-
Notifications
You must be signed in to change notification settings - Fork 2
/
CHANGES
8005 lines (5442 loc) · 260 KB
/
CHANGES
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
--- 9.6.0-P1 released ---
2522. [security] Handle -1 from DSA_do_verify() and EVP_verify().
--- 9.6.0 released ---
2520. [bug] Update xml statistics version number to 2.0 as change
#2388 made the schema incompatible to the previous
version. [RT #19080]
--- 9.6.0rc2 released ---
2515. [port] win32: build dnssec-dsfromkey and dnssec-keyfromlabel.
[RT #19063]
2513 [bug] Fix windows cli build. [RT #19062]
2510. [bug] "dig +sigchase" could trigger REQUIRE failures.
[RT #19033]
2509. [bug] Specifying a fixed query source port was broken.
[RT #19051]
2504. [bug] Address race condition in the socket code. [RT #18899]
--- 9.6.0rc1 released ---
2498. [bug] Removed a bogus function argument used with
ISC_SOCKET_USE_POLLWATCH: it could cause compiler
warning or crash named with the debug 1 level
of logging. [RT #18917]
2497. [bug] Don't add RRSIG bit to NSEC3 bit map for insecure
delegation.
2496. [bug] Add sanity length checks to NSID option. [RT #18813]
2495. [bug] Tighten RRSIG checks. [RT #18795]
2494. [bug] isc/radix.h, dns/sdlz.h and dns/dlz.h were not being
installed. [RT #18826]
2493. [bug] The linux capabilities code was not correctly cleaning
up after itself. [RT #18767]
2492. [func] Rndc status now reports the number of cpus discovered
and the number of worker threads when running
multi-threaded. [RT #18273]
2491. [func] Attempt to re-use a local port if we are already using
the port. [RT #18548]
2490. [port] aix: work around a kernel bug where IPV6_RECVPKTINFO
is cleared when IPV6_V6ONLY is set. [RT #18785]
2489. [port] solaris: Workaround Solaris's kernel bug about
/dev/poll:
http://bugs.opensolaris.org/view_bug.do?bug_id=6724237
Define ISC_SOCKET_USE_POLLWATCH at build time to enable
this workaround. [RT #18870]
2488. [func] Added a tool, dnssec-dsfromkey, to generate DS records
from keyset and .key files. [RT #18694]
2487. [bug] Give TCP connections longer to complete. [RT #18675]
2486. [func] The default locations for named.pid and lwresd.pid
are now /var/run/named/named.pid and
/var/run/lwresd/lwresd.pid respectively.
This allows the owner of the containing directory
to be set, for "named -u" support, and allows there
to be a permanent symbolic link in the path, for
"named -t" support. [RT #18306]
2485. [bug] Change update's the handling of obscured RRSIG
records. Not all orphaned DS records were being
removed. [RT #18828]
2484. [bug] It was possible to trigger a REQUIRE failure when
adding NSEC3 proofs to the response in
query_addwildcardproof(). [RT #18828]
2483. [port] win32: chroot() is not supported. [RT #18805]
2482. [port] libxml2: support versions 2.7.* in addition
to 2.6.*. [RT #18806]
--- 9.6.0b1 released ---
2481. [bug] rbtdb.c:matchparams() failed to handle NSEC3 chain
collisions. [RT #18812]
2480. [bug] named could fail to emit all the required NSEC3
records. [RT #18812]
2479. [bug] xfrout:covers was not properly initialized. [RT #18801]
2478. [bug] 'addresses' could be used uninitialized in
configure_forward(). [RT #18800]
2477. [bug] dig: the global option to print the command line is
+cmd not print_cmd. Update the output to reflect
this. [RT #17008]
2476. [doc] ARM: improve documentation for max-journal-size and
ixfr-from-differences. [RT #15909] [RT #18541]
2475. [bug] LRU cache cleanup under overmem condition could purge
particular entries more aggressively. [RT #17628]
2474. [bug] ACL structures could be allocated with insufficient
space, causing an array overrun. [RT #18765]
2473. [port] linux: raise the limit on open files to the possible
maximum value before spawning threads; 'files'
specified in named.conf doesn't seem to work with
threads as expected. [RT #18784]
2472. [port] linux: check the number of available cpu's before
calling chroot as it depends on "/proc". [RT #16923]
2471. [bug] named-checkzone was not reporting missing mandatory
glue when sibling checks were disabled. [RT #18768]
2470. [bug] Elements of the isc_radix_node_t could be incorrectly
overwritten. [RT# 18719]
2469. [port] solaris: Work around Solaris's select() limitations.
