1NSD RELEASE NOTES 2 34.1.27 4================ 5FEATURES: 6 - Deny ANY with only one RR in response, by default. Patch from 7 Daisuke Higashi. The deny-any statement in nsd.conf sets ANY 8 queries over UDP to be further moved to TCP as well. 9 Also no additional section processig for type ANY, reducing 10 the response size. 11 - Fix #4215: on-the-fly change of TSIG keys with patch from Igor, adds 12 nsd-control print_tsig, update_tsig, add_tsig, assoc_tsig 13 and del_tsig. These changes are gone after reload, edit the 14 config file (or a file included from it) to make changes that 15 last after restart. 16BUG FIXES: 17 - Fix #4213: disable-ipv6 and dnstap compile error. 18 - Fix to reduce region_log_stats if condition, this removes a 19 debug statement. 20 - Fix for FreeBSD port with dnstap enabled. 21 - Fix to remove unused code. 22 - Fix #6: nsd-control-setup: Change validity time to a shorter 23 period (<2038). 24 - Fix unused definition in header remote.h. 25 - Fix #4236: IPV4_MINIMAL_RESPONSE_SIZE=1480 is slightly too big. 26 - Fix #4235: IP_PMTUDISC_OMIT on IPv4/UDP sockets. 27 - Fixed radtree_insert memory leak. 28 - Fixed access recycled variable. 29 30 314.1.26 32================ 33FEATURES: 34 - DNSTAP support for NSD, --enable-dnstap and then config in nsd.conf. 35 - Support SO_REUSEPORT_LB in FreeBSD 12 with the reuseport: yes 36 option in nsd.conf. 37 - Added nsd-control changezone. nsd-control changezone name pattern 38 allows the change of a zone pattern option without downtime for 39 the zone, in one operation. 40BUG FIXES: 41 - Fix #4194: Zone file parser derailed by non-FQDN names in RHS of 42 DNSSEC RRs. 43 - Fix #4202: nsd-control delzone incorrect exit code on error. 44 - Tab style fix to use tab for 8 spaces, from Xiaobo Liu. 45 - Fix #4205: enable-recvmmsg in mixed IPv4/IPv6 environment fails. 46 This sets the msg_hdr.msg_namelen correctly after receipt. 47 - Fix to not set GLOB_NOSORT so the nsd.conf include: files are 48 sorted and in a predictable order. 49 - Fix #3433: document that reconfig does not change per-zone stats. 50 51 524.1.25 53================ 54FEATURES: 55 - nsd-control prints neater errors for file failures. 56BUG FIXES: 57 - Fix that nsec3 precompile deletion happens before the RRs of 58 the zone are deleted. 59 - Fix printout of accepted remote control connection for unix sockets. 60 - Fix use_systemd typo/leftover in remote.c. 61 - Fix codingstyle in nsd-checkconf.c in patch from Sharp Liu. 62 - append_trailing_slash has one implementation and is not repeated 63 differently. 64 - Fix coding style in nsd.c 65 - Fix to combine the same error function into one, from Xiaobo Liu. 66 - Fix initialisation in remote.c. 67 - please clang analyzer and fix parse of IPSECKEY with bad gateway. 68 - Fix nsd-checkconf fail on bad zone name. 69 - Annotate exit functions with noreturn. 70 - Remove unused if clause during server service startup. 71 - Fix #4156: Fix systemd service manager state change notification 72 When it is compiled, systemd readiness signalling is enabled. 73 The option in nsd.conf is not used, it is ignored when read. 74 75 764.1.24 77================ 78FEATURES: 79 - #4102: control interface via local socket. 80 configure it with control-interface: "/path/nsd.ctl" The path 81 has to start with a / to separate it from an IP address. 82 The local socket does not use SSL, but unencrypted traffic, use 83 file and containing directory permissions to restrict access. 84 - configure --enable-systemd (needs pkg-config and libsystemd) can 85 be used to then use-systemd: yes in nsd.conf and have readiness 86 signalling with systemd. 87 - RFC8162 support, for record type SMIMEA. 88BUG FIXES: 89 - Patch to fix openwrt for mac os build darwin detection in configure. 90 - Fix that first control-interface determines if TLS is used. Warn 91 when IP address interfaces are used without TLS. 92 - #4106: Fix that stats printed from nsd-control are recast from 93 unsigned long to unsigned (remote.c). 94 - Fix that type CAA (and URI) in the zone file can contain 95 dots when not in quotes. 96 - #4133: Fix that when IXFR contains a zone with broken NSEC3PARAM 97 chain, NSD leniently attempts to find a working NSEC3PARAM. 98 99 1004.1.23 101================ 102BUG FIXES: 103 - Fix NSD time sensitive TSIG compare vulnerability. 104 105 1064.1.22 107================ 108FEATURES: 109 - refuse-any sends truncation (+TC) in reply to ANY queries over UDP, 110 and allows TCP queries like normal. 111 - Use accept4 to speed up answer of TCP queries, on Linux, FreeBSD 112 and OpenBSD. 113BUG FIXES: 114 - Fix nsec3 hash of parent and child co-hosted nsec3 enabled zones. 115 - Fix to use same condition for nsec3 hash allocation and free. 116 117 1184.1.21 119================ 120FEATURES: 121 - --enable-memclean cleans up memory for use with memory checkers, 122 eg. valgrind. 123 - refuse-any nsd.conf option that refuses queries of type ANY. 124 - lower memory usage for tcp connections, so tcp-count can be higher. 125BUG FIXES: 126 - Fix unused variable warnings and uninit variable in statistics 127 printout from clang analyzer. 128 - Fix spelling error in xfr-inspect. 129 - Fix #3562: explain build error when flex missing. 130 - Fix buffer size warnings from compiler on filename lengths. 131 - Fix #4093: Release notes not using 2018. 132 133 1344.1.20 135================ 136BUG FIXES: 137 - Fix memory leak in zone file read of unknown rr formatted RRs. 138 - Fix memory leak when rehashing nsec3 after axfr or zonefile read, 139 in the selectively allocated precompiled nsec3 hashes. 140 141 1424.1.19 143================ 144BUG FIXES: 145 - ignore fallthrough compiler warning in flex EOF rule. 146 - Fix warnings emitted by clang for --enable-packed. Alignment is not 147 a problem for x86_64, don't enable packed when the platform 148 requires aligned access. 149 - Fix spelling error in xfr-inspect. 150 - Fix 3392: Fix regression in 4.1.18 for notify lists with ip4 151 and ip6 targets. 152 - Add test for support of -Wno-address-of-packed-member for 153 --enable-packed. 154 155 1564.1.18 157================ 158FEATURES: 159 - xfr-inspect, it is not installed, it prints xfr files from /tmp 160 made with 'make xfr-inspect' in the source dir. 161 - retry timeout between sending notifies dropped from 15 to 3 sec. 162 - NSD sends 16 notifies simultaneously. 163 - configure --enable-packed reduces memory usage, at expense of 164 unaligned reads. Saves about 17%. 165 - Save memory by selectively allocate precompiled nsec3 hashes, 166 saves about 16% memory. 167 - make ip-transparent option work on OpenBSD. 168 - Save about 2% memory by changing usage count size in name tree. 169 - Fix #2871: Increase number of sockets for xfrd transfers. 170BUG FIXES: 171 - Fix gcc 7.1.1 warnings. 172 - Fix writev compile warning on FreeBSD. 173 - Fix #1446: A corrupted zone file "propagates" to good ones. 174 - nsd-control zonestatus prints wait time between attempts, for zones 175 that are in that waiting time. 176 - Fix collision printout of nsec3 to print name, hash and reverse. 177 - Fix #1567: Change crit to err log level for gettimeofday failure. 178 Add defines for compile without syslog. 179 - Fix crash for DS query when parent and child zones both configured 180 in nsd.conf and parent zone has not loaded properly. 181 182 1834.1.17 184================ 185FEATURES: 186 - zone parser parses type AVC (it has TXT format). 187 - Fix #1272: use writev to put tcp length field with data for outgoing 188 zone transfer requests. 189BUG FIXES: 190 - Fix potential null pointer in nsec3 adjustment tree. 191 - Fix text format of deletes for CDS and CDNSKEY, single 0 to represent 192 empty base64 or hex string. 193 194 1954.1.16 196================ 197FEATURES: 198 - zone parser can parse acronyms for algorithms ED25519 and ED448. 199 - Fix 1243: Option to make NSD emit really minimal responses, 200 minimal-responses: yes in nsd.conf. 201BUG FIXES: 202 - Calculate new udb index after growing the array, fix from 203 Chaofeng Liu. 204 - Fix missing _t to _type conversion for disable-radix-tree option. 205 - Printout serial error with hint it may be too big. 206 - Fix 1228: OpenSSL include is not guarded with HAVE_SSL 207 - Patch for expire state in multi-master when masters includes 208 broken master, from Manabu Sonoda. 209 - minor manpage fix. 210 211 2124.1.15 213================ 214BUG FIXES: 215 - Fix nsd-control and ipv6 only. 216 - Squelch zone transfer error address family not supported by protocol 217 at low verbosity levels. 218 - Fix #1195: Fix so that NSD fails on non-compliant values for Serial. 219 - Fix to rename _t typedefs because POSIX reserves them. 220 - Fix that nsec3 hash collisions only reported on verbosity level 3. 221 222 2234.1.14 224================ 225FEATURES: 226 - Fix #1132 for SERVFAIL zones perform backoff, and remembers the 227 timeout on next startup. 228BUG FIXES: 229 - Fix null memcpy for radixtree with single link element. 230 - Robust fix against missing master in tcp_open for xfrd. 231 - Fix wildcards in include: config statements with chroot enabled. 232 - suppress compile warning in lex files. 233 - Fix to try every master once, then wait for timeout or notify. 234 - Save backoff timeout into xfrd.state file, this file has a higher 235 version number now. Old files are skipped silently (causes 236 refresh) and created as new files upon exit. 237 - Fix restart of zone transfers when new config becomes available. 