This commit was manufactured by cvs2git to create branch 'rt22288_method2'.

update
update copyright notice
2010-11-29 02:15:07 +00:00 · 2010-11-29 02:15:06 +00:00 · 2010-11-29 01:15:44 +00:00 · 2010-11-29 01:11:04 +00:00 · 2010-11-29 00:41:03 +00:00 · 2010-11-29 00:40:13 +00:00
34 changed files with 1427 additions and 676 deletions
--- a/27
+++ b/27
@@ -1,3 +1,30 @@
+	--- 9.4-ESV-R4 released ---
+
+2970.	[security]	Adding a NO DATA negative cache entry failed to clear
+			any matching RRSIG records.  A subsequent lookup of
+			of NO DATA cache entry could trigger a INSIST when the
+			unexpected RRSIG was also returned with the NO DATA
+			cache entry.
+
+			CVE-2010-3613, VU#706148. [RT #22288]
+
+2968.	[security]	Named could fail to prove a data set was insecure
+			before marking it as insecure.  One set of conditions
+			that can trigger this occurs naturally when rolling
+			DNSKEY algorithms.
+
+			CVE-2010-3614, VU#837744. [RT #22309]
+
+2966.	[bug]		isc_print_vsnprintf() failed to check if there was
+			space available in the buffer when adding a left
+			justified character with a non zero width,
+			(e.g. "%-1c"). [RT #22270]
+
+2962.	[port]		win32: add more dependancies to BINDBuild.dsw.
+			[RT #22062]
+
+2786.	[bug]		Additional could be promoted to answer. [RT #20663]
+
 	--- 9.4-ESV-R3 released ---

 2925.	[bug]		Named failed to accept uncachable negative responses
--- a/RELEASE-NOTES-BIND-9.4-ESV.html
+++ b/RELEASE-NOTES-BIND-9.4-ESV.html
@@ -0,0 +1,123 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<!--
+ - Copyright (C) 2010  Internet Systems Consortium, Inc. ("ISC")
+ -
+ - Permission to use, copy, modify, and/or distribute this software for any
+ - purpose with or without fee is hereby granted, provided that the above
+ - copyright notice and this permission notice appear in all copies.
+ -
+ - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ - AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ - PERFORMANCE OF THIS SOFTWARE.
+-->
+
+<!-- $Id: RELEASE-NOTES-BIND-9.4-ESV.html,v 1.1.2.2 2010/11/29 01:15:44 tbox Exp $ -->
+
+<html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title></title><link rel="stylesheet" type="text/css" href="release-notes.css" /><meta name="generator" content="DocBook XSL Stylesheets V1.76.1" /></head><body><div class="article"><div class="titlepage"><hr /></div>
+
+  <div class="section" title="Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id36111797"></a>Introduction</h2></div></div></div>
+    
+    <p>
+			BIND 9.3-ESV-R4 is a maintenance release for BIND 9.4-ESV.
+		</p>
+    <p>
+			This document summarizes changes from BIND 9.4-ESV-R3 to BIND 9.4-ESV-R4.
+			Please see the CHANGES file in the source code release for a
+			complete list of all changes.
+		</p>
+  </div>
+
+  <div class="section" title="Download"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id36111880"></a>Download</h2></div></div></div>
+    
+    <p>
+			The latest release of BIND 9 software can always be found
+	 		on our web site at
+      <a class="ulink" href="http://www.isc.org/software/bind" target="_top">http://www.isc.org/software/bind</a>.
+  		There you will find additional information about each release,
+ 			source code, and some pre-compiled versions for certain operating
+ 			systems.
+		</p>
+  </div>
+
+  <div class="section" title="Support"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id36111815"></a>Support</h2></div></div></div>
+    
+    <p>Product support information is available on
+      <a class="ulink" href="http://www.isc.org/services/support" target="_top">http://www.isc.org/services/support</a>
+      for paid support options.  Free support is provided by our user
+ 			community via a mailing list.  Information on all public email
+ 			lists is available at
+      <a class="ulink" href="https://lists.isc.org/mailman/listinfo" target="_top">https://lists.isc.org/mailman/listinfo</a>.
+    </p>
+  </div>
+
+  <div class="section" title="New Features"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id36111957"></a>New Features</h2></div></div></div>
+    
+		<div class="section" title="9.4-ESV-R4"><div class="titlepage"><div><div><h3 class="title"><a id="id36111972"></a>9.4-ESV-R4</h3></div></div></div>
+			
+			<p>None.</p>
+		</div>
+  </div>
+
+  <div class="section" title="Feature Changes"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id36111905"></a>Feature Changes</h2></div></div></div>
+    
+		<div class="section" title="9.4-ESV-R4"><div class="titlepage"><div><div><h3 class="title"><a id="id36111988"></a>9.4-ESV-R4</h3></div></div></div>
+			
+			<p>None.</p>
+		</div>
+  </div>
+
+  <div class="section" title="Security Fixes"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id36111999"></a>Security Fixes</h2></div></div></div>
+    
+		<div class="section" title="9.4-ESV-R4"><div class="titlepage"><div><div><h3 class="title"><a id="id36112004"></a>9.4-ESV-R4</h3></div></div></div>
+			
+			<div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem">
+				 	Adding a NO DATA signed negative response to cache failed to clear
+				  any matching RRSIG records already in cache. A subsequent lookup
+				  of the cached NO DATA entry could crash named (INSIST) when the
+				  unexpected RRSIG was also returned with the NO DATA cache entry.
+				  [RT #22288] [CVE-2010-3613] [VU#706148]
+				</li><li class="listitem">
+					BIND, acting as a DNSSEC validator, was determining if the NS RRset
+				  is insecure based on a value that could mean either that the RRset
+				  is actually insecure or that there wasn't a matching key for the RRSIG
+				  in the DNSKEY RRset when resuming from validating the DNSKEY RRset.
+				  This can happen when in the middle of a DNSKEY algorithm rollover,
+				  when two different algorithms were used to sign a zone but only the
+				  new set of keys are in the zone DNSKEY RRset.
+					[RT #22309] [CVE-2010-3614] [VU#837744]
+				</li></ul></div>
+		</div>
+  </div>
+
+  <div class="section" title="Bug Fixes"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id36112029"></a>Bug Fixes</h2></div></div></div>
+    
+		<div class="section" title="9.4-ESV-R4"><div class="titlepage"><div><div><h3 class="title"><a id="id36112035"></a>9.4-ESV-R4</h3></div></div></div>
+			
+	    <div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem">
+          isc_print_vsnprintf() failed to check if there was
+					space available in the buffer when adding a left
+					justified character with a non zero width,
+					(e.g. "%-1c").
+					[RT #22270]
+				</li><li class="listitem">
+          win32: add more dependencies to BINDBuild.dsw.
+          [RT #22062]
+				</li></ul></div>
+		</div>
+  </div>
+
+  <div class="section" title="Thank You"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id36112054"></a>Thank You</h2></div></div></div>
+    
+    <p>
+      Thank you to everyone who assisted us in making this release possible.
+      If you would like to contribute to ISC to assist us in continuing to make
+      quality open source software, please visit our donations page at
+      <a class="ulink" href="http://www.isc.org/supportisc" target="_top">http://www.isc.org/supportisc</a>.
+    </p>
+  </div>
+</div></body></html>
--- a/RELEASE-NOTES-BIND-9.4-ESV.pdf
+++ b/RELEASE-NOTES-BIND-9.4-ESV.pdf
--- a/RELEASE-NOTES-BIND-9.4-ESV.txt
+++ b/RELEASE-NOTES-BIND-9.4-ESV.txt
@@ -0,0 +1,70 @@
+     __________________________________________________________________
+
+Introduction
+
+   BIND 9.3-ESV-R4 is a maintenance release for BIND 9.4-ESV.
+
+   This document summarizes changes from BIND 9.4-ESV-R3 to BIND
+   9.4-ESV-R4. Please see the CHANGES file in the source code release for
+   a complete list of all changes.
+
+Download
+
+   The latest release of BIND 9 software can always be found on our web
+   site at http://www.isc.org/software/bind. There you will find
+   additional information about each release, source code, and some
+   pre-compiled versions for certain operating systems.
+
+Support
+
+   Product support information is available on
+   http://www.isc.org/services/support for paid support options. Free
+   support is provided by our user community via a mailing list.
+   Information on all public email lists is available at
+   https://lists.isc.org/mailman/listinfo.
+
+New Features
+
+9.4-ESV-R4
+
+   None.
+
+Feature Changes
+
+9.4-ESV-R4
+
+   None.
+
+Security Fixes
+
+9.4-ESV-R4
+
+     * Adding a NO DATA signed negative response to cache failed to clear
+       any matching RRSIG records already in cache. A subsequent lookup of
+       the cached NO DATA entry could crash named (INSIST) when the
+       unexpected RRSIG was also returned with the NO DATA cache entry.
+       [RT #22288] [CVE-2010-3613] [VU#706148]
+     * BIND, acting as a DNSSEC validator, was determining if the NS RRset
+       is insecure based on a value that could mean either that the RRset
+       is actually insecure or that there wasn't a matching key for the
+       RRSIG in the DNSKEY RRset when resuming from validating the DNSKEY
+       RRset. This can happen when in the middle of a DNSKEY algorithm
+       rollover, when two different algorithms were used to sign a zone
+       but only the new set of keys are in the zone DNSKEY RRset. [RT
+       #22309] [CVE-2010-3614] [VU#837744]
+
+Bug Fixes
+
+9.4-ESV-R4
+
+     * isc_print_vsnprintf() failed to check if there was space available
+       in the buffer when adding a left justified character with a non
+       zero width, (e.g. "%-1c"). [RT #22270]
+     * win32: add more dependencies to BINDBuild.dsw. [RT #22062]
+
+Thank You
+
+   Thank you to everyone who assisted us in making this release possible.
+   If you would like to contribute to ISC to assist us in continuing to
+   make quality open source software, please visit our donations page at
+   http://www.isc.org/supportisc.
--- a/bin/named/query.c
+++ b/bin/named/query.c
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: query.c,v 1.257.18.55 2010/07/03 23:45:26 tbox Exp $ */
+/* $Id: query.c,v 1.257.18.56 2010/11/17 10:21:01 marka Exp $ */

 /*! \file */

@@ -1129,7 +1129,8 @@ query_addadditional(void *arg, dns_name_t *name, dns_rdatatype_t qtype) {
 			goto cleanup;
 	}
 	result = dns_db_find(db, name, version, type,
-			     client->query.dboptions | DNS_DBFIND_GLUEOK,
+			     client->query.dboptions |
+			     DNS_DBFIND_GLUEOK | DNS_DBFIND_ADDITIONALOK,
 			     client->now, &node, fname, rdataset,
 			     sigrdataset);
 	if (result == DNS_R_GLUE &&
@@ -1614,7 +1615,8 @@ query_addadditional2(void *arg, dns_name_t *name, dns_rdatatype_t qtype) {
 		goto try_glue;

 	result = dns_db_find(db, name, version, type,
-			     client->query.dboptions | DNS_DBFIND_GLUEOK,
+			     client->query.dboptions |
+			     DNS_DBFIND_GLUEOK | DNS_DBFIND_ADDITIONALOK,
 			     client->now, &node, fname, NULL, NULL);
 	if (result == ISC_R_SUCCESS)
 		goto found;
--- a/bin/tests/system/dnssec/ns1/root.db.in
+++ b/bin/tests/system/dnssec/ns1/root.db.in
@@ -1,7 +1,7 @@
-; Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+; Copyright (C) 2004, 2010  Internet Systems Consortium, Inc. ("ISC")
 ; Copyright (C) 2000, 2001  Internet Software Consortium.
 ;
-; Permission to use, copy, modify, and distribute this software for any
+; Permission to use, copy, modify, and/or distribute this software for any
 ; purpose with or without fee is hereby granted, provided that the above
 ; copyright notice and this permission notice appear in all copies.
 ;
@@ -13,7 +13,7 @@
 ; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 ; PERFORMANCE OF THIS SOFTWARE.

