Add CHANGES entry and release note for GL #3439

(cherry picked from commit cfa398ad373ca652402a330542dc9600ba1f29d2)

diff --git a/CHANGES b/CHANGES
index 13d9e9fe3bfa70e3b664fe2cc259053beccf4490..188bbd6158d0e76f29f29fb2dd47bbb44beb827d 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,10 @@
+5925.  [bug]           With a forwarder configured for all queries, resolution
+                       failures encountered during DS chasing could trigger
+                       assertion failures due to a logic bug in
+                       resume_dslookup() that caused it to call
+                       dns_resolver_createfetch() with an invalid name.
+                       [GL #3439]
+
 5924.  [func]          When it's necessary to use AXFR to respond to an
                        IXFR request, a message explaining the reason
                        is now logged at level info. [GL #2683]

diff --git a/doc/notes/notes-current.rst b/doc/notes/notes-current.rst
index 70ae09d0bff7d900731c01895ea59d7c24377ef4..3f3ed47efe62b6317fbcb642dbfb7a36023cf65e 100644 (file)
--- a/doc/notes/notes-current.rst
+++ b/doc/notes/notes-current.rst
@@ -40,6 +40,12 @@ Feature Changes
 Bug Fixes
 ~~~~~~~~~
 
+- When running as a validating resolver forwarding all queries to
+  another resolver, :iscman:`named` could crash with an assertion
+  failure. These crashes occurred when the configured forwarder sent a
+  broken DS response and :iscman:`named` failed its attempts to find a
+  proper one instead. This has been fixed. :gl:`#3439`
+
 - Non-dynamic zones that inherit dnssec-policy from the view or
   options level were not marked as inline-signed, and thus were never
   scheduled to be re-signed. This is now fixed. :gl:`#3438`