* Readd _OPENBSD_SOURCE explicitly to fix build on NetBSD 9
Changelog:
13 August 2019: Wouter
- Fix error message for out of zone data to have more information.
12 August 2019: Wouter
- Fix#33: Fix segfault in service of remaining streams on exit.
6 August 2019: Wouter
- Tag for 4.2.2rc1.
5 August 2019: Wouter
- PR #31: nsd-control: Add missing stdio header.
- PR #32: tsig: Fix compilation without HAVE_SSL.
- Cleanup tls context on xfrd exit.
31 July 2019: Wouter
- Fix#29: SSHFP check NULL pointer dereference.
- Fix#30: SSHFP check failure due to missing domain name.
- Fix to timeval_add in minievent for remaining second in microseconds.
22 July 2019: Wouter
- Set timeout for refetch immediately, only spread load when there
are retries.
19 July 2019: Wouter
- Set no renegotiation on the SSL context to stop client
session renegotiation.
18 July 2019: Wouter
- Fix#25: NSD doesn't refresh zones after extended downtime,
it refreshes the old zones, with a random delay of a couple of
seconds to spread the load.
- Fix so that expired zones stay expired when server is down a
long time.
17 July 2019: Wouter
- Fix that NSD warns for wrong length of the hash in SSHFP records.
15 July 2019: Wouter
- PR #23: Fix typo in nsd.conf man-page.
4 July 2019: Wouter
- Set version to 4.2.2 in development.
- clean memory on exit of nsd-checkzone for memory debug.
- Fix#20: CVE-2019-13207 Stack-based Buffer Overflow in the
dname_concatenate() function. Reported by Frederic Cambus.
It causes the zone parser to crash on a malformed zone file,
with assertions enabled, an assertion catches it.
- Fix#19: Out-of-bounds read caused by improper validation of
array index. Reported by Frederic Cambus. The zone parser
fails on type SIG because of mismatched definition with RRSIG.
2 July 2019: Wouter
- Tag for 4.2.1rc1
27 June 2019: Wouter
- Fix unit test for added options and no dot after zone updated
log message.
- Fix compile without accept4.
21 June 2019: Wouter
- Omit remaining tcp processing if the list is empty.
- Fix output of nsd-checkconf -h.
20 June 2019: Wouter
- Initialize event structures before event_set, to stop uninitialized
values from setting event library lists and assertions, that would
sometimes also show after event_del.
- Added num.tls and num.tls6 stat counters.
- PR #12: send-buffer-size, receive-buffer-size,
tcp-reject-overflow options for nsd.conf, from Jeroen Koekkoek.
- Do not use symbol from libc, instead use own replacement, if not
available, for accept4.
- Fix#14, tcp connections have 1/10 to be active and have to work
every second, and then they get time to complete during a reload,
this is a process that lingers with the old version during a version
update.
19 June 2019: Wouter
- Fix tls handshake event callback function mistake, reported
by Mykhailo Danylenko.
18 June 2019: Wouter
- Fix#15: crash in SSL library, initialize variables for TCP access
when TLS is configured.
14 June 2019: Wouter
- Fix to init event not pointer, in reassignment.
12 June 2019: Wouter
- Fix to init event structure for reassignment.
Changelog:
4.2.0
================
FEATURES:
- Print IP address when bind socket fails with error.
- Fix#4249: The option hide-identity: yes stops NSD from responding
with the hostname for chaos class queries. Implements the RFC4829
security considerations.
- Patch to add support for TCP Fast Open, from Sara
Dickinson (Sinodun).
- Patch to add support for tls service on a specified tls port,
from Sara Dickinson (Sinodun).
- Use travis for build check, initial unit test and clang analysis.
BUG FIXES:
- Fix to delete unused zparser.default_apex member.
- Fix that the TLS handshake routine sets the correct event to
continue when done.
- Fix that TLS renegotiation calls the read and write routines again
with the same parameters when the desired event has been satisfied.
