diff --git a/contrib/bind9/CHANGES b/contrib/bind9/CHANGES
index 3f2df797177..cb2581a44b3 100644
--- a/contrib/bind9/CHANGES
+++ b/contrib/bind9/CHANGES
@@ -1,9 +1,48 @@
- --- 9.6.2-P2 released ---
+ --- 9.6-ESV-R2 released ---
+
+2939. [func] Check that named successfully skips NSEC3 records
+ that fail to match the NSEC3PARAM record currently
+ in use. [RT# 21868]
+
+2937. [bug] Worked around an apparent race condition in over
+ memory conditions. Without this fix a DNS cache DB or
+ ADB could incorrectly stay in an over memory state,
+ effectively refusing further caching, which
+ subsequently made a BIND 9 caching server unworkable.
+ This fix prevents this problem from happening by
+ polling the state of the memory context, rather than
+ making a copy of the state, which appeared to cause
+ a race. This is a "workaround" in that it doesn't
+ solve the possible race per se, but several experiments
+ proved this change solves the symptom. Also, the
+ polling overhead hasn't been reported to be an issue.
+ This bug should only affect a caching server that
+ specifies a finite max-cache-size. It's also quite
+ likely that the bug happens only when enabling threads,
+ but it's not confirmed yet. [RT #21818]
+
+2925. [bug] Named failed to accept uncachable negative responses
+ from insecure zones. [RT# 21555]
+
+2921. [bug] The resolver could attempt to destroy a fetch context
+ too soon. [RT #19878]
+
+2900. [bug] The placeholder negative caching element was not
+ properly constructed triggering a INSIST in
+ dns_ncache_towire(). [RT #21346]
+
+2890. [bug] Handle the introduction of new trusted-keys and
+ DS, DLV RRsets better. [RT #21097]
+
+2869. [bug] Fix arguments to dns_keytable_findnextkeynode() call.
+ [RT #20877]
+
+ --- 9.6-ESV-R1 released ---
2876. [bug] Named could return SERVFAIL for negative responses
from unsigned zones. [RT #21131]
- --- 9.6.2-P1 released ---
+ --- 9.6-ESV released ---
2852. [bug] Handle broken DNSSEC trust chains better. [RT #15619]
diff --git a/contrib/bind9/README b/contrib/bind9/README
index 902d9ed97d2..fc981a6d694 100644
--- a/contrib/bind9/README
+++ b/contrib/bind9/README
@@ -42,6 +42,12 @@ BIND 9
Stichting NLnet - NLnet Foundation
Nominum, Inc.
+BIND 9.6-ESV (Extended Support Version)
+
+ BIND 9.6-ESV will be supported until March 31, 2013, at
+ which time you will need to upgrade to the current release
+ of BIND.
+
BIND 9.6.2
BIND 9.6.2 is a maintenance release, fixing bugs in 9.6.1.
diff --git a/contrib/bind9/bin/dnssec/dnssec-dsfromkey.html b/contrib/bind9/bin/dnssec/dnssec-dsfromkey.html
index 72dfd3a55a1..bc0273d6cfb 100644
--- a/contrib/bind9/bin/dnssec/dnssec-dsfromkey.html
+++ b/contrib/bind9/bin/dnssec/dnssec-dsfromkey.html
@@ -1,5 +1,5 @@
-
+
@@ -33,14 +33,14 @@
dnssec-dsfromkey {-s} [-v level] [-1] [-2] [-a alg] [-c class] [-d dir] {dnsname}
-
DESCRIPTION
+
DESCRIPTION
dnssec-dsfromkey
outputs the Delegation Signer (DS) resource record (RR), as defined in
RFC 3658 and RFC 4509, for the given key(s).
-
EXAMPLE
+
EXAMPLE
To build the SHA-256 DS RR from the
Kexample.com.+003+26160
@@ -96,7 +96,7 @@
-
FILES
+
FILES
The keyfile can be designed by the key identification
Knnnn.+aaa+iiiii or the full file name
@@ -110,13 +110,13 @@
-
CAVEAT
+
CAVEAT
A keyfile error can give a "file not found" even if the file exists.
