-
-
Notifications
You must be signed in to change notification settings - Fork 101
/
ChangeLog
4469 lines (3636 loc) · 163 KB
/
ChangeLog
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
10 March 2020: Wouter
- repository has version number 4.3.0. Tag for 4.3.0rc1.
3 March 2020: Wouter
- Fix that the retry wait does not exceed one day for zone transfers.
27 February 2020: Wouter
- Fix warning on FreeBSD about pointer size cast.
26 February 2020: Wouter
- Fixup fix of reuseport TCP for server close of sockets not used
by it. And the unit test skips when the necessary debug output
is not enabled.
25 February 2020: Wouter
- Fix event unit test, signal has to be registered with signal_add,
event_add not for every backend for signals. The event_initialized
is not possible for every backend, so event_added variable. The
agent write event fires after a timeout, instead of on event write
so that it does not trigger a sigpipe event when the handlers stop.
Timeout shorted to 0.1 second. event_get_fd was not implemented,
so used ev_fd. Debug output printfs added to see what happens.
- Fix checkconf test for new drop-updates config option.
- Fix errors with reuseport and TCP file descriptors, it was
closing them for server-1 in server-2 and server-3..
7 February 2020: Jeroen
- Add feature to drop queries with opcode UPDATE.
6 February 2020: Jeroen
- Support SO_BINDTODEVICE on Linux. Specify bindtodevice: yes
to bind sockets directly to the network interface.
- Support SO_SETFIB on FreeBSD. Add setfib=<FIB> after an ip-address
option to use the specified FIB for that socket.
- Require user to add servers=<range> after an ip-address option to
specify the servers that must listen on that socket.
6 February 2020: Wouter
- Merge PR#60: Minor portability fixes from michaelforney, with
avoid pointer arithmetic on void* and avoid unnecessary VLA.
4 February 2020: Wouter
- Merge PR#22: minimise-any: prefer polular and not large RRset,
from Daisuke Higashi.
- Fix responses for IXFR so that the authority section is not echoed
in the response.
21 January 2020: Wouter
- Fix leak in server bitset setup.
16 January 2020: Jeroen
- Add zone resource record iterator for future zone-verification port.
- Set FD_CLOEXEC on opened sockets.
- Add popen3 implementation for future zone-verification port.
- Add -r option to cutest so that a subset of tests can be run.
15 January 2020: Jeroen
- Add feature to pin server proccesses to specific cpus.
- Add feature to pin IP addresses to selected server processes.
- Set process title to identify individual processes.
13 January 2020: Wouter
- Merge pull request #59 from buddyns: add FreeBSD support
for conf key ip-transparent.
10 January 2020: Wouter
- Fix unreachable code in ssl set options code.
- Fix bad shift in assertion code analyzer complaint.
6 January 2020: Wouter
- Fix #56: Drop sparse TSIG signing support in NSD.
Sign every axfr packet with TSIG, according to the latest
draft-ietf-dnsop-rfc2845bis-06, Section 5.3.1.
12 December 2019: Wouter
- Note that use-systemd is not necessary and ignored in man page.
11 December 2019: Wouter
- Fix whitespace in nsd.conf.sample.in, patch from Paul Wouters.
- use-systemd is ignored in nsd.conf, when NSD is compiled with
libsystemd it always signals readiness, if possible.
9 December 2019: Wouter
- Fix to define upper bounds on rr counts read from untrusted packet
data.
- Try different annotation for radix_find_prefix_node not reachable.
- Separate acl_addr_match_range functions for ip4 and ip6, to
please checkers.
- Avoid unused variable warning in new match_range_v4 function.
6 December 2019: Wouter
- Fix to define max number of EDNS records we are willing to
spend time on.
- Fix size of string len and capacity type cast in udbradtree.
- Fix to protect rrcount in tsig_find_rr from overflow.
- Annotate radix_find_prefix_node not reachable trail code.
- Fix to protect rrcount in packet_find_notify_serial from overflow.
- Fix to close socket on error in create_tcp_accept_sock.
- Fix to log on failure to chmod for socket for remote control.
- Fix to remove unneeded if in open of socket for remote control.
- Fix to restore input parameter on call failure in create_dirs.
- Please checker by terminating and initialising string read
by remote control.
- Fixup of random_generate negative modulo, from previous commit,
and return srandom when random is used if no getrandom.
5 December 2019: Wouter
- Fix fname null check of fname in namedb_read_zonefile.
