bind9 and bind 9.16.1

[Bruce Dubbs]

New point version.

[Bruce Dubbs]

--- 9.16.1 released ---

• Fix a race condition with the keymgr when the same zone plus dnssec-policy is configured in multiple views.

• Algorithm rollover was stuck on submitting DS because keymgr thought it would move to an invalid state. Fixed by checking the current key against the desired state, not the existing state.

• Algorithm rollover waited too long before introducing zone signatures. It waited to make sure all signatures were regenerated, but when introducing a new algorithm, all signatures are regenerated immediately. Only add the sign delay if there is a predecessor key.

• When changing a dnssec-policy, existing keys with properties that no longer match were not being retired.

• named might not accept new connections after hitting tcp-clients quota.

• delv could fail to load trust anchors in DNSKEY format.

• Inline master zones whose master files were touched but otherwise unchanged and were subsequently reloaded may have stopped re-signing.

• Newly added RRSIG records with expiry times before the previous earliest expiry times might not be re-signed in time.

[Bruce Dubbs]

Fixed at revision 22867.

[Bruce Dubbs]

Milestone renamed

[Bruce Dubbs]

Milestone renamed