1 NSD RELEASE NOTES 2 3 4.14.0 4 ================ 5 FEATURES: 6 - Fix #137: Adds tcp-listen-queue: number config option to set 7 the TCP backlog. And the default for the listen TCP backlog is 8 set to -1 on BSDs and Linux. 9 - Merge #444: Refactor RDATA storage to reduce memory footprint 10 BUG FIXES: 11 - Fix empty debug statement body in catalog consumer zone process. 12 - Merge #459: Check for libfstrm version >= 0.4. 13 - For #459: Add configure check for fstrm_tcp_writer_options_init 14 in addition to the check for fstrm_iothr_init. 15 - Merge #460: Add XDP_OBJ fixing link errors for XDP. 16 - Fix XDP build error with --enable-checking 17 - Resolve warnings about mixed declaration and code and unused variable 18 - Fix confusing report for default send and receive buffer-size by 19 nsd-checkconf 20 - Fix to log more details when send-buffer-size or receive-buffer-size 21 is not granted, on verbosity level 2. 22 - Update in acx_nlnetlabs.m4 to version 49. 23 - Update in acx_nlnetlabs.m4 to version 50, with cache value for 24 malloc function check. 25 - Update acx_nlnetlabs.m4 to version 51, with nonstring unknown 26 attribute warning fix. 27 - Merge #466: Do not delete nodes from non-existent zone's NSEC3 hash 28 trees 29 30 4.13.0 31 ================ 32 FEATURES: 33 - Use '(all)' and '(none)' for the socket server affinity 34 log output instead of '*' and '-'. 35 - The --enable-bind8-stats feature, was already enabled by default, 36 is described as enabled by default in usage. 37 - The --enable-zone-stats feature is enabled by default. It can be 38 turned on with config like `zonestats: "%s"`. 39 - The --enable-ratelimit feature is enabled by default. The 40 ratelimit value is off by default. It can be turned on with 41 config like `rrl-ratelimit: 200`. 42 - The --enable-dnstap feature is enabled by default. If fstrm-devel 43 or protobuf-c are not found by configure it prints an error. 44 It can be turned on with config like `dnstap-enable: yes`. 45 - Change default for send-buffer-size to 4m, to mitigate a 46 cross-layer issue where the UDP socket send buffers are 47 exhausted waiting for ARP/NDP resolution. Thanks to Reflyable 48 for the report. 49 - Disable TLSv1.2 if TLSv1.3 is available. 50 - Merge #449: Add useful logging for XoT transfers. 51 - Merge #425: Add experimental XDP (AF_XDP) support for UDP traffic 52 - Merge #455: --with-dbdir option for configure to set the base 53 directory for the xfrd zone timer state file, the zone list file 54 and the cookie secrets file. Thanks Simon Josefsson. 55 - Merge #456: Spelling fixes in metrics.c. Thanks Simon Josefsson. 56 57 58 BUG FIXES: 59 - Fix punctuation of nsd -h output for the -a option. 60 - Fix checkconf unit test for when metrics are not enabled. 61 - Prometheus metrics tests require --enable-zone-stats. 62 - Add unit test for socket server affinity log output. 63 - Move xfrd-tcp unit test to its own file. 64 - Fix contrib/nsd.spec to omit configure flags that are default or 65 that do not exist. 66 - Fix to remove mention of obsolete root-server option. 67 - Fix mention of draft-rrtypes and root-server configure options. 68 - Fix ci workflow for enable dnstap. 69 - Fix to remove use of sprintf from metrics. 70 - Fix for fstrm and protobuf-c for ci workflow coverity-scan. 71 - Fix for parallel build of dnstap protoc-c output. 72 - Fix to remove unneeded mkdir from Makefile. 73 - Fix dnstap to use protoc and keep dnstap_config.h unchanged if 74 possible. 75 - Fix to provide doc for --enable-systemd. 76 - Fix to remove debug printout for configure dnstap header. 77 - Fix #441: SystemD script for NSD prevents using chroot. 78 - Fix to add checks for compression pointers and too long dnames in 79 internal dname routines, dname_make and ixfr dname_length. 80 - Fix to remove shell assignment operator from Makefile for DATE. 81 - make depend. 82 - Fix bitwise operators in conditional expressions with parentheses. 83 - Fix conditional expressions with parentheses for bitwise and. 84 - Merge #445: contrib/nsd.openrc.in: use supervise-daemon and 85 add `need net`. 86 - Fix #446 nsd_size_db_in_mem_bytes (size.db.mem) metric not 87 updated on reload. 88 - Merge #447: Minimize disruptions on reconfig. 89 - For #447: Updated simdzone to latest commit. With the padding 90 test changes. 91 - For #447: use need_to_send_reload to detect if a reload is issued. 92 - For #447: acl_list_equal already tests for TSIG key changes, so 93 removed the duplicate checks. 94 - For #447: log crypto error with the SSL_write error. 95 - Update simdzone with support for --enable-pie. 96 - Merge #454 from jaredmauch: handle rare case but seen in 97 production where data->query is NULL. 98 - Fix zonestatfd check 99 - Fix code analyzer warning, and bail out of handle_tcp_writing 100 and handle_tls_writing early when data->query is NULL. 101 102 4.12.0 103 ================ 104 FEATURES: 105 - Merge #418: Support for DSYNC, EID, NIMLOC, SINK, TALINK, DOA, 106 AMTRELAY and IPN resource record types. 107 - Merge #420: Zones get state "old-serial" with 108 `nsd-control zonestatus` when the served serial is older than 109 the one received by the transfer daemon. 110 - Merge #429: Add prometheus metrics 111 112 BUG FIXES: 113 - Fix re-enable to configure dns-cookies from config file, which was 114 accidentally removed with the 4.11.1 release. 115 - Fix #426: nsd crashes with patterns in config_apply_pattern. 116 - Fix for #430: Confusing documentation: word "outgoing". 117 - Fix for #430: Confusing documentation: word "outgoing". Add wording 118 to tcp-count, xfrd-tcp-max, xfrd-tcp-pipeline options. 119 - Fix that nsec3 prehash after a full transfer can create the nsec3 120 zone trees if they are needed. 121 - Fix in nsd-mem for a zone with ixfr data. 122 - Fix ixfr read routine for use after the temp region is freed of rr. 123 - Fix ixfr file read to manage numlist in temp domains. 124 - Fix nsd-mem to clean ixfr storage. 125 - Fix log print assert in server sockets for printing '-' empty. 126 - Fix notify_fmt test for xfrd file location. 127 - Fix sanitizer warnings in read_uint32. 128 - Fix sanitizer warning in tsig write of zero length mac and otherdata. 129 - Fix to please sanitizer for ixfr store of data in cancelled state. 130 - Fix multiple zone transfers in one reload so that xfrd does not 131 check the update as failed and restart the transfer. 132 - Fix read of ixfr file with rdata subdomain. 133 - Fix test checkconf for metrics options. 134 - Updated simdzone to include fixes for NSAP-PTR, LOC, 135 uninitialized reads, and comment nit. 136 - Fix #436: Fix print of RR type NSAP-PTR. 137 - Fix unit test call to zone_parse_string and initialize padding. 138 - Fix escape more characters when printing an RR type with an 139 unquoted string. 140 - Fix memory leak in the process of addzone. 141 - Fix to update common.sh for speed of kill_pid. 142 - Fix nsd-checkzone ixfr create cleanup on exit. 143 144 145 4.11.1 146 ================ 147 BUG FIXES: 148 - Fix #415: Fix out of tree builds. Thanks Florian Obser (@fobser). 149 - Fix #414: XoT interoperability with BIND and Knot 150 - Fix #421: old-main can quit before the reload process received 151 from old-main that it is done on the reload_listener pipe. 152 Thanks Otto Retter. 153 - Fix whitespace in comment. 154 - Fix #424: Stalled updates after corrupt transfer. 155 156 4.11.0 157 ================ 158 FEATURES: 159 - Support reloading configuration on SIGHUP. 160 - Fix #383: log timestamps in ISO8601 format with timezone. 161 This adds the option `log-time-iso: yes` that logs in ISO8601 162 format. 163 - Updated cookie secrets management. 164 The default cookie secret file location can be set at compile time 165 with the --with-cookiesecretsfile=path option to configure. The 166 default location is changed to {dbdir}/cookiesecrets.txt. The 167 previous default location will be checked at startup when there is 168 no cookie secrets file at the new default location. 169 A staging cookie can now also be configured in the configuration 170 file and secrets configured in the configuration file now take 171 precedence over those read from file. 172 All DNS related setting in the configuration file will be reevaluated 173 and effectuated after nsd-control reconfig. 174 - Merge #398: RFC 9660 The DNS Zone Version (ZONEVERSION) Option 175 - Merge #406: ohttp and tls-supported-groups SvcParam suppor 176 - Merge #408: NINFO, RKEY, RESINFO, WALLET, CLA and TA RR types 177 - Merge #409: Writing of NSAP-PTR, GPOS and HIP RR types 178 - Merge #407: Better balanced verbosity levels for logging. 179 180 BUG FIXES: 181 - Fix title underline and declaration after statement warnings. 182 - Add cross platform freebsd, openbsd and netbsd to github ci. 183 - Update simdzone to include fix for netbsd double bswap declarations, 184 and also semantic checks for DS and ZONEMD. And CFLAGS has -march 185 prepended to fix detection. 186 - Merge #376: Point the user towards tcpdump for logging individual 187 queries. 188 - Track $INCLUDEs in zone files. 189 - Fix ci to update macos-12 to the macos-15 runner image. 190 - Merge #390: Apply non-xfr tasks before xfr tasks. 191 This fixes an issue where non-xfr tasks are lost when they are 192 batch processed together with non-xfr tasks. 193 This merge also changes that notifies are passed on from the serve 194 processes to the xfrd directly instead of via main. This was 195 necessary to allow applying the non-xfr tasks without forking a 196 backup-main for the sole purpose of forwarding notifies. 197 - Merge #391: Update copyright lines (in version output). 198 - Fix #392: Inconsistent documentation about control-interface. 199 - Merge #395: Explain the zonefile example better. 200 - Merge #394: Fix the path to use doc/manual/. 201 - Fix analyzer issue in do_print_cookie_secrets to check for failure. 202 - Merge #404: Introducing Sphinx substitution in code blocks. 203 As well as other fixes with Sphinx build. 204 - Update Copyright lines in help output 205 - Merge #395: Explain zonefile example better 206 - Merge #394: Fix doc path (fixes "Edit on GitHub" button in the docs) 207 - Fix Makefile for parallel build failure around bison rule. 208 - Fix #405: Fix typo in documentation. 209 - Treat a mismatch in RRset TTLs as a warning. 210 211 4.10.1 212 ================ 213 FEATURES: 214 - Merge #352 from orlitzky: contrib: add OpenRC service script, config 215 file, and tmpfiles entry. 216 - Merge #337 from bilias: Mutual TLS-AUTH. 217 218 BUG FIXES: 219 - Fix incorrect punctuation of log messages. 220 - Fix for #317, document more text on pidfile permissions. 221 - Fix #334: RFC8482 behavior documentation. 222 - Fix for OpenSSL 3.0 deprecated functions. 223 - Merge #341: Fix allow-query wording in nsd.conf.5.in. 224 - Fix test script from making spurious output. 225 - Fix cpu_affinity and socket_partitioning tests for --enable-log-role. 226 - Fix #344: Update simdzone. 227 - Fix #347: Adjust verbosity for TLS (+TCP) to be 5. 228 - Merge #348: Move TLS logging to verbosity level 5. 229 - For #347: Also adjust verbosity of log message for remaining TCP 230 connections. 231 - Merge #349: log file name before loading. 232 - Use MAKE variable rather than make command directly in Makefile. 233 - Serialize WKS RRs using numeric values rather than names. 234 - Fix propagation of Makefile targets to simdzone. 235 - Do not log ACL mismatch on followed CNAMEs. 236 - Fix link of xfr-inspect for libssl dependency. 237 - Initialize tls_auth_port and tls_auth_xfr_only options. 238 - Merge #358: Fix Hurd build error due to log_err. 239 - Update simdzone to fix detection of AVX2 support. 240 241 4.10.0 242 ================ 243 FEATURES: 244 - Merge #278: Replace Flex+Bison based zone parser with simdzone. 245 Performance of loading zones and IXFRs is greatly improved by using 246 the simdzone project by NLnet Labs. The optimized presentation format 247 parser leverages SIMD instructions in modern CPUs to improve throughput. 248 Right now SSE4.2 and AVX2 instruction sets are supported, other 249 instruction sets will use the fallback implementation, which still is 250 a decent improvement over the Flex+Bison based parser. 251 252 BUG FIXES: 253 - Fix that when the server truncates the pidfile, it does not follow 254 symbolic links. 255 - Fix #317: nsd should not chown its PID file. 256 - For #317: Modify nsd service script to stop NSD from creating a 257 pid file that systemd is not using. 258 - Fix #324: Clarify the purpose of contrib/bug390.patch. 259 - Fix IXFR requests upstream for zones with a long name. Thanks for 260 the report to Yuuki Wakisaka from Internet Initiative Japan Inc. 261 - Unit test for dname subdomain test used by xfrd-tcp.c. 262 - Fix #329: TCP accept queues number. 263 - Fix that the reload handler for sigchild uses signal_add, and 264 also that the signal handler is restored when done. 265 - Fix that when server verify is done it resets the sigchild handler. 266 - Fix makedist.sh for simdzone inclusion. 267 - Fix makedist.sh to remove simdzone git tracking information and 268 scripting temporaries from tarball. 269 - Fix error output of makedist.sh. 270 - Use simdzone version with name parser fix. 271 - Bump simdzone version to fix OpenBSD build issues. 272 - Bump simdzone to include minor fixes. 273 274 4.9.1 275 ================ 276 BUG FIXES: 277 - Use rooted temporary path in makedist.sh. 278 279 4.9.0 280 ================ 281 FEATURES: 282 - Merge #315: Allow SOA apex queries to otherwise with allow-query 283 protected zones for clients matching a provide-xfr rule, because 284 clients that are allowed to transfer the zone need to be able to 285 query SOA at the apex preceding the actual transfer. 286 - Merge #304: Support for Catalog zones version "2" as specified in 287 RFC 9432. Both the consumer as well as the producer role are 288 implemented, but only a single catalog consumer zone is allowed. 289 The "coo" property, only relevant with multiple catalog consumer, 290 is therefore not supported. The "group" property is supported. 291 Have a look at the nsd.conf man page for details on how to 292 configure and use catalog zones. 293 294 BUG FIXES: 295 - Fix to sync the tests script file common.sh. 296 - Update test script file common.sh. 297 - Fix #306: Missing AC_SUBST(dbdir) breaks installation with 4.8.0. 298 - Fix for #306: Create directory for xfrd.state and zone.list files 299 in make install. 300 - Merge #307 from anandb-ripencc: Many improvements to the nsd.conf 301 man page. 302 - Fix #308: Deprecate "multi-master-check" in favour of 303 "multi-primary-check". 304 - Merge #309: More RFC 8499 compliance. 305 - Fix control-reconfig-xfrd test for zonestatus primary that is 306 printed by nsd-control zonestatus. 307 - Move acx_nlnetlabs.m4 to version 47, with crypt32 check. 308 - Move acx_nlnetlabs.m4 to version 48, with ssp and getaddrinfo 309 include check. 310 - Fix #313: nsd 4.8 stats with implausible spikes. 311 - Fix compile with memclean for xfrd nsd.db close. 