/
ChangeLog
3304 lines (2386 loc) · 133 KB
/
ChangeLog
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
2012-04-23 Paul A. Rombouts <p.a.rombouts@home.nl>
* src/dns_query.c
Refine the return values of p_dns_cached_resolve(), p_dns_resolve() and
p_recursive_query() so that they distinguish between answers found in
the cache and replies obtained by querying other servers.
This, among other things, can be used to prevent data that was recently
obtained from the cache needlessly being added back to the cache.
2012-04-22 Paul A. Rombouts <p.a.rombouts@home.nl>
* configure.in
On the Linux platform, check if we can compile and link with the
-pthread flag instead of linking with -lpthread.
2012-04-21 Paul A. Rombouts <p.a.rombouts@home.nl>
* src/dns_query.c
When following the delegation chain trying to get an authoritative
answer, pdnsd would answer with SERVFAIL if it failed to get a reply
from the last server in the chain. Instead pdnsd will now use the last
reply in the chain with RCode=0 that raised the AA or RA flag, if there
is one.
2012-04-19 Paul A. Rombouts <p.a.rombouts@home.nl>
* src/cache.c
In report_cache_stat(), make copies of volatile data to get a
consistent data set before making calculations with cache size and
entry numbers.
2012-04-16 Paul A. Rombouts <p.a.rombouts@home.nl>
* src/netdev.c
If we can't open /proc/net/if_inet6 in is_local_addr() log a warning
message.
2012-04-15 Paul A. Rombouts <p.a.rombouts@home.nl>
* src/dns_query.c
The code checking for duplicate IP addresses obtained from NS records
in auth_ok() has been slightly optimized.
2012-04-12 Paul A. Rombouts <p.a.rombouts@home.nl>
* src/dns_query.c
When resolving nameservers obtained from NS records, allow pdnsd to use
more than one IP address per nameserver.
In rare cases, using just one IP address for each nameserver will cause
unnecessary resolve failures if the address chosen for each nameserver
happens to be unreachable while the other addresses would lead to
successful resolution, as demonstrated by Yuri Vorobyev.
2012-03-16 Paul A. Rombouts <p.a.rombouts@home.nl>
* src/cache.c
When adding RR records one by one to a cache entry using add_cent_rr(),
use the smallest ttl value in case of conflicting ttls.
Code for local/nonlocal conflict resolution has been taken out of
add_cent_rr_int() and put into add_cent_rr() and cr_check_add()
which should be slightly more efficient.
2012-03-15 Paul A. Rombouts <p.a.rombouts@home.nl>
* src/dns_query.c
Enforcing strict RFC 2181 compliance by rejecting all the answers
with inconsistent ttl timestamps can cause undesirable resolve failures.
I have tried to implement a more compromising solution, whereby
inconsistent answers that should be normally rejected are still never
cached, but are nevertheless used as intermediary or temporary results
if all else fails.
2012-03-13 Paul A. Rombouts <p.a.rombouts@home.nl>
* src/dns_query.c
Fixed a typo in rr_to_cache() that caused pdnsd to fail to compile when
configured with the --enable-strict-rfc2181 option.
Thanks to Gonzalo L. R. for reporting this problem.
Also changed the return value of rr_to_cache() from a simple boolean to
an RC code in order to properly distinguish between memory allocation
errors and time-stamp inconsistencies.
2012-02-21 Paul A. Rombouts <p.a.rombouts@home.nl>
* src/dns_query.c
If we have used EDNS in a query and the remote server answered
with rcode "format error", try again with the OPT pseudo-record
removed from the additional section of the query.
Also fixed a bug in p_exec_query() that caused pdnsd to behave
as if every reply with a non-empty additional section contained
an OPT record.
2012-02-15 Paul A. Rombouts <p.a.rombouts@home.nl>
* src/dns_answer.c,src/helpers.c,src/helpers.h,src/icmp.c,
src/ipvers.h,src/main.c,src/netdev.c
Introduced a new macro SEL_IPVER() to reduce some of the clutter in the
code caused by having to support both IPv4 and IPv6.
2012-01-31 Paul A. Rombouts <p.a.rombouts@home.nl>
* configure.in
Add AM_PROG_CC_C_O line to configure.in to prevent automake warning.
2012-01-29 Paul A. Rombouts <p.a.rombouts@home.nl>
* src/cache.c
In report_cache_stat(), add the average number of bytes used per cache
entry when reporting the cache status, as suggested by M. Galabant.
2012-01-28 Paul A. Rombouts <p.a.rombouts@home.nl>
* src/dns_answer.c,src/dns_query.c
Cleaned up the code a bit to avoid warning messages when
compiling with '-Wall -Winline' flags.
2012-01-18 Paul A. Rombouts <p.a.rombouts@home.nl>
* src/conff.c
Set the default of the edns_query option to false.
2011-07-31 Paul Rombouts <p.a.rombouts@home.nl>
* src/cache.c
Use a slightly more sophisticated merge-sort algorithm in sort_rrl().
2011-05-09 Paul Rombouts <p.a.rombouts@home.nl>
* src/dns_answer.c
In compose_answer(), also add an OPT pseudo-RR to the additional section
of a NXDOMAIN reply when appropriate.
