1################################################################################ 2# 3# Copyright (c) 2011-2021, EURid. All rights reserved. 4# The YADIFA TM software product is provided under the BSD 3-clause license: 5# 6# Redistribution and use in source and binary forms, with or without 7# modification, are permitted provided that the following conditions 8# are met: 9# 10# * Redistributions of source code must retain the above copyright 11# notice, this list of conditions and the following disclaimer. 12# * Redistributions in binary form must reproduce the above copyright 13# notice, this list of conditions and the following disclaimer in the 14# documentation and/or other materials provided with the distribution. 15# * Neither the name of EURid nor the names of its contributors may be 16# used to endorse or promote products derived from this software 17# without specific prior written permission. 18# 19# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 20# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE 22# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE 23# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR 25# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 26# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, 27# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE 28# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 29# 30################################################################################ 31 3220211025: 33 YADIFA 2.5.3-public 34 35 Fixes a critical issue that could cause yadifad to crash handling certain DNS packet with privileged access. 36 3720210929: 38 YADIFA 2.5.2-public 39 40 Fixes a critical issue that could cause yadifad to crash handling certain DNS packet with privileged access. 41 42 Fixes an issue where a corrupted configuration file could lead to a crash while starting-up. 43 4420210924: 45 YADIFA 2.5.1-public 46 47 Fixes a critical issue that could cause yadifad to crash handling certain DNS packet. 48 49 Fixes an issue where yadifad would sometimes reply with an AXFR instead of an IXFR if the journal is under maintenance. 50 51 Increased the pid column in the logger to 6 characters 52 53 Drastically increased the limit for TCP queries. 54 Note that using a high enough number compared to the available memory will cause yadifad to warn about limits and OOM kill risks. 55 In practice a few hundred TCP queries should be enough. 56 5720210602: 58 YADIFA 2.5.0-public 59 60 Adds a new, friendlier, TCP manager. When enabled, TCP connections aren't closed harshly after some time has elapased without any activity. 61 62 In a nutshell: 63 64 It is enabled using --enable-tcp-manager. 65 It works using a quota of allowed parallel connections per host. There is one value for the registeres hosts and one for unknown hosts. 66 All defined primaries are automatically added to the TCP manager as registered hosts. 67 The server's local addresses are automatically added to the registered hosts. 68 The default timeout is set to 3 seconds but doesn't imply a connection will be closed : only that it is a candidate for being closed. 69 70 EDDSA support has been enable. 71 72 Sending a TCP message now uses a single system call (message_send_tcp) 73 74 Fixes an issue in some FreeBSD setups where UDP messages couldn't be sent by YADIFA. 75 Fixes an issue in FreeBSD where TCP connections would sometimes be closed too quickly. 76 Fixes an issue where failed dynamic updates prerequisites would return SERVFAIL instead of the more accurate error code. 77 Fixes atomic usage for older C compilers. 78 Fixes an issue where some RRSIG records may not be updated in time if they happened to have their update bundled with NSEC3 records updates while the incremental change could not be immediately written in the journal. 79 Fixes the yadifa keygen module to understand "help" as a command and not as a domain. 80 8120210223: 82 YADIFA 2.4.2-public 83 84 Fixes an issue where records below delegation are not ignored (https://github.com/yadifa/yadifa/issues/12). 85 Fixes an issue in the _mm model where shutting down while still initializing may not stop properly. 86 Changes default user/group to 'yadifa' user in example configuration. 87 Fixes an issue with autoconf 2.70 obsolete functions. 88 Fixes an issue where an unknown key configured in a zone acl may lead to a crash. 89 Fixes an issue where an query without EDNS involving ACLs using optional keys would incorrectly be rejected. 90 Fixes an issue where a network thread with a failed context would incorrectly have its context deleted. 91 Adds a feature to yadifad to ensure that the dates in the key-roll section can be successfully applied for the next 10 years (--check-policies). 92 Added support for primary and secondary variant options. 93 Fixes builds for gcc 11. 94 9520201209: 96 YADIFA 2.4.1-public 97 98 Fixes an issue in dnscore where a DNS TCP query would not return the real DNS error code. 99 Fixes an issue that could happen when a network model isn't supported. 100 Fixes the propagation of sendmmsg/recvmmsg function availability detection. 101 Fixes an issue where yadifad would issue a warning when a key with algorithm > 7 is used with an NSEC zone. 102 Fixes an issue that will occur on a chrooted environment where a managed-path would be used incorrectly. 103 Fixes CNAME answers not following the aliases chain. 104 Fixes CNAME recursion not returning the same answer as named in NXDOMAIN cases (reported by https://github.com/SivaKesava1, see https://github.com/yadifa/yadifa/issues/11) 105 106 Adds patch for musl support (from https://github.com/kolbma, see https://github.com/yadifa/yadifa/issues/9#issuecomment-723047226) 107 Adds stack size fix for musl support (the default size is way too small) 108 109 Now imports a custom version of stdatomic.h for systems where it is missing, located in dnscore/thirdpary/stdatomic.h 110 Made for CentOS 7 and any other release where that file is missing. 