312 - In xfrd del secondary zone, the timer could perhaps have 313 event_added, and if so, it would not be event_del if a tcp connection 314 is active at the time. This could cause the libevent event lists 315 to fail. Also fix to make sure to set event_added for the 316 nsd-control ssl nonblocking handshake and check event_added there 317 too, for extra certainty. 318 - Merge #316: Fix to reap defunct children by the reload process that 319 emerged when some serve child processes were still serving TCP 320 request while the others had already quit, while the reload process 321 was waiting for the signal from the backup/old main process that all 322 children exited. 323 - Fix (also from Merge #316) to reap exited children more frequently 324 from server main loop for processes that exited during reload, but 325 missed the initial reaping at start of the main loop because they 326 took somewhat longer to exit. 327 - Fix timing sensitivity in ixfr_outsync test. 328 - Test if debug is available in do-tests. 329 - Enforce timeout from NSD in ixfr_gone test. 330 - Update expressions in ixfr_and_restart test. 331 - Make algorithm explicit in control-repattern test. 332 - Switch algorithm to hmac-256 for testplan_mess test. 333 - Replace multiple strcat and strcpy by snprintf. 334 335 4.8.0 336 ================ 337 FEATURES: 338 - Merge #281: Proxy protocol. An implementation of PROXYv2 for NSD. 339 It can be configured with proxy-protocol-port: portnum with the 340 port number of the interface on which proxy traffic is handled. 341 The interface can support proxy traffic for UDP, TCP and TLS. 342 - Merge #301: improve the logging of ixfr fallbacks to axfr. 343 - Merge #305: faster stats. Statistics can be gathered while a reload 344 is in progress. 345 BUG FIXES: 346 - Merge #282: Improve nsd.conf man page. 347 - Fix unused but set variable warning. 348 - Fix #283: Compile failure in remote.c when --disable-bind8-stats 349 and --without-ssl are specified. 350 - Fix #284: dnstap_collector.c: SOCK_NONBLOCK is not available on 351 Mac/Darwin. 352 - Fix unused variable warning in unit test of udb. 353 - Merge #287: Update nsd.conf.5.in. 354 - Fix autoconf 2.69 warnings in configure. 355 - Merge #295: Update e-mail addresses, add ref to support contracts 356 - Fix for interprocess communication to set quit sync command from 357 main process explicitly. 358 - Fix processing of consolidated IXFRs. 359 - Remove on-disk database. 360 - Answer first query for connections accepted just before reload. 361 - Fix: Always instate write handler after reading a query over TCP. 362 - Fix #14: Set timeout to 3s when servicing remaining TCP connections. 363 - Merge #302: Test package fixes. Correct Auxfiles, kill_from_pidfile 364 function and fix drop_updates, rr-test and xfr_update tests. 365 - Fix unit test kill_from_pidfile function for nonexistent files 366 because the argument is evaluated before the test expression. 367 - Fix rr-test to also convert the contents of the just written output 368 file. 369 - Fix test set to remove -f nsd.db and rm nsd.db commands. 370 - Fix test set to remove difffile option. 371 372 4.7.0 373 ================ 374 FEATURES: 375 - Merge #263: Add bash autocompletion script for nsd-control. 376 - Fix #267: Allow unencrypted local operation of nsd-control. 377 - Merge #269 from Fale: Add systemd service unit. 378 - Fix #271: DNSTAP over TCP, with dnstap-ip: "127.0.0.1@3333". 379 - dnstap over TLS, default enabled. Configured with the 380 options dnstap-tls, dnstap-tls-server-name, dnstap-tls-cert-bundle, 381 dnstap-tls-client-key-file and dnstap-tls-client-cert-file. 382 BUG FIXES: 383 - Fix #239: -Wincompatible-pointer-types warning in remote.c. 384 - Fix configure for -Wstrict-prototypes. 385 - Fix #262: Zone(s) not synchronizing properly via TLS. 386 - Fix for #262: More error logging for SSL read failures for zone 387 transfers. 388 - Merge #265: Fix C99 compatibility issue. 389 - Fix #266: Fix build with --without-ssl. 390 - Fix for #267: neater variable definitions. 391 - Fix #270: reserved identifier violation. 392 - Fix to clean more memory on exit of dnstap collector. 393 - Fix dnstap to not check socket path when using IP address. 394 - Fix to compile without ssl with dnstap-tls code. 395 - Dnstap tls code fixes. 396 - Fix include brackets for ssl.h include statements, instead of quotes. 397 - Fix static analyzer warning about nsd_event_method initialization. 398 - Fix #273: Large TXT record breaks AXFR. 399 - Fix ixfr create from adding too many record types. 400 - Fix cirrus script for submit to coverity scan to libtoolize 401 the configure script components config.guess and config.sub. 402 - Fix readme status badge links. 403 - make depend. 404 - Fix for build to run flex and bison before compiling code that needs 405 the headers. 406 - Fix to remove unused whitespace from acx_nlnetlabs.m4 and config.h. 407 - For #279: Note that autoreconf -fi creates the configure script 408 and also the needed auxiliary files, for autoconf 2.69 and 2.71. 409 - Fix unused variable warning in unit test, from clang compile. 410 - Fix #240: Prefix messages originating from verifier. 411 - Fix #275: Drop unnecessary root server checks. 412 413 4.6.1 414 ================ 415 FEATURES: 416 - Set ALPN "dot" token during connection establishment as per RFC9103 417 section 7.1 (Thanks Cesar Kuroiwa). 418 - Add SVCB dohpath support 419 BUG FIXES: 420 - Fix static analyzer reports, fix wrong log print when skipping xfr, 421 fix to print error on pipe read fail, and assert an xfr is in 422 progress during packet checks. 423 - Use AC_PROG_CC_STDC with autoconf versions prior to 2.70. 424 - Add missing documentation for zone verification. 425 - Fix #212: Change commandline control actions to always log. 426 - Merge #231 from moritzbuhl: Fix checking if nonblocking sockets work 427 on OpenBSD. 428 - Change zone parsing to accept non-trailing newline. 429 430 4.6.0 431 ================ 432 FEATURES: 433 - Port zone-verification from CreDNS to NSD4. 434 BUG FIXES: 435 - Fix static analyzer reports on ixfrcreate temp file. 436 - Fixup wrong ixfrcreate fread return check. 437 438 4.5.0 439 ================ 440 FEATURES: 441 - Merge PR #209: IXFR out 442 This adds IXFR out functionality to NSD. NSD can copy IXFRs from 443 upstream to downstream clients, or create IXFRs from zonefiles. 444 The options store-ixfr: yes and create-ixfr: yes can be used to 445 turn this on. Default is turned off. The options ixfr-number and 446 ixfr-size can be used to tune the number of IXFR transfers and 447 total data size stored. This is configured per zone, the IXFRs 448 are served to the hosts that are allowed to perform zone transfers. 449 And if TSIG is configured, signed with the same key. The content 450 is stored to file if a zonefile is configured for the zone, in 451 the zonefile.ixfr and zonefile.ixfr.2, .. files. They contain 452 readable text format. The number of IXFRs is num.rixfr in 453 statistics output, also per zone if per zone statistics are enabled. 454 If offline, nsd-checkzone -i can create ixfr files. 455 NSD already supports requesting IXFRs, this addition allows NSD 456 to serve IXFR transfers to clients. 457 NSD stops responding with NOTIMPL to IXFR requests, also for zones 458 that do not have IXFR enabled. The clients gets a full zone reply 459 or a status reply if the serial is up to date. 460 BUG FIXES: 461 - Fix code analyzer zero divide warning. 462 - Fix code analyzer large value with assertion. 463 - Fix another code analyzer zero divide warning. 464 - Fix code analyzer warning about uninitialized temp storage in loop. 465 - Fix spelling error in comment in svcbparam_lookup_key. 466 - Update cirrus script FreeBSD version. 467 468 4.4.0 469 ================ 470 FEATURES: 471 - Merge #193: Lower memory usage of the XFRD process by default. 472 Instead of preallocating all elements, they are allocated when used. 473 There are options for managing the memory usage, defaults are the 474 same as before. xfrd-tcp-max sets the number of sockets for tcp 475 connections that xfrd can make to download zone contents. And 476 xfrd-tcp-pipeline the number of simultaneous transfers over the 477 same connection. 478 BUG FIXES: 479 - Fix #200: nsd-checkzone succeeds even with incorrect serial in SOA 480 record. 481 - Merge #204 from jonathangray: correct some spelling mistakes. 482 - Fix to change file mode before changing file owner for the 483 nsd-control unix socket file. 484 - Fix to document nsd-checkzone -p in the man page for nsd-checkzone. 485 - Fix #206: build with --without-ssl fails. 486 - Merge #207 Sync nsd-control-setup with unbound-control-setup to 487 generate certificates with SANs. 488 - Fix unit tests for nds-control-setup exit code and the 489 xfrd-tcp-max default. 490 491 4.3.9 492 ================ 493 BUG FIXES: 494 - Fix #198: nsd-control reconfig core dump. 495 - Fix to remove git tracking and ci information from release tarballs. 496 - Fix unit tests for new answer-cookie default. 497 - Fix socket_partitioning unit test for FreeBSD. 498 - Fix SVCB test to work around older dig with drill. 499 500 4.3.8 501 ================ 502 FEATURES: 503 - Merge #185 by cesarkuroiwa: Mutual TLS. 504 - Set default for answer-cookie to no. Because in server deployments 505 with mixed server software, a default of yes causes issues. 506 BUG FIXES: 507 - Fix to compile with OpenSSL 3.0.0beta2. 508 - Fix configure detection of SSL_CTX_set_security_level. 509 - Fix deprecated functions use from openssl 3.0.0beta2. 510 - For #184: Note that all zones can be targeted by some nsd-control 511 commands in the man page. 512 - Fixes for #185: Document client-cert, client-key and client-key-pw 513 in the man page. Fix yacc semicolon. Fix unused variable warning. 514 Use strlcpy instead of strncpy. Fix spelling error in error 515 printout. 516 - Merge #187: Support using system-wide crypto policies. 517 - Fix #188: NSD fails to build against openssl 1.1 on CentOS 7. 518 - Fix sed script in ssldir split handling. 519 - Fix #189: nsd 4.3.7 crash answer_delegation: Assertion 520 `query->delegation_rrset' failed. 521 - Fix #190: NSD returns 3 NSEC3 records for NODATA response. 522 - Fix compile failure with openssl 1.0.2. 523 - Fix #194: Incorrect NSEC3 response for SOA query below delegation 524 point. 525 526 4.3.7 527 ================ 528 FEATURES: 529 - Syntax of SVCB and HTTPS RR type as per draft-ietf-dnsop-svcb-https 530 - Client side DNS Zone Transfer-over-TLS (XoT) support as per 531 draft-ietf-dprive-xfr-over-tls 532 - Interoperable DNS Cookies support as per RFC7873 and RFC9018 533 BUG FIXES: 534 - Fix for #170: Fix build warnings when IPv6 is disabled. 535 - Fix #170: Disabled IPv6 and DNSTAP enabled triggers a build error. 536 - Fix for #128: Skip over sendmmsg invalid argument when port is zero. 537 - Fix #171: Invalid negative response (NSEC3) after IXFR. 538 - Fix to make nsec3_chain_find_prev return NULL if one nsec3 left. 539 - Fix #174: NS Records below delegation are not ignored (nsd-checkzone 540 also does not raise any issue). 541 - Fix #176: please review Loglevel on missing zonefile. 542 - Update the ACX_CHECK_NONBLOCKING_BROKEN test for the configure 543 script. 544 - Fix #179: log notice and server-count. 545 - Update configure nonblocking test to use host. 546 - Fix #168: Buffer overflow in the dname_to_string() function 547 - Fixes for child server processes getting out of sync with the 548 dnstap-collector process 549 - Fix gcc-11 warning on array bounds. 550 - Fix compile of cookies on FreeBSD without IPv6. 551 - Fix for loop initial declaration for nonc99 compiler 552 - Fix typo in xfrd-tcp.c. 553 554 4.3.6 555 ================ 556 FEATURES: 557 - Fix #146 with #147: DNSTAP log the local address of the server 558 with the dnstap logs. 559 - Enable configuring a control-interface by interface name. 560 - A -p option to nsd-checkzone to print a successfully read zone. 561 - Add Extended DNS Errors RFC8914 562 - Per zone Access Control List for queries 563 with an allow-query: option. 564 BUG FIXES: 565 - Prevent a few more yacc clashes. 566 - Merge PR #153 from fobser: Repair -fno-common linker errors 567 automatically. 568 - Fix uninitialized access of log_buf in error printout on apply ixfr. 569 - Fix AF_LOCAL compile error for Solaris. 570 - Fix ifaddrs compile error for Solaris. 571 - Fix ifaddrs.h compile error for Solaris. 572 - Man page documentation for dnstap options. 573 - Fix segfault on high verbosity for TLS channels with dnstap log 574 local address. 575 - Fix #163: A TSIG noncompliance with RFC 2845. 576 - Fix that wildcard is printed as a star instead of escaped, in 577 logs and in written zone files. 578 - Fix double config.h include in configlexer.c 579 - Fix to remove configyyrename from makedist.sh and also 580 update the flex and bison rules there to add the "c_" prefix. 581 - Fix configure to use header checks with compile. 582 - Fix warning about unused function log_addr. 583 - Fix #154: TXT with parentheses fails in 4.3.5. 584 - Align parsing of TXT elements with how bind does it. 585 - Fix configure failure for enable systemd because of autoconf. 586 587 588 4.3.5 589 ================ 590 BUG FIXES: 591 - Fix #143: xfrd no hysteresis with NOT IMPLEMENTED rcode. 592 - Fix #144: Typo fix in nsd.conf.5.in. 593 - For #145: Fix that service of remaining TCP and TLS connections 594 does not allow new queries to be made, the connection is closed. 595 Only existing queries and zone transfers are answered, new ones 596 are rejected by a close of the channel. 597 - Fix that nsd-control has timeout when connection is down. 598 - remove windows socket ifdefs from nsd-control. 599 - Fix #148: CNAME need not be followed after a synthesized CNAME 600 for a CNAME query. 601 - Fix configure.ac for autoconf 2.70. 602 - Fix #150: TXT record validation difference with BIND. 603 - Fix #151: DNAME not applied more than once to resolve the query. 604 - Fix #152: '*' in Rdata causes the return code to be NOERROR instead 605 of NX. 606 607 608 4.3.4 609 ================ 610 FEATURES: 611 - Merge PR #141: ZONEMD RR type. 612 BUG FIXES: 613 - Fix #129: ambiguous use of errno, in log message if sendmmsg fails. 614 - Fix #128: Fix that the invalid port number is logged for sendmmsg 615 failed: Invalid argument. 616 - Fix #127: two minor `-Wcast-qual` cleanups 617 - Fix #126: minor header hygiene 618 - Fix #125: include config.h in compat/setproctitle.c and fix 619 prototype of `setproctitle` 620 - Fix #133: fix 0-init of local ( stack ) buffer. 621 - Fix missing parenthesis on size of fix to init buffer. 622 - Fix #134: IPV4_MINIMAL_RESPONSE_SIZE vs EDNS_MAX_MESSAGE_LEN. 623 - Fix to add missing closest encloser NSEC3 for wildcard nodata type 624 DS answer. 625 - Remove unused init_cfg_parse routine from configlexer. 626 - Fix #138: NSD returns non-EDNS answer when QUESTION is empty. 627 - Fix #142: NODATA answers missin SOA in authority section after 628 CNAME chain. 629 - Fix for CVE-2020-28935 : Fix that symlink does not interfere 630 with chown of pidfile. 631 632 633 4.3.3 634 ================ 635 FEATURES: 636 - Follow DNS flag day 2020 advice and 637 set default EDNS message size to 1232. 