2011-05-08 Paul Rombouts <p.a.rombouts@home.nl>
* src/cache.c,src/cache.h,src/dns_query.c,src/status.c
Make the dns_cent_t struct more compact by putting the fields that are
only used for either non-existent or existent domains, but not both,
into a union so that these fields can share memory.
When saving the cache to file, only write the TTL and time-stamp for
a whole domain when it is negatively cached.
2011-05-06 Paul Rombouts <p.a.rombouts@home.nl>
* src/cache.c,src/cache.h,src/dns_query.c
At the request of Andrei Caraman, the TTL of a negatively cached domain
is now adjusted in accordance with the min_ttl and max_ttl options, just
as it is done for (negatively) cached records.
Additional change to the TTL policy is that for negative records (and
negative domains) the neg_ttl setting overrides min_ttl if
neg_ttl < min_ttl.
2011-04-26 Paul Rombouts <p.a.rombouts@home.nl>
* src/conf-parser.c
Fixed memory leak that can occur when the configuration file is reloaded
and an error is encountered while parsing the definition of a TXT
record.
2011-03-21 Paul Rombouts <p.a.rombouts@home.nl>
* src/make_rr_types_h.pl,src/cache.h,src/cache.c,src/dns_answer.c
Introduced arrays rrmuiterlist and rrcachiterlist to make iterating
over all possible RR types in a cache entry in strict ascending order
a little more efficient.
2011-03-09 Paul Rombouts <p.a.rombouts@home.nl>
* src/dns_query.c,src/conf-parser.c,src/conf-keywords.h
Implemented a new config option "outgoing_ip", which
makes it possible to bind outgoing connections to
a specific interface.
2011-02-21 Paul Rombouts <p.a.rombouts@home.nl>
* src/netdev.c
Fixed UDP socket descriptors leak in the implementation of
is_local_addr() for the FreeBSD platform. Thanks to Ashish Shukla for
reporting this bug.
2011-02-14 Paul Rombouts <p.a.rombouts@home.nl>
* src/cache.c
In purge_all_rrsets(), also free the rrext array if it has become empty after
purging all the RR sets.
2011-02-04 Paul Rombouts <p.a.rombouts@home.nl>
* src/conff.c,src/conff.h,src/conf-parser.c,src/conf-keywords.h,
src/dns_query.c,src/dns_query.h,src/servers.c
Changed "edns_query" from a "global" option to a "server"
configuration option.
2011-02-04 Paul Rombouts <p.a.rombouts@home.nl>
* src/conff.c,src/conff.h,src/dns_query.c,src/dns_query.h,src/servers.c,
src/conf-parser.c
The query uptest sometimes fails because some DNS servers are configured
to ignore empty queries. The new config option "query_test_name" makes
it possible to query for a specific name instead.
2011-02-01 Paul Rombouts <p.a.rombouts@home.nl>
* src/dns_query.c
When processing a reply from a remote name server which seems to delegate
to other name servers, check if the names for which NS records have
been supplied have locally defined NS records. If so, the local
records will now override those supplied by the remote server.
2011-01-31 Paul Rombouts <p.a.rombouts@home.nl>
* src/conf-parser.c
Added support for defining TXT records in the configuration file.
2011-01-30 Paul Rombouts <p.a.rombouts@home.nl>
* src/dns_query.c
Do not cache additional records from a response that is rejected because
it contains IP addresses in the reject list, even when the reply
is processed as a NXDOMAIN reply.
2011-01-25 Paul Rombouts <p.a.rombouts@home.nl>
* src/conf-parser.c
Modified the function scan_string() to allow back-slashed escape
sequences in strings.
2011-01-21 Paul Rombouts <p.a.rombouts@home.nl>
* src/dns_answer.c,src/dns_query.c,src/conff.h,src/conff.c,
src/conf-parser.c
Added support for EDNS (Extension mechanisms for DNS).
Currently this is only useful for allowing UDP message sizes
to be larger than 512 bytes.
2011-01-20 Paul Rombouts <p.a.rombouts@home.nl>
* src/dns_answer.c
To avoid frequent reallocs when composing a DNS reply message,
grow the message buffer in multiples of a certain minimum chunk size.
2011-01-19 Paul Rombouts <p.a.rombouts@home.nl>
* src/dns.c,src/dns.h,src/dns_answer.c
Extended debugging info with DNS-message lengths and flags of incoming
messages.
2011-01-17 Paul Rombouts <p.a.rombouts@home.nl>
* src/conff.c,src/conff.h,src/conf-parser.c,src/dns_answer.c
Made "ignore_cd" option obsolete. It is now effectively always on.
2010-12-27 Paul Rombouts <p.a.rombouts@home.nl>
* src/cache.c,src/cache.h,src/dns_answer.c,src/dns_query.c,
src/make_rr_types.pl,src/rr_types.in,src/rr_types.c
The array of pointers to rr_set_t structs in the dns_cent_t struct
contains mostly null pointers in practice, so is somewhat
inefficient in storage usage. This problem is exacerbated if we add
support for caching more RR-types. To ameliorate to the problem
I have decided to split the array in two, with one part fixed in the
dns_cent_t struct as before, and an extension part that will be
separately allocated, if necessary. If the extension part is used only
for very rarely cached types, in most cases the extension array will not
need to be allocated thus hopefully saving memory overall.