- Fix that TCP Fastopen has better error message and supports OSX.
- Fix to avoid buffer alloc with global buffer in tls write handler.
- Fix to initialize event structure when accepting TCP connection.
- Disable TLS1.0, TLS1.1 and weak ciphers, enable
CIPHER_SERVER_PREFERENCE, patch from Andreas Schulze.
- further setup ssl ctx after the keys are loaded, for ECDH.
- TLS OCSP stapling support, enabled with tls-service-ocsp: filename,
patch from Andreas Schulze.
- Fix#10: Fix memory leaks caused by duplicate rr and include
instructions.
- Fix to define _OPENBSD_SOURCE to get reallocarray on NetBSD.
4.1.27
================
FEATURES:
- Deny ANY with only one RR in response, by default. Patch from
Daisuke Higashi. The deny-any statement in nsd.conf sets ANY
queries over UDP to be further moved to TCP as well.
Also no additional section processing for type ANY, reducing
the response size.
- Fix#4215: on-the-fly change of TSIG keys with patch from Igor, adds
nsd-control print_tsig, update_tsig, add_tsig, assoc_tsig
and del_tsig. These changes are gone after reload, edit the
config file (or a file included from it) to make changes that
last after restart.
BUG FIXES:
- Fix#4213: disable-ipv6 and dnstap compile error.
- Fix to reduce region_log_stats if condition, this removes a
debug statement.
- Fix for FreeBSD port with dnstap enabled.
- Fix to remove unused code.
- Fix#6: nsd-control-setup: Change validity time to a shorter
period (<2038).
- Fix unused definition in header remote.h.
- Fix#4236: IPV4_MINIMAL_RESPONSE_SIZE=1480 is slightly too big.
- Fix#4235: IP_PMTUDISC_OMIT on IPv4/UDP sockets.
- Fixed radtree_insert memory leak.
- Fixed access recycled variable.
XXX Remove MESSAGE as nsd 4.0.0 came out in October 2013?
XXX Did not add dnstap support to pkg.
29 November 2018: Wouter
- Tag for 4.1.26rc1.
27 November 2018: Wouter
- Fix parsezone failure in 4194 fix.
26 November 2018: Wouter
- Fix to not set GLOB_NOSORT so the nsd.conf include: files are
sorted and in a predictable order.
- Added nsd-control changezone. nsd-control changezone name pattern
allows the change of a zone pattern option without downtime for
the zone, in one operation.
- Fix#3433: document that reconfig does not change per-zone stats.
20 November 2018: Wouter
- Fix#4205: enable-recvmmsg in mixed IPv4/IPv6 environment fails.
This sets the msg_hdr.msg_namelen correctly after receipt.
19 November 2018: Wouter
- Support SO_REUSEPORT_LB in FreeBSD 12 with the reuseport: yes
option in nsd.conf.
- Fix#4202: nsd-control delzone incorrect exit code on error.
- Tab style fix to use tab for 8 spaces, from Xiaobo Liu.
25 October 2018: Wouter
- Adjust dnstap socket path for chroot.
22 October 2018: Wouter
- Fix#4194: Zone file parser derailed by non-FQDN names in RHS of
DNSSEC RRs.
- Fix some more, neater code and checks for domain length limit.
- check that the dnstap socket file can be opened and exists, print
error if not.
4 October 2018: Wouter
- dnstap work, the dnstap.proto is a copy of the file from Unbound,
also dnstap.m4 configure include file.
- dnstap collector: free eventbase and memclean nicer.
- dnstap collector: send data and read it in collector.
- dnstap/dnstap.c and .h from Unbound's contribution from
Farsight Security, added to then adapt it for dnstap logging in NSD.
- dnstap.c with auth query and auth response, and called from
the collector.
- dnstap work, config nsd.conf parse.
- dnstap example config.
25 September 2018: Wouter
- NSD 4.1.25 released, trunk has 4.1.26 in development.