638 - Merged PR #113 with fixes. Instead of listing an IP-address to 639 listen on, an interface name can be specified in nsd.conf, with 640 ip-address: eth0. The IP-addresses for that interface are then used. 641 - Port TSIG code for openssl 3.0.0-alpha6. 642 BUG FIXES: 643 - Fix make install with --with-pidfile="". 644 - Merge #115 from millert: Fix strlcpy() usage. From OpenBSD. 645 - Merge #117: mini_event.h (4.3.2 and 4.3.1) on OpenBSD cannot find 646 fd_set - patch. 647 - Fix that configure checks for EVP_sha256 to detect openssl, because 648 HMAC_CTX_new is deprecated in 3.0.0. 649 - Fix #119: fix compile warnings from new gcc. 650 - Fix #119: warn when trying to parse a directory. 651 - Merge PR #121: Increase log level of recreated database from 652 WARNING to ERR. 653 - Remove unused space from LIBS on link line. 654 - Updated date in nsd -v output. 655 656 657 4.3.2 658 ================ 659 FEATURES: 660 - Fix #96: log-only-syslog: yes sets to only use syslog, fixes 661 that the default configuration and systemd results in duplicate 662 log messages. 663 - Fix #107: nsd -v shows configure line, openssl version and libevent version. 664 - Fix #103 with #110: min-expire-time option. To provide a lower 665 bound for expire period. Expressed in number of seconds or 666 refresh+retry+1. 667 BUG FIXES: 668 - Fix for posix shell syntax for trap in nsd-control-setup 669 - Fix to omit the listen-on lines from log at startup, unless verbose. 670 - Fix uninitialised values for bindtodevice option at startup with 671 reuseport and multiple interfaces. 672 - Fix #95: Removed make test check because tpkg not included in 673 release tarballs. 674 - Fix unused parameter compile warnings. 675 - Fix #97: EDNS unknown version: query not in response. 676 - Fix #99: Fix copying of socket properties with reuseport enabled. 677 - Document default value for tcp-timeout. 678 - Merge PR#102 from and0x000: add missing default in documentation 679 for drop-updates. 680 - Fix unlink of pidfile warning if not possible due to permissions, 681 nsd can display the message at high verbosity levels. 682 - Removed contrib/nsd.service, example is too complicated and not 683 useful. 684 - Do not log EAGAIN errors for sendmmsg, to stop log spam on OpenBSD. 685 - Merge #108 from Nomis: Make the max-retry-time description clearer. 686 - Retry when udp send buffer is full to wait until buffer space is 687 available. 688 - Remove errno reset behaviour from sendmmsg and recvmmsg 689 replacement functions. 690 - Fix unit test for different nsd-control-setup -h exit code. 691 - Merge #112 from jaredmauch: log old and new serials when NSD 692 rejects an IXFR due to an old serial number. 693 - Fix #106: Adhere better to xfrd bounds. Refresh and retry times. 694 - Fix #105: Clearing hash_tree means just emptying the tree. 695 696 697 4.3.1 698 ================ 699 BUG FIXES: 700 - Fix #70: error: 'fd_set' undeclared. 701 - Fix #71: error: 'for' loop initial declaration used outside C99 702 mode. 703 - Fix to move declarations out of for loops in event test too. 704 - Fix #76: cpuid typedef for Hurd, DragonflyBSD compile. 705 - Fix #75: configure test for sched_setaffinity, and use 706 cpuset_setaffinity otherwise. Also test for presence of sysconf. 707 - Fix #74: GNU Hurd fix cast from pointer to integer of different size. 708 - Fix for #74, #75: cpuset test for header contents and provide code. 709 - Fix #78: Fix SO_SETFIB error on FreeBSD. 710 - Merge PR #83 from noloader: Fix GNU HURD sched_setaffinity compile. 711 - Fix #80: NetBSD and implicit declaration of reallocarray. 712 - Fix unknown u_long in util.c for Issue #80 . 713 - Merge PR #86 from noloader: Use precious variables for GREP, EGREP, 714 SED, AWK, LEX and YACC. 715 - For PR #86: Fix that programs loaded after CFLAGS and stuff is 716 set, specifically the compiler, so that it can work if it needs 717 special flags from that. Fix that lex only needs to support -i 718 if actually defined, otherwise the output included in the source 719 tarball can be used. 720 - Merge PR #90 by phicoh: O_CLOEXEC should be FD_CLOEXEC. 721 - Merge PR #92 by tonysgi: Fix typo. 722 - Merge PR #91 by gearnode: nsd-control-setup recreate certificates. 723 The '-r' option recreates certificates. Without it it creates them 724 if they do not exist, and does not modify them otherwise. 725 726 727 4.3.0 728 ================ 729 FEATURES: 730 - Fix to use getrandom() for randomness, if available. 731 - Fix #56: Drop sparse TSIG signing support in NSD. 732 Sign every axfr packet with TSIG, according to the latest 733 draft-ietf-dnsop-rfc2845bis-06, Section 5.3.1. 734 - Merge pull request #59 from buddyns: add FreeBSD support 735 for conf key ip-transparent. 736 - Add feature to pin server processes to specific cpus. 737 - Add feature to pin IP addresses to selected server processes. 738 - Set process title to identify individual processes. 739 - Merge PR#22: minimise-any: prefer polular and not large RRset, 740 from Daisuke Higashi. 741 - Add support for SO_BINDTODEVICE on Linux. 742 - Add support for SO_SETFIB on FreeBSD. 743 - Add feature to drop queries with opcode UPDATE. 744 BUG FIXES: 745 - Fix fname null check of fname in namedb_read_zonefile. 746 - Fix implicit cast of size in udb_radnode_array_grow. 747 - Fix ignore of return value of ssl_printf in remote.c. 748 - Fix unused check of fd in parent_handle_reload_command. 749 - Attempt to fix signedness of nscount lookup in ixfr query_process. 750 - Fix identical branches for ssl_print of errors in remote.c. 751 - Fix type cast bounds, signedness of opt_rdlen in edns_parse_record. 752 - Fix to separate header and data lines in parse_zone_list_file. 753 - Fix to define max number of EDNS records we are willing to 754 spend time on. 755 - Fix size of string len and capacity type cast in udbradtree. 756 - Fix to protect rrcount in tsig_find_rr from overflow. 757 - Annotate radix_find_prefix_node not reachable trail code. 758 - Fix to protect rrcount in packet_find_notify_serial from overflow. 759 - Fix to close socket on error in create_tcp_accept_sock. 760 - Fix to log on failure to chmod for socket for remote control. 761 - Fix to remove unneeded if in open of socket for remote control. 762 - Fix to restore input parameter on call failure in create_dirs. 763 - Please checker by terminating and initialising string read 764 by remote control. 765 - Fix to define upper bounds on rr counts read from untrusted packet 766 data. 767 - Separate acl_addr_match_range functions for ip4 and ip6, to 768 please checkers. 769 - Avoid unused variable warning in new match_range_v4 function. 770 - Fix whitespace in nsd.conf.sample.in, patch from Paul Wouters. 771 - use-systemd is ignored in nsd.conf, when NSD is compiled with 772 libsystemd it always signals readiness, if possible. 773 - Note that use-systemd is not necessary and ignored in man page. 774 - Fix unreachable code in ssl set options code. 775 - Fix bad shift in assertion code analyzer complaint. 776 - Fix responses for IXFR so that the authority section is not echoed 777 in the response. 778 - Merge PR#60: Minor portability fixes from michaelforney, with 779 avoid pointer arithmetic on void* and avoid unnecessary VLA. 780 - Fix that the retry wait does not exceed one day for zone transfers. 781 CHANGES: 782 - Set FD_CLOEXEC on opened sockets. 783 784 785 4.2.4 786 ================ 787 FEATURES: 788 - Fix #48: Add make distclean that removes config.h made by configure. 789 And add maintainer-clean that removes bison and flex output. 790 BUG FIXES: 791 - Detect fixed time memcmp for openssl 0.9.8 compatibility. 792 - Detect EC_KEY_new_by_curve_name for openssl 0.9.8. 793 - include limits.h for UINT_MAX. 794 - If no recvmmsg, dont use msg_flags member, but errno for error, 795 where our fallback function left it, msg_flags also does not exist 796 on some systems. 797 - Remove unused variable warning for portability. 798 - Fix #52: do not log transient network full errors unless higher 799 verbosity is set. 800 - Fix regressions in configparser.y where global variables were not 801 set for minimal-responses, round-robin and log-time-ascii. 802 803 804 4.2.3 805 ================ 806 FEATURES: 807 - For #39: confine-to-zone configures NSD to not return out-of-zone 808 additional information. Contributed by Greg Bock. 809 - For #21: pidfile "" allows to run NSD without a pidfile, for 810 startup management tools like daemontools. 811 - For #21 add 812 contrib/patch_for_s6_startup_and_other_service_supervisors.diff 813 that adds support for readiness notification with READY_FD from 814 Cameron Nemo. 815 BUG FIXES: 816 - Fix #35: excessive logging of ixfr failures, it stops the log when 817 fallback to axfr is possible. log is enabled at high verbosity. 818 - Fixup warnings during --disable-ipv6 compile. 819 - The nsd.conf includes are sorted ascending, for include statements 820 with a '*' from glob. 821 - Fix #38: log address and failure reason with tls handshake errors, 822 squelches (the same as unbound) some unless high verbosity is used. 823 - Fixup clang analysis warning in xfrd_parse_received_xfr_packet 824 master dereference. 825 CHANGES: 826 - Number of different UDP handlers has been reduced to one. recvmmsg 827 and sendmmsg implementations are now used on all platforms. 828 Compatible implementations are in place for systems that lack the 829 system calls. 830 - Socket options are now set in designated functions for easy reuse. 831 - Socket setup has been simplified for easy reuse. 832 - Configuration parser is now aware of the context in which an option 833 was specified. 834 - Fix #44: document that remote-control is a top-level nsd.conf 835 attribute. 836 837 838 4.2.2 839 ================ 840 BUG FIXES: 841 - Fix #20: CVE-2019-13207 Stack-based Buffer Overflow in the 842 dname_concatenate() function. Reported by Frederic Cambus. 843 It causes the zone parser to crash on a malformed zone file, 844 with assertions enabled, an assertion catches it. 845 - Fix #19: Out-of-bounds read caused by improper validation of 846 array index. Reported by Frederic Cambus. The zone parser 847 fails on type SIG because of mismatched definition with RRSIG. 848 - PR #23: Fix typo in nsd.conf man-page. 849 - Fix that NSD warns for wrong length of the hash in SSHFP records. 850 - Fix #25: NSD doesn't refresh zones after extended downtime, 851 it refreshes the old zones. 852 - Set no renegotiation on the SSL context to stop client 853 session renegotiation. 854 - Fix #29: SSHFP check NULL pointer dereference. 855 - Fix #30: SSHFP check failure due to missing domain name. 856 - Fix to timeval_add in minievent for remaining second in microseconds. 857 - PR #31: nsd-control: Add missing stdio header. 858 - PR #32: tsig: Fix compilation without HAVE_SSL. 859 - Cleanup tls context on xfrd exit. 860 - Fix #33: Fix segfault in service of remaining streams on exit. 861 - Fix error message for out of zone data to have more information. 862 863 864 4.2.1 865 ================ 866 FEATURES: 867 - Added num.tls and num.tls6 stat counters. 868 - PR #12: send-buffer-size, receive-buffer-size, 869 tcp-reject-overflow options for nsd.conf, from Jeroen Koekkoek. 870 - Fix #14, tcp connections have 1/10 to be active and have to work 871 every second, and then they get time to complete during a reload, 872 this is a process that lingers with the old version during a version 873 update. 874 BUG FIXES: 875 - Fix #13: Stray dot at the end of some log entries, removes dot 876 after updated serial number in log entry. 877 - Fix TLS cipher selection, the previous was redundant, prefers 878 CHACHA20-POLY1305 over AESGCM and was not as readable as it 879 could be. 880 - Consolidate server tls context create and remote control context 881 create, with hardening for the remote control tls context too. 882 - Fix to init event structure for reassignment. 883 - Fix to init event not pointer, in reassignment. 884 - Fix #15: crash in SSL library, initialize variables for TCP access 885 when TLS is configured. 886 - Fix tls handshake event callback function mistake, reported 887 by Mykhailo Danylenko. 888 - Initialize event structures before event_set, to stop uninitialized 889 values from setting event library lists and assertions, that would 890 sometimes also show after event_del. 891 - Do not use symbol from libc, instead use own replacement, if not 892 available, for accept4. 893 - Fix output of nsd-checkconf -h. 894 895 896 4.2.0 897 ================ 898 FEATURES: 899 - Print IP address when bind socket fails with error. 900 - Fix #4249: The option hide-identity: yes stops NSD from responding 901 with the hostname for chaos class queries. Implements the RFC4892 902 security considerations. 903 - Patch to add support for TCP Fast Open, from Sara 904 Dickinson (Sinodun). 905 - Patch to add support for tls service on a specified tls port, 906 from Sara Dickinson (Sinodun). 907 - Use travis for build check, initial unit test and clang analysis. 908 - TLS OCSP stapling support, enabled with tls-service-ocsp: filename, 909 patch from Andreas Schulze. 910 BUG FIXES: 911 - Fix to delete unused zparser.default_apex member. 912 - Fix that the TLS handshake routine sets the correct event to 913 continue when done. 914 - Fix that TLS renegotiation calls the read and write routines again 915 with the same parameters when the desired event has been satisfied. 916 - Fix that TCP Fastopen has better error message and supports OSX. 917 - Fix to avoid buffer alloc with global buffer in tls write handler. 918 - Fix to initialize event structure when accepting TCP connection. 919 - Disable TLS1.0, TLS1.1 and weak ciphers, enable 920 CIPHER_SERVER_PREFERENCE, patch from Andreas Schulze. 921 - further setup ssl ctx after the keys are loaded, for ECDH. 922 - Fix #10: Fix memory leaks caused by duplicate rr and include 923 instructions. 924 - Fix to define _OPENBSD_SOURCE to get reallocarray on NetBSD. 925 926 927 4.1.27 928 ================ 929 FEATURES: 930 - Deny ANY with only one RR in response, by default. Patch from 931 Daisuke Higashi. The deny-any statement in nsd.conf sets ANY 932 queries over UDP to be further moved to TCP as well. 933 Also no additional section processing for type ANY, reducing 934 the response size. 935 - Fix #4215: on-the-fly change of TSIG keys with patch from Igor, adds 936 nsd-control print_tsig, update_tsig, add_tsig, assoc_tsig 937 and del_tsig. These changes are gone after reload, edit the 938 config file (or a file included from it) to make changes that 939 last after restart. 940 BUG FIXES: 941 - Fix #4213: disable-ipv6 and dnstap compile error. 942 - Fix to reduce region_log_stats if condition, this removes a 943 debug statement. 944 - Fix for FreeBSD port with dnstap enabled. 945 - Fix to remove unused code. 946 - Fix #6: nsd-control-setup: Change validity time to a shorter 947 period (<2038). 948 - Fix unused definition in header remote.h. 949 - Fix #4236: IPV4_MINIMAL_RESPONSE_SIZE=1480 is slightly too big. 950 - Fix #4235: IP_PMTUDISC_OMIT on IPv4/UDP sockets. 