The lookup tables which are necessary to support the new cache entry
structure are cumbersome to write by hand, so I have written a perl
script to do this automatically. As an additional benefit, which RR
types are cache-able is now configurable for each type separately via
rr_types.in.
2010-03-14 Paul Rombouts <p.a.rombouts@home.nl>
* src/dns_query.c
Using randomized source ports for outgoing queries in IPv6 mode failed
with the warning "Out of ports in the range 1024-65535, dropping query!",
because the pdnsd tried to bind to the fixed port for incoming queries,
instead of the dynamically chosen port. This is a very old bug, but it
has only become apparent since source port randomization has become the
default.
Thanks to Philip-André Fillion, Phil Sutter, Radoslaw Szkodzinski and
others for reporting this bug and sending patches.
2009-12-25 Paul Rombouts <p.a.rombouts@home.nl>
* src/status.c,src/status.h,src/pdnsd-ctl/pdnsd-ctl.c
Add a magic number to pdnsd-ctl command codes to guard against
possible incompatibility between the pdnsd-ctl utility and the
pdnsd server.
2009-10-18 Paul Rombouts <p.a.rombouts@home.nl>
* src/dns_query.c
Make root-server discovery a little more fault tolerant, i.e. if some
of the root-server names don't resolve don't necessarily reject the
whole result.
2009-10-17 Paul Rombouts <p.a.rombouts@home.nl>
* src/servers.c,src/dns_query.c,src/dns_query.h
Implemented automatic root-server discovery, which can now be configured
by setting "root_server=discover".
2009-06-14 Paul Rombouts <p.a.rombouts@home.nl>
* src/dns_query.c,src/consts.c,src/consts.h,src/conf-parser.c
Changed the default behaviour of the "neg_rrs_pol" option. The default
used to be to only cache records negatively in case the AA (authoritive
answer) bit in the reply was set. The new default is to also allow
negative caching in case the reply has the RA (recursion available) bit
set and the query had the RD (recursion desired) bit set.
This gives the behaviour that is usually wanted in case "proxy_only=on"
is set without having to set "neg_rrs_pol=on", which can be more
problematic. The new default can be explicitly set using
"neg_rrs_pol=default". The values "on","off" and "auth" are also
still available.
2009-06-13 Paul Rombouts <p.a.rombouts@home.nl>
* src/conff.c,src/conff.h,src/dns_answer.c,src/conf-parser.c,src/conf-keywords.h
Included a patch contributed by Andreas Steinmetz that implements a new
global configuration option "ignore_cd". pdnsd used to check that the CD
bit in the DNS header of queries is zero and return the error code
"format error" if it is not. However, considering the meaning of this
bit today it appears to be harmless to ignore it, so the new "ignore_cd"
is on by default. Setting "ignore_cd=off" gives the earlier strict
behavior.
Also renamed the the Z1, AU, Z2 bits to correspond with their modern names
CD, AD, Z.
2008-12-19 Paul Rombouts <p.a.rombouts@home.nl>
* pdnsd-1.2.7/src/dns_query.c
If pdnsd receives a SERVFAIL response with a non-empty answer section,
use the information tentatively if no better response is available.
The previous behaviour was to discard the reply completely, which could
cause failure to resolve some names.
Thanks to Rafal Wijata for providing an example involving PowerDNS servers
replying with CNAME records.
2008-09-01 Paul Rombouts <p.a.rombouts@home.nl>
* src/dns_query.c
In p_dns_resolve(), try to reduce the burden on root servers further for
names ending in "arpa".
2008-08-31 Paul Rombouts <p.a.rombouts@home.nl>
* src/dns_query.c
In p_exec_query(), if the reply from a remote name server is negative
(either because the rcode is NXDOMAIN or because the answer section
contains no records for the queried name), ignore the remaining records
in the answer section (in particular do not add them to the cache).
2008-07-29 Paul Rombouts <p.a.rombouts@home.nl>
* src/conff.c,src/dns_query.c
Made the default of the configuration option query_port_start equal to
1024. Also improved the algorithm used by pdnsd to select random source
ports to ensure that each (free) port gets an equal chance of being
selected. This should guarantee random source ports in the range
1024-65535, making pdnsd less vulnerable to some of the issues described
in CERT VU#800113.
The old situation, where pdnsd lets the kernel select the source ports,
is still available by specifying query_port_start=none.
2008-07-25 Paul Rombouts <p.a.rombouts@home.nl>
* src/dns_query.c
Fixed a dangling pointer bug in p_exec_query(), which could cause pdnsd
to crash when processing a long reply with many entries in the answer
section.
2008-05-12 Paul Rombouts <p.a.rombouts@home.nl>
* src/conf-parser.c,src/conff.c
Added a recursive-depth counter to the read_config_file() and
confparse() functions to prevent the possibility of infinite
recursion when processing include files.
In confparse(), warn when in a server section the root_server option is
set in combination with policy=simple_only or policy=fqdn_only.
