-
Notifications
You must be signed in to change notification settings - Fork 1
/
CHANGES
15544 lines (10718 loc) · 513 KB
/
CHANGES
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
4708. [cleanup] Legacy Windows builds (i.e. for XP and earlier)
are no longer supported. [RT #45186]
4707. [func] The lightweight resolver daemon and library (lwresd
and liblwres) have been removed. [RT #45186]
4706. [func] Code implementing name server query processing has
been moved from bin/named to a new library "libns".
Functions remaining in bin/named are now prefixed
with "named_" rather than "ns_". This will make it
easier to write unit tests for name server code, or
link name server functionality into new tools.
[RT #45186]
4705. [placeholder]
4704. [cleanup] Silence Visual Studio compiler warnings. [RT #45898]
4703. [bug] BINDInstall.exe was missing some buffer length checks.
[RT #45898]
4702. [func] Update function declarations to use
dns_masterstyle_flags_t for style flags. [RT #45924]
4701. [cleanup] Refactored lib/dns/tsig.c to reduce code
duplication and simplify the disabling of MD5.
[RT #45490]
4700. [func] Serving of stale answers is now supported. This
allows named to provide stale cached answers when
the authoritative server is under attack.
See max-stale-ttl, stale-answer-enable,
stale-answer-ttl. [RT #44790]
4699. [func] Multiple cookie-secret clauses can now be specified.
The first one specified is used to generate new
server cookies. [RT #45672]
4698. [port] Add --with-python-install-dir configure option to allow
specifying a nonstandard installation directory for
Python modules. [RT #45407]
4697. [bug] Restore workaround for Microsoft Windows TSIG hash
computation bug. [RT #45854]
4696. [port] Enable filter-aaaa support by default on Windows
builds. [RT #45883]
4695. [bug] cookie-secrets were not being properly checked by
named-checkconf. [RT #45886]
4694. [func] dnssec-keygen no longer uses RSASHA1 by default;
the signing algorithm must be specified on
the command line with the "-a" option. Signing
scripts that rely on the existing default behavior
will break; use "dnssec-keygen -a RSASHA1" to
repair them. (The goal of this change is to make
it easier to find scripts using RSASHA1 so they
can be changed in the event of that algorithm
being deprecated in the future.) [RT #44755]
4693. [func] Synthesis of responses from DNSSEC-verified records.
Stage 1 covers NXDOMAIN synthesis from NSEC records.
This is controlled by synth-from-dnssec and is enabled
by default. [RT #40138]
4692. [bug] Fix build failures with libressl introduced in 4676.
[RT #45879]
4691. [func] Add -4/-6 command line options to nsupdate and rndc.
[RT #45632]
4690. [bug] Command line options -4/-6 were handled inconsistently
between tools. [RT #45632]
4689. [cleanup] Turn on minimal responses for CDNSKEY and CDS in
addition to DNSKEY and DS. Thanks to Tony Finch.
[RT #45690]
4688. [protocol] Check and display EDNS KEY TAG options (RFC 8145) in
messages. [RT #44804]
4687. [func] Refactor tracklines code. [RT #45126]
4686. [bug] dnssec-settime -p could print a bogus warning about
key deletion scheduled before its inactivation when a
key had an inactivation date set but no deletion date
set. [RT #45807]
4685. [bug] dnssec-settime incorrectly calculated publication and
activation dates for a successor key. [RT #45806]
4684. [bug] delv could send bogus DNS queries when an explicit
server address was specified on the command line along
with -4/-6. [RT #45804]
4683. [bug] Prevent nsupdate from immediately exiting on invalid
user input in interactive mode. [RT #28194]
4682. [bug] Don't report errors on records below a DNAME.
