/
RELNOTES
1618 lines (1432 loc) · 64.1 KB
/
RELNOTES
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
NSD RELEASE NOTES
4.1.18 (upcoming)
================
FEATURES:
- xfr-inspect, it is not installed, it prints xfr files from /tmp
made with 'make xfr-inspect' in the source dir.
- retry timeout between sending notifies dropped from 15 to 3 sec.
BUG FIXES:
- Fix gcc 7.1.1 warnings.
4.1.17
================
FEATURES:
- zone parser parses type AVC (it has TXT format).
- Fix #1272: use writev to put tcp length field with data for outgoing
zone transfer requests.
BUG FIXES:
- Fix potential null pointer in nsec3 adjustment tree.
- Fix text format of deletes for CDS and CDNSKEY, single 0 to represent
empty base64 or hex string.
4.1.16
================
FEATURES:
- zone parser can parse acronyms for algorithms ED25519 and ED448.
- Fix 1243: Option to make NSD emit really minimal responses,
minimal-responses: yes in nsd.conf.
BUG FIXES:
- Calculate new udb index after growing the array, fix from
Chaofeng Liu.
- Fix missing _t to _type conversion for disable-radix-tree option.
- Printout serial error with hint it may be too big.
- Fix 1228: OpenSSL include is not guarded with HAVE_SSL
- Patch for expire state in multi-master when masters includes
broken master, from Manabu Sonoda.
- minor manpage fix.
4.1.15
================
BUG FIXES:
- Fix nsd-control and ipv6 only.
- Squelch zone transfer error address family not supported by protocol
at low verbosity levels.
- Fix #1195: Fix so that NSD fails on non-compliant values for Serial.
- Fix to rename _t typedefs because POSIX reserves them.
- Fix that nsec3 hash collisions only reported on verbosity level 3.
4.1.14
================
FEATURES:
- Fix #1132 for SERVFAIL zones perform backoff, and remembers the
timeout on next startup.
BUG FIXES:
- Fix null memcpy for radixtree with single link element.
- Robust fix against missing master in tcp_open for xfrd.
- Fix wildcards in include: config statements with chroot enabled.
- suppress compile warning in lex files.
- Fix to try every master once, then wait for timeout or notify.
- Save backoff timeout into xfrd.state file, this file has a higher
version number now. Old files are skipped silently (causes
refresh) and created as new files upon exit.
- Fix restart of zone transfers when new config becomes available.
4.1.13
================
FEATURES:
- multi-master-check: yes can be used to check all masters for the
last version, using the higher version from the configured masters,
from Manabu Sonoda.
- Support RR type OPENPGPKEY from RFC 7929.
- Can config key algorithms with the digest name, eg. 'sha256'.
- configure --disable-radix-tree for about 15% lower memory usage.
- for type SRV add A/AAAA to the additional section (if possible),
just like we already do for type MX.
- more extensible edns option handling.
BUG FIXES:
- Fix compile warnings about unused result from write and strtol.
and signcompare in minmax retrytime.
- Fix #812: fix that make depend fails after distribution.
- Fix #817: xfrd update failed loop.
- Add robustness against unallocated data in nsec3 trees.
- Fix README spelling error of BSD license (reported by Joerg Jung).
- Fix multimaster for not tried full zone transfer for a expired zone.
- Fix #827: fix compile with openssl 1.1.0 with api=1.1.0.
4.1.12
================
BUG FIXES:
- Fix malformed edns query assertion failure, reported by
Michal Kepien (NASK).
4.1.11
================
FEATURES:
- When tcp is more than half full, use short timeout for tcp session.
- Patch for {max,min}-{refresh,retry}-time from YAMAGUCHI Takanori.
- Fix #790: size-limit-xfr can stop NSD from downloading infinite zone
transfer data size, from Toshifumi Sakaguchi. Fixes CVE-2016-6173
JVN#63359718 JPCERT#91251865.
BUG FIXES:
- Fix build without IPv6, patch from Zdenek Kaspar.
- Fix #783: Trying to run a root server without having configured it
silently gives wrong answers.
- Fix #782: Serve DS record but parent zone has no NS record.
- Fix nsec3 missing for nsec3 signed parent and child for DS at zonecut.
4.1.10
================
FEATURES:
- ip-freebind: yesno option in nsd.conf sets IP_FREEBIND socket option
for Linux, binds to interfaces and addresses that are down.
- NSD includes AAAA before A for queries over IPV6 (in delegations).
And TC is set if no glue can be provided with a delegation because
of packet size.
- print notice that nsd is starting before taking off.
BUG FIXES:
- Fix for openssl 1.1.0, HMAC_CTX size not exported from openssl.
- Fix #751: NSD fails to occlude names below a DNAME.
- If set without nsd.db print "" as the default in the man pages.
- Fix #755: NSD spins after a zone update and a lot of TCP queries.
- Fix for NSEC3 with zone signed without exact match for empty
nonterminals, the answer for that domain gets closest encloser.
- #772 Document that recvmmsg has IPv6 problems on some linux kernels.
4.1.9
================
BUG FIXES:
- Change the nsd.db file version because of nanosecond precision fix.