2008-05-10 Paul Rombouts <p.a.rombouts@home.nl>
* src/ipvers.h
Included a patch contributed by Georg Schwarz which selectively undoes
a Debian patch contributed by Juliusz Chroboczek on platforms for which
the IPV6_RECVPKTINFO macro is not defined (e.g. MacOS X).
2008-05-08 Paul Rombouts <p.a.rombouts@home.nl>
* src/status.c,src/pdnsd-ctl/pdnsd-ctl.c
The pdnsd-ctl add command can now also be used to define NS records.
A wildcard record defined with this command now behaves the same way as
one defined in the config file.
2008-05-07 Paul Rombouts <p.a.rombouts@home.nl>
* src/conf-parser.c,src/conf-keywords.h,src/conff.c
Added the ability to process "include" sections in the configuration
file. This makes it possible to place local definitions in separate
files and include them from the main configuration file.
2008-05-05 Paul Rombouts <p.a.rombouts@home.nl>
* src/conff.c,src/conf-parser.c,src/status.c,src/pdnsd-ctl/pdnsd-ctl.c
Implemented two new pdnsd-ctl commands, which make it easier to add
definitions to the pdnsd cache at run time. "pdnsd-ctl include" is
similar to "pdnsd-ctl config" but only processes configuration sections
that effect the cache and disallows global and server sections.
"pdnsd-ctl eval" directly parses its string arguments as if they were
part of a configuration (include) file.
2007-09-15 Paul Rombouts <p.a.rombouts@home.nl>
* src/dns.h,src/dns_answer.c,src/dns_query.c
Changed the declarations of various packed structs, by moving the
__attribute__((packed)) specifiers from the field level to the struct level.
This was necessary to get the correct value for sizeof(rr_hdr_t) when
compiling with gcc for the ARM architecture.
Thanks to Dirk Armbrust for reporting the problem and supplying the solution.
2007-08-10 Paul Rombouts <p.a.rombouts@home.nl>
* src/dns_answer.c
Applied a Debian patch contributed by Juliusz Chroboczek which
reportedly fixes a problem with pdnsd running in IPv6 mode
(IPV6_RECVPKTINFO instead of IPV6_PKTINFO).
2007-08-04 Paul Rombouts <p.a.rombouts@home.nl>
* src/dns_query.c
When resolving a name recursively, pdnsd would stop querying further
name servers as soon as it received a reply with the authority (aa) flag
set. Unfortunately, it appears this flag is sometimes raised erroneously
in replies. I have implemented a work-around that ignores the aa flag
when there appears to be a clear delegation to a sub-domain.
Thanks to Nico Erfurth for reporting this problem.
It appears that pdnsd would also fail to consult servers in the authority
section when configured with neg_rrs_pol=on. This has been fixed.
2007-08-01 Paul Rombouts <p.a.rombouts@home.nl>
* src/pdnsd-ctl/pdnsd-ctl.c
Made the matching of pdnsd-ctl command names and most of the arguments
case-insensitive.
2007-07-22 Paul Rombouts <p.a.rombouts@home.nl>
* src/dns_answer.c
Instead of sharing the responsibility for freeing the answer buffer in
case of an error amongst different functions, only free it in
compose_answer().
* configure.in, src/Makefile.am, src/test/Makefile.am
Merged patch contributed by Pierre Habouzit to deal with CFLAGS the
automake way (allowing packagers to override CFLAGS properly).
2007-07-21 Paul Rombouts <p.a.rombouts@home.nl>
* src/dns_answer.c
For each target name in a SRV record in the answer section, add
addresses to the additional section of the response, as is recommended
by the RFCs.
2007-07-14 Paul Rombouts <p.a.rombouts@home.nl>
* src/list.c,src/list.h
Made modifications to the implementation of dynamic arrays, which
should ensure proper alignment on all supported architectures.
2007-07-10 Paul Rombouts <p.a.rombouts@home.nl>
* Upgraded pdnsd's license to GPL version 3.
2007-07-08 Paul Rombouts <p.a.rombouts@home.nl>
* src/cache.h,src/dns_query.c
The data field of the rr_bucket_t struct is now aligned such that
it possible to use straightforward assignment to copy IP addresses,
making memcpy unnecessary for this purpose.
2007-07-07 Paul Rombouts <p.a.rombouts@home.nl>
* src/dns_query.c
If pdnsd fails to connect to a name server using a IPv6 address, it will
now retry the connection using a IPv4 address, if available. This allows
pdnsd to recover from situations where IPv6 connectivity is temporarily
unavailable, but IPv4 connectivity still functions.
Thanks to Andreas Ferber for reporting this problem.
2007-07-04 Paul Rombouts <p.a.rombouts@home.nl>
* src/dns_answer.c
I have reordered the arguments of the add_rr() and related
functions to make them more consistent with each other.
2007-07-03 Paul Rombouts <p.a.rombouts@home.nl>
* src/cache.c,src/hash.c
pdnsd will no longer immediately abort in add_dns_hash() if it fails
to allocate memory for a new hash entry.