238 239 2404.1.13 241================ 242FEATURES: 243 - multi-master-check: yes can be used to check all masters for the 244 last version, using the higher version from the configured masters, 245 from Manabu Sonoda. 246 - Support RR type OPENPGPKEY from RFC 7929. 247 - Can config key algorithms with the digest name, eg. 'sha256'. 248 - configure --disable-radix-tree for about 15% lower memory usage. 249 - for type SRV add A/AAAA to the additional section (if possible), 250 just like we already do for type MX. 251 - more extensible edns option handling. 252BUG FIXES: 253 - Fix compile warnings about unused result from write and strtol. 254 and signcompare in minmax retrytime. 255 - Fix #812: fix that make depend fails after distribution. 256 - Fix #817: xfrd update failed loop. 257 - Add robustness against unallocated data in nsec3 trees. 258 - Fix README spelling error of BSD license (reported by Joerg Jung). 259 - Fix multimaster for not tried full zone transfer for a expired zone. 260 - Fix #827: fix compile with openssl 1.1.0 with api=1.1.0. 261 262 2634.1.12 264================ 265BUG FIXES: 266 - Fix malformed edns query assertion failure, reported by 267 Michal Kepien (NASK). 268 269 2704.1.11 271================ 272FEATURES: 273 - When tcp is more than half full, use short timeout for tcp session. 274 - Patch for {max,min}-{refresh,retry}-time from YAMAGUCHI Takanori. 275 - Fix #790: size-limit-xfr can stop NSD from downloading infinite zone 276 transfer data size, from Toshifumi Sakaguchi. Fixes CVE-2016-6173 277 JVN#63359718 JPCERT#91251865. 278BUG FIXES: 279 - Fix build without IPv6, patch from Zdenek Kaspar. 280 - Fix #783: Trying to run a root server without having configured it 281 silently gives wrong answers. 282 - Fix #782: Serve DS record but parent zone has no NS record. 283 - Fix nsec3 missing for nsec3 signed parent and child for DS at zonecut. 284 285 2864.1.10 287================ 288FEATURES: 289 - ip-freebind: yesno option in nsd.conf sets IP_FREEBIND socket option 290 for Linux, binds to interfaces and addresses that are down. 291 - NSD includes AAAA before A for queries over IPV6 (in delegations). 292 And TC is set if no glue can be provided with a delegation because 293 of packet size. 294 - print notice that nsd is starting before taking off. 295BUG FIXES: 296 - Fix for openssl 1.1.0, HMAC_CTX size not exported from openssl. 297 - Fix #751: NSD fails to occlude names below a DNAME. 298 - If set without nsd.db print "" as the default in the man pages. 299 - Fix #755: NSD spins after a zone update and a lot of TCP queries. 300 - Fix for NSEC3 with zone signed without exact match for empty 301 nonterminals, the answer for that domain gets closest encloser. 302 - #772 Document that recvmmsg has IPv6 problems on some linux kernels. 303 304 3054.1.9 306================ 307BUG FIXES: 308 - Change the nsd.db file version because of nanosecond precision fix. 309 310 3114.1.8 312================ 313FEATURES: 314 - #732: tcp-mss, outgoing-tcp-mss options for nsd.conf, patch 315 from Daisuke Higashi. 316 - #739: zonefile changes when mtime is small are detected on reload, 317 if filesystem supports precision mtime values. 318 - RR type CSYNC (RFC7477) syntax is supported. 319BUG FIXES: 320 - take advantage of arc4random_uniform if available, patch from 321 Loganaden Velvindron. 322 - Fix flto check for OSX clang. 323 - Define _DEFAULT_SOURCE with _BSD_SOURCE for glibc 2.20 on Linux. 324 - Fix #736: segfault during zone transfer. 325 - Fix #744: Fix that NSD replies for configured but unloaded zone 326 with SERVFAIL, not REFUSED. 327 328 3294.1.7 330================ 331FEATURES: 332 - support configure --with-dbfile="" for nodb mode by default, where 333 there is no binary database, but nsd reads and writes zonefiles. 334 - reuseport: no is the default, because the feature is not troublefree. 335 - configure --enable-ratelimit-default-is-off with --enable-ratelimit 336 to set the default ratelimit to disabled but available in nsd.conf. 337 - version: "string" option to set chaos version query reply string. 338BUG FIXES: 339 - Fix zones updates from nsd parent event loop when there are a lot 340 of interfaces. 341 - portability fixes. 342 - patch from Doug Hogan for SSL_OP_NO_SSLvx options, for the new 343 defaults in the ssl libraries. 344 - updated contrib/nsd.spec, from Bálint Szigeti, with new configure 345 options. 346 - Allocate less memory for TSIG digest. 347 - Fix #721: Fix wrong error code (FORMERR) returned for unknown 348 opcode. NOTIMP expected. 349 - Fix zonec ttl mismatch printout to include more information. 350 - Fix TCP responses when REUSEPORT is in use by turning it off. 351 - Document default in manpage for rrl-slip, ip4 and 6 prefixlength. 352 - Explain rrl-slip better in documentation. 353 - Document that ratelimit qps and slip are updated in reconfig. 354 - Fix up defaults in manpage. 355 356 3574.1.6 358================ 359BUG FIXES: 360 - Fix #701: Fix that AD=1 set in a BADVERS response. 361 - Fix typo in zonec.c inside error message. 362 - Fix #711: Document that debug-mode yes is used for staying 363 attached to the supervisor console. 364 - Document verbosity 3 prints more information. 365 - nsd-checkconf warns for master zones with no zonefile statement. 366 - Fix start failure when many file descriptors are in use. 367 - The servfail rcode is not printed with a space in the middle. 368 - print failed token for config syntax error or parse error. 369 370 3714.1.5 372================ 373BUG FIXES: 374 - Fix #706: default port 53 not opened on ip4 because of getaddrinfo 375 hints initialisation failure. 376 377 3784.1.4 379================ 380FEATURES: 381 - RFC7553 RR Type URI support. 382 - removed hardcoded interface limit, --with-max-ips removed. 383 - SO_REUSEPORT support, by default on Linux, or with reuseport: yes. 384 - Admitted axfrs are logged at verbosity 1. Refused at verbosity 2. 385 - --enable-pie and --enable-relro-now options for a safer executable. 386BUG FIXES: 387 - Fix NSID response for short edns sizes. 388 - Fix that for expired zones NSD performs an AXFR and accepts newer 389 and older serial numbers. 390 - Document that minimal responses only minimizes responses to fit 391 in one datagram. It does not minimize smaller responses. 392 - Fix #618: documented need to list ip-addresses separately in 393 nsd.conf if there are multiple, because the source address of 394 replies can otherwise go wrong. 395 - Fix that notify from nsd-control contains soa serial. 396 - Fix #698 formatting errors and typos in nsd.8.in. 397 398 3994.1.3 400================ 401FEATURES: 402 - nsd-control addzones and delzones read list of zones from stdin. 403 - hmac sha224, sha384 and sha512 support, patch from David Gwynne. 404 - max-interfaces raised to 32. 405BUG FIXES: 406 - Fix #665: when removing subdomain, nsd does not reparse parent zone. 407 - Fix task and zonestat files to be stored in a subdirectory in tmp 408 to stop privilege elevation. 409 - Fix crash in zone parser for relative dname after error in origin. 410 - Fix that formerrors are ratelimited. 411 412 4134.1.2 414================ 415FEATURES: 416 - Incoming notifies have serial number logged (at verbosity 1). 417BUG FIXES: 418 - Remove some duplicate header includes (from Brad Smith). 419 - Fix tcp waiting list for zone transfers where the bind and connect 420 calls fail. 421 - Fix segfault in zone reader on invalid input. (thanks John Van de 422 Meulebrouck Brendgard) 423 - Fix segfault on double origin in zone reader (thanks John Van de 424 Meulebrouck Brendgard). 425 - Fix b64pton out of bounds error on invalid zonefile input. 426 (thanks John Van de Meulebrouck Brendgard) 427 - Fix origin directive from unused old value and subdomain parser 428 failure, reported by John Van de Meulebrouck Brendgard. 429 - Fix use after free after zonefile syntax error followed by ttl 430 or origin directive, reported by John Van de Meulebrouck Brendgard. 431 - Fix syntax error followed by too many TXT elements parse crash 432 reported by John Van de Meulebrouck Brendgard. 433 - Fix buffer overflow in config parse of domain name, 434 reported by John Van de Meulebrouck Brendgard. 435 - Use reallocarray for integer overflow protection, patch submitted 436 by Loganaden Velvindron. 437 - Fix allocation integer overflow checks. 438 - Fix #654: Fix contradiction in notify logging verbosity level. 439 - Fix #655: Fix contradiction in verbosity for zone transfers. 440 - Made log message more consistent, changed 'axfr refused' log message 441 to be more consistent with other messages. Also notify refused. 442 - verbosity 2 logs axfr refused and notify refused. 443 verbosity 1 contains less log messages. 444 445 4464.1.1 447================ 448FEATURES: 449 - RFC 7344: CDS and CDNSKEY (read record types). 450 - per zone statistics with --enable-zone-stats, config zone with 451 zonestats: "name", zones configured with the same string are added. 452 - Disabled use of SSLv3 in nsd-control. 453 - nsd-checkconf -f prints out full name of pidfile (with dir). 454 - Synthesize CNAMEs with same TTL as DNAME. 455BUG FIXES: 456 - Fix that expired zones stay expired after a server restart. 457 - Fix "xfrd_handle_ipc: bad mode" log errors when compiled 458 with --disable-bind8-stats. 