

  728. 			if a zone may need to be re-signed. [RT #23120]
    729. 

  729. 

  730. 3017.	[doc]		dnssec-keyfromlabel -I was not properly documented.
    731. 

  731. 			[RT #22887]
    732. 

  732. 

  733. 3016.	[bug]		rndc usage missing '-b'. [RT #22937]
    734. 

  734. 

  735. 3015.	[port]		win32: fix IN6_IS_ADDR_LINKLOCAL and
    736. 

  736. 			IN6_IS_ADDR_SITELOCAL macros. [RT #22724]
    737. 

  737. 

  738. 3013.	[bug]		The DNS64 ttl was not always being set as expected.
    739. 

  739. 			[RT #23034]
    740. 

  740. 

  741. 3012.	[bug]		Remove DNSKEY TTL change pairs before generating
    742. 

  742. 			signing records for any remaining DNSKEY changes.
    743. 

  743. 			[RT #22590]
    744. 

  744. 

  745. 3011.	[func]		Allow setting this in named.conf using the new
    746. 

  746. 			'resolver-query-timeout' option, which specifies a max
    747. 

  747. 			time in seconds.  0 means 'default' and anything longer
    748. 

  748. 			than 30 will be silently set to 30. [RT #22852]
    749. 

  749. 

  750. 3010.	[bug]		Fixed a bug where "rndc reconfig" stopped the timer
    751. 

  751. 			for refreshing managed-keys. [RT #22296]
    752. 

  752. 

  753. 3009.	[bug]		clients-per-query code didn't work as expected with
    754. 

  754. 			particular query patterns. [RT #22972]
    755. 

  755. 

  756. 	--- 9.8.0b1 released ---
    757. 

  757. 

  758. 3008.	[func]		Response policy zones (RPZ) support. [RT #21726]
    759. 

  759. 

  760. 3007.	[bug]		Named failed to preserve the case of domain names in
    761. 

  761. 			rdata which is not compressible when writing master
    762. 

  762. 			files.  [RT #22863]
    763. 

  763. 

  764. 3006.	[func]		Allow dynamically generated TSIG keys to be preserved
    765. 

  765. 			across restarts of named.  Initially this is for
    766. 

  766. 			TSIG keys generated using GSSAPI. [RT #22639]
    767. 

  767. 

  768. 3005.	[port]		Solaris: Work around the lack of
    769. 

  769. 			gsskrb5_register_acceptor_identity() by setting
    770. 

  770. 			the KRB5_KTNAME environment variable to the
    771. 

  771. 			contents of tkey-gssapi-keytab.  Also fixed
    772. 

  772. 			test errors on MacOSX.  [RT #22853]
    773. 

  773. 

  774. 3004.	[func]		DNS64 reverse support. [RT #22769]
    775. 

  775. 

  776. 3003.	[experimental]	Added update-policy match type "external",
    777. 

  777. 			enabling named to defer the decision of whether to
    778. 

  778. 			allow a dynamic update to an external daemon.
    779. 

  779. 			(Contributed by Andrew Tridgell.) [RT #22758]
    780. 

  780. 

  781. 3002.	[bug]		isc_mutex_init_errcheck() failed to destroy attr.
    782. 

  782. 			[RT #22766]
    783. 

  783. 

  784. 3001.	[func]		Added a default trust anchor for the root zone, which
    785. 

  785. 			can be switched on by setting "dnssec-validation auto;"
    786. 

  786. 			in the named.conf options. [RT #21727]
    787. 

  787. 

  788. 3000.	[bug]		More TKEY/GSS fixes:
    789. 

  789. 			 - nsupdate can now get the default realm from
    790. 

  790. 			   the user's Kerberos principal
    791. 

  791. 			 - corrected gsstest compilation flags
    792. 

  792. 			 - improved documentation
    793. 

  793. 			 - fixed some NULL dereferences
    794. 

  794. 			[RT #22795]
    795. 

  795. 

  796. 2999.	[func]		Add GOST support (RFC 5933). [RT #20639]
    797. 

  797. 

  798. 2998.	[func]		Add isc_task_beginexclusive and isc_task_endexclusive
    799. 

  799. 			to the task api. [RT #22776]
    800. 

  800. 

  801. 2997.	[func]		named -V now reports the OpenSSL and libxml2 verions
    802. 

  802. 			it was compiled against. [RT #22687]
    803. 

  803. 

  804. 2996.	[security]	Temporarily disable SO_ACCEPTFILTER support.
    805. 

  805. 			[RT #22589]
    806. 

  806. 

  807. 2995.	[bug]		The Kerberos realm was not being correctly extracted
    808. 

  808. 			from the signer's identity. [RT #22770]
    809. 

    810. 

  810. 2994.	[port]		NetBSD: use pthreads by default on NetBSD >= 5.0, and
    811. 

  811. 			do not use threads on earlier versions.  Also kill
    812. 

  812. 			the unproven-pthreads, mit-pthreads, and ptl2 support.
    813. 

  813. 

  814. 2993.	[func]		Dynamically grow adb hash tables. [RT #21186]
    815. 

  815. 

  816. 2992.	[contrib]	contrib/check-secure-delegation.pl:  A simple tool
    817. 

  817. 			for looking at a secure delegation. [RT #22059]
    818. 

  818. 

  819. 2991.	[contrib]	contrib/zone-edit.sh: A simple zone editing tool for
    820. 

  820. 			dynamic zones. [RT #22365]
    821. 

  821. 

  822. 2990.	[bug]		'dnssec-settime -S' no longer tests prepublication
    823. 

  823. 			interval validity when the interval is set to 0.
    824. 

