prep 9.9.13

See merge request !468

fix Atffile/Kyuafile

See merge request !457

prep 9.9.13rc2

See merge request !453

Fix handling of large journal entries.

See merge request !448

(cherry picked from commit 2aee33f4)
(cherry picked from commit 470b8612)

(cherry picked from commit 65bf99c8)

Witold Krecicki authored Jun 27, 2018 and Evan Hunt committed Jun 27, 2018

(cherry picked from commit b1254430)
(cherry picked from commit e92d5421)

Witold Krecicki authored Jun 26, 2018 and Evan Hunt committed Jun 27, 2018

(cherry picked from commit 0db7130f)
(cherry picked from commit 1919f5c9)

Resolve "Missing dereference in REQUIRE statement?"

See merge request !443

(cherry picked from commit f1ee5e4a)

[v9_9] Only request permitted capabilities in non-libcap builds

See merge request !420

4979.	[bug]		Non-libcap builds were not checking whether all
			requested capabilities are present in the permitted
			capability set. [GL #321]

(cherry picked from commit 731b0038)

While libcap-enabled builds check whether any capability named requests
is within the permitted capability set, non-libcap builds just try
requesting them, which potentially causes a misleading error message to
be output ("Operation not permitted: please ensure that the capset
kernel module is loaded").  Ensure non-libcap builds also check whether
any requested capability is within the permitted capability set.

(cherry picked from commit 8c66f32e)

Resolve "Log the remaining -V info at startup"

Closes #247

See merge request !249

Resolve "casecompare of NINFO, TKEY, TXT have wrong return type"

See merge request !407

(cherry picked from commit 3ba1d1e4)

Merge v9.9.13rc1 release into v9_9 branch

See merge request !398

[v9_9] constify dns_rdata_tostruct

See merge request !383

Mark Andrews authored Jun 15, 2018 and Michał Kępień committed Jun 15, 2018

(cherry picked from commit abb2fd10)

Resolve "Recursion improperly allowed by default"

See merge request !376

[v9_9] Fix DNAME handling in DNSSEC tools

See merge request !366

4971.	[bug]		dnssec-signzone and dnssec-verify did not treat records
			below a DNAME as out-of-zone data. [GL #298]

(cherry picked from commit de5916a7)

Mark Andrews authored Jun 13, 2018 and Michał Kępień committed Jun 13, 2018

(cherry picked from commit ec75a070)

DNAME records indicate bottom of zone and thus no records below a DNAME
should be DNSSEC-signed or included in NSEC(3) chains.  Add a helper
function, has_dname(), for detecting DNAME records at a given node.
Prevent signing DNAME-obscured records.  Check that DNAME-obscured
records are not signed.

(cherry picked from commit 9a414516)

Resolve "v9_9 move lib/irs to lib/export/irs"

See merge request !359

(cherry picked from commit 74c3b9d3)