-
Notifications
You must be signed in to change notification settings - Fork 2
/
CHANGES
14705 lines (10130 loc) · 485 KB
/
CHANGES
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
--- 9.11.0rc1 released ---
4460. [test] Add system test for dnstap using unix domain sockets.
[RT #42926]
4459. [bug] TCP client objects created to handle pipeline queries
were not cleaned up correctly, causing uncontrolled
memory growth. [RT #43106]
4458. [cleanup] Update assertions to be more correct, and also remove
use of a reserved word. [RT #43090]
4457. [maint] Added AAAA (2001:500:a8::e) for E.ROOT-SERVERS.NET.
4456. [doc] Add DOCTYPE and lang attribute to <html> tags.
[RT #42587]
4455. [cleanup] Allow dyndb modules to correctly log the filename
and line number when processing configuration text
from named.conf. [RT #43050]
4454. [bug] 'rndc dnstap -reopen' had a race issue. [RT #43089]
4453. [bug] Prefetching of DS records failed to update their
RRSIGs. [RT #42865]
4452. [bug] The default key manager policy file is now
<sysdir>/dnssec-policy.conf (usually
/etc/dnssec-policy.conf). [RT #43064]
4451. [cleanup] Log more useful information if a PKCS#11 provider
library cannot be loaded. [RT #43076]
4450. [port] Provide more nuanced HSM support which better matches
the specific PKCS11 providers capabilities. [RT #42458]
4449. [test] Fix catalog zones test on slower systems. [RT #42997]
4448. [bug] win32: ::1 was not being found when iterating
interfaces. [RT #42993]
4447. [tuning] Allow the fstrm_iothr_init() options to be set using
named.conf to control how dnstap manages the data
flow. [RT #42974]
4446. [bug] The cache_find() and _findrdataset() functions
could find rdatasets that had been marked stale.
[RT #42853]
4445. [cleanup] isc_errno_toresult() can now be used to call the
formerly private function isc__errno2result().
[RT #43050]
4444. [bug] Fixed some issues related to dyndb: A bug caused
braces to be omitted when passing configuration text
from named.conf to a dyndb driver, and there was a
use-after-free in the sample dyndb driver. [RT #43050]
4443. [func] Set TCP_MAXSEG in addition to IPV6_USE_MIN_MTU on
TCP sockets. [RT #42864]
4442. [bug] Fix RPZ CIDR tree insertion bug that corrupted
tree data structure with overlapping networks
(longest prefix match was ineffective).
[RT #43035]
4441. [cleanup] Alphabetize host's help output. [RT #43031]
4440. [func] Enable TCP fast open support when available on the
server side. [RT #42866]
4439. [bug] Address race conditions getting ownernames of nodes.
[RT #43005]
4438. [func] Use LIFO rather than FIFO when processing startup
notify and refresh queries. [RT #42825]
4437. [func] Minimal-responses now has two additional modes
no-auth and no-auth-recursive which suppress
adding the NS records to the authority section
as well as the associated address records for the
nameservers. [RT #42005]
4436. [func] Return TLSA records as additional data for MX and SRV
lookups. [RT #42894]
4435. [tuning] Only set IPV6_USE_MIN_MTU for UDP when the message
will not fit into a single IPv4 encapsulated IPv6
UDP packet when transmitted over a Ethernet link.
[RT #42871]
4434. [protocol] Return EDNS EXPIRE option for master zones in addition
to slave zones. [RT #43008]
4433. [cleanup] Report an error when passing an invalid option or
view name to "rndc dumpdb". [RT #42958]
4432. [test] Hide rndc output on expected failures in logfileconfig
system test. [RT #27996]
4431. [bug] named-checkconf now checks the rate-limit clause.
[RT #42970]
4430. [bug] Lwresd died if a search list was not defined.
Found by 0x710DDDD At Alibaba Security. [RT #42895]
4429. [bug] Address potential use after free on fclose() error.
[RT #42976]
4428. [bug] The "test dispatch getnext" unit test could fail
in a threaded build. [RT #42979]
4427. [bug] The "query" and "response" parameters to the
"dnstap" option had their functions reversed.
