If trying to validate a key set that happens to be a security root, the
validation should only consist of checking that each key in the key set
is also in the list of security root keys.
Strangeness occurs when the key set is signed, since the key set is marked
as secure, but the sig set is not, since it wasn't used in the validation
process. This means that a query for a key set at a security root will
have the AD bit set if the key set is unsigned and not if the key set is signed.
324. [func] In the resolver, turn EDNS0 off if there is no
response after a number of retransmissions.
This is to allow queries some chance of succeeding
even if all the authoritative servers of a zone
silently discard EDNS0 requests instead of
sending an error response like they ought to.
323. [bug] dns_rbt_findname() did not ignore empty rbt nodes.
Because of this, servers authoritative for a parent
and grandchild zone but not authoritative for the
intervening child zone did not correctly issue
referrals to the servers of the child zone.
Check that zone->view is not NULL before checking that zone->view->adb is not
NULL. It appears that zone maintenance can occur when the zone is shutting
down and the view pointer is NULL. We don't want to do zone maintenance in
this case.
322. [bug] Queries for KEY RRs are now sent to the parent
server rather than the authoritative one, making
DNSSEC insecurity proofs work in many cases
where they previously didn't.
299. [cleanup] Get the user and group information before changing the
root directory, so the administrator does not need to
keep a copy of the user and group databases in the
chroot'ed environment. Suggested by Hakan Olsson.
In query_find(), if we're looking up a key and dns_db_find() returns
DNS_R_DELEGATION, don't use the domain & ns set found by dns_db_find().
This means that a recursive server will not immediately ask the child zone
for a key set at the apex; the resolver will determine who to ask.
If we're asking for a key and need to call dns_view_findzonecut(), set
the DNS_DB_NOEXACT flag. This means that the resolver will start look for the
key at or above the parent zone, and will return the key set from the parent
zone if key sets are present in both the parent and child.
299. [cleanup] Get the user and group information before changing the
root directory, so the administrator does not need to
keep a copy of the user and group databases in the
chroot'ed environment. Suggested by Hakan Olsson.
(including multiple fixes to the original change)
313. [bug] When parsing resolv.conf, don't terminate on an
error. Instead, parse as much as possible, but
still return an error if one was found.
312. [bug] Increase the number of allowed elements in the
resolv.conf search path from 6 to 8. If there
are more than this, ignore the remainder rather
than returning a failure in lwres_conf_parse.
make the warning message say 'file does not end with newline' instead of
'unexpected end of file' to lead the user on the right tracks to fixing
the most likely cause. Also, don't include the function name in the message.
