Add release note and CHANGES for #4363

This protocol change is definitely worth mentioning.

diff --git a/CHANGES b/CHANGES
index 06772c24e66020e329fe8852f916287a526f0f35..83590f84452ca11879315e9361086b05120c39ef 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,9 @@
+6292.  [func]          Lower the maximum number of allowed NSEC3 iterations,
+                       from 150 to 50. DNSSEC responses with a higher
+                       iteration count are treated as insecure. For signing
+                       with dnssec-policy, iterations must be set to zero.
+                       [GL #4363]
+
 6291.  [bug]           SIGTERM failed to properly stop multiple outstanding
                        lookup in dig. [GL #4457]
 

diff --git a/doc/notes/notes-current.rst b/doc/notes/notes-current.rst
index 7c0b9b30dc618ef1378c11727f64daa30b480b0d..9bb024fe9b7fd1b164d03eaffa936bfa3bb19846 100644 (file)
--- a/doc/notes/notes-current.rst
+++ b/doc/notes/notes-current.rst
@@ -33,7 +33,12 @@ Removed Features
 Feature Changes
 ~~~~~~~~~~~~~~~
 
-- None.
+- The maximum number of allowed NSEC3 iterations for validation has been
+  lowered from 150 to 50. DNSSEC responses containing NSEC3 records with
+  iteration counts greater than 50 are now treated as insecure.  :gl:`#4363`
+
+- The number of NSEC3 iterations that can be configured for a zone must be 0.
+  :gl:`#4363`
 
 Bug Fixes
 ~~~~~~~~~