--- 9.11.0b3 released ---
4426. [bug] Addressed Coverity warnings. [RT #42908]
4425. [bug] arpaname, dnstap-read and named-rrchecker were not
being installed into ${prefix}/bin. Tidy up
installation issues with CHANGE 4421. [RT #42910]
4424. [experimental] Named now sends _ta-XXXX.<trust-anchor>/NULL queries
to provide feedback to the trust-anchor administrators
about how key rollovers are progressing as per
draft-ietf-dnsop-edns-key-tag-02. This can be
disabled using 'trust-anchor-telemetry no;'.
[RT #40583]
4423. [maint] Added missing IPv6 address 2001:500:84::b for
B.ROOT-SERVERS.NET. [RT #42898]
4422. [port] Silence clang warnings in dig.c and dighost.c.
[RT #42451]
4421. [func] When built with LMDB (Lightning Memory-mapped
Database), named will now use a database to store
the configuration for zones added by "rndc addzone"
instead of using a flat NZF file. This improves
performance of "rndc delzone" and "rndc modzone"
significantly. Existing NZF files will
automatically by converted to NZD databases.
To view the contents of an NZD or to roll back to
NZF format, use "named-nzd2nzf". To disable
this feature, use "configure --without-lmdb".
[RT #39837]
4420. [func] nslookup now looks for AAAA as well as A by default.
[RT #40420]
4419. [bug] Don't cause undefined result if the label of an
entry in catalog zone is changed. [RT #42708]
4418. [bug] Fix a compiler warning in GSSAPI code. [RT #42879]
4417. [bug] dnssec-keymgr could fail to create successor keys
if the prepublication interval was set to a value
smaller than the default. [RT #42820]
4416. [bug] dnssec-keymgr: Domain names in policy files could
fail to match due to trailing dots. [RT #42807]
4415. [bug] dnssec-keymgr: Expired/deleted keys were not always
excluded. [RT #42884]
4414. [bug] Corrected a bug in the MIPS implementation of
isc_atomic_xadd(). [RT #41965]
4413. [bug] GSSAPI negotiation could fail if GSS_S_CONTINUE_NEEDED
was returned. [RT #42733]
--- 9.11.0b2 released ---
4412. [cleanup] Make fixes for GCC 6. ISC_OFFSET_MAXIMUM macro was
removed. [RT #42721]
4411. [func] "rndc dnstap -roll" automatically rolls the
dnstap output file; the previous version is
saved with ".0" suffix, and earlier versions
with ".1" and so on. An optional numeric argument
indicates how many prior files to save. [RT #42830]
4410. [bug] Address use after free and memory leak with dnstap.
[RT #42746]
4409. [bug] DNS64 should exclude mapped addresses by default when
an exclude acl is not defined. [RT #42810]
4408. [func] Continue waiting for expected response when we the
response we get does not match the request. [RT #41026]
4407. [performance] Use GCC builtin for clz in RPZ lookup code.
[RT #42818]
4406. [security] getrrsetbyname with a non absolute name could
trigger an infinite recursion bug in lwresd
and named with lwres configured if when combined
with a search list entry the resulting name is
too long. (CVE-2016-2775) [RT #42694]
4405. [bug] Change 4342 introduced a regression where you could
not remove a delegation in a NSEC3 signed zone using
OPTOUT via nsupdate. [RT #42702]
4404. [misc] Allow krb5-config to be used when configuring gssapi.
[RT #42580]
4403. [bug] Rename variables and arguments that shadow: basename,
clone and gai_error.
4402. [bug] protoc-c is now a hard requirement for --enable-dnstap.
--- 9.11.0b1 released ---
4401. [misc] Change LICENSE to MPL 2.0.
4400. [bug] ttl policy was not being inherited in policy.py.
[RT #42718]
4399. [bug] policy.py 'ECCGOST', 'ECDSAP256SHA256', and
'ECDSAP384SHA384' don't have settable keysize.
[RT #42718]
4398. [bug] Correct spelling of ECDSAP256SHA256 in policy.py.
[RT #42718]
4397. [bug] Update Windows python support. [RT #42538]
4396. [func] dnssec-keymgr now takes a '-r randomfile' option.
[RT #42455]
4395. [bug] Improve out-of-tree installation of python modules.
[RT #42586]
4394. [func] Add rndc command "dnstap-reopen" to close and
reopen dnstap output files. [RT #41803]
4393. [bug] Address potential NULL pointer dereferences in
dnstap code.