951 - Fixed radtree_insert memory leak. 952 - Fixed access recycled variable. 953 954 955 4.1.26 956 ================ 957 FEATURES: 958 - DNSTAP support for NSD, --enable-dnstap and then config in nsd.conf. 959 - Support SO_REUSEPORT_LB in FreeBSD 12 with the reuseport: yes 960 option in nsd.conf. 961 - Added nsd-control changezone. nsd-control changezone name pattern 962 allows the change of a zone pattern option without downtime for 963 the zone, in one operation. 964 BUG FIXES: 965 - Fix #4194: Zone file parser derailed by non-FQDN names in RHS of 966 DNSSEC RRs. 967 - Fix #4202: nsd-control delzone incorrect exit code on error. 968 - Tab style fix to use tab for 8 spaces, from Xiaobo Liu. 969 - Fix #4205: enable-recvmmsg in mixed IPv4/IPv6 environment fails. 970 This sets the msg_hdr.msg_namelen correctly after receipt. 971 - Fix to not set GLOB_NOSORT so the nsd.conf include: files are 972 sorted and in a predictable order. 973 - Fix #3433: document that reconfig does not change per-zone stats. 974 975 976 4.1.25 977 ================ 978 FEATURES: 979 - nsd-control prints neater errors for file failures. 980 BUG FIXES: 981 - Fix that nsec3 precompile deletion happens before the RRs of 982 the zone are deleted. 983 - Fix printout of accepted remote control connection for unix sockets. 984 - Fix use_systemd typo/leftover in remote.c. 985 - Fix codingstyle in nsd-checkconf.c in patch from Sharp Liu. 986 - append_trailing_slash has one implementation and is not repeated 987 differently. 988 - Fix coding style in nsd.c 989 - Fix to combine the same error function into one, from Xiaobo Liu. 990 - Fix initialisation in remote.c. 991 - please clang analyzer and fix parse of IPSECKEY with bad gateway. 992 - Fix nsd-checkconf fail on bad zone name. 993 - Annotate exit functions with noreturn. 994 - Remove unused if clause during server service startup. 995 - Fix #4156: Fix systemd service manager state change notification 996 When it is compiled, systemd readiness signalling is enabled. 997 The option in nsd.conf is not used, it is ignored when read. 998 999 1000 4.1.24 1001 ================ 1002 FEATURES: 1003 - #4102: control interface via local socket. 1004 configure it with control-interface: "/path/nsd.ctl" The path 1005 has to start with a / to separate it from an IP address. 1006 The local socket does not use SSL, but unencrypted traffic, use 1007 file and containing directory permissions to restrict access. 1008 - configure --enable-systemd (needs pkg-config and libsystemd) can 1009 be used to then use-systemd: yes in nsd.conf and have readiness 1010 signalling with systemd. 1011 - RFC8162 support, for record type SMIMEA. 1012 BUG FIXES: 1013 - Patch to fix openwrt for mac os build darwin detection in configure. 1014 - Fix that first control-interface determines if TLS is used. Warn 1015 when IP address interfaces are used without TLS. 1016 - #4106: Fix that stats printed from nsd-control are recast from 1017 unsigned long to unsigned (remote.c). 1018 - Fix that type CAA (and URI) in the zone file can contain 1019 dots when not in quotes. 1020 - #4133: Fix that when IXFR contains a zone with broken NSEC3PARAM 1021 chain, NSD leniently attempts to find a working NSEC3PARAM. 1022 1023 1024 4.1.23 1025 ================ 1026 BUG FIXES: 1027 - Fix NSD time sensitive TSIG compare vulnerability. 1028 1029 1030 4.1.22 1031 ================ 1032 FEATURES: 1033 - refuse-any sends truncation (+TC) in reply to ANY queries over UDP, 1034 and allows TCP queries like normal. 1035 - Use accept4 to speed up answer of TCP queries, on Linux, FreeBSD 1036 and OpenBSD. 1037 BUG FIXES: 1038 - Fix nsec3 hash of parent and child co-hosted nsec3 enabled zones. 1039 - Fix to use same condition for nsec3 hash allocation and free. 1040 1041 1042 4.1.21 1043 ================ 1044 FEATURES: 1045 - --enable-memclean cleans up memory for use with memory checkers, 1046 eg. valgrind. 1047 - refuse-any nsd.conf option that refuses queries of type ANY. 1048 - lower memory usage for tcp connections, so tcp-count can be higher. 1049 BUG FIXES: 1050 - Fix unused variable warnings and uninit variable in statistics 1051 printout from clang analyzer. 1052 - Fix spelling error in xfr-inspect. 1053 - Fix #3562: explain build error when flex missing. 1054 - Fix buffer size warnings from compiler on filename lengths. 1055 - Fix #4093: Release notes not using 2018. 1056 1057 1058 4.1.20 1059 ================ 1060 BUG FIXES: 1061 - Fix memory leak in zone file read of unknown rr formatted RRs. 1062 - Fix memory leak when rehashing nsec3 after axfr or zonefile read, 1063 in the selectively allocated precompiled nsec3 hashes. 1064 1065 1066 4.1.19 1067 ================ 1068 BUG FIXES: 1069 - ignore fallthrough compiler warning in flex EOF rule. 1070 - Fix warnings emitted by clang for --enable-packed. Alignment is not 1071 a problem for x86_64, don't enable packed when the platform 1072 requires aligned access. 1073 - Fix spelling error in xfr-inspect. 1074 - Fix 3392: Fix regression in 4.1.18 for notify lists with ip4 1075 and ip6 targets. 1076 - Add test for support of -Wno-address-of-packed-member for 1077 --enable-packed. 1078 1079 1080 4.1.18 1081 ================ 1082 FEATURES: 1083 - xfr-inspect, it is not installed, it prints xfr files from /tmp 1084 made with 'make xfr-inspect' in the source dir. 1085 - retry timeout between sending notifies dropped from 15 to 3 sec. 1086 - NSD sends 16 notifies simultaneously. 1087 - configure --enable-packed reduces memory usage, at expense of 1088 unaligned reads. Saves about 17%. 1089 - Save memory by selectively allocate precompiled nsec3 hashes, 1090 saves about 16% memory. 1091 - make ip-transparent option work on OpenBSD. 1092 - Save about 2% memory by changing usage count size in name tree. 1093 - Fix #2871: Increase number of sockets for xfrd transfers. 1094 BUG FIXES: 1095 - Fix gcc 7.1.1 warnings. 1096 - Fix writev compile warning on FreeBSD. 1097 - Fix #1446: A corrupted zone file "propagates" to good ones. 1098 - nsd-control zonestatus prints wait time between attempts, for zones 1099 that are in that waiting time. 1100 - Fix collision printout of nsec3 to print name, hash and reverse. 1101 - Fix #1567: Change crit to err log level for gettimeofday failure. 1102 Add defines for compile without syslog. 1103 - Fix crash for DS query when parent and child zones both configured 1104 in nsd.conf and parent zone has not loaded properly. 1105 1106 1107 4.1.17 1108 ================ 1109 FEATURES: 1110 - zone parser parses type AVC (it has TXT format). 1111 - Fix #1272: use writev to put tcp length field with data for outgoing 1112 zone transfer requests. 1113 BUG FIXES: 1114 - Fix potential null pointer in nsec3 adjustment tree. 1115 - Fix text format of deletes for CDS and CDNSKEY, single 0 to represent 1116 empty base64 or hex string. 1117 1118 1119 4.1.16 1120 ================ 1121 FEATURES: 1122 - zone parser can parse acronyms for algorithms ED25519 and ED448. 1123 - Fix 1243: Option to make NSD emit really minimal responses, 1124 minimal-responses: yes in nsd.conf. 1125 BUG FIXES: 1126 - Calculate new udb index after growing the array, fix from 1127 Chaofeng Liu. 1128 - Fix missing _t to _type conversion for disable-radix-tree option. 1129 - Printout serial error with hint it may be too big. 1130 - Fix 1228: OpenSSL include is not guarded with HAVE_SSL 1131 - Patch for expire state in multi-master when masters includes 1132 broken master, from Manabu Sonoda. 1133 - minor manpage fix. 1134 1135 1136 4.1.15 1137 ================ 1138 BUG FIXES: 1139 - Fix nsd-control and ipv6 only. 1140 - Squelch zone transfer error address family not supported by protocol 1141 at low verbosity levels. 1142 - Fix #1195: Fix so that NSD fails on non-compliant values for Serial. 1143 - Fix to rename _t typedefs because POSIX reserves them. 1144 - Fix that nsec3 hash collisions only reported on verbosity level 3. 1145 1146 1147 4.1.14 1148 ================ 1149 FEATURES: 1150 - Fix #1132 for SERVFAIL zones perform backoff, and remembers the 1151 timeout on next startup. 1152 BUG FIXES: 1153 - Fix null memcpy for radixtree with single link element. 1154 - Robust fix against missing master in tcp_open for xfrd. 1155 - Fix wildcards in include: config statements with chroot enabled. 1156 - suppress compile warning in lex files. 1157 - Fix to try every master once, then wait for timeout or notify. 1158 - Save backoff timeout into xfrd.state file, this file has a higher 1159 version number now. Old files are skipped silently (causes 1160 refresh) and created as new files upon exit. 1161 - Fix restart of zone transfers when new config becomes available. 1162 1163 1164 4.1.13 1165 ================ 1166 FEATURES: 1167 - multi-master-check: yes can be used to check all masters for the 1168 last version, using the higher version from the configured masters, 1169 from Manabu Sonoda. 1170 - Support RR type OPENPGPKEY from RFC 7929. 1171 - Can config key algorithms with the digest name, eg. 'sha256'. 1172 - configure --disable-radix-tree for about 15% lower memory usage. 1173 - for type SRV add A/AAAA to the additional section (if possible), 1174 just like we already do for type MX. 1175 - more extensible edns option handling. 1176 BUG FIXES: 1177 - Fix compile warnings about unused result from write and strtol. 1178 and signcompare in minmax retrytime. 1179 - Fix #812: fix that make depend fails after distribution. 1180 - Fix #817: xfrd update failed loop. 1181 - Add robustness against unallocated data in nsec3 trees. 1182 - Fix README spelling error of BSD license (reported by Joerg Jung). 1183 - Fix multimaster for not tried full zone transfer for a expired zone. 1184 - Fix #827: fix compile with openssl 1.1.0 with api=1.1.0. 1185 1186 1187 4.1.12 1188 ================ 1189 BUG FIXES: 1190 - Fix malformed edns query assertion failure, reported by 1191 Michal Kepien (NASK). 1192 1193 1194 4.1.11 1195 ================ 1196 FEATURES: 1197 - When tcp is more than half full, use short timeout for tcp session. 1198 - Patch for {max,min}-{refresh,retry}-time from YAMAGUCHI Takanori. 1199 - Fix #790: size-limit-xfr can stop NSD from downloading infinite zone 1200 transfer data size, from Toshifumi Sakaguchi. Fixes CVE-2016-6173 1201 JVN#63359718 JPCERT#91251865. 1202 BUG FIXES: 1203 - Fix build without IPv6, patch from Zdenek Kaspar. 1204 - Fix #783: Trying to run a root server without having configured it 1205 silently gives wrong answers. 1206 - Fix #782: Serve DS record but parent zone has no NS record. 1207 - Fix nsec3 missing for nsec3 signed parent and child for DS at zonecut. 1208 1209 1210 4.1.10 1211 ================ 1212 FEATURES: 1213 - ip-freebind: yesno option in nsd.conf sets IP_FREEBIND socket option 1214 for Linux, binds to interfaces and addresses that are down. 1215 - NSD includes AAAA before A for queries over IPV6 (in delegations). 1216 And TC is set if no glue can be provided with a delegation because 1217 of packet size. 1218 - print notice that nsd is starting before taking off. 1219 BUG FIXES: 1220 - Fix for openssl 1.1.0, HMAC_CTX size not exported from openssl. 1221 - Fix #751: NSD fails to occlude names below a DNAME. 1222 - If set without nsd.db print "" as the default in the man pages. 1223 - Fix #755: NSD spins after a zone update and a lot of TCP queries. 1224 - Fix for NSEC3 with zone signed without exact match for empty 1225 nonterminals, the answer for that domain gets closest encloser. 1226 - #772 Document that recvmmsg has IPv6 problems on some linux kernels. 1227 1228 1229 4.1.9 1230 ================ 1231 BUG FIXES: 1232 - Change the nsd.db file version because of nanosecond precision fix. 1233 1234 1235 4.1.8 1236 ================ 1237 FEATURES: 1238 - #732: tcp-mss, outgoing-tcp-mss options for nsd.conf, patch 1239 from Daisuke Higashi. 1240 - #739: zonefile changes when mtime is small are detected on reload, 1241 if filesystem supports precision mtime values. 1242 - RR type CSYNC (RFC7477) syntax is supported. 1243 BUG FIXES: 1244 - take advantage of arc4random_uniform if available, patch from 1245 Loganaden Velvindron. 1246 - Fix flto check for OSX clang. 1247 - Define _DEFAULT_SOURCE with _BSD_SOURCE for glibc 2.20 on Linux. 1248 - Fix #736: segfault during zone transfer. 1249 - Fix #744: Fix that NSD replies for configured but unloaded zone 1250 with SERVFAIL, not REFUSED. 1251 1252 1253 4.1.7 1254 ================ 1255 FEATURES: 1256 - support configure --with-dbfile="" for nodb mode by default, where 1257 there is no binary database, but nsd reads and writes zonefiles. 1258 - reuseport: no is the default, because the feature is not troublefree. 1259 - configure --enable-ratelimit-default-is-off with --enable-ratelimit 1260 to set the default ratelimit to disabled but available in nsd.conf. 1261 - version: "string" option to set chaos version query reply string. 1262 BUG FIXES: 1263 - Fix zones updates from nsd parent event loop when there are a lot 1264 of interfaces. 1265 - portability fixes. 1266 - patch from Doug Hogan for SSL_OP_NO_SSLvx options, for the new 1267 defaults in the ssl libraries. 1268 - updated contrib/nsd.spec, from Blint Szigeti, with new configure 1269 options. 1270 - Allocate less memory for TSIG digest. 1271 - Fix #721: Fix wrong error code (FORMERR) returned for unknown 1272 opcode. NOTIMP expected. 1273 - Fix zonec ttl mismatch printout to include more information. 1274 - Fix TCP responses when REUSEPORT is in use by turning it off. 1275 - Document default in manpage for rrl-slip, ip4 and 6 prefixlength. 1276 - Explain rrl-slip better in documentation. 1277 - Document that ratelimit qps and slip are updated in reconfig. 1278 - Fix up defaults in manpage. 1279 1280 1281 4.1.6 1282 ================ 1283 BUG FIXES: 1284 - Fix #701: Fix that AD=1 set in a BADVERS response. 1285 - Fix typo in zonec.c inside error message. 1286 - Fix #711: Document that debug-mode yes is used for staying 1287 attached to the supervisor console. 1288 - Document verbosity 3 prints more information. 1289 - nsd-checkconf warns for master zones with no zonefile statement. 1290 - Fix start failure when many file descriptors are in use. 1291 - The servfail rcode is not printed with a space in the middle. 1292 - print failed token for config syntax error or parse error. 1293 1294 1295 4.1.5 1296 ================ 1297 BUG FIXES: 1298 - Fix #706: default port 53 not opened on ip4 because of getaddrinfo 1299 hints initialisation failure. 1300 1301 1302 4.1.4 1303 ================ 1304 FEATURES: 1305 - RFC7553 RR Type URI support. 1306 - removed hardcoded interface limit, --with-max-ips removed. 1307 - SO_REUSEPORT support, by default on Linux, or with reuseport: yes. 1308 - Admitted axfrs are logged at verbosity 1. Refused at verbosity 2. 1309 - --enable-pie and --enable-relro-now options for a safer executable. 1310 BUG FIXES: 1311 - Fix NSID response for short edns sizes. 1312 - Fix that for expired zones NSD performs an AXFR and accepts newer 1313 and older serial numbers. 