[RT #44880]
4681. [bug] Log messages from the validator now include the
associated view unless the view is "_default/IN"
or "_dnsclient/IN". [RT #45770]
4680. [bug] Fix failing over to another master server address when
nsupdate is used with GSS-API. [RT #45380]
4679. [cleanup] Suggest using -o when dnssec-verify finds a SOA record
not at top of zone and -o is not used. [RT #45519]
4678. [bug] geoip-use-ecs has the wrong type when geoip support
is disabled at configure time. [RT #45763]
4677. [cleanup] Split up the main function in dig to better support
the iOS app version. [RT #45508]
4676. [cleanup] Allow BIND to be built using OpenSSL 1.0.X with
deprecated functions removed. [RT #45706]
4675. [cleanup] Don't use C++ keyword class. [RT #45726]
4674. [func] "dig +sigchase", and related options "+topdown" and
"+trusted-keys", have been removed. Use "delv" for
queries with DNSSEC validation. [RT #42793]
4673. [port] Silence GCC 7 warnings. [RT #45592]
4672. [placeholder]
4671. [bug] Fix a race condition that could cause the
resolver to crash with assertion failure when
chasing DS in specific conditions with a very
short RTT to the upstream nameserver. [RT #45168]
4670. [cleanup] Ensure that a request MAC is never sent back
in an XFR response unless the signature was
verified. [RT #45494]
4669. [func] Iterative query logic in resolver.c has been
refactored into smaller functions and commented,
for improved readability, maintainability and
testability. [RT #45362]
4668. [bug] Use localtime_r and gmtime_r for thread safety.
[RT #45664]
4667. [cleanup] Refactor RDATA unit tests. [RT #45610]
4666. [bug] dnssec-keymgr: Domain names beginning with digits (0-9)
could cause a parser error when reading the policy
file. This now works correctly so long as the domain
name is quoted. [RT #45641]
4665. [protocol] Added support for ED25519 and ED448 DNSSEC signing
algorithms (RFC 8080). (Note: these algorithms
depend on code currently in the development branch
of OpenSSL which has not yet been released.)
[RT #44696]
4664. [func] Add a "glue-cache" option to enable or disable the
glue cache. The default is "yes". [RT #45125]
4663. [cleanup] Clarify error message printed by dnssec-dsfromkey.
[RT #21731]
4662. [performance] Improve cache memory cleanup of zero TTL records
by putting them at the tail of LRU header lists.
[RT #45274]
4661. [bug] A race condition could occur if a zone was reloaded
while resigning, triggering a crash in
rbtdb.c:closeversion(). [RT #45276]
4660. [bug] Remove spurious "peer" from Windows socket log
messages. [RT #45617]
4659. [bug] Remove spurious log message about lmdb-mapsize
not being supported when parsing builtin
configuration file. [RT #45618]
4658. [bug] Clean up build directory created by "setup.py install"
immediately. [RT #45628]
4657. [bug] rrchecker system test result could be improperly
determined. [RT #45602]
4656. [bug] Apply "port" and "dscp" values specified in catalog
zone's "default-masters" option to the generated
configuration of its member zones. [RT #45545]
4655. [bug] Lack of seccomp could be falsely reported. [RT #45599]
4654. [cleanup] Don't use C++ keywords delete, new and namespace.
[RT #45538]
4653. [bug] Reorder includes to move @DST_OPENSSL_INC@ and
@ISC_OPENSSL_INC@ after shipped include directories.
[RT #45581]
4652. [bug] Nsupdate could attempt to use a zeroed address on
server timeout. [RT #45417]
4651. [test] Silence coverity warnings in tsig_test.c. [RT #45528]
4650. [placeholder]
4649. [bug] The wrong zone was logged when a catalog zone is added.
[RT #45520]
4648. [bug] "rndc reconfig" on a slave no longer causes all member
zones of configured catalog zones to be removed from
configuration. [RT #45310]
4647. [bug] Change 4643 broke verification of TSIG signed TCP
message sequences where not all the messages contain
TSIG records. These may be used in AXFR and IXFR
responses. [RT #45509]
4646. [placeholder]
4645. [bug] Fix PKCS#11 RSA parsing when MD5 is disabled.
[RT #45300]
4644. [placeholder]
4643. [security] An error in TSIG handling could permit unauthorized
zone transfers or zone updates. (CVE-2017-3142)
(CVE-2017-3143) [RT #45383]
4642. [cleanup] Add more logging of RFC 5011 events affecting the
status of managed keys: newly observed keys,
deletion of revoked keys, etc. [RT #45354]
4641. [cleanup] Parallel builds (make -j) could fail with --with-atf /
--enable-developer. [RT #45373]
4640. [bug] If query_findversion failed in query_getdb due to
memory failure the error status was incorrectly
discarded. [RT #45331]
4639. [bug] Fix a regression in --with-tuning reporting introduced
by change 4488. [RT #45396]
4638. [bug] Reloading or reconfiguring named could fail on
some platforms when LMDB was in use. [RT #45203]
4637. [func] "nsec3hash -r" option ("rdata order") takes arguments
in the same order as they appear in NSEC3 or
NSEC3PARAM records, so that NSEC3 parameters can
be cut and pasted from an existing record. Thanks
to Tony Finch for the contribution. [RT #45183]
4636. [bug] Normalize rpz policy zone names when checking for
existence. [RT #45358]
4635. [bug] Fix RPZ NSDNAME logging that was logging
failures as NSIP. [RT #45052]
4634. [contrib] check5011.pl needs to handle optional space before
semi-colon in +multi-line output. [RT #45352]
4633. [maint] Updated AAAA (2001:500:200::b) for B.ROOT-SERVERS.NET.