4.1.8
================
FEATURES:
- #732: tcp-mss, outgoing-tcp-mss options for nsd.conf, patch
from Daisuke Higashi.
- #739: zonefile changes when mtime is small are detected on reload,
if filesystem supports precision mtime values.
- RR type CSYNC (RFC7477) syntax is supported.
BUG FIXES:
- take advantage of arc4random_uniform if available, patch from
Loganaden Velvindron.
- Fix flto check for OSX clang.
- Define _DEFAULT_SOURCE with _BSD_SOURCE for glibc 2.20 on Linux.
- Fix #736: segfault during zone transfer.
- Fix #744: Fix that NSD replies for configured but unloaded zone
with SERVFAIL, not REFUSED.
4.1.7
================
FEATURES:
- support configure --with-dbfile="" for nodb mode by default, where
there is no binary database, but nsd reads and writes zonefiles.
- reuseport: no is the default, because the feature is not troublefree.
- configure --enable-ratelimit-default-is-off with --enable-ratelimit
to set the default ratelimit to disabled but available in nsd.conf.
- version: "string" option to set chaos version query reply string.
BUG FIXES:
- Fix zones updates from nsd parent event loop when there are a lot
of interfaces.
- portability fixes.
- patch from Doug Hogan for SSL_OP_NO_SSLvx options, for the new
defaults in the ssl libraries.
- updated contrib/nsd.spec, from Bálint Szigeti, with new configure
options.
- Allocate less memory for TSIG digest.
- Fix #721: Fix wrong error code (FORMERR) returned for unknown
opcode. NOTIMP expected.
- Fix zonec ttl mismatch printout to include more information.
- Fix TCP responses when REUSEPORT is in use by turning it off.
- Document default in manpage for rrl-slip, ip4 and 6 prefixlength.
- Explain rrl-slip better in documentation.
- Document that ratelimit qps and slip are updated in reconfig.
- Fix up defaults in manpage.
4.1.6
================
BUG FIXES:
- Fix #701: Fix that AD=1 set in a BADVERS response.
- Fix typo in zonec.c inside error message.
- Fix #711: Document that debug-mode yes is used for staying
attached to the supervisor console.
- Document verbosity 3 prints more information.
- nsd-checkconf warns for master zones with no zonefile statement.
- Fix start failure when many file descriptors are in use.
- The servfail rcode is not printed with a space in the middle.
- print failed token for config syntax error or parse error.
4.1.5
================
BUG FIXES:
- Fix #706: default port 53 not opened on ip4 because of getaddrinfo
hints initialisation failure.
4.1.4
================
FEATURES:
- RFC7553 RR Type URI support.
- removed hardcoded interface limit, --with-max-ips removed.
- SO_REUSEPORT support, by default on Linux, or with reuseport: yes.
- Admitted axfrs are logged at verbosity 1. Refused at verbosity 2.
- --enable-pie and --enable-relro-now options for a safer executable.
BUG FIXES:
- Fix NSID response for short edns sizes.
- Fix that for expired zones NSD performs an AXFR and accepts newer
and older serial numbers.
- Document that minimal responses only minimizes responses to fit
in one datagram. It does not minimize smaller responses.
- Fix #618: documented need to list ip-addresses separately in
nsd.conf if there are multiple, because the source address of
replies can otherwise go wrong.
- Fix that notify from nsd-control contains soa serial.
- Fix #698 formatting errors and typos in nsd.8.in.
4.1.3
================
FEATURES:
- nsd-control addzones and delzones read list of zones from stdin.
- hmac sha224, sha384 and sha512 support, patch from David Gwynne.
- max-interfaces raised to 32.
BUG FIXES:
- Fix #665: when removing subdomain, nsd does not reparse parent zone.
- Fix task and zonestat files to be stored in a subdirectory in tmp
to stop privilege elevation.
- Fix crash in zone parser for relative dname after error in origin.
- Fix that formerrors are ratelimited.
4.1.2
================
FEATURES:
- Incoming notifies have serial number logged (at verbosity 1).
BUG FIXES:
- Remove some duplicate header includes (from Brad Smith).
- Fix tcp waiting list for zone transfers where the bind and connect
calls fail.
- Fix segfault in zone reader on invalid input. (thanks John Van de
Meulebrouck Brendgard)
- Fix segfault on double origin in zone reader (thanks John Van de
Meulebrouck Brendgard).
- Fix b64pton out of bounds error on invalid zonefile input.
(thanks John Van de Meulebrouck Brendgard)
- Fix origin directive from unused old value and subdomain parser
failure, reported by John Van de Meulebrouck Brendgard.
- Fix use after free after zonefile syntax error followed by ttl
or origin directive, reported by John Van de Meulebrouck Brendgard.
- Fix syntax error followed by too many TXT elements parse crash
reported by John Van de Meulebrouck Brendgard.
- Fix buffer overflow in config parse of domain name,
reported by John Van de Meulebrouck Brendgard.
- Use reallocarray for integer overflow protection, patch submitted
by Loganaden Velvindron.
- Fix allocation integer overflow checks.
- Fix #654: Fix contradiction in notify logging verbosity level.
