diff --git a/contrib/bind9/CHANGES b/contrib/bind9/CHANGES
index cb2581a44b39..a44c804076ba 100644
--- a/contrib/bind9/CHANGES
+++ b/contrib/bind9/CHANGES
@@ -1,3 +1,55 @@
+
+ --- 9.6-ESV-R3 released ---
+
+2972. [bug] win32: address windows socket errors. [RT #21906]
+
+2971. [bug] Fixed a bug that caused journal files not to be
+ compacted on Windows systems as a result of
+ non-POSIX-compliant rename() semantics. [RT #22434]
+
+2970. [security] Adding a NO DATA negative cache entry failed to clear
+ any matching RRSIG records. A subsequent lookup of
+ of NO DATA cache entry could trigger a INSIST when the
+ unexpected RRSIG was also returned with the NO DATA
+ cache entry.
+
+ CVE-2010-3613, VU#706148. [RT #22288]
+
+2969. [security] Fix acl type processing so that allow-query works
+ in options and view statements. Also add a new
+ set of tests to verify proper functioning.
+
+ CVE-2010-3615, VU#510208. [RT #22418]
+
+2968. [security] Named could fail to prove a data set was insecure
+ before marking it as insecure. One set of conditions
+ that can trigger this occurs naturally when rolling
+ DNSKEY algorithms.
+
+ CVE-2010-3614, VU#837744. [RT #22309]
+
+2967. [bug] 'host -D' now turns on debugging messages earlier.
+ [RT #22361]
+
+2966. [bug] isc_print_vsnprintf() failed to check if there was
+ space available in the buffer when adding a left
+ justified character with a non zero width,
+ (e.g. "%-1c"). [RT #22270]
+
+2964. [bug] view->queryacl was being overloaded. Seperate the
+ usage into view->queryacl, view->cacheacl and
+ view->queryonacl. [RT #22114]
+
+2962. [port] win32: add more dependencies to BINDBuild.dsw.
+ [RT #22062]
+
+2952. [port] win32: named-checkzone and named-checkconf failed
+ to initialise winsock. [RT #21932]
+
+2951. [bug] named failed to generate a correct signed response
+ in a optout, delegation only zone with no secure
+ delegations. [RT #22007]
+
--- 9.6-ESV-R2 released ---
2939. [func] Check that named successfully skips NSEC3 records
diff --git a/contrib/bind9/RELEASE-NOTES-BIND-9.6-ESV.html b/contrib/bind9/RELEASE-NOTES-BIND-9.6-ESV.html
new file mode 100644
index 000000000000..946330dfd57c
--- /dev/null
+++ b/contrib/bind9/RELEASE-NOTES-BIND-9.6-ESV.html
@@ -0,0 +1,225 @@
+
+
+
+
+
+
+
+
+
+
+
+ BIND 9.6-ESV-R3 is a maintenance release for BIND 9.6-ESV.
+
+
+ This document summarizes changes from BIND 9.6-ESV-R1 to BIND 9.6-ESV-R3.
+ Please see the CHANGES file in the source code release for a
+ complete list of all changes.
+
+
+
+
+
+
+ The latest release of BIND 9 software can always be found
+ on our web site at
+ http://www.isc.org/software/bind.
+ There you will find additional information about each release,
+ source code, and some pre-compiled versions for certain operating
+ systems.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
+ Adding a NO DATA signed negative response to cache failed to clear
+ any matching RRSIG records already in cache. A subsequent lookup
+ of the cached NO DATA entry could crash named (INSIST) when the
+ unexpected RRSIG was also returned with the NO DATA cache entry.
+ [RT #22288] [CVE-2010-3613] [VU#706148]
+
-
+ BIND, acting as a DNSSEC validator, was determining if the NS RRset
+ is insecure based on a value that could mean either that the RRset
+ is actually insecure or that there wasn't a matching key for the RRSIG
+ in the DNSKEY RRset when resuming from validating the DNSKEY RRset.
+ This can happen when in the middle of a DNSKEY algorithm rollover,
+ when two different algorithms were used to sign a zone but only the
+ new set of keys are in the zone DNSKEY RRset.
+ [RT #22309] [CVE-2010-3614] [VU#837744]
+
+
+
+
+
+
+
+
+
-
+ Check that named successfully skips NSEC3 records
+ that fail to match the NSEC3PARAM record currently
+ in use.
+ [RT #21868]
+
-
+ Worked around a race condition in the cache database memory
+ handling. Without this fix a DNS cache DB or ADB could
+ incorrectly stay in an over memory state, effectively refusing
+ further caching, which subsequently made a BIND 9 caching
+ server unworkable.