459 - Fix #616: retry xfer for zones with no content after command. 460 - Fix char used as array index warnings on NetBSD. 461 - Fix that queries for noname CH TXT are REFUSED instead of nodata. 462 - Fixes for wildcard addition and deletion, speedup for some cases. 463 - Fix that failure to add tcp to tcp base does not leak the socket. 464 - Patch nsd_munin_ from Philip Paeps to use type ABSOLUTE. 465 - Fix spinning NSD with lots of failing transfers, due to pointer 466 comparison using void pointer subtraction (from Otto Moerbeek). 467 - Fix bug#637: fix that nsd.db grows limitlessly, an off by one 468 on one megabyte free chunks, created during AXFRs of large zones, 469 that caused the one megabyte chunk to be leaked. 470 - Fix casts for ctype functions (from Todd Miller). 471 - correct some hyphen-used-as-minus-sign (from Andreas Schulze) in 472 man pages. 473 - Fix zonesdir chroot error message. 474 475 4764.1.0 477================ 478FEATURES: 479 - database: "" starts without mmap of database. Less memory is used, 480 zones are read from text zonefile. 481 - optimised zonefile parse code and zonefile write code. 482 - zonefiles-write option in nsd.conf, enabled when database is "". 483 The server writes changed zonefiles to disk every hour. 484 - xfrdfile: "" disables xfrd.state. If enabled, zones that are 485 same as before are not checked for a serial update at server start. 486 - include: "foo/nsd.d/*.conf" works, wildcard glob on includes. 487 - nsd shuts down during init process if given signal. 488 - log-time-ascii option, default yes, with readable timestamp in log. 489 - nsd-control addzone reports if zone already exists. 490 - Fix #564: add nsd-checkzone tool to check zonefile correctness. 491 - Increased default --with-max-ips from 8 to 16, this increases the 492 number of interfaces you can specify in nsd.conf to listen to. 493BUG FIXES: 494 - Fixed shutdown message sporadically not printed on exit 495 (Thanks Anand Buddhdev). 496 - Documented zonefile %s syntax in nsd.conf man page. 497 - Fix manpage to put colon after zonefiles check and write. 498 - Change from 'Zone" to "zone" with ".. serial .. is updated" log 499 message. 500 - Changed maxbackoff for no-content secondary zones from 4h to 24h. 501 - Fix print filename of encompassing config file on read failure. 502 - Fix delete or rename of a lot of zones and make it take a 503 non-enormous time. 504 - Speed up deletion of zone contents a lot, (56s to 1s), speeds up 505 delete, rename and AXFR for zones. 506 - Fix #571: unused variable and incompatible pointer warnings when 507 compiled on a system without INET6. 508 - Fix write_socket return value check in server.c (Thanks Brad Smith, 509 Mark Kettenis). 510 - Fix that xfrd reaps children also if the signal is lost. 511 - Fix #577: makefile incorrectly installed manpages from srcdir. 512 - Fix #587: Default value for statistics is 0. 513 - Fix #553: Improve TXT parsing. 514 - Fix #590: rrl log does not print wildcard as a star but escaped. 515 - Fix #591: rrl log messages at verbosity level 1. 516 - fix strptime implicit declaration error on OpenBSD. 517 - Fix -O3 compile flag to -O2 to avoid miscompilations. 518 - Allow user to override the -g -O2 CFLAGS in ./configure. 519 - Fix endian.h include for OpenBSD. 520 - Fix #600: document that provide-xfr provides AXFR and not IXFR. 521 - Fix rising-load-average or memory-leaks in OSes (Linux since 2.6), 522 that keep track of all past process parents, or leak memory 523 for them. Fix makes it so there is no very deep string of 524 process parents. 525 - Remove .LP after .SH in man pages. 526 527 5284.0.3 529================ 530BUG FIXES: 531 - Fix nsd.db unclean close check. Previous databases are considered 532 unclean by the code and are created anew. 533 - Adds nsd.db larger than 400Tb check for sanity. Also test if 534 filesize as documented in the file is correct. 535 - nsd waits for tasks to complete on stop, prevents nsd.db corruption. 536 - fix to not delete tmpdir too early in shutdown process. 537 - disabled udb checking functionality that made it very slow, 538 this was enabled when enable-checking was turned on. 539 540 5414.0.2 542================ 543FEATURES: 544 - Return REFUSED for queries to non-hosted zones. 545 546BUG FIXES: 547 - Fix expired zones to give SERVFAIL, also when parent zone loaded. 548 - documented nsd-control zonestatus output in nsd-control manpage. 549 - remove mention of nsdc from nsd-checkconf manpage. 550 - Disabled recvmmsg and sendmmsg usage by default because kernel 551 versions have implementation issues: ipv6 ignored, security issues. 552 - Detect libevent2 install automatically by configure, and use 553 event2 header files if necessary. 554 - Fix #551: change Regent to Copyright holder in the LICENSE, 555 to match the definition on opensource.org for the BSD License. 556 - Fix #552: zonefile loads on nsd-control reconfig when the name 557 of the file has changed. 558 - Fix leak of zone name after zonefile read and fix malloc too 559 large that would be leaked in the radix tree. 560 - Fix from 3.2: make SOA RDATA comparisons in XFR more lenient (only 561 check serial). 562 - Fix that NSD will delete and recreate not-clean-closed databases. 563 564 5654.0.1 566================ 567FEATURES: 568 - recognizes ip-address and interface as synonyms for convenience. 569 - Support for EUI48 and EUI64 RR types enabled by default (RFC 7043). 570 - Support for CAA RRtype (RFC 6844). 571 - NSID can be set with "ascii_somestring" in ascii. 572 573BUG FIXES: 574 - Fix xfrd when zone transfer TCP contains zero length packets. 575 - Fix for NSEC3 zones where parent zone is co-hosted, also NSEC3, 576 because AXFRs overwrote nsec3 administration in the child zone. 577 - Fix that bad IXFR updates do not result in double SOA records, 578 and that an AXFR is started (attempted) when the zone state seems 579 to be inconsistent with the master's zone state. 580 - Log ip address for sendto and sendmmsg failures. 581 - Fix segfaults after read of zones with rr type WKS from zonefile. 582 - Seed PRNG for openssl at start of daemon, fixes SSL connection issue. 583 - Bugfix #534: IXFR query loop over UDP for zones that are unchanged. 584 - (same as in 3.2.16): fix wildcard cname to nxdomain repeated rrset. 585 - (same as in 3.2.16): Bugfix #542: Match RRSIG TTL with SOA TTL in 586 negative response. 587 - Check if configure in srcdir collides with outofdir build. 588 - Fix #546: output format errors in nsd_munin_ (Thanks Tom Hendrikx). 589 - Fix printout of high-chars in TXT on NetBSD. 590 5914.0.0 NSD 4.0 592=============== 593FEATURES: 594 - documented in doc/NSD-4-features. Change configuration without 595 restart, direct nameserver control with nsd-control, support a 596 higher number of zones. Higher performance (compared to NSD3). 597 - nsdc is gone. Use kill -HUP for reload (also checks if zonefiles 598 have changed and rereads them), and kill -TERM for quit. Or use 599 nsd-control for detailed control. 600 - cron job for nsdcpatch is gone. nsd-control write creates zonefiles. 601 - nsd.db has a new format that compacts itself when it is changed, 602 thus nsdc patch is no longer necessary. 603 - nsd.db is memory mapped, NSD needs (part of) that mmap in ram. 604 - tcp-count can go above 1000; epoll/kqueue support with libevent. 605 - nsd-control reconfig for updates with no restart (zones, keys, ..) 606 - nsd-control-setup to create keys for nsd-control (enable nsd-control 607 with remote-control: yes in nsd.conf). 608 - the NSD 3 feature of special zone stats are not ported to 4 yet, 609 as it would entail a complete reimplementation of the feature. 610FEATURES (incremental from BETA5): 611 - configure --disable-recvmmsg for compat with older Linux kernels, 612 by default it autodetects support in the kernel on the buildmachine. 613 - Fix time at 2038, uint32s changed to time_t, support 64bit time_t. 614 - Fix use of 32bit time, for 2038, thanks to Theo de Raadt for patch. 615BUG FIXES (incremental from BETA5): 616 - Bugfix #518 Incorrect RRL prefix length option names in nsd.conf 617 man page from Ville Mattila. 618 - Fix that xfrd, and nsd-control, does not stop responding when reload 619 errors out. The pid is sent like it should by server_main. 620 - Fix that EOF in quoted string error does not cause reload to exit. 621 - Fixup errors from the stack code checker. 622 - Removed use of random when arc4random is available. Thus, random 623 and srandom are then not linked with the executable. 624 - Fix segfault with no logfile and chroot (Thanks Patrik Lundin). 625 6264.0.0b5 BETA 5 release of NSD 4.0 627================================== 628FEATURES: 629 - Optimizations for startup, qps and tcp speed, beta bug fixes and 630 merge with code changes with NSD 3.2.16. 631 - nsd-mem tool (make nsd-mem) to estimate memory usage. 632 - Same as NSD 3.2.16: --enable-draft-rrtypes(EUI48, EUI64), rr-slip, 633 rrl-ipv[46]-prefix-length, ip-transparent config options. 634 - configure option --disable-flto. 635 - improved RRL logging (query details that caused blockage). 636 - nsd-control status prints out ratelimit if ratelimit is enabled. 637 - nsd-control verbosity prints out verbosity level without argument. 638 - Fix #491: pick program name (of executable) as syslog identity. 639 - printout percentage for long activities (to log). After about 5 640 seconds have passed. 