- Fix #655: Fix contradiction in verbosity for zone transfers.
- Made log message more consistent, changed 'axfr refused' log message
to be more consistent with other messages. Also notify refused.
- verbosity 2 logs axfr refused and notify refused.
verbosity 1 contains less log messages.
4.1.1
================
FEATURES:
- RFC 7344: CDS and CDNSKEY (read record types).
- per zone statistics with --enable-zone-stats, config zone with
zonestats: "name", zones configured with the same string are added.
- Disabled use of SSLv3 in nsd-control.
- nsd-checkconf -f prints out full name of pidfile (with dir).
- Synthesize CNAMEs with same TTL as DNAME.
BUG FIXES:
- Fix that expired zones stay expired after a server restart.
- Fix "xfrd_handle_ipc: bad mode" log errors when compiled
with --disable-bind8-stats.
- Fix #616: retry xfer for zones with no content after command.
- Fix char used as array index warnings on NetBSD.
- Fix that queries for noname CH TXT are REFUSED instead of nodata.
- Fixes for wildcard addition and deletion, speedup for some cases.
- Fix that failure to add tcp to tcp base does not leak the socket.
- Patch nsd_munin_ from Philip Paeps to use type ABSOLUTE.
- Fix spinning NSD with lots of failing transfers, due to pointer
comparison using void pointer subtraction (from Otto Moerbeek).
- Fix bug#637: fix that nsd.db grows limitlessly, an off by one
on one megabyte free chunks, created during AXFRs of large zones,
that caused the one megabyte chunk to be leaked.
- Fix casts for ctype functions (from Todd Miller).
- correct some hyphen-used-as-minus-sign (from Andreas Schulze) in
man pages.
- Fix zonesdir chroot error message.
4.1.0
================
FEATURES:
- database: "" starts without mmap of database. Less memory is used,
zones are read from text zonefile.
- optimised zonefile parse code and zonefile write code.
- zonefiles-write option in nsd.conf, enabled when database is "".
The server writes changed zonefiles to disk every hour.
- xfrdfile: "" disables xfrd.state. If enabled, zones that are
same as before are not checked for a serial update at server start.
- include: "foo/nsd.d/*.conf" works, wildcard glob on includes.
- nsd shuts down during init process if given signal.
- log-time-ascii option, default yes, with readable timestamp in log.
- nsd-control addzone reports if zone already exists.
- Fix #564: add nsd-checkzone tool to check zonefile correctness.
- Increased default --with-max-ips from 8 to 16, this increases the
number of interfaces you can specify in nsd.conf to listen to.
BUG FIXES:
- Fixed shutdown message sporadically not printed on exit
(Thanks Anand Buddhdev).
- Documented zonefile %s syntax in nsd.conf man page.
- Fix manpage to put colon after zonefiles check and write.
- Change from 'Zone" to "zone" with ".. serial .. is updated" log
message.
- Changed maxbackoff for no-content secondary zones from 4h to 24h.
- Fix print filename of encompassing config file on read failure.
- Fix delete or rename of a lot of zones and make it take a
non-enormous time.
- Speed up deletion of zone contents a lot, (56s to 1s), speeds up
delete, rename and AXFR for zones.
- Fix #571: unused variable and incompatible pointer warnings when
compiled on a system without INET6.
- Fix write_socket return value check in server.c (Thanks Brad Smith,
Mark Kettenis).
- Fix that xfrd reaps children also if the signal is lost.
- Fix #577: makefile incorrectly installed manpages from srcdir.
- Fix #587: Default value for statistics is 0.
- Fix #553: Improve TXT parsing.
- Fix #590: rrl log does not print wildcard as a star but escaped.
- Fix #591: rrl log messages at verbosity level 1.
- fix strptime implicit declaration error on OpenBSD.
- Fix -O3 compile flag to -O2 to avoid miscompilations.
- Allow user to override the -g -O2 CFLAGS in ./configure.
- Fix endian.h include for OpenBSD.
- Fix #600: document that provide-xfr provides AXFR and not IXFR.
- Fix rising-load-average or memory-leaks in OSes (Linux since 2.6),
that keep track of all past process parents, or leak memory
for them. Fix makes it so there is no very deep string of
process parents.
- Remove .LP after .SH in man pages.
4.0.3
================
BUG FIXES:
- Fix nsd.db unclean close check. Previous databases are considered
unclean by the code and are created anew.
- Adds nsd.db larger than 400Tb check for sanity. Also test if
filesize as documented in the file is correct.
- nsd waits for tasks to complete on stop, prevents nsd.db corruption.
- fix to not delete tmpdir too early in shutdown process.
- disabled udb checking functionality that made it very slow,
this was enabled when enable-checking was turned on.
4.0.2
================
FEATURES:
- Return REFUSED for queries to non-hosted zones.
BUG FIXES:
- Fix expired zones to give SERVFAIL, also when parent zone loaded.
- documented nsd-control zonestatus output in nsd-control manpage.
- remove mention of nsdc from nsd-checkconf manpage.
- Disabled recvmmsg and sendmmsg usage by default because kernel
versions have implementation issues: ipv6 ignored, security issues.