111 The import is only active if strictly needed and will only be visible during the build. 112 At the moment, it is not being installed with the other headers. 113 The original source of the file was taken from https://gist.github.com/nhatminhle/5181506 114 115 YAKEYROLLD 2.4.1 116 117 Fixes the handling of incomplete TCP queries. 118 Fixes a possible race-condition when initialising the keyroll context error codes. 119 120 The keyroll now has another automatic recovery layer where it completely restarts the handling of a domain, generating a one-step update to put the zone in the expected state. 121 12220201012: 123 YADIFA 2.4.0-public 124 125 Fixes an issue that could happen with multiprocess logging. 126 Fixes an issue parsing a *. domain. 127 Improves support for LibreSSL. 128 Added contributions directories with community-provided patches. 129 Readied the source for the release. 130 131 Many changes have been made since version 2.3.x. 132 133 Please read the manual for more information. 134 135 YAKEYROLLD 2.4.0 136 137 Since version 2.4.0, yadifad optionally allows dynamic update of RRSIG records. 138 The external key managing tool using this feature is being released along with it. 139 140 Please read the manual for more information. 141 142 YADIFA CTRL 2.4.0 143 144 The updated version of the command line controller has been made more user-friendly. 145 146 Please read the manual for more information. 147 14820200722: 149 YADIFA 2.4.0-67 150 151 Default listen is now "0.0.0.0,::0" 152 Added "do-not-listen" feature to avoid conflicts with systemd-resolved, default is empty. 153 Added --enable-systemd-resolved-avoidance in the configure script to change the default of "do-not-listen" to "127.0.0.53 port 53" 154 Zone file reader now decodes \ddd tokens. 155 Text zone parsing is now more lenient in what it accepts: unescaped @ and $ in a domain will be read as '@' and '$', with a warning. 156 Improves the configuration update by keeping a timestamp of all files involved and checking they have been modified. 157 Logger configuration can now be reconfigured during runtime. 158 In the event of an incorrect reconfiguration of the network, yadifad will periodically try to reconfigure itself reading the configuration files. 159 160 Fixes a potential issue in NSEC3 replying. 161 Fixes TXT parsing issues. 162 Fixes a leak with the chroot remapping when reconfiguring. 163 Fixes a leak processing the command line. 164 Fixes a leak in the policies configuration. 165 16620200630: 167 YADIFA 2.4.0-64 168 169 Network setup errors will now stop yadifad if they occur during the first configuration. 170 If they occur during a reconfiguration the error will be logged every minute instead of every second. 171 172 Fixes DSA API usage with OpenSSL 1.1.0 173 Fixes an other side effect of FreeBSD's process-shared mutexes where a thread waiting on a condition wouldn't always be woken up. 174 Fixes IPv6 handling in FreeBSD. 175 Fixes an issue where the logging could lock when daemonizing. 176 Fixes the build-time-configuration paths when using cmake. 177 Fixes an issue where a sync clean command would not delete the journal if the zone wasn't dynamically updated since the start of yadifad. 178 Fixes an issue where the size of the buffer given for a message would be slightly bigger than needed. 179 Duplicate but identical definition of a TSIG key are nolonger considered an error. 180 Increased the log output handling control commands (mostly error conditions) 181 182 yadifa ctrl: 183 The fqdn isn't set by default anymore (it used to be '.' by default) 184 Adds the "freeze", "thaw", "unfreeze", "freezeall", "unfreezeall" and "thawall" friendly keywords to yadfia ctrl. 185 Adds the "notify" command. 186 The FQDN has no default value anymore. 187 Fixes the friendly parsing of the command line. 188 Fixes several minor issues with the console output of the command line. 189 19020200608: 191 YADIFA 2.4.0-52 192 This is version is going to production as primary and for public release. 193 194 Fixes limit case issues giving NSEC3 answers for some zone structures (mostly *, * + CNAME) 195 Fixes an issue where the packet reader may not allocate enough room for SOA records (found in yakeyrolld) 196 197 YKEYROLL-1.0.5-4 198 This is version is going to production as primary and for public release. 199 200 Fixes the handling of more limit cases (broken setup). 201 20220200515: 203 YADIFA 2.4.0-51 204 In an effort to find issues using different tools, the code has been partially ported to compile in Visual Studio 2019. (Doesn't run) 205 The code analyser from Visual Studio 2019 reported 290 potential issues, 5 of which were valid (understand: errors) and not reported by other analysers. 206 We have used a mmap.c MIT-licensed code from github to help in this task. We'll have to decide to keep it or to write ours when we will do a Windows release. 207 Adds a DNS pcap analyser tool to measure DNS traffic from a network pcap file. Used to find why so many packets were lost in the benchmark. 208 (resut: The benchmark tool was broken.) 209 Adds a --disable-filepool-cache build configure option. 210 Logs clarity has been improved. 211 Improved usability: <main> network-model option can now use words instead of just numbers, respectively: single, buffered, multi for 0, 1, 2. 212 213 Fixes an issue that could occur in the logger service with some settings. 214 Fixes an issue in the new network model. 215 Fixes a memory leak that could occur in the cirular_file layer of the journal. 216 Fixes a memory leak that could occur in the journal depending on the reason it was closed. 217 Fixes a memory leak that could occur at shutdown while destroying a file pool. 218 Fixes an issue where trying to print a corrupted fqdn (e.g.: random bytes) could have an undefined behaviour. 219 Fixes an issue using the drop-before-load feature where the memory of the previous zone would not be completely freed yet before the new version of the zone started to load. 220 Fixes a race condition that could occur while detaching stdout/stderr from console. 