4632. [security] The BIND installer on Windows used an unquoted
service path, which can enable privilege escalation.
(CVE-2017-3141) [RT #45229]
4631. [security] Some RPZ configurations could go into an infinite
query loop when encountering responses with TTL=0.
(CVE-2017-3140) [RT #45181]
4630. [bug] "dyndb" is dependent on dlopen existing / being
enabled. [RT #45291]
4629. [bug] dns_client_startupdate could not be called with a
running client. [RT #45277]
4628. [bug] Fixed a potential reference leak in query_getdb().
[RT #45247]
4627. [placeholder]
4626. [test] Added more tests for handling of different record
ordering in CNAME and DNAME responses. [QA #430]
4625. [bug] Running "rndc addzone" and "rndc delzone" at close
to the same time could trigger a deadlock if using
LMDB. [RT #45209]
4624. [placeholder]
4623. [bug] Use --with-protobuf-c and --with-libfstrm to find
protoc-c and fstrm_capture. [RT #45187]
4622. [bug] Remove unnecessary escaping of semicolon in CAA and
URI records. [RT #45216]
4621. [port] Force alignment of oid arrays to silence loader
warnings. [RT #45131]
4620. [port] Handle EPFNOSUPPORT being returned when probing
to see if a socket type is supported. [RT #45214]
4619. [bug] Call isc_mem_put instead of isc_mem_free in
bin/named/server.c:setup_newzones. [RT #45202]
4618. [bug] Check isc_mem_strdup results in dns_view_setnewzones.
Add logging for lmdb call failures. [RT #45204]
4617. [test] Update rndc system test to be more delay tolerant.
[RT #45177]
4616. [bug] When using LMDB, zones deleted using "rndc delzone"
were not correctly removed from the new-zone
database. [RT #45185]
4615. [bug] AD could be set on truncated answer with no records
present in the answer and authority sections.
[RT #45140]
4614. [test] Fixed an error in the sockaddr unit test. [RT #45146]
4613. [func] By default, the maximum size of a zone journal file
is now twice the size of the zone's contents (there
is little benefit to a journal larger than this).
This can be overridden by setting "max-journal-size"
to "unlimited" or to an explicit value up to 2G.
Thanks to Tony Finch. [RT #38324]
4612. [bug] Silence 'may be use uninitalised' warning and simplify
the code in lwres/getaddinfo:process_answer.
[RT #45158]
4611. [bug] The default LMDB mapsize was too low and caused
errors after few thousand zones were added using
rndc addzone. A new config option "lmdb-mapsize"
has been introduced to configure the LMDB
mapsize depending on operational needs.
[RT #44954]
4610. [func] The "new-zones-directory" option specifies the
location of NZF or NZD files for storing
configuration of zones added by "rndc addzone".
Thanks to Petr Menšík. [RT #44853]
4609. [cleanup] Rearrange makefiles to enable parallel execution
(i.e. "make -j"). [RT #45078]
4608. [func] DiG now warns about .local queries which are reserved
for Multicast DNS. [RT #44783]
4607. [bug] The memory context's malloced and maxmalloced counters
were being updated without the appropriate lock being
held. [RT #44869]
4606. [port] Stop using experimental "Experimental keys on scalar"
feature of perl as it has been removed. [RT #45012]
4605. [performance] Improve performance for delegation heavy answers
and also general query performance. Removes the
acache feature that didn't significantly improve
performance. Adds a glue cache. Removes
additional-from-cache and additional-from-auth
features. Enables minimal-responses by
default. Improves performance of compression
code, owner case restoration, hash function,
etc. Uses inline buffer implementation by
default. Many other performance changes and fixes.