-
SEE ALSO
+
SEE ALSO
dnssec-keygen(8),
dnssec-signzone(8),
BIND 9 Administrator Reference Manual,
@@ -125,7 +125,7 @@
-
AUTHOR
+
AUTHOR
Internet Systems Consortium
diff --git a/contrib/bind9/bin/dnssec/dnssec-keyfromlabel.html b/contrib/bind9/bin/dnssec/dnssec-keyfromlabel.html
index 1aafccd97c1..2ef83d2c0cc 100644
--- a/contrib/bind9/bin/dnssec/dnssec-keyfromlabel.html
+++ b/contrib/bind9/bin/dnssec/dnssec-keyfromlabel.html
@@ -13,7 +13,7 @@
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
@@ -31,7 +31,7 @@
dnssec-keyfromlabel {-a algorithm} {-l label} [-c class] [-f flag] [-k] [-n nametype] [-p protocol] [-t type] [-v level] {name}
-
DESCRIPTION
+
DESCRIPTION
dnssec-keyfromlabel
gets keys with the given label from a crypto hardware and builds
key files for DNSSEC (Secure DNS), as defined in RFC 2535
@@ -39,7 +39,7 @@
-
OPTIONS
+
OPTIONS
- -a
algorithm
-
@@ -120,7 +120,7 @@
-
GENERATED KEY FILES
+
GENERATED KEY FILES
When dnssec-keyfromlabel completes
successfully,
@@ -161,7 +161,7 @@
-
SEE ALSO
+
SEE ALSO
dnssec-keygen(8),
dnssec-signzone(8),
BIND 9 Administrator Reference Manual,
@@ -169,7 +169,7 @@
-
AUTHOR
+
AUTHOR
Internet Systems Consortium
diff --git a/contrib/bind9/bin/dnssec/dnssec-keygen.html b/contrib/bind9/bin/dnssec/dnssec-keygen.html
index fccec6f684c..0e9255a3b5f 100644
--- a/contrib/bind9/bin/dnssec/dnssec-keygen.html
+++ b/contrib/bind9/bin/dnssec/dnssec-keygen.html
@@ -14,7 +14,7 @@
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
@@ -32,7 +32,7 @@
dnssec-keygen {-a algorithm} {-b keysize} {-n nametype} [-c class] [-e] [-f flag] [-g generator] [-h] [-k] [-p protocol] [-r randomdev] [-s strength] [-t type] [-v level] {name}
-
DESCRIPTION
+
DESCRIPTION
dnssec-keygen
generates keys for DNSSEC (Secure DNS), as defined in RFC 2535
and RFC 4034. It can also generate keys for use with
@@ -45,7 +45,7 @@
-
OPTIONS
+
OPTIONS
- -a
algorithm
-
@@ -155,7 +155,7 @@
-
GENERATED KEYS
+
GENERATED KEYS
When dnssec-keygen completes
successfully,
@@ -201,7 +201,7 @@
-
EXAMPLE
+
EXAMPLE
To generate a 768-bit DSA key for the domain
example.com, the following command would be
@@ -222,7 +222,7 @@
-
SEE ALSO
+
SEE ALSO
dnssec-signzone(8),
BIND 9 Administrator Reference Manual,
RFC 2539,
@@ -231,7 +231,7 @@
-
AUTHOR
+
AUTHOR
Internet Systems Consortium
diff --git a/contrib/bind9/bin/dnssec/dnssec-signzone.html b/contrib/bind9/bin/dnssec/dnssec-signzone.html
index e7c534f9094..c37b6f50b0b 100644
--- a/contrib/bind9/bin/dnssec/dnssec-signzone.html
+++ b/contrib/bind9/bin/dnssec/dnssec-signzone.html
@@ -14,7 +14,7 @@
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
@@ -32,7 +32,7 @@
dnssec-signzone [-a] [-c class] [-d directory] [-e end-time] [-f output-file] [-g] [-h] [-k key] [-l domain] [-i interval] [-I input-format] [-j jitter] [-N soa-serial-format] [-o origin] [-O output-format] [-p] [-P] [-r randomdev] [-s start-time] [-t] [-v level] [-z] [-3 salt] [-H iterations] [-A] {zonefile} [key...]