- Fix implicit cast of size in udb_radnode_array_grow.
- Fix ignore of return value of ssl_printf in remote.c.
- Fix unused check of fd in parent_handle_reload_command.
- Fix to use getrandom() for randomness, if available.
- Attempt to fix signedness of nscount lookup in ixfr query_process.
- Fix identical branches for ssl_print of errors in remote.c.
- Fix type cast bounds, signedness of opt_rdlen in edns_parse_record.
- Fix to separate header and data lines in parse_zone_list_file.
3 December 2019: Wouter
- Fix #52: do not log transient network full errors unless higher
verbosity is set.
- Fix checkconf test for new error output string.
- tag for 4.2.4rc1 release. This became the 4.2.4 release,
and the master branch continues with 4.2.5 in development.
27 November 2017 Jeroen
- Fix regressions in configparser.y
22 November 2019: Wouter
- Fix #48: Add make distclean that removes config.h made by configure.
And add maintainer-clean that removes bison and flex output.
18 November 2019: Wouter
- Detect fixed time memcmp for openssl 0.9.8 compatibility.
- Detect EC_KEY_new_by_curve_name for openssl 0.9.8.
- include limits.h for UINT_MAX.
- If no recvmmsg, dont use msg_flags member, but errno for error,
where our fallback function left it, msg_flags also does not exist
on some systems.
- Remove unused variable warning for portability.
14 November 2019: Wouter
- Fix checkconf test with filenames that sort in the same order.
- Tag for 4.2.3rc1. Branch master is 4.2.4 in development.
11 November 2019: Wouter
- Fix #44: document that remote-control is a top-level nsd.conf
attribute.
- Fix compile on OSX.
- Fix for #44: nicer top-level clause documentation.
22 October 2019: Jeroen
- Number of different UDP handlers has been reduced to one. recvmmsg
and sendmmsg implementations are now used on all platforms.
Compatible implementations are in place for systems that lack the
system calls.
- Socket options are now set in designated functions for easy reuse.
- Socket setup has been simplified for easy reuse.
- Configuration parser is now aware of the context in which an option
was specified.
21 October 2019: Wouter
- For #21 add
contrib/patch_for_s6_startup_and_other_service_supervisors.diff
that adds support for readiness notification with READY_FD from
Cameron Nemo.
17 October 2019: Jeroen
- Fix #40: Merge small fixes for confine-to-zone by Greg Bock.
15 October 2019: Jeroen
- For #39: Merge confine-to-zone feature contributes by Greg Bock.
26 September 2019: Wouter
- Fix #38: log address and failure reason with tls handshake errors,
squelches (the same as unbound) some unless high verbosity is used.
- Fixup clang analysis warning in xfrd_parse_received_xfr_packet
master dereference.
25 September 2019: Wouter
- The nsd.conf includes are sorted ascending, for include statements
with a '*' from glob.
16 September 2019: Wouter
- Fixup warnings during --disable-ipv6 compile.
- Fixup unit test executable to run without IPv6.
4 September 2019: Wouter
- Fix #35: excessive logging of ixfr failures, it stops the log when
fallback to axfr is possible. log is enabled at high verbosity.
2 September 2019: Wouter
- For #21: pidfile "" allows to run NSD without a pidfile, for
startup management tools like daemontools.
28 August 2019: Wouter
- In tests check for tls test tool availability.
19 August 2019: Wouter
- Tag for 4.2.2 release. Git master contains 4.2.3 in development.
13 August 2019: Wouter
- Fix error message for out of zone data to have more information.
- Tag for 4.2.2rc2.
12 August 2019: Wouter
- Fix #33: Fix segfault in service of remaining streams on exit.
6 August 2019: Wouter
- Tag for 4.2.2rc1.
5 August 2019: Wouter
- PR #31: nsd-control: Add missing stdio header.
- PR #32: tsig: Fix compilation without HAVE_SSL.
- Cleanup tls context on xfrd exit.
31 July 2019: Wouter
- Fix #29: SSHFP check NULL pointer dereference.
- Fix #30: SSHFP check failure due to missing domain name.
- Fix to timeval_add in minievent for remaining second in microseconds.
22 July 2019: Wouter
- Set timeout for refetch immediately, only spread load when there
are retries.
19 July 2019: Wouter
- Set no renegotiation on the SSL context to stop client
session renegotiation.
18 July 2019: Wouter
- Fix #25: NSD doesn't refresh zones after extended downtime,
it refreshes the old zones, with a random delay of a couple of
seconds to spread the load.