1314 - Document that minimal responses only minimizes responses to fit 1315 in one datagram. It does not minimize smaller responses. 1316 - Fix #618: documented need to list ip-addresses separately in 1317 nsd.conf if there are multiple, because the source address of 1318 replies can otherwise go wrong. 1319 - Fix that notify from nsd-control contains soa serial. 1320 - Fix #698 formatting errors and typos in nsd.8.in. 1321 1322 1323 4.1.3 1324 ================ 1325 FEATURES: 1326 - nsd-control addzones and delzones read list of zones from stdin. 1327 - hmac sha224, sha384 and sha512 support, patch from David Gwynne. 1328 - max-interfaces raised to 32. 1329 BUG FIXES: 1330 - Fix #665: when removing subdomain, nsd does not reparse parent zone. 1331 - Fix task and zonestat files to be stored in a subdirectory in tmp 1332 to stop privilege elevation. 1333 - Fix crash in zone parser for relative dname after error in origin. 1334 - Fix that formerrors are ratelimited. 1335 1336 1337 4.1.2 1338 ================ 1339 FEATURES: 1340 - Incoming notifies have serial number logged (at verbosity 1). 1341 BUG FIXES: 1342 - Remove some duplicate header includes (from Brad Smith). 1343 - Fix tcp waiting list for zone transfers where the bind and connect 1344 calls fail. 1345 - Fix segfault in zone reader on invalid input. (thanks John Van de 1346 Meulebrouck Brendgard) 1347 - Fix segfault on double origin in zone reader (thanks John Van de 1348 Meulebrouck Brendgard). 1349 - Fix b64pton out of bounds error on invalid zonefile input. 1350 (thanks John Van de Meulebrouck Brendgard) 1351 - Fix origin directive from unused old value and subdomain parser 1352 failure, reported by John Van de Meulebrouck Brendgard. 1353 - Fix use after free after zonefile syntax error followed by ttl 1354 or origin directive, reported by John Van de Meulebrouck Brendgard. 1355 - Fix syntax error followed by too many TXT elements parse crash 1356 reported by John Van de Meulebrouck Brendgard. 1357 - Fix buffer overflow in config parse of domain name, 1358 reported by John Van de Meulebrouck Brendgard. 1359 - Use reallocarray for integer overflow protection, patch submitted 1360 by Loganaden Velvindron. 1361 - Fix allocation integer overflow checks. 1362 - Fix #654: Fix contradiction in notify logging verbosity level. 1363 - Fix #655: Fix contradiction in verbosity for zone transfers. 1364 - Made log message more consistent, changed 'axfr refused' log message 1365 to be more consistent with other messages. Also notify refused. 1366 - verbosity 2 logs axfr refused and notify refused. 1367 verbosity 1 contains less log messages. 1368 1369 1370 4.1.1 1371 ================ 1372 FEATURES: 1373 - RFC 7344: CDS and CDNSKEY (read record types). 1374 - per zone statistics with --enable-zone-stats, config zone with 1375 zonestats: "name", zones configured with the same string are added. 1376 - Disabled use of SSLv3 in nsd-control. 1377 - nsd-checkconf -f prints out full name of pidfile (with dir). 1378 - Synthesize CNAMEs with same TTL as DNAME. 1379 BUG FIXES: 1380 - Fix that expired zones stay expired after a server restart. 1381 - Fix "xfrd_handle_ipc: bad mode" log errors when compiled 1382 with --disable-bind8-stats. 1383 - Fix #616: retry xfer for zones with no content after command. 1384 - Fix char used as array index warnings on NetBSD. 1385 - Fix that queries for noname CH TXT are REFUSED instead of nodata. 1386 - Fixes for wildcard addition and deletion, speedup for some cases. 1387 - Fix that failure to add tcp to tcp base does not leak the socket. 1388 - Patch nsd_munin_ from Philip Paeps to use type ABSOLUTE. 1389 - Fix spinning NSD with lots of failing transfers, due to pointer 1390 comparison using void pointer subtraction (from Otto Moerbeek). 1391 - Fix bug#637: fix that nsd.db grows limitlessly, an off by one 1392 on one megabyte free chunks, created during AXFRs of large zones, 1393 that caused the one megabyte chunk to be leaked. 1394 - Fix casts for ctype functions (from Todd Miller). 1395 - correct some hyphen-used-as-minus-sign (from Andreas Schulze) in 1396 man pages. 1397 - Fix zonesdir chroot error message. 1398 1399 1400 4.1.0 1401 ================ 1402 FEATURES: 1403 - database: "" starts without mmap of database. Less memory is used, 1404 zones are read from text zonefile. 1405 - optimised zonefile parse code and zonefile write code. 1406 - zonefiles-write option in nsd.conf, enabled when database is "". 1407 The server writes changed zonefiles to disk every hour. 1408 - xfrdfile: "" disables xfrd.state. If enabled, zones that are 1409 same as before are not checked for a serial update at server start. 1410 - include: "foo/nsd.d/*.conf" works, wildcard glob on includes. 1411 - nsd shuts down during init process if given signal. 1412 - log-time-ascii option, default yes, with readable timestamp in log. 1413 - nsd-control addzone reports if zone already exists. 1414 - Fix #564: add nsd-checkzone tool to check zonefile correctness. 1415 - Increased default --with-max-ips from 8 to 16, this increases the 1416 number of interfaces you can specify in nsd.conf to listen to. 1417 BUG FIXES: 1418 - Fixed shutdown message sporadically not printed on exit 1419 (Thanks Anand Buddhdev). 1420 - Documented zonefile %s syntax in nsd.conf man page. 1421 - Fix manpage to put colon after zonefiles check and write. 1422 - Change from 'Zone" to "zone" with ".. serial .. is updated" log 1423 message. 1424 - Changed maxbackoff for no-content secondary zones from 4h to 24h. 1425 - Fix print filename of encompassing config file on read failure. 1426 - Fix delete or rename of a lot of zones and make it take a 1427 non-enormous time. 1428 - Speed up deletion of zone contents a lot, (56s to 1s), speeds up 1429 delete, rename and AXFR for zones. 1430 - Fix #571: unused variable and incompatible pointer warnings when 1431 compiled on a system without INET6. 1432 - Fix write_socket return value check in server.c (Thanks Brad Smith, 1433 Mark Kettenis). 1434 - Fix that xfrd reaps children also if the signal is lost. 1435 - Fix #577: makefile incorrectly installed manpages from srcdir. 1436 - Fix #587: Default value for statistics is 0. 1437 - Fix #553: Improve TXT parsing. 1438 - Fix #590: rrl log does not print wildcard as a star but escaped. 1439 - Fix #591: rrl log messages at verbosity level 1. 1440 - fix strptime implicit declaration error on OpenBSD. 1441 - Fix -O3 compile flag to -O2 to avoid miscompilations. 1442 - Allow user to override the -g -O2 CFLAGS in ./configure. 1443 - Fix endian.h include for OpenBSD. 1444 - Fix #600: document that provide-xfr provides AXFR and not IXFR. 1445 - Fix rising-load-average or memory-leaks in OSes (Linux since 2.6), 1446 that keep track of all past process parents, or leak memory 1447 for them. Fix makes it so there is no very deep string of 1448 process parents. 1449 - Remove .LP after .SH in man pages. 1450 1451 1452 4.0.3 1453 ================ 1454 BUG FIXES: 1455 - Fix nsd.db unclean close check. Previous databases are considered 1456 unclean by the code and are created anew. 1457 - Adds nsd.db larger than 400Tb check for sanity. Also test if 1458 filesize as documented in the file is correct. 1459 - nsd waits for tasks to complete on stop, prevents nsd.db corruption. 1460 - fix to not delete tmpdir too early in shutdown process. 1461 - disabled udb checking functionality that made it very slow, 1462 this was enabled when enable-checking was turned on. 1463 1464 1465 4.0.2 1466 ================ 1467 FEATURES: 1468 - Return REFUSED for queries to non-hosted zones. 1469 1470 BUG FIXES: 1471 - Fix expired zones to give SERVFAIL, also when parent zone loaded. 1472 - documented nsd-control zonestatus output in nsd-control manpage. 1473 - remove mention of nsdc from nsd-checkconf manpage. 1474 - Disabled recvmmsg and sendmmsg usage by default because kernel 1475 versions have implementation issues: ipv6 ignored, security issues. 1476 - Detect libevent2 install automatically by configure, and use 1477 event2 header files if necessary. 1478 - Fix #551: change Regent to Copyright holder in the LICENSE, 1479 to match the definition on opensource.org for the BSD License. 1480 - Fix #552: zonefile loads on nsd-control reconfig when the name 1481 of the file has changed. 1482 - Fix leak of zone name after zonefile read and fix malloc too 1483 large that would be leaked in the radix tree. 1484 - Fix from 3.2: make SOA RDATA comparisons in XFR more lenient (only 1485 check serial). 1486 - Fix that NSD will delete and recreate not-clean-closed databases. 1487 1488 1489 4.0.1 1490 ================ 1491 FEATURES: 1492 - recognizes ip-address and interface as synonyms for convenience. 1493 - Support for EUI48 and EUI64 RR types enabled by default (RFC 7043). 1494 - Support for CAA RRtype (RFC 6844). 1495 - NSID can be set with "ascii_somestring" in ascii. 1496 1497 BUG FIXES: 1498 - Fix xfrd when zone transfer TCP contains zero length packets. 1499 - Fix for NSEC3 zones where parent zone is co-hosted, also NSEC3, 1500 because AXFRs overwrote nsec3 administration in the child zone. 1501 - Fix that bad IXFR updates do not result in double SOA records, 1502 and that an AXFR is started (attempted) when the zone state seems 1503 to be inconsistent with the master's zone state. 1504 - Log ip address for sendto and sendmmsg failures. 1505 - Fix segfaults after read of zones with rr type WKS from zonefile. 1506 - Seed PRNG for openssl at start of daemon, fixes SSL connection issue. 1507 - Bugfix #534: IXFR query loop over UDP for zones that are unchanged. 1508 - (same as in 3.2.16): fix wildcard cname to nxdomain repeated rrset. 1509 - (same as in 3.2.16): Bugfix #542: Match RRSIG TTL with SOA TTL in 1510 negative response. 1511 - Check if configure in srcdir collides with outofdir build. 1512 - Fix #546: output format errors in nsd_munin_ (Thanks Tom Hendrikx). 1513 - Fix printout of high-chars in TXT on NetBSD. 1514 1515 4.0.0 NSD 4.0 1516 =============== 1517 FEATURES: 1518 - documented in doc/NSD-4-features. Change configuration without 1519 restart, direct nameserver control with nsd-control, support a 1520 higher number of zones. Higher performance (compared to NSD3). 1521 - nsdc is gone. Use kill -HUP for reload (also checks if zonefiles 1522 have changed and rereads them), and kill -TERM for quit. Or use 1523 nsd-control for detailed control. 1524 - cron job for nsdcpatch is gone. nsd-control write creates zonefiles. 1525 - nsd.db has a new format that compacts itself when it is changed, 1526 thus nsdc patch is no longer necessary. 1527 - nsd.db is memory mapped, NSD needs (part of) that mmap in ram. 1528 - tcp-count can go above 1000; epoll/kqueue support with libevent. 1529 - nsd-control reconfig for updates with no restart (zones, keys, ..) 1530 - nsd-control-setup to create keys for nsd-control (enable nsd-control 1531 with remote-control: yes in nsd.conf). 1532 - the NSD 3 feature of special zone stats are not ported to 4 yet, 1533 as it would entail a complete reimplementation of the feature. 1534 FEATURES (incremental from BETA5): 1535 - configure --disable-recvmmsg for compat with older Linux kernels, 1536 by default it autodetects support in the kernel on the buildmachine. 1537 - Fix time at 2038, uint32s changed to time_t, support 64bit time_t. 1538 - Fix use of 32bit time, for 2038, thanks to Theo de Raadt for patch. 1539 BUG FIXES (incremental from BETA5): 1540 - Bugfix #518 Incorrect RRL prefix length option names in nsd.conf 1541 man page from Ville Mattila. 1542 - Fix that xfrd, and nsd-control, does not stop responding when reload 1543 errors out. The pid is sent like it should by server_main. 1544 - Fix that EOF in quoted string error does not cause reload to exit. 1545 - Fixup errors from the stack code checker. 1546 - Removed use of random when arc4random is available. Thus, random 1547 and srandom are then not linked with the executable. 1548 - Fix segfault with no logfile and chroot (Thanks Patrik Lundin). 1549 1550 4.0.0b5 BETA 5 release of NSD 4.0 1551 ================================== 1552 FEATURES: 1553 - Optimizations for startup, qps and tcp speed, beta bug fixes and 1554 merge with code changes with NSD 3.2.16. 1555 - nsd-mem tool (make nsd-mem) to estimate memory usage. 1556 - Same as NSD 3.2.16: --enable-draft-rrtypes(EUI48, EUI64), rr-slip, 1557 rrl-ipv[46]-prefix-length, ip-transparent config options. 1558 - configure option --disable-flto. 1559 - improved RRL logging (query details that caused blockage). 1560 - nsd-control status prints out ratelimit if ratelimit is enabled. 1561 - nsd-control verbosity prints out verbosity level without argument. 1562 - Fix #491: pick program name (of executable) as syslog identity. 1563 - printout percentage for long activities (to log). After about 5 1564 seconds have passed. 1565 BUG FIXES: 1566 - The same fixes up to NSD 3.2.16. 1567 - Fix that old zonefile does not override newer AXFR for slave zones. 1568 - Nicer printout of notify. 1569 - Fix tcp zonetransfer pipeline lookup function. 1570 - Fix compile on bigendian netbsd alpha. 1571 - Fixup the growth and shrinkage of nsd.db. This should use less 1572 calls to remap and change the file and mmap size. 1573 - notify information is logged at correct verbosity level, 1. 1574 - Fix memory statistics in nsd_munin_. 1575 - faster nsec3 updates. 1576 - Fixup contrib/bug390.patch for 4.0.0b4. 1577 - remove leak of nsec3. 1578 - allocate radixtree in region for small (5%) total savings and 1579 about 15% savings in the radixtree itself (due to many small alloc 1580 savings in region). 1581 - Patch from Lukas Wunner that makes nsd.conf include files work 1582 inside chroot/etc environments on repattern and reconfig. 1583 - Fix race on exit of nsd, for restarts, so that the pidfile-pid 1584 process waits until port53 has been closed before exiting. 1585 - Patch from Lukas Wunner that makes chroot more consistent. 1586 Make all paths absolute with the chrootdir in front, or use 1587 an absolute zonesdir with other paths relative to that. 1588 - Fix segfault on repeated reconfigs, double free of zone apex name. 1589 - Fix zone parser allocations are put in the db region. 1590 - Fix memory leak in zone parser for txt record. 1591 - Optimizations: -O3 if possible (user can override CFLAGS), udp 1592 buffers are set to 1m by default (if socket options exist), 1593 use recvmmsg and sendmmsg, or only recvmmsg, or recvfrom. 1594 - nsd.db 12% smaller, no nsec3 hash storage. Also ups udb version 1595 because of the format change. The nsd.db is recreated when a 1596 different version number is detected on startup. 1597 - Fix region-allocator for speedup of load and change of large data. 1598 - Increase tcpbacklog default to 256 (silently capped to 128 on BSD). 1599 For remote control keep it at 16, it has less TCP load. 1600 It does not actually increase TCP performance (some except), but 1601 reduces connection loss when there is a spike in TCP connections. 1602 - unlink xfr file if transfer is stopped, timeouted or interrupted. 1603 And unlink xfr file in progress when the zone is deleted. 