Commit Graph

206 Commits

Author SHA1 Message Date
Mark Andrews
967c2a93ac issue -> flaw
(cherry picked from commit 268f9e6832)
2016-07-13 11:23:36 +10:00
Mark Andrews
b740318a42 add CVE-2016-2775
(cherry picked from commit 909d442cc0)
2016-07-12 01:09:37 +10:00
Mark Andrews
da984e8fc5 add note for rt42694
(cherry picked from commit 429701008e)
2016-07-07 13:50:56 +10:00
Mark Andrews
d2647cd5fd license section is no longer a list 2016-07-06 13:01:40 +10:00
Mark Andrews
988c13928a spelling 2016-07-06 12:57:34 +10:00
Evan Hunt
f0e7471845 [v9_11] notes formatting, fix a CHANGES tag 2016-07-02 14:06:27 -07:00
Witold Krecicki
4ab08a8117 Fix a typo and missing link in notes.xml 2016-06-27 19:33:10 +02:00
Curtis Blackburn
448e23ed61 cleanup of notes.xml
added better text to describe the license change

    added information about the following changes to notes.xml

    +4396. [func] dnssec-keymgr now takes a '-r randomfile' option.
    + [RT #42455]
    +4392. [func] Collect statistics for RSSAC02v3 traffic-volume,
    + traffic-sizes and rcode-volume reporting. [RT #41475]
    +4388. [func] Support for master entries with TSIG keys in catalog
    + zones. [RT #42577]
    +4385. [func] Add support for allow-query and allow-transfer ACLs
    + to catalog zones. [RT #42578]
2016-06-27 10:01:58 -07:00
Mark Andrews
0c27b3fe77 4401. [misc] Change LICENSE to MPL 2.0. 2016-06-27 14:56:38 +10:00
Mark Andrews
7d262a3647 4394. [func] Add rndc command "dnstap-reopen" to close and
reopen dnstap output filed. [RT #41803]
2016-06-24 09:37:04 +10:00
Witold Krecicki
7a00d69909 4376. [experimental] Added support for Catalog Zones, a new method for
provisioning secondary servers in which a list of
                        zones to be served is stored in a DNS zone and can
                        be propagated to slaves via AXFR/IXFR. [RT #41581]

4375.   [func]          Add support for automatic reallocation of isc_buffer
                        to isc_buffer_put* functions. [RT #42394]
2016-05-26 21:23:19 +02:00
Evan Hunt
5c5dcf34c3 [master] spelling 2016-05-25 18:44:59 -07:00
Evan Hunt
8e4d28d018 [master] extend release notes 2016-05-25 18:40:47 -07:00
Evan Hunt
9211688e88 [master] fix tag mismatch 2016-05-25 18:32:38 -07:00
Evan Hunt
0cbe448914 [master] minimal-any
4371.	[func]		New "minimal-any" option reduces the size of UDP
			responses for qtype ANY by returning a single
			arbitrarily selected RRset instead of all RRsets.
			Thanks to Tony Finch. [RT #41615]
2016-05-25 13:54:34 -07:00
Mark Andrews
47d19078de note RNDC module 2016-05-24 10:47:58 +10:00
Mark Andrews
259107718f update for 9.11.0a2 2016-05-17 14:08:30 +10:00
Witold Krecicki
e846f127d6 4362. [func] Changed rndc reconfig behaviour so that newly added
zones are loaded asynchronously and the loading does
			not block the server. [RT #41934]
2016-05-05 21:41:12 +02:00
Evan Hunt
370c6e0ac1 [master] add nsip-wait-recurse release note 2016-05-05 09:33:28 -07:00
Evan Hunt
66074f152f [master] log message when using ISC DLV
4352.	[cleanup]	The ISC DNSSEC Lookaside Validation (DLV) service
			is scheduled to be disabled in 2017.  A warning is
			now logged when named is configured to use it,
			either explicitly or via "dnssec-lookaside auto;"
			[RT #42207]
2016-05-04 14:37:25 -07:00
Mark Andrews
1bebd86e9f fix tag mis-match 2016-04-29 11:10:21 +10:00
Evan Hunt
f6096b958c [master] dnssec-keymgr
4349.   [contrib]       kasp2policy: A python script to create a DNSSEC
                        policy file from an OpenDNSSEC KASP XML file.