- Fix so that expired zones stay expired when server is down a
long time.
17 July 2019: Wouter
- Fix that NSD warns for wrong length of the hash in SSHFP records.
15 July 2019: Wouter
- PR #23: Fix typo in nsd.conf man-page.
4 July 2019: Wouter
- Set version to 4.2.2 in development.
- clean memory on exit of nsd-checkzone for memory debug.
- Fix #20: CVE-2019-13207 Stack-based Buffer Overflow in the
dname_concatenate() function. Reported by Frederic Cambus.
It causes the zone parser to crash on a malformed zone file,
with assertions enabled, an assertion catches it.
- Fix #19: Out-of-bounds read caused by improper validation of
array index. Reported by Frederic Cambus. The zone parser
fails on type SIG because of mismatched definition with RRSIG.
2 July 2019: Wouter
- Tag for 4.2.1rc1
27 June 2019: Wouter
- Fix unit test for added options and no dot after zone updated
log message.
- Fix compile without accept4.
21 June 2019: Wouter
- Omit remaining tcp processing if the list is empty.
- Fix output of nsd-checkconf -h.
20 June 2019: Wouter
- Initialize event structures before event_set, to stop uninitialized
values from setting event library lists and assertions, that would
sometimes also show after event_del.
- Added num.tls and num.tls6 stat counters.
- PR #12: send-buffer-size, receive-buffer-size,
tcp-reject-overflow options for nsd.conf, from Jeroen Koekkoek.
- Do not use symbol from libc, instead use own replacement, if not
available, for accept4.
- Fix #14, tcp connections have 1/10 to be active and have to work
every second, and then they get time to complete during a reload,
this is a process that lingers with the old version during a version
update.
19 June 2019: Wouter
- Fix tls handshake event callback function mistake, reported
by Mykhailo Danylenko.
18 June 2019: Wouter
- Fix #15: crash in SSL library, initialize variables for TCP access
when TLS is configured.
14 June 2019: Wouter
- Fix to init event not pointer, in reassignment.
12 June 2019: Wouter
- Fix to init event structure for reassignment.
11 June 2019: Wouter
- NSD 4.2.0 release. Current development is 4.2.1.
- Fixup of RELNOTES, corrected RFC reference for 4892.
- Fix #13: Stray dot at the end of some log entries, removes dot
after updated serial number in log entry.
- Fix TLS cipher selection, the previous was redundant, prefers
CHACHA20-POLY1305 over AESGCM and was not as readable as it could be.
- Consolidate server tls context create and remote control context
create, with hardening for the remote control tls context too.
6 June 2019: Wouter
- NSD 4.2.0rc1 tag.
4 June 2019: Wouter
- Fix unit test for outgoing interface to use random port numbers for
the outgoing interface config.
29 May 2019: Wouter
- Fix to guard _OPENBSD_SOURCE from redefinition.
28 May 2019: Wouter
- Fix to define _OPENBSD_SOURCE to get reallocarray on NetBSD.
16 May 2019: Wouter
- Fix #10: Fix memory leaks caused by duplicate rr and include
instructions.
6 May 2019: Wouter
- Note CII best practices badge for NSD on the README.md.
2 May 2019: Wouter
- Fix .gitignore for unit test generated files.
- Fix checkconf unit test for hide-identity and tls.
1 May 2019: Wouter
- Fix makedist.sh for use with git.
- Nicer output on travis for clang analysis.
- Add .gitignore file to exclude built files from version tracking.
- Add README.md file in repository with compile instructions.
- Fix .gitignore for dnstap files and aclocal temp.
- Add aclocal to README.md for pkgconfig for some configure options.
25 April 2019: Wouter
- Add tls.tpkg unit test for DNS over TLS functionality.
18 April 2019: Wouter
- Fix to avoid buffer alloc with global buffer in tls write handler.
- Fix to initialize event structure when accepting TCP connection.
- Use travis for build check, initial unit test and clang analysis.
- Disable SSLv2,3,TLSv1.0,1.1 if TLS1.2 is available in libssl.
- Disable weak ciphers, enable CIPHER_SERVER_PREFERENCE.
- further setup ssl ctx after the keys are loaded, for ECDH.
- TLS OCSP stapling support, enabled with tls-service-ocsp: filename,
patch from Andreas Schulze.
17 April 2019: Wouter
- Fix to share openssl init code, and perform it once.