+ [RT #21818]
+
-
+ BIND did not properly handle non-cacheable negative responses
+ from insecure zones. This caused several non-protocol-compliant
+ zones to become unresolvable. BIND is now more accepting of
+ responses it receives from less strict servers.
+ [RT #21555]
+
-
+ The resolver could attempt to destroy a fetch context too
+ soon, resulting in a crash.
+ [RT #19878]
+
-
+ The placeholder negative caching element was not
+ properly constructed triggering a crash (INSIST) in
+ dns_ncache_towire().
+ [RT #21346]
+
-
+ Handle the introduction of new trusted-keys and
+ DS, DLV RRsets better.
+ [RT #21097]
+
-
+ Fix arguments to dns_keytable_findnextkeynode() call.
+ [RT #20877]
+
+
+
+
+
-
+ Microsoft changed the behavior of sockets between NT/XP based
+ stacks vs Vista/windows7 stacks. Server 2003/2008 have the older
+ behavior, 2008r2 has the new behavior. With the change, different
+ error results are possible, so ISC adapted BIND to handle the new
+ error results.
+ This resolves an issue where sockets would shut down on
+ Windows servers causing named to stop responding to queries.
+ [RT #21906]
+
-
+ Windows has non-POSIX compliant behavior in its rename() and unlink()
+ calls. This caused journal compaction to fail on Windows BIND servers
+ with the log error: "dns_journal_compact failed: failure".
+ [RT #22434]
+
-
+ 'host -D' now turns on debugging messages earlier.
+ [RT #22361]
+
-
+ isc_print_vsnprintf() failed to check if there was
+ space available in the buffer when adding a left
+ justified character with a non zero width,
+ (e.g. "%-1c").
+ [RT #22270]
+
-
+ view->queryacl was being overloaded. Seperate the
+ usage into view->queryacl, view->cacheacl and
+ view->queryonacl.
+ [RT #22114]
+
-
+ win32: add more dependencies to BINDBuild.dsw.
+ [RT #22062]
+
-
+ win32: named-checkzone and named-checkconf failed
+ to initialise winsock.
+ [RT #21932]
+
-
+ named failed to generate a correct signed response
+ in a optout, delegation only zone with no secure
+ delegations.
+ [RT #22007]
+
+
+
+
+
Known issues in this release
+
+
-
+
+ "make test" will fail on OSX and possibly other operating systems.
+ The failure occurs in a new test to check for allow-query ACLs.
+ The failure is caused because the source address is not specified on
+ the dig commands issued in the test.
+
+
+ If running "make test" is part of your usual acceptance process,
+ please edit the file bin/tests/system/allow_query/test.sh
+ and add
+
+ -b 10.53.0.2
+
+ to the DIGOPTS
line.
+
+
+
+
+
+
+
+ Thank you to everyone who assisted us in making this release possible.
+ If you would like to contribute to ISC to assist us in continuing to make
+ quality open source software, please visit our donations page at
+ http://www.isc.org/supportisc.
+
+
+
diff --git a/contrib/bind9/RELEASE-NOTES-BIND-9.6-ESV.pdf b/contrib/bind9/RELEASE-NOTES-BIND-9.6-ESV.pdf
new file mode 100644
index 000000000000..60fa9fa0f166
Binary files /dev/null and b/contrib/bind9/RELEASE-NOTES-BIND-9.6-ESV.pdf differ
diff --git a/contrib/bind9/RELEASE-NOTES-BIND-9.6-ESV.txt b/contrib/bind9/RELEASE-NOTES-BIND-9.6-ESV.txt
new file mode 100644
index 000000000000..028c16dcdbb7
--- /dev/null
+++ b/contrib/bind9/RELEASE-NOTES-BIND-9.6-ESV.txt
@@ -0,0 +1,133 @@
+ __________________________________________________________________
+
+Introduction
+
+ BIND 9.6-ESV-R3 is a maintenance release for BIND 9.6-ESV.
+
+ This document summarizes changes from BIND 9.6-ESV-R1 to BIND
+ 9.6-ESV-R3. Please see the CHANGES file in the source code release for
+ a complete list of all changes.
+
+Download
+
+ The latest release of BIND 9 software can always be found on our web
+ site at http://www.isc.org/software/bind. There you will find
+ additional information about each release, source code, and some
+ pre-compiled versions for certain operating systems.
+
+Support
+
+ Product support information is available on
+ http://www.isc.org/services/support for paid support options. Free
+ support is provided by our user community via a mailing list.
+ Information on all public email lists is available at
+ https://lists.isc.org/mailman/listinfo.
+
+New Features
+
+9.6-ESV-R2
+
+ None.
+
+9.6-ESV-R3
+
+ None.
+
+Feature Changes
+
+9.6-ESV-R2
+
+ None.
+
+9.6-ESV-R3
+
+ None.