4392. [func] Collect statistics for RSSAC02v3 traffic-volume,
traffic-sizes and rcode-volume reporting. [RT #41475]
4391. [contrib] Fix leaks in contrib DLZ code. [RT #42707]
4390. [doc] Description of masters with TSIG, allow-query and
allow-transfer options in catalog zones. [RT #42692]
4389. [test] Rewritten test suite for catalog zones. [RT #42676]
4388. [func] Support for master entries with TSIG keys in catalog
zones. [RT #42577]
4387. [bug] Change 4336 was not complete leading to SERVFAIL
being return as NS records expired. [RT #42683]
4386. [bug] Remove shadowed overmem function/variable. [RT #42706]
4385. [func] Add support for allow-query and allow-transfer ACLs
to catalog zones. [RT #42578]
4384. [bug] Change 4256 accidentally disabled logging of the
rndc command. [RT #42654]
4383. [bug] Correct spelling error in stats channel description of
"EDNS client subnet option received". [RT #42633]
4382. [bug] rndc {addzone,modzone,delzone,showzone} should all
compare the zone name using a canonical format.
[RT #42630]
4381. [bug] Missing "zone-directory" option in catalog zone
definition caused BIND to crash. [RT #42579]
--- 9.11.0a3 released ---
4380. [experimental] Added a "zone-directory" option to "catalog-zones"
syntax, allowing local masterfiles for slaves
that are provisioned by catalog zones to be stored
in a directory other than the server's working
directory. [RT #42527]
4379. [bug] An INSIST could be triggered if a zone contains
RRSIG records with expiry fields that loop
using serial number arithmetic. [RT #40571]
4378. [contrib] #include <isc/string.h> for strlcat in zone2ldap.c.
[RT #42525]
4377. [bug] Don't reuse zero TTL responses beyond the current
client set (excludes ANY/SIG/RRSIG queries).
[RT #42142]
4376. [experimental] Added support for Catalog Zones, a new method for
provisioning secondary servers in which a list of
zones to be served is stored in a DNS zone and can
be propagated to slaves via AXFR/IXFR. [RT #41581]
4375. [func] Add support for automatic reallocation of isc_buffer
to isc_buffer_put* functions. [RT #42394]
4374. [bug] Use SAVE/RESTORE macros in query.c to reduce the
probability of reference counting errors as seen
in 4365. [RT #42405]
4373. [bug] Address undefined behavior in getaddrinfo. [RT #42479]
4372. [bug] Address undefined behavior in libt_api. [RT #42480]
4371. [func] New "minimal-any" option reduces the size of UDP
responses for qtype ANY by returning a single
arbitrarily selected RRset instead of all RRsets.
Thanks to Tony Finch. [RT #41615]
4370. [bug] Address python3 compatibility issues with RNDC module.
[RT #42499] [RT #42506]
--- 9.11.0a2 released ---
4369. [bug] Fix 'make' and 'make install' out-of-tree python
support. [RT #42484]
4368. [bug] Fix a crash when calling "rndc stats" on some
Windows builds because some Visual Studio compilers
generated crashing code for the "%z" printf()
format specifier. [RT #42380]
4367. [bug] Remove unnecessary assignment of loadtime in
zone_touched. [RT #42440]
4366. [bug] Address race condition when updating rbtnode bit
fields. [RT #42379]
4365. [bug] Address zone reference counting errors involving
nxdomain-redirect. [RT #42258]
4364. [port] freebsd: add -Wl,-E to loader flags [RT #41690]
4363. [port] win32: Disable explicit triggering UAC when running
BINDInstall.
4362. [func] Changed rndc reconfig behavior so that newly added
zones are loaded asynchronously and the loading does
not block the server. [RT #41934]
4361. [cleanup] Where supported, file modification times returned
by isc_file_getmodtime() are now accurate to the
nanosecond. [RT #41968]
4360. [bug] Silence spurious 'bad key type' message when there is
a existing TSIG key. [RT #42195]
4359. [bug] Inherited 'also-notify' lists were not being checked
by named-checkconf. [RT #42174]
4358. [test] Added American Fuzzy Lop harness that allows
feeding fuzzed packets into BIND.
[RT #41723]
4357. [func] Add the python RNDC module. [RT #42093]
4356. [func] Add the ability to specify whether to wait for
nameserver addresses to be looked up or not to
RPZ with a new modifying directive 'nsip-wait-recurse'.