-
DESCRIPTION
+
DESCRIPTION
dnssec-signzone
signs a zone. It generates
NSEC and RRSIG records and produces a signed version of the
@@ -43,7 +43,7 @@
-
EXAMPLE
+
EXAMPLE
The following command signs the example.com
zone with the DSA key generated by dnssec-keygen
@@ -302,7 +302,7 @@ db.example.com.signed
%
-
KNOWN BUGS
+
KNOWN BUGS
dnssec-signzone was designed so that it could
sign a zone partially, using only a subset of the DNSSEC keys
@@ -327,14 +327,14 @@ db.example.com.signed
-
SEE ALSO
+
SEE ALSO
dnssec-keygen(8),
BIND 9 Administrator Reference Manual,
RFC 4033.
-
AUTHOR
+
AUTHOR
Internet Systems Consortium
diff --git a/contrib/bind9/bin/named/include/named/globals.h b/contrib/bind9/bin/named/include/named/globals.h
index 6040dc30eb0..c39fe5ec3d7 100644
--- a/contrib/bind9/bin/named/include/named/globals.h
+++ b/contrib/bind9/bin/named/include/named/globals.h
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2008, 2010 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: globals.h,v 1.80 2008/11/16 22:49:18 marka Exp $ */
+/* $Id: globals.h,v 1.80.84.2 2010/06/26 23:46:15 tbox Exp $ */
#ifndef NAMED_GLOBALS_H
#define NAMED_GLOBALS_H 1
@@ -132,6 +132,7 @@ EXTERN int ns_g_listen INIT(3);
EXTERN isc_time_t ns_g_boottime;
EXTERN isc_boolean_t ns_g_memstatistics INIT(ISC_FALSE);
EXTERN isc_boolean_t ns_g_clienttest INIT(ISC_FALSE);
+EXTERN isc_boolean_t ns_g_nosoa INIT(ISC_FALSE);
#undef EXTERN
#undef INIT
diff --git a/contrib/bind9/bin/named/main.c b/contrib/bind9/bin/named/main.c
index f97ab45a317..74bace50065 100644
--- a/contrib/bind9/bin/named/main.c
+++ b/contrib/bind9/bin/named/main.c
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2004-2009 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2010 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: main.c,v 1.166.34.3 2009/04/03 20:18:59 marka Exp $ */
+/* $Id: main.c,v 1.166.34.3.24.3 2010/09/06 03:58:32 marka Exp $ */
/*! \file */
@@ -446,13 +446,15 @@ parse_command_line(int argc, char *argv[]) {
/* XXXJAB should we make a copy? */
ns_g_chrootdir = isc_commandline_argument;
break;
- case 'T':
+ case 'T': /* NOT DOCUMENTED */
/*
* clienttest: make clients single shot with their
* own memory context.
*/
if (strcmp(isc_commandline_argument, "clienttest") == 0)
ns_g_clienttest = ISC_TRUE;
+ else if (!strcmp(isc_commandline_argument, "nosoa"))
+ ns_g_nosoa = ISC_TRUE;
else
fprintf(stderr, "unknown -T flag '%s\n",
isc_commandline_argument);
diff --git a/contrib/bind9/bin/named/query.c b/contrib/bind9/bin/named/query.c
index cef6d7f7c3a..73ed1a6b909 100644
--- a/contrib/bind9/bin/named/query.c
+++ b/contrib/bind9/bin/named/query.c
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2004-2009 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2010 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: query.c,v 1.313.20.16 2009/12/30 08:34:29 jinmei Exp $ */
+/* $Id: query.c,v 1.313.20.16.10.2 2010/06/26 23:46:14 tbox Exp $ */
/*! \file */
@@ -56,6 +56,7 @@
#include
#include
+#include
#include
#include
#include
@@ -2038,7 +2039,7 @@ query_addrrset(ns_client_t *client, dns_name_t **namep,
static inline isc_result_t
query_addsoa(ns_client_t *client, dns_db_t *db, dns_dbversion_t *version,
- isc_boolean_t zero_ttl)
+ isc_boolean_t zero_ttl, isc_boolean_t isassociated)
{
dns_name_t *name;
dns_dbnode_t *node;
@@ -2055,6 +2056,12 @@ query_addsoa(ns_client_t *client, dns_db_t *db, dns_dbversion_t *version,
rdataset = NULL;
node = NULL;
+ /*
+ * Don't add the SOA record for test which set "-T nosoa".