-; $Id: root.db.in,v 1.8 2004/03/10 02:19:53 marka Exp $
+; $Id: root.db.in,v 1.8.18.2 2010/11/16 23:45:23 tbox Exp $

 $TTL 300
 . 			IN SOA	gson.nominum.com. a.root.servers.nil. (
@@ -30,3 +30,5 @@ example.		NS	ns2.example.
 ns2.example.		A	10.53.0.2
 dlv.			NS	ns2.dlv.
 ns2.dlv.		A	10.53.0.2
+algroll			NS	ns2.algroll
+ns2.algroll.		A	10.53.0.2
--- a/bin/tests/system/dnssec/ns1/sign.sh
+++ b/bin/tests/system/dnssec/ns1/sign.sh
@@ -1,9 +1,9 @@
 #!/bin/sh
 #
-# Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2006, 2010  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2000-2003  Internet Software Consortium.
 #
-# Permission to use, copy, modify, and distribute this software for any
+# Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
 # copyright notice and this permission notice appear in all copies.
 #
@@ -15,7 +15,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.

-# $Id: sign.sh,v 1.19.18.2 2006/01/04 00:37:23 marka Exp $
+# $Id: sign.sh,v 1.19.18.4 2010/11/16 23:45:23 tbox Exp $

 SYSTEMTESTTOP=../..
 . $SYSTEMTESTTOP/conf.sh
@@ -28,15 +28,16 @@ zonefile=root.db

 (cd ../ns2 && sh sign.sh )

-cp ../ns2/keyset-example. .
-cp ../ns2/keyset-dlv. .
+cp ../ns2/dsset-example. .
+cp ../ns2/dsset-dlv. .
+grep "5 [12]" ../ns2/dsset-algroll. > dsset-algroll.

 keyname=`$KEYGEN -r $RANDFILE -a RSAMD5 -b 768 -n zone $zone`

-cat $infile $keyname.key > $zonefile
+cat $infile $keyname.key dsset-example. dsset-dlv. dsset-algroll. > $zonefile

-echo $SIGNER -g -r $RANDFILE -o $zone $zonefile
-$SIGNER -g -r $RANDFILE -o $zone $zonefile > /dev/null
+echo $SIGNER -r $RANDFILE -o $zone $zonefile
+$SIGNER -r $RANDFILE -o $zone $zonefile > /dev/null

 # Configure the resolving server with a trusted key.

--- a/bin/tests/system/dnssec/ns2/algroll.db.in
+++ b/bin/tests/system/dnssec/ns2/algroll.db.in
@@ -0,0 +1,31 @@
+; Copyright (C) 2010  Internet Systems Consortium, Inc. ("ISC")
+;
+; Permission to use, copy, modify, and/or distribute this software for any
+; purpose with or without fee is hereby granted, provided that the above
+; copyright notice and this permission notice appear in all copies.
+;
+; THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+; REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+; AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+; INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+; LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+; PERFORMANCE OF THIS SOFTWARE.
+
+; $Id: algroll.db.in,v 1.2.12.3 2010/11/16 23:45:23 tbox Exp $
+
+$TTL 30	; 5 minutes
+@			IN SOA	mname1. . (
+				2000042407 ; serial
+				20         ; refresh (20 seconds)
+				20         ; retry (20 seconds)
+				1814400    ; expire (3 weeks)
+				30       ; minimum (1 hour)
+				)
+			NS	ns2
+ns2			A	10.53.0.2
+ns3			A	10.53.0.3
+
+a			A	10.0.0.1
+b			A	10.0.0.2
+d			A	10.0.0.4
--- a/bin/tests/system/dnssec/ns2/named.conf
+++ b/bin/tests/system/dnssec/ns2/named.conf
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2006, 2010  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2000-2002  Internet Software Consortium.
 *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: named.conf,v 1.23.18.3 2006/03/10 00:23:20 marka Exp $ */
+/* $Id: named.conf,v 1.23.18.5 2010/11/16 23:45:23 tbox Exp $ */

 // NS2

@@ -69,4 +69,9 @@ zone "rfc2335.example" {
 };


+zone "algroll" {
+	type master;
+	file "algroll.db.signed";
+};
+
 include "trusted.conf";
--- a/bin/tests/system/dnssec/ns2/sign.sh
+++ b/bin/tests/system/dnssec/ns2/sign.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2004, 2006, 2009  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2006, 2009, 2010  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2000-2003  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.

-# $Id: sign.sh,v 1.24.18.4 2009/12/30 23:46:04 tbox Exp $
+# $Id: sign.sh,v 1.24.18.6 2010/11/16 23:45:23 tbox Exp $

 SYSTEMTESTTOP=../..
 . $SYSTEMTESTTOP/conf.sh
@@ -113,3 +113,21 @@ dlvkeyname=`$KEYGEN -r $RANDFILE -a RSAMD5 -b 768 -n zone $dlvzone`
 cat $dlvinfile $dlvkeyname.key dlvset-$privzone > $dlvzonefile

 $SIGNER -g -r $RANDFILE -o $dlvzone $dlvzonefile > /dev/null
+
+#
+# algroll has just has the old DNSKEY records removed and is waiting
+# for them to be flushed from caches.  We still need to generate
+# RRSIGs for the old DNSKEY.
+#
+zone=algroll.
+infile=algroll.db.in
+zonefile=algroll.db
+
+keyold1=`$KEYGEN -r $RANDFILE -a RSAMD5 -b 1024 -n zone -f KSK $zone`
+keyold2=`$KEYGEN -r $RANDFILE -a RSAMD5 -b 1024 -n zone $zone`
+keynew1=`$KEYGEN -r $RANDFILE -a RSASHA1 -b 1024 -n zone -f KSK $zone`
+keynew2=`$KEYGEN -r $RANDFILE -a RSASHA1 -b 1024 -n zone $zone`
+
+cat $infile $keynew1.key $keynew2.key >$zonefile
+
+$SIGNER -r $RANDFILE -o $zone -k $keyold1 -k $keynew1 $zonefile $keyold1 $keyold2 $keynew1 $keynew2 > /dev/null
--- a/bin/tests/system/dnssec/tests.sh
+++ b/bin/tests/system/dnssec/tests.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2004-2006, 2009  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004-2006, 2009, 2010  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2000-2002  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.

-# $Id: tests.sh,v 1.44.18.7 2009/12/30 23:46:03 tbox Exp $
+# $Id: tests.sh,v 1.44.18.9 2010/11/16 23:45:23 tbox Exp $

 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh
@@ -509,6 +509,14 @@ n=`expr $n + 1`
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

+echo "I:checking that a zone finishing the transition from RSAMD5 to RSASHA1 validates secure ($n)"
+ret=0
+$DIG $DIGOPTS ns algroll. @10.53.0.4 > dig.out.ns4.test$n || ret=1
+grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
+grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
 # Run a minimal update test if possible.  This is really just
 # a regression test for RT #2399; more tests should be added.

--- a/bin/tests/system/resolver/clean.sh
+++ b/bin/tests/system/resolver/clean.sh
@@ -0,0 +1,18 @@
+# Copyright (C) 2010  Internet Systems Consortium, Inc. ("ISC")
+#
+# Permission to use, copy, modify, and/or distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+# AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+# PERFORMANCE OF THIS SOFTWARE.
+
+# $Id: clean.sh,v 1.4.2.3 2010/11/16 23:45:23 tbox Exp $
+
+rm -f ns6/K*
+rm -f ns6/example.net.db.signed ns6/example.net.db
--- a/bin/tests/system/resolver/ns6/example.net.db.in
+++ b/bin/tests/system/resolver/ns6/example.net.db.in
@@ -0,0 +1,22 @@
+; Copyright (C) 2010  Internet Systems Consortium, Inc. ("ISC")
+;
+; Permission to use, copy, modify, and/or distribute this software for any
+; purpose with or without fee is hereby granted, provided that the above
+; copyright notice and this permission notice appear in all copies.
+;
+; THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+; REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+; AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+; INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+; LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+; PERFORMANCE OF THIS SOFTWARE.
+
+; $Id: example.net.db.in,v 1.2.12.3 2010/11/16 23:45:23 tbox Exp $
+
+$TTL 600
+@	IN SOA	ns hostmaster 1 1800 900 604800 600
+@	IN NS	ns
+@	IN MX	0 mail
+ns	IN A	10.53.0.6
+mail	IN A	10.53.0.6
--- a/bin/tests/system/resolver/ns6/keygen.sh
+++ b/bin/tests/system/resolver/ns6/keygen.sh
@@ -0,0 +1,31 @@
+#!/bin/sh -e
+#
+# Copyright (C) 2010  Internet Systems Consortium, Inc. ("ISC")
+#
+# Permission to use, copy, modify, and/or distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+# AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+# PERFORMANCE OF THIS SOFTWARE.
+
+# $Id: keygen.sh,v 1.2.12.3 2010/11/17 10:11:43 marka Exp $
+
+SYSTEMTESTTOP=../..
+. $SYSTEMTESTTOP/conf.sh
+
+RANDFILE=../random.data
+
+zone=example.net
+zonefile="${zone}.db"
+infile="${zonefile}.in"
+cp $infile $zonefile
+ksk=`$KEYGEN -a RSASHA1 -b 1024 -n zone -r $RANDFILE -f KSK $zone`
+zsk=`$KEYGEN -a RSASHA1 -b 1024 -n zone -r $RANDFILE $zone`
+cat $ksk.key $zsk.key >> $zonefile
+$SIGNER -r $RANDFILE -o $zone $zonefile > /dev/null 2>&1
--- a/bin/tests/system/resolver/ns6/named.conf
+++ b/bin/tests/system/resolver/ns6/named.conf
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2010  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: named.conf,v 1.2.12.2 2010/11/16 08:01:09 marka Exp $ */
+
+// NS4
+
+controls { /* empty */ };
+
+options {
+	query-source address 10.53.0.6;
+	notify-source 10.53.0.6;
+	transfer-source 10.53.0.6;
+	port 5300;
+	pid-file "named.pid";
+	listen-on { 10.53.0.6; };
+	listen-on-v6 { none; };
+	recursion no;
+	// minimal-responses yes;
+};
+
+zone "." {
+	type master;
+	file "root.db";
+};
+
+zone "example.net" {
+	type master;
+	file "example.net.db.signed";
+	allow-update { any; };
+};
--- a/bin/tests/system/resolver/ns6/root.db
+++ b/bin/tests/system/resolver/ns6/root.db
@@ -0,0 +1,26 @@
+; Copyright (C) 2010  Internet Systems Consortium, Inc. ("ISC")
+;
+; Permission to use, copy, modify, and/or distribute this software for any
+; purpose with or without fee is hereby granted, provided that the above
+; copyright notice and this permission notice appear in all copies.
+;
+; THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+; REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+; AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+; INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+; LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+; PERFORMANCE OF THIS SOFTWARE.
+
+; $Id: root.db,v 1.2.12.2 2010/11/16 08:01:09 marka Exp $
+
+$TTL 300
+. 			IN SOA	marka.isc.org. a.root.servers.nil. (
+				2010   	; serial
+				600         	; refresh
+				600         	; retry
+				1200    	; expire
+				600       	; minimum
+				)
+.			NS	a.root-servers.nil.
+a.root-servers.nil.	A	10.53.0.6
--- a/bin/tests/system/resolver/ns7/named.conf
+++ b/bin/tests/system/resolver/ns7/named.conf
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2010  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: named.conf,v 1.2.12.2 2010/11/16 08:01:09 marka Exp $ */
+
+// NS4
+
+controls { /* empty */ };
+
+options {
+	query-source address 10.53.0.7;
+	notify-source 10.53.0.7;
+	transfer-source 10.53.0.7;
+	port 5300;
+	pid-file "named.pid";
+	listen-on { 10.53.0.7; };
+	listen-on-v6 { none; };
+	recursion yes;
+};
+
+zone "." {
+	type hint;
+	file "root.hint";
+};
--- a/bin/tests/system/resolver/ns7/root.hint
+++ b/bin/tests/system/resolver/ns7/root.hint
@@ -0,0 +1,19 @@
+; Copyright (C) 2010  Internet Systems Consortium, Inc. ("ISC")
+;
+; Permission to use, copy, modify, and/or distribute this software for any
+; purpose with or without fee is hereby granted, provided that the above
+; copyright notice and this permission notice appear in all copies.
+;
+; THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+; REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+; AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+; INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+; LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+; PERFORMANCE OF THIS SOFTWARE.
+
+; $Id: root.hint,v 1.2.12.2 2010/11/16 08:01:09 marka Exp $
+
+$TTL 999999
+.			 IN NS	a.root-servers.nil.
+a.root-servers.nil.	 IN A	10.53.0.6
--- a/bin/tests/system/resolver/setup.sh
+++ b/bin/tests/system/resolver/setup.sh
@@ -0,0 +1,21 @@
+#!/bin/sh -e
+#
+# Copyright (C) 2010  Internet Systems Consortium, Inc. ("ISC")
+#
+# Permission to use, copy, modify, and/or distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+# AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+# PERFORMANCE OF THIS SOFTWARE.
+
+# $Id: setup.sh,v 1.2.12.4 2010/11/17 09:12:52 marka Exp $
+
+../../genrandom 400 random.data
+
+(cd ns6 && sh keygen.sh)
--- a/bin/tests/system/resolver/tests.sh
+++ b/bin/tests/system/resolver/tests.sh
@@ -15,12 +15,13 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.