18 September 2018: Wouter
- tag for NSD 4.1.25rc1.
17 September 2018: Wouter
- Fix#4156: Fix systemd service manager state change notification
14 September 2018: Wouter
- Remove unused if clause during server service startup.
13 September 2018: Wouter
- Fix typo in clang analysis test.
- Annotate exit functions with noreturn.
- nsd-control prints neater errors for file failures.
12 September 2018: Wouter
- clang analysis test.
11 September 2018: Wouter
- Fix to combine the same error function into one, from Xiaobo Liu.
- Fix initialisation in remote.c.
- please clang analyzer and fix parse of IPSECKEY with bad gateway.
- Fix unit test code for clang analyzer.
- Fix nsd-checkconf fail on bad zone name.
10 September 2018: Wouter
- Fix coding style in nsd.c
7 September 2018: Wouter
- append_trailing_slash has one implementation and is not repeated
differently.
4 September 2018: Wouter
- Fix codingstyle in nsd-checkconf.c in patch from Sharp Liu.
15 August 2018: Wouter
- Fix use_systemd typo/leftover in remote.c.
13 August 2018: Wouter
- tag for 4.1.24 release.
- trunk is 4.1.25 in development.
- Fix that nsec3 precompile deletion happens before the RRs of
the zone are deleted.
- Fix printout of accepted remote control connection for unix sockets.
6 August 2018: Wouter
- tag for 4.1.24rc1 release.
4.1.24
================
FEATURES:
- #4102: control interface via local socket.
configure it with control-interface: "/path/nsd.ctl" The path
has to start with a / to separate it from an IP address.
The local socket does not use SSL, but unencrypted traffic, use
file and containing directory permissions to restrict access.
- configure --enable-systemd (needs pkg-config and libsystemd) can
be used to then use-systemd: yes in nsd.conf and have readiness
signalling with systemd.
- RFC8162 support, for record type SMIMEA.
BUG FIXES:
- Patch to fix openwrt for mac os build darwin detection in configure.
- Fix that first control-interface determines if TLS is used. Warn
when IP address interfaces are used without TLS.
- #4106: Fix that stats printed from nsd-control are recast from
unsigned long to unsigned (remote.c).
- Fix that type CAA (and URI) in the zone file can contain
dots when not in quotes.
- #4133: Fix that when IXFR contains a zone with broken NSEC3PARAM
chain, NSD leniently attempts to find a working NSEC3PARAM.
4.1.23
================
BUG FIXES:
- Fix NSD time sensitive TSIG compare vulnerability.
4.1.22
================
FEATURES:
- refuse-any sends truncation (+TC) in reply to ANY queries over UDP,
and allows TCP queries like normal.
- Use accept4 to speed up answer of TCP queries, on Linux, FreeBSD
and OpenBSD.
BUG FIXES:
- Fix nsec3 hash of parent and child co-hosted nsec3 enabled zones.
- Fix to use same condition for nsec3 hash allocation and free.
Changelog:
Features
--enable-memclean cleans up memory for use with memory checkers,
eg. valgrind.
refuse-any nsd.conf option that refuses queries of type ANY.
lower memory usage for tcp connections, so tcp-count can be higher.
Bug Fixes
Fix unused variable warnings and uninit variable in statistics printout
from clang analyzer.
Fix spelling error in xfr-inspect.
Fix#3562: explain build error when flex missing.
Fix buffer size warnings from compiler on filename lengths.
Fix#4093: Release notes not using 2018.
Changelog:
4.1.20
================
BUG FIXES:
- Fix memory leak in zone file read of unknown rr formatted RRs.
- Fix memory leak when rehashing nsec3 after axfr or zonefile read,
in the selectively allocated precompiled nsec3 hashes.
Changelog:
NSD 4.1.19
Dec 11, 2017
Bugfixes
* ignore fallthrough compiler warning in flex EOF rule.
* Fix warnings emitted by clang for --enable-packed. Alignment is
not a problem for x86_64, don't enable packed when the platform
requires aligned access.