  824. 			[RT #22761]
    825. 

  825. 

  826. 2989.	[func]		Added support for writable DLZ zones. (Contributed
    827. 

  827. 			by Andrew Tridgell of the Samba project.) [RT #22629]
    828. 

  828. 

  829. 2988.	[experimental]	Added a "dlopen" DLZ driver, allowing the creation
    830. 

  830. 			of external DLZ drivers that can be loaded as
    831. 

  831. 			shared objects at runtime rather than linked with
    832. 

  832. 			named.  Currently this is switched on via a
    833. 

  833. 			compile-time option, "configure --with-dlz-dlopen".
    834. 

  834. 			Note: the syntax for configuring DLZ zones
    835. 

  835. 			is likely to be refined in future releases.
    836. 

  836. 			(Contributed by Andrew Tridgell of the Samba
    837. 

  837. 			project.) [RT #22629]
    838. 

  838. 

  839. 2987.	[func]		Improve ease of configuring TKEY/GSS updates by
    840. 

  840. 			adding a "tkey-gssapi-keytab" option.  If set,
    841. 

  841. 			updates will be allowed with any key matching
    842. 

  842. 			a principal in the specified keytab file.
    843. 

  843. 			"tkey-gssapi-credential" is no longer required
    844. 

  844. 			and is expected to be deprecated.  (Contributed
    845. 

  845. 			by Andrew Tridgell of the Samba project.)
    846. 

  846. 			[RT #22629]
    847. 

  847. 

  848. 2986.	[func]		Add new zone type "static-stub".  It's like a stub
    849. 

  849. 			zone, but the nameserver names and/or their IP
    850. 

  850. 			addresses are statically configured. [RT #21474]
    851. 

  851. 

  852. 2985.	[bug]		Add a regression test for change #2896. [RT #21324]
    853. 

  853. 

  854. 2984.	[bug]		Don't run MX checks when the target of the MX record
    855. 

  855. 			is ".".  [RT #22645]
    856. 

  856. 

  857. 2983.	[bug]		Include "loadkeys" in rndc help output. [RT #22493]
    858. 

  858. 

  859. 	--- 9.8.0a1 released ---
    860. 

  860. 

  861. 2982.	[bug]		Reference count dst keys.  dst_key_attach() can be used
    862. 

  862. 			increment the reference count.
    863. 

  863. 

  864. 			Note: dns_tsigkey_createfromkey() callers should now
    865. 

  865. 			always call dst_key_free() rather than setting it
    866. 

  866. 			to NULL on success. [RT #22672]
    867. 

  867. 

  868. 2981.	[func]		Partial DNS64 support (AAAA synthesis). [RT #21991]
    869. 

  869. 

  870. 2980.	[bug]		named didn't properly handle UPDATES that changed the
    871. 

  871. 			TTL of the NSEC3PARAM RRset. [RT #22363]
    872. 

  872. 

  873. 2979.	[bug]		named could deadlock during shutdown if two
    874. 

  874. 			"rndc stop" commands were issued at the same
    875. 

  875. 			time. [RT #22108]
    876. 

  876. 

  877. 2978.	[port]		hpux: look for <devpoll.h> [RT #21919]
    878. 

  878. 

  879. 2977.	[bug]		'nsupdate -l' report if the session key is missing.
    880. 

  880. 			[RT #21670]
    881. 

  881. 

  882. 2976.	[bug]		named could die on exit after negotiating a GSS-TSIG
    883. 

  883. 			key. [RT #22573]
    884. 

  884. 

  885. 2975.	[bug]		rbtdb.c:cleanup_dead_nodes_callback() acquired the
    886. 

  886. 			wrong lock which could lead to server deadlock.
    887. 

  887. 			[RT #22614]
    888. 

  888. 

  889. 2974.	[bug]		Some valid UPDATE requests could fail due to a
    890. 

  890. 			consistency check examining the existing version
    891. 

  891. 			of the zone rather than the new version resulting
    892. 

  892. 			from the UPDATE. [RT #22413]
    893. 

  893. 

  894. 2973.	[bug]		bind.keys.h was being removed by the "make clean"
    895. 

  895. 			at the end of configure resulting in build failures
    896. 

  896. 			where there is very old version of perl installed.
    897. 

  897. 			Move it to "make maintainer-clean". [RT #22230]
    898. 

  898. 

  899. 2972.	[bug]		win32: address windows socket errors. [RT #21906]
    900. 

  900. 

  901. 2971.	[bug]		Fixed a bug that caused journal files not to be
    902. 

  902. 			compacted on Windows systems as a result of
    903. 

  903. 			non-POSIX-compliant rename() semantics. [RT #22434]
    904. 

  904. 

  905. 2970.	[security]	Adding a NO DATA negative cache entry failed to clear
    906. 

  906. 			any matching RRSIG records.  A subsequent lookup of
    907. 

  907. 			of NO DATA cache entry could trigger a INSIST when the
    908. 

  908. 			unexpected RRSIG was also returned with the NO DATA
    909. 

  909. 			cache entry.
    910. 

  910. 

  911. 			CVE-2010-3613, VU#706148. [RT #22288]
    912. 

  912. 

  913. 2969.	[security]	Fix acl type processing so that allow-query works
    914. 

  914. 			in options and view statements.  Also add a new
    915. 

  915. 			set of tests to verify proper functioning.
    916. 

  916. 

  917. 			CVE-2010-3615, VU#510208. [RT #22418]
    918. 

  918. 

  919. 2968.	[security]	Named could fail to prove a data set was insecure
    920. 