-# $Id: tests.sh,v 1.7.18.2 2010/06/04 23:46:02 tbox Exp $
+# $Id: tests.sh,v 1.7.18.4 2010/11/17 10:10:55 marka Exp $

 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

 status=0
+n=0

 echo "I:checking non-cachable NXDOMAIN response handling"
 ret=0
@@ -50,5 +51,30 @@ echo "I:check that server is still running"
 $DIG +tcp www.example.com. a @10.53.0.1 -p 5300 >/dev/null || status=1


+n=`expr $n + 1`
+echo "I:check that replacement of additional data by a negative cache no data entry clears the additional RRSIGs ($n)"
+ret=0
+$DIG +tcp mx example.net @10.53.0.7 -p 5300 > dig.ns7.out.${n} || ret=1
+grep "status: NOERROR" dig.ns7.out.${n} > /dev/null || ret=1
+if [ $ret = 1 ]; then echo "I:mx priming failed"; fi
+$NSUPDATE << EOF
+server 10.53.0.6 5300
+zone example.net
+update delete mail.example.net A
+update add mail.example.net 0 AAAA ::1
+send
+EOF
+$DIG +tcp a mail.example.net @10.53.0.7 -p 5300 > dig.ns7.out.${n} || ret=2
+grep "status: NOERROR" dig.ns7.out.${n} > /dev/null || ret=2
+grep "ANSWER: 0" dig.ns7.out.${n} > /dev/null || ret=2
+if [ $ret = 2 ]; then echo "I:ncache priming failed"; fi
+$DIG +tcp mx example.net @10.53.0.7 -p 5300 > dig.ns7.out.${n} || ret=3
+grep "status: NOERROR" dig.ns7.out.${n} > /dev/null || ret=3
+$DIG +tcp rrsig mail.example.net +norec @10.53.0.7 -p 5300 > dig.ns7.out.${n}  || ret=4
+grep "status: NOERROR" dig.ns7.out.${n} > /dev/null || ret=4
+grep "ANSWER: 0" dig.ns7.out.${n} > /dev/null || ret=4
+if [ $ret != 0 ]; then echo "I:failed"; ret=1; fi
+status=`expr $status + $ret`
+
 echo "I:exit status: $status"
 exit $status
--- a/doc/draft/draft-ietf-behave-dns64-11.txt
+++ b/doc/draft/draft-ietf-behave-dns64-11.txt
--- a/doc/draft/draft-ietf-dnsext-dnssec-bis-updates-12.txt
+++ b/doc/draft/draft-ietf-dnsext-dnssec-bis-updates-12.txt
@@ -5,12 +5,12 @@ Network Working Group                                          S. Weiler
 Internet-Draft                                              SPARTA, Inc.
 Updates: 4033, 4034, 4035, 5155                                D. Blacka
 (if approved)                                             VeriSign, Inc.
-Intended status: Standards Track                           March 8, 2010
-Expires: September 9, 2010
+Intended status: Standards Track                       November 10, 2010
+Expires: May 14, 2011


         Clarifications and Implementation Notes for DNSSECbis
-                draft-ietf-dnsext-dnssec-bis-updates-10
+                draft-ietf-dnsext-dnssec-bis-updates-12

 Abstract

@@ -20,26 +20,20 @@ Abstract

 Status of this Memo

-   This Internet-Draft is submitted to IETF in full conformance with the
+   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
-   Task Force (IETF), its areas, and its working groups.  Note that
-   other groups may also distribute working documents as Internet-
-   Drafts.
+   Task Force (IETF).  Note that other groups may also distribute
+   working documents as Internet-Drafts.  The list of current Internet-
+   Drafts is at http://datatracker.ietf.org/drafts/current/.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

-   The list of current Internet-Drafts can be accessed at
-   http://www.ietf.org/ietf/1id-abstracts.txt.
-
-   The list of Internet-Draft Shadow Directories can be accessed at
-   http://www.ietf.org/shadow.html.
-
-   This Internet-Draft will expire on September 9, 2010.
+   This Internet-Draft will expire on May 14, 2011.

 Copyright Notice

@@ -49,20 +43,18 @@ Copyright Notice
   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (http://trustee.ietf.org/license-info) in effect on the date of
-
-
-
-Weiler & Blacka         Expires September 9, 2010               [Page 1]
-
-Internet-Draft       DNSSECbis Implementation Notes           March 2010
-
-
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
-   described in the BSD License.
+   described in the Simplified BSD License.
+
+
+
+Weiler & Blacka           Expires May 14, 2011                  [Page 1]
+
+Internet-Draft       DNSSECbis Implementation Notes        November 2010


 Table of Contents
@@ -72,45 +64,53 @@ Table of Contents
     1.2.  Terminology  . . . . . . . . . . . . . . . . . . . . . . .  3
   2.  Important Additions to DNSSSECbis  . . . . . . . . . . . . . .  3
     2.1.  NSEC3 Support  . . . . . . . . . . . . . . . . . . . . . .  3
-     2.2.  SHA-256 Support  . . . . . . . . . . . . . . . . . . . . .  4
-   3.  Security Concerns  . . . . . . . . . . . . . . . . . . . . . .  4
-     3.1.  Clarifications on Non-Existence Proofs . . . . . . . . . .  4
-     3.2.  Validating Responses to an ANY Query . . . . . . . . . . .  5
-     3.3.  Check for CNAME  . . . . . . . . . . . . . . . . . . . . .  5
-     3.4.  Insecure Delegation Proofs . . . . . . . . . . . . . . . .  5
-   4.  Interoperability Concerns  . . . . . . . . . . . . . . . . . .  5
-     4.1.  Errors in Canonical Form Type Code List  . . . . . . . . .  5
-     4.2.  Unknown DS Message Digest Algorithms . . . . . . . . . . .  6
-     4.3.  Private Algorithms . . . . . . . . . . . . . . . . . . . .  6
-     4.4.  Caution About Local Policy and Multiple RRSIGs . . . . . .  7
-     4.5.  Key Tag Calculation  . . . . . . . . . . . . . . . . . . .  7
-     4.6.  Setting the DO Bit on Replies  . . . . . . . . . . . . . .  7
-     4.7.  Setting the AD Bit on Queries  . . . . . . . . . . . . . .  8
-     4.8.  Setting the AD Bit on Replies  . . . . . . . . . . . . . .  8
-     4.9.  Setting the CD bit on Requests . . . . . . . . . . . . . .  8
-     4.10. Nested Trust Anchors . . . . . . . . . . . . . . . . . . .  8
-       4.10.1.  Closest Encloser  . . . . . . . . . . . . . . . . . .  9
-       4.10.2.  Accept Any Success  . . . . . . . . . . . . . . . . .  9
-       4.10.3.  Preference Based on Source  . . . . . . . . . . . . . 10
-   5.  Minor Corrections and Clarifications . . . . . . . . . . . . . 10
-     5.1.  Finding Zone Cuts  . . . . . . . . . . . . . . . . . . . . 10
-     5.2.  Clarifications on DNSKEY Usage . . . . . . . . . . . . . . 10
-     5.3.  Errors in Examples . . . . . . . . . . . . . . . . . . . . 11
-     5.4.  Errors in RFC 5155 . . . . . . . . . . . . . . . . . . . . 11
-   6.  IANA Considerations  . . . . . . . . . . . . . . . . . . . . . 12
-   7.  Security Considerations  . . . . . . . . . . . . . . . . . . . 12
-   8.  References . . . . . . . . . . . . . . . . . . . . . . . . . . 12
-     8.1.  Normative References . . . . . . . . . . . . . . . . . . . 12
-     8.2.  Informative References . . . . . . . . . . . . . . . . . . 13
+     2.2.  SHA-2 Support  . . . . . . . . . . . . . . . . . . . . . .  4
+   3.  Scaling Concerns . . . . . . . . . . . . . . . . . . . . . . .  4
+     3.1.  Implement a BAD cache  . . . . . . . . . . . . . . . . . .  4
+   4.  Security Concerns  . . . . . . . . . . . . . . . . . . . . . .  4
+     4.1.  Clarifications on Non-Existence Proofs . . . . . . . . . .  4
+     4.2.  Validating Responses to an ANY Query . . . . . . . . . . .  5
+     4.3.  Check for CNAME  . . . . . . . . . . . . . . . . . . . . .  5
+     4.4.  Insecure Delegation Proofs . . . . . . . . . . . . . . . .  5
+   5.  Interoperability Concerns  . . . . . . . . . . . . . . . . . .  5
+     5.1.  Errors in Canonical Form Type Code List  . . . . . . . . .  6
+     5.2.  Unknown DS Message Digest Algorithms . . . . . . . . . . .  6
+     5.3.  Private Algorithms . . . . . . . . . . . . . . . . . . . .  6
+     5.4.  Caution About Local Policy and Multiple RRSIGs . . . . . .  7
+     5.5.  Key Tag Calculation  . . . . . . . . . . . . . . . . . . .  7
+     5.6.  Setting the DO Bit on Replies  . . . . . . . . . . . . . .  8
+     5.7.  Setting the AD Bit on Queries  . . . . . . . . . . . . . .  8
+     5.8.  Setting the AD Bit on Replies  . . . . . . . . . . . . . .  8
+     5.9.  Handling Queries With the CD Bit Set . . . . . . . . . . .  8
+     5.10. Nested Trust Anchors . . . . . . . . . . . . . . . . . . .  9
+       5.10.1.  Closest Encloser  . . . . . . . . . . . . . . . . . .  9
+       5.10.2.  Accept Any Success  . . . . . . . . . . . . . . . . .  9
+       5.10.3.  Preference Based on Source  . . . . . . . . . . . . . 10
+   6.  Minor Corrections and Clarifications . . . . . . . . . . . . . 10
+     6.1.  Finding Zone Cuts  . . . . . . . . . . . . . . . . . . . . 10
+     6.2.  Clarifications on DNSKEY Usage . . . . . . . . . . . . . . 11
+     6.3.  Errors in Examples . . . . . . . . . . . . . . . . . . . . 11
+     6.4.  Errors in RFC 5155 . . . . . . . . . . . . . . . . . . . . 11
+   7.  IANA Considerations  . . . . . . . . . . . . . . . . . . . . . 12
+   8.  Security Considerations  . . . . . . . . . . . . . . . . . . . 12
+   9.  References . . . . . . . . . . . . . . . . . . . . . . . . . . 12
+     9.1.  Normative References . . . . . . . . . . . . . . . . . . . 12
+     9.2.  Informative References . . . . . . . . . . . . . . . . . . 13
   Appendix A.  Acknowledgments . . . . . . . . . . . . . . . . . . . 13
   Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 14




-Weiler & Blacka         Expires September 9, 2010               [Page 2]
+
+
+
+
+
+
+Weiler & Blacka           Expires May 14, 2011                  [Page 2]

-Internet-Draft       DNSSECbis Implementation Notes           March 2010
+Internet-Draft       DNSSECbis Implementation Notes        November 2010


 1.  Introduction and Terminology
@@ -158,37 +158,47 @@ Internet-Draft       DNSSECbis Implementation Notes           March 2010
   Family as described by [RFC4033], Section 10.