[RT #18769]
2468. [bug] Resolver could try unreachable servers multiple times.
[RT #18739]
2467. [bug] Failure of fcntl(F_DUPFD) wasn't logged. [RT #18740]
2466. [doc] ARM: explain max-cache-ttl 0 SERVFAIL issue.
[RT #18302]
2465. [bug] Adb's handling of lame addresses was different
for IPv4 and IPv6. [RT #18738]
2464. [port] linux: check that a capability is present before
trying to set it. [RT #18135]
2463. [port] linux: POSIX doesn't include the IPv6 Advanced Socket
API and glibc hides parts of the IPv6 Advanced Socket
API as a result. This is stupid as it breaks how the
two halves (Basic and Advanced) of the IPv6 Socket API
were designed to be used but we have to live with it.
Define _GNU_SOURCE to pull in the IPv6 Advanced Socket
API. [RT #18388]
2462. [doc] Document -m (enable memory usage debugging)
option for dig. [RT #18757]
2461. [port] sunos: Change #2363 was not complete. [RT #17513]
--- 9.6.0a1 released ---
2460. [bug] Don't call dns_db_getnsec3parameters() on the cache.
[RT #18697]
2459. [contrib] Import dnssec-zkt to contrib/zkt. [RT #18448]
2458. [doc] ARM: update and correction for max-cache-size.
[RT #18294]
2457. [tuning] max-cache-size is reverted to 0, the previous
default. It should be safe because expired cache
entries are also purged. [RT #18684]
2456. [bug] In ACLs, ::/0 and 0.0.0.0/0 would both match any
address, regardless of family. They now correctly
distinguish IPv4 from IPv6. [RT #18559]
2455. [bug] Stop metadata being transferred via axfr/ixfr.
[RT #18639]
2454. [func] nsupdate: you can now set a default ttl. [RT #18317]
2453. [bug] Remove NULL pointer dereference in dns_journal_print().
[RT #18316]
2452. [func] Improve bin/test/journalprint. [RT #18316]
2451. [port] solaris: handle runtime linking better. [RT #18356]
2450. [doc] Fix lwresd docbook problem for manual page.
[RT #18672]
2449. [placeholder]
2448. [func] Add NSEC3 support. [RT #15452]
2447. [cleanup] libbind has been split out as a separate product.
2446. [func] Add a new log message about build options on startup.
A new command-line option '-V' for named is also
provided to show this information. [RT# 18645]
2445. [doc] ARM out-of-date on empty reverse zones (list includes
RFC1918 address, but these are not yet compiled in).
[RT #18578]
2444. [port] Linux, FreeBSD, AIX: Turn off path mtu discovery
(clear DF) for UDP responses and requests.
2443. [bug] win32: UDP connect() would not generate an event,
and so connected UDP sockets would never clean up.
Fix this by doing an immediate WSAConnect() rather
than an io completion port type for UDP.
2442. [bug] A lock could be destroyed twice. [RT# 18626]
2441. [bug] isc_radix_insert() could copy radix tree nodes
incompletely. [RT #18573]
2440. [bug] named-checkconf used an incorrect test to determine
if an ACL was set to none.
2439. [bug] Potential NULL dereference in dns_acl_isanyornone().
[RT #18559]
2438. [bug] Timeouts could be logged incorrectly under win32.
2437. [bug] Sockets could be closed too early, leading to
inconsistent states in the socket module. [RT #18298]
2436. [security] win32: UDP client handler can be shutdown. [RT #18576]
2435. [bug] Fixed an ACL memory leak affecting win32.
2434. [bug] Fixed a minor error-reporting bug in
lib/isc/win32/socket.c.
2433. [tuning] Set initial timeout to 800ms.
2432. [bug] More Windows socket handling improvements. Stop
using I/O events and use IO Completion Ports
throughout. Rewrite the receive path logic to make
it easier to support multiple simultaneous
requesters in the future. Add stricter consistency
checking as a compile-time option (define
ISC_SOCKET_CONSISTENCY_CHECKS; defaults to off).
