updated to ldns 1.6.12

Author: jelu

Changelog

@@ -1,14 +1,77 @@
-1.6.10
+1.6.12	2012-01-11
+	* bugfix #413: Fix manpage source for srcdir != builddir
+	* Canonicalize the signers name rdata field in RRSIGs when signing
+	* Ignore minor version of Private-key-format (so v1.3 may be used)
+	* Allow a check_time to be given in stead of always checking against
+	  the current time. With ldns-verify-zone the check_time can be set
+	  with the -t option.
+	* Added functions for updating and manipulating SOA serial numbers.
+	  ldns-read-zone has an option -S for updating and manipulating the
+	  serial numbers.
+	* The library Makefile is now GNU and BSD make compatible.
+	* bugfix #419: NSEC3 validation of a name covered by a wildcard with
+	  no data.
+	* Two new options (--with-drill and --with-examples) to the main
+	  configure script (in the root of the source tree) to build drill
+	  and examples too.
+	* Fix days_since_epoch to year_yday calculation on 32bits systems.
+
+1.6.11	2011-09-29
+	* bugfix #394: Fix socket leak on errors
+	* bugfix #392: Apex only and percentage checks for ldns-verify-zone
+	  (thanks Miek Gieben)
+	* bugfix #398: Allow NSEC RRSIGs before the NSEC3 in ldns-verify-zone
+	* Fix python site package path from sitelib to sitearch for pyldns.
+	* Fix python api to support python2 and python3 (thanks Karel Slany).
+	* bugfix #401: Correction of date/time functions algorithm and
+	  prevention of an infinite loop therein
+	* bugfix #402: Correct the minimum and maximum number of rdata fields
+	  in TSIG. (thanks David Keeler)
+	* bugfix #403: Fix heap overflow (thanks David Keeler)
+	* bugfix #404: Make parsing APL strings more robust
+	  (thanks David Keeler)
+	* bugfix #391: Complete library assessment to prevent assertion errors
+	  through ldns_rdf_size usage.
+	* Slightly more specific error messaging on wrong number of rdata
+	  fields with the LDNS_STATUS_MISSING_RDATA_FIELDS_RRSIG and
+	  LDNS_STATUS_MISSING_RDATA_FIELDS_KEY result codes.
+	* bugfix #406: More rigorous openssl result code handling to prevent
+	  future crashes within openssl.
+	* Fix ldns_fetch_valid_domain_keys to search deeper than just one level
+	  for a DNSKEY that signed a DS RR. (this function was used in the
+	  check_dnssec_trace nagios module)
+	* bugfix #407: Canonicalize TSIG dnames and algorithm fields
+	* A new output specifier to accommodate configuration of what to show
+	  in comment texts when converting host and/or wire-format data to
+	  string. All conversion to string and printing functions have a new
+	  version that have such a format specifier as an extra argument.
+	  The default is changed so that only DNSKEY RR's are annotated with
+	  an comment show the Key Tag of the DNSKEY.
+	* Fixed the ldns resolver to not mark a nameserver unreachable when
+	  edns0 is tried unsuccessfully with size 4096 (no return packet came),
+	  but to still try TCP. A big UDP packet might have been corrupted by
+	  fragments dropping firewalls.
+	* Update of libdns.vim (thanks Miek Gieben)
+	* Added the ldnsx Python module to our contrib section, which adds even
+	  more pythonisticism to the usage of ldns with  Python. (Many thanks
+	  to Christpher Olah and Paul Wouters)
+	  The ldnsx module is automatically installed when --with-pyldns is
+	  used with configuring, but may explicitly be excluded with the
+	  --without-pyldnsx option to configure.
+	* bugfix #410: Fix clearing out temporary data on stack in sha2.c
+	* bugfix #411: Don't let empty non-terminal NSEC3s cause assertion failure.
+
+1.6.10	2011-05-31
 	* New example tool added: ldns-gen-zone.
 	* bugfix #359: Serial-arithmetic for the inception and expiration
 	  fields of a RRSIG and correctly converting them to broken-out time
 	  information.
 	* bugfix #364: Slight performance increase of ldns-verifyzone.
 	* bugfix #367: Fix to allow glue records with the same name as the
 	  delegation.
-	* Fix ldns-verifyzone to allow NSEC3-less records for NS rrsets *and* 
+	* Fix ldns-verifyzone to allow NSEC3-less records for NS rrsets *and*
 	  glue when the zone is opt-out.
-	* bugfix #376: Adapt ldns_nsec3_salt, ldns_nsec3_iterations, 
+	* bugfix #376: Adapt ldns_nsec3_salt, ldns_nsec3_iterations,
 	  ldns_nsec3_flags and ldns_nsec3_algorithm to work for NSEC3PARAMS too.
 	* pyldns memory leaks fixed by Bedrich Kosata (at the cost of a bit
 	  performance)
@@ -46,7 +109,7 @@
 