1604 1605 4.0.0b4 BETA 4 release of NSD 4.0 1606 ================================== 1607 BUG FIXES: 1608 - remove -fwhole-program gcc flag usage. We cannot reliably detect 1609 if it works without failure. 1610 - fix zonefiles-check: entry in nsd.conf 1611 - fix gcc warning, do not use uninit value for rng init. 1612 - remove printout of "bad transfer" to the log for notimpl. 1613 - printout log less verbosely, not every axfr packet. 1614 - RRL documented in nsd.conf.sample 1615 - Fix is_apex flag for zones read from udb. 1616 - Fix that nsec3 zones are precompiled when read from udb. This 1617 caused assertion failures. 1618 - Less printout of 'bad transfer'. 1619 - Fix AXFR of NSEC3 slave zone. 1620 - Fix that old zonefile does not override newer AXFR for slave zones. 1621 - Nicer printout of notify on verbosity 2. 1622 1623 4.0.0b3 BETA 3 release of NSD 4.0 1624 ================================== 1625 BUG FIXES: 1626 - applied patch from Robin Hack to remove double pid file truncation. 1627 - repattern is called reconfig (because most config options are 1628 picked up, except for superuser options (chroot, logfile, port)) 1629 - document that the zonefile attribute can be empty. 1630 - documented that the _implicit_ pattern names are used internally. 1631 - Added zonefiles-check option, default yes, check mtimes of zone files 1632 on sighup and startup (from Robin Hack). 1633 - Fix spurious assertion failure for some rrl blocks. 1634 - Tabs and spaces nicer in nsd.conf.sample. 1635 - List libevent in README. 1636 - Fix configure for gentoo gcc and headers. 1637 - do-ip4 and do-ip6 nsd.conf options just like unbound. 1638 - do not leave task files in /tmp if nsd fails to startup because 1639 of file permissions. 1640 - create xfrdir on make install (does not remove on make uninstall, 1641 because this could be /tmp). 1642 - Fix segv if xfrdir does not exit. 1643 - log ip address with tcp failure. 1644 - Fix time calculation of zone transfer. 1645 1646 4.0.0b2 BETA 2 release of NSD 4.0 1647 ================================== 1648 FEATURES: 1649 - Add and remove zones from nsd.conf with nsd-control repattern. 1650 - Merge changes from 3.2.15 (such as xname-rcode fix). 1651 1652 BUG FIXES: 1653 - Fix for use with libev. 1654 - 'nsd-control start' runs an absolute path to start sbin/nsd. 1655 - Fix for use with libevent-2.1.2. 1656 - --with-logfile sets the logfile inside the example documentation. 1657 - Fixed addzone and delzone inside chroot (thanks Will Pressly). 1658 - Fix make outside of source directory. 1659 1660 4.0.0b1 BETA 1 release of NSD 4.0 1661 ================================== 1662 FEATURES: 1663 - add and remove zones without restart. 1664 - nsdc is gone, use nsd-control for direct server control. 1665 - performance increases 1666 - support lots of zones 1667 - and more ... 1668 - longer desc in doc/NSD-4-features 1669 1670 BUG FIXES: 1671 - core code is fixed like 3.2.15r3763 (12 dec 2012). 1672 1673 1674 3.2.16 (development branch) 1675 ================================= 1676 1677 FEATURES: 1678 - New config option "ip-transparent:" to allow NSD to bind to 1679 non local addresses. Default no. 1680 - Use IPV6 minimum MTU settings with TCP to reduce failures that 1681 are caused by delays in learning working PMTU when communicating 1682 through a tunnel. 1683 - Bugfix #496: Support for EUI48 and EUI64 RR types. Experimental, 1684 turned off by default. Enable with --enable-draft-rrtypes. 1685 - New config option "rrl-slip:" to set the average number of 1686 packets discarded before we send back a truncated response. 1687 - New config option "rrl-ipv4-prefix-length:" and 1688 "rrl-ipv6-prefix-length:" to set the prefix lengths. 1689 - Improved RRL logging, also print triggering query src address and 1690 QTYPE. 1691 - Provide RRL documentation in nsd.conf.sample. 1692 1693 BUG FIXES: 1694 - Bugfix #357: Parent process waits until children closed down 1695 sockets, to prevent NSD failing to bind to sockets when restarting. 1696 - Bugfix #487: lookup3.c determine endianness for BSD systems. 1697 - Bugfix #491: pick program name (0th argument) as syslog identity. 1698 - Bugfix #494: Exit with return code 1 if socket code fails. 1699 - RRtypes ASFDB, RP, RT should not compress dnames. 1700 - Fix outgoing-interface: Don't fail if family is IPv6 but 1701 only IPv4 outgoing-interface is set, or vice versa. 1702 - RRtypes ASFDB, RP, RT should not compress dnames. 1703 - Check that zone directory is within chroot directory. 1704 - Better XFR checking, fallback to AXFR (if allowed) if three 1705 malformed XFR packets have been seen. 1706 1707 1708 3.2.15 1709 ================================= 1710 1711 FEATURES: 1712 - Support for ILNP RR types: NID, L32, L64, LP (RFC6742). 1713 - RRL, --enable-ratelimit at configure time and config options. 1714 - TSIG initialization only fails when there is no digest found 1715 at all. 1716 1717 BUG FIXES: 1718 - Bugfix #478: Declaration after statement (for gcc 2.95). 1719 - Bugfix #483: Better error message in case of TSIG error. 1720 - Bugfix #485: TTL should not be greater than 2^31 - 1. 1721 - Fix RCODE when CNAME loop final answer does not exist, should 1722 return NXDOMAIN as stated by RFC 6604. 1723 - Fix --disable-full-prehash bug, where after multiple incoming 1724 IXFRs, NSEC3 can be removed unjustified. 1725 1726 3.2.14 1727 ================ 1728 1729 FEATURES: 1730 - TCP writev support. 1731 1732 BUG FIXES: 1733 - Fix build on OpenBSD (thanks Oliver Peter). 1734 - Prioritize notify sender for requesting XFR (thanks Ilya Bakulin). 1735 - Fix crash in zonec if TXT string too long (thanks Ilya Bakulin). 1736 - tzset before chroot for correct timezone (thanks Camiel Dobbelaar). 1737 - Fix --disable-full-prehash bug when nsdc patch happens while ixfr too, 1738 it did not rehash the new database. 1739 - Bugfix #464: Conditionally define MAXHOSTNAMELEN. 1740 1741 3.2.13 1742 ================ 1743 1744 BUG FIXES: 1745 - Fix for nsd-patch segfault if zone has been removed from nsd.conf 1746 (thanks Ilya Bakulin). 1747 - Bugfix #460: man page correction - identity. 1748 - Bugfix #461: NSD child segfaults when asked for out-of-zone data 1749 with --enable-zone-stats. [VU#517036 CVE-2012-2979] 1750 1751 1752 3.2.12 1753 ================ 1754 1755 BUG FIXES: 1756 - Fix for VU#624931 CVE-2012-2978: NSD denial of service 1757 vulnerability from non-standard DNS packet from any host 1758 on the internet. 1759 http://www.nlnetlabs.nl/downloads/CVE-2012-2978.txt 1760 1761 1762 3.2.11 1763 ================ 1764 1765 FEATURES: 1766 - Fallback to AXFR if IXFR is unknown at the primary. NSD considers 1767 IXFR unknown at the primary if there is a negative response for the 1768 IXFR RRtype. This does not override the value for 1769 'allow-axfr-fallback'. 1770 - Allow for reading in new DNSKEY algorithm mnemonics (RFC5155, 1771 RFC5702, RFC5933, and RFC6605 (ECDSA)). 1772 - Zone statistics, enable with --enable-zone-stats. This stores the 1773 BIND8 stats per zone in a configurable statistics file. This option 1774 does not scale and should therefore not be enabled when serving 1775 many zones. 1776 - Support for TLSA RRtype (DANE). 1777 1778 BUG FIXES: 1779 - Fix for qtype ANY for a wildcard domain in NSEC signed zone: Don't 1780 add the wildcard domain NSEC into the answer section. Instead, 1781 put the wildcard expanded NSEC into the answer section and keep the 1782 wildcard domain NSEC in the authority section. 1783 - Fix for accept spinning reported by OpenBSD. 1784 - Fix restart failed due to bad ixfr packet because of zone removed 1785 from nsd.conf. 1786 - Bugfix #453: typo in nsdc man page. 1787 1788 OPERATIONAL NOTES: 1789 - NSD uses the query name for dname compression again (Fix #235 1790 had as side effect that this didn't happen anymore and is hereby 1791 undone). 1792 1793 1794 3.2.10 1795 ================ 1796 1797 BUG FIXES: 1798 - Bugfix #421: Truncate pidfile on shutdown, before unlink. 1799 - Bugfix #423: Fix slow zone transfer processing due to 1800 'Fix is_existing flag for ENT' bugfix. 1801 - Fix bug #430: segfault when MAX_INTERFACES set to more than 65K. 1802 - Fix configure.ac strptime check for gcc 4.6.2, acx_nlnetlabs update. 1803 1804 1805 3.2.9 1806 ================ 1807 1808 FEATURES: 1809 - Minimize responses to reduce truncation: NSD will only add optional 1810 records to the authority and additional sections when the response 1811 size does not exceed the minimal response size. 1812 1813 The minimal response size is 512 (no-EDNS), 1480 (EDNS/IPv4), 1814 1220 (EDNS/IPv6), or the advertized EDNS buffer size if that is 1815 smaller than the EDNS default. 1816 1817 The feature is enabled by default. You can disable it by configuring 1818 NSD with --disable-minimal-responses. 1819 1820 - Less NSEC3 prehashing. This will make NSD handle zone transfers 1821 faster, but will decrease the performance of NXDOMAIN and wildcard 1822 NODATA responses. Full prehashing is enabled by default. If you want 1823 less NSEC3 prehashing, configure NSD with --disable-full-prehash. 1824 Thanks Secure64 for the patch. 1825 1826 BUG FIXES: 1827 - Bugfix #302: nsd accepts XFR but refuses to re-read the slave zone. 1828 - Bugfix #365: set patch style and zonec verbose for nsdc. 1829 - First step of bug #369: RRSIG DNSKEY sets zone to be treated DNSSEC. 1830 - Bugfix #375: typos in nsd.conf.5. 1831 - Bugfix #381: Binary escaped and transfers. 1832 - Bugfix #397: Don't allow relative domain names as origin in $INCLUDE 1833 directives. 1834 - Fix printout of IPSECKEY by nsd-patch. 1835 - Fix is_existing flag for ENT when domain that has a shared ENT 1836 is deleted by IXFR. (ENT == Empty Non-Terminal) 1837 - Fix bug if the zonefile is changed for a secondary but stored 1838 transfers are applied, and stop it from applying ixfr to empty zone. 1839 The zone is flagged with error and AXFR-ed. 1840 - Fix to have no authority NS set processing for CNAMEs. 1841 - Fix nsd-checkconf to check tsig algorithms properly. 1842 - Set the AA bit on responses that have an authoritative CNAME. 1843 - Fix denial of existence response for empty non-terminal that looks 1844 like a NSEC3-only domain (but has data below it). 1845 1846 OPERATIONAL NOTES: 1847 - nsd.db version number increased because NSD 3.2.7 and earlier 1848 zonec is not compatible due to the TXT strings change. Please 1849 run nsdc rebuild before running NSD 3.2.9 and later versions. 1850 1851 1852 3.2.8 1853 ============= 1854 1855 BUG FIXES: 1856 - Do setusercontext() before chroot(), otherwise login.conf etc. are 1857 required inside chroot. 1858 - Bugfix #216: Fix leak of compressiontable when the domain table increases 1859 in size. 1860 - Bugfix #348: Don't include header/library path if OpenSSL is in /usr 1861 - Bugfix #350: Refused notifies should log client ip. 1862 - Bugfix #352: Fix hard coded paths in man pages. 1863 - Bugfix #354: The realclean target deletes a bit too much. 1864 - Bugfix #357, make xfrd quit with many zones. 1865 - Bugfix #362: outgoing-interface and v4 vs. v6 leads to spurious 1866 warning messages. 1867 - Bugfix #363: nsd-checkconf -v does not print outgoing-interface ok. 1868 - Bugfix: nsd-checkconf -o outgoing-interface omits NOKEY. 1869 1870 OPERATIONAL NOTES: 1871 - Use 'make clean' to clean up files that make created. 1872 - Use 'make realclean' to also clean up files that were generated by 1873 running ./configure. 1874 - Use 'make devclean' to also clean up autoconf, autoheader files. 1875 1876 3.2.7 1877 ============= 1878 1879 BUG FIXES: 1880 - Bugfix #253: Don't put NS RRs in a response with QTYPE=DS. 1881 - Bugfix #320: use arcrandom(4) for QID generation if available. 1882 - Bugfix #328: nsd-checkconf overrun. 1883 - Bugfix #343: nsdc update fix. 1884 - Bugfix #347: Wrong NSEC3 returned for nodata response QTYPE=DS no delegation. 1885 - Bugfix: Allow for huge amount of strings in TXT (and other) records. 1886 - Bugfix: nsdc can now deal with tsig algorithms other than hmac-md5. 1887 - Fixed several parts in the documentation, including #306, #345. 1888 1889 3.2.6 1890 ============= 1891 1892 BUG FIXES: 1893 - Bugfix #314: correctly print NSEC next field, escape spaces and 1894 fix label overflows. 1895 1896 FEATURES: 1897 - Expand command line option '-a' and config option 'ip-address:' 1898 with port number. 1899 1900 OPERATIONAL NOTES: 1901 - Configure options --disable-dnssec, --disable-nsid, --disable-tsig 1902 are removed. 1903 - Configure option --max-interfaces is renamed to --max-ips. 1904 1905 3.2.5 1906 ============= 1907 BUG FIXES: 1908 - NSD will not start if chroot is configured, but changing root is 1909 not possible (it used to ignore the badly configured chroot). 1910 - Make use of the more secure strl* functions. 1911 - Bugfix #303: spelling error. 1912 1913 FEATURES: 1914 - New option 'nsid:', to specify the NSID (Bugfix #298). 1915 - The default chroot can be set with --with-chroot=<dir>. 1916 If not set, by default chroot will not be used (thanks Jakob Schlyter). 1917 - Optimized zonec and b64_pton compatibility code (thanks Martin Svec). 1918 - Optimized memory allocations. Use mmap/munmap instead of malloc/free. 1919 Experimental, by default off. Enable it at build time with 1920 --enable-mmap (thanks Martin Svec). 1921 1922 OPERATIONAL NOTES: 1923 - NSID support is now enabled by default. 1924 1925 3.2.4 1926 ============= 1927 BUG FIXES: 1928 - Bugfix #269: Additional C99 syntax. 1929 - Bugfix #276: Zonec prints debug data to stderr. 1930 - Bugfix #286: Document verbosity levels in nsd.conf manual page. 1931 - Bugfix #288: Ignore SIGHUP to child processes. 1932 - Fix typo in include file for setusercontext. 1933 1934 FEATURES: 1935 - Support DLV records. 1936 - New option 'tcp-query-count:', to limit the maximum number of 1937 DNS queries on a single tcp connection. 1938 - New option 'tcp-timeout:', to override the default tcp timeout. 1939 The default can also be set at build time, --with-tcp-timeout=<number>. 1940 - New option 'notify-retry:', to configure how many times NSD should retry 1941 a NOTIFY message. 1942 - New options 'ipv4-edns-size:' and 'ipv6-edns-size:'. to set your preferred 1943 EDNS buffer size. 1944 1945 OPERATIONAL NOTES: 1946 - UDP/IPv4 sockets have new options set that will disable the DF flag in IP 1947 packets. 1948 1949 3.2.3 1950 ============= 1951 BUG FIXES: 1952 - Bugfix #236: Allow RRs before the SOA in a zonefile. 1953 - Bugfix #249: Remove the C99 code. 1954 - Bugfix #253: Don't put NS RRs in a response with QTYPE=DNSKEY. 1955 - Bugfix #263: Make TSIG algorithm comparison case insensitive. 1956 - Bugfix #266: Build failed on systems without strptime. 1957 - Bugfix: install hickup. 1958 - Fix to use 4096 EDNS limit for IPv6 on Linux. 1959 1960 3.2.2 1961 ============= 1962 BUG FIXES: 1963 - Off-by-one buffer overflow fix while processing the QUESTION section. 1964 - Return BADVERS when NSD does not implement the VERSION level of the 1965 request, instead of 0x1<FORMERR>. 1966 - Bugfix #234. 1967 - Bugfix #235. 1968 - Reset 'error occurred' after notifying an error occurred at the $TTL or 1969 $ORIGIN directive (Otherwise, the whole zone is skipped because the 1970 error is reset after reading the SOA). 