16 April 2019: Andreas via Sara
- Patch to add support for TCP Fast Open
- Patch to add support for tls service on a specified tls port
16 April 2019: Wouter
- Fix #4249: The option hide-identity: yes stops NSD from responding
with the hostname for chaos class queries. Implements the RFC4829
security considerations.
- Remove starttls, this signalling method was not standardized.
- Remove TO bit, this signalling method was not standardized.
- Remove unused first_query and tls_ok states.
- Remove sign-compare warning in tls packet send code.
- Fix spelling in comment and log printout.
- Fix potential uninitialized variable.
- Fix documentation for DNS over TLS, and set default port 853.
- Fix to add missing comment.
- Fix that the TLS handshake routine sets the correct event to
continue when done.
- Fix that TLS renegotiation calls the read and write routines again
with the same parameters when the desired event has been satisfied.
- Fix that TCP Fastopen has better error message and supports OSX.
- Fix log for fastopen with verbosity.
- Squelch TLS handshake failure log until verbosity 3.
- Add per-zone statistics for TLS queries, and dnstap for TLS queries,
and rcode and TCflag statistics for TCP and TLS queries.
25 March 2019: Wouter
- Print IP address when bind socket fails with error.
21 March 2019: Wouter
- Fix spelling error in release notes.
- Fix to delete unused zparser.default_apex member.
19 March 2019: Wouter
- tag 4.1.27rc1. This became 4.1.27 on 25 March 2019 and trunk has
4.1.28 in development.
18 March 2019: Wouter
- Fix unit test bug013_truncate for new truncation with EDNS size,
it is one RR smaller for the truncated response in the test.
14 March 2019: Wouter
- Fixed radtree_insert memory leak.
- Fixed access recycled variable.
11 March 2019: Wouter
- Fix #6: nsd-control-setup: Change validity time to a shorter
period (<2038).
- Fix unused definition in header remote.h.
- Fix #4236: IPV4_MINIMAL_RESPONSE_SIZE=1480 is slightly too big.
- Fix #4235: IP_PMTUDISC_OMIT on IPv4/UDP sockets.
18 February 2019: Wouter
- Fix to remove unused code.
15 February 2019: Wouter
- tentative robustness, delete stats items from list twice if needed.
14 February 2019: Wouter
- Fix #4: setusercontext() is in libutil on NetBSD, and also
include login_cap.h only if it exists.
- Fix #4215: fixup for state update for TSIG information in server
processes, nicer printout for tsig_print, tsig_print without
arguments and no leaks.
- nicer logging for update_tsig.
1 February 2019: Wouter
- Fix for tsig assoc_tsig command on acl with nokey elements.
29 January 2019: Wouter
- Fix #4215: on-the-fly change of TSIG keys with patch from Igor, adds
nsd-control print_tsig, update_tsig, add_tsig, assoc_tsig
and del_tsig. These changes are gone after reload, edit the
config file (or a file included from it) to make changes that
last after restart.
- documentation for tsig nsd-control options.
24 January 2019: Wouter
- Deny ANY with only one RR in response, by default. Patch from
Daisuke Higashi. The deny-any statement in nsd.conf sets ANY
queries over UDP to be further moved to TCP as well.
Also no additional section processig for type ANY, reducing
the response size.
- assertions for clang analysis.
10 December 2018: Wouter
- Fix for FreeBSD port with dnstap enabled.
6 December 2018: Wouter
- Fix to reduce region_log_stats if condition, this removes a
debug statement.
5 December 2018: Wouter
- Fix #4213: disable-ipv6 and dnstap compile error.
3 December 2018: Wouter
- Note that the content_list member is unused; and could be removed
if the database format is modified or updated.
- Fix that dnstap logs CQ and CR like BIND does.
- Revert that, it looks wrong, AQ and AR are for the authoritative.
29 November 2018: Wouter
- Tag for 4.1.26rc1. Which became 4.1.26 on 4 dec 2018.
Trunk has 4.1.27 in development.
- Fix clang analysis warning on null in closest encloser for wildcard
denial nsec.
- Fix clang analysis warnings.
27 November 2018: Wouter
- Fix parsezone failure in 4194 fix.
26 November 2018: Wouter
- Fix to not set GLOB_NOSORT so the nsd.conf include: files are
sorted and in a predictable order.
- Added nsd-control changezone. nsd-control changezone name pattern
allows the change of a zone pattern option without downtime for
the zone, in one operation.