[RT #35009]
4355. [func] "pkcs11-list" now displays the extractability
attribute of private or secret keys stored in
an HSM, as either "true", "false", or "never"
Thanks to Daniel Stirnimann. [RT #36557]
4354. [bug] Check that the received HMAC length matches the
expected length prior to check the contents on the
control channel. This prevents a OOB read error.
This was reported by Lian Yihan, <lianyihan@360.cn>.
[RT #42215]
4353. [cleanup] Update PKCS#11 header files. [RT #42175]
4352. [cleanup] The ISC DNSSEC Lookaside Validation (DLV) service
is scheduled to be disabled in 2017. A warning is
now logged when named is configured to use it,
either explicitly or via "dnssec-lookaside auto;"
[RT #42207]
4351. [bug] 'dig +noignore' didn't work. [RT #42273]
4350. [contrib] Declare result in dlz_filesystem_dynamic.c.
4349. [contrib] kasp2policy: A python script to create a DNSSEC
policy file from an OpenDNSSEC KASP XML file.
4348. [func] dnssec-keymgr: A new python-based DNSSEC key
management utility, which reads a policy definition
file and can create or update DNSSEC keys as needed
to ensure that a zone's keys match policy, roll over
correctly on schedule, etc. Thanks to Sebastian
Castro for assistance in development. [RT #39211]
4347. [port] Corrected a build error on x86_64 Solaris. [RT #42150]
4346. [bug] Fixed a regression introduced in change #4337 which
caused signed domains with revoked KSKs to fail
validation. [RT #42147]
4345. [contrib] perftcpdns mishandled the return values from
clock_nanosleep. [RT #42131]
4344. [port] Address openssl version differences. [RT #42059]
4343. [bug] dns_dnssec_syncupdate mis-declared in <dns/dnssec.h>.
[RT #42090]
4342. [bug] 'rndc flushtree' could fail to clean the tree if there
wasn't a node at the specified name. [RT #41846]
--- 9.11.0a1 released ---
4341. [bug] Correct the handling of ECS options with
address family 0. [RT #41377]
4340. [performance] Implement adaptive read-write locks, reducing the
overhead of locks that are only held briefly.
[RT #37329]
4339. [test] Use "mdig" to test pipelined queries. [RT #41929]
4338. [bug] Reimplement change 4324 as it wasn't properly doing
all the required book keeping. [RT #41941]
4337. [bug] The previous change exposed a latent flaw in
key refresh queries for managed-keys when
a cached DNSKEY had TTL 0. [RT #41986]
4336. [bug] Don't emit records with zero ttl unless the records
were learnt with a zero ttl. [RT #41687]
4335. [bug] zone->view could be detached too early. [RT #41942]
4334. [func] 'named -V' now reports zlib version. [RT #41913]
4333. [maint] L.ROOT-SERVERS.NET is now 199.7.83.42 and
2001:500:9f::42.
4332. [placeholder]
4331. [func] When loading managed signed zones detect if the
RRSIG's inception time is in the future and regenerate
the RRSIG immediately. [RT #41808]
4330. [protocol] Identify the PAD option as "PAD" when printing out
a message.
4329. [func] Warn about a common misconfiguration when forwarding
RFC 1918 zones. [RT #41441]
4328. [performance] Add dns_name_fromwire() benchmark test. [RT #41694]
4327. [func] Log query and depth counters during fetches when
querytrace (./configure --enable-querytrace) is
enabled (helps in diagnosing). [RT #41787]
4326. [protocol] Add support for AVC. [RT #41819]
4325. [func] Add a line to "rndc status" indicating the
hostname and operating system details. [RT #41610]
4324. [bug] When deleting records from a zone database, interior
nodes could be left empty but not deleted, damaging
search performance afterward. [RT #40997]
4323. [bug] Improve HTTP header processing on statschannel.
[RT #41674]
4322. [security] Duplicate EDNS COOKIE options in a response could
trigger an assertion failure. (CVE-2016-2088)
[RT #41809]
4321. [bug] Zones using mapped files containing out-of-zone data
could return SERVFAIL instead of the expected NODATA
or NXDOMAIN results. [RT #41596]
4320. [bug] Insufficient memory allocation when handling
"none" ACL could cause an assertion failure in
named when parsing ACL configuration. [RT #41745]
4319. [security] Fix resolver assertion failure due to improper
DNAME handling when parsing fetch reply messages.
