Source-Changes-HG archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

[src/trunk]: src/external/mpl/bind/dist Import bind-9.16.15



details:   https://anonhg.NetBSD.org/src/rev/c28305e5bf24
branches:  trunk
changeset: 378917:c28305e5bf24
user:      christos <christos%NetBSD.org@localhost>
date:      Thu Apr 29 16:46:17 2021 +0000

description:
Import bind-9.16.15
Changes since bind-9.16.12:

        --- 9.16.15 released ---

5621.   [bug]           Due to a backporting mistake in change 5609, named
                        binaries built against a Kerberos/GSSAPI library whose
                        header files did not define the GSS_SPNEGO_MECHANISM
                        preprocessor macro were not able to start if their
                        configuration included the "tkey-gssapi-credential"
                        option. This has been fixed. [GL #2634]

5620.   [bug]           If zone journal files written by BIND 9.16.11 or earlier
                        were present when BIND was upgraded, the zone file for
                        that zone could have been inadvertently rewritten with
                        the current zone contents. This caused the original zone
                        file structure (e.g. comments, $INCLUDE directives) to
                        be lost, although the zone data itself was preserved.
                        This has been fixed. [GL #2623]

        --- 9.16.14 released ---

5617.   [security]      A specially crafted GSS-TSIG query could cause a buffer
                        overflow in the ISC implementation of SPNEGO.
                        (CVE-2021-25216) [GL #2604]

5616.   [security]      named crashed when a DNAME record placed in the ANSWER
                        section during DNAME chasing turned out to be the final
                        answer to a client query. (CVE-2021-25215) [GL #2540]

5615.   [security]      Insufficient IXFR checks could result in named serving a
                        zone without an SOA record at the apex, leading to a
                        RUNTIME_CHECK assertion failure when the zone was
                        subsequently refreshed. This has been fixed by adding an
                        owner name check for all SOA records which are included
                        in a zone transfer. (CVE-2021-25214) [GL #2467]

5614.   [bug]           Ensure all resources are properly cleaned up when a call
                        to gss_accept_sec_context() fails. [GL #2620]

5613.   [bug]           It was possible to write an invalid transaction header
                        in the journal file for a managed-keys database after
                        upgrading. This has been fixed. Invalid headers in
                        existing journal files are detected and named is able
                        to recover from them. [GL #2600]

5611.   [func]          Set "stale-answer-client-timeout" to "off" by default.
                        [GL #2608]

5610.   [bug]           Prevent a crash which could happen when a lookup
                        triggered by "stale-answer-client-timeout" was attempted
                        right after recursion for a client query finished.
                        [GL #2594]

5609.   [func]          The ISC implementation of SPNEGO was removed from BIND 9
                        source code. It was no longer necessary as all major
                        contemporary Kerberos/GSSAPI libraries include support
                        for SPNEGO. [GL #2607]

5608.   [bug]           When sending queries over TCP, dig now properly handles
                        "+tries=1 +retry=0" by not retrying the connection when
                        the remote server closes the connection prematurely.
                        [GL #2490]

5607.   [bug]           As "rndc dnssec -checkds" and "rndc dnssec -rollover"
                        commands may affect the next scheduled key event,
                        reconfiguration of zone keys is now triggered after
                        receiving either of these commands to prevent
                        unnecessary key rollover delays. [GL #2488]

5606.   [bug]           CDS/CDNSKEY DELETE records are now removed when a zone
                        transitions from a secure to an insecure state.
                        named-checkzone also no longer reports an error when
                        such records are found in an unsigned zone. [GL #2517]

5605.   [bug]           "dig -u" now uses the CLOCK_REALTIME clock source for
                        more accurate time reporting. [GL #2592]

5603.   [bug]           Fix a memory leak that occurred when named failed to
                        bind a UDP socket to a network interface. [GL #2575]

5602.   [bug]           Fix TCPDNS and TLSDNS timers in Network Manager. This
                        makes the "tcp-initial-timeout" and "tcp-idle-timeout"
                        options work correctly again. [GL #2583]

5601.   [bug]           Zones using KASP could not be thawed after they were
                        frozen using "rndc freeze". This has been fixed.
                        [GL #2523]

        --- 9.16.13 released ---

5597.   [bug]           When serve-stale was enabled and starting the recursive
                        resolution process for a query failed, a named instance
                        could crash if it was configured as both a recursive and
                        authoritative server. This problem was introduced by
                        change 5573 and has now been fixed. [GL #2565]

5595.   [cleanup]       Public header files for BIND 9 libraries no longer
                        directly include third-party library headers. This
                        prevents the need to include paths to third-party header
                        files in CFLAGS whenever BIND 9 public header files are
                        used, which could cause build-time issues on hosts with
                        older versions of BIND 9 installed. [GL #2357]

5594.   [bug]           Building with --enable-dnsrps --enable-dnsrps-dl failed.
                        [GL #2298]