   Note that the algorithm identifiers defined in RFC5155 (DSA-NSEC3-
-   SHA1 and RSASHA1-NSEC3-SHA1) signal that a zone MAY be using NSEC3,
-   rather than NSEC.  The zone MAY indeed be using either and validators
-   supporting these algorithms MUST support both NSEC3 and NSEC
+   SHA1 and RSASHA1-NSEC3-SHA1) and RFC5702 (RSASHA256 and RSASHA512)
+   signal that a zone MAY be using NSEC3, rather than NSEC.  The zone
+   MAY indeed be using either and validators supporting these algorithms



-Weiler & Blacka         Expires September 9, 2010               [Page 3]
+Weiler & Blacka           Expires May 14, 2011                  [Page 3]

-Internet-Draft       DNSSECbis Implementation Notes           March 2010
+Internet-Draft       DNSSECbis Implementation Notes        November 2010


-   responses.
+   MUST support both NSEC3 and NSEC responses.

-2.2.  SHA-256 Support
+2.2.  SHA-2 Support

   [RFC4509] describes the use of SHA-256 as a digest algorithm in
   Delegation Signer (DS) RRs.  [RFC5702] describes the use of the
-   RSASHA256 algorithm in DNSKEY and RRSIG RRs.  Validator
-   implementations are strongly encouraged to include support for this
-   algorithm for DS, DNSKEY, and RRSIG records.
+   RSASHA256 and RSASHA512 algorithms in DNSKEY and RRSIG RRs.
+   Validator implementations are strongly encouraged to include support
+   for these algorithms for DS, DNSKEY, and RRSIG records.

   Both [RFC4509] and [RFC5702] should also be considered part of the
   DNS Security Document Family as described by [RFC4033], Section 10.


-3.  Security Concerns
+3.  Scaling Concerns
+
+3.1.  Implement a BAD cache
+
+   Section 4.7 of RFC4035 permits security-aware resolvers to implement
+   a BAD cache.  Because of scaling concerns not discussed in this
+   document, that guidance has changed: security-aware resolvers SHOULD
+   implement a BAD cache, as described in RFC4035.
+
+
+4.  Security Concerns

   This section provides clarifications that, if overlooked, could lead
   to security issues.

-3.1.  Clarifications on Non-Existence Proofs
+4.1.  Clarifications on Non-Existence Proofs

   [RFC4035] Section 5.4 under-specifies the algorithm for checking non-
   existence proofs.  In particular, the algorithm as presented would
@@ -207,6 +217,14 @@ Internet-Draft       DNSSECbis Implementation Notes           March 2010
   that (original) owner name other than DS RRs, and all RRs below that
   owner name regardless of type.

+
+
+
+Weiler & Blacka           Expires May 14, 2011                  [Page 4]
+
+Internet-Draft       DNSSECbis Implementation Notes        November 2010
+
+
   Similarly, the algorithm would also allow an NSEC RR at the same
   owner name as a DNAME RR, or an NSEC3 RR at the same original owner
   name as a DNAME, to prove the non-existence of names beneath that
@@ -214,18 +232,7 @@ Internet-Draft       DNSSECbis Implementation Notes           March 2010
   to assume the non-existence of any subdomain of that NSEC/NSEC3 RR's
   (original) owner name.

-
-
-
-
-
-
-Weiler & Blacka         Expires September 9, 2010               [Page 4]
-
-Internet-Draft       DNSSECbis Implementation Notes           March 2010
-
-
-3.2.  Validating Responses to an ANY Query
+4.2.  Validating Responses to an ANY Query

   [RFC4035] does not address how to validate responses when QTYPE=*.
   As described in Section 6.2.2 of [RFC1034], a proper response to
@@ -241,7 +248,7 @@ Internet-Draft       DNSSECbis Implementation Notes           March 2010
   To be clear, a validator must not expect to receive all records at
   the QNAME in response to QTYPE=*.

-3.3.  Check for CNAME
+4.3.  Check for CNAME

   Section 5 of [RFC4035] says little about validating responses based
   on (or that should be based on) CNAMEs.  When validating a NOERROR/
@@ -250,7 +257,7 @@ Internet-Draft       DNSSECbis Implementation Notes           March 2010
   type.  Without this check, an attacker could successfully transform a
   positive CNAME response into a NOERROR/NODATA response.

-3.4.  Insecure Delegation Proofs
+4.4.  Insecure Delegation Proofs

   [RFC4035] Section 5.2 specifies that a validator, when proving a
   delegation is not secure, needs to check for the absence of the DS
@@ -263,9 +270,18 @@ Internet-Draft       DNSSECbis Implementation Notes           March 2010
   not signed.


-4.  Interoperability Concerns
+5.  Interoperability Concerns

-4.1.  Errors in Canonical Form Type Code List
+
+
+
+
+Weiler & Blacka           Expires May 14, 2011                  [Page 5]
+
+Internet-Draft       DNSSECbis Implementation Notes        November 2010
+
+
+5.1.  Errors in Canonical Form Type Code List

   When canonicalizing DNS names, DNS names in the RDATA section of NSEC
   and RRSIG resource records are not downcased.
@@ -273,14 +289,6 @@ Internet-Draft       DNSSECbis Implementation Notes           March 2010
   [RFC4034] Section 6.2 item 3 has a list of resource record types for
   which DNS names in the RDATA are downcased for purposes of DNSSEC
   canonical form (for both ordering and signing).  That list
-
-
-
-Weiler & Blacka         Expires September 9, 2010               [Page 5]
-
-Internet-Draft       DNSSECbis Implementation Notes           March 2010
-
-
   erroneously contains NSEC and RRSIG.  According to [RFC3755], DNS
   names in the RDATA of NSEC and RRSIG should not be downcased.

@@ -288,7 +296,7 @@ Internet-Draft       DNSSECbis Implementation Notes           March 2010
   Since HINFO records contain no domain names, they are not subject to
   downcasing.

-4.2.  Unknown DS Message Digest Algorithms
+5.2.  Unknown DS Message Digest Algorithms

   Section 5.2 of [RFC4035] includes rules for how to handle delegations
   to zones that are signed with entirely unsupported public key
@@ -317,10 +325,18 @@ Internet-Draft       DNSSECbis Implementation Notes           March 2010
   disregards any DS records using unknown or unsupported message digest
   algorithms.

-4.3.  Private Algorithms
+5.3.  Private Algorithms

   As discussed above, section 5.2 of [RFC4035] requires that validators
   make decisions about the security status of zones based on the public
+
+
+
+Weiler & Blacka           Expires May 14, 2011                  [Page 6]
+
+Internet-Draft       DNSSECbis Implementation Notes        November 2010
+
+
   key algorithms shown in the DS records for those zones.  In the case
   of private algorithms, as described in [RFC4034] Appendix A.1.1, the
   eight-bit algorithm field in the DS RR is not conclusive about what
@@ -329,17 +345,9 @@ Internet-Draft       DNSSECbis Implementation Notes           March 2010
   If no private algorithms appear in the DS set or if any supported
   algorithm appears in the DS set, no special processing will be
   needed.  In the remaining cases, the security status of the zone
-
-
-
-Weiler & Blacka         Expires September 9, 2010               [Page 6]
-
-Internet-Draft       DNSSECbis Implementation Notes           March 2010
-
-
   depends on whether or not the resolver supports any of the private
   algorithms in use (provided that these DS records use supported hash
-   functions, as discussed in Section 4.2).  In these cases, the
+   functions, as discussed in Section 5.2).  In these cases, the
   resolver MUST retrieve the corresponding DNSKEY for each private
   algorithm DS record and examine the public key field to determine the
   algorithm in use.  The security-aware resolver MUST ensure that the
@@ -351,7 +359,7 @@ Internet-Draft       DNSSECbis Implementation Notes           March 2010
   This clarification facilitates the broader use of private algorithms,
   as suggested by [RFC4955].

-4.4.  Caution About Local Policy and Multiple RRSIGs
+5.4.  Caution About Local Policy and Multiple RRSIGs

   When multiple RRSIGs cover a given RRset, [RFC4035] Section 5.3.3
   suggests that "the local resolver security policy determines whether
@@ -370,30 +378,30 @@ Internet-Draft       DNSSECbis Implementation Notes           March 2010
   method described in section 4.2.1.2 of [RFC4641] might not work
   reliably.

-4.5.  Key Tag Calculation
+5.5.  Key Tag Calculation

   [RFC4034] Appendix B.1 incorrectly defines the Key Tag field
   calculation for algorithm 1.  It correctly says that the Key Tag is
   the most significant 16 of the least significant 24 bits of the
   public key modulus.  However, [RFC4034] then goes on to incorrectly
   say that this is 4th to last and 3rd to last octets of the public key
+
+
+
+Weiler & Blacka           Expires May 14, 2011                  [Page 7]
+
+Internet-Draft       DNSSECbis Implementation Notes        November 2010
+
+
   modulus.  It is, in fact, the 3rd to last and 2nd to last octets.

-4.6.  Setting the DO Bit on Replies
+5.6.  Setting the DO Bit on Replies

   As stated in [RFC3225], the DO bit of the query MUST be copied in the
   response.  At least one implementation has done something different,
   so it may be wise for resolvers to be liberal in what they accept.

-
-
-
-Weiler & Blacka         Expires September 9, 2010               [Page 7]
-
-Internet-Draft       DNSSECbis Implementation Notes           March 2010
-
-
-4.7.  Setting the AD Bit on Queries
+5.7.  Setting the AD Bit on Queries

   The use of the AD bit in the query was previously undefined.  This
   document defines it as a signal indicating that the requester
@@ -401,7 +409,7 @@ Internet-Draft       DNSSECbis Implementation Notes           March 2010
   response.  This allows a requestor to indicate that it understands
   the AD bit without also requesting DNSSEC data via the DO bit.

-4.8.  Setting the AD Bit on Replies
+5.8.  Setting the AD Bit on Replies

   Section 3.2.3 of [RFC4035] describes under which conditions a
   validating resolver should set or clear the AD bit in a response.  In
@@ -410,7 +418,7 @@ Internet-Draft       DNSSECbis Implementation Notes           March 2010
   conditions listed in RFC 4035, section 3.2.3, and the request
   contained either a set DO bit or a set AD bit.