- Detect libevent2 install automatically by configure, and use
event2 header files if necessary.
- Fix #551: change Regent to Copyright holder in the LICENSE,
to match the definition on opensource.org for the BSD License.
- Fix #552: zonefile loads on nsd-control reconfig when the name
of the file has changed.
- Fix leak of zone name after zonefile read and fix malloc too
large that would be leaked in the radix tree.
- Fix from 3.2: make SOA RDATA comparisons in XFR more lenient (only
check serial).
- Fix that NSD will delete and recreate not-clean-closed databases.
4.0.1
================
FEATURES:
- recognizes ip-address and interface as synonyms for convenience.
- Support for EUI48 and EUI64 RR types enabled by default (RFC 7043).
- Support for CAA RRtype (RFC 6844).
- NSID can be set with "ascii_somestring" in ascii.
BUG FIXES:
- Fix xfrd when zone transfer TCP contains zero length packets.
- Fix for NSEC3 zones where parent zone is co-hosted, also NSEC3,
because AXFRs overwrote nsec3 administration in the child zone.
- Fix that bad IXFR updates do not result in double SOA records,
and that an AXFR is started (attempted) when the zone state seems
to be inconsistent with the master's zone state.
- Log ip address for sendto and sendmmsg failures.
- Fix segfaults after read of zones with rr type WKS from zonefile.
- Seed PRNG for openssl at start of daemon, fixes SSL connection issue.
- Bugfix #534: IXFR query loop over UDP for zones that are unchanged.
- (same as in 3.2.16): fix wildcard cname to nxdomain repeated rrset.
- (same as in 3.2.16): Bugfix #542: Match RRSIG TTL with SOA TTL in
negative response.
- Check if configure in srcdir collides with outofdir build.
- Fix #546: output format errors in nsd_munin_ (Thanks Tom Hendrikx).
- Fix printout of high-chars in TXT on NetBSD.
4.0.0 NSD 4.0
===============
FEATURES:
- documented in doc/NSD-4-features. Change configuration without
restart, direct nameserver control with nsd-control, support a
higher number of zones. Higher performance (compared to NSD3).
- nsdc is gone. Use kill -HUP for reload (also checks if zonefiles
have changed and rereads them), and kill -TERM for quit. Or use
nsd-control for detailed control.
- cron job for nsdcpatch is gone. nsd-control write creates zonefiles.
- nsd.db has a new format that compacts itself when it is changed,
thus nsdc patch is no longer necessary.
- nsd.db is memory mapped, NSD needs (part of) that mmap in ram.
- tcp-count can go above 1000; epoll/kqueue support with libevent.
- nsd-control reconfig for updates with no restart (zones, keys, ..)
- nsd-control-setup to create keys for nsd-control (enable nsd-control
with remote-control: yes in nsd.conf).
- the NSD 3 feature of special zone stats are not ported to 4 yet,
as it would entail a complete reimplementation of the feature.
FEATURES (incremental from BETA5):
- configure --disable-recvmmsg for compat with older Linux kernels,
by default it autodetects support in the kernel on the buildmachine.
- Fix time at 2038, uint32s changed to time_t, support 64bit time_t.
- Fix use of 32bit time, for 2038, thanks to Theo de Raadt for patch.
BUG FIXES (incremental from BETA5):
- Bugfix #518 Incorrect RRL prefix length option names in nsd.conf
man page from Ville Mattila.
- Fix that xfrd, and nsd-control, does not stop responding when reload
errors out. The pid is sent like it should by server_main.
- Fix that EOF in quoted string error does not cause reload to exit.
- Fixup errors from the stack code checker.
- Removed use of random when arc4random is available. Thus, random
and srandom are then not linked with the executable.
- Fix segfault with no logfile and chroot (Thanks Patrik Lundin).
4.0.0b5 BETA 5 release of NSD 4.0
==================================
FEATURES:
- Optimizations for startup, qps and tcp speed, beta bug fixes and
merge with code changes with NSD 3.2.16.
- nsd-mem tool (make nsd-mem) to estimate memory usage.
- Same as NSD 3.2.16: --enable-draft-rrtypes(EUI48, EUI64), rr-slip,
rrl-ipv[46]-prefix-length, ip-transparent config options.
- configure option --disable-flto.
- improved RRL logging (query details that caused blockage).
- nsd-control status prints out ratelimit if ratelimit is enabled.
- nsd-control verbosity prints out verbosity level without argument.
- Fix #491: pick program name (of executable) as syslog identity.
- printout percentage for long activities (to log). After about 5
seconds have passed.
BUG FIXES:
- The same fixes up to NSD 3.2.16.
- Fix that old zonefile does not override newer AXFR for slave zones.
- Nicer printout of notify.
- Fix tcp zonetransfer pipeline lookup function.
- Fix compile on bigendian netbsd alpha.
- Fixup the growth and shrinkage of nsd.db. This should use less
calls to remap and change the file and mmap size.
- notify information is logged at correct verbosity level, 1.
- Fix memory statistics in nsd_munin_.
- faster nsec3 updates.
- Fixup contrib/bug390.patch for 4.0.0b4.
- remove leak of nsec3.