221 Fixes missing AA flag in primary notification. 222 Fixes a rare issue where a signal could block the logger. 223 Fixes TSIG-covered answers of an unsupported opcode. 224 225 YKEYROLL-1.0.5-3 226 Fixes the handling of several limit cases (all coming from a broken, corrupted state). 227 22820200320: 229 YADIFA 2.4.0-50 230 Efforts have been made to reduce the memory usage in the case where a lot of specific listening addresses are defined. 231 A new network-model taking advantage of the multiple-send/receive of some kernels has been added. (recvmmsg, sendmmsg) 232 233 Back-ported gcc-10 compatibility fix from the main development branch (trunk) 234 This issue was reported by several distributions already using the yet-to-be-released gcc-10 (We are using gcc-9) 235 236 Adds the tcp_manager for experimentation (an alternative way to keep track of opened TCP connections). 237 238 Fixes a potential memory leak that could sometimes happen freeing NSEC3 records without removing their attached RRSIG first. 239 Fixes FreeBSD 12.1/libressl build issue. 240 241 YKEYROLL-1.0.5-2 242 Now handles SIGHUP to reopen the log files. 243 Imrpoved the command line options help. 244 24520200212: 246 YADIFA 2.4.0-49 247 This version is going for production. 248 249 Fixes an issue with signature expiration value where the time was sometimes incorrectly taken from the oldest key. 250 The RRL tables are now growing faster in order to avoid wasting resources. 251 252 YKEYROLL-1.0.4-2 253 This version is going for production. 254 255 Now keeps the expected starting point and end point for all steps. 256 This is used to verify the state before and after each update. 257 Now has a "print" mode that logs the "plan" out (logs all the known steps). 258 25920200128: 260 YADIFA 2.4.0-48 261 New nameserver infrastructure update. 262 263 In <main>, adds a log_files_disabled flag to disable checking the log-path directory for existence and writing rights. 264 Without this, yadifad would refuse to work without a proper log output directory like we have on our SELinux setup. 265 266 Fixes an issue that would occur if SELinux would reject a write operation with EPERM to a socket we have succesfully opened for writing. 267 yadifad would not complain and end-up hammering both the socket creation and the logs 268 269 Fixes an issue that would occur if SELinux would reject a read operation with EPERM on a socket we have successfully opened for reading. 270 This happens, notably, the notify service, producing a lot of log lines. 271 Now such an issue will make yadifad pause for one second. 272 27320200106: 274 YADIFA 2.4.0-45 275 Fixes an issue where having no ZSK would trigger a useless maintenance pass. 276 Fixes an issue where notifies could stop being sent when their queue was full. (New dynamic queue used at minimal increased CPU cost for this part) 277 Fixes an issue where reopening or syncing would have their effect delayed. 278 Fixes an issue that could occur for DSA T parameter deduction from a public key. 279 280 Made the command line more friendly using the new features from dnscore. 281 282 YKEYROLL 1.0.3-0 283 Now filters-out publish and unpublish meta lines. 284 Fixes an issue where retrying to send a message to an unresponsive server could have the message content reset. 285 28620191120: 287 YKEYROLL-1.0.2-3 288 This version is going for production. 289 290 Adds switching to a uid/gid set in the configuration file (must be set to the same as yadifad). 291 Adds process mutual-exclusion for plan generation. 292 Improves shutdown speed. 293 Reduces logging. 294 29520191118: 296 YADIFA 2.4.0-43 297 Fixes an issue where enabling key activation leniency would incorrectly enable deactivation leniency. 298 Fixes an issue where redundant signatures would be kept longuer than needed. 299 The journal name for the root zone will now be root_zone.cjf (only one dot) intead of ..cjf, as that name was troublesome. 300 301 YKEYROLL-1.0.1-9 302 This version is going for production. 303 304 Can now work in a loop without detaching from console. 305 30620191106: 307 YADIFA 2.4.0-42 308 This version is going for production. 309 310 Issues found by CLion's code inspector fixed or marked as invalid. 311 Downgrades several "error" into "notice". 312 More generally, an effort has been made to reduce the log size. 313 Setting a policy field with an incorrect value will now log an error instead of stopping yadifad. 314 Slave zones don't run sanitization anymore, as the primary is "right". This avoids thight rules being counter-productive in production environments. 315 316 Fixes an issue that would occur if an update happens at tahe same time as the removal of a DNSKEY when a maintenance has started. 317 Fixes an issue where the authoritative bit coudl be flipped off in some operations. 318 Fixes an issue where removing and adding the same record in a single update would incorrectly drop its signature. 319 Fixes an issue where a secondary receiving an inccorrect IXFR stream (specifically: finishing on an incomplete page) would not reject the broken page. 320 Fixes an issue where a primary would cut an IXFR page in half if a shutdown was triggered while the page was being read from the journal. 321 Fixes an issue in the policy date computation that could lead to a time period without signature coverage. 322 32320191010: 324 YADIFA 2.4.0-41 325 Fixes typos. 326 327 YKEYROLL-1.0.0 328 Improved error codes returned by the keyroll policies. 329 Fixes an error that could occur parsing a corrupted step file. 330 33120190927: 332 YADIFA 2.4.0-40 333 Adds a tool to append an IXFR in text form (so, from a dig command) to a journal. 334 This is an unfriendly pure dev tool meant to create some tests scenarii. 335 The cjf-scan tool, used to print the content of a journal, can now print its content in a way similar to the dig command. 