1971 - Minor bugfixes. 1972 1973 3.2.1 1974 ============= 1975 OPERATIONAL NOTES: 1976 - NSD will now fallback to AXFR, only if the master does not support IXFR. 1977 - You can adjust nsdc patch to skip textfile patching. This will 1978 increase the patching process, but will not output to zonefiles 1979 anymore. By default, this is off. 1980 1981 BUG FIXES: 1982 - When configuring, don't do strptime test when cross-compiling. 1983 - Bug #230: Output non-error messages to stdout. 1984 - Better error message when ixfr.db old file format is read. 1985 - Bug #218: shared UDP query for all interfaces. 1986 - Bug #222: Remove bashism from nsdc script. 1987 - Nicer check for SHA-256 functionality. 1988 - Fixed some minor memory leaks that occurred on reload. 1989 - nsdc: check if a lockfile has not gone stale, when lock failed. 1990 - Bugfix strptime compatibility function 1991 1992 FEATURES: 1993 - New configuration option 'allow-afxr-fallback', "yes" by default. If 1994 set to "no", NSD will never do AXFR fallback, even if the master 1995 does not support IXFR. 1996 - Allow file rotation on nsd.log. 1997 - The new nsd-patch options -s and -o allows you to skip writing 1998 zonefiles and store the output directly to a database file, 1999 respectively. 2000 2001 3.2.0 2002 ============= 2003 OPERATIONAL NOTES: 2004 - Format of ixfr.db has changed. When you are planning an upgrade to the 2005 new NSD release, make sure to process the old ixfr.db before starting 2006 the new release (by running nsdc patch). 2007 - IXFR is transmitted over TCP by default instead of UDP. If you want to 2008 continue the use of IXFR/UDP, please modify your zone configuration 2009 file to: 2010 request-xfr: UDP 1.2.3.4 tsigkey 2011 We strongly recommend to enable TSIG if you send IXFR over UDP. 2012 When all masters fail to transmit IXFR/UDP, slave will fallback to 2013 IXFR/TCP and eventually AXFR/TCP. 2014 - nsd-patch prints errors to stderr instead of stdout. 2015 2016 BUG FIXES: 2017 - Only normalize dnames in rdatas when rrtype is listed in RFC 4034, 2018 section 6.2: Canonical RR Form, following 2019 draft-ietf-dnsext-dnssec-bis-updates (affects RRSIG and NSEC records). 2020 - Typo in zonec manpage. 2021 - Bugfix in log_finalize. 2022 - Fix race condition between nsdc patch and server reload. 2023 2024 FEATURES: 2025 - AXFR/TCP fallback in case of failing IXFR zone transfers. 2026 - RFC 4635: support for hmac-sha1 and hmac-sha256 TSIG algorithm 2027 identifiers, "Bugfix #130". 2028 - Configure the source ip-address for notifies (master) and zone 2029 requests (slave) in nsd.conf, "Bugfix #148". 2030 - nsd-notify and nsd-xfer allow you to configure the outgoing 2031 hostname and source port, in addition to the source address. 2032 - Additional debug and verbose log messages. 2033 2034 3.1.1 2035 ============= 2036 BUG FIXES: 2037 - Try to avoid race conditions with NSD reloading and nsdc running, 2038 by writing pidfile before closing old parent process. 2039 - Fixed NSEC3 memory leak in the case NSEC3 is not needed. 2040 - Fixed some memory leaks that happened on error, mostly on 2041 zone transfer errors. 2042 - Bugfix #191: nsd-checkconf allowed only (max_interfaces-1) interfaces. 2043 2044 FEATURES: 2045 - The number of maximum interfaces allowed is configurable with 2046 --with-max_interfaces=<number> (thanks John Lightsey). 2047 2048 3.1.0 2049 ============= 2050 OPERATIONAL NOTES: 2051 - Default locations of nsd.db, ixfr.db & xfrd.state are changed to 2052 the /var/db/nsd directory. 2053 2054 BUG FIXES: 2055 - Zone compiler gives more sane error messages when out of 2056 diskspace and bug #172: when compiling single zone file. 2057 - Changed man pages format from mdoc to mansun, to support the Solaris OS. 2058 - Log tcp read error only when connection not reset by peer or when 2059 verbosity level is high. 2060 - RRs are compared without checking the TTL value. 2061 2062 FEATURES: 2063 - NSD is now NSEC3 enabled by default. You can disable it by configuring 2064 NSD with --disable-nsec3. 2065 - Added "hide-version" configuration setting. Enabling this feature 2066 stops NSD from answering to CHAOS class version requests. 2067 - Added bind2nsd 0.5.0 (http://bind2nsd.sourceforge.net) in contrib/. 2068 - Report source and zone for denied AXFR attempts. 2069 2070 3.0.8 2071 ============= 2072 FEATURES: 2073 - Better logging for nsd-notify (show 'broken' zone) 2074 - Add configuration for chkconfig to control nsd service. 2075 2076 BUG FIXES: 2077 - Fixed nsdc start when nsd already running: do not initialize server, 2078 since it is already running. 2079 - Fixup bug where data related files are looked up in the wrong 2080 directory when chrooted with chrootdir ending with a slash. 2081 - Fixup bug where nsd would return FORMERR if received an edns 2082 query with version set to zero and rdlen larger than zero. 2083 - Fixed strptime, so that zonec will also work on systems with broken 2084 strptime (like leopard :-)) 2085 - Do not answer nsec3 wildcard information when DO bit is not set 2086 - Better logging when creating database failed. 2087 - Various spelling errors 2088 2089 3.0.7 2090 ============= 2091 BUG FIXES: 2092 - Error handling for malformed IXFRs improved. 2093 - Fixed man pages, consistent syntax. 2094 2095 3.0.6 2096 ============= 2097 FEATURES: 2098 - Report source and zone for denied AXFR attempts. 2099 2100 BUG FIXES: 2101 - More elegant handling of malformed nsec3 records from a zone 2102 transfer. 2103 - Fixup ignored return value in region-allocator. 2104 - Added bind2nsd 0.5.0 (http://bind2nsd.sourceforge.net) in contrib/. 2105 2106 3.0.5 2107 ============= 2108 BUG FIXES: 2109 - Fixed problem with reload waiting very long. If the OS has a 2110 raging herd problem, NSD could block in a UDP operation and 2111 that process would stop reload from finishing. Made UDP sockets 2112 nonblocking. 2113 - Made TCP listen sockets nonblocking. NSD could block in accept. 2114 - Handle the new CERT RDATA types defined in RFC 4398 (submitted by 2115 Mans Nilsson). 2116 - Fixed a bug where zonec would choke on unknown CERT RDATA types. 2117 - Change nsd-notify retry timer from linear into exponential 2118 backoff (submitted by Mans Nilsson). 2119 - Debug flag (-d) behavior changed. Nsd now also forks children when 2120 run in debug mode. 2121 - Added verbosity mode (-V <level>) for extra operational logging. 2122 - zonesdir default is /etc/nsd. This can be overridden in nsd.conf. 2123 - if clients drop the tcp connection this does not result in a logfile 2124 entry, unless verbosity is set 2 or more. 2125 2126 3.0.4 2127 ============= 2128 BUG FIXES: 2129 - zonec will print an error when other data is put next to a CNAME. 2130 - Fixup unaligned memory access that could occur when reading ixfr.db 2131 with a partial transfer inside. 2132 - Fixup for the WKS RR type printout by nsd-patch and nsd-xfer. 2133 - Error message 'could not read database CRC' now only given on error. 2134 - ./configure --zonesdir=<directory for zone files> now works to 2135 set a default value for the zonesdir: <dir> nsd.conf directive. 2136 Set zonesdir: "" to disable the change of directory. 2137 - Bug: reload crashes with log message 'continuing with old database', 2138 and after that no more zone updates. Manual fix is to kill -HUP, 2139 but now fixed in software to try to reload again (and again). 2140 - Small speedup where xfrd could briefly be busy-waiting. 2141 - If master sends IXFR with glue that is already present in the zone 2142 this is silently accepted. Printed in debug mode -L 2. To make 2143 the log file smaller. 2144 - Exponential backoff for zones that never worked to max of 4 hours. 2145 For expired zones the SOA retry values are used. 2146 - allow-notify acl entries 'NOKEY' match only queries without TSIG. 2147 - Answers to valid notifies contained wrong RR counts in the header. 2148 The notifies were processed correctly, but now the acknowledgement 2149 reply is in correct DNS format. 2150 FEATURES: 2151 - Added contrib/nsd.zones2nsd.conf python script to convert NSD 2 to 2152 NSD 3 config files, contributed by Stephane Bortzmeyer. 2153 - The nsdc control script will print 'nsd startup failed' if the nsd 2154 executable does not start (due to bad permissions, bad config, ...). 2155 2156 3.0.3 2157 ============= 2158 BUG FIXES: 2159 - Bug #152: NSD would not use the identity from nsd.conf, fixed. 2160 - Bug #153: When running with thousands of secondary zones, NSD would 2161 run out of UDP sockets. Caused crash on FreeBSD, errors on Linux 2162 ('out of file descriptors'), depending on ulimits. Fixed. 2163 - Fixed getaddrinfo error message to be more descriptive. 2164 - Fallback to ip4 if getaddrinfo fails for ip6. 2165 - Will no longer lose a notify message during reloads (IPC). 2166 - Will no longer lose transfer in progress when notified for that zone. 2167 - Nicer error when operator forgets to rebuild after deleting a zone. 2168 2169 3.0.2 2170 ============= 2171 BUG FIXES: 2172 - Nice error from zonec on a wrong configuration zone name. 2173 - Nicer warning from zonec when starting secondary zone with 2174 no zone file for the first time. 2175 - nsdc makes more portable use of 'which' (for SunOS5.9/bash2.05). 2176 - Bug #143: Improved handling of zonesdir: directive and relative 2177 pidfile, database, diff file, xfrdfile paths in nsdc.sh and 2178 nsd-patch. They would not find the files. 2179 - Bug #144: LOC RRtype default values for precision wrong. Fixed. 2180 - Bug #145: NSD failed to reload cases of simultaneous zone transfer. 2181 - Bug #146: NSD fails to write to xfrdfile when chrooted. Fixed. 2182 Also fix for difffile when chrooted. 2183 - Bug #147: NSD runs out of memory. Fixed, memory is reused. 2184 Occurred when running NSD with very big zones and large updates. 2185 - nsd -L 1 logging is smaller, -L 2 contains all debug information. 2186 (only available for debug compiles). 2187 - Bug #149: Fixed text for NOTAUTH error code. When notify is not 2188 authorised REFUSED error code returned instead. 2189 2190 3.0.1 2191 ============= 2192 BUG FIXES: 2193 - nsd-patch prints SOA record at start of zone files. 2194 2195 3.0.0 2196 ============= 2197 FEATURES: 2198 - AXFR/IXFR zone transfer supported. 2199 - NSD requests but does not provide IXFR transfers. 2200 - NSD keeps track of SOA timeouts for secondary zones. 2201 - TSIG authentication supported. 2202 - For queries, for notifies, for zone transfers. 2203 - NOTIFY messages of zone updates, incoming and outgoing. 2204 - DNAME type is supported, including CNAME synthesis. 2205 - config file, nsd.conf(5), place to put TSIG keys, server settings, 2206 and lists of ip-addresses/ranges for AXFR/IXFR and NOTIFY. 2207 - prepared for NSEC3 (--enable-nsec3), experimental code for testing 2208 in workshops. 2209 - prepared for NSID (--enable-nsid), experimental code for testing in 2210 workshops. 2211 2212 OPERATIONAL NOTES: 2213 - config file needed, nsd.conf(5) supersedes nsd.zones and nsdc.conf. 2214 - AXFR transfers are denied by default. Allow in config file. 2215 - Zones only become secondary with "request-xfr:" items in config file. 2216 - NSD produces "ixfr.db" file with a journal of zone transfers. 2217 Use nsdc patch to merge changes back to zone files and remake db. 2218 - NSD produces "xfrd.state" file with zone timeout information. 2219 The file is text formatted. 2220 - NSD sends notifies automatically, 2221 nsd-notify is deprecated and will be removed from the package. 2222 - NSD requests AXFR/IXFR and reloads the updates automatically, 2223 nsd-xfer is deprecated and will be removed from the package. 2224 - Check your config file with nsd-checkconf. 2225 2226 BUG FIXES: 2227 - contains all bug fixes from 2.3.5 and before. 2228 - The sighandler() bug is fixed more thoroughly, 2229 by using pipes for interprocess communication. 2230 - CNAMEs are followed by the server to different zones and 2231 information from that zone is returned. This saves a followup 2232 query. 2233 - bug fixes (ported) 2.3.6. 2234 - nsd-notify will retry max 15 times 5 second retries. 2235 - Bug #105: nsdc lacks locking, fixed locking for root user. 2236 - Bug #134: nsd: make -N <large number> work again 2237 - Bug #135: Typo in locking code for nsdc, fixed. 2238 - uninitialised variable fixed. 2239 - unaligned memory access (on Solaris SPARC), in zonec 2240 LOC parsing, fixed. 2241 - Bug #138: nsd aborts trying to bind all interfaces if ip6 2242 is not enabled, instead it will fallback to ip4. 2243 - Bug #139: resync timer for stats to whole minute. 2244 - Bug #140: NSD did not clear CD bit on authoritative answers. 2245 - Bug #141: NSD did not clear flags on a formerror reply. 2246 2247 2.3.5 2248 ============= 2249 BUG FIXES: 2250 - Bug #132: regression, nsd: fix compile with --disable-ipv6 2251 - Makefile: remove gnuisms 2252 2253 2.3.4 2254 ============= 2255 BUG FIXES: 2256 - Unknown type codes for type code numbers > 48 and < 97 work again. 2257 (this implies --enable-checking can be enabled again) 2258 - nsd: sighandler() fixes 2259 - Bug #118: nsd: nsd_notify waits for a response. Will retry the notify 2260 after a timeout. 2261 - Bug #124: $(DESTDIR) was added to Makefile.in. 2262 - Bug #128: zonec: parser can handle \\ at the end of a string. 2263 - zonec: lexer: add \r to the newline delimeter 2264 - zonec: use strtol with an explicit base 10 as parameter. 2265 (Scott Rose, Roy Arends) 2266 - nsd-xfer: print human readable error codes. Change logging to 2267 be more in line with the rest 2268 2269 2.3.3 2270 ============= 2271 BUG FIXES: 2272 - Apply the correct patch to nsdc.sh.in. 2273 2274 2.3.2 2275 ============= 2276 FEATURES: 2277 - Bug #101: add support for the SPF record. 2278 2279 BUG FIXES: 2280 - Bug #100: replaced non-portable use of timegm(3) with 2281 portable implementation (mktime_from_utc). 2282 - Bug #103: nsd: trim the SOA's TTL to the MINIMUM value when returning a 2283 negative answer. 2284 - Bug #104: nsd: add a time_t timestamp to the log when logging to 2285 a file. 2286 - Bug #105: nsdc: use a lock file when rebuilding the database (patch by 2287 Jakob Schlyter/Ted Lindgreen/Sebastian/Ondrej Sury). 2288 - Bug #106: zonec: don't walk all 256 NSEC windows when that is not 2289 needed. 2290 - Bug #107: zonec: fixed a crash when encountering bad unknown rdata. 2291 - nsd: Don't print: "error: nsd is already running as <pid>, stopping" 2292 when in fact NSD continues to run. 2293 - nsd: Minimize the race window in sig_handler(). 2294 2295 2.3.1 2296 ============= 2297 BUG FIXES: 2298 - zonec: Don't crash when generating error messages outside of zone 2299 files. 2300 - nsd: when logging to a file the pid is now printed. 2301 - nsd: Reset 'boot' time in statistics when reloading the database, 2302 since the statistics are reset to 0 on a reload. 2303 - nsd-xfer.c: Added '-a' option to specify local address to connect 2304 from. Original patch supplied by Walter Hop <nsd (a] walter.transip.nl>. 2305 - Bug #98: Allow mnemonics for DS and RRSIG algorithm field. 