[RT #44029]
4604. [bug] Don't use ERR_load_crypto_strings() when building
with OpenSSL 1.1.0. [RT #45117]
4603. [doc] Automatically generate named.conf(5) man page
from doc/misc/options. Thanks to Tony Finch.
[RT #43525]
4602. [func] Threads are now set to human-readable
names to assist debugging, when supported by
the OS. [RT #43234]
4601. [bug] Reject incorrect RSA key lengths during key
generation and and sign/verify context
creation. [RT #45043]
4600. [bug] Adjust RPZ trigger counts only when the entry
being deleted exists. [RT #43386]
4599. [bug] Fix inconsistencies in inline signing time
comparison that were introduced with the
introduction of rdatasetheader->resign_lsb.
[RT #42112]
4598. [func] Update fuzzing code to (1) reply to a DNSKEY
query from named with appropriate DNSKEY used in
fuzzing; (2) patch the QTYPE correctly in
resolver fuzzing; (3) comment things so the rest
of us are able to understand how fuzzing is
implemented in named; (4) Coding style changes,
cleanup, etc. [RT #44787]
4597. [bug] The validator now ignores SHA-1 DS digest type
when a DS record with SHA-384 digest type is
present and is a supported digest type.
[RT #45017]
4596. [bug] Validate glue before adding it to the additional
section. This also fixes incorrect TTL capping
when the RRSIG expired earlier than the TTL.
[RT #45062]
4595. [func] dnssec-keygen will no longer generate RSA keys
less than 1024 bits in length. dnssec-keymgr
was similarly updated. [RT #36895]
4594. [func] "dnstap-read -x" prints a hex dump of the wire
format of each logged DNS message. [RT #44816]
4593. [doc] Update README using markdown, remove outdated FAQ
file in favor of the knowledge base.
4592. [bug] A race condition on shutdown could trigger an
assertion failure in dispatch.c. [RT #43822]
4591. [port] Addressed some python 3 compatibility issues.
Thanks to Ville Skytta. [RT #44955] [RT #44956]
4590. [bug] Support for PTHREAD_MUTEX_ADAPTIVE_NP was not being
properly detected. [RT #44871]
4589. [cleanup] "configure -q" is now silent. [RT #44829]
4588. [bug] nsupdate could send queries for TKEY to the wrong
server when using GSSAPI. Thanks to Tomas Hozza.
[RT #39893]
4587. [bug] named-checkzone failed to handle occulted data below
DNAMEs correctly. [RT #44877]
4586. [func] dig, host and nslookup now use TCP for ANY queries.
[RT #44687]
4585. [port] win32: Set CompileAS value. [RT #42474]
4584. [bug] A number of memory usage statistics were not properly
reported when they exceeded 4G. [RT #44750]
4583. [func] "host -A" returns most records for a name but
omits RRSIG, NSEC and NSEC3. (Thanks to Tony Finch.)
[RT #43032]
4582. [security] 'rndc ""' could trigger a assertion failure in named.
(CVE-2017-3138) [RT #44924]
4581. [port] Linux: Add getpid and getrandom to the list of system
calls named uses for seccomp. [RT #44883]
4580. [bug] 4578 introduced a regression when handling CNAME to
referral below the current domain. [RT #44850]
4579. [func] Logging channels and dnstap output files can now
be configured with a "suffix" option, set to
either "increment" or "timestamp", indicating
whether to use incrementing numbers or timestamps
as the file suffix when rolling over a log file.
[RT #42838]
4578. [security] Some chaining (CNAME or DNAME) responses to upstream
queries could trigger assertion failures.
(CVE-2017-3137) [RT #44734]
4577. [func] Make qtype of resolver fuzzing packet configurable
via command line. [RT #43540]
4576. [func] The RPZ implementation has been substantially
refactored for improved performance and reliability.
[RT #43449]
4575. [security] DNS64 with "break-dnssec yes;" can result in an
assertion failure. (CVE-2017-3136) [RT #44653]
4574. [bug] Dig leaked memory with multiple +subnet options.
[RT #44683]
4573. [func] Query logic has been substantially refactored (e.g.
query_find function has been split into smaller
functions) for improved readability, maintainability
and testability. [RT #43929]
4572. [func] The "dnstap-output" option can now take "size" and
"versions" parameters to indicate the maximum size
a dnstap log file can grow before rolling to a new
file, and how many old files to retain. [RT #44502]
4571. [bug] Out-of-tree builds of backtrace_test failed.