641BUG FIXES: 642 - The same fixes up to NSD 3.2.16. 643 - Fix that old zonefile does not override newer AXFR for slave zones. 644 - Nicer printout of notify. 645 - Fix tcp zonetransfer pipeline lookup function. 646 - Fix compile on bigendian netbsd alpha. 647 - Fixup the growth and shrinkage of nsd.db. This should use less 648 calls to remap and change the file and mmap size. 649 - notify information is logged at correct verbosity level, 1. 650 - Fix memory statistics in nsd_munin_. 651 - faster nsec3 updates. 652 - Fixup contrib/bug390.patch for 4.0.0b4. 653 - remove leak of nsec3. 654 - allocate radixtree in region for small (5%) total savings and 655 about 15% savings in the radixtree itself (due to many small alloc 656 savings in region). 657 - Patch from Lukas Wunner that makes nsd.conf include files work 658 inside chroot/etc environments on repattern and reconfig. 659 - Fix race on exit of nsd, for restarts, so that the pidfile-pid 660 process waits until port53 has been closed before exiting. 661 - Patch from Lukas Wunner that makes chroot more consistent. 662 Make all paths absolute with the chrootdir in front, or use 663 an absolute zonesdir with other paths relative to that. 664 - Fix segfault on repeated reconfigs, double free of zone apex name. 665 - Fix zone parser allocations are put in the db region. 666 - Fix memory leak in zone parser for txt record. 667 - Optimizations: -O3 if possible (user can override CFLAGS), udp 668 buffers are set to 1m by default (if socket options exist), 669 use recvmmsg and sendmmsg, or only recvmmsg, or recvfrom. 670 - nsd.db 12% smaller, no nsec3 hash storage. Also ups udb version 671 because of the format change. The nsd.db is recreated when a 672 different version number is detected on startup. 673 - Fix region-allocator for speedup of load and change of large data. 674 - Increase tcpbacklog default to 256 (silently capped to 128 on BSD). 675 For remote control keep it at 16, it has less TCP load. 676 It does not actually increase TCP performance (some except), but 677 reduces connection loss when there is a spike in TCP connections. 678 - unlink xfr file if transfer is stopped, timeouted or interrupted. 679 And unlink xfr file in progress when the zone is deleted. 680 6814.0.0b4 BETA 4 release of NSD 4.0 682================================== 683BUG FIXES: 684 - remove -fwhole-program gcc flag usage. We cannot reliably detect 685 if it works without failure. 686 - fix zonefiles-check: entry in nsd.conf 687 - fix gcc warning, do not use uninit value for rng init. 688 - remove printout of "bad transfer" to the log for notimpl. 689 - printout log less verbosely, not every axfr packet. 690 - RRL documented in nsd.conf.sample 691 - Fix is_apex flag for zones read from udb. 692 - Fix that nsec3 zones are precompiled when read from udb. This 693 caused assertion failures. 694 - Less printout of 'bad transfer'. 695 - Fix AXFR of NSEC3 slave zone. 696 - Fix that old zonefile does not override newer AXFR for slave zones. 697 - Nicer printout of notify on verbosity 2. 698 6994.0.0b3 BETA 3 release of NSD 4.0 700================================== 701BUG FIXES: 702 - applied patch from Robin Hack to remove double pid file truncation. 703 - repattern is called reconfig (because most config options are 704 picked up, except for superuser options (chroot, logfile, port)) 705 - document that the zonefile attribute can be empty. 706 - documented that the _implicit_ pattern names are used internally. 707 - Added zonefiles-check option, default yes, check mtimes of zone files 708 on sighup and startup (from Robin Hack). 709 - Fix spurious assertion failure for some rrl blocks. 710 - Tabs and spaces nicer in nsd.conf.sample. 711 - List libevent in README. 712 - Fix configure for gentoo gcc and headers. 713 - do-ip4 and do-ip6 nsd.conf options just like unbound. 714 - do not leave task files in /tmp if nsd fails to startup because 715 of file permissions. 716 - create xfrdir on make install (does not remove on make uninstall, 717 because this could be /tmp). 718 - Fix segv if xfrdir does not exit. 719 - log ip address with tcp failure. 720 - Fix time calculation of zone transfer. 721 7224.0.0b2 BETA 2 release of NSD 4.0 723================================== 724FEATURES: 725 - Add and remove zones from nsd.conf with nsd-control repattern. 726 - Merge changes from 3.2.15 (such as xname-rcode fix). 727 728BUG FIXES: 729 - Fix for use with libev. 730 - 'nsd-control start' runs an absolute path to start sbin/nsd. 731 - Fix for use with libevent-2.1.2. 732 - --with-logfile sets the logfile inside the example documentation. 733 - Fixed addzone and delzone inside chroot (thanks Will Pressly). 734 - Fix make outside of source directory. 735 7364.0.0b1 BETA 1 release of NSD 4.0 737================================== 738FEATURES: 739 - add and remove zones without restart. 740 - nsdc is gone, use nsd-control for direct server control. 741 - performance increases 742 - support lots of zones 743 - and more ... 744 - longer desc in doc/NSD-4-features 745 746BUG FIXES: 747 - core code is fixed like 3.2.15r3763 (12 dec 2012). 748 749 7503.2.16 (development branch) 751================================= 752 753FEATURES: 754 - New config option "ip-transparent:" to allow NSD to bind to 755 non local addresses. Default no. 756 - Use IPV6 minimum MTU settings with TCP to reduce failures that 757 are caused by delays in learning working PMTU when communicating 758 through a tunnel. 759 - Bugfix #496: Support for EUI48 and EUI64 RR types. Experimental, 760 turned off by default. Enable with --enable-draft-rrtypes. 761 - New config option "rrl-slip:" to set the average number of 762 packets discarded before we send back a truncated response. 763 - New config option "rrl-ipv4-prefix-length:" and 764 "rrl-ipv6-prefix-length:" to set the prefix lengths. 765 - Improved RRL logging, also print triggering query src address and 766 QTYPE. 767 - Provide RRL documentation in nsd.conf.sample. 768 769BUG FIXES: 770 - Bugfix #357: Parent process waits until children closed down 771 sockets, to prevent NSD failing to bind to sockets when restarting. 772 - Bugfix #487: lookup3.c determine endianness for BSD systems. 773 - Bugfix #491: pick program name (0th argument) as syslog identity. 774 - Bugfix #494: Exit with return code 1 if socket code fails. 775 - RRtypes ASFDB, RP, RT should not compress dnames. 776 - Fix outgoing-interface: Don't fail if family is IPv6 but 777 only IPv4 outgoing-interface is set, or vice versa. 778 - RRtypes ASFDB, RP, RT should not compress dnames. 779 - Check that zone directory is within chroot directory. 780 - Better XFR checking, fallback to AXFR (if allowed) if three 781 malformed XFR packets have been seen. 782 783 7843.2.15 785================================= 786 787FEATURES: 788 - Support for ILNP RR types: NID, L32, L64, LP (RFC6742). 789 - RRL, --enable-ratelimit at configure time and config options. 790 - TSIG initialization only fails when there is no digest found 791 at all. 792 793BUG FIXES: 794 - Bugfix #478: Declaration after statement (for gcc 2.95). 795 - Bugfix #483: Better error message in case of TSIG error. 796 - Bugfix #485: TTL should not be greater than 2^31 - 1. 797 - Fix RCODE when CNAME loop final answer does not exist, should 798 return NXDOMAIN as stated by RFC 6604. 799 - Fix --disable-full-prehash bug, where after multiple incoming 800 IXFRs, NSEC3 can be removed unjustified. 801 8023.2.14 803================ 804 805FEATURES: 806 - TCP writev support. 807 808BUG FIXES: 809 - Fix build on OpenBSD (thanks Oliver Peter). 810 - Prioritize notify sender for requesting XFR (thanks Ilya Bakulin). 811 - Fix crash in zonec if TXT string too long (thanks Ilya Bakulin). 812 - tzset before chroot for correct timezone (thanks Camiel Dobbelaar). 813 - Fix --disable-full-prehash bug when nsdc patch happens while ixfr too, 814 it did not rehash the new database. 815 - Bugfix #464: Conditionally define MAXHOSTNAMELEN. 816 8173.2.13 818================ 819 820BUG FIXES: 821 - Fix for nsd-patch segfault if zone has been removed from nsd.conf 822 (thanks Ilya Bakulin). 823 - Bugfix #460: man page correction - identity. 824 - Bugfix #461: NSD child segfaults when asked for out-of-zone data 825 with --enable-zone-stats. [VU#517036 CVE-2012-2979] 826 827 8283.2.12 829================ 830 831BUG FIXES: 832 - Fix for VU#624931 CVE-2012-2978: NSD denial of service 833 vulnerability from non-standard DNS packet from any host 834 on the internet. 835 http://www.nlnetlabs.nl/downloads/CVE-2012-2978.txt 836 837 8383.2.11 839================ 840 841FEATURES: 842 - Fallback to AXFR if IXFR is unknown at the primary. NSD considers 843 IXFR unknown at the primary if there is a negative response for the 844 IXFR RRtype. This does not override the value for 845 'allow-axfr-fallback'. 846 - Allow for reading in new DNSKEY algorithm mnemonics (RFC5155, 847 RFC5702, RFC5933, and RFC6605 (ECDSA)). 848 - Zone statistics, enable with --enable-zone-stats. This stores the 849 BIND8 stats per zone in a configurable statistics file. This option 850 does not scale and should therefore not be enabled when serving 851 many zones. 852 - Support for TLSA RRtype (DANE). 853 854BUG FIXES: 855 - Fix for qtype ANY for a wildcard domain in NSEC signed zone: Don't 856 add the wildcard domain NSEC into the answer section. Instead, 857 put the wildcard expanded NSEC into the answer section and keep the 858 wildcard domain NSEC in the authority section. 