336 Simply use the "-clean" command line option before the journal file name. 337 338 Both the above tools mean that a journal can be dumped as text, edited then re-created as binary. 339 Although not initially created for this purpose, it can be a powerful fix tool. 340 341 Fixes the "11:04" issue. It was triggered by an optimisation not being handled on all exit paths of the maintenance function, potentially leading to a buffer overflow. 342 Fixes an issue in the journal: 343 If the first update written into a dynamically sized journal is bigger that the default size of the journal (64KB) then yadifad incorrectly tries to shift-out 344 content to make room, which it obviously cannot do. 345 34620190920: 347 YADIFA 2.4.0-39 348 In <main>, adds axfr-strict-authority option. Defaulted to enabled unless yadifad was built-configured using --enable-non-aa-axfr-support. 349 Improves TXT parsing (github/ JZerf). 350 Fixes an potential crash on SIGHUP if the zone loader calee gives an incorrect answer (github/kolbma). 351 Fixes an issue where a UDP query with invalid return address (port 0) would trigger an EINVAL leading yadifa to shutdown the thread. 352 Fixes an issue with IPv6 aliased replies. Depending on the OS/release the value could be wrong. The fix tries several options. 353 This has been tested on several Debian and RedHat variants and seems to work properly. 354 35520190919: 356 YADIFA 2.4.0-38 357 note: Serial bump due to issues during rpm packaging. 358 359 Reduces the number of warnings triggered by type bitmap fixes. Now only prints one and leaves the rest available as debug. 360 Contains code to track the "11:04" issue and verify the hypothesis of its cause. 361 36220190913: 363 YADIFA 2.4.0-26 364 Timestamp in dns-udp are now human-readable. 365 Writing a zone as text now computes and updates the approximate wire size for the zone (AXFR/IXFR trigger accuracy) 366 yadifad now replies to ENDS# bad format. 367 368 Fixes an issue in dns-udp where the message size would not be reset on the received side. 369 Fixes an issue in dns-udp where the rate-limiter would fire before a message would be checked for actual IO (aggregated queries). 370 Fixes an issue in dns-udp where a very slow call-back would slow down the processing part of the receiver enough to trigger a timeout of the query. 371 Fixes a warning that would be shown for keys being both NSEC and NSEC3. 372 Fixes an issue where the '#' character was incorrectly set as a zone comment. 373 Fixes an issue where a journal with an invalid character in a name would trigger an infinite error loop (until program shutdown). 374 Fixes an issue where a DNSKEY dynamic update coming with an RRSIG push could fail under certain conditions. 375 376 Fixes some typos. 377 378 YKEYROLL-beta 379 Improves error reporting. 380 Allows different configuration files. 381 Fixes corrupted plan handling. 382 Updates the configuration example. 383 Correction updates are now merged in a single step, then played. 384 Added error-retries-cases in daemon mode. 385 Added a --timeus-offset parameter (not publicly documented) to lie about the current time. 386 Added a --dryrun parameter. 387 Fixes an issue handling key duplicates. 388 38920190627: 390 YADIFA 2.4.0-25 391 Fixes an issue where a corrupted journal would prevent a secondary from working. 392 Fixes an issue replaying NSEC3 chain changes as a secondary that could occur when a discrepancy was found. 393 If a corrupted journal is found, yadifad now renames it adding ".bad" to its name. 394 39520190613: 396 YADIFA 2.4.0-24 397 Adds safeguards for the logger shutdown. 398 399 FreeBSD 12.0 issue diagnostic: 400 There was an elusive issue occurring only on FreeBSD 12.0 related to shared mutexes. 401 After posting an the issue anonymously with a proof-of-concept code, it turns out it was bug in FreeBSD: 402 403 An unlocked mutex is still being accessed by the thread library right after the effective unlock has occurred. 404 405 yadifad destroys a structure containing mutexes right after it is unlocked for the last time. 406 407 FreeBSD has issued a fix, but at the moment the fix appeared to have side effects. 408 This may have been us not rebuilding "world" properly (First time we do this), or it may be that the patch wasn't complete at the time. 409 The matter is closed as far as yadifad's source code is concerned so this is something to watch after the next FreeBSD update. 410 411 Added the "freebsd12-test" proof-of-concept code in the test section of the code. 412 413 Adds the IP_MTU_DISCOVER IP_PMTUDISC_OMIT patch: 414 415 patch received 20190323 from daisuke.higashi@gmail.com 416 417 /* 418 * Linux 3.15 has IP_PMTUDISC_OMIT which makes sockets 419 * ignore PMTU information and send packets with DF=0. 420 * Fragmentation is allowed if and only if the packet 421 * size exceeds the outgoing interface MTU or the packet 422 * encounters smaller MTU link in network. 423 * This mitigates DNS fragmentation attacks by preventing 424 * forged PMTU information. 425 * FreeBSD already has same semantics without setting 426 * the option. 427 */ 428 429 Added sereral fixes for NetBSD builds. 430 Ultimately, NetBSD declares but does not implement PSHARED. 431 This makes that platform unusable for the moment. 432 433 Logs have been improved (level & verbosity, some have been downgraded to debug). 434 435 Improves command-line help. 436 437 Internally, INVALID and UNPROCESSABLE messages are now seen as the same error. 438 439 In <main>, added log_unprocessable boolean to add a warning log for bad DNS messages. 440 441 If yadifad is not started as root but requires elevated privileges in order to bind an addess, it will stop. 442 443 Fixes build on older sytems (FreeBSD). 444 Fixes an incorrect warning message related to TSIG. 445 Fixes an issue with garbage collection at shutdown. 446 Fixes an issue that would occur if the signature max-interval was set high enough to end up in an integer overflow. 447 Fixes an issue where newly added keys would not always be taken into account in the computations. 