5593.   [bug]           Journal files written by older versions of named can now
                        be read when loading zones, so that journal
                        incompatibility does not cause problems on upgrade.
                        Outdated journals are updated to the new format after
                        loading. [GL #2505]

5592.   [bug]           Prevent hazard pointer table overflows on machines with
                        many cores, by allowing the thread IDs (serving as
                        indices into hazard pointer tables) of finished threads
                        to be reused by those created later. [GL #2396]

5591.   [bug]           Fix a crash that occurred when
                        "stale-answer-client-timeout" was triggered without any
                        (stale) data available in the cache to answer the query.
                        [GL #2503]

5590.   [bug]           NSEC3 records were not immediately created for dynamic
                        zones using NSEC3 with "dnssec-policy", resulting in
                        such zones going bogus. Add code to process the
                        NSEC3PARAM queue at zone load time so that NSEC3 records
                        for such zones are created immediately. [GL #2498]

5588.   [func]          Add a new "purge-keys" option for "dnssec-policy". This
                        option determines the period of time for which key files
                        are retained after they become obsolete. [GL #2408]

5586.   [bug]           An invalid direction field in a LOC record resulted in
                        an INSIST failure when a zone file containing such a
                        record was loaded. [GL #2499]

5584.   [bug]           No longer set the IP_DONTFRAG option on UDP sockets, to
                        prevent dropping outgoing packets exceeding
                        "max-udp-size". [GL #2466]

5582.   [bug]           BIND 9 failed to build when static OpenSSL libraries
                        were used and the pkg-config files for libssl and/or
                        libcrypto were unavailable. This has been fixed by
                        ensuring that the correct linking order for libssl and
                        libcrypto is always used. [GL #2402]

5581.   [bug]           Fix a memory leak that occurred when inline-signed zones
                        were added to the configuration, followed by a
                        reconfiguration of named. [GL #2041]

5580.   [test]          The system test framework no longer differentiates
                        between SKIPPED and UNTESTED system test results. Any
                        system test which is not run is now marked as SKIPPED.
                        [GL !4517]

5573.   [func]          When serve-stale is enabled and stale data is available,
                        named now returns stale answers upon encountering any
                        unexpected error in the query resolution process.
                        However, the "stale-refresh-time" window is still only
                        started upon a timeout. [GL #2434]

5564.   [cleanup]       Network manager's TLSDNS module was refactored to use
                        libuv and libssl directly instead of a stack of TCP/TLS
                        sockets. [GL #2335]

diffstat:

 external/mpl/bind/dist/CHANGES                                                    |   163 +
 external/mpl/bind/dist/PLATFORMS                                                  |     2 +-
 external/mpl/bind/dist/PLATFORMS.md                                               |     2 +-
 external/mpl/bind/dist/aclocal.m4                                                 |     1 +
 external/mpl/bind/dist/bin/check/Makefile.in                                      |     5 +-
 external/mpl/bind/dist/bin/dig/dig.rst                                            |     6 +-
 external/mpl/bind/dist/bin/named/Makefile.in                                      |     1 +
 external/mpl/bind/dist/bin/named/named.conf.rst                                   |     1 +
 external/mpl/bind/dist/bin/tests/system/README                                    |     9 +-
 external/mpl/bind/dist/bin/tests/system/checkconf/good.conf                       |     1 +
 external/mpl/bind/dist/bin/tests/system/checkzone/zones/good-cds-unsigned.db      |     5 +
 external/mpl/bind/dist/bin/tests/system/conf.sh.common                            |     3 +
 external/mpl/bind/dist/bin/tests/system/digdelv/tests.sh                          |    31 +-
 external/mpl/bind/dist/bin/tests/system/dnssec/clean.sh                           |     1 +
 external/mpl/bind/dist/bin/tests/system/ecdsa/clean.sh                            |    13 +-
 external/mpl/bind/dist/bin/tests/system/ecdsa/ns1/named.conf.in                   |    34 +
 external/mpl/bind/dist/bin/tests/system/ecdsa/ns1/sign.sh                         |    39 +-
 external/mpl/bind/dist/bin/tests/system/ecdsa/ns2/named.conf.in                   |    34 +
 external/mpl/bind/dist/bin/tests/system/ecdsa/ns3/named.conf.in                   |    34 +
 external/mpl/bind/dist/bin/tests/system/ecdsa/setup.sh                            |    18 +-
 external/mpl/bind/dist/bin/tests/system/ecdsa/tests.sh                            |    43 +-
 external/mpl/bind/dist/bin/tests/system/eddsa/clean.sh                            |    14 +-
 external/mpl/bind/dist/bin/tests/system/eddsa/ns1/named.conf.in                   |    34 +
 external/mpl/bind/dist/bin/tests/system/eddsa/ns1/sign.sh                         |    40 +-
 external/mpl/bind/dist/bin/tests/system/eddsa/ns2/example.com.db.in               |    20 +
 external/mpl/bind/dist/bin/tests/system/eddsa/ns2/named.conf.in                   |    34 +
 external/mpl/bind/dist/bin/tests/system/eddsa/ns2/sign.sh                         |    21 +-
 external/mpl/bind/dist/bin/tests/system/eddsa/ns3/Xexample.com.+016+09713.key     |     1 +
 external/mpl/bind/dist/bin/tests/system/eddsa/ns3/Xexample.com.+016+09713.private |     3 +
 external/mpl/bind/dist/bin/tests/system/eddsa/ns3/Xexample.com.+016+38353.key     |     1 +
 external/mpl/bind/dist/bin/tests/system/eddsa/ns3/Xexample.com.+016+38353.private |     3 +
 external/mpl/bind/dist/bin/tests/system/eddsa/ns3/example.com.db.in               |    20 +
 external/mpl/bind/dist/bin/tests/system/eddsa/ns3/named.conf.in                   |    34 +
 external/mpl/bind/dist/bin/tests/system/eddsa/ns3/sign.sh                         |    34 +
 external/mpl/bind/dist/bin/tests/system/eddsa/prereq.sh                           |    10 +-
 external/mpl/bind/dist/bin/tests/system/eddsa/setup.sh                            |    25 +-
 external/mpl/bind/dist/bin/tests/system/eddsa/tests.sh                            |    99 +-
 external/mpl/bind/dist/bin/tests/system/fromhex.pl                                |    45 +
 external/mpl/bind/dist/bin/tests/system/journal/clean.sh                          |    16 +
 external/mpl/bind/dist/bin/tests/system/journal/ns1/changed.ver1.jnl.saved        |   Bin 
 external/mpl/bind/dist/bin/tests/system/journal/ns1/changed.ver2.jnl.saved        |   Bin 
 external/mpl/bind/dist/bin/tests/system/journal/ns1/d1212.jnl.saved               |   Bin 
 external/mpl/bind/dist/bin/tests/system/journal/ns1/d2121.jnl.saved               |   Bin 
 external/mpl/bind/dist/bin/tests/system/journal/ns1/generic.db.in                 |    16 +
 external/mpl/bind/dist/bin/tests/system/journal/ns1/ixfr.db.in                    |    17 +
 external/mpl/bind/dist/bin/tests/system/journal/ns1/ixfr.ver1.jnl.saved           |   Bin 
 external/mpl/bind/dist/bin/tests/system/journal/ns1/managed-keys.bind.in          |     2 +
 external/mpl/bind/dist/bin/tests/system/journal/ns1/managed-keys.bind.jnl.in      |   704 +++
 external/mpl/bind/dist/bin/tests/system/journal/ns1/maxjournal.jnl.saved          |   Bin 
 external/mpl/bind/dist/bin/tests/system/journal/ns1/maxjournal2.jnl.saved         |   Bin 
 external/mpl/bind/dist/bin/tests/system/journal/ns1/named.conf.in                 |    90 +
 external/mpl/bind/dist/bin/tests/system/journal/ns1/unchanged.ver1.jnl.saved      |   Bin 
 external/mpl/bind/dist/bin/tests/system/journal/ns1/unchanged.ver2.jnl.saved      |   Bin 