2431. [bug] Acl processing could leak memory. [RT #18323]
2430. [bug] win32: isc_interval_set() could round down to
zero if the input was less than NS_INTERVAL
nanoseconds. Round up instead. [RT #18549]
2429. [doc] nsupdate should be in section 1 of the man pages.
[RT #18283]
2428. [bug] dns_iptable_merge() mishandled merges of negative
tables. [RT #18409]
2427. [func] Treat DNSKEY queries as if "minimal-response yes;"
was set. [RT #18528]
2426. [bug] libbind: inet_net_pton() can sometimes return the
wrong value if excessively large net masks are
supplied. [RT #18512]
2425. [bug] named didn't detect unavailable query source addresses
at load time. [RT #18536]
2424. [port] configure now probes for a working epoll
implementation. Allow the use of kqueue,
epoll and /dev/poll to be selected at compile
time. [RT #18277]
2423. [security] Randomize server selection on queries, so as to
make forgery a little more difficult. Instead of
always preferring the server with the lowest RTT,
pick a server with RTT within the same 128
millisecond band. [RT #18441]
2422. [bug] Handle the special return value of a empty node as
if it was a NXRRSET in the validator. [RT #18447]
2421. [func] Add new command line option '-S' for named to specify
the max number of sockets. [RT #18493]
Use caution: this option may not work for some
operating systems without rebuilding named.
2420. [bug] Windows socket handling cleanup. Let the io
completion event send out canceled read/write
done events, which keeps us from writing to memory
we no longer have ownership of. Add debugging
socket_log() function. Rework TCP socket handling
to not leak sockets.
2419. [cleanup] Document that isc_socket_create() and isc_socket_open()
should not be used for isc_sockettype_fdwatch sockets.
[RT #18521]
2418. [bug] AXFR request on a DLZ could trigger a REQUIRE failure
[RT #18430]
2417. [bug] Connecting UDP sockets for outgoing queries could
unexpectedly fail with an 'address already in use'
error. [RT #18411]
2416. [func] Log file descriptors that cause exceeding the
internal maximum. [RT #18460]
2415. [bug] 'rndc dumpdb' could trigger various assertion failures
in rbtdb.c. [RT #18455]
2414. [bug] A masterdump context held the database lock too long,
causing various troubles such as dead lock and
recursive lock acquisition. [RT #18311, #18456]
2413. [bug] Fixed an unreachable code path in socket.c. [RT #18442]
2412. [bug] win32: address a resource leak. [RT #18374]
2411. [bug] Allow using a larger number of sockets than FD_SETSIZE
for select(). To enable this, set ISC_SOCKET_MAXSOCKETS
at compilation time. [RT #18433]
Note: with changes #2469 and #2421 above, there is no
need to tweak ISC_SOCKET_MAXSOCKETS at compilation time
any more.
2410. [bug] Correctly delete m_versionInfo. [RT #18432]
2409. [bug] Only log that we disabled EDNS processing if we were
subsequently successful. [RT #18029]
2408. [bug] A duplicate TCP dispatch event could be sent, which
could then trigger an assertion failure in
resquery_response(). [RT #18275]
2407. [port] hpux: test for sys/dyntune.h. [RT #18421]
2406. [placeholder]
2405. [cleanup] The default value for dnssec-validation was changed to
"yes" in 9.5.0-P1 and all subsequent releases; this
was inadvertently omitted from CHANGES at the time.
2404. [port] hpux: files unlimited support.
2403. [bug] TSIG context leak. [RT #18341]
2402. [port] Support Solaris 2.11 and over. [RT #18362]
2401. [bug] Expect to get E[MN]FILE errno internal_accept()
(from accept() or fcntl() system calls). [RT #18358]
2400. [bug] Log if kqueue()/epoll_create()/open(/dev/poll) fails.
[RT #18297]
2399. [placeholder]
2398. [bug] Improve file descriptor management. New,
temporary, named.conf option reserved-sockets,
default 512. [RT #18344]
2397. [bug] gssapi_functions had too many elements. [RT #18355]
2396. [bug] Don't set SO_REUSEADDR for randomized ports.
