Merge branch '1265-disable-synth-from-dnssec-by-default-workaround-v9_14' into 'v9_14'

Disable synth-from-dnssec by default [v9_14]

See merge request isc-projects/bind9!2494

CHANGES

@@ -1,3 +1,8 @@
+5305.	[bug]		NSEC Aggressive Cache ("synth-from-dnssec") has been
+			disabled by default because it was found to have
+			a significant performance impact on the recursive
+			service. [GL #1265]
+
 5304.	[bug]		"dnskey-sig-validity 0;" was not being accepted.
 			[GL #876]
 

bin/named/config.c

@@ -197,7 +197,7 @@ options {\n\
 #	sortlist <none>\n\
 	stale-answer-enable false;\n\
 	stale-answer-ttl 1; /* 1 second */\n\
-	synth-from-dnssec yes;\n\
+	synth-from-dnssec no;\n\
 #	topology <none>\n\
 	transfer-format many-answers;\n\
 	v6-bias 50;\n\

bin/tests/system/synthfromdnssec/tests.sh

@@ -93,7 +93,7 @@ sleep 1
 for ns in 2 4 5
 do
     case $ns in
-    2) synth=yes description="<default>";;
+    2) synth=no description="<default>";;
     4) synth=no  description="no";;
     5) synth=yes description="yes";;
     *) exit 1;;
@@ -171,7 +171,7 @@ ret=0
 dig_with_opts b.redirect. @10.53.0.3 a > dig.out.ns2.test$n || ret=1
 grep "flags:[^;]* ad[ ;]" dig.out.ns2.test$n > /dev/null || ret=1
 grep "status: NXDOMAIN," dig.out.ns2.test$n > /dev/null || ret=1
-grep "\..*3600.IN.SOA" dig.out.ns2.test$n > /dev/null && ret=1
+grep "\..*3600.IN.SOA" dig.out.ns2.test$n > /dev/null || ret=1
 n=$((n+1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))

doc/arm/Bv9ARM-book.xml

@@ -6812,7 +6812,9 @@ options {
 		<para>
 		  Synthesize answers from cached NSEC, NSEC3 and
 		  other RRsets that have been proved to be correct
-		  using DNSSEC.  The default is <command>yes</command>.
+		  using DNSSEC.  The default is <command>no</command>,
+		  but it will become <command>yes</command> again
+		  in the future releases.
 		</para>
 		<para>
 		  Note:

doc/arm/notes-feature-changes.xml

@@ -0,0 +1,23 @@
+<!--
+ - Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ -
+ - This Source Code Form is subject to the terms of the Mozilla Public
+ - License, v. 2.0. If a copy of the MPL was not distributed with this
+ - file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ -
+ - See the COPYRIGHT file distributed with this work for additional
+ - information regarding copyright ownership.
+-->
+
+<section xml:id="relnotes_changes"><info><title>Feature Changes</title></info>
+  <itemizedlist>
+    <listitem>
+      <para>
+	NSEC Aggressive Cache (synth-from-dnssec) has been disabled by default
+	because it was found to have a significant performance impact on the
+	recursive service. The NSEC Aggressive Cache will be enable by default
+	in the future releases. [GL #1265]
+      </para>
+    </listitem>
+  </itemizedlist>
+</section>

doc/arm/notes.xml

@@ -25,6 +25,7 @@
   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-download.xml"/>
   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-sec-fixes.xml"/>
   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-new-features.xml"/>
+  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-feature-changes.xml"/>
   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-bug-fixes.xml"/>
   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-license.xml"/>
   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-eol.xml"/>

util/copyrights

@@ -1525,6 +1525,7 @@
 ./doc/arm/notes-bug-fixes.xml			SGML	2019
 ./doc/arm/notes-download.xml			SGML	2019
 ./doc/arm/notes-eol.xml				SGML	2019
+./doc/arm/notes-feature-changes.xml		SGML	2019
 ./doc/arm/notes-intro.xml			SGML	2019
 ./doc/arm/notes-license.xml			SGML	2019
 ./doc/arm/notes-new-features.xml		SGML	2019