  920. 			before marking it as insecure.  One set of conditions
    921. 

  921. 			that can trigger this occurs naturally when rolling
    922. 

  922. 			DNSKEY algorithms.
    923. 

  923. 

  924. 			CVE-2010-3614, VU#837744. [RT #22309]
    925. 

  925. 

  926. 2967.	[bug]		'host -D' now turns on debugging messages earlier.
    927. 

  927. 			[RT #22361]
    928. 

  928. 

  929. 2966.	[bug]		isc_print_vsnprintf() failed to check if there was
    930. 

  930. 			space available in the buffer when adding a left
    931. 

  931. 			justified character with a non zero width,
    932. 

  932. 			(e.g. "%-1c"). [RT #22270]
    933. 

  933. 

  934. 2965.	[func]		Test HMAC functions using test data from RFC 2104 and
    935. 

  935. 			RFC 4634. [RT #21702]
    936. 

  936. 

  937. 2964.	[placeholder]
    938. 

  938. 

  939. 2963.	[security]	The allow-query acl was being applied instead of the
    940. 

  940. 			allow-query-cache acl to cache lookups. [RT #22114]
    941. 

  941. 

  942. 2962.	[port]		win32: add more dependencies to BINDBuild.dsw.
    943. 

  943. 			[RT #22062]
    944. 

  944. 

  945. 2961.	[bug]		Be still more selective about the non-authoritative
    946. 

  946. 			answers we apply change 2748 to. [RT #22074]
    947. 

  947. 

  948. 2960.	[func]		Check that named accepts non-authoritative answers.
    949. 

  949. 			[RT #21594]
    950. 

  950. 

  951. 2959.	[func]		Check that named starts with a missing masterfile.
    952. 

  952. 			[RT #22076]
    953. 

  953. 

  954. 2958.	[bug]		named failed to start with a missing master file.
    955. 

  955. 			[RT #22076]
    956. 

  956. 

  957. 2957.	[bug]		entropy_get() and entropy_getpseudo() failed to match
    958. 

  958. 			the API for RAND_bytes() and RAND_pseudo_bytes()
    959. 

  959. 			respectively. [RT #21962]
    960. 

  960. 

  961. 2956.	[port]		Enable atomic operations on the PowerPC64. [RT #21899]
    962. 

  962. 

  963. 2955.	[func]		Provide more detail in the recursing log. [RT #22043]
    964. 

  964. 

  965. 2954.	[bug]		contrib: dlz_mysql_driver.c bad error handling on
    966. 

  966. 			build_sqldbinstance failure. [RT #21623]
    967. 

  967. 

  968. 2953.	[bug]		Silence spurious "expected covering NSEC3, got an
    969. 

  969. 			exact match" message when returning a wildcard
    970. 

  970. 			no data response. [RT #21744]
    971. 

  971. 

  972. 2952.	[port]		win32: named-checkzone and named-checkconf failed
    973. 

  973. 			to initialise winsock. [RT #21932]
    974. 

  974. 

  975. 2951.	[bug]		named failed to generate a correct signed response
    976. 

  976. 			in a optout, delegation only zone with no secure
    977. 

  977. 			delegations. [RT #22007]
    978. 

  978. 

  979. 2950.	[bug]		named failed to perform a SOA up to date check when
    980. 

  980. 			falling back to TCP on UDP timeouts when
    981. 

  981. 			ixfr-from-differences was set. [RT #21595]
    982. 

  982. 

  983. 2949.	[bug]		dns_view_setnewzones() contained a memory leak if
    984. 

  984. 			it was called multiple times. [RT #21942]
    985. 

  985. 

  986. 2948.	[port]		MacOS: provide a mechanism to configure the test
    987. 

  987. 			interfaces at reboot. See bin/tests/system/README
    988. 

  988. 			for details.
    989. 

  989. 

  990. 2947.	[placeholder]
    991. 

  991. 

  992. 2946.	[doc]		Document the default values for the minimum and maximum
    993. 

  993. 			zone refresh and retry values in the ARM. [RT #21886]
    994. 

  994. 

  995. 2945.	[doc]		Update empty-zones list in ARM. [RT #21772]
    996. 

  996. 

  997. 2944.	[maint]		Remove ORCHID prefix from built in empty zones.
    998. 

  998. 			[RT #21772]
    999. 

  999. 

  1000. 2943.	[func]		Add support to load new keys into managed zones
    1001. 

  1001. 			without signing immediately with "rndc loadkeys".
    1002. 

  1002. 			Add support to link keys with "dnssec-keygen -S"
    1003. 

  1003. 			and "dnssec-settime -S".  [RT #21351]
    1004. 

  1004. 

  1005. 2942.	[contrib]	zone2sqlite failed to setup the entropy sources.
    1006. 

  1006. 			[RT #21610]
    1007. 

  1007. 

  1008. 2941.	[bug]		sdb and sdlz (dlz's zone database) failed to support
    1009. 

  1009. 			DNAME at the zone apex.  [RT #21610]
    1010. 

  1010. 

  1011. 2940.	[port]		Remove connection aborted error message on
    1012. 

  1012. 			Windows. [RT #21549]
    1013. 

  1013. 

  1014. 2939.	[func]		Check that named successfully skips NSEC3 records
    1015. 

  1015. 			that fail to match the NSEC3PARAM record currently
    1016. 

  1016. 			in use. [RT# 21868]
    1017. 

  1017. 

  1018. 2938.	[bug]		When generating signed responses, from a signed zone
    1019. 

  1019. 			that uses NSEC3, named would use a uninitialised
    1020. 