- Fix #3433: document that reconfig does not change per-zone stats.
20 November 2018: Wouter
- Fix #4205: enable-recvmmsg in mixed IPv4/IPv6 environment fails.
This sets the msg_hdr.msg_namelen correctly after receipt.
19 November 2018: Wouter
- Support SO_REUSEPORT_LB in FreeBSD 12 with the reuseport: yes
option in nsd.conf.
- Fix #4202: nsd-control delzone incorrect exit code on error.
- Tab style fix to use tab for 8 spaces, from Xiaobo Liu.
25 October 2018: Wouter
- Adjust dnstap socket path for chroot.
22 October 2018: Wouter
- Fix #4194: Zone file parser derailed by non-FQDN names in RHS of
DNSSEC RRs.
- Fix some more, neater code and checks for domain length limit.
- check that the dnstap socket file can be opened and exists, print
error if not.
4 October 2018: Wouter
- dnstap work, the dnstap.proto is a copy of the file from Unbound,
also dnstap.m4 configure include file.
- dnstap collector: free eventbase and memclean nicer.
- dnstap collector: send data and read it in collector.
- dnstap/dnstap.c and .h from Unbound's contribution from
Farsight Security, added to then adapt it for dnstap logging in NSD.
- dnstap.c with auth query and auth response, and called from
the collector.
- dnstap work, config nsd.conf parse.
- dnstap example config.
25 September 2018: Wouter
- NSD 4.1.25 released, trunk has 4.1.26 in development.
18 September 2018: Wouter
- tag for NSD 4.1.25rc1.
17 September 2018: Wouter
- Fix #4156: Fix systemd service manager state change notification
14 September 2018: Wouter
- Remove unused if clause during server service startup.
13 September 2018: Wouter
- Fix typo in clang analysis test.
- Annotate exit functions with noreturn.
- nsd-control prints neater errors for file failures.
12 September 2018: Wouter
- clang analysis test.
11 September 2018: Wouter
- Fix to combine the same error function into one, from Xiaobo Liu.
- Fix initialisation in remote.c.
- please clang analyzer and fix parse of IPSECKEY with bad gateway.
- Fix unit test code for clang analyzer.
- Fix nsd-checkconf fail on bad zone name.
10 September 2018: Wouter
- Fix coding style in nsd.c
7 September 2018: Wouter
- append_trailing_slash has one implementation and is not repeated
differently.
4 September 2018: Wouter
- Fix codingstyle in nsd-checkconf.c in patch from Sharp Liu.
15 August 2018: Wouter
- Fix use_systemd typo/leftover in remote.c.
13 August 2018: Wouter
- tag for 4.1.24 release.
- trunk is 4.1.25 in development.
- Fix that nsec3 precompile deletion happens before the RRs of
the zone are deleted.
- Fix printout of accepted remote control connection for unix sockets.
6 August 2018: Wouter
- tag for 4.1.24rc1 release.
30 July 2018: Wouter
- Tag for NSD 4.1.23 release, trunk is 4.1.24, includes
fix NSD time sensitive TSIG compare vulnerability.
- Fix checkconf test for use-systemd option.
25 July 2018: Wouter
- #4133: Fix that when IXFR contains a zone with broken NSEC3PARAM
chain, NSD leniently attempts to find a working NSEC3PARAM.
23 July 2018: Wouter
- Remove socket activation from systemd code, it was reported as
not useful to enable. The readiness signalling is still there,
and can be enabled with use-systemd: yes.
- Only call sd_notify from systemd when use-systemd is yes.
6 July 2018: Wouter
- RFC8162 support, for record type SMIMEA.
- Fix that type CAA (and URI) in the zone file can contain
dots when not in quotes.
26 June 2018: Wouter
- configure --enable-systemd (needs pkg-config and libsystemd) can
be used to then use-systemd: yes in nsd.conf and use socket
activation and readiness signalling with systemd.
19 June 2018: Wouter
- #4106: Fix that stats printed from nsd-control are recast from
unsigned long to unsigned (remote.c).
14 June 2018: Wouter
- Fix that first control-interface determines if TLS is used. Warn
when IP address interfaces are used without TLS.
12 June 2018: Wouter
- #4102: control interface via local socket.
configure it with control-interface: "/path/nsd.ctl" The path
has to start with a / to separate it from an IP address.
The local socket does not use SSL, but unencrypted traffic, use
file and containing directory permissions to restrict access.