 external/mpl/bind/dist/bin/tests/system/journal/setup.sh                          |    45 +
 external/mpl/bind/dist/bin/tests/system/journal/tests.sh                          |   221 +
 external/mpl/bind/dist/bin/tests/system/kasp.sh                                   |  1095 +++++
 external/mpl/bind/dist/bin/tests/system/kasp/README                               |     6 +-
 external/mpl/bind/dist/bin/tests/system/kasp/ns3/named.conf.in                    |    20 +
 external/mpl/bind/dist/bin/tests/system/kasp/ns3/policies/autosign.conf.in        |     4 +
 external/mpl/bind/dist/bin/tests/system/kasp/ns3/setup.sh                         |   146 +-
 external/mpl/bind/dist/bin/tests/system/kasp/ns3/template2.db.in                  |     6 +-
 external/mpl/bind/dist/bin/tests/system/kasp/ns6/named.conf.in                    |    32 +-
 external/mpl/bind/dist/bin/tests/system/kasp/ns6/named2.conf.in                   |    22 -
 external/mpl/bind/dist/bin/tests/system/kasp/ns6/policies/kasp.conf.in            |    60 +-
 external/mpl/bind/dist/bin/tests/system/kasp/ns6/setup.sh                         |    48 -
 external/mpl/bind/dist/bin/tests/system/kasp/setup.sh                             |     5 -
 external/mpl/bind/dist/bin/tests/system/kasp/tests.sh                             |  1942 +---------
 external/mpl/bind/dist/bin/tests/system/keymgr2kasp/README                        |    10 +
 external/mpl/bind/dist/bin/tests/system/keymgr2kasp/clean.sh                      |    31 +
 external/mpl/bind/dist/bin/tests/system/keymgr2kasp/ns3/kasp.conf.in              |    82 +
 external/mpl/bind/dist/bin/tests/system/keymgr2kasp/ns3/named.conf.in             |    80 +
 external/mpl/bind/dist/bin/tests/system/keymgr2kasp/ns3/named2.conf.in            |    71 +
 external/mpl/bind/dist/bin/tests/system/keymgr2kasp/ns3/setup.sh                  |   121 +
 external/mpl/bind/dist/bin/tests/system/keymgr2kasp/ns3/template.db.in            |    25 +
 external/mpl/bind/dist/bin/tests/system/keymgr2kasp/ns4/named.conf.in             |    70 +
 external/mpl/bind/dist/bin/tests/system/keymgr2kasp/ns4/named2.conf.in            |    81 +
 external/mpl/bind/dist/bin/tests/system/keymgr2kasp/ns4/setup.sh                  |    54 +
 external/mpl/bind/dist/bin/tests/system/keymgr2kasp/ns4/template.ext.db.in        |    22 +
 external/mpl/bind/dist/bin/tests/system/keymgr2kasp/ns4/template.int.db.in        |    22 +
 external/mpl/bind/dist/bin/tests/system/keymgr2kasp/setup.sh                      |    32 +
 external/mpl/bind/dist/bin/tests/system/keymgr2kasp/tests.sh                      |   948 ++++
 external/mpl/bind/dist/bin/tests/system/mirror/clean.sh                           |     1 +
 external/mpl/bind/dist/bin/tests/system/nsec3/ns3/named.conf.in                   |    18 +-
 external/mpl/bind/dist/bin/tests/system/nsec3/ns3/named2.conf.in                  |    19 +-
 external/mpl/bind/dist/bin/tests/system/nsec3/ns3/setup.sh                        |     2 +-
 external/mpl/bind/dist/bin/tests/system/nsec3/tests.sh                            |    45 +-
 external/mpl/bind/dist/bin/tests/system/nsupdate/tests.sh                         |     5 +-
 external/mpl/bind/dist/bin/tests/system/rpzrecurse/clean.sh                       |     1 +
 external/mpl/bind/dist/bin/tests/system/run.sh                                    |    56 +-
 external/mpl/bind/dist/bin/tests/system/serve-stale/ans2/ans.pl                   |     2 +-
 external/mpl/bind/dist/bin/tests/system/serve-stale/ns1/named1.conf.in            |     1 -
 external/mpl/bind/dist/bin/tests/system/serve-stale/ns1/named2.conf.in            |     1 -
 external/mpl/bind/dist/bin/tests/system/serve-stale/ns1/named3.conf.in            |     1 -
 external/mpl/bind/dist/bin/tests/system/serve-stale/ns3/named2.conf.in            |     1 +
 external/mpl/bind/dist/bin/tests/system/serve-stale/ns3/named3.conf.in            |     1 -
 external/mpl/bind/dist/bin/tests/system/serve-stale/ns3/named6.conf.in            |    49 +
 external/mpl/bind/dist/bin/tests/system/serve-stale/ns3/named7.conf.in            |    54 +
 external/mpl/bind/dist/bin/tests/system/serve-stale/tests.sh                      |   290 +-
 external/mpl/bind/dist/bin/tests/system/shutdown/clean.sh                         |     1 +
 external/mpl/bind/dist/bin/tests/system/testcrypto.sh                             |     2 +-
 external/mpl/bind/dist/bin/tests/system/timeouts/clean.sh                         |    19 +
 external/mpl/bind/dist/bin/tests/system/timeouts/conftest.py                      |    59 +
 external/mpl/bind/dist/bin/tests/system/timeouts/ns1/example.db                   |    23 +
 external/mpl/bind/dist/bin/tests/system/timeouts/ns1/named.conf.in                |    41 +
 external/mpl/bind/dist/bin/tests/system/timeouts/ns1/root.db                      |    22 +