-4.9.  Setting the CD bit on Requests
+5.9.  Handling Queries With the CD Bit Set

   When processing a request with the CD bit set, a resolver SHOULD
   attempt to return all responsive data, even data that has failed
@@ -428,11 +436,20 @@ Internet-Draft       DNSSECbis Implementation Notes           March 2010
   up to five minutes.)  In these cases, a new query with the CD bit set
   is required.

-   For efficiency, a validator may wish to set the CD bit on all
-   upstream queries when it has a trust anchor at or above the QNAME
-   (and thus can reasonably expect to be able to validate the response).
+   For efficiency, a validator SHOULD set the CD bit on upstream queries
+   when it has a trust anchor at or above the QNAME (and thus can
+   reasonably expect to be able to validate the response).

-4.10.  Nested Trust Anchors
+
+
+
+
+Weiler & Blacka           Expires May 14, 2011                  [Page 8]
+
+Internet-Draft       DNSSECbis Implementation Notes        November 2010
+
+
+5.10.  Nested Trust Anchors

   A DNSSEC validator may be configured such that, for a given response,
   more than one trust anchor could be used to validate the chain of
@@ -441,24 +458,16 @@ Internet-Draft       DNSSECbis Implementation Notes           March 2010
   When the validator is asked to validate a response to
   "www.sub.zone.example.", either trust anchor could apply.

-
-
-
-Weiler & Blacka         Expires September 9, 2010               [Page 8]
-
-Internet-Draft       DNSSECbis Implementation Notes           March 2010
-
-
   When presented with this situation, DNSSEC validators have a choice
   of which trust anchor(s) to use.  Which to use is a matter of
   implementation choice.  It is possible and perhaps advisable to
   expose the choice of policy as a configuration option.  The rest of
   this section discusses some possible policies.  As a default, we
   suggest that validators implement the "Accept Any Success" policy
-   described below in Section 4.10.2 while exposing other policies as
+   described below in Section 5.10.2 while exposing other policies as
   configuration options.

-4.10.1.  Closest Encloser
+5.10.1.  Closest Encloser

   One policy is to choose the trust anchor closest to the QNAME of the
   response.  In our example, that would be the "zone.example." trust
@@ -480,7 +489,7 @@ Internet-Draft       DNSSECbis Implementation Notes           March 2010
   trust anchor.  With the "closest encloser" policy, the validator gets
   validation failures.

-4.10.2.  Accept Any Success
+5.10.2.  Accept Any Success

   Another policy is to try all applicable trust anchors until one gives
   a validation result of Secure, in which case the final validation
@@ -489,6 +498,13 @@ Internet-Draft       DNSSECbis Implementation Notes           March 2010
   or more trust anchors lead to a Bogus result and there is no Secure
   result, then the final validation result is Bogus.

+
+
+Weiler & Blacka           Expires May 14, 2011                  [Page 9]
+
+Internet-Draft       DNSSECbis Implementation Notes        November 2010
+
+
   This has the advantage of causing the fewer validation failures,
   which may deliver a better user experience.  If one trust anchor is
   out of date (as in our above example), the user may still be able to
@@ -497,17 +513,9 @@ Internet-Draft       DNSSECbis Implementation Notes           March 2010
   This policy has the disadvantage of making the validator subject to
   compromise of the weakest of these trust anchors while making its
   relatively painless to keep old trust anchors configured in
-
-
-
-Weiler & Blacka         Expires September 9, 2010               [Page 9]
-
-Internet-Draft       DNSSECbis Implementation Notes           March 2010
-
-
   perpetuity.

-4.10.3.  Preference Based on Source
+5.10.3.  Preference Based on Source

   When the trust anchors have come from different sources (e.g.
   automated updates ([RFC5011]), one or more DLV registries
@@ -532,9 +540,9 @@ Internet-Draft       DNSSECbis Implementation Notes           March 2010
   configured trust anchors.


-5.  Minor Corrections and Clarifications
+6.  Minor Corrections and Clarifications

-5.1.  Finding Zone Cuts
+6.1.  Finding Zone Cuts

   Appendix C.8 of [RFC4035] discusses sending DS queries to the servers
   for a parent zone.  To do that, a resolver may first need to apply
@@ -545,22 +553,22 @@ Internet-Draft       DNSSECbis Implementation Notes           March 2010
   and in some situations the resolver may also need to apply special
   rules to locate the name servers for the parent zone if the resolver
   does not already have the parent's NS RRset.  Section 4.2 of
+
+
+
+Weiler & Blacka           Expires May 14, 2011                 [Page 10]
+
+Internet-Draft       DNSSECbis Implementation Notes        November 2010
+
+
   [RFC4035] specifies a mechanism for doing that.

-5.2.  Clarifications on DNSKEY Usage
+6.2.  Clarifications on DNSKEY Usage

   Questions of the form "can I use a different DNSKEY for signing this
   RRset" have occasionally arisen.

   The short answer is "yes, absolutely".  You can even use a different
-
-
-
-Weiler & Blacka         Expires September 9, 2010              [Page 10]
-
-Internet-Draft       DNSSECbis Implementation Notes           March 2010
-
-
   DNSKEY for each RRset in a zone, subject only to practical limits on
   the size of the DNSKEY RRset.  However, be aware that there is no way
   to tell resolvers what a particularly DNSKEY is supposed to be used
@@ -579,7 +587,7 @@ Internet-Draft       DNSSECbis Implementation Notes           March 2010
   possible to use a single DNSKEY, with or without the SEP bit set, to
   sign the entire zone, including the DNSKEY RRset itself.

-5.3.  Errors in Examples
+6.3.  Errors in Examples

   The text in [RFC4035] Section C.1 refers to the examples in B.1 as
   "x.w.example.com" while B.1 uses "x.w.example".  This is painfully
@@ -594,12 +602,21 @@ Internet-Draft       DNSSECbis Implementation Notes           March 2010
   the reference to "a.z.w.w.example" should instead be "a.z.w.example",
   as in the previous line.

-5.4.  Errors in RFC 5155
+6.4.  Errors in RFC 5155

   A NSEC3 record that matches an Empty Non-Terminal effectively has no
   type associated with it.  This NSEC3 record has an empty type bit
   map.  Section 3.2.1 of [RFC5155] contains the statement:

+
+
+
+
+Weiler & Blacka           Expires May 14, 2011                 [Page 11]
+
+Internet-Draft       DNSSECbis Implementation Notes        November 2010
+
+
      Blocks with no types present MUST NOT be included.

   However, the same section contains a regular expression:
@@ -609,41 +626,33 @@ Internet-Draft       DNSSECbis Implementation Notes           March 2010
   The plus sign in the regular expression indicates that there is one
   or more of the preceding element.  This means that there must be at
   least one window block.  If this window block has no types, it
-
-
-
-Weiler & Blacka         Expires September 9, 2010              [Page 11]
-
-Internet-Draft       DNSSECbis Implementation Notes           March 2010
-
-
   contradicts with the first statement.  Therefore, the correct text in
   RFC 5155 3.2.1 should be:

      Type Bit Maps Field = ( Window Block # | Bitmap Length | Bitmap )*


-6.  IANA Considerations
+7.  IANA Considerations

   This document specifies no IANA Actions.


-7.  Security Considerations
+8.  Security Considerations

   This document adds two cryptographic features to the core DNSSEC
   protocol.  Additionally, it addresses some ambiguities and omissions
   in the core DNSSEC documents that, if not recognized and addressed in
   implementations, could lead to security failures.  In particular, the
-   validation algorithm clarifications in Section 3 are critical for
+   validation algorithm clarifications in Section 4 are critical for
   preserving the security properties DNSSEC offers.  Furthermore,
-   failure to address some of the interoperability concerns in Section 4
+   failure to address some of the interoperability concerns in Section 5
   could limit the ability to later change or expand DNSSEC, including
   adding new algorithms.


-8.  References
+9.  References

-8.1.  Normative References
+9.1.  Normative References

   [RFC1034]  Mockapetris, P., "Domain names - concepts and facilities",
              STD 13, RFC 1034, November 1987.
@@ -656,6 +665,14 @@ Internet-Draft       DNSSECbis Implementation Notes           March 2010

   [RFC4033]  Arends, R., Austein, R., Larson, M., Massey, D., and S.
              Rose, "DNS Security Introduction and Requirements",
+
+
+
+Weiler & Blacka           Expires May 14, 2011                 [Page 12]
+
+Internet-Draft       DNSSECbis Implementation Notes        November 2010
+
+
              RFC 4033, March 2005.

   [RFC4034]  Arends, R., Austein, R., Larson, M., Massey, D., and S.
@@ -666,13 +683,6 @@ Internet-Draft       DNSSECbis Implementation Notes           March 2010
              Rose, "Protocol Modifications for the DNS Security
              Extensions", RFC 4035, March 2005.

-
-
-Weiler & Blacka         Expires September 9, 2010              [Page 12]
-
-Internet-Draft       DNSSECbis Implementation Notes           March 2010
-
-
   [RFC4509]  Hardaker, W., "Use of SHA-256 in DNSSEC Delegation Signer
              (DS) Resource Records (RRs)", RFC 4509, May 2006.

@@ -684,7 +694,7 @@ Internet-Draft       DNSSECbis Implementation Notes           March 2010
              and RRSIG Resource Records for DNSSEC", RFC 5702,
              October 2009.

-8.2.  Informative References
+9.2.  Informative References

   [RFC3755]  Weiler, S., "Legacy Resolver Compatibility for Delegation
              Signer (DS)", RFC 3755, May 2004.
@@ -711,32 +721,33 @@ Appendix A.  Acknowledgments
   finding errors and omissions in the DNSSECbis document set, have
   provided text suitable for inclusion in this document.

+
+
+
+Weiler & Blacka           Expires May 14, 2011                 [Page 13]
+
+Internet-Draft       DNSSECbis Implementation Notes        November 2010
+
+
   The lack of specificity about handling private algorithms, as
-   described in Section 4.3, and the lack of specificity in handling ANY
-   queries, as described in Section 3.2, were discovered by David
+   described in Section 5.3, and the lack of specificity in handling ANY
+   queries, as described in Section 4.2, were discovered by David
   Blacka.

   The error in algorithm 1 key tag calculation, as described in
-   Section 4.5, was found by Abhijit Hayatnagarkar.  Donald Eastlake
-   contributed text for Section 4.5.
-
-   The bug relating to delegation NSEC RR's in Section 3.1 was found by
-
-
-
-Weiler & Blacka         Expires September 9, 2010              [Page 13]
-
-Internet-Draft       DNSSECbis Implementation Notes           March 2010
-
+   Section 5.5, was found by Abhijit Hayatnagarkar.  Donald Eastlake
+   contributed text for Section 5.5.

+   The bug relating to delegation NSEC RR's in Section 4.1 was found by
   Roy Badami.  Roy Arends found the related problem with DNAME.

   The errors in the [RFC4035] examples were found by Roy Arends, who
-   also contributed text for Section 5.3 of this document.
+   also contributed text for Section 6.3 of this document.

   The editors would like to thank Alfred Hoenes, Ed Lewis, Danny Mayer,
-   Olafur Gudmundsson, Suzanne Woolf, and Scott Rose for their
-   substantive comments on the text of this document.
+   Olafur Gudmundsson, Suzanne Woolf, Rickard Bellgrim, Mike St. Johns,
+   and Scott Rose for their substantive comments on the text of this
+   document.