2306 2307 2.3.0 2308 ============= 2309 FEATURES: 2310 - DNSSEC is now enabled by default. NSD should be fully 2311 compliant with RFC4033, RFC4034, and RFC4035. 2312 2313 BUG FIXES: 2314 - nsd: Ensure that the number of -a flags does not exceed the 2315 maximum specified by MAX_INTERFACES in config.h. 2316 - nsd-xfer: Use serial number arithmetic (RFC1982) for the 2317 zone serial check 2318 - nsdc: Don't pass (fake) serial number to nsd-xfer if the 2319 zone file does not exist. 2320 - zonec: Loading many zones would cause namedb_find_zone to 2321 slow down, performance patch by Kazunori Fujiwara. 2322 - Bug #96: nsd-xfer did not handle 8-bit domain names 2323 correctly. 2324 2325 2.2.1 2326 ============= 2327 FEATURES: 2328 - The message priority is now included when logging to a file. 2329 2330 BUG FIXES: 2331 - Zero length RDATA using the unknown RR notation was not 2332 working (except for the APL RR type). 2333 - Bug #93: './configure' error message containing a comma must 2334 be properly bracketed. 2335 - Bug #94: nsd-xfer: Handle unexpected EOF when receiving AXFR 2336 data. Timeout if no data is received for more than 120 2337 seconds (see the TCP_TIMEOUT parameter in config.h). 2338 - Bug #95: An owner starting with an asterisk label ("*") was 2339 being treated as its own wildcard child. 2340 2341 2.2.0 2342 ============= 2343 FEATURES: 2344 - nsd-xfer: replacement program for named-xfer to perform zone 2345 transfers using AXFR. TSIG is supported by nsd-xfer but not 2346 yet by the nsd server. DNSSEC is also supported. TSIG 2347 requires OpenSSL version 0.9.7 or higher, configure using 2348 --disable-tsig if you do not have OpenSSL installed. 2349 Configure using --with-ssl=path if OpenSSL is not installed 2350 at a standard location. 2351 2352 CODE CHANGES: 2353 - New data structure 'buffer_type' for representing binary 2354 buffers that can be read, written, and resized. Data in 2355 these buffers is stored in network byte order. This data 2356 structure replaces the iobuf field of 'struct query'. 2357 2358 BUG FIXES: 2359 - Fixed endian problem in WKS record. 2360 - Protocol can now be specified numerically in WKS record. 2361 - Allow escape sequences (\DDD) in TTL, RR class, and RR type. 2362 - The zone compiler now accepts many more characters in 2363 unquoted strings such as domain name labels. The characters 2364 no longer need to be escaped with a backslash. 2365 - Close included files after reading. 2366 - Maximum TCP message size is now 65535 bytes. AXFR response 2367 packets are still limited to 16383 bytes for optimal 2368 compression of dnames. 2369 - The TSIG key for AXFRs can now also be stored in the file 2370 <zonename>.tsiginfo. This makes it possible to use TSIG 2371 with multiple master servers. 2372 - Signals are no longer blocked while performing I/O so the 2373 server should respond quicker to signals. 2374 - Fixed parsing of LOC rdata. Fractions and altitude were not 2375 handled correctly. 2376 2377 2.1.5 2378 ============= 2379 BUG FIXES: 2380 - Bug #90: handle \000 in TXT records correctly 2381 - Fixed undefined behavior in the use of vsnprintf when 2382 logging messages. This caused crashes on Linux/PPC. 2383 2384 2.1.4 2385 ============= 2386 BUG FIXES: 2387 - nsdc: Fixed a typo that caused AXFRs to stop working. 2388 2389 2.1.3 2390 ============= 2391 FEATURES: 2392 - nsd: The pidfile can be specified using the '-P' option. 2393 2394 BUG FIXES: 2395 - Bug #87: allow @ in the rdata 2396 - Bug #88: allow ::FFFF:ipv4addr in AAAA records 2397 - Bug #89: Count the number of queries received over TCP, 2398 instead of the number of TCP connections. 2399 - Zonec: when - is used as input, set the filename to 'STDIN'. 2400 - The nsdc script handles failed AXFRs more gracefully. 2401 - NSD emits an error when it sees bitlabels (RFC 2673). 2402 - Only copy the CD bit when DNSSEC is enabled. 2403 2404 2.1.2 2405 ============= 2406 FEATURES: 2407 - NSD now fully supports unknown record types using the 2408 notation specified in RFC3597. 2409 - Support for the following RR types has been added: WKS, X25, 2410 ISDN, RT, NSAP, PX, NAPTR, KX, CERT, DNAME, and APL. DNAME 2411 special processing is not supported. 2412 2413 BUG FIXES: 2414 - Bug #84: NSD now uses SIGUSR1 instead of SIGILL to report stats. 2415 - Bug #85: Support for WKS records. 2416 - Bug #86: The characters "#%&^[]?" can now be used without 2417 backslash in zone file domain names. 2418 - Plugin callback return type fixed. 2419 - The maximum message length for IPv6 UDP packets is now 2420 limited to the IPv6 minimum MTU (1280) unless the 2421 IPV6_USE_MIN_MTU socket option is supported. 2422 2423 2.1.1 2424 ============= 2425 BUG FIXES: 2426 - Bug #81: Handle unknown types correctly. 2427 - Bug #82: Zonec: don't report "0 errors" unless -v is 2428 specified. 2429 - Bug #83: Close zone files after parsing. 2430 - Handle AFSDB RR type. 2431 2432 2.1.0 2433 ============= 2434 FEATURES: 2435 - New networking code allows a single server to handle both 2436 UDP and TCP connections. By default up to 10 simultaneous 2437 TCP connections are supported. Use the '-n' flag to change 2438 the default. 2439 2440 2.0.2 2441 ============= 2442 BUG FIXES: 2443 - Allow the use of a mnemonic for the algorithm field of a 2444 DNSKEY record. 2445 - Behavior of the zonec -v flag has been modified. By default 2446 zonec will only print a single line with a summary of the 2447 error count. 2448 - Bug #75: Fixed typo in previous "fix". 2449 2450 2.0.1 2451 ============= 2452 BUG FIXES: 2453 - Queries for QTYPE DS (DNSSEC) were not handled correctly in 2454 certain cases. 2455 - Partial support for unknown RRs. Known RR types with 2456 unknown RR data format is not yet supported. 2457 - Bug #75: Fixed bad error message when nsdc update is run for 2458 the first time. 2459 - Bug #78: Multiple zones, each with include directives, are 2460 now compiled correctly. 2461 2462 2.0.0 2463 ============= 2464 FEATURES: 2465 - Experimental DNSSEC support implemented, but disabled by 2466 default. Enable using the --enable-dnssec configuration 2467 option. 2468 - IPv6 enabled by default. Disable using the --disable-ipv6 2469 configuration option. 2470 2471 BUG FIXES: 2472 - Bug #47: Domain name is now logged when a notify is 2473 received. 2474 - Bug #70: First include all A records in the additional 2475 section, followed by AAAA records. 2476 - Bug #77: Check length of domain name and label. 2477 - LOC records are supported again. 2478 2479 1.4.0-alpha1 2480 ============= 2481 FEATURES: 2482 - New database format that is much more compact and portable 2483 across architectures. 2484 - The new zone compiler is now the default and the old zone 2485 compiler has been removed. 2486 - Name compression is done dynamically, removing one other 2487 difference with BIND in the responses generated (the full 2488 query name is now used for compression). 2489 - CNAME target records are now generated from wildcard 2490 records if necessary. 2491 2492 REGRESSIONS: 2493 - mmap(2) isn't currently supported. 2494 - Not all RR types are supported by zonec (such as LOC). 2495 2496 1.3.0-alpha1 2497 ============= 2498 FEATURES: 2499 - New name lookup algorithm. This required a change to the 2500 database format. Performance should increase at the expense 2501 of database size and memory usage. 2502 - New zone compiler (zonec2) based on flex and yacc, fully RFC 2503 compliant (still in alpha). 2504 - Database can be loaded using mmap(2) (use the --enable-mmap 2505 configure option to enable). This is useful on operating 2506 systems such as Solaris that do not allow memory overcommit. 2507 - Region based memory allocation and resource management. 2508 - New internal format for storing domain names. Each dname 2509 now includes an array of label offsets within the domain 2510 name. 2511 - Updates to the plugin API. 2512 2513 BUG FIXES: 2514 - Bug #65: The syslog facility is now a compile time option 2515 (--with-facility=FACILITY). The default facility is DAEMON. 2516 - Bug #66: Automatic periodic dumping of the statistics (using 2517 the -s option) is now continued after a database reload. 2518 2519 1.2.4 2520 ============= 2521 BUG FIXES: 2522 - Bug #72: If an RRset for a child domain is defined before 2523 the RRset of the parent domain the parent's RRset would be 2524 "lost". 2525 2526 1.2.3 2527 ============= 2528 BUG FIXES: 2529 - Bug #65: The syslog facility is now a compile time option 2530 (--with-facility=FACILITY). The default facility is DAEMON. 2531 - Bug #66: Automatic periodic dumping of the statistics (using 2532 the -s option) is now continued after a database reload. 2533 - NSD would try to kill pid -1 on startup if forking of a child 2534 process failed. 2535 - Do not log EAGAIN errors on calls to recvfrom. These errors 2536 should be harmless. 2537 2538 1.2.2 2539 ============= 2540 BUG FIXES: 2541 - Bug #59: NSD returns FORMERR when the query name is >= 246 2542 bytes. 2543 - Bug #60: Zonec runs out of file descriptors with many zones. 2544 - Bug #61: nsdc uses /bin/sh hardwired (and should not). 2545 - Bug #62: NSD is not able to log to a file. 2546 - Bug #63: nsdc update and zonec are too talkative. 2547 - Bug #64: Answer for request of a host resolved by a 2548 wildcard-resource-record is not understandable by dig. 2549 2550 1.2.1 2551 ============= 2552 BUG FIXES: 2553 - AXFR terminates early if a zone contains a CNAME pointing 2554 the the zone's domain name (SOA record) (bug #56). 2555 - During an AXFR memory above the top of the stack was 2556 accessed. This could lead to occasional AXFR errors (bad 2557 packets). 2558 - NSD now prints its version number and exits when invoked 2559 with the -v flag (bug #57). 2560 - NSD prints help information and exits when invoked with the 2561 -h flag. 2562 2563 1.2.0 2564 ============= 2565 FEATURES: 2566 - NSD is now a single parent process (handling child 2567 termination and database reloads) plus multiple UDP and TCP 2568 child processes handling queries. Before the parent process 2569 also handled UDP queries. This change simplifies the parent 2570 and child processes and allows the use of multiple 2571 concurrent UDP servers. 2572 - Experimental plugin support. This required a minor, 2573 incompatible change to the database format. Make sure you 2574 recompile your database. Use --enable-plugins to enable. 2575 - Full IPv6 support (for multi-homing and for Linux, thanks to 2576 Colm MacCrthaigh and Jun-ichiro itojun Hagino). Use 2577 --enable-ipv6 to enable. 2578 - Support for multi-homing with TCP connections. 2579 - Support for SunOS 4.x has been dropped. 2580 2581 CODE CHANGES: 2582 - NSD should now conform to the Single Unix Specification 2583 (http://www.unix.org/). 2584 - Const correctness for strings and some other data types. 2585 - Removed code for Berkeley DB, hash tables, and mmap(2). 2586 - Separate preprocessor flags from code flags (CPPFLAGS and 2587 CFLAGS). 2588 - Use uint8_t instead of u_char, uint{16,32}_t instead of 2589 u_int{16,32}_t. 2590 - Fixed warnings from mixing signed and unsigned types. 2591 - Use sigaction(2) instead of signal(2). 2592 - The query_process function has been split up for clarity. 2593 2594 BUG FIXES: 2595 - CHAOS TXT queries failed on big-endian machines. 2596 - Portability fixes for Tru64 (thanks to Stephane Bortzmeyer), 2597 HP-UX, and MacOS X (thanks to Ronald van der Pol). 2598 - Removed compile time limit on maximum number of TCP child 2599 servers. 2600 - Support for debugging UDP and TCP queries. 2601 - Always ensure there is enough room for the EDNS record when 2602 answering a query with EDNS enabled. 2603 2604 1.1 2605 ============= 2606 FEATURES: 2607 - ANSI C 2608 - autoconf/configure 2609 - new parser 2610 - support for various RR types in zonec 2611 - support for UNKN RR types 2612 2613 BUG FIXES: 2614 - lots of zone parsing errors eliminated 2615 - empty node matching bug gives NXDOMAIN 2616 2617 1.0.3 2618 ============= 2619 This release is a bug fix release and does not add any new features. 2620 2621 BUG FIXES: 2622 - Ignore SIGPIPE errors (bug #43). 2623 - Keep track of TCP child servers and restart if necessary. 2624 (bug #55) 2625 - Handle database reload failures correctly. 2626 - Close UDP sockets in TCP child servers. 2627 - Handle escaped characters (besides \.) in labels. 2628 - Preserve the query's RD flag in the answer. 2629 2630 1.0.2 2631 ============= 2632 FEATURES: 2633 - -DBIND8_STATS to enable bind8 like [NX]STATS 2634 - -t flag to make nsd chroot to a certain directory 2635 - -s flag to make nsd produce statistics every s seconds 2636 - /etc/nsd/nsdc.conf to overwrite default variables 2637 for nsdc.sh 2638 - less loggin and more radical tcp connection (mis)handling 2639 - prefork -n processes to handle tcp connections 2640 - multiple -a flags 2641 2642 CHANGES: 2643 - named.stats file functionality is removed 2644 2645 BUG FIXES: 2646 - couple of pedantic fixes in C code 2647 - last zone in database axfr bug fixed 2648 - nsdc update wont update bug fixed 2649 2650 1.0.1 2651 ============= 2652 2653 FEATURES: 2654 - NSD drops permissions after binding the sockets 2655 - ``cache'' zones are no longer allowed 2656 - ID.Server & Version.Server compile time options 2657 - AXFR implemented (with tcpwrapper for access control) 2658 - nsdc update and nsdc notify functionality 2659 - using named-xfer with TSIG for inbound axfr 2660 2661 2662 CHANGES: 2663 - the order of records in the database is from now 2664 on significant 2665 - since Berkeley DB doesnt define order for sequential 2666 access it is no longer supported 2667 2668 BUG FIXES: 2669 - white space problem in zonec is fixed 2670 2671 KNOWN BUGS: 2672 - please see appropriate man pages for the known bugs 2673 2674 1.0.0 RELEASE 2675 ============= 2676 2677 KNOWN BUGS: 2678 2679 - Although NSD allows one to configure a zone without SOA record and 2680 use it as so called ``cached'' non-authoritative data, it is decided 2681 that having this functionality is wrong, dangerous and will be removed 2682 from the further versions. 2683 2684 - If while processing EDNS(0) OPT record NSD encounters bad EDNS(0) 2685 version it will answer with Format Error instead of EDNS(0) BADVERS 2686 2687 PLATFORMS: 2688 2689 Tested and working on i386 FreeBSD-4.4, i386 Linux, dec alpha Linux, 2690 sparc SunOS 4.x 2691 2692 2693 1.0.0-BETA2 2694 =========== 2695 2696 FIXES: 2697 - wildcards bug fixed 2698 - AA bit for class ANY bug fixed 2699 - minor coredumps with really broken zones in zonec fixed 2700 - linux & SunOS port 2701 2702 1.0-ALPHA2 2703 ========== 2704 FIXES: 2705 - IPv6 transport support added by Jun-ichiro itojun Hagino (Use -DINET6) 2706 - Makefile modified for easier compile time configuration 2707 - EDNS(0) bug fixed 2708 - Default database changed to all lowercase, red-black tree to make nsd 2709 DNSSEC ready 2710 - REQUIREMENTS are cleaned up and updated 2711 - Signal names changed in nsdc.sh.in 2712 - Default compile options dont include -DMIMIC_BIND8 2713
Indexes created Sun Mar 01 05:31:48 UTC 2026