- allocate radixtree in region for small (5%) total savings and
about 15% savings in the radixtree itself (due to many small alloc
savings in region).
- Patch from Lukas Wunner that makes nsd.conf include files work
inside chroot/etc environments on repattern and reconfig.
- Fix race on exit of nsd, for restarts, so that the pidfile-pid
process waits until port53 has been closed before exiting.
- Patch from Lukas Wunner that makes chroot more consistent.
Make all paths absolute with the chrootdir in front, or use
an absolute zonesdir with other paths relative to that.
- Fix segfault on repeated reconfigs, double free of zone apex name.
- Fix zone parser allocations are put in the db region.
- Fix memory leak in zone parser for txt record.
- Optimizations: -O3 if possible (user can override CFLAGS), udp
buffers are set to 1m by default (if socket options exist),
use recvmmsg and sendmmsg, or only recvmmsg, or recvfrom.
- nsd.db 12% smaller, no nsec3 hash storage. Also ups udb version
because of the format change. The nsd.db is recreated when a
different version number is detected on startup.
- Fix region-allocator for speedup of load and change of large data.
- Increase tcpbacklog default to 256 (silently capped to 128 on BSD).
For remote control keep it at 16, it has less TCP load.
It does not actually increase TCP performance (some except), but
reduces connection loss when there is a spike in TCP connections.
- unlink xfr file if transfer is stopped, timeouted or interrupted.
And unlink xfr file in progress when the zone is deleted.
4.0.0b4 BETA 4 release of NSD 4.0
==================================
BUG FIXES:
- remove -fwhole-program gcc flag usage. We cannot reliably detect
if it works without failure.
- fix zonefiles-check: entry in nsd.conf
- fix gcc warning, do not use uninit value for rng init.
- remove printout of "bad transfer" to the log for notimpl.
- printout log less verbosely, not every axfr packet.
- RRL documented in nsd.conf.sample
- Fix is_apex flag for zones read from udb.
- Fix that nsec3 zones are precompiled when read from udb. This
caused assertion failures.
- Less printout of 'bad transfer'.
- Fix AXFR of NSEC3 slave zone.
- Fix that old zonefile does not override newer AXFR for slave zones.
- Nicer printout of notify on verbosity 2.
4.0.0b3 BETA 3 release of NSD 4.0
==================================
BUG FIXES:
- applied patch from Robin Hack to remove double pid file truncation.
- repattern is called reconfig (because most config options are
picked up, except for superuser options (chroot, logfile, port))
- document that the zonefile attribute can be empty.
- documented that the _implicit_ pattern names are used internally.
- Added zonefiles-check option, default yes, check mtimes of zone files
on sighup and startup (from Robin Hack).
- Fix spurious assertion failure for some rrl blocks.
- Tabs and spaces nicer in nsd.conf.sample.
- List libevent in README.
- Fix configure for gentoo gcc and headers.
- do-ip4 and do-ip6 nsd.conf options just like unbound.
- do not leave task files in /tmp if nsd fails to startup because
of file permissions.
- create xfrdir on make install (does not remove on make uninstall,
because this could be /tmp).
- Fix segv if xfrdir does not exit.
- log ip address with tcp failure.
- Fix time calculation of zone transfer.
4.0.0b2 BETA 2 release of NSD 4.0
==================================
FEATURES:
- Add and remove zones from nsd.conf with nsd-control repattern.
- Merge changes from 3.2.15 (such as xname-rcode fix).
BUG FIXES:
- Fix for use with libev.
- 'nsd-control start' runs an absolute path to start sbin/nsd.
- Fix for use with libevent-2.1.2.
- --with-logfile sets the logfile inside the example documentation.
- Fixed addzone and delzone inside chroot (thanks Will Pressly).
- Fix make outside of source directory.
4.0.0b1 BETA 1 release of NSD 4.0
==================================
FEATURES:
- add and remove zones without restart.
- nsdc is gone, use nsd-control for direct server control.
- performance increases
- support lots of zones
- and more ...
- longer desc in doc/NSD-4-features
BUG FIXES:
- core code is fixed like 3.2.15r3763 (12 dec 2012).
3.2.16 (development branch)
=================================
FEATURES:
- New config option "ip-transparent:" to allow NSD to bind to
non local addresses. Default no.
- Use IPV6 minimum MTU settings with TCP to reduce failures that
are caused by delays in learning working PMTU when communicating
through a tunnel.
- Bugfix #496: Support for EUI48 and EUI64 RR types. Experimental,
turned off by default. Enable with --enable-draft-rrtypes.
- New config option "rrl-slip:" to set the average number of
packets discarded before we send back a truncated response.
- New config option "rrl-ipv4-prefix-length:" and
"rrl-ipv6-prefix-length:" to set the prefix lengths.
- Improved RRL logging, also print triggering query src address and
QTYPE.
- Provide RRL documentation in nsd.conf.sample.
BUG FIXES:
- Bugfix #357: Parent process waits until children closed down
sockets, to prevent NSD failing to bind to sockets when restarting.
- Bugfix #487: lookup3.c determine endianness for BSD systems.
- Bugfix #491: pick program name (0th argument) as syslog identity.