2007-07-01 Paul Rombouts <p.a.rombouts@home.nl>
* src/conff.c,src/conff.h,src/consts.c,src/consts.h,
src/conf-parser.c,src/conf-keywords.h,src/dns_query.c
Implemented the new "reject", "reject_policy" and "reject_recursively"
options for the server section of the configuration file.
* src/ipvers.h,src/conf-parser.c,src/dns.c,src/status.c,
src/pdnsd-ctl/pdnsd-ctl.c
Allow local AAAA records to be defined even if pdnsd is compiled
without --enable-ipv6, provided there is sufficient support in the
C libraries and --disable-new-rrs was not used.
2007-06-30 Paul Rombouts <p.a.rombouts@home.nl>
* src/dns_answer.c
Previously, when the answer buffer was realloced in add_rr(), an
extra 2 bytes used to be reserved, which are unnecessary, as far
as I can tell. I have decided to do without these extra 2 bytes,
which originate from Thomas Moestl's code. As compensation, I have
added extra PDNSD_ASSERT() statements to check that the answer
buffer does not overflow.
2007-06-27 Paul Rombouts <p.a.rombouts@home.nl>
* src/status.c, src/pdnsd-ctl/pdnsd-ctl.c
Extended the pdnsd-ctl 'add a' and 'add aaaa' commands to allow
multiple IP addresses to be specified.
2007-06-25 Paul Rombouts <p.a.rombouts@home.nl>
* src/conff.c,src/conff.h,src/conf-parser.c,src/conf-keywords.h,
src/dns_query.c
Implemented a new option for the server section of the configuration
file: randomize_servers.
* src/servers.c
Improved the debug messages in uptest().
2007-01-30 Paul Rombouts <p.a.rombouts@home.nl>
* src/icmp.c
Fixed up the code implementing the ping test in icmp.c,
which was broken for 64-bit systems.
Thanks to Michael Uleysky for reporting this bug.
2007-01-09 Paul Rombouts <p.a.rombouts@home.nl>
* src/dns_query.c
auth_ok() now returns 1 if the cache entry has the DF_NEGATIVE flag set,
without providing a list of authoritative servers to continue querying.
Otherwise if we receive a non-authoritative NXDOMAIN reply and pdnsd
is configured with neg_domain_pol=on, pdnsd will continue to try to
get an authoritative answer. The intention is that pdnsd
stops querying as soon as it gets an "unknown domain" answer.
2006-04-29 Paul Rombouts <p.a.rombouts@home.nl>
* src/main.c
pdnsd would segfault if it tried to call log_message() (via the
log_warn() and log_error() macros) before the FILE pointer to the debug
output stream was properly initialized.
Thanks to Thomas Cort for discovering this problem and suggesting a fix.
2006-04-09 Paul Rombouts <p.a.rombouts@home.nl>
* src/conf-parser.c,src/helpers.c,src/conff.h,src/conff.c
I have included a patch contributed by Jan-Marek Glogowski, that
implements the configuration option "use_nss". With use_nss=off pdnsd
will avoid system functions that may use NSS (i.e. initgroups()), which
may need DNS for LDAP lookups, which can lead to long timeouts and
stalls if pdnsd itself is used for the DNS lookup.
2006-03-26 Paul Rombouts <p.a.rombouts@home.nl>
* src/dns_query.c
Negative caching of RR sets is now also supported with lean_query=off.
2006-03-25 Paul Rombouts <p.a.rombouts@home.nl>
* src/dns_query.c,src/conf-parser.c,src/main.c
I have implemented a new query method: udp_tcp. With this method a UDP
query is tried first and, if the UDP answer is truncated, the query is
repeated using TCP. This is the behaviour that seems to be recommended
by the DNS standards. However, pdnsd wil not discard the truncated
answer if the TCP requery fails.
2006-03-24 Paul Rombouts <p.a.rombouts@home.nl>
* src/dns_answer.c
Previously, pdnsd would add at most one additional A (and AAA) record
for each record in the answer and authority sections. At the request of
Angel Marin, pdnsd will now add all A and AAA records it can find in the
cache for each name that produces additional records.
2006-01-02 Paul Rombouts <p.a.rombouts@home.nl>
* src/dns_answer.c
compose_answer() would leak memory if the query contained
an unsupported QTYPE or QCLASS. This has now been fixed.
2005-12-27 Paul Rombouts <p.a.rombouts@home.nl>
* configure.in
TCP-query support is now compiled in by default.
It can still be disabled using the configure option
--disable-tcp-queries.
2005-12-23 Paul Rombouts <p.a.rombouts@home.nl>
* src/dns_answer.c
Queries received from clients with non-empty answer, authority or
additional sections are now treated as malformed and rejected with
rcode 1 (format error).
2005-11-06 Paul Rombouts <p.a.rombouts@home.nl>
* src/conf-parser.c
Time intervals in the configuration files can now be expressed in
seconds, minutes, hours, days and weeks, using the suffixes
s,m,h,d,and w.
2005-10-14 Paul Rombouts <p.a.rombouts@home.nl>
* src/consts.c
In the pdnsd configuration file, true/false and yes/no are now accepted
as synonyms for the constants on/off.
2005-08-24 Paul Rombouts <p.a.rombouts@home.nl>
* src/helpers.c
I have fixed a potential buffer overflow problem that could occur with
the 'pdnsd-ctl dump' command.
