3496. [func] Improvements to RPZ performance. The "response-policy"
syntax now includes a "min-ns-dots" clause, with
default 1, to exclude top-level domains from
NSIP and NSDNAME checking. [RT #32251]
Response policy (rpz) changes to
- add zone statistics
- speed up by adding min-ns-dots to the response-policy syntax
with a default of 1
- detect and reject policy zones with a database other than rbt
only rbtdb has rpz hooks
- allow empty response-policy{} statement
- make --enable-rpz-nsip and --enable-rpz-nsdname the default
(cherry picked from commit 8159e80279408be50d31db5d853ae2736bd1934d)
3468. [security] RPZ rules to generate A records (but not AAAA records)
could trigger an assertion failure when used in
conjunction with DNS64. [RT #32141]
(cherry picked from commit 71f8edccba)
[RT #32315]
Squashed commit of the following:
commit ad40744e2c7dc253b70857bb229def5dd194b418
Author: Mark Andrews <marka@isc.org>
Date: Fri Jan 4 17:24:45 2013 +1100
logfileconfig spams the system log files
Conflicts:
bin/named/main.c
Conflicts:
bin/tests/system/logfileconfig/tests.sh
3448. [bug] The allow-query-on ACL was not processed correctly.
[RT #29486]
(cherry picked from commit 222d38735f)
(cherry picked from commit 8d9207a17b)
Squashed commit of the following:
commit bce2efe66d69d60b746b85df49974ca341723169
Author: Mark Andrews <marka@isc.org>
Date: Mon Oct 29 12:59:25 2012 +1100
use 'static dns_rdata_xxxx_t xxxx'
commit 704d3c29acbf2dd350a26f2df82a57cb077ba72e
Author: Mark Andrews <marka@isc.org>
Date: Mon Oct 29 12:35:16 2012 +1100
return ISC_R_NOTFOUND if private record length does not make sense
commit 7596610c12c5685336fc0909860173d2fae359af
Author: Mark Andrews <marka@isc.org>
Date: Sat Oct 27 21:41:17 2012 +1100
check private->length == 5
commit 3836365a3e3e83b057bd940350f032279e080296
Author: Mark Andrews <marka@isc.org>
Date: Sat Oct 27 21:40:50 2012 +1100
properly set private->length
commit a295778ac53109d39ef3a8b233751100edae678b
Author: Mark Andrews <marka@isc.org>
Date: Sat Oct 27 21:13:30 2012 +1100
check dns_rdata_tostruct result
commit e33c37ca9112159e0b2363615bb018d27fa7d1a5
Author: Mark Andrews <marka@isc.org>
Date: Sat Oct 27 21:10:43 2012 +1100
check remove/fopen/chmod return values
commit 3a675e0666aae25d1c51f51ec7bd3fbe25545aae
Author: Mark Andrews <marka@isc.org>
Date: Sat Oct 27 20:59:10 2012 +1100
check isc_socket_accept result
commit 696923344f4b07ce0dba4cf2675b1cbb6eba7e8e
Author: Mark Andrews <marka@isc.org>
Date: Sat Oct 27 20:55:40 2012 +1100
change variable scopes
commit b9e9d9ad58270271003e463f10744e0ceaf9ad97
Author: Mark Andrews <marka@isc.org>
Date: Sat Oct 27 20:53:19 2012 +1100
check inet_pton return value
commit 70698e9589da77e3745efb6ea24b8830addd6ae4
Author: Mark Andrews <marka@isc.org>
Date: Sat Oct 27 20:52:40 2012 +1100
break -> /* NOTREACHED */
commit 88de9de2e8e201ab2fef16a868f241e8206ea826
Author: Mark Andrews <marka@isc.org>
Date: Sat Oct 27 20:52:06 2012 +1100
strcpy -> strlcpy
commit 6ba79c7cec0e48014cdfa76e8a9406b7a921556e
Author: Mark Andrews <marka@isc.org>
Date: Sat Oct 27 20:51:26 2012 +1100
check dns_rdata_tostruct return values
Conflicts:
bin/tests/rdata_test.c
lib/dns/private.c
lib/dns/tests/private_test.c
lib/dns/zone.c
3383. [security] A certain combinations of records in the RBT could
cause named to hang while populating the additional
section of a response. [RT #31090]