 external/mpl/bind/dist/bin/tests/system/timeouts/prereq.sh                        |    29 +
 external/mpl/bind/dist/bin/tests/system/timeouts/setup.sh                         |    23 +
 external/mpl/bind/dist/bin/tests/system/timeouts/tests-tcp.py                     |   161 +
 external/mpl/bind/dist/bin/tests/system/tsiggss/authsock.pl                       |     5 +
 external/mpl/bind/dist/bin/tests/system/upforwd/setup.sh                          |     2 +-
 external/mpl/bind/dist/bin/tests/system/views/clean.sh                            |     2 +
 external/mpl/bind/dist/bin/tests/system/views/ns2/named1.conf.in                  |     8 +
 external/mpl/bind/dist/bin/tests/system/views/ns2/named3.conf.in                  |    33 +
 external/mpl/bind/dist/bin/tests/system/views/tests.sh                            |    41 +
 external/mpl/bind/dist/bin/tools/Makefile.in                                      |     2 +-
 external/mpl/bind/dist/bin/tools/named-journalprint.rst                           |    18 +-
 external/mpl/bind/dist/config.h.win32                                             |    63 +-
 external/mpl/bind/dist/configure.ac                                               |    51 +-
 external/mpl/bind/dist/doc/arm/notes.rst                                          |     3 +
 external/mpl/bind/dist/doc/arm/reference.rst                                      |    45 +-
 external/mpl/bind/dist/doc/dnssec-guide/signing.rst                               |    16 +-
 external/mpl/bind/dist/doc/man/dig.1in                                            |     6 +-
 external/mpl/bind/dist/doc/man/named-journalprint.8in                             |    18 +-
 external/mpl/bind/dist/doc/man/named.conf.5in                                     |     1 +
 external/mpl/bind/dist/doc/misc/dnssec-policy.default.conf                        |     1 +
 external/mpl/bind/dist/doc/misc/dnssec-policy.grammar.rst                         |     1 +
 external/mpl/bind/dist/doc/misc/options                                           |     1 +
 external/mpl/bind/dist/doc/misc/options.active                                    |     1 +
 external/mpl/bind/dist/doc/notes/notes-9.16.13.rst                                |    71 +
 external/mpl/bind/dist/doc/notes/notes-9.16.14.rst                                |    18 +
 external/mpl/bind/dist/doc/notes/notes-9.16.15.rst                                |   104 +
 external/mpl/bind/dist/lib/bind9/Makefile.in                                      |     2 +-
 external/mpl/bind/dist/lib/dns/Makefile.in                                        |     6 +-
 external/mpl/bind/dist/lib/dns/tests/Makefile.in                                  |     3 +-
 external/mpl/bind/dist/lib/dns/win32/libdns.def.in                                |     3 +
 external/mpl/bind/dist/lib/dns/win32/libdns.vcxproj.filters.in                    |     6 -
 external/mpl/bind/dist/lib/dns/win32/libdns.vcxproj.in                            |     6 +-
 external/mpl/bind/dist/lib/isc/Makefile.in                                        |     8 +-
 external/mpl/bind/dist/lib/isc/include/isc/Makefile.in                            |     3 +-
 external/mpl/bind/dist/lib/isc/include/isc/tls.h                                  |    50 +
 external/mpl/bind/dist/lib/isc/lib_p.h                                            |    20 +
 external/mpl/bind/dist/lib/isc/netmgr/Makefile.in                                 |     4 +-
 external/mpl/bind/dist/lib/isc/tests/Makefile.in                                  |    16 +-
 external/mpl/bind/dist/lib/isc/tests/tlsdns_test.c                                |   899 ++++
 external/mpl/bind/dist/lib/isc/tls.c                                              |   367 +
 external/mpl/bind/dist/lib/isc/tls_p.h                                            |    20 +
 external/mpl/bind/dist/lib/isc/trampoline.c                                       |   198 +
 external/mpl/bind/dist/lib/isc/trampoline_p.h                                     |    55 +
 external/mpl/bind/dist/lib/isc/win32/libisc.def.in                                |    19 +-
 external/mpl/bind/dist/lib/isc/win32/libisc.vcxproj.filters.in                    |    12 +
 external/mpl/bind/dist/lib/isc/win32/libisc.vcxproj.in                            |    13 +-
 external/mpl/bind/dist/m4/ax_check_openssl.m4                                     |     2 +-
 external/mpl/bind/dist/m4/ax_gcc_func_attribute.m4                                |   242 +
 external/mpl/bind/dist/make/includes.in                                           |     4 +-
 external/mpl/bind/dist/srcid                                                      |     2 +-
 external/mpl/bind/dist/version                                                    |     2 +-
 external/mpl/bind/dist/win32utils/Configure                                       |    86 +-
 157 files changed, 8135 insertions(+), 2381 deletions(-)

