GitLab

3741.	[func]		"delve" (domain entity lookup and validation engine):
			A new tool with dig-like semantics for performing DNS
			lookups, with internal DNSSEC validation, using the
			same resolver and validator logic as named. This
			allows easy validation of DNSSEC data in environments
			with untrustworthy resolvers, and assists with
			troubleshooting of DNSSEC problems. (Note: not yet
			available on win32.) [RT #32406]

3740.	[contrib]	Minor fixes to configure --with-dlz-bdb,
			--with-dlz-postgres and --with-dlz-odbc. [RT #35340]

3735.	[cleanup]	Merged the libiscpk11 library into libisc
			to simplify dependencies. [RT #35205]

3733.   [func]          Improve interface scanning support.  Interface
                        information will be automatically updated if the
                        OS supports routing sockets (MacOS, *BSD, Linux).
                        Use "automatic-interface-scan no;" to disable.

                        Add "rndc scan" to trigger a scan. [RT #23027]

                        information will be automatically updated if the
                        OS supports routing sockets.  Use
                        "automatic-interface-scan no;" to disable.

                        Add "rndc scan" to trigger a scan. [RT #23027]

3725.	[contrib]	Updated zkt and nslint to newest versions,
			cleaned up and rearranged the contrib
			directory, added a README.

3722.	[bug]		Using geoip ACLs in a blackhole statement
			could cause a segfault. [RT #35272]

    see RT #35423 for details; highlights:
    - remove license clauses 3 and 4 from NetBSD code
    - remove advertising clause from historical BSD code
    - add openssl advertising attributions

3714.	[test]		System tests that need to test for cryptography
			support before running can now use a common
			"testcrypto.sh" script to do so. [RT #35213]

3705.	[func]		"configure --enable-native-pkcs11" enables BIND
			to use the PKCS#11 API for all cryptographic
			functions, so that it can drive a hardware service
			module directly without the need to use a modified
			OpenSSL as intermediary (so long as the HSM's vendor
			provides a complete-enough implementation of the
			PKCS#11 interface). This has been tested successfully
			with the Thales nShield HSM and with SoftHSMv2 from
			the OpenDNSSEC project. [RT #29031]

                        information for their extensions in the version
                        file by setting the EXTENSIONS variable.

                        [RT #34856]

                        when libcap-devel is installed. [RT #34838]

only generate DSA/ECDSA signatures in named if we have a source of randomness and only on specific platforms

3648.	[test]		Updated the ATF test framework to version 0.17.
			[RT #25627]

                        when building from a git repository. [RT #20422]

                        the json library. [RT #34449]

3615.	[cleanup]	"configure" now finishes by printing a summary
			of optional BIND features and whether they are
			active or inactive. ("configure --enable-full-report"
			increases the verbosity of the summary.) [RT #31777]

3614.	[port]		Check for <linux/types.h>. [RT #34162]

3512.	[port]		Check whether to use -ljson or -ljson-c. [RT #34115]

3611.	[bug]		Improved resistance to a theoretical authentication
			attack based on differential timing.  [RT #33939]

3572.	[func]		Threads are now enabled by default on most
			operating systems. [RT #25483]

3568.	[cleanup]	Add a product description line to the version file,
			to be reported by named -v/-V. [RT #33366]

3550.	[func]		Unified the internal and export versions of the
			BIND libraries, allowing external clients to use
			the same libraries as BIND. [RT #33131]

3528.	[func]		New "dnssec-coverage" command scans the timing
			metadata for a set of DNSSEC keys and reports if a
			lapse in signing coverage has been scheduled
			inadvertently. (Note: This tool depends on python;
			it will not be built or installed on systems that
			do not have a python interpreter.) [RT #28098]