* Fix spelling error in xfr-inspect.
* Fix 3392: Fix regression in 4.1.18 for notify lists with ip4 and ip6
targets.
* Add test for support of -Wno-address-of-packed-member for --enable-packed.
NSD 4.1.18
Nov 30, 2017
Features
* xfr-inspect, it is not installed, it prints xfr files from /tmp made
with 'make xfr-inspect' in the source dir.
* retry timeout between sending notifies dropped from 15 to 3 sec.
* NSD sends 16 notifies simultaneously.
* configure --enable-packed reduces memory usage, at expense of unaligned
reads. Saves about 17%.
* Save memory by selectively allocate precompiled nsec3 hashes, saves
about 16% memory.
* make ip-transparent option work on OpenBSD.
* Save about 2% memory by changing usage count size in name tree.
* Fix#2871: Increase number of sockets for xfrd transfers.
Bugfixes
* Fix gcc 7.1.1 warnings.
* Fix writev compile warning on FreeBSD.
* Fix#1446: A corrupted zone file "propagates" to good ones.
* nsd-control zonestatus prints wait time between attempts, for zones
that are in that waiting time.
* Fix collision printout of nsec3 to print name, hash and reverse.
* Fix#1567: Change crit to err log level for gettimeofday failure.
Add defines for compile without syslog.
* Fix crash for DS query when parent and child zones both configured
in nsd.conf and parent zone has not loaded properly.
Changes from release notes.
Features
* zone parser parses type AVC (it has TXT format).
* Fix#1272: use writev to put tcp length field
with data for outgoing zone transfer requests.
Bugfixes
* Fix potential null pointer in nsec3 adjustment tree.
* Fix text format of deletes for CDS and CDNSKEY,
single 0 to represent empty base64 or hex string.
Changelog:
Apr 25, 2017
Features
zone parser can parse acronyms for algorithms ED25519 and ED448.
Fix 1243: Option to make NSD emit really minimal responses, minimal-responses: yes in nsd.conf.
Bugfixes
Calculate new udb index after growing the array, fix from Chaofeng Liu.
Fix missing _t to _type conversion for disable-radix-tree option.
Printout serial error with hint it may be too big.
Fix 1228: OpenSSL include is not guarded with HAVE_SSL
Patch for expire state in multi-master when masters includes broken master, from Manabu Sonoda.
minor manpage fix.
Changelog:
NSD 4.1.15
Feb 16, 2017
Bugfixes
Fix nsd-control and ipv6 only.
Squelch zone transfer error address family not supported by protocol at low verbosity levels.
Fix#1195: Fix so that NSD fails on non-compliant values for Serial.
Fix to rename _t typedefs because POSIX reserves them.
Fix that nsec3 hash collisions only reported on verbosity level 3.
==========
FEATURES:
- Fix#1132 for SERVFAIL zones perform backoff, and remembers the
timeout on next startup.
BUG FIXES:
- Fix null memcpy for radixtree with single link element.
- Robust fix against missing master in tcp_open for xfrd.
- Fix wildcards in include: config statements with chroot enabled.
- suppress compile warning in lex files.
- Fix to try every master once, then wait for timeout or notify.
- Save backoff timeout into xfrd.state file, this file has a higher
version number now. Old files are skipped silently (causes
refresh) and created as new files upon exit.
- Fix restart of zone transfers when new config becomes available.
* Remove an useless patch
Changelog:
NSD 4.1.13
Sep 27, 2016
Features
multi-master-check: yes can be used to check all masters for the last version, using the higher version from the configured masters, from Manabu Sonoda.
Support RR type OPENPGPKEY from RFC 7929.
Can config key algorithms with the digest name, eg. 'sha256'.
configure --disable-radix-tree for about 15% lower memory usage.
for type SRV add A/AAAA to the additional section (if possible), just like we already do for type MX.
more extensible edns option handling.