- Bugfix #494: Exit with return code 1 if socket code fails.
- RRtypes ASFDB, RP, RT should not compress dnames.
- Fix outgoing-interface: Don't fail if family is IPv6 but
only IPv4 outgoing-interface is set, or vice versa.
- RRtypes ASFDB, RP, RT should not compress dnames.
- Check that zone directory is within chroot directory.
- Better XFR checking, fallback to AXFR (if allowed) if three
malformed XFR packets have been seen.
3.2.15
=================================
FEATURES:
- Support for ILNP RR types: NID, L32, L64, LP (RFC6742).
- RRL, --enable-ratelimit at configure time and config options.
- TSIG initialization only fails when there is no digest found
at all.
BUG FIXES:
- Bugfix #478: Declaration after statement (for gcc 2.95).
- Bugfix #483: Better error message in case of TSIG error.
- Bugfix #485: TTL should not be greater than 2^31 - 1.
- Fix RCODE when CNAME loop final answer does not exist, should
return NXDOMAIN as stated by RFC 6604.
- Fix --disable-full-prehash bug, where after multiple incoming
IXFRs, NSEC3 can be removed unjustified.
3.2.14
================
FEATURES:
- TCP writev support.
BUG FIXES:
- Fix build on OpenBSD (thanks Oliver Peter).
- Prioritize notify sender for requesting XFR (thanks Ilya Bakulin).
- Fix crash in zonec if TXT string too long (thanks Ilya Bakulin).
- tzset before chroot for correct timezone (thanks Camiel Dobbelaar).
- Fix --disable-full-prehash bug when nsdc patch happens while ixfr too,
it did not rehash the new database.
- Bugfix #464: Conditionally define MAXHOSTNAMELEN.
3.2.13
================
BUG FIXES:
- Fix for nsd-patch segfault if zone has been removed from nsd.conf
(thanks Ilya Bakulin).
- Bugfix #460: man page correction - identity.
- Bugfix #461: NSD child segfaults when asked for out-of-zone data
with --enable-zone-stats. [VU#517036 CVE-2012-2979]
3.2.12
================
BUG FIXES:
- Fix for VU#624931 CVE-2012-2978: NSD denial of service
vulnerability from non-standard DNS packet from any host
on the internet.
http://www.nlnetlabs.nl/downloads/CVE-2012-2978.txt
3.2.11
================
FEATURES:
- Fallback to AXFR if IXFR is unknown at the primary. NSD considers
IXFR unknown at the primary if there is a negative response for the
IXFR RRtype. This does not override the value for
'allow-axfr-fallback'.
- Allow for reading in new DNSKEY algorithm mnemonics (RFC5155,
RFC5702, RFC5933, and RFC6605 (ECDSA)).
- Zone statistics, enable with --enable-zone-stats. This stores the
BIND8 stats per zone in a configurable statistics file. This option
does not scale and should therefore not be enabled when serving
many zones.
- Support for TLSA RRtype (DANE).
BUG FIXES:
- Fix for qtype ANY for a wildcard domain in NSEC signed zone: Don't
add the wildcard domain NSEC into the answer section. Instead,
put the wildcard expanded NSEC into the answer section and keep the
wildcard domain NSEC in the authority section.
- Fix for accept spinning reported by OpenBSD.
- Fix restart failed due to bad ixfr packet because of zone removed
from nsd.conf.
- Bugfix #453: typo in nsdc man page.
OPERATIONAL NOTES:
- NSD uses the query name for dname compression again (Fix #235
had as side effect that this didn't happen anymore and is hereby
undone).
3.2.10
================
BUG FIXES:
- Bugfix #421: Truncate pidfile on shutdown, before unlink.
- Bugfix #423: Fix slow zone transfer processing due to
'Fix is_existing flag for ENT' bugfix.
- Fix bug #430: segfault when MAX_INTERFACES set to more than 65K.
- Fix configure.ac strptime check for gcc 4.6.2, acx_nlnetlabs update.
3.2.9
================
FEATURES:
- Minimize responses to reduce truncation: NSD will only add optional
records to the authority and additional sections when the response
size does not exceed the minimal response size.
The minimal response size is 512 (no-EDNS), 1480 (EDNS/IPv4),
1220 (EDNS/IPv6), or the advertized EDNS buffer size if that is
smaller than the EDNS default.
The feature is enabled by default. You can disable it by configuring
NSD with --disable-minimal-responses.
- Less NSEC3 prehashing. This will make NSD handle zone transfers
faster, but will decrease the performance of NXDOMAIN and wildcard
NODATA responses. Full prehashing is enabled by default. If you want
less NSEC3 prehashing, configure NSD with --disable-full-prehash.
Thanks Secure64 for the patch.
BUG FIXES:
- Bugfix #302: nsd accepts XFR but refuses to re-read the slave zone.
- Bugfix #365: set patch style and zonec verbose for nsdc.
- First step of bug #369: RRSIG DNSKEY sets zone to be treated DNSSEC.
- Bugfix #375: typos in nsd.conf.5.
- Bugfix #381: Binary escaped and transfers.
- Bugfix #397: Don't allow relative domain names as origin in $INCLUDE
directives.
