Add CHANGES and release notes for [GL #3459]

diff --git a/CHANGES b/CHANGES
index 280ccc71a619b5a80e4f3283b243a0ccea09c520..a7c5f1c51e6b9553f33f0f029844b71faaf2088a 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+5956.  [func]          Make RRL code treat all QNAMEs that are subject to
+                       wildcard processing within a given zone as the same
+                       name. [GL #3459]
+
 5955.  [port]          The libxml2 library has deprecated the usage of
                        xmlInitThreads() and xmlCleanupThreads() functions. Use
                        xmlInitParser() and xmlCleanupParser() instead.

diff --git a/doc/notes/notes-current.rst b/doc/notes/notes-current.rst
index e97eb97108c97876a6826c1278fcd389c97edb76..e758ca89662c9b8d296604acdcfcbc028979ea29 100644 (file)
--- a/doc/notes/notes-current.rst
+++ b/doc/notes/notes-current.rst
@@ -37,6 +37,10 @@ Removed Features
 Feature Changes
 ~~~~~~~~~~~~~~~
 
+- Response Rate Limiting (RRL) code now treats all QNAMEs that are
+  subject to wildcard processing within a given zone as the same name,
+  to prevent circumventing the limits enforced by RRL. :gl:`#3459`
+
 - Zones using ``dnssec-policy`` now require dynamic DNS or
   ``inline-signing`` to be configured explicitly :gl:`#3381`.