Bugfixes
Fix compile warnings about unused result from write and strtol. and signcompare in minmax retrytime.
Fix#812: fix that make depend fails after distribution.
Fix#817: xfrd update failed loop.
Add robustness against unallocated data in nsec3 trees.
Fix README spelling error of BSD license (reported by Joerg Jung).
Fix multimaster for not tried full zone transfer for a expired zone.
Fix#827: fix compile with openssl 1.1.0 with api=1.1.0.
Changelog:
1 August 2016: Wouter
- Tag 4.1.11rc1.
- Fix nsec3 missing for nsec3 signed parent and child for DS at zonecut.
- Tag 4.1.11rc2.
8 July 2016: Wouter
- Note down tracking numbers for issue JVN#63359718 JPCERT#91251865.
5 July 2016: Wouter
- Fix#790: size-limit-xfr can stop NSD from downloading infinite zone
transfer data size, from Toshifumi Sakaguchi.
27 June 2016: Wouter
- Set default for min-refresh-time and min-retry-time to 0. Behaves
just like before, but has a configurable option in nsd.conf.
- Fix#783: Trying to run a root server without having configured it
silently gives wrong answers.
16 June 2016: Wouter
- When tcp is more than half full, use short timeout for tcp session.
- Patch for {max,min}-{refresh,retry}-time from YAMAGUCHI Takanori.
- man page entries for max-refresh-time patch.
15 June 2016: Wouter
- Fix build without IPv6, patch from Zdenek Kaspar.
==========
FEATURES:
- ip-freebind: yesno option in nsd.conf sets IP_FREEBIND socket option
for Linux, binds to interfaces and addresses that are down.
- NSD includes AAAA before A for queries over IPV6 (in delegations).
And TC is set if no glue can be provided with a delegation because
of packet size.
- print notice that nsd is starting before taking off.
BUG FIXES:
- Fix for openssl 1.1.0, HMAC_CTX size not exported from openssl.
- Fix#751: NSD fails to occlude names below a DNAME.
- If set without nsd.db print "" as the default in the man pages.
- Fix#755: NSD spins after a zone update and a lot of TCP queries.
- Fix for NSEC3 with zone signed without exact match for empty
nonterminals, the answer for that domain gets closest encloser.
- #772 Document that recvmmsg has IPv6 problems on some linux kernels.
================
FEATURES:
- #732: tcp-mss, outgoing-tcp-mss options for nsd.conf.
- #739: zonefile changes when mtime is small are detected on reload,
if filesystem supports precision mtime values.
- RR type CSYNC (RFC7477) syntax is supported.
BUG FIXES:
- take advantage of arc4random_uniform if available.
- Fix flto check for OSX clang.
- Define _DEFAULT_SOURCE with _BSD_SOURCE for glibc 2.20 on Linux.
- Fix#736: segfault during zone transfer.
- Fix#744: Fix that NSD replies for configured but unloaded zone
with SERVFAIL, not REFUSED.
=========
FEATURES:
- support configure --with-dbfile="" for nodb mode by default, where
there is no binary database, but nsd reads and writes zonefiles.
- reuseport: no is the default, because the feature is not troublefree.
- configure --enable-ratelimit-default-is-off with --enable-ratelimit
to set the default ratelimit to disabled but available in nsd.conf.
- version: "string" option to set chaos version query reply string.
BUG FIXES:
- Fix zones updates from nsd parent event loop when there are a lot
of interfaces.
- portability fixes.
- patch from Doug Hogan for SSL_OP_NO_SSLvx options, for the new
defaults in the ssl libraries.
- updated contrib/nsd.spec, with new configure options.
- Allocate less memory for TSIG digest.
- Fix#721: Fix wrong error code (FORMERR) returned for unknown
opcode. NOTIMP expected.
- Fix zonec ttl mismatch printout to include more information.
- Fix TCP responses when REUSEPORT is in use by turning it off.
- Document default in manpage for rrl-slip, ip4 and 6 prefixlength.