  1020. 			pointer if it needed to skip a NSEC3 record because
    1021. 

  1021. 			it didn't match the selected NSEC3PARAM record for
    1022. 

  1022. 			zone. [RT# 21868]
    1023. 

  1023. 

  1024. 2937.	[bug]		Worked around an apparent race condition in over
    1025. 

  1025. 			memory conditions.  Without this fix a DNS cache DB or
    1026. 

  1026. 			ADB could incorrectly stay in an over memory state,
    1027. 

  1027. 			effectively refusing further caching, which
    1028. 

  1028. 			subsequently made a BIND 9 caching server unworkable.
    1029. 

  1029. 			This fix prevents this problem from happening by
    1030. 

  1030. 			polling the state of the memory context, rather than
    1031. 

  1031. 			making a copy of the state, which appeared to cause
    1032. 

  1032. 			a race.  This is a "workaround" in that it doesn't
    1033. 

  1033. 			solve the possible race per se, but several experiments
    1034. 

  1034. 			proved this change solves the symptom.  Also, the
    1035. 

  1035. 			polling overhead hasn't been reported to be an issue.
    1036. 

  1036. 			This bug should only affect a caching server that
    1037. 

  1037. 			specifies a finite max-cache-size.  It's also quite
    1038. 

  1038. 			likely that the bug happens only when enabling threads,
    1039. 

  1039. 			but it's not confirmed yet. [RT #21818]
    1040. 

    1041. 

  1041. 2936.	[func]		Improved configuration syntax and multiple-view
    1042. 

  1042. 			support for addzone/delzone feature (see change
    1043. 

  1043. 			#2930).  Removed "new-zone-file" option, replaced
    1044. 

  1044. 			with "allow-new-zones (yes|no)".  The new-zone-file
    1045. 

  1045. 			for each view is now created automatically, with
    1046. 

  1046. 			a filename generated from a hash of the view name.
    1047. 

  1047. 			It is no longer necessary to "include" the
    1048. 

  1048. 			new-zone-file in named.conf; this happens
    1049. 

  1049. 			automatically.  Zones that were not added via
    1050. 

  1050. 			"rndc addzone" can no longer be removed with
    1051. 

  1051. 			"rndc delzone". [RT #19447]
    1052. 

  1052. 

  1053. 2935.	[bug]		nsupdate: improve 'file not found' error message.
    1054. 

  1054. 			[RT #21871]
    1055. 

  1055. 

  1056. 2934.	[bug]		Use ANSI C compliant shift range in lib/isc/entropy.c.
    1057. 

  1057. 			[RT #21871]
    1058. 

  1058. 

  1059. 2933.	[bug]		'dig +nsid' used stack memory after it went out of
    1060. 

  1060. 			scope.  This could potentially result in a unknown,
    1061. 

  1061. 			potentially malformed, EDNS option being sent instead
    1062. 

  1062. 			of the desired NSID option. [RT #21781]
    1063. 

  1063. 

  1064. 2932.	[cleanup]	Corrected a numbering error in the "dnssec" test.
    1065. 

  1065. 			[RT #21597]
    1066. 

  1066. 

  1067. 2931.	[bug]		Temporarily and partially disable change 2864
    1068. 

  1068. 			because it would cause infinite attempts of RRSIG
    1069. 

  1069. 			queries.  This is an urgent care fix; we'll
    1070. 

  1070. 			revisit the issue and complete the fix later.
    1071. 

  1071. 			[RT #21710]
    1072. 

  1072. 

  1073. 2930.	[experimental]	New "rndc addzone" and "rndc delzone" commads
    1074. 

  1074. 			allow dynamic addition and deletion of zones.
    1075. 

  1075. 			To enable this feature, specify a "new-zone-file"
    1076. 

  1076. 			option at the view or options level in named.conf.
    1077. 

  1077. 			Zone configuration information for the new zones
    1078. 

  1078. 			will be written into that file.  To make the new
    1079. 

  1079. 			zones persist after a restart, "include" the file
    1080. 

  1080. 			into named.conf in the appropriate view.  (Note:
    1081. 

  1081. 			This feature is not yet documented, and its syntax
    1082. 

  1082. 			is expected to change.) [RT #19447]
    1083. 

  1083. 

  1084. 2929.	[bug]		Improved handling of GSS security contexts:
    1085. 

  1085. 			 - added LRU expiration for generated TSIGs
    1086. 

  1086. 			 - added the ability to use a non-default realm
    1087. 

  1087. 			 - added new "realm" keyword in nsupdate
    1088. 

  1088. 			 - limited lifetime of generated keys to 1 hour
    1089. 

  1089. 			   or the lifetime of the context (whichever is
    1090. 

  1090. 			   smaller)
    1091. 

  1091. 			[RT #19737]
    1092. 

  1092. 

  1093. 2928.	[bug]		Be more selective about the non-authoritative
    1094. 

  1094. 			answer we apply change 2748 to. [RT #21594]
    1095. 

  1095. 

  1096. 2927.	[placeholder]
    1097. 

  1097. 

  1098. 2926.	[placeholder]
    1099. 

  1099. 

  1100. 2925.	[bug]		Named failed to accept uncachable negative responses
    1101. 

  1101. 			from insecure zones. [RT# 21555]
    1102. 

  1102. 

  1103. 2924.	[func]		'rndc  secroots'  dump a combined summary of the
    1104. 

  1104. 			current managed keys combined with trusted keys.
    1105. 

  1105. 			[RT #20904]
    1106. 

  1106. 

  1107. 2923.	[bug]		'dig +trace' could drop core after "connection
    1108. 

  1108. 			timeout". [RT #21514]
    1109. 