(CVE-2016-1286) [RT #41753]
4318. [security] Malformed control messages can trigger assertions
in named and rndc. (CVE-2016-1285) [RT #41666]
4317. [bug] Age all unused servers on fetch timeout. [RT #41597]
4316. [func] Add option to tools to print RRs in unknown
presentation format [RT #41595].
4315. [bug] Check that configured view class isn't a meta class.
[RT #41572].
4314. [contrib] Added 'dnsperf-2.1.0.0-1', a set of performance
testing tools provided by Nominum, Inc.
4313. [bug] Handle ns_client_replace failures in test mode.
[RT #41190]
4312. [bug] dig's unknown DNS and EDNS flags (MBZ value) logging
was not consistent. [RT #41600]
4311. [bug] Prevent "rndc delzone" from being used on
response-policy zones. [RT #41593]
4310. [performance] Use __builtin_expect() where available to annotate
conditions with known behavior. [RT #41411]
4309. [cleanup] Remove the spurious "none" filename from log messages
when processing built-in configuration. [RT #41594]
4308. [func] Added operating system details to "named -V"
output. [RT #41452]
4307. [bug] "dig +subnet" and "mdig +subnet" could send
incorrectly-formatted Client Subnet options
if the prefix length was not divisible by 8.
Also fixed a memory leak in "mdig". [RT #45178]
4306. [maint] Added a PKCS#11 openssl patch supporting
version 1.0.2f [RT #38312]
4305. [bug] dnssec-signzone was not removing unnecessary rrsigs
from the zone's apex. [RT #41483]
4304. [port] xfer system test failed as 'tail -n +value' is not
portable. [RT #41315]
4303. [bug] "dig +subnet" was unable to send a prefix length of
zero, as it was incorrectly changed to 32 for v4
prefixes or 128 for v6 prefixes. In addition to
fixing this, "dig +subnet=0" has been added as a
short form for 0.0.0.0/0. The same changes have
also been made in "mdig". [RT #41553]
4302. [port] win32: fixed a build error in VS 2015. [RT #41426]
4301. [bug] dnssec-settime -p [DP]sync was not working. [RT #41534]
4300. [bug] A flag could be set in the wrong field when setting
up non-recursive queries; this could cause the
SERVFAIL cache to cache responses it shouldn't.
New querytrace logging has been added which
identified this error. [RT #41155]
4299. [bug] Check that exactly totallen bytes are read when
reading a RRset from raw files in both single read
and incremental modes. [RT #41402]
4298. [bug] dns_rpz_add errors in loadzone were not being
propagated up the call stack. [RT #41425]
4297. [test] Ensure delegations in RPZ zones fail robustly.
[RT #41518]
4296. [bug] TCP packet sizes were calculated incorrectly in the
stats channel; they could be counted in the wrong
histogram bucket. [RT #40587]
4295. [bug] An unchecked result in dns_message_pseudosectiontotext()
could allow incorrect text formatting of EDNS EXPIRE
options. [RT #41437]
4294. [bug] Fixed a regression in which "rndc stop -p" failed
to print the PID. [RT #41513]
4293. [bug] Address memory leak on priming query creation failure.
[RT #41512]
4292. [placeholder]
4291. [cleanup] Added a required include to dns/forward.h. [RT #41474]
4290. [func] The timers returned by the statistics channel
(indicating current time, server boot time, and
most recent reconfiguration time) are now reported
with millisecond accuracy. [RT #40082]
4289. [bug] The server could crash due to memory being used
after it was freed if a zone transfer timed out.
[RT #41297]
4288. [bug] Fixed a regression in resolver.c:possibly_mark()
which caused known-bogus servers to be queried
anyway. [RT #41321]
4287. [bug] Silence an overly noisy log message when message
parsing fails. [RT #41374]
4286. [security] render_ecs errors were mishandled when printing out
a OPT record resulting in a assertion failure.
(CVE-2015-8705) [RT #41397]
4285. [security] Specific APL data could trigger a INSIST.