+
+Security Fixes
+
+9.6-ESV-R2
+
+ None.
+
+9.6-ESV-R3
+
+ * Adding a NO DATA signed negative response to cache failed to clear
+ any matching RRSIG records already in cache. A subsequent lookup of
+ the cached NO DATA entry could crash named (INSIST) when the
+ unexpected RRSIG was also returned with the NO DATA cache entry.
+ [RT #22288] [CVE-2010-3613] [VU#706148]
+ * BIND, acting as a DNSSEC validator, was determining if the NS RRset
+ is insecure based on a value that could mean either that the RRset
+ is actually insecure or that there wasn't a matching key for the
+ RRSIG in the DNSKEY RRset when resuming from validating the DNSKEY
+ RRset. This can happen when in the middle of a DNSKEY algorithm
+ rollover, when two different algorithms were used to sign a zone
+ but only the new set of keys are in the zone DNSKEY RRset. [RT
+ #22309] [CVE-2010-3614] [VU#837744]
+
+Bug Fixes
+
+9.6-ESV-R2
+
+ * Check that named successfully skips NSEC3 records that fail to
+ match the NSEC3PARAM record currently in use. [RT #21868]
+ * Worked around a race condition in the cache database memory
+ handling. Without this fix a DNS cache DB or ADB could incorrectly
+ stay in an over memory state, effectively refusing further caching,
+ which subsequently made a BIND 9 caching server unworkable. [RT
+ #21818]
+ * BIND did not properly handle non-cacheable negative responses from
+ insecure zones. This caused several non-protocol-compliant zones to
+ become unresolvable. BIND is now more accepting of responses it
+ receives from less strict servers. [RT #21555]
+ * The resolver could attempt to destroy a fetch context too soon,
+ resulting in a crash. [RT #19878]
+ * The placeholder negative caching element was not properly
+ constructed triggering a crash (INSIST) in dns_ncache_towire(). [RT
+ #21346]
+ * Handle the introduction of new trusted-keys and DS, DLV RRsets
+ better. [RT #21097]
+ * Fix arguments to dns_keytable_findnextkeynode() call. [RT #20877]
+
+9.6-ESV-R3
+
+ * Microsoft changed the behavior of sockets between NT/XP based
+ stacks vs Vista/windows7 stacks. Server 2003/2008 have the older
+ behavior, 2008r2 has the new behavior. With the change, different
+ error results are possible, so ISC adapted BIND to handle the new
+ error results. This resolves an issue where sockets would shut down
+ on Windows servers causing named to stop responding to queries. [RT
+ #21906]
+ * Windows has non-POSIX compliant behavior in its rename() and
+ unlink() calls. This caused journal compaction to fail on Windows
+ BIND servers with the log error: "dns_journal_compact failed:
+ failure". [RT #22434]
+ * 'host -D' now turns on debugging messages earlier. [RT #22361]
+ * isc_print_vsnprintf() failed to check if there was space available
+ in the buffer when adding a left justified character with a non
+ zero width, (e.g. "%-1c"). [RT #22270]
+ * view->queryacl was being overloaded. Seperate the usage into
+ view->queryacl, view->cacheacl and view->queryonacl. [RT #22114]
+ * win32: add more dependencies to BINDBuild.dsw. [RT #22062]
+ * win32: named-checkzone and named-checkconf failed to initialise
+ winsock. [RT #21932]
+ * named failed to generate a correct signed response in a optout,
+ delegation only zone with no secure delegations. [RT #22007]
+
+Known issues in this release
+
+ * "make test" will fail on OSX and possibly other operating systems.
+ The failure occurs in a new test to check for allow-query ACLs. The
+ failure is caused because the source address is not specified on
+ the dig commands issued in the test.
+ If running "make test" is part of your usual acceptance process,
+ please edit the file bin/tests/system/allow_query/test.sh and add
+ -b 10.53.0.2
+ to the DIGOPTS line.
+
+Thank You
+
+ Thank you to everyone who assisted us in making this release possible.
+ If you would like to contribute to ISC to assist us in continuing to
+ make quality open source software, please visit our donations page at
+ http://www.isc.org/supportisc.
diff --git a/contrib/bind9/bin/check/check-tool.c b/contrib/bind9/bin/check/check-tool.c
index e0a7208f3788..396f10520cf4 100644
--- a/contrib/bind9/bin/check/check-tool.c
+++ b/contrib/bind9/bin/check/check-tool.c
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2004-2009 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2010 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 2000-2002 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: check-tool.c,v 1.35.36.3 2009/01/20 02:03:18 marka Exp $ */
+/* $Id: check-tool.c,v 1.35.36.3.24.2 2010/09/07 23:46:25 tbox Exp $ */
/*! \file */
@@ -23,6 +23,10 @@
#include