Add CHANGES and release notes for [GL #3459]

(cherry picked from commit 0b0cf12741f4d975328c1e4fe95ee1bbc4af46ba)

diff --git a/CHANGES b/CHANGES
index 4104c9cda0d1b524ecd01c405bdf98101799a169..e8ea8e1e602e92a1fda37c126d40cb8341009a10 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+5956.  [func]          Make RRL code treat all QNAMEs that are subject to
+                       wildcard processing within a given zone as the same
+                       name. [GL #3459]
+
 5955.  [port]          The libxml2 library has deprecated the usage of
                        xmlInitThreads() and xmlCleanupThreads() functions. Use
                        xmlInitParser() and xmlCleanupParser() instead.

diff --git a/doc/notes/notes-current.rst b/doc/notes/notes-current.rst
index 8e177646b932a8448669453d3f0b1c10e756b79d..306a87ccbb1928b6349198e7191eb7ab05a2d8e5 100644 (file)
--- a/doc/notes/notes-current.rst
+++ b/doc/notes/notes-current.rst
@@ -35,6 +35,10 @@ Removed Features
 Feature Changes
 ~~~~~~~~~~~~~~~
 
+- Response Rate Limiting (RRL) code now treats all QNAMEs that are
+  subject to wildcard processing within a given zone as the same name,
+  to prevent circumventing the limits enforced by RRL. :gl:`#3459`
+
 - Zones using ``dnssec-policy`` now require dynamic DNS or
   ``inline-signing`` to be configured explicitly :gl:`#3381`.