 Authors' Addresses
@@ -769,17 +780,6 @@ Authors' Addresses



-
-
-
-
-
-
-
-
-
-
-
-Weiler & Blacka         Expires September 9, 2010              [Page 14]
+Weiler & Blacka           Expires May 14, 2011                 [Page 14]


--- a/doc/private/SRCID
+++ b/doc/private/SRCID
@@ -1,6 +1,6 @@
-# $Id: SRCID,v 1.17.4.80 2010/09/02 08:15:09 tbox Exp $
+# $Id: SRCID,v 1.17.4.98 2010/11/29 02:15:06 tbox Exp $
 # 
 # This file must follow /bin/sh rules.  It is imported directly via
 # configure.
 #
-SRCID="( $Date: 2010/09/02 08:15:09 $ )"
+SRCID="( $Date: 2010/11/29 02:15:06 $ )"
--- a/lib/dns/api
+++ b/lib/dns/api
@@ -1,3 +1,3 @@
 LIBINTERFACE = 39
-LIBREVISION = 0
+LIBREVISION = 1
 LIBAGE = 1
--- a/lib/dns/include/dns/db.h
+++ b/lib/dns/include/dns/db.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007, 2009  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2009, 2010  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: db.h,v 1.76.18.14 2009/01/19 00:36:28 marka Exp $ */
+/* $Id: db.h,v 1.76.18.16 2010/11/17 23:45:12 tbox Exp $ */

 #ifndef DNS_DB_H
 #define DNS_DB_H 1
@@ -184,13 +184,15 @@ struct dns_db {
 /*%
 * Options that can be specified for dns_db_find().
 */
-#define DNS_DBFIND_GLUEOK		0x01
-#define DNS_DBFIND_VALIDATEGLUE		0x02
-#define DNS_DBFIND_NOWILD		0x04
-#define DNS_DBFIND_PENDINGOK		0x08
-#define DNS_DBFIND_NOEXACT		0x10
-#define DNS_DBFIND_FORCENSEC		0x20
-#define DNS_DBFIND_COVERINGNSEC		0x40
+#define DNS_DBFIND_GLUEOK		0x0001
+#define DNS_DBFIND_VALIDATEGLUE		0x0002
+#define DNS_DBFIND_NOWILD		0x0004
+#define DNS_DBFIND_PENDINGOK		0x0008
+#define DNS_DBFIND_NOEXACT		0x0010
+#define DNS_DBFIND_FORCENSEC		0x0020
+#define DNS_DBFIND_COVERINGNSEC		0x0040
+#define DNS_DBFIND_FORCENSEC3		0x0080
+#define DNS_DBFIND_ADDITIONALOK		0x0100
 /*@}*/

 /*@{*/
@@ -649,6 +651,10 @@ dns_db_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
 *	For cache databases, glue is any rdataset with a trust of
 *	dns_trust_glue.
 *
+ * \li	If 'options' does not have #DNS_DBFIND_ADDITIONALOK set, then no
+ *	additional records will be returned.  Only caches can have
+ *	rdataset with trust dns_trust_additional.
+ *
 * \li	If 'options' does not have #DNS_DBFIND_PENDINGOK set, then no
 *	pending data will be returned.  This option is only meaningful for
 *	cache databases.
--- a/lib/dns/rbtdb.c
+++ b/lib/dns/rbtdb.c
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: rbtdb.c,v 1.196.18.61 2010/02/26 23:46:36 tbox Exp $ */
+/* $Id: rbtdb.c,v 1.196.18.64 2010/11/17 10:21:01 marka Exp $ */

 /*! \file */

@@ -3594,6 +3594,8 @@ cache_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
 	 * If we didn't find what we were looking for...
 	 */
 	if (found == NULL ||
+	    (found->trust == dns_trust_additional &&
+	     ((options & DNS_DBFIND_ADDITIONALOK) == 0)) ||
 	    (found->trust == dns_trust_glue &&
 	     ((options & DNS_DBFIND_GLUEOK) == 0)) ||
 	    (DNS_TRUST_PENDING(found->trust) &&
@@ -4406,14 +4408,14 @@ add(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
    dns_rdataset_t *addedrdataset, isc_stdtime_t now)
 {
 	rbtdb_changed_t *changed = NULL;
-	rdatasetheader_t *topheader, *topheader_prev, *header;
+	rdatasetheader_t *topheader, *topheader_prev, *header, *sigheader;
 	unsigned char *merged;
 	isc_result_t result;
 	isc_boolean_t header_nx;
 	isc_boolean_t newheader_nx;
 	isc_boolean_t merge;
 	dns_rdatatype_t rdtype, covers;
-	rbtdb_rdatatype_t negtype;
+	rbtdb_rdatatype_t negtype, sigtype;
 	dns_trust_t trust;

 	/*
@@ -4450,7 +4452,7 @@ add(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,

 	newheader_nx = NONEXISTENT(newheader) ? ISC_TRUE : ISC_FALSE;
 	topheader_prev = NULL;
-
+	sigheader = NULL;
 	negtype = 0;
 	if (rbtversion == NULL && !newheader_nx) {
 		rdtype = RBTDB_RDATATYPE_BASE(newheader->type);
@@ -4459,26 +4461,35 @@ add(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
 			 * We're adding a negative cache entry.
 			 */
 			covers = RBTDB_RDATATYPE_EXT(newheader->type);
-			if (covers == dns_rdatatype_any) {
+			sigtype = RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig,
+							covers);
+
+			for (topheader = rbtnode->data;
+			     topheader != NULL;
+			     topheader = topheader->next) {
 				/*
-				 * We're adding an negative cache entry
+				 * If we're adding an negative cache entry
 				 * which covers all types (NXDOMAIN,
 				 * NODATA(QTYPE=ANY)).
 				 *
 				 * We make all other data stale so that the
 				 * only rdataset that can be found at this
 				 * node is the negative cache entry.
+				 *
+				 * Otherwise look for any RRSIGs of the
+				 * given type so they can be marked stale
+				 * later.
 				 */
-				for (topheader = rbtnode->data;
-				     topheader != NULL;
-				     topheader = topheader->next) {
+				if (covers == dns_rdatatype_any) {
 					topheader->ttl = 0;
 					topheader->attributes |=
 						RDATASET_ATTR_STALE;
-				}
-				rbtnode->dirty = 1;
-				goto find_header;
+					rbtnode->dirty = 1;
+				} else if (topheader->type == sigtype)
+					sigheader = topheader;
 			}
+			if (covers == dns_rdatatype_any)
+				goto find_header;
 			negtype = RBTDB_RDATATYPE_VALUE(covers, 0);
 		} else {
 			/*
@@ -4700,6 +4711,11 @@ add(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
 			if (rbtversion == NULL) {
 				header->ttl = 0;
 				header->attributes |= RDATASET_ATTR_STALE;
+				if (sigheader != NULL) {
+					sigheader->ttl = 0;
+					sigheader->attributes |=
+						 RDATASET_ATTR_STALE;
+				}
 			}
 		}
 	} else {
--- a/lib/dns/validator.c
+++ b/lib/dns/validator.c
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: validator.c,v 1.119.18.59 2010/09/02 07:21:53 marka Exp $ */
+/* $Id: validator.c,v 1.119.18.60 2010/11/16 04:17:44 marka Exp $ */

 /*! \file */

@@ -304,6 +304,7 @@ fetch_callback_validator(isc_task_t *task, isc_event_t *event) {
 	isc_boolean_t want_destroy;
 	isc_result_t result;
 	isc_result_t eresult;
+	isc_result_t saved_result;

 	UNUSED(task);
 	INSIST(event->ev_type == DNS_EVENT_FETCHDONE);
@@ -340,6 +341,17 @@ fetch_callback_validator(isc_task_t *task, isc_event_t *event) {
 				val->keyset = &val->frdataset;
 		}
 		result = validate(val, ISC_TRUE);
+		if (result == DNS_R_NOVALIDSIG &&
+		    (val->attributes & VALATTR_TRIEDVERIFY) == 0)
+		{
+			saved_result = result;
+			validator_log(val, ISC_LOG_DEBUG(3),
+				      "falling back to insecurity proof");
+			val->attributes |= VALATTR_INSECURITY;
+			result = proveunsecure(val, ISC_FALSE, ISC_FALSE);
+			if (result == DNS_R_NOTINSECURE)
+				result = saved_result;
+		}
 		if (result != DNS_R_WAIT)
 			validator_done(val, result);
 	} else {
@@ -530,6 +542,7 @@ keyvalidated(isc_task_t *task, isc_event_t *event) {
 	isc_boolean_t want_destroy;
 	isc_result_t result;
 	isc_result_t eresult;
+	isc_result_t saved_result;

 	UNUSED(task);
 	INSIST(event->ev_type == DNS_EVENT_VALIDATORDONE);
@@ -556,6 +569,17 @@ keyvalidated(isc_task_t *task, isc_event_t *event) {
 		if (val->frdataset.trust >= dns_trust_secure)
 			(void) get_dst_key(val, val->siginfo, &val->frdataset);
 		result = validate(val, ISC_TRUE);
+		if (result == DNS_R_NOVALIDSIG &&
+		    (val->attributes & VALATTR_TRIEDVERIFY) == 0)
+		{
+			saved_result = result;
+			validator_log(val, ISC_LOG_DEBUG(3),
+				      "falling back to insecurity proof");
+			val->attributes |= VALATTR_INSECURITY;
+			result = proveunsecure(val, ISC_FALSE, ISC_FALSE);
+			if (result == DNS_R_NOTINSECURE)
+				result = saved_result;
+		}
 		if (result != DNS_R_WAIT)
 			validator_done(val, result);
 	} else {
@@ -1480,9 +1504,11 @@ validate(dns_validator_t *val, isc_boolean_t resume) {
 		 * was known and "sufficiently good".
 		 */
 		if (!dns_resolver_algorithm_supported(val->view->resolver,
-						      event->name,
-						      val->siginfo->algorithm))
+						    event->name,
+						    val->siginfo->algorithm)) {
+			resume = ISC_FALSE;
 			continue;
+		}

 		if (!resume) {
 			result = get_key(val, val->siginfo);
@@ -1493,16 +1519,12 @@ validate(dns_validator_t *val, isc_boolean_t resume) {
 		}

 		/*
-		 * The key is insecure, so mark the data as insecure also.
+		 * There isn't a secure DNSKEY for this signature so move
+		 * onto the next RRSIG.
 		 */
 		if (val->key == NULL) {
-			if (val->mustbesecure) {
-				validator_log(val, ISC_LOG_WARNING,
-					      "must be secure failure");
-				return (DNS_R_MUSTBESECURE);
-			}
-			markanswer(val, "validate");
-			return (ISC_R_SUCCESS);
+			resume = ISC_FALSE;
+			continue;
 		}

 		do {
@@ -3123,6 +3145,20 @@ proveunsecure(dns_validator_t *val, isc_boolean_t have_ds, isc_boolean_t resume)
 				 */
 				result = DNS_R_NOVALIDNSEC;
 				goto out;
+			} else if (DNS_TRUST_PENDING(val->frdataset.trust) ||
+				   DNS_TRUST_ANSWER(val->frdataset.trust)) {
+				/*
+				 * If we have "trust == answer" then this namespace
+				 * has switched from insecure to should be secure.
+				 */
+				result = create_validator(val, tname,
+							  dns_rdatatype_ds,
+							  &val->frdataset,
+							  NULL, dsvalidated,
+							  "proveunsecure");
+				if (result != ISC_R_SUCCESS)
+					goto out;
+				return (DNS_R_WAIT);
 			} else if (val->frdataset.trust < dns_trust_secure) {
 				/*
 				 * This shouldn't happen, since the negative
--- a/lib/isc/api
+++ b/lib/isc/api
@@ -1,3 +1,3 @@
 LIBINTERFACE = 37
-LIBREVISION = 0
+LIBREVISION = 1
 LIBAGE = 1
--- a/lib/isc/print.c
+++ b/lib/isc/print.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2006, 2008  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006, 2008, 2010  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: print.c,v 1.27.18.5 2008/02/18 23:46:01 tbox Exp $ */
+/* $Id: print.c,v 1.27.18.7 2010/10/18 23:45:45 tbox Exp $ */