In case of the root domain, the function rhn2str() would write 2 bytes
to the output buffer even if size==1. Theoretically (under pathological
circumstances) this could have allowed the dbuf buffer in the function
dump_cent() to overflow by one byte.
2005-08-21 Paul Rombouts <p.a.rombouts@home.nl>
* acconfig.h,src/cache.c,src/conff.c,src/conf-parser.c,src/dns.c,
src/dns_answer.c,src/dns_query.c,src/error.h,src/helpers.c,src/main.c,
status.c
It appears the newer versions of gcc won't convert a pointer to char
into a pointer to unsigned char and vice versa without complaining.
The changes I have made should get rid of these distracting warning
messages. Unfortunately I had to introduce casts in some cases,
which reduces type safety :-(.
2005-08-16 Paul Rombouts <p.a.rombouts@home.nl>
* src/dns.h
Some changes were made to the endianess detection code to
address problems on Mac OS X v10.4 Tiger.
2005-08-15 Paul Rombouts <p.a.rombouts@home.nl>
* configure.in
Some changes where made to address the reported problems with the
configure script on Mac OS X v10.4 Tiger.
2005-08-05 Paul Rombouts <p.a.rombouts@home.nl>
* src/status.c,src/dns_answer.c
The output of the 'pdnsd-ctl status' command now includes some
statistics on the number of query threads.
2005-07-29 Paul Rombouts <p.a.rombouts@home.nl>
* src/main.c
It appears that sigwait() can return EINTR under certain conditions.
This explains the problems reported by Sanjoy Mahajan with strace
and ACPI S3 sleep, which both caused pdnsd to exit prematurely.
The return value of sigwait() is now checked and sigwait() is retried
if the return value is EINTR.
2005-07-04 Paul Rombouts <p.a.rombouts@home.nl>
* src/dns_query.c
It appears that some servers that do not support recursive queries
answer with "query refused" instead of "not supported". The
p_exec_query() function now takes that possibility into account.
2005-07-01 Paul Rombouts <p.a.rombouts@home.nl>
* src/dns_query.c
In the processing of queries, I will make a distinction between
recoverable errors and non-recoverable ones (typically caused by out of
memory conditions). In the case of non-recoverable errors, no attempt to
query alternative name servers is made.
2005-06-26 Paul Rombouts <p.a.rombouts@home.nl>
* src/dns_query.c
In p_recursive_query(), as soon as one of the servers in the q list
replied "no error" or "name error", only this reply was examined and
the other servers in the q list were ignored. Joshua Coombs has brought
to my attention that this strategy sometimes fails when this reply is not
authoritative and doesn't contain any usable references to name servers
in the authority section.
I have modified p_recursive_query() to allow pdnsd to continue querying
the remaining servers in the q list as long as we haven't received an
authoritative answer or usable authority information. This will allow
pdnsd to arrive at the correct answer in some cases where it would
formerly fail.
2005-06-25 Paul Rombouts <p.a.rombouts@home.nl>
* src/status.c
The "pdnsd dump" command may now also be given an argument
consisting of a name beginning with a dot. This will dump information
about all names in the cache ending in the given name. An argument
consisting of a name without a leading dot will only give information
about the exact name, as it did before.
2005-06-24 Paul Rombouts <p.a.rombouts@home.nl>
* src/servers.c,src/status.c
All uptests are now conducted by the server status thread. If a retest
is requested via a "pdnsd-ctl server", an existing server status thread
is signaled or a new server status thread is spawned if the old one has
exited. This has the effect that a "pdnsd-ctl server label retest"
command will now return immediately without waiting for the tests to
finish.
2005-06-20 Paul Rombouts <p.a.rombouts@home.nl>
* src/conf-parser.c,src/servers.c,src/servers.h
At the request of Al-Junaid Walker I have added a new configuration
option for the uptest interval. With "interval=ontimeout" the server is
not tested at startup/reconfig, or at regular intervals, but only after
a DNS query to a server times out. However, once a server is declared
dead it is never considered again unless it is revived using a
"pdnsd-ctl config" or "pdnsd-ctl server" command.
2005-06-19 Paul Rombouts <p.a.rombouts@home.nl>
* src/servers.c,src/dns_query.c,src/icmp.c
During an uptest the server configuration data is locked. Especially
with ping or query uptests of unresponsive servers this means that the
execution of "pdnsd-ctl config" or "pdnsd-ctl server" commands can be
delayed for a long time (or even time out). I have made modifications
that allow a "pdnsd-ctl config" or "pdnsd-ctl server" commands to
interrupt pending uptests to allow these commands to proceed without
delay in most cases.
* src/thread.h
Use the POSIX sigaction() instead of signal() to install signal handlers.
2005-06-08 Paul Rombouts <p.a.rombouts@home.nl>
* src/dns_answer.c,src/dns_query.c
I have defined a struct dns_msg_t that includes a message length field.
In the case of sending a DNS message over TCP, we no longer need a
separate write() call to send the message length. This prevents possible
packet fragmentation.