(CVE-2015-8704) [RT #41396]
4284. [bug] Some GeoIP options were incorrectly documented
using abbreviated forms which were not accepted by
named. The code has been updated to allow both
long and abbreviated forms. [RT #41381]
4283. [bug] OPENSSL_config is no longer re-callable. [RT #41348]
4282. [func] 'dig +[no]mapped' determine whether the use of mapped
IPv4 addresses over IPv6 is permitted or not. The
default is +mapped. [RT #41307]
4281. [bug] Teach dns_message_totext about BADCOOKIE. [RT #41257]
4280. [performance] Use optimal message sizes to improve compression
in AXFRs. This reduces network traffic. [RT #40996]
4279. [test] Don't use fixed ports when unit testing. [RT #41194]
4278. [bug] 'delv +short +[no]split[=##]' didn't work as expected.
[RT #41238]
4277. [performance] Improve performance of the RBT, the central zone
datastructure: The aux hashtable was improved,
hash function was updated to perform more
uniform mapping, uppernode was added to
dns_rbtnode, and other cleanups and performance
improvements were made. [RT #41165]
4276. [protocol] Add support for SMIMEA. [RT #40513]
4275. [performance] Lazily initialize dns_compress->table only when
compression is enabled. [RT #41189]
4274. [performance] Speed up typemap processing from text. [RT #41196]
4273. [bug] Only call dns_test_begin() and dns_test_end() once each
in nsec3_test as it fails with GOST if called multiple
times.
4272. [bug] dig: the +norrcomments option didn't work with +multi.
[RT #41234]
4271. [test] Unit tests could deadlock in isc__taskmgr_pause().
[RT #41235]
4270. [security] Update allowed OpenSSL versions as named is
potentially vulnerable to CVE-2015-3193.
4269. [bug] Zones using "map" format master files currently
don't work as policy zones. This limitation has
now been documented; attempting to use such zones
in "response-policy" statements is now a
configuration error. [RT #38321]
4268. [func] "rndc status" now reports the path to the
configuration file. [RT #36470]
4267. [test] Check sdlz error handling. [RT #41142]
4266. [placeholder]
4265. [bug] Address unchecked isc_mem_get calls. [RT #41187]
4264. [bug] Check const of strchr/strrchr assignments match
argument's const status. [RT #41150]
4263. [contrib] Address compiler warnings in mysqldyn module.
[RT #41130]
4262. [bug] Fixed a bug in epoll socket code that caused
sockets to not be registered for ready
notification in some cases, causing named to not
read from or write to them, resulting in what
appear to the user as blocked connections.
[RT #41067]
4261. [maint] H.ROOT-SERVERS.NET is 198.97.190.53 and 2001:500:1::53.
[RT #40556]
4260. [security] Insufficient testing when parsing a message allowed
records with an incorrect class to be be accepted,
triggering a REQUIRE failure when those records
were subsequently cached. (CVE-2015-8000) [RT #40987]
4259. [func] Add an option for non-destructive control channel
access using a "read-only" clause. In such
cases, a restricted set of rndc commands are
allowed for querying information from named.
[RT #40498]
4258. [bug] Limit rndc query message sizes to 32 KiB. This should
not break any legitimate rndc commands, but will
prevent a rogue rndc query from allocating too
much memory. [RT #41073]
4257. [cleanup] Python scripts reported incorrect version. [RT #41080]
4256. [bug] Allow rndc command arguments to be quoted so as
to allow spaces. [RT #36665]
4255. [performance] Add 'message-compression' option to disable DNS
compression in responses. [RT #40726]
4254. [bug] Address missing lock when getting zone's serial.
[RT #41072]
4253. [security] Address fetch context reference count handling error
on socket error. (CVE-2015-8461) [RT#40945]
4252. [func] Add support for automating the generation CDS and
CDNSKEY rrsets to named and dnssec-signzone.
[RT #40424]
4251. [bug] NTAs were deleted when the server was reconfigured
or reloaded. [RT #41058]
4250. [func] Log the TSIG key in use during inbound zone
transfers. [RT #41075]
4249. [func] Improve error reporting of TSIG / SIG(0) records in
the wrong location. [RT #41030]
4248. [performance] Add an isc_atomic_storeq() function, use it in
stats counters to improve performance.
[RT #39972] [RT #39979]
4247. [port] Require both HAVE_JSON and JSON_C_VERSION to be
defined to report json library version. [RT #41045]
4246. [test] Ensure the statschannel system test runs when BIND
is not built with libjson. [RT #40944]
4245. [placeholder]
4244. [bug] The parser was not reporting that use-ixfr is obsolete.