diffs (truncated from 12620 to 300 lines):

diff -r e7ec5beb1e9a -r c28305e5bf24 external/mpl/bind/dist/CHANGES
--- a/external/mpl/bind/dist/CHANGES    Thu Apr 29 09:27:29 2021 +0000
+++ b/external/mpl/bind/dist/CHANGES    Thu Apr 29 16:46:17 2021 +0000
@@ -1,3 +1,166 @@
+       --- 9.16.15 released ---
+
+5621.  [bug]           Due to a backporting mistake in change 5609, named
+                       binaries built against a Kerberos/GSSAPI library whose
+                       header files did not define the GSS_SPNEGO_MECHANISM
+                       preprocessor macro were not able to start if their
+                       configuration included the "tkey-gssapi-credential"
+                       option. This has been fixed. [GL #2634]
+
+5620.  [bug]           If zone journal files written by BIND 9.16.11 or earlier
+                       were present when BIND was upgraded, the zone file for
+                       that zone could have been inadvertently rewritten with
+                       the current zone contents. This caused the original zone
+                       file structure (e.g. comments, $INCLUDE directives) to
+                       be lost, although the zone data itself was preserved.
+                       This has been fixed. [GL #2623]
+
+       --- 9.16.14 released ---
+
+5617.  [security]      A specially crafted GSS-TSIG query could cause a buffer
+                       overflow in the ISC implementation of SPNEGO.
+                       (CVE-2021-25216) [GL #2604]
+
+5616.  [security]      named crashed when a DNAME record placed in the ANSWER
+                       section during DNAME chasing turned out to be the final
+                       answer to a client query. (CVE-2021-25215) [GL #2540]
+
+5615.  [security]      Insufficient IXFR checks could result in named serving a
+                       zone without an SOA record at the apex, leading to a
+                       RUNTIME_CHECK assertion failure when the zone was
+                       subsequently refreshed. This has been fixed by adding an
+                       owner name check for all SOA records which are included
+                       in a zone transfer. (CVE-2021-25214) [GL #2467]
+
+5614.  [bug]           Ensure all resources are properly cleaned up when a call
+                       to gss_accept_sec_context() fails. [GL #2620]
+
+5613.  [bug]           It was possible to write an invalid transaction header
+                       in the journal file for a managed-keys database after
+                       upgrading. This has been fixed. Invalid headers in
+                       existing journal files are detected and named is able
+                       to recover from them. [GL #2600]
+
+5611.  [func]          Set "stale-answer-client-timeout" to "off" by default.
+                       [GL #2608]
+
+5610.  [bug]           Prevent a crash which could happen when a lookup
+                       triggered by "stale-answer-client-timeout" was attempted
+                       right after recursion for a client query finished.
+                       [GL #2594]
+
+5609.  [func]          The ISC implementation of SPNEGO was removed from BIND 9
+                       source code. It was no longer necessary as all major
+                       contemporary Kerberos/GSSAPI libraries include support
+                       for SPNEGO. [GL #2607]
+
+5608.  [bug]           When sending queries over TCP, dig now properly handles
+                       "+tries=1 +retry=0" by not retrying the connection when
+                       the remote server closes the connection prematurely.
+                       [GL #2490]
+
+5607.  [bug]           As "rndc dnssec -checkds" and "rndc dnssec -rollover"
+                       commands may affect the next scheduled key event,
+                       reconfiguration of zone keys is now triggered after
+                       receiving either of these commands to prevent
+                       unnecessary key rollover delays. [GL #2488]
+
+5606.  [bug]           CDS/CDNSKEY DELETE records are now removed when a zone
+                       transitions from a secure to an insecure state.
+                       named-checkzone also no longer reports an error when
+                       such records are found in an unsigned zone. [GL #2517]
+
+5605.  [bug]           "dig -u" now uses the CLOCK_REALTIME clock source for
+                       more accurate time reporting. [GL #2592]
+
+5603.  [bug]           Fix a memory leak that occurred when named failed to
+                       bind a UDP socket to a network interface. [GL #2575]
+
+5602.  [bug]           Fix TCPDNS and TLSDNS timers in Network Manager. This
+                       makes the "tcp-initial-timeout" and "tcp-idle-timeout"
+                       options work correctly again. [GL #2583]
+
+5601.  [bug]           Zones using KASP could not be thawed after they were
+                       frozen using "rndc freeze". This has been fixed.
+                       [GL #2523]
+
+       --- 9.16.13 released ---
+
+5597.  [bug]           When serve-stale was enabled and starting the recursive
+                       resolution process for a query failed, a named instance
+                       could crash if it was configured as both a recursive and
+                       authoritative server. This problem was introduced by
+                       change 5573 and has now been fixed. [GL #2565]
+
+5595.  [cleanup]       Public header files for BIND 9 libraries no longer
+                       directly include third-party library headers. This
+                       prevents the need to include paths to third-party header
+                       files in CFLAGS whenever BIND 9 public header files are
+                       used, which could cause build-time issues on hosts with
+                       older versions of BIND 9 installed. [GL #2357]
+
+5594.  [bug]           Building with --enable-dnsrps --enable-dnsrps-dl failed.
+                       [GL #2298]
+
+5593.  [bug]           Journal files written by older versions of named can now
+                       be read when loading zones, so that journal
+                       incompatibility does not cause problems on upgrade.
+                       Outdated journals are updated to the new format after
+                       loading. [GL #2505]
+
+5592.  [bug]           Prevent hazard pointer table overflows on machines with
+                       many cores, by allowing the thread IDs (serving as
+                       indices into hazard pointer tables) of finished threads
+                       to be reused by those created later. [GL #2396]
+
+5591.  [bug]           Fix a crash that occurred when
+                       "stale-answer-client-timeout" was triggered without any
+                       (stale) data available in the cache to answer the query.
+                       [GL #2503]
+
+5590.  [bug]           NSEC3 records were not immediately created for dynamic
+                       zones using NSEC3 with "dnssec-policy", resulting in
+                       such zones going bogus. Add code to process the
+                       NSEC3PARAM queue at zone load time so that NSEC3 records
+                       for such zones are created immediately. [GL #2498]
+
+5588.  [func]          Add a new "purge-keys" option for "dnssec-policy". This
+                       option determines the period of time for which key files
+                       are retained after they become obsolete. [GL #2408]
+
+5586.  [bug]           An invalid direction field in a LOC record resulted in
+                       an INSIST failure when a zone file containing such a
+                       record was loaded. [GL #2499]
+
+5584.  [bug]           No longer set the IP_DONTFRAG option on UDP sockets, to
+                       prevent dropping outgoing packets exceeding
+                       "max-udp-size". [GL #2466]
+
+5582.  [bug]           BIND 9 failed to build when static OpenSSL libraries
+                       were used and the pkg-config files for libssl and/or
+                       libcrypto were unavailable. This has been fixed by
+                       ensuring that the correct linking order for libssl and
+                       libcrypto is always used. [GL #2402]
+
+5581.  [bug]           Fix a memory leak that occurred when inline-signed zones
+                       were added to the configuration, followed by a
+                       reconfiguration of named. [GL #2041]
+
+5580.  [test]          The system test framework no longer differentiates
+                       between SKIPPED and UNTESTED system test results. Any
+                       system test which is not run is now marked as SKIPPED.
+                       [GL !4517]
+
+5573.  [func]          When serve-stale is enabled and stale data is available,
+                       named now returns stale answers upon encountering any
+                       unexpected error in the query resolution process.
+                       However, the "stale-refresh-time" window is still only
+                       started upon a timeout. [GL #2434]
+
+5564.  [cleanup]       Network manager's TLSDNS module was refactored to use
+                       libuv and libssl directly instead of a stack of TCP/TLS
+                       sockets. [GL #2335]
+
        --- 9.16.12 released ---
 