[RT #18336]
2395. [port] Avoid warning and no effect from "files unlimited"
on Linux when running as root. [RT #18335]
2394. [bug] Default configuration options set the limit for
open files to 'unlimited' as described in the
documentation. [RT #18331]
2393. [bug] nested acls containing keys could trigger an
assertion in acl.c. [RT #18166]
2392. [bug] remove 'grep -q' from acl test script, some platforms
don't support it. [RT #18253]
2391. [port] hpux: cover additional recvmsg() error codes.
[RT #18301]
2390. [bug] dispatch.c could make a false warning on 'odd socket'.
[RT #18301].
2389. [bug] Move the "working directory writable" check to after
the ns_os_changeuser() call. [RT #18326]
2388. [bug] Avoid using tables for layout purposes in
statistics XSL [RT #18159].
2387. [bug] Silence compiler warnings in lib/isc/radix.c.
[RT #18147] [RT #18258]
2386. [func] Add warning about too small 'open files' limit.
[RT #18269]
2385. [bug] A condition variable in socket.c could leak in
rare error handling [RT #17968].
2384. [security] Fully randomize UDP query ports to improve
forgery resilience. [RT #17949, #18098]
2383. [bug] named could double queries when they resulted in
SERVFAIL due to overkilling EDNS0 failure detection.
[RT #18182]
2382. [doc] Add descriptions of DHCID, IPSECKEY, SPF and SSHFP
to ARM.
2381. [port] dlz/mysql: support multiple install layouts for
mysql. <prefix>/include/{,mysql/}mysql.h and
<prefix>/lib/{,mysql/}. [RT #18152]
2380. [bug] dns_view_find() was not returning NXDOMAIN/NXRRSET
proofs which, in turn, caused validation failures
for insecure zones immediately below a secure zone
the server was authoritative for. [RT #18112]
2379. [contrib] queryperf/gen-data-queryperf.py: removed redundant
TLDs and supported RRs with TTLs [RT #17972]
2378. [bug] gssapi_functions{} had a redundant member in BIND 9.5.
[RT #18169]
2377. [bug] Address race condition in dnssec-signzone. [RT #18142]
2376. [bug] Change #2144 was not complete.
2375. [placeholder]
2374. [bug] "blackhole" ACLs could cause named to segfault due
to some uninitialized memory. [RT #18095]
2373. [bug] Default values of zone ACLs were re-parsed each time a
new zone was configured, causing an overconsumption
of memory. [RT #18092]
2372. [bug] Fixed incorrect TAG_HMACSHA256_BITS value [RT #18047]
2371. [doc] Add +nsid option to dig man page. [RT #18039]
2370. [bug] "rndc freeze" could trigger an assertion in named
when called on a nonexistent zone. [RT #18050]
2369. [bug] libbind: Array bounds overrun on read in bitncmp().
[RT #18054]
2368. [port] Linux: use libcap for capability management if
possible. [RT# 18026]
2367. [bug] Improve counting of dns_resstatscounter_retry
[RT #18030]
2366. [bug] Adb shutdown race. [RT #18021]
2365. [bug] Fix a bug that caused dns_acl_isany() to return
spurious results. [RT #18000]
2364. [bug] named could trigger a assertion when serving a
malformed signed zone. [RT #17828]
2363. [port] sunos: pre-set "lt_cv_sys_max_cmd_len=4096;".
[RT #17513]
2362. [cleanup] Make "rrset-order fixed" a compile-time option.
settable by "./configure --enable-fixed-rrset".
Disabled by default. [RT #17977]
2361. [bug] "recursion" statistics counter could be counted
multiple times for a single query. [RT #17990]
2360. [bug] Fix a condition where we release a database version
(which may acquire a lock) while holding the lock.
2359. [bug] Fix NSID bug. [RT #17942]
2358. [doc] Update host's default query description. [RT #17934]
2357. [port] Don't use OpenSSL's engine support in versions before
OpenSSL 0.9.7f. [RT #17922]
2356. [bug] Built in mutex profiler was not scalable enough.
[RT #17436]
2355. [func] Extend the number statistics counters available.
[RT #17590]
2354. [bug] Failed to initialize some rdatasetheader_t elements.
[RT #17927]
2353. [func] Add support for Name Server ID (RFC 5001).