    1110. 

  1110. 2922.	[contrib]	Update zkt to version 1.0.
    1111. 

  1111. 

  1112. 2921.	[bug]		The resolver could attempt to destroy a fetch context
    1113. 

  1113. 			too soon.  [RT #19878]
    1114. 

  1114. 

  1115. 2920.	[func]		Allow 'filter-aaaa-on-v4' to be applied selectively
    1116. 

  1116. 			to IPv4 clients.  New acl 'filter-aaaa' (default any).
    1117. 

  1117. 

  1118. 2919.	[func]		Add autosign-ksk and autosign-zsk virtual time tests.
    1119. 

  1119. 			[RT #20840]
    1120. 

  1120. 

  1121. 2918.	[maint]		Add AAAA address for I.ROOT-SERVERS.NET.
    1122. 

  1122. 

  1123. 2917.	[func]		Virtual time test framework. [RT #20801]
    1124. 

  1124. 

  1125. 2916.	[func]		Add framework to use IPv6 in tests.
    1126. 

  1126. 			fd92:7065:b8e:ffff::1 ... fd92:7065:b8e:ffff::7
    1127. 

  1127. 

  1128. 2915.	[cleanup]	Be smarter about which objects we attempt to compile
    1129. 

  1129. 			based on configure options. [RT #21444]
    1130. 

  1130. 

  1131. 2914.	[bug]		Make the "autosign" system test more portable.
    1132. 

  1132. 			[RT #20997]
    1133. 

  1133. 

  1134. 2913.	[func]		Add pkcs#11 system tests. [RT #20784]
    1135. 

  1135. 

  1136. 2912.	[func]		Windows clients don't like UPDATE responses that clear
    1137. 

  1137. 			the zone section. [RT #20986]
    1138. 

  1138. 

  1139. 2911.	[bug]		dnssec-signzone didn't handle out of zone records well.
    1140. 

  1140. 			[RT #21367]
    1141. 

  1141. 

  1142. 2910.	[func]		Sanity check Kerberos credentials. [RT #20986]
    1143. 

  1143. 

  1144. 2909.	[bug]		named-checkconf -p could die if "update-policy local;"
    1145. 

  1145. 			was specified in named.conf. [RT #21416]
    1146. 

  1146. 

  1147. 2908.	[bug]		It was possible for re-signing to stop after removing
    1148. 

  1148. 			a DNSKEY. [RT #21384]
    1149. 

  1149. 

  1150. 2907.	[bug]		The export version of libdns had undefined references.
    1151. 

  1151. 			[RT #21444]
    1152. 

  1152. 

  1153. 2906.	[bug]		Address RFC 5011 implementation issues. [RT #20903]
    1154. 

  1154. 

  1155. 2905.	[port]		aix: set use_atomic=yes with native compiler.
    1156. 

  1156. 			[RT #21402]
    1157. 

  1157. 

  1158. 2904.	[bug]		When using DLV, sub-zones of the zones in the DLV,
    1159. 

  1159. 			could be incorrectly marked as insecure instead of
    1160. 

  1160. 			secure leading to negative proofs failing.  This was
    1161. 

  1161. 			a unintended outcome from change 2890. [RT# 21392]
    1162. 

  1162. 

  1163. 2903.	[bug]		managed-keys-directory missing from namedconf.c.
    1164. 

  1164. 			[RT #21370]
    1165. 

  1165. 

  1166. 2902.	[func]		Add regression test for change 2897. [RT #21040]
    1167. 

  1167. 

  1168. 2901.	[port]		Use AC_C_FLEXIBLE_ARRAY_MEMBER. [RT #21316]
    1169. 

  1169. 

  1170. 2900.	[bug]		The placeholder negative caching element was not
    1171. 

  1171. 			properly constructed triggering a INSIST in
    1172. 

  1172. 			dns_ncache_towire(). [RT #21346]
    1173. 

  1173. 

  1174. 2899.	[port]		win32: Support linking against OpenSSL 1.0.0.
    1175. 

  1175. 

  1176. 2898.	[bug]		nslookup leaked memory when -domain=value was
    1177. 

  1177. 			specified. [RT #21301]
    1178. 

  1178. 

  1179. 2897.	[bug]		NSEC3 chains could be left behind when transitioning
    1180. 

  1180. 			to insecure. [RT #21040]
    1181. 

  1181. 

  1182. 2896.	[bug]		"rndc sign" failed to properly update the zone
    1183. 

  1183. 			when adding a DNSKEY for publication only. [RT #21045]
    1184. 

  1184. 

  1185. 2895.	[func]		genrandom: add support for the generation of multiple
    1186. 

  1186. 			files.  [RT #20917]
    1187. 

  1187. 

  1188. 2894.	[contrib]	DLZ LDAP support now use '$' not '%'. [RT #21294]
    1189. 

  1189. 

  1190. 2893.	[bug]		Improve managed keys support.  New named.conf option
    1191. 

  1191. 			managed-keys-directory. [RT #20924]
    1192. 

  1192. 

  1193. 2892.	[bug]		Handle REVOKED keys better. [RT #20961]
    1194. 

  1194. 

  1195. 2891.	[maint]		Update empty-zones list to match
    1196. 

  1196. 			draft-ietf-dnsop-default-local-zones-13. [RT# 21099]
    1197. 

  1197. 

  1198. 2890.	[bug]		Handle the introduction of new trusted-keys and
    1199. 

  1199. 			DS, DLV RRsets better. [RT #21097]
    1200. 

  1200. 

  1201. 2889.	[bug]		Elements of the grammar where not properly reported.
    1202. 