- Fix printout of IPSECKEY by nsd-patch.
- Fix is_existing flag for ENT when domain that has a shared ENT
is deleted by IXFR. (ENT == Empty Non-Terminal)
- Fix bug if the zonefile is changed for a secondary but stored
transfers are applied, and stop it from applying ixfr to empty zone.
The zone is flagged with error and AXFR-ed.
- Fix to have no authority NS set processing for CNAMEs.
- Fix nsd-checkconf to check tsig algorithms properly.
- Set the AA bit on responses that have an authoritative CNAME.
- Fix denial of existence response for empty non-terminal that looks
like a NSEC3-only domain (but has data below it).
OPERATIONAL NOTES:
- nsd.db version number increased because NSD 3.2.7 and earlier
zonec is not compatible due to the TXT strings change. Please
run nsdc rebuild before running NSD 3.2.9 and later versions.
3.2.8
=============
BUG FIXES:
- Do setusercontext() before chroot(), otherwise login.conf etc. are
required inside chroot.
- Bugfix #216: Fix leak of compressiontable when the domain table increases
in size.
- Bugfix #348: Don't include header/library path if OpenSSL is in /usr
- Bugfix #350: Refused notifies should log client ip.
- Bugfix #352: Fix hard coded paths in man pages.
- Bugfix #354: The realclean target deletes a bit too much.
- Bugfix #357, make xfrd quit with many zones.
- Bugfix #362: outgoing-interface and v4 vs. v6 leads to spurious
warning messages.
- Bugfix #363: nsd-checkconf -v does not print outgoing-interface ok.
- Bugfix: nsd-checkconf -o outgoing-interface omits NOKEY.
OPERATIONAL NOTES:
- Use 'make clean' to clean up files that make created.
- Use 'make realclean' to also clean up files that were generated by
running ./configure.
- Use 'make devclean' to also clean up autoconf, autoheader files.
3.2.7
=============
BUG FIXES:
- Bugfix #253: Don't put NS RRs in a response with QTYPE=DS.
- Bugfix #320: use arcrandom(4) for QID generation if available.
- Bugfix #328: nsd-checkconf overrun.
- Bugfix #343: nsdc update fix.
- Bugfix #347: Wrong NSEC3 returned for nodata response QTYPE=DS no delegation.
- Bugfix: Allow for huge amount of strings in TXT (and other) records.
- Bugfix: nsdc can now deal with tsig algorithms other than hmac-md5.
- Fixed several parts in the documentation, including #306, #345.
3.2.6
=============
BUG FIXES:
- Bugfix #314: correctly print NSEC next field, escape spaces and
fix label overflows.
FEATURES:
- Expand command line option '-a' and config option 'ip-address:'
with port number.
OPERATIONAL NOTES:
- Configure options --disable-dnssec, --disable-nsid, --disable-tsig
are removed.
- Configure option --max-interfaces is renamed to --max-ips.
3.2.5
=============
BUG FIXES:
- NSD will not start if chroot is configured, but changing root is
not possible (it used to ignore the badly configured chroot).
- Make use of the more secure strl* functions.
- Bugfix #303: spelling error.
FEATURES:
- New option 'nsid:', to specify the NSID (Bugfix #298).
- The default chroot can be set with --with-chroot=<dir>.
If not set, by default chroot will not be used (thanks Jakob Schlyter).
- Optimized zonec and b64_pton compatibility code (thanks Martin Svec).
- Optimized memory allocations. Use mmap/munmap instead of malloc/free.
Experimental, by default off. Enable it at build time with
--enable-mmap (thanks Martin Svec).
OPERATIONAL NOTES:
- NSID support is now enabled by default.
3.2.4
=============
BUG FIXES:
- Bugfix #269: Additional C99 syntax.
- Bugfix #276: Zonec prints debug data to stderr.
- Bugfix #286: Document verbosity levels in nsd.conf manual page.
- Bugfix #288: Ignore SIGHUP to child processes.
- Fix typo in include file for setusercontext.
FEATURES:
- Support DLV records.
- New option 'tcp-query-count:', to limit the maximum number of
DNS queries on a single tcp connection.
- New option 'tcp-timeout:', to override the default tcp timeout.
The default can also be set at build time, --with-tcp-timeout=<number>.
- New option 'notify-retry:', to configure how many times NSD should retry
a NOTIFY message.
- New options 'ipv4-edns-size:' and 'ipv6-edns-size:'. to set your preferred
EDNS buffer size.
OPERATIONAL NOTES:
- UDP/IPv4 sockets have new options set that will disable the DF flag in IP
packets.
3.2.3
=============
BUG FIXES:
- Bugfix #236: Allow RRs before the SOA in a zonefile.
- Bugfix #249: Remove the C99 code.
- Bugfix #253: Don't put NS RRs in a response with QTYPE=DNSKEY.
- Bugfix #263: Make TSIG algorithm comparison case insensitive.
- Bugfix #266: Build failed on systems without strptime.
- Bugfix: install hickup.
- Fix to use 4096 EDNS limit for IPv6 on Linux.
3.2.2
=============
BUG FIXES:
- Off-by-one buffer overflow fix while processing the QUESTION section.