'dig +nsid' requests NSID from server.
'request-nsid yes;' causes recursive server to send
NSID requests to upstream servers. Server responds
to NSID requests with the string configured by
'server-id' option. [RT #17091]
2352. [bug] Various GSS_API fixups. [RT #17729]
2351. [bug] convertxsl.pl generated very long lines. [RT #17906]
2350. [port] win32: IPv6 support. [RT #17797]
2349. [func] Provide incremental re-signing support for secure
dynamic zones. [RT #1091]
2348. [func] Use the EVP interface to OpenSSL. Add PKCS#11 support.
Documentation is in the new README.pkcs11 file.
New tool, dnssec-keyfromlabel, which takes the
label of a key pair in a HSM and constructs a DNS
key pair for use by named and dnssec-signzone.
[RT #16844]
2347. [bug] Delete now traverses the RB tree in the canonical
order. [RT #17451]
2346. [func] Memory statistics now cover all active memory contexts
in increased detail. [RT #17580]
2345. [bug] named-checkconf failed to detect when forwarders
were set at both the options/view level and in
a root zone. [RT #17671]
2344. [bug] Improve "logging{ file ...; };" documentation.
[RT #17888]
2343. [bug] (Seemingly) duplicate IPv6 entries could be
created in ADB. [RT #17837]
2342. [func] Use getifaddrs() if available under Linux. [RT #17224]
2341. [bug] libbind: add missing -I../include for off source
tree builds. [RT #17606]
2340. [port] openbsd: interface configuration. [RT #17700]
2339. [port] tru64: support for libbind. [RT #17589]
2338. [bug] check_ds() could be called with a non DS rdataset.
[RT #17598]
2337. [bug] BUILD_LDFLAGS was not being correctly set. [RT #17614]
2336. [func] If "named -6" is specified then listen on all IPv6
interfaces if there are not listen-on-v6 clauses in
named.conf. [RT #17581]
2335. [port] sunos: libbind and *printf() support for long long.
[RT #17513]
2334. [bug] Bad REQUIRES in fromstruct_in_naptr(), off by one
bug in fromstruct_txt(). [RT #17609]
2333. [bug] Fix off by one error in isc_time_nowplusinterval().
[RT #17608]
2332. [contrib] query-loc-0.4.0. [RT #17602]
2331. [bug] Failure to regenerate any signatures was not being
reported nor being past back to the UPDATE client.
[RT #17570]
2330. [bug] Remove potential race condition when handling
over memory events. [RT #17572]
WARNING: API CHANGE: over memory callback
function now needs to call isc_mem_waterack().
See <isc/mem.h> for details.
2329. [bug] Clearer help text for dig's '-x' and '-i' options.
2328. [maint] Add AAAA addresses for A.ROOT-SERVERS.NET,
F.ROOT-SERVERS.NET, H.ROOT-SERVERS.NET,
J.ROOT-SERVERS.NET, K.ROOT-SERVERS.NET and
M.ROOT-SERVERS.NET.
2327. [bug] It was possible to dereference a NULL pointer in
rbtdb.c. Implement dead node processing in zones as
we do for caches. [RT #17312]
2326. [bug] It was possible to trigger a INSIST in the acache
processing.
2325. [port] Linux: use capset() function if available. [RT #17557]
2324. [bug] Fix IPv6 matching against "any;". [RT #17533]
2323. [port] tru64: namespace clash. [RT #17547]
2322. [port] MacOS: work around the limitation of setrlimit()
for RLIMIT_NOFILE. [RT #17526]
2321. [placeholder]
2320. [func] Make statistics counters thread-safe for platforms
that support certain atomic operations. [RT #17466]
2319. [bug] Silence Coverity warnings in
lib/dns/rdata/in_1/apl_42.c. [RT #17469]
2318. [port] sunos fixes for libbind. [RT #17514]
2317. [bug] "make distclean" removed bind9.xsl.h. [RT #17518]
2316. [port] Missing #include <isc/print.h> in lib/dns/gssapictx.c.
[RT #17513]
2315. [bug] Used incorrect address family for mapped IPv4
addresses in acl.c. [RT #17519]
2314. [bug] Uninitialized memory use on error path in
bin/named/lwdnoop.c. [RT #17476]
2313. [cleanup] Silence Coverity warnings. Handle private stacks.