2005-06-07 Paul Rombouts <p.a.rombouts@home.nl>
* src/dns_query.c
The query_method=tcp_udp option only used to work with cooperative name
servers, i.e. servers that either send back a TCP reply or explicitly
refuse the TCP connection request. This wasn't sufficiently satisfactory
in practice, because some name servers are completely unresponsive to TCP
connection requests. I have made modifications to allow pdnsd to try UDP
queries in case TCP connections time out. When a short server timeout is
combined with a global timeout that is at least twice as long, this may
allow a query to a name server that only responds to UDP queries to
succeed with query_method=tcp_udp.
2005-04-20 Paul Rombouts <p.a.rombouts@home.nl>
* src/cache.c,src/hash.c,src/conff.c,src/status.c,src/pdnsd-ctl/pdnsd-ctl.c
The "pdnsd-ctl empty-cache" command now accepts additional arguments;
these are interpreted as include/exclude names. During execution of the
command the name of each cache entry is matched against the names in the
include/exclude list. If the name ends in a name to be included, the
cache entry is deleted, otherwise not.
This feature was added at the request of Joshua Coombs.
2005-04-19 Paul Rombouts <p.a.rombouts@home.nl>
* src/cache.c, src/hash.c
pdnsd will now (temporarily) unlock the cache between emptying hash
buckets, this should allow pdnsd to remain responsive while executing
the "pdnsd-ctl empty-cache" command. However, this only applies to DNS
queries; pdnsd will not accept any new pdnsd-ctl commands while a
pdnsd-ctl command is still running.
2005-03-29 Paul Rombouts <p.a.rombouts@home.nl>
* configure.in, src/hash.h
I have added a new configure option --with-hash-buckets=...
This makes it possible to specify a different number of
hash buckets without editing the source files.
2005-03-17 Paul Rombouts <p.a.rombouts@home.nl>
* src/error.c
When running in both daemon and debug mode, print warning and
error messages to debug file as well as the syslog.
2005-03-15 Paul Rombouts <p.a.rombouts@home.nl>
* src/dns_answer.c
Only call pthread_setspecific() in debug mode, because
pthread_getspecific() is also only used in debug mode.
If pthread_setspecific() fails, treat this as a non-fatal error.
2005-03-10 Paul Rombouts <p.a.rombouts@home.nl>
* configure.in
On Linux systems the configure script will now try to detect automatically
whether the system implements the Native POSIX Thread Library, but
the method is not necessarily foolproof.
* src/dns.c
Local PTR records generated for resolving numeric IPv6 addresses back into
names, are now based on ip6.arpa instead of ip6.int, because the latter domain
will be phased out eventually.
2005-03-06 Paul Rombouts <p.a.rombouts@home.nl>
* Makefile.am,src/cache.c
Create an empty cache-file at install time and don't complain about empty
cache files at start up.
2005-02-20 Paul Rombouts <p.a.rombouts@home.nl>
* acconfig.h,configure.in,src/conf-parser.c,src/conff.h,src/dns.h,
src/dns_answer.c,src/dns_query.c,src/error.h,src/helpers.h,src/icmp.c,
src/ipvers.h
I have applied some changes to the code proposed by Rodney Brown to improve
portability. In particular, pdnsd should now compile on the Darwin platform
(Apple Mac OS X).
To support some of these changes, the source package is now built with a
slightly more modern version of autoconf (2.57) and automake (1.6.3).
2005-01-29 Paul Rombouts <p.a.rombouts@home.nl>
* src/dns.c,src/dns_answer.c,src/dns_query.c
I have added some extra debug code to make it easier to discover the
reason that pdnsd considers a query or reply malformed (format error).
2005-01-12 Paul Rombouts <p.a.rombouts@home.nl>
* src/dns.c,src/dns_answer.c,src/dns_query.c
I have extended some debug code contributed by Kiyo Kelvin Lee to dump
the data received by pdnsd in debug mode (queries from clients, replies
from name servers). Because this will give very verbose debug output,
I've arranged it so that this data dump only occurs if pdnsd has been
configured and compiled with --with-debug=9 and pdnsd has been called
with -v9.
Additionally, in the case that pdnsd rejects a reply from a name server
because it is not well formed, I have refined the debug messages to
distinguish between format errors due to unexpected truncation and
others kinds of format errors.
2004-10-30 Paul Rombouts <p.a.rombouts@home.nl>
* src/rr_types.c
I have included some changes proposed by Joseph Pecquet to address
the compilation problems reported by FreeBSD users.
2004-10-18 Paul Rombouts <p.a.rombouts@home.nl>
* acconfig.h,configure.in,src/helpers.c,src/helpers.h,src/dns.h
I have merged a patch for CYGWIN support by Kiyo Kelvin Lee into
my version of the code.
2004-10-15 Paul Rombouts <p.a.rombouts@home.nl>
* src/cache.c
Invalidating local records with the pdnsd-ctl did not work the way the
documentation described. An invalidated local record would be always be
purged at the next lookup, thus invalidation would practically have the
same effect as deletion. An invalidated local record is of no use at all and
would occupy space until it is purged during a lookup (but not by purge_cache).
The function invalidate_record() now behaves as the documentation describes, i.e.
invalidation of local records has no effect.