- Explain rrl-slip better in documentation.
- Document that ratelimit qps and slip are updated in reconfig.
- Fix up defaults in manpage.
=========
BUG FIXES:
- Fix#701: Fix that AD=1 set in a BADVERS response.
- Fix typo in zonec.c inside error message.
- Fix#711: Document that debug-mode yes is used for staying
attached to the supervisor console.
- Document verbosity 3 prints more information.
- nsd-checkconf warns for master zones with no zonefile statement.
- Fix start failure when many file descriptors are in use.
- The servfail rcode is not printed with a space in the middle.
- print failed token for config syntax error or parse error.
=========
FEATURES:
- RFC7553 RR Type URI support.
- removed hardcoded interface limit, --with-max-ips removed.
- SO_REUSEPORT support, by default on Linux, or with reuseport: yes.
- Admitted axfrs are logged at verbosity 1. Refused at verbosity 2.
- --enable-pie and --enable-relro-now options for a safer executable.
BUG FIXES:
- Fix NSID response for short edns sizes.
- Fix that for expired zones NSD performs an AXFR and accepts newer
and older serial numbers.
- Document that minimal responses only minimizes responses to fit
in one datagram. It does not minimize smaller responses.
- Fix#618: documented need to list ip-addresses seperately in
nsd.conf if there are multiple, because the source address of
replies can otherwise go wrong.
- Fix that notify from nsd-control contains soa serial.
- Fix#698 formatting errors and typos in nsd.8.in.
=========
FEATURES:
- nsd-control addzones and delzones read list of zones from stdin.
- hmac sha224, sha384 and sha512 support.
- max-interfaces raised to 32.
BUG FIXES:
- Fix#665: when removing subdomain, nsd does not reparse parent zone.
- Fix task and zonestat files to be stored in a subdirectory in tmp
to stop privilege elevation.
- Fix crash in zone parser for relative dname after error in origin.
- Fix that formerrors are ratelimited.
=========
FEATURES:
- Incoming notifies have serial number logged (at verbosity 1).
BUG FIXES:
- Remove some duplicate header includes.
- Fix tcp waiting list for zone transfers where the bind and connect
calls fail.
- Fix segfault in zone reader on invalid input.
- Fix segfault on double origin in zone reader.
- Fix b64pton out of bounds error on invalid zonefile input.
- Fix origin directive from unused old value and subdomain parser
failure.
- Fix use after free after zonefile syntax error followed by ttl
or origin directive.
- Fix syntax error followed by too many TXT elements parse crash.
- Fix buffer overflow in config parse of domain name.
- Use reallocarray for integer overflow protection.
- Fix allocation integer overflow checks.
- Fix#654: Fix contradiction in notify logging verbosity level.
- Fix#655: Fix contradiction in verbosity for zone transfers.
- Made log message more consistent, changed 'axfr refused' log message
to be more consistent with other messages. Also notify refused.
- verbosity 2 logs axfr refused and notify refused.
verbosity 1 contains less log messages.
================
FEATURES:
- RFC 7344: CDS and CDNSKEY (read record types).
- per zone statistics with --enable-zone-stats, config zone with
zonestats: "name", zones configured with the same string are added.
- Disabled use of SSLv3 in nsd-control.
- nsd-checkconf -f prints out full name of pidfile (with dir).
- Synthesize CNAMEs with same TTL as DNAME.
BUG FIXES:
- Fix that expired zones stay expired after a server restart.
- Fix "xfrd_handle_ipc: bad mode" log errors when compiled
with --disable-bind8-stats.
- Fix#616: retry xfer for zones with no content after command.
- Fix char used as array index warnings on NetBSD.
- Fix that queries for noname CH TXT are REFUSED instead of nodata.
- Fixes for wildcard addition and deletion, speedup for some cases.
- Fix that failure to add tcp to tcp base does not leak the socket.
- Patch nsd_munin_ from Philip Paeps to use type ABSOLUTE.