448 Fixes an issue where the nttl cache could overflow. 449 Fixes an issue in the path provider of yadifad where an empty secondary zone file setting could lead to a NULL pointer reference. 450 Fixes an issue where the KSK public key would not be stored, losing the flags of the key as seen by libdnscore. 451 Fixes an issue in dns-udp that would occur when TCP fails with a DNS error. 452 Fixes an issue in dns-udp where the thread_pool destruction order could trigger some issues. 453 Fixes an issue where a TCP read time-out from a client (thus when the server is sending) could lead to an indefinitely held connection. 454 Fixes an issue that could happen in the RRL, leading to the current state pool being misused. 455 Fixes an issue where an error code sent from the socket server would nto be interpreted correctly. 456 Fixes an issue in the text parser that was being tripped in the yakeyrolld. 457 Fixes an issue where asking the help from the command line would return to the shell with a non-zero value. 458 459 460 YKEYROLL-alpha 461 Code commited in alpha state to avoid potential issues related to a certain event. 462 463 The new keyroll software is being written in C. 464 It is based on the YADIFA framework. 465 It's main features are: 466 _ cron-like timings, 467 _ KSK/ZSK separation, 468 _ RRSIG push usage, 469 _ one event per file and one file per event, 470 _ integrity milestones, 471 _ extension of the time-line on demand. 472 47320190326: 474 YADIFA 2.4.0-23 475 Added autogen.sh in the make dist. 476 Improved yadifad startup so that simply asking for its version would not go through service start. 477 Improved AXFR log messages: now showing the peer's IP address. 478 47920190322: 480 YADIFA 2.4.0-22 481 EDDSA is known but not handled. (EDDSA handling code is in the 2.5.x branch) 482 483 Sanitization now checks for DNSKEY matching RRSIG records. 484 485 Fixes an issue where yadifad would abort in a specific condition: 486 487 A zone that allows RRSIG pushed by dynamic updates 488 with a bunch of inactive ZSK keys available, one of them still in the zone 489 with said inactive ZSK key in the zone having signature expiring after its deactivation date AND in the future 490 with an active key in the zone that does not expire and is fully usable (key pair available) 491 with a single KSK key in the zone that has no private part available ... 492 493 ... was considered fubar and triggering an emergency stop (ending up in an abort()) 494 495 Fixes an issue handling BigNum from OpenSSL being sometimes smaller than expected. 496 Fixes a double-free issue (crashed yadifad the 20190311). 497 Fixes an issue that would occur on a secondary when the journal is too small to work optimally. 498 499 Added a "dsfromkey" in the test section, to be added in the command line later 500 50120190218: 502 YADIFA 2.4.0-21 503 Fixes an issue where killing yadifad while thread creation is in limbo would not work. 504 yadifad will now ignore all signals until notify service thread is up and running (thus outside of limbo) 505 Fixes an issue where policies would be tried on non-policed zones. 506 50720190213: 508 YADIFA 2.4.0-19 509 Improves CPU usage by inlining several small domain-related functions. 510 Sanitization now occurs only once, after the journal has been replayed. 511 Code marked as obsolete has been removed. 512 Fixes an issue where an internal update message woudln't be properly initialised. 513 Fixes an irrelevant warning when "publish" equals "active" or "inactive" equals "delete" in a DNSKEY key. 514 Fixes embedded delegation issues. 515 _ Sanitization complaining about wrong glue resource records in embedded delegations 516 _ Sanitization complaining about unexpected signatures in embedded delegations 517 _ Internal state is now correctly set. 518 Fixes a policy issue where a DNSSEC chain would not be added if the DNSKEY was not already generated and added. 519 Fixes an issue where removing an RRSIG covering a type could sometimes invalidate an RRSIG covering another in the same domain. 520 Fixes an issue where a query that would return an RDATA with a '.' domain and require additionals, would trigger a memory underflow with undefined results. 521 Fixes an issue that could occur when replaying NSEC3 updates from the journal. 522 Fixes dnssec-policy NSEC chain generation that could not be completed because of an interference by the internal integrity tests. 523 Fixes an issue with NSEC3 type bitmap handling that would occur on an empty broken zone without RRSIG records. 524 Fixes an issue where reading corrupted messages would not be handled properly. 525 Fixes an issue where the illegal addition of a DS resource record would not be handled properly. 526 52720190205: 528 YADIFA 2.4.0-18 529 Signature verification now has an abstract API (easier extension to future algorithms e.g.: EDDSA). 530 Added our own zone test program. This includes signatures verification. 531 It's in the test section and the feature should be moved inside the command line later. 532 Fixes an issue where deleting a DNSKEY in a dynamic update would not be handled properly. 533 Fixes an issue where removing an RRSIG in signature maintenance would not change the type bitmap in the associated NSEC3 record. 534 Fixes an issue where maintenance would remove an RRSIG for a replacement (exchange) that could not be created (e.g.: private key missing). 535 Fixes an issue managing a zone with an NSEC3PARAM record but no NSEC3 chain. 536 Fixes an issue where NSEC3 chain recomputation could be called before RRSIG changes would be known. 537 Fixes an issue where stopping yadifad while it started a signature thread (in a window of a few instructions) would trigger an assertion. 538 Fixes an issue where dnssec-policies could conflict with RRSIG pushed with a dynamic update. 539 Fixes an issue parsing records with a class ANY in update messages. 540 54120190109: 542 YADIFA 2.4.0-17 543 Added a test for the keyroll feature (test section). 