 1.6.8	2011-01-24
 	* Fix ldns zone, so that $TTL definition match RFC 2308.
-	* Fix lots of missing checks on allocation failures and parse of 
+	* Fix lots of missing checks on allocation failures and parse of
 	  NSEC with many types and max parse length in hosts_frm_fp routine
 	  and off by one in read_anchor_file routine (thanks Dan Kaminsky and
 	  Justin Ferguson).
@@ -111,7 +174,7 @@
 	* Catch \X where X is a digit as an error.
 	* Fix segfault when ip6 ldns resolver only has ip4 servers.
 	* Fix NSEC record after DNSKEY at zone apex not properly signed.
-	* Fix syntax error if last label too long and no dot at end of domain. 
+	* Fix syntax error if last label too long and no dot at end of domain.
 	* Fix parse of \# syntax with space for type LOC.
 	* Fix ldns_dname_absolute for escape sequences, fixes some parse errs.
 	* bugfix #297: linking ssl, bug due to patch submitted as #296.
@@ -240,15 +303,15 @@
 	  the SEP flag
 	* ldns-signzone now equalizes the TTL of the DNSKEY RRset (to
 	  the first non-default DNSKEY TTL value it sees)
-	
+
 1.5.1
 	Example tools:
 	* ldns-signzone was broken in 1.5.0 for multiple keys, this
-          has been repaired
+	  has been repaired
 
 	Build system:
-        * Removed a small erroneous output warning in
-          examples/configure and drill/configure
+	* Removed a small erroneous output warning in
+	  examples/configure and drill/configure
 
 1.5.0
 	Bug fixes:
@@ -265,7 +328,7 @@
 	* ldns_key now has support for 'external' data, in which
 	  case the OpenSSL EVP structures are not used;
 	  ldns_key_set_external_key() and ldns_key_external_key()
-	* added ldns_key_get_file_base_name() which creates a 
+	* added ldns_key_get_file_base_name() which creates a
 	  'default' filename base string for key storage, of the
 	  form "K<zone>+<algorithm>+<keytag>"
 	* the ldns_dnssec_* family of structures now have deep_free()
@@ -283,9 +346,9 @@
 	* added new example tool: ldns-nsec3-hash
 	* ldns-dpa can now filter on specific query name and types
 	* ldnsd has fixes for the zone name, a fix for the return
-          value of recvfrom(), and an memory initialization fix
-          (Thanks to Colm MacCárthaigh for the patch)
-        * Fixed memory leaks in ldnsd
+	  value of recvfrom(), and an memory initialization fix
+	  (Thanks to Colm MacCárthaigh for the patch)
+	* Fixed memory leaks in ldnsd
 
 
 
@@ -296,12 +359,12 @@
 	* NSEC3 optout flag now correctly printed in string output
 	* inttypes.h moved to configured inclusion
 	* fixed NSEC3 type bitmaps for empty nonterminals and unsigned
-	  delegations 
+	  delegations
 
 	API addition:
 	* for that last fix, we added a new function
 	  ldns_dname_add_from() that can clone parts of a dname
-	
+
 1.4.0
 	Bug fixes:
 	* sig chase return code fix (patch from Rafael Justo, bug id 189)
@@ -319,7 +382,7 @@
 	* Fixed a bug concerning whitespace in zone data (with patch from Ondrej
 	  Sury, bug 213)
 	* Fixed a small fallback problem in axfr client code
-	
+
 	API CHANGES:
 	* added 2str convenience functions:
 		- ldns_rr_type2str
@@ -339,7 +402,7 @@
 	* TCP fallback system has been improved
 	* HMAC-SHA256 TSIG support has been added.
 	* TTLS are now correcly set in NSEC(3) records when signing zones
-	
+
 	EXAMPLE TOOLS:
 	* New example: ldns-revoke to revoke DNSKEYs according to RFC5011
 	* ldns-testpkts has been fixed and updated
@@ -409,7 +472,7 @@
 	Contrib:
 	* new contrib/ dir with user contributions
 	* added compilation script for solaris (thanks to Jakob Schlyter)
-	
+
 28 Nov 2007 1.2.2:
 	* Added support for HMAC-MD5 keys in generator
 	* Added a new example tool (written by Ondrej Sury): ldns-compare-zones
@@ -432,7 +495,7 @@
 