  1202. 			[RT #21046]
    1203. 

  1203. 

  1204. 2888.	[bug]		Only the first EDNS option was displayed. [RT #21273]
    1205. 

  1205. 

  1206. 2887.	[bug]		Report the keytag times in UTC in the .key file,
    1207. 

  1207. 			local time is presented as a comment within the
    1208. 

  1208. 			comment.  [RT #21223]
    1209. 

  1209. 

  1210. 2886.	[bug]		ctime() is not thread safe. [RT #21223]
    1211. 

  1211. 

  1212. 2885.	[bug]		Improve -fno-strict-aliasing support probing in
    1213. 

  1213. 			configure. [RT #21080]
    1214. 

  1214. 

  1215. 2884.	[bug]		Insufficient validation in dns_name_getlabelsequence().
    1216. 

  1216. 			[RT #21283]
    1217. 

  1217. 

  1218. 2883.	[bug]		'dig +short' failed to handle really large datasets.
    1219. 

  1219. 			[RT #21113]
    1220. 

  1220. 

  1221. 2882.	[bug]		Remove memory context from list of active contexts
    1222. 

  1222. 			before clearing 'magic'. [RT #21274]
    1223. 

  1223. 

  1224. 2881.	[bug]		Reduce the amount of time the rbtdb write lock
    1225. 

  1225. 			is held when closing a version. [RT #21198]
    1226. 

  1226. 

  1227. 2880.	[cleanup]	Make the output of dnssec-keygen and dnssec-revoke
    1228. 

  1228. 			consistent. [RT #21078]
    1229. 

  1229. 

  1230. 2879.	[contrib]	DLZ bdbhpt driver fails to close correct cursor.
    1231. 

  1231. 			[RT #21106]
    1232. 

  1232. 

  1233. 2878.	[func]		Incrementally write the master file after performing
    1234. 

  1234. 			a AXFR.  [RT #21010]
    1235. 

  1235. 

  1236. 2877.	[bug]		The validator failed to skip obviously mismatching
    1237. 

  1237. 			RRSIGs. [RT #21138]
    1238. 

  1238. 

  1239. 2876.	[bug]		Named could return SERVFAIL for negative responses
    1240. 

  1240. 			from unsigned zones. [RT #21131]
    1241. 

  1241. 

  1242. 2875.	[bug]		dns_time64_fromtext() could accept non digits.
    1243. 

  1243. 			[RT #21033]
    1244. 

  1244. 

  1245. 2874.	[bug]		Cache lack of EDNS support only after the server
    1246. 

  1246. 			successfully responds to the query using plain DNS.
    1247. 

  1247. 			[RT #20930]
    1248. 

  1248. 

  1249. 2873.	[bug]		Cancelling a dynamic update via the dns/client module
    1250. 

  1250. 			could trigger an assertion failure. [RT #21133]
    1251. 

  1251. 

  1252. 2872.	[bug]		Modify dns/client.c:dns_client_createx() to only
    1253. 

  1253. 			require one of IPv4 or IPv6 rather than both.
    1254. 

  1254. 			[RT #21122]
    1255. 

  1255. 

  1256. 2871.	[bug]		Type mismatch in mem_api.c between the definition and
    1257. 

  1257. 			the header file, causing build failure with
    1258. 

  1258. 			--enable-exportlib. [RT #21138]
    1259. 

  1259. 

  1260. 2870.	[maint]		Add AAAA address for L.ROOT-SERVERS.NET.
    1261. 

  1261. 

  1262. 2869.	[bug]		Fix arguments to dns_keytable_findnextkeynode() call.
    1263. 

  1263. 			[RT #20877]
    1264. 

  1264. 

  1265. 2868.	[cleanup]	Run "make clean" at the end of configure to ensure
    1266. 

  1266. 			any changes made by configure are integrated.
    1267. 

  1267. 			Use --with-make-clean=no to disable.  [RT #20994]
    1268. 

  1268. 

  1269. 2867.	[bug]		Don't set GSS_C_SEQUENCE_FLAG as Windows DNS servers
    1270. 

  1270. 			don't like it.  [RT #20986]
    1271. 

    1272. 

  1272. 2866.	[bug]		Windows does not like the TSIG name being compressed.
    1273. 

  1273. 			[RT #20986]
    1274. 

  1274. 

  1275. 2865.	[bug]		memset to zero event.data.  [RT #20986]
    1276. 

  1276. 

  1277. 2864.	[bug]		Direct SIG/RRSIG queries were not handled correctly.
    1278. 

  1278. 			[RT #21050]
    1279. 

  1279. 

  1280. 2863.	[port]		linux: disable IPv6 PMTUD and use network minimum MTU.
    1281. 

  1281. 			[RT #21056]
    1282. 

  1282. 

  1283. 2862.	[bug]		nsupdate didn't default to the parent zone when
    1284. 

  1284. 			updating DS records. [RT #20896]
    1285. 

  1285. 

  1286. 2861.	[doc]		dnssec-settime man pages didn't correctly document the
    1287. 

  1287. 			inactivation time. [RT #21039]
    1288. 

  1288. 

  1289. 2860.	[bug]		named-checkconf's usage was out of date. [RT #21039]
    1290. 

    1291. 

  1291. 2859.	[bug]		When cancelling validation it was possible to leak
    1292. 

  1292. 			memory. [RT #20800]
    1293. 

  1293. 

  1294. 2858.	[bug]		RTT estimates were not being adjusted on ICMP errors.
    1295. 

  1295. 			[RT #20772]
    1296. 

  1296. 

