diff --git a/CHANGES b/CHANGES
index d34cc8b978..2f4f972fc7 100644
--- a/CHANGES
+++ b/CHANGES
@@ -6,9 +6,15 @@
readability and allow correct parsing of YAML
output. [GL #1226]
-5299. [placeholder]
+ --- 9.15.5 released ---
-5298. [placeholder]
+5299. [security] A flaw in DNSSEC verification when transferring
+ mirror zones could allow data to be incorrectly
+ marked valid. (CVE-2019-6475) [GL #1252]
+
+5298. [security] Named could assert if a forwarder returned a
+ referral, rather than resolving the query, when QNAME
+ minimization was enabled. (CVE-2019-6476) [GL #1051]
5297. [bug] Check whether a previous QNAME minimization fetch
is still running before starting a new one; return
@@ -39,7 +45,7 @@
5289. [bug] Address NULL pointer dereference in rpz.c:rpz_detach.
[GL #1210]
-5288. [bug] dnssec-must-be-secure was not always honoured.
+5288. [bug] dnssec-must-be-secure was not always honored.
[GL #1209]
5287. [placeholder]
@@ -116,7 +122,7 @@
5268. [placeholder]
-5267. [func] Allow statistics groups display to be toggleable.
+5267. [func] Allow statistics groups display to be toggle-able.
[GL #1030]
5266. [bug] named-checkconf failed to report dnstap-output
@@ -224,7 +230,7 @@
code in a high-load cold-cache resolver scenario.
[GL #943]
-5242. [bug] In relaxed qname minimizatiom mode, fall back to
+5242. [bug] In relaxed qname minimization mode, fall back to
normal resolution when encountering a lame
delegation, and use _.domain/A queries rather
than domain/NS. [GL #1055]
diff --git a/bin/tests/system/forward/ns1/named.conf.in b/bin/tests/system/forward/ns1/named.conf.in
index 462b7378c0..282e76bb64 100644
--- a/bin/tests/system/forward/ns1/named.conf.in
+++ b/bin/tests/system/forward/ns1/named.conf.in
@@ -51,6 +51,11 @@ zone "example5." {
file "example.db";
};
+zone "sld.tld" {
+ type master;
+ file "sld.tld.db";
+};
+
/* A forward zone without forwarders. */
zone "example6" {
type forward;
diff --git a/bin/tests/system/forward/ns1/sld.tld.db b/bin/tests/system/forward/ns1/sld.tld.db
new file mode 100644
index 0000000000..5fab37aae7
--- /dev/null
+++ b/bin/tests/system/forward/ns1/sld.tld.db
@@ -0,0 +1,11 @@
+$TTL 300 ; 5 minutes
+@ IN SOA ns root (
+ 2000082401 ; serial
+ 1800 ; refresh (30 minutes)
+ 1800 ; retry (30 minutes)
+ 1814400 ; expire (3 weeks)
+ 3600 ; minimum (1 hour)
+ )
+ NS ns
+ns A 10.53.0.1
+xxx TXT "foo"
diff --git a/bin/tests/system/forward/ns2/named.conf.in b/bin/tests/system/forward/ns2/named.conf.in
index 190bd69953..14ae9644c8 100644
--- a/bin/tests/system/forward/ns2/named.conf.in
+++ b/bin/tests/system/forward/ns2/named.conf.in
@@ -60,3 +60,8 @@ zone "1.0.10.in-addr.arpa." {
type master;
file "example.db";
};
+
+zone "tld" {
+ type master;
+ file "tld.db";
+};
diff --git a/bin/tests/system/forward/ns2/tld.db b/bin/tests/system/forward/ns2/tld.db
new file mode 100644
index 0000000000..61b6569b07
--- /dev/null
+++ b/bin/tests/system/forward/ns2/tld.db
@@ -0,0 +1,12 @@
+$TTL 300 ; 5 minutes
+@ IN SOA ns root (
+ 2000082401 ; serial
+ 1800 ; refresh (30 minutes)
+ 1800 ; retry (30 minutes)
+ 1814400 ; expire (3 weeks)
+ 3600 ; minimum (1 hour)
+ )
+ NS ns
+ns A 10.53.0.2
+sld NS ns.sld
+ns.sld A 10.53.0.1
diff --git a/bin/tests/system/forward/ns8/named.conf.in b/bin/tests/system/forward/ns8/named.conf.in
new file mode 100644
index 0000000000..531ff59ece
--- /dev/null
+++ b/bin/tests/system/forward/ns8/named.conf.in
@@ -0,0 +1,28 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+ query-source address 10.53.0.8;
+ notify-source 10.53.0.8;
+ transfer-source 10.53.0.8;
+ port @PORT@;
+ pid-file "named.pid";
+ listen-on { 10.53.0.8; };
+ listen-on-v6 { none; };
+ forwarders { 10.53.0.2; }; // returns referrals
+ forward first;
+ dnssec-validation yes;
+};
+
+zone "." {
+ type hint;
+ file "root.db";
+};
diff --git a/bin/tests/system/forward/ns8/root.db b/bin/tests/system/forward/ns8/root.db
new file mode 100644
index 0000000000..0785fc7597
--- /dev/null
+++ b/bin/tests/system/forward/ns8/root.db
@@ -0,0 +1,11 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+. NS a.root-servers.nil.
+a.root-servers.nil. A 10.53.0.1
diff --git a/bin/tests/system/forward/setup.sh b/bin/tests/system/forward/setup.sh
index d64579e590..285ecc9de9 100644
--- a/bin/tests/system/forward/setup.sh
+++ b/bin/tests/system/forward/setup.sh
@@ -19,3 +19,4 @@ copy_setports ns3/named.conf.in ns3/named.conf
copy_setports ns4/named.conf.in ns4/named.conf
copy_setports ns5/named.conf.in ns5/named.conf
copy_setports ns7/named.conf.in ns7/named.conf
+copy_setports ns8/named.conf.in ns8/named.conf
diff --git a/bin/tests/system/forward/tests.sh b/bin/tests/system/forward/tests.sh
index 5a63e06e86..36fd8a0040 100644
--- a/bin/tests/system/forward/tests.sh
+++ b/bin/tests/system/forward/tests.sh
@@ -159,5 +159,12 @@ sent=`grep "10.53.0.7#.* (.): query '\./NS/IN' approved" ns1/named.run | wc -l`
if [ $ret != 0 ]; then echo_i "failed"; fi
status=`expr $status + $ret`
+echo_i "checking recovery from forwarding to a non-recursive server"
+ret=0
+$DIG $DIGOPTS xxx.sld.tld txt @10.53.0.8 > dig.out.f8
+grep "status: NOERROR" dig.out.f8 > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
echo_i "exit status: $status"
[ $status -eq 0 ] || exit 1
diff --git a/doc/arm/Bv9ARM.ch01.html b/doc/arm/Bv9ARM.ch01.html
index 4319abf766..4e0cfcb2e2 100644
--- a/doc/arm/Bv9ARM.ch01.html
+++ b/doc/arm/Bv9ARM.ch01.html
@@ -614,6 +614,6 @@
-BIND 9.15.4 (Development Release)
+BIND 9.15.5 (Development Release)