response is a more RFC conformant FORMERR, since the EDNS
option is malformed. Also fix to have an EDNS size for
the reply error encoding for failed EDNS parse of the query.
Thanks to Qifan Zhang, Palo Alto Networks, for the report.
udpsize, the reply is truncated with TC and fix for the
rcode in that short reply to be a sensible rcode.
Thanks to Qifan Zhang, Palo Alto Networks, for the report.
zonefile input. If it can not be parsed it is leniently
accepted, much like as a secondary it leniently accepts it.
Thanks to Qifan Zhang, Palo Alto Networks, for the report.
this stops negative cache overdeletion. It also contrains
the hash label length and checks if the NSEC nextowner
is valid. Thanks to Yuqi Qiu & Xiang Li (Nankai University,
AOSP Lab).
support.
- Fix to use sha256 for unbound-anchor unit test.
- Fix unbound-anchor check for return value of
X509_NAME_get_text_by_NID of the emailaddress.
respip instead of original A records. Adds local-zone types
block_a_wdata and block_aaaa_wdata, that are like block_a
and block_aaaa, and uses local-data if present.
records with overreaching next owner name. Also the result
is not above the trust anchor's bailiwick. Also RRSIGS are
not considered valid when an NSEC next owner name is not
under the signer zone name. Thanks to Qifan Zhang, Palo
Alto Networks, for the report.
the TTL of A/AAAA records disallowing a one-time 'ghost domain'
delegation renewal via glue records. Thanks to Qifan Zhang, Palo
Alto Networks, for the report.
transfer task cleans the chunk list. Also fix the
auth_transfer_limit test to use a forwarder for each type
of failure, so the one is not blocked by the other waiting.
similarity with other file. The ipsecmod is changed for
exec of the hook. The ipsecmod hook, if a script, has to
start now with a line like `#!/bin/sh`. Thanks to Qifan
Zhang, Palo Alto Networks, for the report.
lookups are in progress, for a primary name. Also after the
change, it no longer picks up the old results. Thanks to
Qifan Zhang, Palo Alto Networks, for the report.
limit auth-zone and rpz transfer amount and time taken.
Default is disabled. This hardens against unbounded
transfers. Thanks to Qifan Zhang, Palo Alto Networks,
for the report.
a heap use-after-free. That could happen if at least two
distinct classes are configured for resolution. Thanks
to Qifan Zhang, Palo Alto Networks for the report.
In addition, thanks to Xin Wang, Jiapeng Li, and Jiajia
Liu, Northwestern Polytechnical University, for also
reporting this.
W.C.A. Wijngaards