[RT #41010]
4243. [func] Improved stats reporting from Timothe Litt. [RT #38941]
4242. [bug] Replace the client if not already replaced when
prefetching. [RT #41001]
4241. [doc] Improved the TSIG, TKEY, and SIG(0) sections in
the ARM. [RT #40955]
4240. [port] Fix LibreSSL compatibility. [RT #40977]
4239. [func] Changed default servfail-ttl value to 1 second from 10.
Also, the maximum value is now 30 instead of 300.
[RT #37556]
4238. [bug] Don't send to servers on net zero (0.0.0.0/8).
[RT #40947]
4237. [doc] Upgraded documentation toolchain to use DocBook 5
and dblatex. [RT #40766]
4236. [performance] On machines with 2 or more processors (CPU), the
default value for the number of UDP listeners
has been changed to the number of detected
processors minus one. [RT #40761]
4235. [func] Added support in named for "dnstap", a fast method of
capturing and logging DNS traffic, and a new command
"dnstap-read" to read a dnstap log file. Use
"configure --enable-dnstap" to enable this
feature (note that this requires libprotobuf-c
and libfstrm). See the ARM for configuration details.
Thanks to Robert Edmonds of Farsight Security.
[RT #40211]
4234. [func] Add deflate compression in statistics channel HTTP
server. [RT #40861]
4233. [test] Add tests for CDS and CDNSKEY with delegation-only.
[RT #40597]
4232. [contrib] Address unchecked memory allocation calls in
query-loc and zone2ldap. [RT #40789]
4231. [contrib] Address unchecked calloc call in dlz_mysqldyn_mod.c.
[RT #40840]
4230. [contrib] dlz_wildcard_dynamic.c:dlz_create could return a
uninitialized result. [RT #40839]
4229. [bug] A variable could be used uninitialized in
dns_update_signaturesinc. [RT #40784]
4228. [bug] Address race condition in dns_client_destroyrestrans.
[RT #40605]
4227. [bug] Silence static analysis warnings. [RT #40828]
4226. [bug] Address a theoretical shutdown race in
zone.c:notify_send_queue(). [RT #38958]
4225. [port] freebsd/openbsd: Use '${CC} -shared' for building
shared libraries. [RT #39557]
4224. [func] Added support for "dyndb", a new interface for loading
zone data from an external database, developed by
Red Hat for the FreeIPA project.
DynDB drivers fully implement the BIND database
API, and are capable of significantly better
performance and functionality than DLZ drivers,
while taking advantage of advanced database
features not available in BIND such as multi-master
replication.
Thanks to Adam Tkac and Petr Spacek of Red Hat.
[RT #35271]
4223. [func] Add support for setting max-cache-size to percentage
of available physical memory, set default to 90%.
[RT #38442]
4222. [func] Bias IPv6 servers when selecting the next server to
query. [RT #40836]
4221. [bug] Resource leak on DNS_R_NXDOMAIN in fctx_create.
[RT #40583]
4220. [doc] Improve documentation for zone-statistics.
[RT #36955]
4219. [bug] Set event->result to ISC_R_WOULDBLOCK on EWOULDBLOCK,
EGAIN when these soft error are not retried for
isc_socket_send*().
4218. [bug] Potential null pointer dereference on out of memory
if mmap is not supported. [RT #40777]
4217. [protocol] Add support for CSYNC. [RT #40532]
4216. [cleanup] Silence static analysis warnings. [RT #40649]
4215. [bug] nsupdate: skip to next request on GSSTKEY create
failure. [RT #40685]
4214. [protocol] Add support for TALINK. [RT #40544]
4213. [bug] Don't reuse a cache across multiple classes.
[RT #40205]
4212. [func] Re-query if we get a bad client cookie returned over
UDP. [RT #40748]
4211. [bug] Ensure that lwresd gets at least one task to work
with if enabled. [RT #40652]
4210. [cleanup] Silence use after free false positive. [RT #40743]
4209. [bug] Address resource leaks in dlz modules. [RT #40654]
4208. [bug] Address null pointer dereferences on out of memory.
[RT #40764]
4207. [bug] Handle class mismatches with raw zone files.
[RT #40746]
4206. [bug] contrib: fixed a possible NULL dereference in
DLZ wildcard module. [RT #40745]
4205. [bug] 'named-checkconf -p' could include unwanted spaces
when printing tuples with unset optional fields.