 /*! \file */

@@ -468,7 +468,7 @@ isc_print_vsnprintf(char *str, size_t size, const char *format, va_list ap) {
 			if (width > 0) {
 				count += width;
 				width--;
-				if (left) {
+				if (left && size > 1) {
 					*str++ = c;
 					size--;
 				}
--- a/release-notes.css
+++ b/release-notes.css
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2010  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: release-notes.css,v 1.1.2.2 2010/11/29 01:15:44 tbox Exp $ */
+
+body {
+	background-color: #ffffff;
+	color: #333333;
+	font-family: "Helvetica Neue", "ArialMT", "Verdana", "Arial", "Helvetica", sans-serif;
+	font-size: 14px;
+	line-height: 18px;
+	margin: 2em auto;
+	width: 700px;
+}
+
+.command {
+	font-family: "Courier New", "Courier", monospace;
+	font-weight: normal;
+}
+
+.note {
+	background-color: #ddeedd;
+	border: 1px solid #aaccaa;
+	margin: 1em 0 1em 0;
+	padding: 0.5em 1em 0.5em 1em;
+	-moz-border-radius: 10px;
+	-webkit-border-radius: 10px;
+}
+
+.screen {
+	background-color: #ffffee;
+	border: 1px solid #ddddaa;
+	padding: 0.25em 1em 0.25em 1em;
+	margin: 1em 0 1em 0;
+	-moz-border-radius: 10px;
+	-webkit-border-radius: 10px;
+}
+
+.section.title {
+	font-size: 150%;
+	font-weight: bold;
+}
+
+.section.section.title {
+  font-size: 130%;
+  font-weight: bold;
+}
--- a/util/copyrights
+++ b/util/copyrights
@@ -6,6 +6,9 @@
 ./Makefile.in					MAKE	1998,1999,2000,2001,2002,2004,2005,2006,2007,2009
 ./README					X	1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010
 ./README.idnkit					X	2005,2009
+./RELEASE-NOTES-BIND-9.4-ESV.html		HTML	2010
+./RELEASE-NOTES-BIND-9.4-ESV.pdf		X	2010
+./RELEASE-NOTES-BIND-9.4-ESV.txt		X	2010
 ./acconfig.h					C	1999,2000,2001,2002,2003,2004,2005,2008
 ./aclocal.m4					X	1999,2000,2001
 ./bin/.cvsignore				X	1998,1999,2000,2001
@@ -495,17 +498,18 @@
 ./bin/tests/system/dnssec/dnssec_update_test.pl	PERL	2002,2004
 ./bin/tests/system/dnssec/ns1/.cvsignore	X	2000,2001
 ./bin/tests/system/dnssec/ns1/named.conf	CONF-C	2000,2001,2004,2006
-./bin/tests/system/dnssec/ns1/root.db.in	ZONE	2000,2001,2004
-./bin/tests/system/dnssec/ns1/sign.sh		SH	2000,2001,2002,2003,2004,2006
+./bin/tests/system/dnssec/ns1/root.db.in	ZONE	2000,2001,2004,2010
+./bin/tests/system/dnssec/ns1/sign.sh		SH	2000,2001,2002,2003,2004,2006,2010
 ./bin/tests/system/dnssec/ns2/.cvsignore	X	2000,2001
+./bin/tests/system/dnssec/ns2/algroll.db.in	ZONE	2010
 ./bin/tests/system/dnssec/ns2/dlv.db.in		ZONE	2004
 ./bin/tests/system/dnssec/ns2/dst.example.db.in	ZONE	2004
 ./bin/tests/system/dnssec/ns2/example.db.in	ZONE	2000,2001,2002,2004,2009
 ./bin/tests/system/dnssec/ns2/insecure.secure.example.db	ZONE	2000,2001,2004
-./bin/tests/system/dnssec/ns2/named.conf	CONF-C	2000,2001,2002,2004,2006
+./bin/tests/system/dnssec/ns2/named.conf	CONF-C	2000,2001,2002,2004,2006,2010
 ./bin/tests/system/dnssec/ns2/private.secure.example.db.in	ZONE	2000,2001,2004
 ./bin/tests/system/dnssec/ns2/rfc2335.example.db	X	2004
-./bin/tests/system/dnssec/ns2/sign.sh		SH	2000,2001,2002,2003,2004,2006,2009
+./bin/tests/system/dnssec/ns2/sign.sh		SH	2000,2001,2002,2003,2004,2006,2009,2010
 ./bin/tests/system/dnssec/ns3/.cvsignore	X	2000,2001
 ./bin/tests/system/dnssec/ns3/bogus.example.db.in	ZONE	2000,2001,2004
 ./bin/tests/system/dnssec/ns3/dynamic.example.db.in	ZONE	2002,2004
@@ -522,7 +526,7 @@
 ./bin/tests/system/dnssec/ns6/named.conf	CONF-C	2004,2006,2007
 ./bin/tests/system/dnssec/prereq.sh		SH	2000,2001,2002,2004,2006
 ./bin/tests/system/dnssec/setup.sh		SH	2000,2001,2004
-./bin/tests/system/dnssec/tests.sh		SH	2000,2001,2002,2004,2005,2006,2009
+./bin/tests/system/dnssec/tests.sh		SH	2000,2001,2002,2004,2005,2006,2009,2010
 ./bin/tests/system/forward/clean.sh		SH	2000,2001,2004
 ./bin/tests/system/forward/ns1/.cvsignore	X	2000,2001
 ./bin/tests/system/forward/ns1/example.db	X	2000,2001
@@ -670,10 +674,18 @@
 ./bin/tests/system/resolver/ans2/ans.pl		PERL	2000,2001,2004,2007,2010
 ./bin/tests/system/resolver/ans3/.cvsignore	X	2001
 ./bin/tests/system/resolver/ans3/ans.pl		PERL	2000,2001,2004,2007
+./bin/tests/system/resolver/clean.sh		SH	2010
 ./bin/tests/system/resolver/ns1/.cvsignore	X	2001
 ./bin/tests/system/resolver/ns1/named.conf	CONF-C	2000,2001,2004,2007
 ./bin/tests/system/resolver/ns1/root.hint	ZONE	2000,2001,2004
+./bin/tests/system/resolver/ns6/example.net.db.in	ZONE	2010
+./bin/tests/system/resolver/ns6/keygen.sh	SH	2010
+./bin/tests/system/resolver/ns6/named.conf	CONF-C	2010
+./bin/tests/system/resolver/ns6/root.db		ZONE	2010
+./bin/tests/system/resolver/ns7/named.conf	CONF-C	2010
+./bin/tests/system/resolver/ns7/root.hint	ZONE	2010
 ./bin/tests/system/resolver/prereq.sh		SH	2000,2001,2004
+./bin/tests/system/resolver/setup.sh		SH	2010
 ./bin/tests/system/resolver/tests.sh		SH	2000,2001,2004,2010
 ./bin/tests/system/rrsetorder/clean.sh		SH	2006
 ./bin/tests/system/rrsetorder/dig.out.cyclic.good1	X	2006
@@ -1803,7 +1815,7 @@
 ./lib/dns/include/dns/callbacks.h		C	1999,2000,2001,2002,2004,2005
 ./lib/dns/include/dns/cert.h			C	1999,2000,2001,2004,2005
 ./lib/dns/include/dns/compress.h		C	1999,2000,2001,2002,2004,2005,2006,2009
-./lib/dns/include/dns/db.h			C	1999,2000,2001,2002,2003,2004,2005,2007,2009
+./lib/dns/include/dns/db.h			C	1999,2000,2001,2002,2003,2004,2005,2007,2009,2010
 ./lib/dns/include/dns/dbiterator.h		C	1999,2000,2001,2004,2005
 ./lib/dns/include/dns/dbtable.h			C	1999,2000,2001,2004,2005
 ./lib/dns/include/dns/diff.h			C	2000,2001,2004,2005,2009
@@ -2048,7 +2060,7 @@
 ./lib/isc/alpha/include/isc/.cvsignore		X	2007
 ./lib/isc/alpha/include/isc/Makefile.in		MAKE	2007
 ./lib/isc/alpha/include/isc/atomic.h		C	2005,2009
-./lib/isc/api					X	1999,2000,2001,2005,2006,2007,2008,2009
+./lib/isc/api					X	1999,2000,2001,2005,2006,2007,2008,2009,2010
 ./lib/isc/assertions.c				C	1997,1998,1999,2000,2001,2004,2005,2008
 ./lib/isc/base64.c				C	1998,1999,2000,2001,2003,2004,2005
 ./lib/isc/bitstring.c				C	1999,2000,2001,2004,2005
@@ -2193,7 +2205,7 @@
 ./lib/isc/powerpc/include/isc/.cvsignore	X	2007
 ./lib/isc/powerpc/include/isc/Makefile.in	MAKE	2007
 ./lib/isc/powerpc/include/isc/atomic.h		C	2005,2007
-./lib/isc/print.c				C	1999,2000,2001,2003,2004,2005,2006,2008
+./lib/isc/print.c				C	1999,2000,2001,2003,2004,2005,2006,2008,2010
 ./lib/isc/pthreads/.cvsignore			X	1998,1999,2000,2001
 ./lib/isc/pthreads/Makefile.in			MAKE	1998,1999,2000,2001,2004
 ./lib/isc/pthreads/condition.c			C	1998,1999,2000,2001,2004,2005
@@ -2555,6 +2567,7 @@
 ./make/mkdep.in					X	1999,2000,2001
 ./make/rules.in					MAKE	1998,1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009
 ./mkinstalldirs					X	1996
+./release-notes.css				C	2010
 ./util/.cvsignore				X	2000,2001
 ./util/COPYRIGHT				X	1996,1997,1998,1999,2000,2001,2004
 ./util/COPYRIGHT.BRIEF				X	1996,1997,1998,1999,2000,2001,2004
@@ -2573,7 +2586,7 @@
 ./util/mandoc2docbook.pl			PERL	2001,2004
 ./util/mdnbuildtest.sh				SH	2000,2001,2004
 ./util/memleak.pl				PERL	1999,2000,2001,2004
-./util/merge_copyrights				PERL	1998,1999,2000,2001,2003,2004,2005,2006,2007,2009
+./util/merge_copyrights				PERL	1998,1999,2000,2001,2003,2004,2005,2006,2007,2009,2010
 ./util/mkreslib.pl				PERL	2000,2001,2004
 ./util/nanny.pl					PERL	2000,2001,2004
 ./util/nt-kit					SH	1999,2000,2001,2004
@@ -2582,7 +2595,7 @@
 ./util/update-drafts.pl				PERL	2000,2001,2004
 ./util/update_copyrights			PERL	1998,1999,2000,2001,2004,2005,2006,2007,2008,2009
 ./version					X	1998,1999,2000,2001,2002,2003,2005,2006,2007,2008,2009,2010
-./win32utils/BINDBuild.dsw			X	2001,2005,2006
+./win32utils/BINDBuild.dsw			X	2001,2005,2006,2010
 ./win32utils/BuildAll.bat			BAT	2001,2002,2004,2005,2006,2007
 ./win32utils/BuildOpenSSL.bat			BAT	2007
 ./win32utils/BuildPost.bat			BAT	2005,2006
--- a/util/merge_copyrights
+++ b/util/merge_copyrights
@@ -1,6 +1,6 @@
 #!/usr/local/bin/perl -w
 #
-# Copyright (C) 2004-2007, 2009  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004-2007, 2009, 2010  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 1998-2001, 2003  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.