544 Key creation time is now systematically set in newly created keys. 545 54620181122: 547 YADIFA 2.4.0-11 548 Fixes handling of several limit cases in chain updates (that should never happen in a sane system). 549 Fixes some minor memory leaks. 550 This is the first release that is meant to prevent DNSKEY with incorrect "smart" setup making yadifad trying to take them at every occasion (e.g.: dynamic update). 551 55220181122: 553 YADIFA-2.4.0-10 554 Made to caters for the needs of an internal project. 555 55620180802: 557 YADIFA 2.4.0-1 558 Fixes all fixable -Wextra warnings (that ar not in -Wall for some reason) 559 One of these warnings would have showed the suprise-issue with the ACL ... 560 These fixes needs to be thoroughly tested before being used on anything production. 561 56220180725: 563 YADIFA 2.4.0 alpha 564 565 Fixes an issue where a secondary having downloaded a invalid zone from an primary will proceed re-download it and failing until the zone is fixed on the primary. 566 Now it will wait until the axfr-retry + random(axfr-retry-jitter) elapsed. 567 568 It is now possible to change the network configuration at runtime. 569 570 It is now possible to have threads logged with a tag instead of an opaque hexadecimal ID. (--enable-log-thread-tag) 571 572 It is now possible to pipe execute loggers output. 573 574 e.g.: 575 <channel> 576 my-zipped-channel "|/usr/bin/gzip - >> /var/log/yadifa.log.gz" 577 </channel> 578 579 Obviously, outputs are run using the uid/gid set for the server. 580 As the command can be restarted for several reasons so using >> is the obvious choice. 581 582 The maximum number of queries that are queued on an overloaded server is now configurable. 583 Note this is currently only used by network-model 1 and the ram usage in bytes is about (workers * size * 64) 584 585 For a server that only needs to answer 10000 queries per second, it would be suitable to use: 586 587 e.g.: 588 network-model-worker-backlog-size 10000 589 590 Our artificial benchmark tests are showing that setting this value to 500000 is enough to handle about 2.5 millions queries per second 591 on a server with the appropriate hardware configured properly (network queues, ...). 592 593 The zone journal maximum size is now an hard limit instead of "best effort within a few bytes". 594 595 The --disable-messages ./configure option has now been removed as the send & recv are not suitable for proper aliased addresses handling. 596 597 The build system has been changed: 598 599 From now on, to do a debug build, add CFLAGS='-O0 -g3 -DEBUG=1' to the configure command. 600 601 e.g.: 602 603 ./configure --enable-shared --enable-log-thread-tag CC=clang CFLAGS='-O0 -g3 -DDEBUG=1' 604 605 A release build that keeps the symbols would be: 606 607 ./configure --enable-log-thread-tag CC=clang CFLAGS='-O3 -g -DDEBUG=0' 608 609 The dnszone library has been merged into dnscore and dnsdb. 610 611 Several of our unit tests have been added as well as the valgrind suppression file (yadifad.supp). 612 613 Several simplifications and abstractions have been made on the internal APIs. 614 615 Network model 1 is the only model available from this version. 616 617 dnssec-thread-count parameter is now obsolete 618 61920180213: 620 YADIFA 2.3.8 621 Fixes the OPT record Z flags not being cleared in server answers. 622 62320171207: 624 YADIFA 2.3.0 - 2.3.7 625 From now on, both primary and secondaries are updating the zone in the same manner (journal transactions) 626 Messages are now default (--enable-messages). Disable them using --disable-messages. 627 Adds more (dynamic) update validation. 628 Adds a build option to remove compile date and time from various help messages (--disable-build-timestamp) 629 A primary can now be configured to allow updating RRSIG records externally (e.g.: update add domain. RRSIG ...) 630 631 Fixes an issue where closing an (a)XFR stream could lead to a race over the file descriptors. 632 Fixes an issue where an AXFR query would return a version of the zone too old to be upgradable by following incremntal updates. 633 Fixes an issue where zones with big-enough NSEC3 coverage (several millions NSEC3 record) could potentially reach an internal limit of the database. 634 Fixes an issue where shutting down YADIFA while a zone is being downloaded (AXFR) may make it wait forever. 635 Fixes an issue where the secondary would complain about a missing private key. 636 Fixes an issue where a specifically truncated IXFR query may make YADIFA replying with an AXFR. 637 Fixes an issue where an IXFR query returning "not implemented" instead of an AXFR would be retried later as an IXFR. 638 Fixes an issue where hammering reopening the logs on an overloaded server would not work properly. 639 64020170912: 641 YADIFA 2.2.6 642 Fixes an issue where a maliciously crafted message may block the server. (CVE-2017-14339) 643 64420170420: 645 YADIFA 2.2.5 646 Fixes an issue on message-enabled servers where the return address would not be captured 647 Increased the maximum number of network interfaces to 256 648 64920170406: 650 YADIFA 2.2.4 651 Fixes an issue with relative include names that would not always be properly computed 652 Fixes an issue where concurrent configuration reloads could lead to a crash 653 65420170223: 655 YADIFA 2.3.1 (internal) 656 Added thread_pool_try_enqueue_call to give up if a queue is full or overworked (distance project) 657 Fixes an issue with the CW queuing mechanism when trying to fill a full queue. 658 65920161124: 660 YADIFA 2.3.0 (internal) 661 662 ECDSA can now be disabled at ./configure time. 663 The support of ECDSA is not available in the openssl package of older Linux distributions. 664 You can now add --disable-ecdsa at configure time to allow a build on these systems. 665 666 Processed signals are now logged upon processing (info level) to allow the admin to know when a signal has effectively gone through. 