[RT #40731]
4204. [bug] 'dig +trace' failed to lookup the correct type if
the initial root NS query was retried. [RT #40296]
4203. [test] The rrchecker system test now tests conversion
to and from unknown-type format. [RT #40584]
4202. [bug] isccc_cc_fromwire() could return an incorrect
result. [RT #40614]
4201. [func] The default preferred-glue is now the address record
type of the transport the query was received
over. [RT #40468]
4200. [cleanup] win32: update BINDinstall to be BIND release
independent. [RT #38915]
4199. [protocol] Add support for NINFO, RKEY, SINK, TA.
[RT #40545] [RT #40547] [RT #40561] [RT #40563]
4198. [placeholder]
4197. [bug] 'named-checkconf -z' didn't handle 'in-view' clauses.
[RT #40603]
4196. [doc] Improve how "enum + other" types are documented.
[RT #40608]
4195. [bug] 'max-zone-ttl unlimited;' was broken. [RT #40608]
4194. [bug] named-checkconf -p failed to properly print a port
range. [RT #40634]
4193. [bug] Handle broken servers that return BADVERS incorrectly.
[RT #40427]
4192. [bug] The default rrset-order of random was not always being
applied. [RT #40456]
4191. [protocol] Accept DNS-SD non LDH PTR records in reverse zones
as per RFC 6763. [RT #37889]
4190. [protocol] Accept Active Directory gc._msdcs.<forest> name as
valid with check-names. <forest> still needs to be
LDH. [RT #40399]
4189. [cleanup] Don't exit on overly long tokens in named.conf.
[RT #40418]
4188. [bug] Support HTTP/1.0 client properly on the statistics
channel. [RT #40261]
4187. [func] When any RR type implementation doesn't
implement totext() for the RDATA's wire
representation and returns ISC_R_NOTIMPLEMENTED,
such RDATA is now printed in unknown
presentation format (RFC 3597). RR types affected
include LOC(29) and APL(42). [RT #40317].
4186. [bug] Fixed an RPZ bug where a QNAME would be matched
against a policy RR with wildcard owner name
(trigger) where the QNAME was the wildcard owner
name's parent. For example, the bug caused a query
with QNAME "example.com" to match a policy RR with
"*.example.com" as trigger. [RT #40357]
4185. [bug] Fixed an RPZ bug where a policy RR with wildcard
owner name (trigger) would prevent another policy RR
with its parent owner name from being
loaded. For example, the bug caused a policy RR
with trigger "example.com" to not have any
effect when a previous policy RR with trigger
"*.example.com" existed in that RPZ zone.
[RT #40357]
4184. [bug] Fixed a possible memory leak in name compression
when rendering long messages. (Also, improved
wire_test for testing such messages.) [RT #40375]
4183. [cleanup] Use timing-safe memory comparisons in cryptographic
code. Also, the timing-safe comparison functions have
been renamed to avoid possible confusion with
memcmp(). Thanks to Loganaden Velvindron of
AFRINIC. [RT #40148]
4182. [cleanup] Use mnemonics for RR class and type comparisons.
[RT #40297]
4181. [bug] Queued notify messages could be dequeued from the
wrong rate limiter queue. [RT #40350]
4180. [bug] Error responses in pipelined queries could
cause a crash in client.c. [RT #40289]
4179. [bug] Fix double frees in getaddrinfo() in libirs.
[RT #40209]
4178. [bug] Fix assertion failure in parsing UNSPEC(103) RR from
text. [RT #40274]
4177. [bug] Fix assertion failure in parsing NSAP records from
text. [RT #40285]
4176. [bug] Address race issues with lwresd. [RT #40284]
4175. [bug] TKEY with GSS-API keys needed bigger buffers.
[RT #40333]
4174. [bug] "dnssec-coverage -r" didn't handle time unit
suffixes correctly. [RT #38444]
4173. [bug] dig +sigchase was not properly matching the trusted
key. [RT #40188]
4172. [bug] Named / named-checkconf didn't handle a view of CLASS0.
[RT #40265]
4171. [bug] Fixed incorrect class checks in TSIG RR
implementation. [RT #40287]
4170. [security] An incorrect boundary check in the OPENPGPKEY
rdatatype could trigger an assertion failure.
(CVE-2015-5986) [RT #40286]
4169. [test] Added a 'wire_test -d' option to read input as
raw binary data, for use as a fuzzing harness.