6 June 2018: Wouter
- Patch to fix openwrt for mac os build darwin detection in configure.
4 June 2018: Wouter
- tag for 4.1.22rc1. Became 4.1.22 on 11 June, trunk is 4.1.23 in
development from this point.
31 May 2018: Wouter
- Fix to use same condition for nsec3 hash allocation and free.
23 May 2018: Wouter
- Use accept4 to speed up answer of TCP queries, on Linux and FreeBSD
and OpenBSD.
22 May 2018: Wouter
- Fix nsec3 hash of parent and child co-hosted nsec3 enabled zones.
15 May 2018: Wouter
- Fix memory free in unit test.
14 May 2018: Wouter
- Tag for 4.1.21 release.
- trunk has 4.1.22 in development.
- refuse-any sends truncation (+TC) in reply to ANY queries over UDP,
and allows TCP queries like normal.
7 May 2018: Wouter
- Tag for 4.1.21rc1 release.
4 May 2018: Wouter
- Fix #4093: Release notes not using 2018.
3 May 2018: Wouter
- Fix buffer size warnings from compiler on filename lengths.
26 April 2018: Wouter
- lower memory usage for tcp connections, so tcp-count can be higher.
- Fix checkconf test for refuse-any option.
3 April 2018: Wouter
- refuse-any nsd.conf option that refuses queries of type ANY.
5 March 2018: Wouter
- Fix #3562: explain build error when flex missing.
20 February 2018: Wouter
- For more clang warnings
- Fix spelling error in xfr-inspect.
19 February 2018: Wouter
- Fix for clang analysis complaints.
15 February 2018: Wouter
- --enable-memclean cleans up memory for use with memory checkers,
eg. valgrind.
- Fix unused variable warnings from clang analyzer.
14 February 2018: Wouter
- updated RELNOTES for upcoming release.
- tag 4.1.20rc1, became release on 20 feb, trunk has 4.1.21 in
development.
9 February 2018: Wouter
- make depend: updated the make dependencies in the Makefile.
8 February 2018: Wouter
- Fix memory leak when rehashing nsec3 after axfr or zonefile read,
in the selectively allocated precompiled nsec3 hashes.
6 February 2018: Wouter
- Fix memory leak in zone file read of unknown rr formatted RRs.
11 December 2017: Wouter
- Add test for support of -Wno-address-of-packed-member for
--enable-packed.
- tag for release 4.1.19
- trunk has 4.1.20 in development.
8 December 2017: Wouter
- tag for 4.1.19rc1
7 December 2017: Wouter
- Fixup lexer warning for gcc 4.2.
6 December 2017: Wouter
- Fix 3392: Fix regression in 4.1.18 for notify lists with ip4
and ip6 targets.
5 December 2017: Wouter
- Fix spelling error in xfr-inspect.
1 December 2017: Wouter
- Fix warnings emitted by clang for --enable-packed. Alignment is not
a problem for x86_64, don't enable packed when the platform
requires aligned access.
30 November 2017: Wouter
- tag for 4.1.18 release.
- trunk has 4.1.19 in development.
- ignore fallthrough compiler warning in flex EOF rule.
27 November 2017: Wouter
- Fix crash for DS query when parent and child zones both configured
in nsd.conf and parent zone has not loaded properly.
- tag for 4.1.18rc2.
16 November 2017: Wouter
- tag for 4.1.18rc1.
14 November 2017: Wouter
- Fix #2871: Increase number of sockets for xfrd transfers.
6 November 2017: Wouter
- Set usage counts in namedb tree to uint32 to save memory.
- Fix up debug content from nsec3 collision printout work.
2 November 2016: Wouter
- make ip-transparent option work on OpenBSD.
11 October 2016: Wouter
- Fix #1567: Change crit to err log level for gettimeofday failure.
Add defines for compile without syslog.
9 October 2016: Wouter
- Fix collision printout of nsec3 to print name, hash and reverse.
2 October 2016: Wouter
- nsd-control zonestatus prints wait time between attempts, for zones
that are in that waiting time.
19 September 2016: Wouter
- merges feature branch branches/alloced_prehashes into trunk.
18 September 2016: Wouter
- Fix #1446: A corrupted zone file "propagates" to good ones.
14 September 2016: Wouter
- Fix layout in xfrd.c.
6 September 2017: Willem
- Save memory by selectively allocate precompiled nsec3 hashes
29 August 2016: Wouter
- With --enable-packed save memory, at expense of unaligned reads.
