GitLab

3705.	[func]		"configure --enable-native-pkcs11" enables BIND
			to use the PKCS#11 API for all cryptographic
			functions, so that it can drive a hardware service
			module directly without the need to use a modified
			OpenSSL as intermediary (so long as the HSM's vendor
			provides a complete-enough implementation of the
			PKCS#11 interface). This has been tested successfully
			with the Thales nShield HSM and with SoftHSMv2 from
			the OpenDNSSEC project. [RT #29031]

                        information for their extensions in the version
                        file by setting the EXTENSIONS variable.

                        [RT #34856]

                        when libcap-devel is installed. [RT #34838]

only generate DSA/ECDSA signatures in named if we have a source of randomness and only on specific platforms

3648.	[test]		Updated the ATF test framework to version 0.17.
			[RT #25627]

                        when building from a git repository. [RT #20422]

                        the json library. [RT #34449]

3615.	[cleanup]	"configure" now finishes by printing a summary
			of optional BIND features and whether they are
			active or inactive. ("configure --enable-full-report"
			increases the verbosity of the summary.) [RT #31777]

3614.	[port]		Check for <linux/types.h>. [RT #34162]

3512.	[port]		Check whether to use -ljson or -ljson-c. [RT #34115]

3611.	[bug]		Improved resistance to a theoretical authentication
			attack based on differential timing.  [RT #33939]

3572.	[func]		Threads are now enabled by default on most
			operating systems. [RT #25483]

3568.	[cleanup]	Add a product description line to the version file,
			to be reported by named -v/-V. [RT #33366]

3550.	[func]		Unified the internal and export versions of the
			BIND libraries, allowing external clients to use
			the same libraries as BIND. [RT #33131]

3528.	[func]		New "dnssec-coverage" command scans the timing
			metadata for a set of DNSSEC keys and reports if a
			lapse in signing coverage has been scheduled
			inadvertently. (Note: This tool depends on python;
			it will not be built or installed on systems that
			do not have a python interpreter.) [RT #28098]

3526.	[cleanup]	Set up dependencies for unit tests correctly during
			build. [RT #32803]

3524.	[func]		Added an alternate statistics channel in JSON format,
			when the server is built with the json-c library:
			http://[address]:[port]/json.  [RT #32630]

                        easy naming of different products (BIND
                        vs BIND ESV, for example). [RT #32755]

    only compile geoip.o when requested.
    silence compiler warnings

3504.	[func]		Add support for ACLs based on geographic location,
			using MaxMind GeoIP databases. Based on code
			contributed by Ken Brownfield <kb@slide.com>.
			[RT #30681]

3495.	[func]		Support multiple response-policy zones, while
			improving RPZ performance. [RT #32476]

                        dns_dlzcreate() failed to properly initialize
                        dlzdb.link.  When cloning a rdataset do not copy
                        the link contents.  [RT #32651]

Squashed commit of the following:

commit c36c49cbdaeec8b2506dffadbffa543283702fa2
Author: Mark Andrews <marka@isc.org>
Date:   Mon Feb 18 23:24:57 2013 +1100

    don't copy the link when cloning a rdataset

commit 9fef5827edcc925075832dcce900eeca9057456d
Author: Mark Andrews <marka@isc.org>
Date:   Mon Feb 18 23:23:25 2013 +1100

    initialise the dlzdb link; don't return a stale pointer on error

commit a13c584732eae2dde48920a73886b54f1fe6b030
Author: Mark Andrews <marka@isc.org>
Date:   Mon Feb 18 23:21:59 2013 +1100

    turn on ISC_LIST_CHECKINIT