859 - Fix for accept spinning reported by OpenBSD. 860 - Fix restart failed due to bad ixfr packet because of zone removed 861 from nsd.conf. 862 - Bugfix #453: typo in nsdc man page. 863 864OPERATIONAL NOTES: 865 - NSD uses the query name for dname compression again (Fix #235 866 had as side effect that this didn't happen anymore and is hereby 867 undone). 868 869 8703.2.10 871================ 872 873BUG FIXES: 874 - Bugfix #421: Truncate pidfile on shutdown, before unlink. 875 - Bugfix #423: Fix slow zone transfer processing due to 876 'Fix is_existing flag for ENT' bugfix. 877 - Fix bug #430: segfault when MAX_INTERFACES set to more than 65K. 878 - Fix configure.ac strptime check for gcc 4.6.2, acx_nlnetlabs update. 879 880 8813.2.9 882================ 883 884FEATURES: 885 - Minimize responses to reduce truncation: NSD will only add optional 886 records to the authority and additional sections when the response 887 size does not exceed the minimal response size. 888 889 The minimal response size is 512 (no-EDNS), 1480 (EDNS/IPv4), 890 1220 (EDNS/IPv6), or the advertized EDNS buffer size if that is 891 smaller than the EDNS default. 892 893 The feature is enabled by default. You can disable it by configuring 894 NSD with --disable-minimal-responses. 895 896 - Less NSEC3 prehashing. This will make NSD handle zone transfers 897 faster, but will decrease the performance of NXDOMAIN and wildcard 898 NODATA responses. Full prehashing is enabled by default. If you want 899 less NSEC3 prehashing, configure NSD with --disable-full-prehash. 900 Thanks Secure64 for the patch. 901 902BUG FIXES: 903 - Bugfix #302: nsd accepts XFR but refuses to re-read the slave zone. 904 - Bugfix #365: set patch style and zonec verbose for nsdc. 905 - First step of bug #369: RRSIG DNSKEY sets zone to be treated DNSSEC. 906 - Bugfix #375: typos in nsd.conf.5. 907 - Bugfix #381: Binary escaped and transfers. 908 - Bugfix #397: Don't allow relative domain names as origin in $INCLUDE 909 directives. 910 - Fix printout of IPSECKEY by nsd-patch. 911 - Fix is_existing flag for ENT when domain that has a shared ENT 912 is deleted by IXFR. (ENT == Empty Non-Terminal) 913 - Fix bug if the zonefile is changed for a secondary but stored 914 transfers are applied, and stop it from applying ixfr to empty zone. 915 The zone is flagged with error and AXFR-ed. 916 - Fix to have no authority NS set processing for CNAMEs. 917 - Fix nsd-checkconf to check tsig algorithms properly. 918 - Set the AA bit on responses that have an authoritative CNAME. 919 - Fix denial of existence response for empty non-terminal that looks 920 like a NSEC3-only domain (but has data below it). 921 922OPERATIONAL NOTES: 923 - nsd.db version number increased because NSD 3.2.7 and earlier 924 zonec is not compatible due to the TXT strings change. Please 925 run nsdc rebuild before running NSD 3.2.9 and later versions. 926 927 9283.2.8 929============= 930 931BUG FIXES: 932 - Do setusercontext() before chroot(), otherwise login.conf etc. are 933 required inside chroot. 934 - Bugfix #216: Fix leak of compressiontable when the domain table increases 935 in size. 936 - Bugfix #348: Don't include header/library path if OpenSSL is in /usr 937 - Bugfix #350: Refused notifies should log client ip. 938 - Bugfix #352: Fix hard coded paths in man pages. 939 - Bugfix #354: The realclean target deletes a bit too much. 940 - Bugfix #357, make xfrd quit with many zones. 941 - Bugfix #362: outgoing-interface and v4 vs. v6 leads to spurious 942 warning messages. 943 - Bugfix #363: nsd-checkconf -v does not print outgoing-interface ok. 944 - Bugfix: nsd-checkconf -o outgoing-interface omits NOKEY. 945 946OPERATIONAL NOTES: 947 - Use 'make clean' to clean up files that make created. 948 - Use 'make realclean' to also clean up files that were generated by 949 running ./configure. 950 - Use 'make devclean' to also clean up autoconf, autoheader files. 951 9523.2.7 953============= 954 955BUG FIXES: 956 - Bugfix #253: Don't put NS RRs in a response with QTYPE=DS. 957 - Bugfix #320: use arcrandom(4) for QID generation if available. 958 - Bugfix #328: nsd-checkconf overrun. 959 - Bugfix #343: nsdc update fix. 960 - Bugfix #347: Wrong NSEC3 returned for nodata response QTYPE=DS no delegation. 961 - Bugfix: Allow for huge amount of strings in TXT (and other) records. 962 - Bugfix: nsdc can now deal with tsig algorithms other than hmac-md5. 963 - Fixed several parts in the documentation, including #306, #345. 964 9653.2.6 966============= 967 968BUG FIXES: 969 - Bugfix #314: correctly print NSEC next field, escape spaces and 970 fix label overflows. 971 972FEATURES: 973 - Expand command line option '-a' and config option 'ip-address:' 974 with port number. 975 976OPERATIONAL NOTES: 977 - Configure options --disable-dnssec, --disable-nsid, --disable-tsig 978 are removed. 979 - Configure option --max-interfaces is renamed to --max-ips. 980 9813.2.5 982============= 983BUG FIXES: 984 - NSD will not start if chroot is configured, but changing root is 985 not possible (it used to ignore the badly configured chroot). 986 - Make use of the more secure strl* functions. 987 - Bugfix #303: spelling error. 988 989FEATURES: 990 - New option 'nsid:', to specify the NSID (Bugfix #298). 991 - The default chroot can be set with --with-chroot=<dir>. 992 If not set, by default chroot will not be used (thanks Jakob Schlyter). 993 - Optimized zonec and b64_pton compatibility code (thanks Martin Svec). 994 - Optimized memory allocations. Use mmap/munmap instead of malloc/free. 995 Experimental, by default off. Enable it at build time with 996 --enable-mmap (thanks Martin Svec). 997 998OPERATIONAL NOTES: 999 - NSID support is now enabled by default. 1000 10013.2.4 1002============= 1003BUG FIXES: 1004 - Bugfix #269: Additional C99 syntax. 1005 - Bugfix #276: Zonec prints debug data to stderr. 1006 - Bugfix #286: Document verbosity levels in nsd.conf manual page. 1007 - Bugfix #288: Ignore SIGHUP to child processes. 1008 - Fix typo in include file for setusercontext. 1009 1010FEATURES: 1011 - Support DLV records. 1012 - New option 'tcp-query-count:', to limit the maximum number of 1013 DNS queries on a single tcp connection. 1014 - New option 'tcp-timeout:', to override the default tcp timeout. 1015 The default can also be set at build time, --with-tcp-timeout=<number>. 1016 - New option 'notify-retry:', to configure how many times NSD should retry 1017 a NOTIFY message. 1018 - New options 'ipv4-edns-size:' and 'ipv6-edns-size:'. to set your preferred 1019 EDNS buffer size. 1020 1021OPERATIONAL NOTES: 1022 - UDP/IPv4 sockets have new options set that will disable the DF flag in IP 1023 packets. 1024 10253.2.3 1026============= 1027BUG FIXES: 1028 - Bugfix #236: Allow RRs before the SOA in a zonefile. 1029 - Bugfix #249: Remove the C99 code. 1030 - Bugfix #253: Don't put NS RRs in a response with QTYPE=DNSKEY. 1031 - Bugfix #263: Make TSIG algorithm comparison case insensitive. 1032 - Bugfix #266: Build failed on systems without strptime. 1033 - Bugfix: install hickup. 1034 - Fix to use 4096 EDNS limit for IPv6 on Linux. 1035 10363.2.2 1037============= 1038BUG FIXES: 1039 - Off-by-one buffer overflow fix while processing the QUESTION section. 1040 - Return BADVERS when NSD does not implement the VERSION level of the 1041 request, instead of 0x1<FORMERR>. 1042 - Bugfix #234. 1043 - Bugfix #235. 1044 - Reset 'error occurred' after notifying an error occurred at the $TTL or 1045 $ORIGIN directive (Otherwise, the whole zone is skipped because the 1046 error is reset after reading the SOA). 1047 - Minor bugfixes. 1048 10493.2.1 1050============= 1051OPERATIONAL NOTES: 1052 - NSD will now fallback to AXFR, only if the master does not support IXFR. 1053 - You can adjust nsdc patch to skip textfile patching. This will 1054 increase the patching process, but will not output to zonefiles 1055 anymore. By default, this is off. 1056 1057BUG FIXES: 1058 - When configuring, don't do strptime test when cross-compiling. 1059 - Bug #230: Output non-error messages to stdout. 1060 - Better error message when ixfr.db old file format is read. 1061 - Bug #218: shared UDP query for all interfaces. 1062 - Bug #222: Remove bashism from nsdc script. 1063 - Nicer check for SHA-256 functionality. 1064 - Fixed some minor memory leaks that occurred on reload. 1065 - nsdc: check if a lockfile has not gone stale, when lock failed. 1066 - Bugfix strptime compatibility function 1067 1068FEATURES: 1069 - New configuration option 'allow-afxr-fallback', "yes" by default. If 1070 set to "no", NSD will never do AXFR fallback, even if the master 1071 does not support IXFR. 1072 - Allow file rotation on nsd.log. 1073 - The new nsd-patch options -s and -o allows you to skip writing 1074 zonefiles and store the output directly to a database file, 1075 respectively. 1076 10773.2.0 1078============= 1079OPERATIONAL NOTES: 1080 - Format of ixfr.db has changed. When you are planning an upgrade to the 1081 new NSD release, make sure to process the old ixfr.db before starting 1082 the new release (by running nsdc patch). 