4570. [cleanup] named did not correctly fall back to the built-in
initializing keys if the bind.keys file was present
but empty. [RT #44531]
4569. [func] Store both local and remote addresses in dnstap
logging, and modify dnstap-read output format to
print them. [RT #43595]
4568. [contrib] Added a --with-bind option to the dnsperf configure
script to specify BIND prefix path.
4567. [port] Call getprotobyname and getservbyname prior to calling
chroot so that shared libraries get loaded. [RT #44537]
4566. [func] Query logging now includes the ECS option if one
was included in the query. [RT #44476]
4565. [cleanup] The inline macro versions of isc_buffer_put*()
did not implement automatic buffer reallocation.
[RT #44216]
4564. [maint] Update the built in managed keys to include the
upcoming root KSK. [RT #44579]
4563. [bug] Modified zones would occasionally fail to reload.
[RT #39424]
4562. [func] Add additional memory statistics currently malloced
and maxmalloced per memory context. [RT #43593]
4561. [port] Silence a warning in strict C99 compilers. [RT #44414]
4560. [bug] mdig: add -m option to enable memory debugging rather
than having it on all the time. [RT #44509]
4559. [bug] openssl_link.c didn't compile if ISC_MEM_TRACKLINES
was turned off. [RT #44509]
4558. [bug] Synthesised CNAME before matching DNAME was still
being cached when it should not have been. [RT #44318]
4557. [security] Combining dns64 and rpz can result in dereferencing
a NULL pointer (read). (CVE-2017-3135) [RT#44434]
4556. [bug] Sending an EDNS Padding option using "dig
+ednsopt" could cause a crash in dig. [RT #44462]
4555. [func] dig +ednsopt: EDNS options can now be specified by
name in addition to numeric value. [RT #44461]
4554. [bug] Remove double unlock in dns_dispatchmgr_setudp.
[RT #44336]
4553. [bug] Named could deadlock there were multiple changes to
NSEC/NSEC3 parameters for a zone being processed at
the same time. [RT #42770]
4552. [bug] Named could trigger a assertion when sending notify
messages. [RT #44019]
4551. [test] Add system tests for integrity checks of MX and
SRV records. [RT #43953]
4550. [cleanup] Increased the number of available master file
output style flags from 32 to 64. [RT #44043]
4549. [func] Added support for the EDNS TCP Keepalive option
(RFC 7828). [RT #42126]
4548. [func] Added support for the EDNS Padding option (RFC 7830).
[RT #42094]
4547. [port] Add support for --enable-native-pkcs11 on the AEP
Keyper HSM. [RT #42463]
4546. [func] Extend the use of const declarations. [RT #43379]
4545. [func] Expand YAML output from dnstap-read to include
a detailed breakdown of the DNS message contents.
[RT #43642]
4544. [bug] Add message/payload size to dnstap-read YAML output.
[RT #43622]
4543. [bug] dns_client_startupdate now delays sending the update
request until isc_app_ctxrun has been called.
[RT #43976]
4542. [func] Allow rndc to manipulate redirect zones with using
-redirect as the zone name (use "-redirect." to
manipulate a zone named "-redirect"). [RT #43971]
4541. [bug] rndc addzone should properly reject non master/slave
zones. [RT #43665]
4540. [bug] Correctly handle ecs entries in dns_acl_isinsecure.
[RT #43601]
4539. [bug] Referencing a nonexistent zone with RPZ could lead
to a assertion failure when configuring. [RT #43787]
4538. [bug] Call dns_client_startresolve from client->task.
[RT #43896]
4537. [bug] Handle timeouts better in dig/host/nslookup. [RT #43576]
4536. [bug] ISC_SOCKEVENTATTR_USEMINMTU was not being cleared
when reusing the event structure. [RT #43885]
4535. [bug] Address race condition in setting / testing of
DNS_REQUEST_F_SENDING. [RT #43889]
4534. [bug] Only set RD, RA and CD in QUERY responses. [RT #43879]
4533. [bug] dns_client_update should terminate on prerequisite
failures (NXDOMAIN, YXDOMAIN, NXRRSET, YXRRSET)
and also on BADZONE. [RT #43865]
4532. [contrib] Make gen-data-queryperf.py python 3 compatible.
[RT #43836]
4531. [security] 'is_zone' was not being properly updated by redirect2
and subsequently preserved leading to an assertion
failure. (CVE-2016-9778) [RT #43837]
4530. [bug] Change 4489 broke the handling of CNAME -> DNAME
in responses resulting in SERVFAIL being returned.