[RT #17447] [RT #17478]
2312. [cleanup] Silence Coverity warning in lib/isc/unix/socket.c.
[RT #17458]
2311. [bug] IPv6 addresses could match IPv4 ACL entries and
vice versa. [RT #17462]
2310. [bug] dig, host, nslookup: flush stdout before emitting
debug/fatal messages. [RT #17501]
2309. [cleanup] Fix Coverity warnings in lib/dns/acl.c and iptable.c.
[RT #17455]
2308. [cleanup] Silence Coverity warning in bin/named/controlconf.c.
[RT #17495]
2307. [bug] Remove infinite loop from lib/dns/sdb.c. [RT #17496]
2306. [bug] Remove potential race from lib/dns/resolver.c.
[RT #17470]
2305. [security] inet_network() buffer overflow. CVE-2008-0122.
2304. [bug] Check returns from all dns_rdata_tostruct() calls.
[RT #17460]
2303. [bug] Remove unnecessary code from bin/named/lwdgnba.c.
[RT #17471]
2302. [bug] Fix memset() calls in lib/tests/t_api.c. [RT #17472]
2301. [bug] Remove resource leak and fix error messages in
bin/tests/system/lwresd/lwtest.c. [RT #17474]
2300. [bug] Fixed failure to close open file in
bin/tests/names/t_names.c. [RT #17473]
2299. [bug] Remove unnecessary NULL check in
bin/nsupdate/nsupdate.c. [RT #17475]
2298. [bug] isc_mutex_lock() failure not caught in
bin/tests/timers/t_timers.c. [RT #17468]
2297. [bug] isc_entropy_createfilesource() failure not caught in
bin/tests/dst/t_dst.c. [RT #17467]
2296. [port] Allow docbook stylesheet location to be specified to
configure. [RT #17457]
2295. [bug] Silence static overrun error in bin/named/lwaddr.c.
[RT #17459]
2294. [func] Allow the experimental statistics channels to have
multiple connections and ACL.
Note: the stats-server and stats-server-v6 options
available in the previous beta releases are replaced
with the generic statistics-channels statement.
2293. [func] Add ACL regression test. [RT #17375]
2292. [bug] Log if the working directory is not writable.
[RT #17312]
2291. [bug] PR_SET_DUMPABLE may be set too late. Also report
failure to set PR_SET_DUMPABLE. [RT #17312]
2290. [bug] Let AD in the query signal that the client wants AD
set in the response. [RT #17301]
2289. [func] named-checkzone now reports the out-of-zone CNAME
found. [RT #17309]
2288. [port] win32: mark service as running when we have finished
loading. [RT #17441]
2287. [bug] Use 'volatile' if the compiler supports it. [RT #17413]
2286. [func] Allow a TCP connection to be used as a weak
authentication method for reverse zones.
New update-policy methods tcp-self and 6to4-self.
[RT #17378]
2285. [func] Test framework for client memory context management.
[RT #17377]
2284. [bug] Memory leak in UPDATE prerequisite processing.
[RT #17377]
2283. [bug] TSIG keys were not attaching to the memory
context. TSIG keys should use the rings
memory context rather than the clients memory
context. [RT #17377]
2282. [bug] Acl code fixups. [RT #17346] [RT #17374]
2281. [bug] Attempts to use undefined acls were not being logged.
[RT #17307]
2280. [func] Allow the experimental http server to be reached
over IPv6 as well as IPv4. [RT #17332]
2279. [bug] Use setsockopt(SO_NOSIGPIPE), when available,
to protect applications from receiving spurious
SIGPIPE signals when using the resolver.
2278. [bug] win32: handle the case where Windows returns no
search list or DNS suffix. [RT #17354]
2277. [bug] Empty zone names were not correctly being caught at
in the post parse checks. [RT #17357]
2276. [bug] Install <dst/gssapi.h>. [RT# 17359]
2275. [func] Add support to dig to perform IXFR queries over UDP.
[RT #17235]
2274. [func] Log zone transfer statistics. [RT #17336]
2273. [bug] Adjust log level to WARNING when saving inconsistent
stub/slave master and journal files. [RT# 17279]
2272. [bug] Handle illegal dnssec-lookaside trust-anchor names.