 11 Apr 2007 1.2.0:
 	* canonicalization of rdata in DNSSEC functions now adheres to the
-          rr type list in rfc3597, not rfc4035, which will be updated
+	  rr type list in rfc3597, not rfc4035, which will be updated
 	  (see http://www.ops.ietf.org/lists/namedroppers/namedroppers.2007/msg00183.html)
 	* ldns-walk now support dnames with maximum label length
 	* ldnsd now takes an extra argument containing the address to listen on
@@ -476,36 +539,36 @@
 	  platform; some gnuism were identified and fixed.
 	* The ldns_zone structure was stress tested. The current setup
 	 (ie. just a list of rrs) can scale to zone file in order of
-  	  megabytes. Sorting such zone is still difficult.
+	  megabytes. Sorting such zone is still difficult.
 	* Reading multiline b64 encoded rdata works.
 	* OpenSSL was made optional, configure --without-ssl.
 	  Ofcourse all dnssec/tsig related functions are disabled
 	* Building of examples and drill now happens with the same
 	  defines as the building of ldns itself.
 	* Preliminary sha-256 support was added. Currently is your
-     	  OpenSSL supports it, it is supported in the DS creation.
+	  OpenSSL supports it, it is supported in the DS creation.
 	* ldns_resolver_search was implemented
 	* Fixed a lot of bugs
 
 	Drill:
-	* -r was killed in favor of -o <header bit mnemonic> which 
+	* -r was killed in favor of -o <header bit mnemonic> which
 	  allows for a header bits setting (and maybe more in the
 	  future)
 	* DNSSEC is never automaticaly set, even when you query
 	  for DNSKEY/RRSIG or DS.
 	* Implement a crude RTT check, it now distinguishes between
 	  reachable and unreachable.
-        * A form of secure tracing was added
-        * Secure Chasing has been improved
+	* A form of secure tracing was added
+	* Secure Chasing has been improved
 	* -x does a reverse lookup for the given IP address
-	
+
 	Examples:
 	* ldns-dpa was added to the examples - this is the Dns Packet
 	  Analyzer tool.
 	* ldnsd - as very, very simple nameserver impl.
 	* ldns-zsplit - split zones for parrallel signing
 	* ldns-zcat - cat split zones back together
-        * ldns-keyfetcher - Fetches DNSKEY records with a few (non-strong, 
+	* ldns-keyfetcher - Fetches DNSKEY records with a few (non-strong,
 	  non-DNSSEC) anti-spoofing techniques.
 	* ldns-walk - 'Walks' a DNSSEC signed zone
 	* Added an all-static target to the makefile so you can use examples
@@ -516,26 +579,26 @@
 	Code:
 	* All networking code was moved to net.c
 	* rdata.c: added asserts to the rdf set/get functions
-	* const keyword was added to pointer arguments that 
+	* const keyword was added to pointer arguments that
 	  aren't changed
 
 	API:
 	Changed:
 	* renamed ldns/dns.h to ldns/ldns.h
 	* ldns_rr_new_frm_str() is extented with an extra variable which
 	  in common use may be NULL. This trickles through to:
-          o ldns_rr_new_frm_fp
+	  o ldns_rr_new_frm_fp
 	  o ldns_rr_new_frm_fp_l
 	  Which also get an extra variable
 	  Also the function has been changed to return a status message.
 	  The compiled RR is returned in the first argument.
 	* ldns_zone_new_frm_fp_l()  and ldns_zone_new_frm_fp() are
-          changed to return a status msg.
+	  changed to return a status msg.
 	* ldns_key_new_frm_fp is changed to return ldns_status and
 	  the actual key list in the first argument
 	* ldns_rdata_new_frm_fp[_l]() are changed to return a status.
 	  the rdf is return in the first argument
-        * ldns_resolver_new_frm_fp: same treatment: return status and 
+	* ldns_resolver_new_frm_fp: same treatment: return status and
 	  the new resolver in the first argument
 	* ldns_pkt_query_new_frm_str(): same: return status and the
 	  packet in the first arg
@@ -552,7 +615,7 @@
 	* ldns_pkt_empty(): check is a packet is empty
 	* ldns_rr_list_pop_rr_list(): pop multiple rr's from another rr_list
 	* ldns_rr_list_push_rr_list(): push multiple rr's to an rr_list
-        * ldns_rr_list_compare(): compare 2 ldns_rr_lists
+	* ldns_rr_list_compare(): compare 2 ldns_rr_lists
 	* ldns_pkt_push_rr_list: rr_list equiv for rr
 	* ldns_pkt_safe_push_rr_list: rr_list equiv for rr
 	Removed:
@@ -594,9 +657,9 @@
 	* Usual fixes in documentation and code
 
 13 Jun 2005: 0.65: ldns-team
-	* Repository is online at: 
+	* Repository is online at:
 	  http://www.nlnetlabs.nl/ldns/svn/
-	* Apply reference copying throuhgout ldns, except in 2 
+	* Apply reference copying throuhgout ldns, except in 2
 	  places in the ldns_resolver structure (._domain and
 	 ._nameservers)
 	* Usual array of bugfixes
@@ -608,7 +671,7 @@
 	  (you're not supposed to include that in a libary)
 	* Further tweaking
 	  - DNSSEC signing/verification works
-	  - Assorted bug fixes and tweaks (memory management) 
+	  - Assorted bug fixes and tweaks (memory management)
 
 May 2005: 0.50: ldns-team
 	* First usable release