* fixed SSL in chroot environment (bnc#715881)

* Added a new include file with function typedefs for the DLZ
  "dlopen" driver. [RT #23629]
* Added a tool able to generate malformed packets to allow testing of
  how named handles them. [RT #24096]
* The root key is now provided in the file bind.keys allowing DNSSEC
  validation to be switched on at start up by adding
  "dnssec-validation auto;" to named.conf. If the root key provided
  has expired, named will log the expiration and validation will not
  work. More information and the most current copy of bind.keys can
  be found at http://www.isc.org/bind-keys. *Please note this feature
  was actually added in 9.8.0 but was not included in the 9.8.0
  release notes. [RT #21727]
* If named is configured with a response policy zone (RPZ) and a
  query of type RRSIG is received for a name configured for RRset
  replacement in that RPZ, it will trigger an INSIST and crash the
  server. RRSIG. [RT #24280]
* named, set up to be a caching resolver, is vulnerable to a user
  querying a domain with very large resource record sets (RRSets)
  when trying to negatively cache the response. Due to an off-by-one
  error, caching the response could cause named to crash. [RT #24650]
  [CVE-2011-1910]
* Using Response Policy Zone (RPZ) to query a wildcard CNAME label
  with QUERY type SIG/RRSIG, it can cause named to crash. Fix is
  query type independant. [RT #24715]
* Using Response Policy Zone (RPZ) with DNAME records and querying
  the subdomain of that label can cause named to crash. Now logs that
  DNAME is not supported. [RT #24766]
* Change #2912 populated the message section in replies to UPDATE

• Files Changed
• Browse Source