- Return BADVERS when NSD does not implement the VERSION level of the
request, instead of 0x1<FORMERR>.
- Bugfix #234.
- Bugfix #235.
- Reset 'error occurred' after notifying an error occurred at the $TTL or
$ORIGIN directive (Otherwise, the whole zone is skipped because the
error is reset after reading the SOA).
- Minor bugfixes.
3.2.1
=============
OPERATIONAL NOTES:
- NSD will now fallback to AXFR, only if the master does not support IXFR.
- You can adjust nsdc patch to skip textfile patching. This will
increase the patching process, but will not output to zonefiles
anymore. By default, this is off.
BUG FIXES:
- When configuring, don't do strptime test when cross-compiling.
- Bug #230: Output non-error messages to stdout.
- Better error message when ixfr.db old file format is read.
- Bug #218: shared UDP query for all interfaces.
- Bug #222: Remove bashism from nsdc script.
- Nicer check for SHA-256 functionality.
- Fixed some minor memory leaks that occurred on reload.
- nsdc: check if a lockfile has not gone stale, when lock failed.
- Bugfix strptime compatibility function
FEATURES:
- New configuration option 'allow-afxr-fallback', "yes" by default. If
set to "no", NSD will never do AXFR fallback, even if the master
does not support IXFR.
- Allow file rotation on nsd.log.
- The new nsd-patch options -s and -o allows you to skip writing
zonefiles and store the output directly to a database file,
respectively.
3.2.0
=============
OPERATIONAL NOTES:
- Format of ixfr.db has changed. When you are planning an upgrade to the
new NSD release, make sure to process the old ixfr.db before starting
the new release (by running nsdc patch).
- IXFR is transmitted over TCP by default instead of UDP. If you want to
continue the use of IXFR/UDP, please modify your zone configuration
file to:
request-xfr: UDP 1.2.3.4 tsigkey
We strongly recommend to enable TSIG if you send IXFR over UDP.
When all masters fail to transmit IXFR/UDP, slave will fallback to
IXFR/TCP and eventually AXFR/TCP.
- nsd-patch prints errors to stderr instead of stdout.
BUG FIXES:
- Only normalize dnames in rdatas when rrtype is listed in RFC 4034,
section 6.2: Canonical RR Form, following
draft-ietf-dnsext-dnssec-bis-updates (affects RRSIG and NSEC records).
- Typo in zonec manpage.
- Bugfix in log_finalize.
- Fix race condition between nsdc patch and server reload.
FEATURES:
- AXFR/TCP fallback in case of failing IXFR zone transfers.
- RFC 4635: support for hmac-sha1 and hmac-sha256 TSIG algorithm
identifiers, "Bugfix #130".
- Configure the source ip-address for notifies (master) and zone
requests (slave) in nsd.conf, "Bugfix #148".
- nsd-notify and nsd-xfer allow you to configure the outgoing
hostname and source port, in addition to the source address.
- Additional debug and verbose log messages.
3.1.1
=============
BUG FIXES:
- Try to avoid race conditions with NSD reloading and nsdc running,
by writing pidfile before closing old parent process.
- Fixed NSEC3 memory leak in the case NSEC3 is not needed.
- Fixed some memory leaks that happened on error, mostly on
zone transfer errors.
- Bugfix #191: nsd-checkconf allowed only (max_interfaces-1) interfaces.
FEATURES:
- The number of maximum interfaces allowed is configurable with
--with-max_interfaces=<number> (thanks John Lightsey).
3.1.0
=============
OPERATIONAL NOTES:
- Default locations of nsd.db, ixfr.db & xfrd.state are changed to
the /var/db/nsd directory.
BUG FIXES:
- Zone compiler gives more sane error messages when out of
diskspace and bug #172: when compiling single zone file.
- Changed man pages format from mdoc to mansun, to support the Solaris OS.
- Log tcp read error only when connection not reset by peer or when
verbosity level is high.
- RRs are compared without checking the TTL value.
FEATURES:
- NSD is now NSEC3 enabled by default. You can disable it by configuring
NSD with --disable-nsec3.
- Added "hide-version" configuration setting. Enabling this feature
stops NSD from answering to CHAOS class version requests.
- Added bind2nsd 0.5.0 (http://bind2nsd.sourceforge.net) in contrib/.
- Report source and zone for denied AXFR attempts.
3.0.8
=============
FEATURES:
- Better logging for nsd-notify (show 'broken' zone)
- Add configuration for chkconfig to control nsd service.
BUG FIXES:
- Fixed nsdc start when nsd already running: do not initialize server,
since it is already running.
- Fixup bug where data related files are looked up in the wrong
directory when chrooted with chrootdir ending with a slash.
- Fixup bug where nsd would return FORMERR if received an edns
query with version set to zero and rdlen larger than zero.
- Fixed strptime, so that zonec will also work on systems with broken
strptime (like leopard :-))
- Do not answer nsec3 wildcard information when DO bit is not set
- Better logging when creating database failed.
- Various spelling errors
3.0.7
=============
BUG FIXES:
- Error handling for malformed IXFRs improved.
- Fixed man pages, consistent syntax.