 5578.  [protocol]      Make "check-names" accept A records below "_spf",
diff -r e7ec5beb1e9a -r c28305e5bf24 external/mpl/bind/dist/PLATFORMS
--- a/external/mpl/bind/dist/PLATFORMS  Thu Apr 29 09:27:29 2021 +0000
+++ b/external/mpl/bind/dist/PLATFORMS  Thu Apr 29 16:46:17 2021 +0000
@@ -43,7 +43,7 @@ following systems:
   * Red Hat Enterprise Linux / CentOS 7, 8
   * FreeBSD 11.4, 12.2
   * OpenBSD 6.8
-  * Alpine Linux 3.12
+  * Alpine Linux 3.13
 
 The amd64, i386, armhf and arm64 CPU architectures are all fully
 supported.
diff -r e7ec5beb1e9a -r c28305e5bf24 external/mpl/bind/dist/PLATFORMS.md
--- a/external/mpl/bind/dist/PLATFORMS.md       Thu Apr 29 09:27:29 2021 +0000
+++ b/external/mpl/bind/dist/PLATFORMS.md       Thu Apr 29 16:46:17 2021 +0000
@@ -51,7 +51,7 @@ following systems:
 * Red Hat Enterprise Linux / CentOS 7, 8
 * FreeBSD 11.4, 12.2
 * OpenBSD 6.8
-* Alpine Linux 3.12
+* Alpine Linux 3.13
 
 The amd64, i386, armhf and arm64 CPU architectures are all fully supported.
 
diff -r e7ec5beb1e9a -r c28305e5bf24 external/mpl/bind/dist/aclocal.m4
--- a/external/mpl/bind/dist/aclocal.m4 Thu Apr 29 09:27:29 2021 +0000
+++ b/external/mpl/bind/dist/aclocal.m4 Thu Apr 29 16:46:17 2021 +0000
@@ -376,6 +376,7 @@ AC_DEFUN([AM_SUBST_NOTMAKE], [_AM_SUBST_
 
 m4_include([m4/ax_check_compile_flag.m4])
 m4_include([m4/ax_check_openssl.m4])
+m4_include([m4/ax_gcc_func_attribute.m4])
 m4_include([m4/ax_posix_shell.m4])
 m4_include([m4/ax_pthread.m4])
 m4_include([m4/ax_restore_flags.m4])
diff -r e7ec5beb1e9a -r c28305e5bf24 external/mpl/bind/dist/bin/check/Makefile.in
--- a/external/mpl/bind/dist/bin/check/Makefile.in      Thu Apr 29 09:27:29 2021 +0000
+++ b/external/mpl/bind/dist/bin/check/Makefile.in      Thu Apr 29 16:46:17 2021 +0000
@@ -15,9 +15,8 @@ VERSION=@BIND9_VERSION@
 
 @BIND9_MAKE_INCLUDES@
 
-CINCLUDES =    ${NS_INCLUDES} ${BIND9_INCLUDES} ${DNS_INCLUDES} ${ISCCFG_INCLUDES} \
-               ${ISC_INCLUDES} \
-               ${OPENSSL_CFLAGS}
+CINCLUDES =    ${NS_INCLUDES} ${BIND9_INCLUDES} ${DNS_INCLUDES} \
+               ${ISCCFG_INCLUDES} ${ISC_INCLUDES} ${OPENSSL_CFLAGS}
 
 CDEFINES =     -DNAMED_CONFFILE=\"${sysconfdir}/named.conf\"
 CWARNINGS =
diff -r e7ec5beb1e9a -r c28305e5bf24 external/mpl/bind/dist/bin/dig/dig.rst
--- a/external/mpl/bind/dist/bin/dig/dig.rst    Thu Apr 29 09:27:29 2021 +0000
+++ b/external/mpl/bind/dist/bin/dig/dig.rst    Thu Apr 29 16:46:17 2021 +0000
@@ -449,8 +449,8 @@ abbreviation is unambiguous; for example
    ``+nssearch`` or ``+trace`` query option is used.
 