1083 - IXFR is transmitted over TCP by default instead of UDP. If you want to 1084 continue the use of IXFR/UDP, please modify your zone configuration 1085 file to: 1086 request-xfr: UDP 1.2.3.4 tsigkey 1087 We strongly recommend to enable TSIG if you send IXFR over UDP. 1088 When all masters fail to transmit IXFR/UDP, slave will fallback to 1089 IXFR/TCP and eventually AXFR/TCP. 1090 - nsd-patch prints errors to stderr instead of stdout. 1091 1092BUG FIXES: 1093 - Only normalize dnames in rdatas when rrtype is listed in RFC 4034, 1094 section 6.2: Canonical RR Form, following 1095 draft-ietf-dnsext-dnssec-bis-updates (affects RRSIG and NSEC records). 1096 - Typo in zonec manpage. 1097 - Bugfix in log_finalize. 1098 - Fix race condition between nsdc patch and server reload. 1099 1100FEATURES: 1101 - AXFR/TCP fallback in case of failing IXFR zone transfers. 1102 - RFC 4635: support for hmac-sha1 and hmac-sha256 TSIG algorithm 1103 identifiers, "Bugfix #130". 1104 - Configure the source ip-address for notifies (master) and zone 1105 requests (slave) in nsd.conf, "Bugfix #148". 1106 - nsd-notify and nsd-xfer allow you to configure the outgoing 1107 hostname and source port, in addition to the source address. 1108 - Additional debug and verbose log messages. 1109 11103.1.1 1111============= 1112BUG FIXES: 1113 - Try to avoid race conditions with NSD reloading and nsdc running, 1114 by writing pidfile before closing old parent process. 1115 - Fixed NSEC3 memory leak in the case NSEC3 is not needed. 1116 - Fixed some memory leaks that happened on error, mostly on 1117 zone transfer errors. 1118 - Bugfix #191: nsd-checkconf allowed only (max_interfaces-1) interfaces. 1119 1120FEATURES: 1121 - The number of maximum interfaces allowed is configurable with 1122 --with-max_interfaces=<number> (thanks John Lightsey). 1123 11243.1.0 1125============= 1126OPERATIONAL NOTES: 1127 - Default locations of nsd.db, ixfr.db & xfrd.state are changed to 1128 the /var/db/nsd directory. 1129 1130BUG FIXES: 1131 - Zone compiler gives more sane error messages when out of 1132 diskspace and bug #172: when compiling single zone file. 1133 - Changed man pages format from mdoc to mansun, to support the Solaris OS. 1134 - Log tcp read error only when connection not reset by peer or when 1135 verbosity level is high. 1136 - RRs are compared without checking the TTL value. 1137 1138FEATURES: 1139 - NSD is now NSEC3 enabled by default. You can disable it by configuring 1140 NSD with --disable-nsec3. 1141 - Added "hide-version" configuration setting. Enabling this feature 1142 stops NSD from answering to CHAOS class version requests. 1143 - Added bind2nsd 0.5.0 (http://bind2nsd.sourceforge.net) in contrib/. 1144 - Report source and zone for denied AXFR attempts. 1145 11463.0.8 1147============= 1148FEATURES: 1149 - Better logging for nsd-notify (show 'broken' zone) 1150 - Add configuration for chkconfig to control nsd service. 1151 1152BUG FIXES: 1153 - Fixed nsdc start when nsd already running: do not initialize server, 1154 since it is already running. 1155 - Fixup bug where data related files are looked up in the wrong 1156 directory when chrooted with chrootdir ending with a slash. 1157 - Fixup bug where nsd would return FORMERR if received an edns 1158 query with version set to zero and rdlen larger than zero. 1159 - Fixed strptime, so that zonec will also work on systems with broken 1160 strptime (like leopard :-)) 1161 - Do not answer nsec3 wildcard information when DO bit is not set 1162 - Better logging when creating database failed. 1163 - Various spelling errors 1164 11653.0.7 1166============= 1167BUG FIXES: 1168 - Error handling for malformed IXFRs improved. 1169 - Fixed man pages, consistent syntax. 1170 11713.0.6 1172============= 1173FEATURES: 1174 - Report source and zone for denied AXFR attempts. 1175 1176BUG FIXES: 1177 - More elegant handling of malformed nsec3 records from a zone 1178 transfer. 1179 - Fixup ignored return value in region-allocator. 1180 - Added bind2nsd 0.5.0 (http://bind2nsd.sourceforge.net) in contrib/. 1181 11823.0.5 1183============= 1184BUG FIXES: 1185 - Fixed problem with reload waiting very long. If the OS has a 1186 raging herd problem, NSD could block in a UDP operation and 1187 that process would stop reload from finishing. Made UDP sockets 1188 nonblocking. 1189 - Made TCP listen sockets nonblocking. NSD could block in accept. 1190 - Handle the new CERT RDATA types defined in RFC 4398 (submitted by 1191 Mans Nilsson). 1192 - Fixed a bug where zonec would choke on unknown CERT RDATA types. 1193 - Change nsd-notify retry timer from linear into exponential 1194 backoff (submitted by Mans Nilsson). 1195 - Debug flag (-d) behavior changed. Nsd now also forks children when 1196 run in debug mode. 1197 - Added verbosity mode (-V <level>) for extra operational logging. 1198 - zonesdir default is /etc/nsd. This can be overridden in nsd.conf. 1199 - if clients drop the tcp connection this does not result in a logfile 1200 entry, unless verbosity is set 2 or more. 1201 12023.0.4 1203============= 1204BUG FIXES: 1205 - zonec will print an error when other data is put next to a CNAME. 1206 - Fixup unaligned memory access that could occur when reading ixfr.db 1207 with a partial transfer inside. 1208 - Fixup for the WKS RR type printout by nsd-patch and nsd-xfer. 1209 - Error message 'could not read database CRC' now only given on error. 1210 - ./configure --zonesdir=<directory for zone files> now works to 1211 set a default value for the zonesdir: <dir> nsd.conf directive. 1212 Set zonesdir: "" to disable the change of directory. 1213 - Bug: reload crashes with log message 'continuing with old database', 1214 and after that no more zone updates. Manual fix is to kill -HUP, 1215 but now fixed in software to try to reload again (and again). 1216 - Small speedup where xfrd could briefly be busy-waiting. 1217 - If master sends IXFR with glue that is already present in the zone 1218 this is silently accepted. Printed in debug mode -L 2. To make 1219 the log file smaller. 1220 - Exponential backoff for zones that never worked to max of 4 hours. 1221 For expired zones the SOA retry values are used. 1222 - allow-notify acl entries 'NOKEY' match only queries without TSIG. 1223 - Answers to valid notifies contained wrong RR counts in the header. 1224 The notifies were processed correctly, but now the acknowledgement 1225 reply is in correct DNS format. 1226FEATURES: 1227 - Added contrib/nsd.zones2nsd.conf python script to convert NSD 2 to 1228 NSD 3 config files, contributed by Stephane Bortzmeyer. 1229 - The nsdc control script will print 'nsd startup failed' if the nsd 1230 executable does not start (due to bad permissions, bad config, ...). 1231 12323.0.3 1233============= 1234BUG FIXES: 1235 - Bug #152: NSD would not use the identity from nsd.conf, fixed. 1236 - Bug #153: When running with thousands of secondary zones, NSD would 1237 run out of UDP sockets. Caused crash on FreeBSD, errors on Linux 1238 ('out of file descriptors'), depending on ulimits. Fixed. 1239 - Fixed getaddrinfo error message to be more descriptive. 1240 - Fallback to ip4 if getaddrinfo fails for ip6. 1241 - Will no longer lose a notify message during reloads (IPC). 1242 - Will no longer lose transfer in progress when notified for that zone. 1243 - Nicer error when operator forgets to rebuild after deleting a zone. 1244 12453.0.2 1246============= 1247BUG FIXES: 1248 - Nice error from zonec on a wrong configuration zone name. 1249 - Nicer warning from zonec when starting secondary zone with 1250 no zone file for the first time. 1251 - nsdc makes more portable use of 'which' (for SunOS5.9/bash2.05). 1252 - Bug #143: Improved handling of zonesdir: directive and relative 1253 pidfile, database, diff file, xfrdfile paths in nsdc.sh and 1254 nsd-patch. They would not find the files. 1255 - Bug #144: LOC RRtype default values for precision wrong. Fixed. 1256 - Bug #145: NSD failed to reload cases of simultaneous zone transfer. 1257 - Bug #146: NSD fails to write to xfrdfile when chrooted. Fixed. 1258 Also fix for difffile when chrooted. 1259 - Bug #147: NSD runs out of memory. Fixed, memory is reused. 1260 Occurred when running NSD with very big zones and large updates. 1261 - nsd -L 1 logging is smaller, -L 2 contains all debug information. 1262 (only available for debug compiles). 1263 - Bug #149: Fixed text for NOTAUTH error code. When notify is not 1264 authorised REFUSED error code returned instead. 1265 12663.0.1 1267============= 1268BUG FIXES: 1269 - nsd-patch prints SOA record at start of zone files. 1270 12713.0.0 1272============= 1273FEATURES: 1274 - AXFR/IXFR zone transfer supported. 1275 - NSD requests but does not provide IXFR transfers. 1276 - NSD keeps track of SOA timeouts for secondary zones. 1277 - TSIG authentication supported. 1278 - For queries, for notifies, for zone transfers. 1279 - NOTIFY messages of zone updates, incoming and outgoing. 1280 - DNAME type is supported, including CNAME synthesis. 1281 - config file, nsd.conf(5), place to put TSIG keys, server settings, 1282 and lists of ip-addresses/ranges for AXFR/IXFR and NOTIFY. 1283 - prepared for NSEC3 (--enable-nsec3), experimental code for testing 1284 in workshops. 1285 - prepared for NSID (--enable-nsid), experimental code for testing in 1286 workshops. 1287 1288OPERATIONAL NOTES: 1289 - config file needed, nsd.conf(5) supersedes nsd.zones and nsdc.conf. 1290 - AXFR transfers are denied by default. Allow in config file. 1291 - Zones only become secondary with "request-xfr:" items in config file. 1292 - NSD produces "ixfr.db" file with a journal of zone transfers. 