Pkgsrc changes:
* Adapt patches
Upstream changes:
Notes for BIND 9.16.7
---------------------
New Features
~~~~~~~~~~~~
- Add a new ``rndc`` command, ``rndc dnssec -checkds``, which signals to
``named`` that a DS record for a given zone or key has been published
or withdrawn from the parent. This command replaces the time-based
``parent-registration-delay`` configuration option. [GL #1613]
- Log when ``named`` adds a CDS/CDNSKEY to the zone. [GL #1748]
Bug Fixes
~~~~~~~~~
- In rare circumstances, ``named`` would exit with an assertion failure
when the number of nodes stored in the red-black tree exceeded the
maximum allowed size of the internal hash table. [GL #2104]
- Silence spurious system log messages for an EPROTO(71) error code that
was seen on older operating systems, where unhandled ICMPv6 errors
resulted in a generic protocol error being returned instead of a more
specific error code. [GL #1928]
- With query name minimization enabled, ``named`` failed to resolve
``ip6.arpa.`` names that had extra labels to the left of the IPv6
part. For example, when ``named`` attempted query name minimization on
a name like ``A.B.1.2.3.4.(...).ip6.arpa.``, it stopped at the
leftmost IPv6 label, i.e. ``1.2.3.4.(...).ip6.arpa.``, without
considering the extra labels (``A.B``). That caused a query loop when
resolving the name: if ``named`` received NXDOMAIN answers, then the
same query was repeatedly sent until the number of queries sent
reached the value of the ``max-recursion-queries`` configuration
option. [GL #1847]
- Parsing of LOC records was made more strict by rejecting a sole period
(``.``) and/or ``m`` as a value. These changes prevent zone files
using such values from being loaded. Handling of negative altitudes
which are not integers was also corrected. [GL #2074]
- Several problems found by `OSS-Fuzz`_ were fixed. (None of these are
security issues.) [GL !3953] [GL !3975]
.. _OSS-Fuzz: https://github.com/google/oss-fuzz
0d23db68d8