 ``+retry=T``
-   This option sets the number of times to retry UDP queries to server to ``T``
-   instead of the default, 2. Unlike ``+tries``, this does not include
+   This option sets the number of times to retry UDP and TCP queries to server to ``T``
+   instead of the default, 2.  Unlike ``+tries``, this does not include
    the initial query.
 
 ``+[no]rrcomments``
@@ -532,7 +532,7 @@ abbreviation is unambiguous; for example
    default queries from a name server.
 
 ``+tries=T``
-   This option sets the number of times to try UDP queries to server to ``T``
+   This option sets the number of times to try UDP and TCP queries to server to ``T``
    instead of the default, 3. If ``T`` is less than or equal to zero,
    the number of tries is silently rounded up to 1.
 
diff -r e7ec5beb1e9a -r c28305e5bf24 external/mpl/bind/dist/bin/named/Makefile.in
--- a/external/mpl/bind/dist/bin/named/Makefile.in      Thu Apr 29 09:27:29 2021 +0000
+++ b/external/mpl/bind/dist/bin/named/Makefile.in      Thu Apr 29 16:46:17 2021 +0000
@@ -49,6 +49,7 @@ CINCLUDES =   -I${srcdir}/include -I${srcd
                ${DBDRIVER_INCLUDES} \
                ${LIBUV_CFLAGS} \
                ${FSTRM_CFLAGS} \
+               ${LMDB_CFLAGS} \
                ${OPENSSL_CFLAGS} \
                ${PROTOBUF_C_CFLAGS} \
                ${JSON_C_CFLAGS} \
diff -r e7ec5beb1e9a -r c28305e5bf24 external/mpl/bind/dist/bin/named/named.conf.rst
--- a/external/mpl/bind/dist/bin/named/named.conf.rst   Thu Apr 29 09:27:29 2021 +0000
+++ b/external/mpl/bind/dist/bin/named/named.conf.rst   Thu Apr 29 16:46:17 2021 +0000
@@ -81,6 +81,7 @@ DNSSEC-POLICY
        parent-ds-ttl duration;
        parent-propagation-delay duration;
        publish-safety duration;
+       purge-keys duration;
        retire-safety duration;
        signatures-refresh duration;
        signatures-validity duration;
diff -r e7ec5beb1e9a -r c28305e5bf24 external/mpl/bind/dist/bin/tests/system/README
--- a/external/mpl/bind/dist/bin/tests/system/README    Thu Apr 29 09:27:29 2021 +0000
+++ b/external/mpl/bind/dist/bin/tests/system/README    Thu Apr 29 16:46:17 2021 +0000
@@ -214,9 +214,6 @@ This indicates the type of message.  Thi
             FAIL        The test failed
             SKIPPED     The test was not run, usually because some
                         prerequisites required to run the test are missing.
-            UNTESTED    The test was not run for some other reason, e.g. a
-                        prerequisite is available but is not compatible with
-                        the platform on which the test is run.
 
 <test-name>
 This is the name of the test from which the message emanated, which is also the
@@ -270,9 +267,9 @@ As noted above, each test is in a separa
 test framework, the directories contain the following standard files:
 
 prereq.sh   Run at the beginning to determine whether the test can be run at
-            all; if not, we see a result of R:SKIPPED or R:UNTESTED.  This file
-            is optional: if not present, the test is assumed to have all its
-            prerequisites met.
+            all; if not, we see a R:SKIPPED result.  This file is optional:
+            if not present, the test is assumed to have all its prerequisites
+            met.
 
 setup.sh    Run after prereq.sh, this sets up the preconditions for the tests.
             Although optional, virtually all tests will require such a file to
diff -r e7ec5beb1e9a -r c28305e5bf24 external/mpl/bind/dist/bin/tests/system/checkconf/good.conf
--- a/external/mpl/bind/dist/bin/tests/system/checkconf/good.conf       Thu Apr 29 09:27:29 2021 +0000
+++ b/external/mpl/bind/dist/bin/tests/system/checkconf/good.conf       Thu Apr 29 16:46:17 2021 +0000
@@ -26,6 +26,7 @@ dnssec-policy "test" {
        parent-ds-ttl 7200;
        parent-propagation-delay PT1H;
        publish-safety PT3600S;
+       purge-keys P90D;
        retire-safety PT3600S;



Home | Main Index | Thread Index | Old Index