667 668 CPU affinity can now be tuned to stick a worker on a core. In <main>: 669 670 thread-affinity-multiplier can be used to use every (1) or every odd (2) logical CPU. 671 672 Parameter range from 0 to 4. (default is 0 = autodetect) 673 By default, if hypertheading is detected, the multiplier is set to 2, else to 1. 674 675 thread-affinity-base can be used to chose the first local CPU to consider. 676 677 Parameter range from 0 to 3. (default is 0) 678 679 In the end, network workers will have their affinity set to (base + multiplier * workerindex). 680 681 The main purpose is to avoid using the hyperthread logical CPU as it can be counterproductive in some setups for high (10Gbps) troughput. 682 683 Fixes: 684 - fixed an issue on servers using the network-model 1 model (<main> : network-model 1) 685 - fixed an issue where the removal in a certain order of hash/hash* related domains would end-up triggering an abort 686 - fixed an issue where querying a signed domain that was deleted would answer NOERROR instead of NXDOMAIN 687 - fixed an issue where a zone loaded with a journal would not be marked "dirty" and thus would not be fully dumped on disk upon kill -USR1 688 - fixed an issue with network aliases not configured on all setups of --enable-messages 689 - fixed an issue with the logger not releasing the log files before reconfiguration 690 - fixed an issue with the journal where heavy load would prevent notification to secondaries 691 69220161108: 693 YADIFA 2.2.2 694 OpenSSL 1.1.0 crypto API support 695 69620160719: 697 YADIFA 2.2.1 698 699 Multi-primary support: 700 Added axfr-retry-failure-delay-multiplier and axfr-retry-failure-delay-max <main> parameters to increase the time between two AXFR/IXFR retries on a primary. 701 702 Fixes: 703 - fixed an issue that would crash a YADIFA secondary when restarting with a journal present 704 - fixed an issue in AXFR/IXFR retry timing management 705 70620160715: 707 YADIFA 2.2.0 708 Multi-primary support: 709 710 In <zone>, the primaries field is now a list. 711 When the primary fails to answer, it is moved to the end of the list and (new) first one is used instead. 712 713 There is a true-multiprimary setting, defaulted to 'no'. In true multiprimary mode, changing the primary implies dropping local zone data and ignore serial values. 714 This is to be used for a setup with truly independent primaries. 715 716 By default, the primary change occurs at first failure. This can be changed to a higher value with multiprimary-retries (maximum: 255) 717 This mostly makes sense on true-multiprimary mode as you want to be sure before reloading a zone completely. 718 719 Smart signing: 720 721 Keys with smart signing information are now handled by YADIFA. 722 723 DNSSEC policies: 724 725 YADIFA generates an rolls your keys and makes a non-DNSSEC zone into an NSEC or NSEC3 one. 726 727 728 Support for ECDSA algorithm. 729 730 Better support for huge incremental changes of a zone: 731 YADIFA used to do the modification in one go, which could make it unresponsive for very big changes. 732 Now the changes are applied more slowly, allowing queries to be answered. 733 734 New network model: 735 A new network model can be enabled. This model's main purpose is to be more resistent to system stalls with minimal, if any, performance loss. 736 737 <main> network-model 1 738 739 NSEC3 management improved. 740 Several improvements have been made on the way NSEC3 is handlded. Chains partially covering the zone are now accepted. 741 742 Fixes: 743 - fixed an issue where the maximum pid value supported was 99999 744 - fixed an issue with RRSIG TTL values that were not always at the expected value. 745 - fixed an issue with the $TTL not being respected. 746 74720160126: 748 YADIFA 2.1.6 749 750 Fixes: 751 - fixed an issue where the referral would not be measured for UDP on a optimised build. 752 75320160108: 754 YADIFA 2.1.5 755 756 Dynamic updates do not use temporary files anymore which improves their general performance. 757 The statistics now shows the referrals. 758 759 Fixes: 760 - fixed an issue where getting a huge incremental transfer would prevent the server from answering queries while applying the changes. 761 - fixed an issue serving IXFR that would occur when a incremental change step was bigger than 64KB 762 - fixed an issue for Solaris with the memory alignment fix not active everywhere 763 - fixed an issue on the Solaris build settings 764 - fixed an issue where sometimes yadifad would not find a configuration file given as a parameter with a relative path 765 - fixed an issue where a wild-card would not be properly returned with an AXFR 766 - fixed an issue where dynamically updating a zone at a speed such that the zone file would need to be written multiple times on disk 767 before finishing the previous write could lead to a deadlock 768 76920151026: 770 YADIFA 2.1.4 771 772 The zone reader error reporting has been improved. 773 Stacktrace support added for Solaris. 774 775 Known issue: 776 - Adding and or removing NSEC3PARAM dynamically is not properly handled. 777 778 Fixes: 779 - fixed an issue where an NSEC3 answer proving a * query would lead to a crash 780 - fixed an issue where a private key may be not recognised as such 781 - fixed an issue where dynamic update prerequisite check would fail a valid match 782 - fixed an issue where zone signature maintenance would only start if all private keys were available. 783 78420150821: 785 YADIFA 2.1.3 786 787 Fixes: 788 - fixed an issue that could lead to a crash at startup 789 - fixed an issue where parsing a TYPE#### record would stop the parser prematurely 790 791 79220150814: 793 YADIFA 2.1.2 794 795 The ./configure script has a new option: --enable-full-ascii7 796 This changes the behaviour of DNS name validation to accept all the ASCII7 characters instead of only the DNS-space ones. 797 Enabling this option is not recommended. 798 799 Fixes: 800 - fixes an issue where the hmac-shaX identification string sent with a TSIG had the suffix ".sig-alg.reg.int". 