[RT #43779]
4529. [cleanup] Silence noisy log warning when DSCP probe fails
due to firewall rules. [RT #43847]
4528. [bug] Only set the flag bits for the i/o we are waiting
for on EPOLLERR or EPOLLHUP. [RT #43617]
4527. [doc] Support DocBook XSL Stylesheets v1.79.1. [RT #43831]
4526. [doc] Corrected errors and improved formatting of
grammar definitions in the ARM. [RT #43739]
4525. [doc] Fixed outdated documentation on managed-keys.
[RT #43810]
4524. [bug] The net zero test was broken causing IPv4 servers
with addresses ending in .0 to be rejected. [RT #43776]
4523. [doc] Expand config doc for <querysource4> and
<querysource6>. [RT #43768]
4522. [bug] Handle big gaps in log file version numbers better.
[RT #38688]
4521. [cleanup] Log it as an error if an entropy source is not
found and there is no fallback available. [RT #43659]
4520. [cleanup] Alphabetize more of the grammar when printing it
out. Fix unbalanced indenting. [RT #43755]
4519. [port] win32: handle ERROR_MORE_DATA. [RT #43534]
4518. [func] The "print-time" option in the logging configuration
can now take arguments "local", "iso8601" or
"iso8601-utc" to indicate the format in which the
date and time should be logged. For backward
compatibility, "yes" is a synonym for "local".
[RT #42585]
4517. [security] Named could mishandle authority sections that were
missing RRSIGs triggering an assertion failure.
(CVE-2016-9444) [RT # 43632]
4516. [bug] isc_socketmgr_renderjson was missing from the
windows build. [RT #43602]
4515. [port] FreeBSD: Find readline headers when they are in
edit/readline/ instead of readline/. [RT #43658]
4514. [port] NetBSD: strip -WL, from ld command line. [RT #43204]
4513. [cleanup] Minimum Python versions are now 2.7 and 3.2.
[RT #43566]
4512. [bug] win32: @GEOIP_INC@ missing from delv.vcxproj.in.
[RT #43556]
4511. [bug] win32: mdig.exe-BNFT was missing Configure. [RT #43554]
4510. [security] Named mishandled some responses where covering RRSIG
records are returned without the requested data
resulting in a assertion failure. (CVE-2016-9147)
[RT #43548]
4509. [test] Make the rrl system test more reliable on slower
machines by using mdig instead of dig. [RT #43280]
4508. [security] Named incorrectly tried to cache TKEY records which
could trigger a assertion failure when there was
a class mismatch. (CVE-2016-9131) [RT #43522]
4507. [bug] Named could incorrectly log 'allows updates by IP
address, which is insecure' [RT #43432]
4506. [func] 'named-checkconf -l' will now list the zones found in
named.conf. [RT #43154]
4505. [port] Use IP_PMTUDISC_OMIT if available. [RT #35494]
4504. [security] Allow the maximum number of records in a zone to
be specified. This provides a control for issues
raised in CVE-2016-6170. [RT #42143]
4503. [cleanup] "make uninstall" now removes files installed by
BIND. (This currently excludes Python files
due to lack of support in setup.py.) [RT #42192]
4502. [func] Report multiple and experimental options when printing
grammar. [RT #43134]
4501. [placeholder]
4500. [bug] Support modifier I64 in isc__print_printf. [RT #43526]
4499. [port] MacOSX: silence deprecated function warning
by using arc4random_stir() when available
instead of arc4random_addrandom(). [RT #43503]
4498. [test] Simplify prerequisite checks in system tests.
[RT #43516]
4497. [port] Add support for OpenSSL 1.1.0. [RT #41284]
4496. [func] dig: add +idnout to control whether labels are
display in punycode or not. Requires idn support
to be enabled at compile time. [RT #43398]
4495. [bug] A isc_mutex_init call was not being checked.
[RT #43391]
4494. [bug] Look for <editline/readline.h>. [RT #43429]
4493. [bug] bin/tests/system/dyndb/driver/Makefile.in should use
SO_TARGETS. [RT# 43336]
4492. [bug] irs_resconf_load failed to initialize sortlistnxt
causing bad writes if resolv.conf contained a
sortlist directive. [RT #43459]
4491. [bug] Improve message emitted when testing whether sendmsg
works with TOS/TCLASS fails. [RT #43483]
4490. [maint] Added AAAA (2001:500:12::d0d) for G.ROOT-SERVERS.NET.