4348.	[func]		dnssec-keymgr: A new python-based DNSSEC key
			management utility, which reads a policy definition
			file and can create or update DNSSEC keys as needed
			to ensure that a zone's keys match policy, roll over
			correctly on schedule, etc.  Thanks to Sebastian
			Castro for assistance in development. [RT #39211]
2016-04-28 00:16:01 -07:00
Evan Hunt
4d3f9f216a [master] better relnote for read-only controls option 2016-03-24 16:52:17 -07:00
Evan Hunt
1831596a79 [master] fixes for release notes 2016-03-24 14:40:44 -07:00
Evan Hunt
936bfae6d5 [master] remove pre-9.11.0a1 security fixes from 9.11 release notes 2016-03-24 12:11:53 -07:00
Tinderbox User
46472a450e regen master 2016-03-23 06:45:14 +00:00
Evan Hunt
bee8d5b202 [master] fix broken tag 2016-03-22 21:38:25 -07:00
Evan Hunt
4488842485 [master] prep 9.11.0a1 2016-03-22 20:00:47 -07:00
Mark Andrews
98c5690bd9 note rrsig regeneration 2016-03-10 17:05:49 +11:00
Mark Andrews
7a3a30e296 add AVC 2016-03-04 18:18:04 +11:00
Evan Hunt
44c86318ed [master] recursively clean empty interior nodes when deleting database records
4324.	[bug]		When deleting records from a zone database, interior
			nodes could be left empty but not deleted, damaging
			search performance afterward. [RT #40997]
2016-03-03 21:13:42 -08:00
Mark Andrews
455c0848f8 4322. [security] Duplicate EDNS COOKIE options in a response could
trigger an assertion failure. (CVE-2016-2088)
                        [RT #41809]
2016-02-27 11:23:50 +11:00
Mukund Sivaraman
5995fec51c Fix resolver assertion failure due to improper DNAME handling (CVE-2016-1286) (#41753) 2016-02-22 12:22:43 +05:30
Mark Andrews
a2b15b3305 4318. [security] Malformed control messages can trigger assertions
in named and rndc. (CVE-2016-1285) [RT #41666]
2016-02-18 12:11:27 +11:00
Evan Hunt
b5c22260e5 [master] remove reporter's name per his request 2016-01-29 10:35:14 -08:00
Evan Hunt
630b2d0c5a [master] NOSETFC incorrectly applied
4300.	[bug]		A flag could be set in the wrong field when setting
			up nonrecursive queries; this could cause the
			SERVFAIL cache to cache responses it shouldn't.
			New querytrace logging has been added which
			identified this error. [RT #41155]
2016-01-22 13:58:11 -08:00
Evan Hunt
bb5d14d724 [master] millisecond granularity for statschannel timers
4290.	[func]		The timers returned by the statistics channel
			(indicating current time, server boot time, and
			most recent reconfiguration time) are now reported
			with millisecond accuracy. [RT #40082]
2016-01-07 15:34:58 -08:00
Evan Hunt
455b99ed92 [master] fix ticket number 2016-01-05 09:08:49 -08:00
Evan Hunt
c8b968f414 [master] fix use after free on xfr timeout
4289.	[bug]		The server could crash due to memory being used
			after it was freed if a zone transfer timed out.
			[RT #41297]
2016-01-04 22:05:23 -08:00
Evan Hunt
aadca3f7d0 [master] Merge branch 'master' of ssh://repo/proj/git/prod/bind9 2016-01-04 16:09:40 -08:00
Evan Hunt
41494939b6 [master] fixed bogus server regression
4288.	[bug]		Fixed a regression in resolver.c:possibly_mark()
			which caused known-bogus servers to be queried
			anyway. [RT #41321]
2016-01-04 15:47:16 -08:00
Tinderbox User
e1836d1fe4 update copyright notice / whitespace 2016-01-04 23:45:26 +00:00
Evan Hunt
43176d82c8 [master] clean up notes 2016-01-03 21:22:00 -08:00
Mark Andrews
292eb9c4e4 4286. [security] render_ecs errors were mishandled when printing out
a OPT record resulting in a assertion failure.
                        (CVE-2015-8705) [RT #41397]

(cherry picked from commit 3e0c1603a8)
2015-12-31 22:19:46 +11:00
Mark Andrews
9c52f43036 remove period 2015-12-31 14:35:06 +11:00
Mark Andrews
1b3d211802 4285. [security] Specific APL data could trigger a INSIST.
(CVE-2015-8704) [RT #41396]
2015-12-31 13:43:21 +11:00
Evan Hunt
fbed5f0f44 [master] fix geoip options
4284.	[bug]		Some GeoIP options were incorrectly documented
			using abbreviated forms which were not accepted by
			named.  The code has been updated to allow both
			long and abbreviated forms. [RT #41381]
2015-12-26 10:50:32 -08:00
Mark Andrews
8beb9bf514 add dig +mapped 2015-12-19 09:51:53 +11:00
Mukund Sivaraman
6960e7fd12 Update notes.xml for #40996 2015-12-15 18:06:13 +05:30
Evan Hunt
4071efbec0 [master] disallow map zones in response-policy
4269.	[bug]		Zones using "map" format master files currently
			don't work as policy zones.  This limitation has
			now been documented; attempting to use such zones
			in "response-policy" statements is now a
			configuration error.  [RT #38321]
2015-12-02 21:10:09 -08:00