1293 Use nsdc patch to merge changes back to zone files and remake db. 1294 - NSD produces "xfrd.state" file with zone timeout information. 1295 The file is text formatted. 1296 - NSD sends notifies automatically, 1297 nsd-notify is deprecated and will be removed from the package. 1298 - NSD requests AXFR/IXFR and reloads the updates automatically, 1299 nsd-xfer is deprecated and will be removed from the package. 1300 - Check your config file with nsd-checkconf. 1301 1302BUG FIXES: 1303 - contains all bug fixes from 2.3.5 and before. 1304 - The sighandler() bug is fixed more thoroughly, 1305 by using pipes for interprocess communication. 1306 - CNAMEs are followed by the server to different zones and 1307 information from that zone is returned. This saves a followup 1308 query. 1309 - bug fixes (ported) 2.3.6. 1310 - nsd-notify will retry max 15 times 5 second retries. 1311 - Bug #105: nsdc lacks locking, fixed locking for root user. 1312 - Bug #134: nsd: make -N <large number> work again 1313 - Bug #135: Typo in locking code for nsdc, fixed. 1314 - uninitialised variable fixed. 1315 - unaligned memory access (on Solaris SPARC), in zonec 1316 LOC parsing, fixed. 1317 - Bug #138: nsd aborts trying to bind all interfaces if ip6 1318 is not enabled, instead it will fallback to ip4. 1319 - Bug #139: resync timer for stats to whole minute. 1320 - Bug #140: NSD did not clear CD bit on authoritative answers. 1321 - Bug #141: NSD did not clear flags on a formerror reply. 1322 13232.3.5 1324============= 1325BUG FIXES: 1326 - Bug #132: regression, nsd: fix compile with --disable-ipv6 1327 - Makefile: remove gnuisms 1328 13292.3.4 1330============= 1331BUG FIXES: 1332 - Unknown type codes for type code numbers > 48 and < 97 work again. 1333 (this implies --enable-checking can be enabled again) 1334 - nsd: sighandler() fixes 1335 - Bug #118: nsd: nsd_notify waits for a response. Will retry the notify 1336 after a timeout. 1337 - Bug #124: $(DESTDIR) was added to Makefile.in. 1338 - Bug #128: zonec: parser can handle \\ at the end of a string. 1339 - zonec: lexer: add \r to the newline delimeter 1340 - zonec: use strtol with an explicit base 10 as parameter. 1341 (Scott Rose, Roy Arends) 1342 - nsd-xfer: print human readable error codes. Change logging to 1343 be more in line with the rest 1344 13452.3.3 1346============= 1347BUG FIXES: 1348 - Apply the correct patch to nsdc.sh.in. 1349 13502.3.2 1351============= 1352FEATURES: 1353 - Bug #101: add support for the SPF record. 1354 1355BUG FIXES: 1356 - Bug #100: replaced non-portable use of timegm(3) with 1357 portable implementation (mktime_from_utc). 1358 - Bug #103: nsd: trim the SOA's TTL to the MINIMUM value when returning a 1359 negative answer. 1360 - Bug #104: nsd: add a time_t timestamp to the log when logging to 1361 a file. 1362 - Bug #105: nsdc: use a lock file when rebuilding the database (patch by 1363 Jakob Schlyter/Ted Lindgreen/Sebastian/Ondrej Sury). 1364 - Bug #106: zonec: don't walk all 256 NSEC windows when that is not 1365 needed. 1366 - Bug #107: zonec: fixed a crash when encountering bad unknown rdata. 1367 - nsd: Don't print: "error: nsd is already running as <pid>, stopping" 1368 when in fact NSD continues to run. 1369 - nsd: Minimize the race window in sig_handler(). 1370 13712.3.1 1372============= 1373BUG FIXES: 1374 - zonec: Don't crash when generating error messages outside of zone 1375 files. 1376 - nsd: when logging to a file the pid is now printed. 1377 - nsd: Reset 'boot' time in statistics when reloading the database, 1378 since the statistics are reset to 0 on a reload. 1379 - nsd-xfer.c: Added '-a' option to specify local address to connect 1380 from. Original patch supplied by Walter Hop <nsd@walter.transip.nl>. 1381 - Bug #98: Allow mnemonics for DS and RRSIG algorithm field. 1382 13832.3.0 1384============= 1385FEATURES: 1386 - DNSSEC is now enabled by default. NSD should be fully 1387 compliant with RFC4033, RFC4034, and RFC4035. 1388 1389BUG FIXES: 1390 - nsd: Ensure that the number of -a flags does not exceed the 1391 maximum specified by MAX_INTERFACES in config.h. 1392 - nsd-xfer: Use serial number arithmetic (RFC1982) for the 1393 zone serial check 1394 - nsdc: Don't pass (fake) serial number to nsd-xfer if the 1395 zone file does not exist. 1396 - zonec: Loading many zones would cause namedb_find_zone to 1397 slow down, performance patch by Kazunori Fujiwara. 1398 - Bug #96: nsd-xfer did not handle 8-bit domain names 1399 correctly. 1400 14012.2.1 1402============= 1403FEATURES: 1404 - The message priority is now included when logging to a file. 1405 1406BUG FIXES: 1407 - Zero length RDATA using the unknown RR notation was not 1408 working (except for the APL RR type). 1409 - Bug #93: './configure' error message containing a comma must 1410 be properly bracketed. 1411 - Bug #94: nsd-xfer: Handle unexpected EOF when receiving AXFR 1412 data. Timeout if no data is received for more than 120 1413 seconds (see the TCP_TIMEOUT parameter in config.h). 1414 - Bug #95: An owner starting with an asterisk label ("*") was 1415 being treated as its own wildcard child. 1416 14172.2.0 1418============= 1419FEATURES: 1420 - nsd-xfer: replacement program for named-xfer to perform zone 1421 transfers using AXFR. TSIG is supported by nsd-xfer but not 1422 yet by the nsd server. DNSSEC is also supported. TSIG 1423 requires OpenSSL version 0.9.7 or higher, configure using 1424 --disable-tsig if you do not have OpenSSL installed. 1425 Configure using --with-ssl=path if OpenSSL is not installed 1426 at a standard location. 1427 1428CODE CHANGES: 1429 - New data structure 'buffer_type' for representing binary 1430 buffers that can be read, written, and resized. Data in 1431 these buffers is stored in network byte order. This data 1432 structure replaces the iobuf field of 'struct query'. 1433 1434BUG FIXES: 1435 - Fixed endian problem in WKS record. 1436 - Protocol can now be specified numerically in WKS record. 1437 - Allow escape sequences (\DDD) in TTL, RR class, and RR type. 1438 - The zone compiler now accepts many more characters in 1439 unquoted strings such as domain name labels. The characters 1440 no longer need to be escaped with a backslash. 1441 - Close included files after reading. 1442 - Maximum TCP message size is now 65535 bytes. AXFR response 1443 packets are still limited to 16383 bytes for optimal 1444 compression of dnames. 1445 - The TSIG key for AXFRs can now also be stored in the file 1446 <zonename>.tsiginfo. This makes it possible to use TSIG 1447 with multiple master servers. 1448 - Signals are no longer blocked while performing I/O so the 1449 server should respond quicker to signals. 1450 - Fixed parsing of LOC rdata. Fractions and altitude were not 1451 handled correctly. 1452 14532.1.5 1454============= 1455BUG FIXES: 1456 - Bug #90: handle \000 in TXT records correctly 1457 - Fixed undefined behavior in the use of vsnprintf when 1458 logging messages. This caused crashes on Linux/PPC. 1459 14602.1.4 1461============= 1462BUG FIXES: 1463 - nsdc: Fixed a typo that caused AXFRs to stop working. 1464 14652.1.3 1466============= 1467FEATURES: 1468 - nsd: The pidfile can be specified using the '-P' option. 1469 1470BUG FIXES: 1471 - Bug #87: allow @ in the rdata 1472 - Bug #88: allow ::FFFF:ipv4addr in AAAA records 1473 - Bug #89: Count the number of queries received over TCP, 1474 instead of the number of TCP connections. 1475 - Zonec: when - is used as input, set the filename to 'STDIN'. 1476 - The nsdc script handles failed AXFRs more gracefully. 1477 - NSD emits an error when it sees bitlabels (RFC 2673). 1478 - Only copy the CD bit when DNSSEC is enabled. 1479 14802.1.2 1481============= 1482FEATURES: 1483 - NSD now fully supports unknown record types using the 1484 notation specified in RFC3597. 1485 - Support for the following RR types has been added: WKS, X25, 1486 ISDN, RT, NSAP, PX, NAPTR, KX, CERT, DNAME, and APL. DNAME 1487 special processing is not supported. 1488 1489BUG FIXES: 1490 - Bug #84: NSD now uses SIGUSR1 instead of SIGILL to report stats. 1491 - Bug #85: Support for WKS records. 1492 - Bug #86: The characters "#%&^[]?" can now be used without 1493 backslash in zone file domain names. 1494 - Plugin callback return type fixed. 1495 - The maximum message length for IPv6 UDP packets is now 1496 limited to the IPv6 minimum MTU (1280) unless the 1497 IPV6_USE_MIN_MTU socket option is supported. 1498 14992.1.1 1500============= 1501BUG FIXES: 1502 - Bug #81: Handle unknown types correctly. 1503 - Bug #82: Zonec: don't report "0 errors" unless -v is 1504 specified. 1505 - Bug #83: Close zone files after parsing. 1506 - Handle AFSDB RR type. 1507 15082.1.0 1509============= 1510FEATURES: 1511 - New networking code allows a single server to handle both 1512 UDP and TCP connections. By default up to 10 simultaneous 1513 TCP connections are supported. Use the '-n' flag to change 1514 the default. 1515 15162.0.2 1517============= 1518BUG FIXES: 1519 - Allow the use of a mnemonic for the algorithm field of a 1520 DNSKEY record. 1521 - Behavior of the zonec -v flag has been modified. By default 1522 zonec will only print a single line with a summary of the 1523 error count. 1524 - Bug #75: Fixed typo in previous "fix". 1525 15262.0.1 1527============= 1528BUG FIXES: 1529 - Queries for QTYPE DS (DNSSEC) were not handled correctly in 1530 certain cases. 