2004-09-27 Paul Rombouts <p.a.rombouts@home.nl>
* doc/pdnsd.conf.5.in
A new man page describing the format of the pdnsd config file has been
added to the pdnsd package. I've used a customized Perl script to generate
one automatically from the html documentation.
2004-09-14 Paul Rombouts <p.a.rombouts@home.nl>
* src/hash.c
The cache entries in a hash chain are now stored in order of increasing long hash
value. The advantage is that if an name is looked up that is not present in the
cache, this can be done by comparing with only half (on average) of the number
of entries in the hash chain. Not a huge speed up, but still worth while, I think.
Additionally, the number of hash computations for each add_cache() call has
been halved.
2004-09-11 Paul Rombouts <p.a.rombouts@home.nl>
* src/cache.c
insert_rrl() will no longer add local records to the rr_l list, because
purge_cache() ignores them anyway.
2004-09-08 Paul Rombouts <p.a.rombouts@home.nl>
* src/dns.h,src/cache.c,src/dns_query.c,src/dns_answer.c,src/conf-parser.c
I've started using GETINT16,GETINT32,PUTINT16,PUTINT32 macros, which are based
on the NS_GET/NS_PUT macros that can be found in the BIND source, instead of memcpy
for fetching and storing non-aligned integer data.
2004-09-08 Paul Rombouts <p.a.rombouts@home.nl>
* src/cache.c,src/status.c,src/pdnsd-ctl/pdnsd-ctl.c
New pdnsd-ctl command: "pdnsd-ctl dump" will print information about all the
entries contained in the cache.
"pdnsd-ctl dump <name>" will only print entries belonging to <name>.
The data fields of the more common rr-types will be printed in human readable
form, the remaining ones in a hexadecimal representation.
With thanks to Dan Jacobson for suggesting this feature.
2004-08-31 Paul Rombouts <p.a.rombouts@home.nl>
* src/conf-parser.c
At the suggestion of Dan Tihelka, I have expanded to the server_ip= option
to allow the name of an interface to be specified instead of an IP address.
pdnsd will not bind to the interface name, but will lookup the address the
interface has at start up, and listen on that address. If the address
of the interface changes while pdnsd is running, pdnsd will not notice that.
2004-08-30 Paul Rombouts <p.a.rombouts@home.nl>
* src/cache.h,src/cache.c
I've reversed the meaning of the CF_NOAUTH and renamed it CF_AUTH.
I've also added a domain level flag DF_AUTH, which is used to
mark cache entries obtained from authoritave replies in response to
a query of type * (all)..
2004-08-30 Paul Rombouts <p.a.rombouts@home.nl>
* src/cache.c
I've changed the format of the cache file. A typical cache entry has empty
sets for most RR types (even more if DNS_NEW_RRS is defined). In the old
format, each empty RR set was represented by a zero byte.
In the new format only non-empty sets are respresented, leading
to a (modest) reduction is size.
2004-08-28 Paul Rombouts <p.a.rombouts@home.nl>
* src/conf-parser.c
New option for "rr" sections in the config file: reverse=on/off.
If you want a locally defined name to resolve to a numeric address and vice
versa, you can now achieve this by setting reverse=on before defining the
A record, making it unnecessary to define a seperate PTR record for the reverse
resolving.
2004-08-20 Paul Rombouts <p.a.rombouts@home.nl>
* src/cache.h,src/cache.c,src/conf-parser.c,src/dns_query.c
At the request of Daniel Black, I have added support for defining local wildcard records
in pdnsd. The only type supported presently is records beginning with '*.'.
2004-08-10 Paul Rombouts <p.a.rombouts@home.nl>
* src/hash.c,src/cache.c,src/dns_query.c,src/dns_answer.c
Sampo Lehtinen has remarked that pdnsd sometimes failed to resolve classless
reversed-delegated IP addresses, and that this has something to do with the fact
that pdnsd did not accept '/' characters in domain names. After reading Sampo's
and Thomas' remarks, and also rfc2317 and some of the rfc's referenced in rfc2317,
I decided pdnsd should place no restrictions at all on the types of characters it
allows in domain names, only on the lengths of the byte sequences.
This led me to make some quite extensive internal changes to pdnsd. Among other
things domain names are now stored in transport format (sequences of bytes preceded
by length bytes) instead of C strings. This is also more efficient because there
is no need any more to convert from one representation to the other, except when
reading the config file, interacting with pdnsd-ctl or running in debug mode.
Conversion between the two representations isn't always possible, though.
For example, domain names in transport format might contain non-printable characters.
These are now printed as escape sequences (three octal digits preceded by a back slash).
Presently there are still restrictions on the characters in the domain names that can
be defined in local records. I doubt this will ever be considered a problem.
2004-08-02 Paul Rombouts <p.a.rombouts@home.nl>
* src/dns_query.c
The code for handling NXT records was flawed. A response from a remote server
containing NXT records (even well-formed ones) could cause pdnsd to crash.
The code for handling NAPTR records contained incorrect PDNSD_ASSERT statements,
which could cause pdnsd to abort unnecessarily.
2004-07-25 Paul A. Rombouts <p.a.rombouts@home.nl>