- Fix writev compile warning on FreeBSD.
25 July 2016: Wouter
- NSD sends up to 16 notifies simultaneously for up to 64 zones,
to increase rate of notification for large master configurations.
24 July 2016: Wouter
- Fix gcc 7.1.1 warnings.
17 July 2016: Wouter
- Trunk has 4.1.18
- xfr-inspect is part of source dir, but not made or installed by
default.
- retry timeout between sending notifies dropped from 15 to 3 sec.
13 July 2016: Wouter
- tag 4.1.17rc1, and that became the 4.1.17 release on 21 July 2017.
29 June 2016: Wouter
- make depend.
26 June 2016: Wouter
- Fix text format of deletes for CDS and CDNSKEY, single 0 to represent
empty base64 or hex string.
23 June 2016: Wouter
- Fix potential null pointer in nsec3 adjustment tree.
15 June 2016: Wouter
- xfr-inspect debug tool prints out xfr contents of files in tmp.
6 June 2016: Wouter
- Fix #1272: use writev to put tcp length field with data for outgoing
zone transfer requests.
16 May 2016: Wouter
- zone parser parses type AVC (it has TXT format).
25 April 2016: Wouter
- 4.1.16 release tag.
- trunk contains 4.1.17 in development.
11 April 2016: Wouter
- 4.1.16 rc1 tag for release.
- minor manpage fix.
5 April 2016: Wouter
- Patch for expire state in multi-master when masters includes
broken master.
27 March 2016: Wouter
- Fix 1243: Option to make NSD emit really minimal responses,
minimal-responses: yes in nsd.conf.
- but they give additional information for priming queries (type NS).
6 March 2016: Wouter
- Fix 1228: OpenSSL include is not guarded with HAVE_SSL
28 February 2016: Wouter
- Printout serial error with hint it may be too big.
20 February 2016: Wouter
- Fix missing _t to _type conversion for disable-radix-tree option.
15 February 2016: Wouter
- zone parser can parse acronyms for algorithms ED25519 and ED448.
13 February 2016: Wouter
- Calculate new udb index after growing the array, fix from
Chaofeng Liu.
7 February 2016: Wouter
- tag for 4.1.15 rc1. Which became 4.1.15 on 16 Feb. Trunk 4.1.16.
19 January 2016: Wouter
- Fix to rename _t typedefs because POSIX reserves them.
3 January 2016: Wouter
- Fix #1195: Fix so that NSD fails on non-compliant values for Serial.
14 December 2016: Wouter
- Squelch zone transfer error address family not supported by protocol
at low verbosity levels.
13 December 2016: Wouter
- Fix nsd-control and ipv6 only.
8 December 2016: Wouter
- tag 4.1.14
- trunk contains 4.1.15 in development.
1 December 2016: Wouter
- Fix restart of zone transfers when new config becomes available.
- tag 4.1.14rc1
25 October 2016: Wouter
- Fix #1132 for SERVFAIL zones perform backoff, and remembers the
timeout on next startup.
- Save backoff timeout into xfrd.state file, this file has a higher
version number now. Old files are skipped silently (causes
refresh) and created as new files upon exit.
- Set number of rounds to 1; NSD will try every master once, then
wait for timeout or notify.
- Fix axfr fallback for rounds to 1.
20 October 2016: Wouter
- suppress compile warning in lex files.
18 October 2016: Wouter
- Robust fix against missing master in tcp_open for xfrd.
- More in depth fix for the previous.
- Fix wildcards in include: config statements with chroot enabled.
27 September 2016: Wouter
- NSD 4.1.13 tag.
- trunk has 4.1.14 in development.
- Fix null memcpy for radixtree with single link element.
19 September 2016: Wouter
- Review comments Ralph: wrapped long lines and nicer example conf.
16 September 2016: Wouter
- NSD 4.1.13rc1 tag.
15 September 2016: Wouter
- Test for openssl init_crypto and init_ssl functions.
14 September 2016: Ralph
- Fix OPENSSL_INIT_ADD_ALL_DIGESTS compatibility check
13 September 2016: Wouter
- Fix double const in dname_const() function.
- Silenced flex-generated sign-unsigned warning print with gcc
diagnostic pragma.
8 September 2016: Wouter
- more extensible edns option handling.
2 September 2016: Wouter
- Release of 4.1.12; trunk is 4.1.13 and the patch for 4.1.12 (that
does not contain the other changes to the trunk) is folded into
the trunk.