4489. [security] It was possible to trigger assertions when processing
a response containing a DNAME answer. (CVE-2016-8864)
[RT #43465]
4488. [port] Darwin: use -framework for Kerberos. [RT #43418]
4487. [test] Make system tests work on Windows. [RT #42931]
4486. [bug] Look in $prefix/lib/pythonX.Y/site-packages for
the python modules we install. [RT #43330]
4485. [bug] Failure to find readline when requested should be
fatal to configure. [RT #43328]
4484. [func] Check prefixes in acls to make sure the address and
prefix lengths are consistent. Warn only in
BIND 9.11 and earlier. [RT #43367]
4483. [bug] Address use before require check and remove extraneous
dns_message_gettsigkey call in dns_tsig_sign.
[RT #43374]
4482. [cleanup] Change #4455 was incomplete. [RT #43252]
4481. [func] dig: make +class, +crypto, +multiline, +rrcomments,
+onesoa, +qr, +ttlid, +ttlunits and -u per lookup
rather than global. [RT #42450]
4480. [placeholder]
4479. [placeholder]
4478. [func] Add +continue option to mdig, allow continue on socket
errors. [RT #43281]
4477. [test] Fix mkeys test timing issues. [RT #41028]
4476. [test] Fix reclimit test on slower machines. [RT #43283]
4475. [doc] Update named-checkconf documentation. [RT #43153]
4474. [bug] win32: call WSAStartup in fromtext_in_wks so that
getprotobyname and getservbyname work. [RT #43197]
4473. [bug] Only call fsync / _commit on regular files. [RT #43196]
4472. [bug] Named could fail to find the correct NSEC3 records when
a zone was updated between looking for the answer and
looking for the NSEC3 records proving nonexistence
of the answer. [RT #43247]
--- 9.11.0 released ---
--- 9.11.0rc3 released ---
4471. [cleanup] Render client/query logging format consistent for
ease of log file parsing. (Note that this affects
"querylog" format: there is now an additional field
indicating the client object address.) [RT #43238]
4470. [bug] Reset message with intent parse before
calling dns_dispatch_getnext. [RT #43229]
4469. [placeholder]
--- 9.11.0rc2 released ---
4468. [bug] Address ECS option handling issues. [RT #43191]
4467. [security] It was possible to trigger an assertion when
rendering a message. (CVE-2016-2776) [RT #43139]
4466. [bug] Interface scanning didn't work on a Windows system
without a non local IPv6 addresses. [RT #43130]
4465. [bug] Don't use "%z" as Windows doesn't support it.
[RT #43131]
4464. [bug] Fix windows python support. [RT #43173]
4463. [bug] The dnstap system test failed on some systems.
[RT #43129]
4462. [bug] Don't describe a returned EDNS COOKIE as "good"
when there isn't a valid server cookie. [RT #43167]
4461. [bug] win32: not all external data was properly marked
as external data for windows dll. [RT #43161]
--- 9.11.0rc1 released ---
4460. [test] Add system test for dnstap using unix domain sockets.
[RT #42926]
4459. [bug] TCP client objects created to handle pipeline queries
were not cleaned up correctly, causing uncontrolled
memory growth. [RT #43106]
4458. [cleanup] Update assertions to be more correct, and also remove
use of a reserved word. [RT #43090]
4457. [maint] Added AAAA (2001:500:a8::e) for E.ROOT-SERVERS.NET.
4456. [doc] Add DOCTYPE and lang attribute to <html> tags.
[RT #42587]
4455. [cleanup] Allow dyndb modules to correctly log the filename
and line number when processing configuration text
from named.conf. [RT #43050]
4454. [bug] 'rndc dnstap -reopen' had a race issue. [RT #43089]
4453. [bug] Prefetching of DS records failed to update their
RRSIGs. [RT #42865]
4452. [bug] The default key manager policy file is now
<sysdir>/dnssec-policy.conf (usually
/etc/dnssec-policy.conf). [RT #43064]
4451. [cleanup] Log more useful information if a PKCS#11 provider
library cannot be loaded. [RT #43076]
4450. [port] Provide more nuanced HSM support which better matches
the specific PKCS11 providers capabilities. [RT #42458]
4449. [test] Fix catalog zones test on slower systems. [RT #42997]
4448. [bug] win32: ::1 was not being found when iterating
interfaces. [RT #42993]
4447. [tuning] Allow the fstrm_iothr_init() options to be set using
named.conf to control how dnstap manages the data
flow. [RT #42974]
4446. [bug] The cache_find() and _findrdataset() functions
could find rdatasets that had been marked stale.