  1297. 2857.	[bug]		named-checkconf did not fail on a bad trusted key.
    1298. 

  1298. 			[RT #20705]
    1299. 

  1299. 

  1300. 2856.	[bug]		The size of a memory allocation was not always properly
    1301. 

  1301. 			recorded. [RT #20927]
    1302. 

  1302. 

  1303. 2855.	[func]		nsupdate will now preserve the entered case of domain
    1304. 

  1304. 			names in update requests it sends. [RT #20928]
    1305. 

  1305. 

  1306. 2854.	[func]		dig: allow the final soa record in a axfr response to
    1307. 

  1307. 			be suppressed, dig +onesoa. [RT #20929]
    1308. 

  1308. 

  1309. 2853.	[bug]		add_sigs() could run out of scratch space. [RT #21015]
    1310. 

  1310. 

  1311. 2852.	[bug]		Handle broken DNSSEC trust chains better. [RT #15619]
    1312. 

  1312. 

  1313. 2851.	[doc]		nslookup.1, removed <informalexample> from the docbook
    1314. 

  1314. 			source as it produced bad nroff.  [RT #21007]
    1315. 

  1315. 

  1316. 2850.	[bug]		If isc_heap_insert() failed due to memory shortage
    1317. 

  1317. 			the heap would have corrupted entries. [RT #20951]
    1318. 

  1318. 

  1319. 2849.	[bug]		Don't treat errors from the xml2 library as fatal.
    1320. 

  1320. 			[RT #20945]
    1321. 

  1321. 

  1322. 2848.	[doc]		Moved README.dnssec, README.libdns, README.pkcs11 and
    1323. 

  1323. 			README.rfc5011 into the ARM. [RT #20899]
    1324. 

  1324. 

  1325. 2847.	[cleanup]	Corrected usage message in dnssec-settime. [RT #20921]
    1326. 

  1326. 

  1327. 2846.	[bug]		EOF on unix domain sockets was not being handled
    1328. 

  1328. 			correctly. [RT #20731]
    1329. 

  1329. 

  1330. 2845.	[bug]		RFC 5011 client could crash on shutdown. [RT #20903]
    1331. 

  1331. 

  1332. 2844.	[doc]		notify-delay default in ARM was wrong.  It should have
    1333. 

  1333. 			been five (5) seconds.
    1334. 

  1334. 

  1335. 2843.	[func]		Prevent dnssec-keygen and dnssec-keyfromlabel from
    1336. 

  1336. 			creating key files if there is a chance that the new
    1337. 

  1337. 			key ID will collide with an existing one after
    1338. 

  1338. 			either of the keys has been revoked.  (To override
    1339. 

  1339. 			this in the case of dnssec-keyfromlabel, use the -y
    1340. 

  1340. 			option.  dnssec-keygen will simply create a
    1341. 

  1341. 			different, non-colliding key, so an override is
    1342. 

  1342. 			not necessary.) [RT #20838]
    1343. 

  1343. 

  1344. 2842.	[func]		Added "smartsign" and improved "autosign" and
    1345. 

  1345. 			"dnssec" regression tests. [RT #20865]
    1346. 

  1346. 

  1347. 2841.	[bug]		Change 2836 was not complete. [RT #20883]
    1348. 

  1348. 

  1349. 2840.	[bug]		Temporary fixed pkcs11-destroy usage check.
    1350. 

  1350. 			[RT #20760]
    1351. 

  1351. 

  1352. 2839.	[bug]		A KSK revoked by named could not be deleted.
    1353. 

  1353. 			[RT #20881]
    1354. 

  1354. 

  1355. 2838.	[placeholder]
    1356. 

  1356. 

  1357. 2837.	[port]		Prevent Linux spurious warnings about fwrite().
    1358. 

  1358. 			[RT #20812]
    1359. 

  1359. 

  1360. 2836.	[bug]		Keys that were scheduled to become active could
    1361. 

  1361. 			be delayed. [RT #20874]
    1362. 

  1362. 

  1363. 2835.	[bug]		Key inactivity dates were inadvertently stored in
    1364. 

  1364. 			the private key file with the outdated tag
    1365. 

  1365. 			"Unpublish" rather than "Inactive".  This has been
    1366. 

  1366. 			fixed; however, any existing keys that had Inactive
    1367. 

  1367. 			dates set will now need to have them reset, using
    1368. 

  1368. 			'dnssec-settime -I'. [RT #20868]
    1369. 

  1369. 

  1370. 2834.	[bug]		HMAC-SHA* keys that were longer than the algorithm
    1371. 

  1371. 			digest length were used incorrectly, leading to
    1372. 

  1372. 			interoperability problems with other DNS
    1373. 

  1373. 			implementations.  This has been corrected.
    1374. 

  1374. 			(Note: If an oversize key is in use, and
    1375. 

  1375. 			compatibility is needed with an older release of
    1376. 

  1376. 			BIND, the new tool "isc-hmac-fixup" can convert
    1377. 

  1377. 			the key secret to a form that will work with all
    1378. 

  1378. 			versions.) [RT #20751]
    1379. 

  1379. 

  1380. 2833.	[cleanup]	Fix usage messages in dnssec-keygen and dnssec-settime.
    1381. 

  1381. 			[RT #20851]
    1382. 

  1382. 

  1383. 2832.	[bug]		Modify "struct stat" in lib/export/samples/nsprobe.c
    1384. 

  1384. 			to avoid redefinition in some OSs [RT 20831]
    1385. 

  1385. 

  1386. 2831.	[security]	Do not attempt to validate or cache
    1387. 

  1387. 			out-of-bailiwick data returned with a secure
    1388. 