1531 - Partial support for unknown RRs. Known RR types with 1532 unknown RR data format is not yet supported. 1533 - Bug #75: Fixed bad error message when nsdc update is run for 1534 the first time. 1535 - Bug #78: Multiple zones, each with include directives, are 1536 now compiled correctly. 1537 15382.0.0 1539============= 1540FEATURES: 1541 - Experimental DNSSEC support implemented, but disabled by 1542 default. Enable using the --enable-dnssec configuration 1543 option. 1544 - IPv6 enabled by default. Disable using the --disable-ipv6 1545 configuration option. 1546 1547BUG FIXES: 1548 - Bug #47: Domain name is now logged when a notify is 1549 received. 1550 - Bug #70: First include all A records in the additional 1551 section, followed by AAAA records. 1552 - Bug #77: Check length of domain name and label. 1553 - LOC records are supported again. 1554 15551.4.0-alpha1 1556============= 1557FEATURES: 1558 - New database format that is much more compact and portable 1559 across architectures. 1560 - The new zone compiler is now the default and the old zone 1561 compiler has been removed. 1562 - Name compression is done dynamically, removing one other 1563 difference with BIND in the responses generated (the full 1564 query name is now used for compression). 1565 - CNAME target records are now generated from wildcard 1566 records if necessary. 1567 1568REGRESSIONS: 1569 - mmap(2) isn't currently supported. 1570 - Not all RR types are supported by zonec (such as LOC). 1571 15721.3.0-alpha1 1573============= 1574FEATURES: 1575 - New name lookup algorithm. This required a change to the 1576 database format. Performance should increase at the expense 1577 of database size and memory usage. 1578 - New zone compiler (zonec2) based on flex and yacc, fully RFC 1579 compliant (still in alpha). 1580 - Database can be loaded using mmap(2) (use the --enable-mmap 1581 configure option to enable). This is useful on operating 1582 systems such as Solaris that do not allow memory overcommit. 1583 - Region based memory allocation and resource management. 1584 - New internal format for storing domain names. Each dname 1585 now includes an array of label offsets within the domain 1586 name. 1587 - Updates to the plugin API. 1588 1589BUG FIXES: 1590 - Bug #65: The syslog facility is now a compile time option 1591 (--with-facility=FACILITY). The default facility is DAEMON. 1592 - Bug #66: Automatic periodic dumping of the statistics (using 1593 the -s option) is now continued after a database reload. 1594 15951.2.4 1596============= 1597BUG FIXES: 1598 - Bug #72: If an RRset for a child domain is defined before 1599 the RRset of the parent domain the parent's RRset would be 1600 "lost". 1601 16021.2.3 1603============= 1604BUG FIXES: 1605 - Bug #65: The syslog facility is now a compile time option 1606 (--with-facility=FACILITY). The default facility is DAEMON. 1607 - Bug #66: Automatic periodic dumping of the statistics (using 1608 the -s option) is now continued after a database reload. 1609 - NSD would try to kill pid -1 on startup if forking of a child 1610 process failed. 1611 - Do not log EAGAIN errors on calls to recvfrom. These errors 1612 should be harmless. 1613 16141.2.2 1615============= 1616BUG FIXES: 1617 - Bug #59: NSD returns FORMERR when the query name is >= 246 1618 bytes. 1619 - Bug #60: Zonec runs out of file descriptors with many zones. 1620 - Bug #61: nsdc uses /bin/sh hardwired (and should not). 1621 - Bug #62: NSD is not able to log to a file. 1622 - Bug #63: nsdc update and zonec are too talkative. 1623 - Bug #64: Answer for request of a host resolved by a 1624 wildcard-resource-record is not understandable by dig. 1625 16261.2.1 1627============= 1628BUG FIXES: 1629 - AXFR terminates early if a zone contains a CNAME pointing 1630 the the zone's domain name (SOA record) (bug #56). 1631 - During an AXFR memory above the top of the stack was 1632 accessed. This could lead to occasional AXFR errors (bad 1633 packets). 1634 - NSD now prints its version number and exits when invoked 1635 with the -v flag (bug #57). 1636 - NSD prints help information and exits when invoked with the 1637 -h flag. 1638 16391.2.0 1640============= 1641FEATURES: 1642 - NSD is now a single parent process (handling child 1643 termination and database reloads) plus multiple UDP and TCP 1644 child processes handling queries. Before the parent process 1645 also handled UDP queries. This change simplifies the parent 1646 and child processes and allows the use of multiple 1647 concurrent UDP servers. 1648 - Experimental plugin support. This required a minor, 1649 incompatible change to the database format. Make sure you 1650 recompile your database. Use --enable-plugins to enable. 1651 - Full IPv6 support (for multi-homing and for Linux, thanks to 1652 Colm MacCárthaigh and Jun-ichiro itojun Hagino). Use 1653 --enable-ipv6 to enable. 1654 - Support for multi-homing with TCP connections. 1655 - Support for SunOS 4.x has been dropped. 1656 1657CODE CHANGES: 1658 - NSD should now conform to the Single Unix Specification 1659 (http://www.unix.org/). 1660 - Const correctness for strings and some other data types. 1661 - Removed code for Berkeley DB, hash tables, and mmap(2). 1662 - Separate preprocessor flags from code flags (CPPFLAGS and 1663 CFLAGS). 1664 - Use uint8_t instead of u_char, uint{16,32}_t instead of 1665 u_int{16,32}_t. 1666 - Fixed warnings from mixing signed and unsigned types. 1667 - Use sigaction(2) instead of signal(2). 1668 - The query_process function has been split up for clarity. 1669 1670BUG FIXES: 1671 - CHAOS TXT queries failed on big-endian machines. 1672 - Portability fixes for Tru64 (thanks to Stephane Bortzmeyer), 1673 HP-UX, and MacOS X (thanks to Ronald van der Pol). 1674 - Removed compile time limit on maximum number of TCP child 1675 servers. 1676 - Support for debugging UDP and TCP queries. 1677 - Always ensure there is enough room for the EDNS record when 1678 answering a query with EDNS enabled. 1679 16801.1 1681============= 1682FEATURES: 1683 - ANSI C 1684 - autoconf/configure 1685 - new parser 1686 - support for various RR types in zonec 1687 - support for UNKN RR types 1688 1689BUG FIXES: 1690 - lots of zone parsing errors eliminated 1691 - empty node matching bug gives NXDOMAIN 1692 16931.0.3 1694============= 1695This release is a bug fix release and does not add any new features. 1696 1697BUG FIXES: 1698 - Ignore SIGPIPE errors (bug #43). 1699 - Keep track of TCP child servers and restart if necessary. 1700 (bug #55) 1701 - Handle database reload failures correctly. 1702 - Close UDP sockets in TCP child servers. 1703 - Handle escaped characters (besides \.) in labels. 1704 - Preserve the query's RD flag in the answer. 1705 17061.0.2 1707============= 1708FEATURES: 1709 - -DBIND8_STATS to enable bind8 like [NX]STATS 1710 - -t flag to make nsd chroot to a certain directory 1711 - -s flag to make nsd produce statistics every s seconds 1712 - /etc/nsd/nsdc.conf to overwrite default variables 1713 for nsdc.sh 1714 - less loggin and more radical tcp connection (mis)handling 1715 - prefork -n processes to handle tcp connections 1716 - multiple -a flags 1717 1718CHANGES: 1719 - named.stats file functionality is removed 1720 1721BUG FIXES: 1722 - couple of pedantic fixes in C code 1723 - last zone in database axfr bug fixed 1724 - nsdc update wont update bug fixed 1725 17261.0.1 1727============= 1728 1729FEATURES: 1730 - NSD drops permissions after binding the sockets 1731 - ``cache'' zones are no longer allowed 1732 - ID.Server & Version.Server compile time options 1733 - AXFR implemented (with tcpwrapper for access control) 1734 - nsdc update and nsdc notify functionality 1735 - using named-xfer with TSIG for inbound axfr 1736 1737 1738CHANGES: 1739 - the order of records in the database is from now 1740 on significant 1741 - since Berkeley DB doesnt define order for sequential 1742 access it is no longer supported 1743 1744BUG FIXES: 1745 - white space problem in zonec is fixed 1746 1747KNOWN BUGS: 1748 - please see appropriate man pages for the known bugs 1749 17501.0.0 RELEASE 1751============= 1752 1753KNOWN BUGS: 1754 1755- Although NSD allows one to configure a zone without SOA record and 1756 use it as so called ``cached'' non-authoritative data, it is decided 1757 that having this functionality is wrong, dangerous and will be removed 1758 from the further versions. 1759 1760- If while processing EDNS(0) OPT record NSD encounters bad EDNS(0) 1761 version it will answer with Format Error instead of EDNS(0) BADVERS 1762 1763PLATFORMS: 1764 1765 Tested and working on i386 FreeBSD-4.4, i386 Linux, dec alpha Linux, 1766 sparc SunOS 4.x 1767 1768 17691.0.0-BETA2 1770=========== 1771 1772FIXES: 1773 - wildcards bug fixed 1774 - AA bit for class ANY bug fixed 1775 - minor coredumps with really broken zones in zonec fixed 1776 - linux & SunOS port 1777 17781.0-ALPHA2 1779========== 1780FIXES: 1781 - IPv6 transport support added by Jun-ichiro itojun Hagino (Use -DINET6) 1782 - Makefile modified for easier compile time configuration 1783 - EDNS(0) bug fixed 1784 - Default database changed to all lowercase, red-black tree to make nsd 1785 DNSSEC ready 1786 - REQUIREMENTS are cleaned up and updated 1787 - Signal names changed in nsdc.sh.in 1788 - Default compile options dont include -DMIMIC_BIND8 1789