- Fix spinning NSD with lots of failing transfers, due to pointer
comparison using void pointer subtraction.
- Fix bug#637: fix that nsd.db grows limitlessly, an off by one
on one megabyte free chunks, created during AXFRs of large zones,
that caused the one megabyte chunk to be leaked.
- Fix casts for ctype functions.
- correct some hyphen-used-as-minus-sign (from Andreas Schulze) in
man pages.
- Fix zonesdir chroot error message.
================
FEATURES:
- database: "" starts without mmap of database. Less memory is used,
zones are read from text zonefile.
- optimised zonefile parse code and zonefile write code.
- zonefiles-write option in nsd.conf, enabled when database is "".
The server writes changed zonefiles to disk every hour.
- xfrdfile: "" disables xfrd.state. If enabled, zones that are
same as before are not checked for a serial update at server start.
- include: "foo/nsd.d/*.conf" works, wildcard glob on includes.
- nsd shuts down during init process if given signal.
- log-time-ascii option, default yes, with readable timestamp in log.
- nsd-control addzone reports if zone already exists.
- Fix#564: add nsd-checkzone tool to check zonefile correctness.
- Increased default --with-max-ips from 8 to 16, this increases the
number of interfaces you can specify in nsd.conf to listen to.
BUG FIXES:
- Fixed shutdown message sporadically not printed on exit.
- Documented zonefile %s syntax in nsd.conf man page.
- Fix manpage to put colon after zonefiles check and write.
- Change from 'Zone" to "zone" with ".. serial .. is updated" log
message.
- Changed maxbackoff for no-content secondary zones from 4h to 24h.
- Fix print filename of encompassing config file on read failure.
- Fix delete or rename of a lot of zones and make it take a
non-enormous time.
- Speed up deletion of zone contents a lot, (56s to 1s), speeds up
delete, rename and AXFR for zones.
- Fix#571: unused variable and incompatible pointer warnings when
compiled on a system without INET6.
- Fix write_socket return value check in server.c
- Fix that xfrd reaps children also if the signal is lost.
- Fix#577: makefile incorrectly installed manpages from srcdir.
- Fix#587: Default value for statistics is 0.
- Fix#553: Improve TXT parsing.
- Fix#590: rrl log does not print wildcard as a star but escaped.
- Fix#591: rrl log messages at verbosity level 1.
- fix strptime implicit declaration error on OpenBSD.
- Fix -O3 compile flag to -O2 to avoid miscompilations.
- Allow user to override the -g -O2 CFLAGS in ./configure.
- Fix endian.h include for OpenBSD.
- Fix#600: document that provide-xfr provides AXFR and not IXFR.
- Fix rising-load-average or memory-leaks in OSes (Linux since 2.6),
that keep track of all past process parents, or leak memory
for them. Fix makes it so there is no very deep string of
process parents.
- Remove .LP after .SH in man pages.
Bug Fixes:
- Fix nsd.db unclean close check. Previous databases are considered
unclean by the code and are created anew.
- Adds nsd.db larger than 400Tb check for sanity. Also test if
filesize as documented in the file is correct.
- nsd waits for tasks to complete on stop, prevents nsd.db corruption.
- fix to not delete tmpdir too early in shutdown process.
- disabled udb checking functionality that made it very slow,
this was enabled when enable-checking was turned on.
Features:
* Return REFUSED for queries to non-hosted zones.
Bug Fixes:
* Fix expired zones to give SERVFAIL, also when parent zone loaded.
* documented nsd-control zonestatus output in nsd-control manpage.
* remove mention of nsdc from nsd-checkconf manpage.
* Disabled recvmmsg and sendmmsg usage by default because kernel
versions have implementation issues: ipv6 ignored, security issues.
* Detect libevent2 install automatically by configure, and use
event2 header files if necessary.
* Fix#551: change Regent to Copyright holder in the LICENSE,
to match the definition on opensource.org for the BSD License.