  1388. 			answer; it must be re-fetched from its original
    1389. 

  1389. 			source and validated in that context. [RT #20819]
    1390. 

  1390. 

  1391. 2830.	[bug]		Changing the OPTOUT setting could take multiple
    1392. 

  1392. 			passes. [RT #20813]
    1393. 

  1393. 

  1394. 2829.	[bug]		Fixed potential node inconsistency in rbtdb.c.
    1395. 

  1395. 			[RT #20808]
    1396. 

  1396. 

  1397. 2828.	[security]	Cached CNAME or DNAME RR could be returned to clients
    1398. 

  1398. 			without DNSSEC validation. [RT #20737]
    1399. 

  1399. 

  1400. 2827.	[security]	Bogus NXDOMAIN could be cached as if valid. [RT #20712]
    1401. 

  1401. 

  1402. 2826.	[bug]		NSEC3->NSEC transitions could fail due to a lock not
    1403. 

  1403. 			being released.  [RT #20740]
    1404. 

  1404. 

  1405. 2825.	[bug]		Changing the setting of OPTOUT in a NSEC3 chain that
    1406. 

  1406. 			was in the process of being created was not properly
    1407. 

  1407. 			recorded in the zone. [RT #20786]
    1408. 

  1408. 

  1409. 2824.	[bug]		"rndc sign" was not being run by the correct task.
    1410. 

  1410. 			[RT #20759]
    1411. 

  1411. 

  1412. 2823.	[bug]		rbtdb.c:getsigningtime() was missing locks. [RT #20781]
    1413. 

  1413. 

  1414. 2822.	[bug]		rbtdb.c:loadnode() could return the wrong result.
    1415. 

  1415. 			[RT #20802]
    1416. 

  1416. 

  1417. 2821.	[doc]		Add note that named-checkconf doesn't automatically
    1418. 

  1418. 			read rndc.key and bind.keys [RT #20758]
    1419. 

  1419. 

  1420. 2820.	[func]		Handle read access failure of OpenSSL configuration
    1421. 

  1421. 			file more user friendly (PKCS#11 engine patch).
    1422. 

  1422. 			[RT #20668]
    1423. 

  1423. 

  1424. 2819.	[cleanup]	Removed unnecessary DNS_POINTER_MAXHOPS define.
    1425. 

  1425. 			[RT #20771]
    1426. 

  1426. 

  1427. 2818.	[cleanup]	rndc could return an incorrect error code
    1428. 

  1428. 			when a zone was not found. [RT #20767]
    1429. 

  1429. 

  1430. 2817.	[cleanup]	Removed unnecessary isc_task_endexclusive() calls.
    1431. 

  1431. 			[RT #20768]
    1432. 

  1432. 

  1433. 2816.	[bug]		previous_closest_nsec() could fail to return
    1434. 

  1434. 			data for NSEC3 nodes [RT #29730]
    1435. 

  1435. 

  1436. 2815.	[bug]		Exclusively lock the task when freezing a zone.
    1437. 

  1437. 			[RT #19838]
    1438. 

  1438. 

  1439. 2814.	[func]		Provide a definitive error message when a master
    1440. 

  1440. 			zone is not loaded. [RT #20757]
    1441. 

  1441. 

  1442. 2813.	[bug]		Better handling of unreadable DNSSEC key files.
    1443. 

  1443. 			[RT #20710]
    1444. 

  1444. 

  1445. 2812.	[bug]		Make sure updates can't result in a zone with
    1446. 

  1446. 			NSEC-only keys and NSEC3 records. [RT #20748]
    1447. 

  1447. 

  1448. 2811.	[cleanup]	Add "rndc sign" to list of commands in rndc usage
    1449. 

  1449. 			output. [RT #20733]
    1450. 

  1450. 

  1451. 2810.	[doc]		Clarified the process of transitioning an NSEC3 zone
    1452. 

  1452. 			to insecure. [RT #20746]
    1453. 

  1453. 

  1454. 2809.	[cleanup]	Restored accidentally-deleted text in usage output
    1455. 

  1455. 			in dnssec-settime and dnssec-revoke [RT #20739]
    1456. 

  1456. 

  1457. 2808.	[bug]		Remove the attempt to install atomic.h from lib/isc.
    1458. 

  1458. 			atomic.h is correctly installed by the architecture
    1459. 

  1459. 			specific subdirectories.  [RT #20722]
    1460. 

  1460. 

  1461. 2807.	[bug]		Fixed a possible ASSERT when reconfiguring zone
    1462. 

  1462. 			keys. [RT #20720]
    1463. 

  1463. 

  1464. 	--- 9.7.0rc1 released ---
    1465. 

  1465. 

  1466. 2806.	[bug]		"rdnc sign" could delay re-signing the DNSKEY
    1467. 

  1467. 			when it had changed. [RT #20703]
    1468. 

  1468. 

  1469. 2805.	[bug]		Fixed namespace problems encountered when building
    1470. 

  1470. 			external programs using non-exported BIND9 libraries
    1471. 

  1471. 			(i.e., built without --enable-exportlib). [RT #20679]
    1472. 

  1472. 

  1473. 2804.	[bug]		Send notifies when a zone is signed with "rndc sign"
    1474. 

  1474. 			or as a result of a scheduled key change. [RT #20700]
    1475. 

  1475. 

  1476. 2803.	[port]		win32: Install named-journalprint, nsec3hash, arpaname
    1477. 

  1477. 			and genrandom under windows. [RT #20670]
    1478. 

  1478. 

  1479. 2802.	[cleanup]	Rena…
    1480.