[RT #17262]
2271. [bug] Fix a memory leak in http server code [RT #17100]
2270. [bug] dns_db_closeversion() version->writer could be reset
before it is tested. [RT #17290]
2269. [contrib] dbus memory leaks and missing va_end calls. [RT #17232]
2268. [bug] 0.IN-ADDR.ARPA was missing from the empty zones
list.
--- 9.5.0b1 released ---
2267. [bug] Radix tree node_num value could be set incorrectly,
causing positive ACL matches to look like negative
ones. [RT #17311]
2266. [bug] client.c:get_clientmctx() returned the same mctx
once the pool of mctx's was filled. [RT #17218]
2265. [bug] Test that the memory context's basic_table is non NULL
before freeing. [RT #17265]
2264. [bug] Server prefix length was being ignored. [RT #17308]
2263. [bug] "named-checkconf -z" failed to set default value
for "check-integrity". [RT #17306]
2262. [bug] Error status from all but the last view could be
lost. [RT #17292]
2261. [bug] Fix memory leak with "any" and "none" ACLs [RT #17272]
2260. [bug] Reported wrong clients-per-query when increasing the
value. [RT #17236]
2259. [placeholder]
--- 9.5.0a7 released ---
2258. [bug] Fallback from IXFR/TSIG to SOA/AXFR/TSIG broken.
[RT #17241]
2257. [bug] win32: Use the full path to vcredist_x86.exe when
calling it. [RT #17222]
2256. [bug] win32: Correctly register the installation location of
bindevt.dll. [RT #17159]
2255. [maint] L.ROOT-SERVERS.NET is now 199.7.83.42.
2254. [bug] timer.c:dispatch() failed to lock timer->lock
when reading timer->idle allowing it to see
intermediate values as timer->idle was reset by
isc_timer_touch(). [RT #17243]
2253. [func] "max-cache-size" defaults to 32M.
"max-acache-size" defaults to 16M.
2252. [bug] Fixed errors in sortlist code [RT #17216]
2251. [placeholder]
2250. [func] New flag 'memstatistics' to state whether the
memory statistics file should be written or not.
Additionally named's -m option will cause the
statistics file to be written. [RT #17113]
2249. [bug] Only set Authentic Data bit if client requested
DNSSEC, per RFC 3655 [RT #17175]
2248. [cleanup] Fix several errors reported by Coverity. [RT #17160]
2247. [doc] Sort doc/misc/options. [RT #17067]
2246. [bug] Make the startup of test servers (ans.pl) more
robust. [RT #17147]
2245. [bug] Validating lack of DS records at trust anchors wasn't
working. [RT #17151]
2244. [func] Allow the check of nameserver names against the
SOA MNAME field to be disabled by specifying
'notify-to-soa yes;'. [RT #17073]
2243. [func] Configuration files without a newline at the end now
parse without error. [RT #17120]
2242. [bug] nsupdate: GSS-TSIG support using the Heimdal Kerberos
library could require a source of random data.
[RT #17127]
2241. [func] nsupdate: add a interactive 'help' command. [RT #17099]
2240. [bug] Cleanup nsupdates GSS-TSIG support. Convert
a number of INSIST()s into plain fatal() errors
which report the triggering result code.
The 'key' command wasn't disabling GSS-TSIG.
[RT #17099]
2239. [func] Ship a pre built bin/named/bind9.xsl.h. [RT #17114]
2238. [bug] It was possible to trigger a REQUIRE when a
validation was canceled. [RT #17106]
2237. [bug] libbind: res_init() was not thread aware. [RT #17123]
2236. [bug] dnssec-signzone failed to preserve the case of
of wildcard owner names. [RT #17085]
2235. [bug] <isc/atomic.h> was not being installed. [RT #17135]
2234. [port] Correct some compiler warnings on SCO OSr5 [RT #17134]
2233. [func] Add support for O(1) ACL processing, based on
radix tree code originally written by Kevin
Brintnall. [RT #16288]
2232. [bug] dns_adb_findaddrinfo() could fail and return
ISC_R_SUCCESS. [RT #17137]
2231. [bug] Building dlzbdb (contrib/dlz/bin/dlzbdb) was broken.