* Fix#552: zonefile loads on nsd-control reconfig when the name
of the file has changed.
* Fix leak of zone name after zonefile read and fix malloc too
large that would be leaked in the radix tree.
* Fix from 3.2: make SOA RDATA comparisons in XFR more lenient (only
check serial).
* Fix that NSD will delete and recreate not-clean-closed databases.
Features:
* recognizes ip-address and interface as synonyms for convenience.
* Support for EUI48 and EUI64 RR types enabled by default (RFC 7043).
* Support for CAA RRtype (RFC 6844).
* NSID can be set with "ascii_somestring" in ascii.
Bug fixes:
* Fix xfrd when zone transfer TCP contains zero length packets.
* Fix for NSEC3 zones where parent zone is co-hosted, also NSEC3,
because AXFRs overwrote nsec3 administration in the child zone.
* Fix that bad IXFR updates do not result in double SOA records,
and that an AXFR is started (attempted) when the zone state seems
to be inconsistent with the master's zone state.
* Log ip address for sendto and sendmmsg failures.
* Fix segfaults after read of zones with rr type WKS from zonefile.
* Seed PRNG for openssl at start of daemon, fixes SSL connection issue.
* Bugfix #534: IXFR query loop over UDP for zones that are unchanged.
* (same as in 3.2.16): fix wildcard cname to nxdomain repeated rrset.
* (same as in 3.2.16): Bugfix #542: Match RRSIG TTL with SOA TTL in
negative response.
* Check if configure in srcdir collides with outofdir build.
* Fix#546: output format errors in nsd_munin_ (Thanks Tom Hendrikx).
* Fix printout of high-chars in TXT on NetBSD.
Features:
* documented in doc/NSD-4-features. Change configuration without restart,
direct nameserver control with nsd-control, support a higher number of zones.
Higher performance (compared to NSD3).
* nsdc is gone. Use kill -HUP for reload (also checks if zonefiles have
changed and rereads them), and kill -TERM for quit. Or use nsd-control
for detailed control.
* cron job for nsdc patch is gone. nsd-control write creates zonefiles.
* nsd.db has a new format that compacts itself when it is changed,
thus nsdc patch is no longer necessary.
* nsd.db is memory mapped, NSD needs (part of) that mmap in ram.
* tcp-count can go above 1000; epoll/kqueue support with libevent.
* nsd-control reconfig for updates with no restart (zones, keys, ..)
* nsd-control-setup to create keys for nsd-control (enable nsd-control
with remote-control: yes in nsd.conf).
Features:
* New config option "ip-transparent:" to allow NSD to bind to non local
addresses. Default no.
* Use IPV6 minimum MTU settings with TCP to reduce failures that are caused
by delays in learning working PMTU when communicating through a tunnel.
* Bugfix #496: Support for EUI48 and EUI64 RR types. Experimental,
turned off by default. Enable with --enable-draft-rrtypes.
* New config option "rrl-slip:" to set the average number of packets
discarded before we send back a truncated response.
* New config option "rrl-ipv4-prefix-length:" and "rrl-ipv6-prefix-length:"
to set the prefix lengths.
* Improved RRL logging, also print triggering query src address and QTYPE.
* Provide RRL documentation in nsd.conf.sample.
Bugfixes:
* Bugfix #357: Parent process waits until children closed down sockets,
to prevent NSD failing to bind to sockets when restarting.
* Bugfix #487: lookup3.c determine endianness for BSD systems.
* Bugfix #491: pick program name (0th argument) as syslog identity.
* Bugfix #494: Exit with return code 1 if socket code fails.
* Bugfix #495: Wrong bufsize in dname_to_string for root.
* Fix outgoing-interface: Don't fail if family is IPv6 but only IPv4
outgoing-interface is set, or vice versa.
* RRtypes ASFDB, RP, RT should not compress dnames.
* Check that zone directory is within chroot directory.
* Better XFR checking, fallback to AXFR (if allowed) if three malformed
XFR packets have been seen.