-# $Id: merge_copyrights,v 1.19.18.12 2009/06/11 23:46:03 tbox Exp $
+# $Id: merge_copyrights,v 1.19.18.14 2010/11/17 23:45:12 tbox Exp $

 %file_types = ();
 %file_years = ();
@@ -72,7 +72,7 @@ while (<FILES>) {
 	    $file_types{$_} = "MAN";
 	} elsif ($base =~ /\/Makefile$/) {
 	    $file_types{$_} = "MAKE";
-	} elsif ($base =~ /\/(named|rndc).?\.conf$/) {
+	} elsif ($base =~ /\/(named|rndc).{0,2}\.conf$/) {
 	    $file_types{$_} = "CONF-C";
 	} elsif ($base =~ /\/resolv.?\.conf$/) {
 	    $file_types{$_} = "CONF-SH";
--- a/4
+++ b/4
@@ -1,4 +1,4 @@
-# $Id: version,v 1.29.134.31 2010/09/02 07:23:32 marka Exp $
+# $Id: version,v 1.29.134.32 2010/11/18 01:34:50 marka Exp $
 #
 # This file must follow /bin/sh rules.  It is imported directly via
 # configure.
@@ -7,4 +7,4 @@ MAJORVER=9
 MINORVER=4
 PATCHVER=
 RELEASETYPE=-ESV
-RELEASEVER=-R3
+RELEASEVER=-R4
--- a/win32utils/BINDBuild.dsw
+++ b/win32utils/BINDBuild.dsw
@@ -48,6 +48,12 @@ Package=<4>
    Project_Dep_Name liblwres
    End Project Dependency
    Begin Project Dependency
+    Project_Dep_Name libisccfg
+    End Project Dependency
+    Begin Project Dependency
+    Project_Dep_Name libisccc
+    End Project Dependency
+    Begin Project Dependency
    Project_Dep_Name dighost
    End Project Dependency
 }}}
@@ -185,6 +191,9 @@ Package=<5>

 Package=<4>
 {{{
+    Begin Project Dependency
+    Project_Dep_Name libdns
+    End Project Dependency
    Begin Project Dependency
    Project_Dep_Name libisc
    End Project Dependency
@@ -212,6 +221,9 @@ Package=<5>

 Package=<4>
 {{{
+    Begin Project Dependency
+    Project_Dep_Name libbind9
+    End Project Dependency
    Begin Project Dependency
    Project_Dep_Name libdns
    End Project Dependency
@@ -227,9 +239,6 @@ Package=<4>
    Begin Project Dependency
    Project_Dep_Name liblwres
    End Project Dependency
-    Begin Project Dependency
-    Project_Dep_Name libbind9
-    End Project Dependency
 }}}

 ###############################################################################
@@ -243,16 +252,19 @@ Package=<5>
 Package=<4>
 {{{
    Begin Project Dependency
-    Project_Dep_Name libisc
+    Project_Dep_Name checktool
    End Project Dependency
    Begin Project Dependency
-    Project_Dep_Name libisccfg
+    Project_Dep_Name bind9
    End Project Dependency
    Begin Project Dependency
    Project_Dep_Name libdns
    End Project Dependency
    Begin Project Dependency
-    Project_Dep_Name checktool
+    Project_Dep_Name libisc
+    End Project Dependency
+    Begin Project Dependency
+    Project_Dep_Name libisccfg
    End Project Dependency
 }}}

@@ -266,6 +278,9 @@ Package=<5>

 Package=<4>
 {{{
+    Begin Project Dependency
+    Project_Dep_Name checktool
+    End Project Dependency
    Begin Project Dependency
    Project_Dep_Name libdns
    End Project Dependency
@@ -273,7 +288,7 @@ Package=<4>
    Project_Dep_Name libisc
    End Project Dependency
    Begin Project Dependency
-    Project_Dep_Name checktool
+    Project_Dep_Name libisccfg
    End Project Dependency
 }}}

@@ -287,6 +302,9 @@ Package=<5>

 Package=<4>
 {{{
+    Begin Project Dependency
+    Project_Dep_Name libbind9
+    End Project Dependency
    Begin Project Dependency
    Project_Dep_Name libdns
    End Project Dependency
@@ -294,9 +312,6 @@ Package=<4>
    Project_Dep_Name libisc
    End Project Dependency
    Begin Project Dependency
-    Project_Dep_Name libbind9
-    End Project Dependency
-    Begin Project Dependency
    Project_Dep_Name liblwres
    End Project Dependency
    Begin Project Dependency
@@ -314,6 +329,9 @@ Package=<5>

 Package=<4>
 {{{
+    Begin Project Dependency
+    Project_Dep_Name libbind9
+    End Project Dependency
    Begin Project Dependency
    Project_Dep_Name libdns
    End Project Dependency
@@ -321,7 +339,7 @@ Package=<4>
    Project_Dep_Name libisc
    End Project Dependency
    Begin Project Dependency
-    Project_Dep_Name libbind9
+    Project_Dep_Name liblwres
    End Project Dependency
 }}}

@@ -335,6 +353,12 @@ Package=<5>

 Package=<4>
 {{{
+    Begin Project Dependency
+    Project_Dep_Name libbind9
+    End Project Dependency
+    Begin Project Dependency
+    Project_Dep_Name libdns
+    End Project Dependency
    Begin Project Dependency
    Project_Dep_Name libisc
    End Project Dependency
@@ -345,9 +369,6 @@ Package=<4>
    Project_Dep_Name libisccfg
    End Project Dependency
    Begin Project Dependency
-    Project_Dep_Name libbind9
-    End Project Dependency
-    Begin Project Dependency
    Project_Dep_Name rndcutil
    End Project Dependency
 }}}
@@ -362,6 +383,18 @@ Package=<5>

 Package=<4>
 {{{
+    Begin Project Dependency
+    Project_Dep_Name libdns
+    End Project Dependency
+    Begin Project Dependency
+    Project_Dep_Name libisc
+    End Project Dependency
+    Begin Project Dependency
+    Project_Dep_Name libisccc
+    End Project Dependency
+    Begin Project Dependency
+    Project_Dep_Name libisccfg
+    End Project Dependency
    Begin Project Dependency
    Project_Dep_Name rndcutil
    End Project Dependency
@@ -377,15 +410,15 @@ Package=<5>

 Package=<4>
 {{{
+    Begin Project Dependency
+    Project_Dep_Name dnssectool
+    End Project Dependency
    Begin Project Dependency
    Project_Dep_Name libdns
    End Project Dependency
    Begin Project Dependency
    Project_Dep_Name libisc
    End Project Dependency
-    Begin Project Dependency
-    Project_Dep_Name dnssectool
-    End Project Dependency
 }}}

 ###############################################################################
Author	SHA1	Message	Date
cvs2git	9ef41eec67	This commit was manufactured by cvs2git to create branch 'rt22288_method2'.	2010-11-29 02:15:07 +00:00
Automatic Updater	e08edd5ea4	update	2010-11-29 02:15:06 +00:00
Automatic Updater	32a72d8d7d	update copyright notice	2010-11-29 01:15:44 +00:00
Automatic Updater	383d1b29ea	update	2010-11-29 01:11:04 +00:00
Mark Andrews	04edcb637f	add release notes	2010-11-29 00:41:03 +00:00
Mark Andrews	7d9635f938	remove CVSS scores add vectors	2010-11-29 00:40:13 +00:00
Automatic Updater	dbe9ece285	update	2010-11-25 05:15:03 +00:00
Mark Andrews	bbac4157e5	CVE-2010-3613 Reduce complexity from M to L raising score from 7.1 to 7.8. Just have the base CVSS vectors.	2010-11-25 04:55:50 +00:00
Automatic Updater	20c8d7e3e3	update	2010-11-19 00:15:06 +00:00
Automatic Updater	533b584e56	newcopyrights	2010-11-18 23:30:07 +00:00
Automatic Updater	62087d6662	update	2010-11-18 03:15:26 +00:00
Mark Andrews	845baabb7c	add CVE, VU and CVSS	2010-11-18 02:56:53 +00:00
Automatic Updater	5770cef756	update	2010-11-18 02:15:06 +00:00
Mark Andrews	4ff8895925	9.4-ESV-R4	2010-11-18 01:34:51 +00:00
Automatic Updater	8ab8b99193	update	2010-11-18 00:15:07 +00:00
Automatic Updater	1dfb563662	update copyright notice	2010-11-17 23:45:12 +00:00
Automatic Updater	79f3e95be9	newcopyrights	2010-11-17 23:30:07 +00:00
Automatic Updater	762d06d0b4	update	2010-11-17 11:15:07 +00:00
Mark Andrews	3a66e0f68c	2786. [bug] Additional could be promoted to answer. [RT #20663 ]	2010-11-17 10:21:02 +00:00
Automatic Updater	9422f406f9	update	2010-11-17 10:15:09 +00:00
Mark Andrews	d5e5c8d8f7	convert to 9.4 syntax and algorithms	2010-11-17 10:11:43 +00:00
Mark Andrews	5d51096644	initalise n	2010-11-17 10:10:55 +00:00
Automatic Updater	29cc20bd79	update	2010-11-17 09:15:08 +00:00
Mark Andrews	f067658513	genrandom is not in tools in 9.4	2010-11-17 09:12:52 +00:00
Automatic Updater	648cc13bd9	update	2010-11-17 04:15:20 +00:00
Mark Andrews	cf065ab76e	handle namedxx.conf	2010-11-17 03:17:12 +00:00
Automatic Updater	4ebdedf925	update	2010-11-17 00:15:11 +00:00
Automatic Updater	09065d8286	update copyright notice	2010-11-16 23:45:24 +00:00
Automatic Updater	4f9711d61e	newcopyrights	2010-11-16 23:30:05 +00:00
Automatic Updater	f5b4ce0ca0	update	2010-11-16 08:15:06 +00:00
Mark Andrews	b78658f143	2970. [security] Adding a NO DATA negative cache entry failed to clear any matching RRSIG records. A subsequent lookup of of NO DATA cache entry could trigger a INSIST when the unexpected RRSIG was also returned with the NO DATA cache entry. [RT #22288]	2010-11-16 08:01:09 +00:00
Automatic Updater	13da26c5e1	update	2010-11-16 05:15:10 +00:00
Mark Andrews	a407ead333	2968. [security] Named could fail to prove a data set was insecure before marking it as insecure. One set of conditions that can trigger this occurs naturally when rolling DNSKEY algorithms. [RT #22309] Had to adjust the test to use RSAMD5 -> RSASH1 as we need to use algorithms supported by 9.4.	2010-11-16 04:17:44 +00:00
Automatic Updater	a9c555038b	update	2010-11-11 02:15:11 +00:00
Automatic Updater	d601031022	sync	2010-11-11 01:22:51 +00:00
Automatic Updater	8a24363e29	update	2010-10-19 00:15:13 +00:00
Automatic Updater	98172e6c3f	update copyright notice	2010-10-18 23:45:45 +00:00
Automatic Updater	78579cb427	newcopyrights	2010-10-18 23:30:07 +00:00
Automatic Updater	03ca2e97ed	update	2010-10-18 05:15:11 +00:00
Mark Andrews	d56cb6aead	2962. [port] win32: add more dependancies to BINDBuild.dsw. [RT #22062]	2010-10-18 04:46:26 +00:00
Automatic Updater	2b63bb22ad	update	2010-10-18 04:15:32 +00:00
Mark Andrews	b35d42c270	2966. [bug] isc_print_vsnprintf() failed to check if there was space available in the buffer when adding a left justified character with a non zero width, (e.g. "%-1c"). [RT #22270]	2010-10-18 04:08:02 +00:00
Automatic Updater	a011b44e82	update	2010-10-03 02:15:11 +00:00
Automatic Updater	dd9a10bcaf	sync	2010-10-03 01:22:51 +00:00