[RT #17088]
2230. [bug] We could INSIST reading a corrupted journal.
[RT #17132]
2229. [bug] Null pointer dereference on query pool creation
failure. [RT #17133]
2228. [contrib] contrib: Change 2188 was incomplete.
2227. [cleanup] Tidied up the FAQ. [RT #17121]
2226. [placeholder]
2225. [bug] More support for systems with no IPv4 addresses.
[RT #17111]
2224. [bug] Defer journal compaction if a xfrin is in progress.
[RT #17119]
2223. [bug] Make a new journal when compacting. [RT #17119]
2222. [func] named-checkconf now checks server key references.
[RT #17097]
2221. [bug] Set the event result code to reflect the actual
record turned to caller when a cache update is
rejected due to a more credible answer existing.
[RT #17017]
2220. [bug] win32: Address a race condition in final shutdown of
the Windows socket code. [RT #17028]
2219. [bug] Apply zone consistency checks to additions, not
removals, when updating. [RT #17049]
2218. [bug] Remove unnecessary REQUIRE from dns_validator_create().
[RT #16976]
2217. [func] Adjust update log levels. [RT #17092]
2216. [cleanup] Fix a number of errors reported by Coverity.
[RT #17094]
2215. [bug] Bad REQUIRE check isc_hmacsha1_verify(). [RT #17094]
2214. [bug] Deregister OpenSSL lock callback when cleaning
up. Reorder OpenSSL cleanup so that RAND_cleanup()
is called before the locks are destroyed. [RT #17098]
2213. [bug] SIG0 diagnostic failure messages were looking at the
wrong status code. [RT #17101]
2212. [func] 'host -m' now causes memory statistics and active
memory to be printed at exit. [RT 17028]
2211. [func] Update "dynamic update temporarily disabled" message.
[RT #17065]
2210. [bug] Deleting class specific records via UPDATE could
fail. [RT #17074]
2209. [port] osx: linking against user supplied static OpenSSL
libraries failed as the system ones were still being
found. [RT #17078]
2208. [port] win32: make sure both build methods produce the
same output. [RT #17058]
2207. [port] Some implementations of getaddrinfo() fail to set
ai_canonname correctly. [RT #17061]
--- 9.5.0a6 released ---
2206. [security] "allow-query-cache" and "allow-recursion" now
cross inherit from each other.
If allow-query-cache is not set in named.conf then
allow-recursion is used if set, otherwise allow-query
is used if set, otherwise the default (localnets;
localhost;) is used.
If allow-recursion is not set in named.conf then
allow-query-cache is used if set, otherwise allow-query
is used if set, otherwise the default (localnets;
localhost;) is used.
[RT #16987]
2205. [bug] libbind: change #2119 broke thread support. [RT #16982]
2204. [bug] "rndc flushanme name unknown-view" caused named
to crash. [RT #16984]
2203. [security] Query id generation was cryptographically weak.
[RT # 16915]
2202. [security] The default acls for allow-query-cache and
allow-recursion were not being applied. [RT #16960]
2201. [bug] The build failed in a separate object directory.
[RT #16943]
2200. [bug] The search for cached NSEC records was stopping to
early leading to excessive DLV queries. [RT #16930]
2199. [bug] win32: don't call WSAStartup() while loading dlls.
[RT #16911]
2198. [bug] win32: RegCloseKey() could be called when
RegOpenKeyEx() failed. [RT #16911]
2197. [bug] Add INSIST to catch negative responses which are
not setting the event result code appropriately.
[RT #16909]
2196. [port] win32: yield processor while waiting for once to
to complete. [RT #16958]
2195. [func] dnssec-keygen now defaults to nametype "ZONE"
when generating DNSKEYs. [RT #16954]
2194. [bug] Close journal before calling 'done' in xfrin.c.
--- 9.5.0a5 released ---
2193. [port] win32: BINDInstall.exe is now linked statically.
[RT #16906]
2192. [port] win32: use vcredist_x86.exe to install Visual
Studio's redistributable dlls if building with
Visual Stdio 2005 or later.
2191. [func] named-checkzone now allows dumping to stdout (-).
named-checkconf now has -h for help.
named-checkzone now has -h for help.
rndc now has -h for help.
Better handling of '-?' for usage summaries.