GitLab

Reject incorrect RSA key lengths during key generation and and sign/verify context creation (#45043)

                        the specific PKCS11 providers capabilities. [RT #42458]

                        argument's const status. [RT #41150]

4183.	[cleanup]	Use timing-safe memory comparisons in cryptographic
			code. Also, the timing-safe comparison functions have
			been renamed to avoid possible confusion with
			memcmp(). [RT #40148]

4168.	[security]	A buffer accounting error could trigger an
			assertion failure when parsing certain malformed
			DNSSEC keys. (CVE-2015-5722) [RT #40212]

3723.	[cleanup]	Imported keys are now handled the same way
			regardless of DNSSEC algorithm. [RT #35215]

3705.	[func]		"configure --enable-native-pkcs11" enables BIND
			to use the PKCS#11 API for all cryptographic
			functions, so that it can drive a hardware service
			module directly without the need to use a modified
			OpenSSL as intermediary (so long as the HSM's vendor
			provides a complete-enough implementation of the
			PKCS#11 interface). This has been tested successfully
			with the Thales nShield HSM and with SoftHSMv2 from
			the OpenDNSSEC project. [RT #29031]

3698.	[cleanup]	Replaced all uses of memcpy() with memmove().
			[RT #35120]

                        into the DNSKEY management framework.  A new tool
                        dnssec-importkey is used to this. [RT #34698]

3402.	[bug]		Correct interface numbers for IPv4 and IPv6 interfaces.

3339.   [func]          Allow the maximum supported rsa exponent size to be                        specified: "max-rsa-exponent-size <value>;" [RT #29228]

                        support. [RT #23473]

                        across restarts of named.  Initially this is for
                        TSIG keys generated using GSSAPI. [RT #22639]

                        test. [RT #20453]