- Fix #827: fix compile with openssl 1.1.0 with api=1.1.0.
25 August 2016: Wouter
- Fix multimaster for not tried full zone transfer for a expired zone.
- Explain --disable-radix tree uses some more CPU.
22 August 2016: Wouter
- Fix README spelling error of BSD license (reported by Joerg Jung).
19 August 2016: Wouter
- for type SRV add A/AAAA to the additional section (if possible),
just like we already do for type MX.
17 August 2016: Wouter
- Add robustness against unallocated data in nsec3 trees.
16 August 2016: Wouter
- configure --disable-radix-tree for about 15% lower memory usage.
12 August 2016: Wouter
- Fix #817: xfrd update failed loop.
9 August 2016: Wouter
- Can config key algorithms with the digest name, eg. 'sha256'.
- default tsig algorithm is sha256.
- Fix typo in log output, 'transfered' -> 'transferred'.
- Fix compile warnings about signcompare in minmax retrytime.
8 August 2016: Wouter
- Support syntax of RR type OPENPGPKEY from RFC 7929.
5 August 2016: Wouter
- multi-master-check: yes can be used to check all masters for the
last version, using the higher version from the configured masters,
from Manabu Sonoda.
- small fixups on patch. And fix spacing and remove configure flag.
- Fix #812: make depend fails after distribution.
2 August 2016: Wouter
- Fix unused result warnings from write and strtol.
1 August 2016: Wouter
- Tag 4.1.11rc1.
- Fix nsec3 missing for nsec3 signed parent and child for DS at zonecut.
- Tag 4.1.11rc2.
- trunk is 4.1.12 in development.
8 July 2016: Wouter
- Note down tracking numbers for issue JVN#63359718 JPCERT#91251865.
5 July 2016: Wouter
- Fix #790: size-limit-xfr can stop NSD from downloading infinite zone
transfer data size, from Toshifumi Sakaguchi.
27 June 2016: Wouter
- Set default for min-refresh-time and min-retry-time to 0. Behaves
just like before, but has a configurable option in nsd.conf.
- Fix #783: Trying to run a root server without having configured it
silently gives wrong answers.
16 June 2016: Wouter
- When tcp is more than half full, use short timeout for tcp session.
- Patch for {max,min}-{refresh,retry}-time from YAMAGUCHI Takanori.
- man page entries for max-refresh-time patch.
15 June 2016: Wouter
- Fix build without IPv6, patch from Zdenek Kaspar.
14 June 2016: Wouter
- release 4.1.10 and tag for that.
- trunk has 4.1.11 in development.
7 June 2016: Wouter
- Fix NSEC3 ent fix to use closest encloser, not wildcard denial.
2 June 2016: Wouter
- Fix for NSEC3 with zone signed without exact match for empty
nonterminals, the answer for that domain gets wildcard denial.
- #772 Document that recvmmsg has IPv6 problems on some linux kernels.
- tag for 4.1.10rc1.
31 May 2016: Wouter
- print notice that nsd is starting before taking off.
20 May 2016: Wouter
- Updated fix for nonterminal nsec3 answers.
19 May 2016: Wouter
- Fix empty nonterminal nsec3 cover answers.
12 May 2016: Wouter
- NSD includes AAAA before A for queries over IPV6 (in delegations).
And TC is set if no glue can be provided with a delegation because
of packet size.
19 April 2016: Wouter
- Fix #755: NSD spins after a zone update and a lot of TCP queries.
7 April 2016: Wouter
- If set without nsd.db print "" as the default in the man pages.
4 April 2016: Wouter
- Fix #751: NSD fails to occlude names below a DNAME.
24 March 2016: Wouter
- Fix for openssl 1.1.0, HMAC_CTX size not exported from openssl.
21 March 2016: Wouter
- Update acx_nlnetlabs.m4 to version 33 with HMAC_Update test.
- acx_nlnetlabs.m4 to v34, with -ldl -pthread test for libcrypto.
15 March 2016: Wouter
- ip-freebind: yesno option in nsd.conf sets IP_FREEBIND socket option
for Linux, binds to interfaces and addresses that are down.
- Change the nsd.db file version because of nanosecond precision fix.
- 4.1.9 release with the nsd.db file version fix (but not freebind),
trunk contains 4.1.10 in development.
10 March 2016: Wouter
- Tag 4.1.8
- Trunk contains 4.1.9 in development.
2 March 2016: Wouter