[RT #42853]
4445. [cleanup] isc_errno_toresult() can now be used to call the
formerly private function isc__errno2result().
[RT #43050]
4444. [bug] Fixed some issues related to dyndb: A bug caused
braces to be omitted when passing configuration text
from named.conf to a dyndb driver, and there was a
use-after-free in the sample dyndb driver. [RT #43050]
4443. [func] Set TCP_MAXSEG in addition to IPV6_USE_MIN_MTU on
TCP sockets. [RT #42864]
4442. [bug] Fix RPZ CIDR tree insertion bug that corrupted
tree data structure with overlapping networks
(longest prefix match was ineffective).
[RT #43035]
4441. [cleanup] Alphabetize host's help output. [RT #43031]
4440. [func] Enable TCP fast open support when available on the
server side. [RT #42866]
4439. [bug] Address race conditions getting ownernames of nodes.
[RT #43005]
4438. [func] Use LIFO rather than FIFO when processing startup
notify and refresh queries. [RT #42825]
4437. [func] Minimal-responses now has two additional modes
no-auth and no-auth-recursive which suppress
adding the NS records to the authority section
as well as the associated address records for the
nameservers. [RT #42005]
4436. [func] Return TLSA records as additional data for MX and SRV
lookups. [RT #42894]
4435. [tuning] Only set IPV6_USE_MIN_MTU for UDP when the message
will not fit into a single IPv4 encapsulated IPv6
UDP packet when transmitted over a Ethernet link.
[RT #42871]
4434. [protocol] Return EDNS EXPIRE option for master zones in addition
to slave zones. [RT #43008]
4433. [cleanup] Report an error when passing an invalid option or
view name to "rndc dumpdb". [RT #42958]
4432. [test] Hide rndc output on expected failures in logfileconfig
system test. [RT #27996]
4431. [bug] named-checkconf now checks the rate-limit clause.
[RT #42970]
4430. [bug] Lwresd died if a search list was not defined.
Found by 0x710DDDD At Alibaba Security. [RT #42895]
4429. [bug] Address potential use after free on fclose() error.
[RT #42976]
4428. [bug] The "test dispatch getnext" unit test could fail
in a threaded build. [RT #42979]
4427. [bug] The "query" and "response" parameters to the
"dnstap" option had their functions reversed.
--- 9.11.0b3 released ---
4426. [bug] Addressed Coverity warnings. [RT #42908]
4425. [bug] arpaname, dnstap-read and named-rrchecker were not
being installed into ${prefix}/bin. Tidy up
installation issues with CHANGE 4421. [RT #42910]
4424. [experimental] Named now sends _ta-XXXX.<trust-anchor>/NULL queries
to provide feedback to the trust-anchor administrators
about how key rollovers are progressing as per
draft-ietf-dnsop-edns-key-tag-02. This can be
disabled using 'trust-anchor-telemetry no;'.
[RT #40583]
4423. [maint] Added missing IPv6 address 2001:500:84::b for
B.ROOT-SERVERS.NET. [RT #42898]
4422. [port] Silence clang warnings in dig.c and dighost.c.
[RT #42451]
4421. [func] When built with LMDB (Lightning Memory-mapped
Database), named will now use a database to store
the configuration for zones added by "rndc addzone"
instead of using a flat NZF file. This improves
performance of "rndc delzone" and "rndc modzone"
significantly. Existing NZF files will
automatically by converted to NZD databases.
To view the contents of an NZD or to roll back to
NZF format, use "named-nzd2nzf". To disable
this feature, use "configure --without-lmdb".
[RT #39837]
4420. [func] nslookup now looks for AAAA as well as A by default.
[RT #40420]
4419. [bug] Don't cause undefined result if the label of an
entry in catalog zone is changed. [RT #42708]
4418. [bug] Fix a compiler warning in GSSAPI code. [RT #42879]
4417. [bug] dnssec-keymgr could fail to create successor keys
if the prepublication interval was set to a value
smaller than the default. [RT #42820]
4416. [bug] dnssec-keymgr: Domain names in policy files could