+ */
+ if (ns_g_nosoa && (!WANTDNSSEC(client) || !isassociated))
+ return (ISC_R_SUCCESS);
+
/*
* Get resources and make 'name' be the database origin.
*/
@@ -4324,7 +4331,8 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
/*
* Add SOA.
*/
- result = query_addsoa(client, db, version, ISC_FALSE);
+ result = query_addsoa(client, db, version, ISC_FALSE,
+ dns_rdataset_isassociated(rdataset));
if (result != ISC_R_SUCCESS) {
QUERY_ERROR(result);
goto cleanup;
@@ -4372,9 +4380,11 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
zone != NULL &&
#endif
dns_zone_getzeronosoattl(zone))
- result = query_addsoa(client, db, version, ISC_TRUE);
+ result = query_addsoa(client, db, version, ISC_TRUE,
+ dns_rdataset_isassociated(rdataset));
else
- result = query_addsoa(client, db, version, ISC_FALSE);
+ result = query_addsoa(client, db, version, ISC_FALSE,
+ dns_rdataset_isassociated(rdataset));
if (result != ISC_R_SUCCESS) {
QUERY_ERROR(result);
goto cleanup;
@@ -4742,7 +4752,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
* Add SOA.
*/
result = query_addsoa(client, db, version,
- ISC_FALSE);
+ ISC_FALSE, ISC_FALSE);
if (result == ISC_R_SUCCESS)
result = ISC_R_NOMORE;
} else {
diff --git a/contrib/bind9/bin/named/server.c b/contrib/bind9/bin/named/server.c
index 6608fdfe140..8f6778666a0 100644
--- a/contrib/bind9/bin/named/server.c
+++ b/contrib/bind9/bin/named/server.c
@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: server.c,v 1.520.12.11.8.2 2010/02/25 10:57:11 tbox Exp $ */
+/* $Id: server.c,v 1.520.12.11.10.1 2010/03/03 22:06:36 marka Exp $ */
/*! \file */
diff --git a/contrib/bind9/bin/nsupdate/nsupdate.html b/contrib/bind9/bin/nsupdate/nsupdate.html
index 9f45171a4fe..c655c02da17 100644
--- a/contrib/bind9/bin/nsupdate/nsupdate.html
+++ b/contrib/bind9/bin/nsupdate/nsupdate.html
@@ -14,7 +14,7 @@
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
@@ -32,7 +32,7 @@
nsupdate [-d] [-D] [[-g] | [-o] | [-y [hmac:]keyname:secret] | [-k keyfile]] [-t timeout] [-u udptimeout] [-r udpretries] [-R randomdev] [-v] [filename]
-
DESCRIPTION
+
DESCRIPTION
nsupdate
is used to submit Dynamic DNS Update requests as defined in RFC2136
to a name server.
@@ -169,7 +169,7 @@
-
INPUT FORMAT
+
INPUT FORMAT
nsupdate
reads input from
filename
@@ -433,7 +433,7 @@
-
EXAMPLES
+
EXAMPLES
The examples below show how
nsupdate
@@ -487,7 +487,7 @@
-
FILES
+
FILES
/etc/resolv.conf
@@ -506,7 +506,7 @@
-
SEE ALSO
+
SEE ALSO
RFC2136,
RFC3007,
RFC2104,
@@ -519,7 +519,7 @@
-
BUGS
+
BUGS
The TSIG key is redundantly stored in two separate files.
This is a consequence of nsupdate using the DST library
diff --git a/contrib/bind9/doc/arm/Bv9ARM-book.xml b/contrib/bind9/doc/arm/Bv9ARM-book.xml
index 29331d98579..da80a31f157 100644
--- a/contrib/bind9/doc/arm/Bv9ARM-book.xml
+++ b/contrib/bind9/doc/arm/Bv9ARM-book.xml
@@ -18,7 +18,7 @@
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
BIND 9 Administrator Reference Manual
diff --git a/contrib/bind9/doc/arm/Bv9ARM.ch06.html b/contrib/bind9/doc/arm/Bv9ARM.ch06.html
index 9e0667e2525..a6ccccdc68d 100644
--- a/contrib/bind9/doc/arm/Bv9ARM.ch06.html
+++ b/contrib/bind9/doc/arm/Bv9ARM.ch06.html
@@ -14,7 +14,7 @@
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
diff --git a/contrib/bind9/doc/arm/Bv9ARM.ch07.html b/contrib/bind9/doc/arm/Bv9ARM.ch07.html
index 91994f3472b..e56035adc85 100644
--- a/contrib/bind9/doc/arm/Bv9ARM.ch07.html
+++ b/contrib/bind9/doc/arm/Bv9ARM.ch07.html
@@ -14,7 +14,7 @@
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
diff --git a/contrib/bind9/doc/arm/Bv9ARM.ch08.html b/contrib/bind9/doc/arm/Bv9ARM.ch08.html
index 3e7c8c310fd..04b05a3eaf3 100644
--- a/contrib/bind9/doc/arm/Bv9ARM.ch08.html
+++ b/contrib/bind9/doc/arm/Bv9ARM.ch08.html
@@ -14,7 +14,7 @@
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
diff --git a/contrib/bind9/doc/arm/Bv9ARM.ch09.html b/contrib/bind9/doc/arm/Bv9ARM.ch09.html
index 6b6af6a7f1d..8007dd2dade 100644
--- a/contrib/bind9/doc/arm/Bv9ARM.ch09.html
+++ b/contrib/bind9/doc/arm/Bv9ARM.ch09.html
@@ -14,7 +14,7 @@
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
diff --git a/contrib/bind9/doc/arm/Bv9ARM.html b/contrib/bind9/doc/arm/Bv9ARM.html
index 2f127c661c3..44abd7729d4 100644
--- a/contrib/bind9/doc/arm/Bv9ARM.html
+++ b/contrib/bind9/doc/arm/Bv9ARM.html
@@ -14,7 +14,7 @@
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
diff --git a/contrib/bind9/doc/arm/Bv9ARM.pdf b/contrib/bind9/doc/arm/Bv9ARM.pdf
index 87f346299a7..2e0260445d1 100644
--- a/contrib/bind9/doc/arm/Bv9ARM.pdf
+++ b/contrib/bind9/doc/arm/Bv9ARM.pdf
@@ -9622,7 +9622,7 @@ endobj
stream
xte\6 tݡ000 R"t ȋ>??w^Z75
rprtP(W琅CfL9g0] #5@xDDD0 rp'/g+_. + .[;9a@=0j@`YI PC@``w@: @p5\8d\ @y{N!v
l0f[G3{$ӆ!NǬtypGOk8`4+s=]!.NPcG2'gn.@gk(wuuO= ' .`
'&cNcn[l nN
-{fXE 0lɥ w}L `u?@#
ܿ,vNj xc ߏs:B^F4;Wc!d`(B<W}SL 70};A`?6x.Mu=rA˂GP9pro:#
?de ^ 7=*7tux^psr?Fr~sOo4
+{fXE 0lɥ w}L `u?@#
ܿ,vNj xc ߏs:B^F4;Wc!d`(B<W}SL 70};A`?6x.y-
cySrA˂GP9pro:#
?de ^ 7=*7tux^psr?Fr~sOo4
0a֏Oo?x= a.Ab9Y
/z{x*2#Dj,8Ey;on
Aߋ(X>.3vmsW`gϨ"
rn蚗ߡRw9_ҹ_8=e4%v>oFk(?`Lٽ`4&9[~;26cL|r)Sjl(
b7Vh9,IRe߷R%=
t(%LǏ)>1٥^2O %>pjÕr{2wBx(S|Duޡ{:ґ2G9C{ɕ<|?K@F),w? ah%ٱo^{6@-%~jwXjz1i%u3^g`d+K[De]Y?>Hj,kѸh8v_
[J֮9m=?\k>ଇ*ѳ,Y
W7}C#ZR$`bGοa9gS%\/hC|?sg)m}vk.b&O
+uqf`a,I㯽/ݛ'P6ߢH?ٹ9mHr7:pMRY# 'WKC|-mW躖nᲶ03=j-,nebi;Hl<)L.Yڷ)wL=(L|)='-@.