801 80220150714: 803 YADIFA 2.1.1 804 805 The yadifa command line has a new option: --config|-c file : read the specific configuration file instead of ~/.yadifa.rc 806 807 Issues detected on the NSEC3 database have now been upgraded from debug to info/warning 808 809 Fixes: 810 - fixed an issue where, on some cases; the garbage collector for the zones was not triggering for a long time. 811 - fixed an issue in the Makefile (courtesy of DENIC) 812 - fixed an issue where a few bytes could be leaked in some rare cases when failing to unload a zone 813 - fixed an issue in RRL where some values of IPv6 prefix 814 - fixed an issue accepting some answers on IXFR transfers 815 81620150424: 817 YADIFA 2.1.0 818 819 New journal file format: 820 821 This new format addresses a few issues like having maximum journal file and 822 a relatively constant random access time even for very big sizes. 823 824 The internal messaging queue has been changed to address huge amount of zones. 825 826 New CHaos queries supported: 827 hostname 828 id.server 829 830 Known issues: 831 _ building successfully with LTO may require to append both AR=gcc-ar and RANLIB=gcc-ranlib to the ./configure command 832 833 83420150403: 835 YADIFA 2.0.6 836 837 This release is a public release. 838 This minor update's sole purpose is to fix YADIFA builds on OpenBSD. 839 840 Fixes: 841 - fixed a crash that could occur while sending a massive amount of notifications 842 - OpenBSD builds are fixed. 843 Tested on: OpenBSD 5.6 amd64, standard installation. 844 Configure: ./configure 845 846 Tested on: OpenBSD 5.6 amd64, with gcc 4.9 installed. 847 Configure: ./configure CC=egcc 848 84920150226: 850 YADIFA 2.0.5 851 852 This release is a public release. 853 854 Fixes: 855 - fixed an issue with huge IXFR transfers as a primary 856 - fixed an issue with notifications on secondary-secondary-primary setup 857 - fixed an issue with a potential infinite loop loading an AXFR from a primary 858 - fixed missing hmac-sha* from <key> configuration 859 - fixed an issue with TLSA records parsing 860 - fixed an issue with base 16 encoding 861 - fixed an issue parsing * domains 862 - fixed an issue with some RRL motivated answers 863 - increased the maximum number of network interfaces from 5 to 16 864 - fixed an error in the configuration examples where "statistics" was used instead of "stats" 865 - minor fixes and improvements 866 86720141216: 868 YADIFA 2.0.4 869 870 This release is a public release. 871 872 By popular demand, the default log file directory is now PREFIX/var/log/yadifa. It can be set using --with-logdir=/my/dir 873 874 Improved build mechanism. 875 It has been tested to work automatically on Linux, FreeBSD, OSX, SunOS. 876 RedHat family builds will use -O2 as maximum optimisations. 877 878 Note that some optional features are now enabled by default but can be disabled. 879 880 Fixes: 881 - fixed an issue with the AXFR transfer where the serial number would not be properly taken into account 882 - fixed an issue with the notify mechanism that could occur if the server was only listening to 127.0.0.1 883 - fixed an issue with bogus DNSKEY records that may potentially lead to a crash in openssl 884 - fixed a reported potential "tmpfile" vulnerability on DEBUG builds (generated with make debug) 885 - fixed an issue with IPv6 connections on some architectures 886 - typos fixes 887 - minor fixes and improvements 888 88920141104: 890 Architecture portability enhancements. 891 892 On Solaris, if no --enable-force32bits nor --enable-force64bits is set, then 64 bits will be forced (fixes an issue at link-time) 893 894 ELF 64-bit MSB executable SPARCV9 Version 1, UltraSPARC3 Extensions Required, dynamically linked, not stripped, no debugging information available 895 896 PATH=/opt/csw/bin:/usr/ccs/bin:$PATH ./configure --enable-force32bits 897 PATH=/opt/csw/bin:/usr/ccs/bin:$PATH make 898 89920141030: 900 Architecture portability enhancements. 901 902 FreeBSD 9 903 FreeBSD dnode3 9.0-RELEASE-p3 FreeBSD 9.0-RELEASE-p3 #0: Tue Jun 12 02:52:29 UTC 2012 root@amd64-builder.daemonology.net:/usr/obj/usr/src/sys/GENERIC amd64 904 gcc (GCC) 4.2.1 20070831 patched [FreeBSD] 905 ELF 64-bit LSB executable, x86-64, version 1 (FreeBSD), dynamically linked (uses shared libs), for FreeBSD 9.0 (900044), not stripped 906 907 Ubuntu 908 Linux dnode10 3.2.0-49-generic #75-Ubuntu SMP Tue Jun 18 17:39:32 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux 909 gcc (Ubuntu/Linaro 4.6.3-1ubuntu5) 4.6.3 910 ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.24, BuildID[sha1]=0xe3b8601b9b5e59f8c9ce519cacbe9b8ff544ff1d, not stripped 911 912 OSX 913 Darwin RD-Mac-Mini.local 13.3.0 Darwin Kernel Version 13.3.0: Tue Jun 3 21:27:35 PDT 2014; root:xnu-2422.110.17~1/RELEASE_X86_64 x86_64 914 Apple LLVM version 5.1 (clang-503.0.40) (based on LLVM 3.4svn) 915 Mach-O 64-bit executable x86_64 916 91720141029: 918 Architecture portability enhancements. 919 920 uname -a 921 gcc --version 922 file yadifad 923 924 YellowDog Linux 925 Linux 2.6.29-3.ydl61.4 #1 SMP Mon Sep 7 14:50:27 PDT 2009 ppc64 ppc64 ppc64 GNU/Linux 926 gcc (GCC) 4.1.2 20080704 (Red Hat 4.1.2-44) 927 ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (SYSV), for GNU/Linux 2.6.9, dynamically linked (uses shared libs), for GNU/Linux 2.6.9, not stripped 928 929 note: using --enable-force64bits failed because of ssl, no simple/quick way to install openssl-devel.ppc64 seemed available 930 931 Debian PPC64 932 Linux 3.2.0-3-powerpc64 #1 SMP Mon Jul 23 08:03:56 UTC 2012 ppc64 GNU/Linux 933 gcc (Debian 4.6.3-8) 4.6.3 934 ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.26, BuildID[sha1]=0xedc47c984a4af7eb9a7ecbc0f135e4d064ba08f0, with unknown capability 0x41000000 = 0x13676e75, with unknown capability 0x10000 = 0xb0401, not stripped 935 936 note: using --enable-force64bits failed because of ssl, no simple/quick way to install openssl-devel.ppc64 seemed available 937 93820141016: 939 YADIFA 2.0.2 940 941 TCP fallback support on truncation 942 943 94420140905: 945 YADIFA 2.0.0 946 947 This release is a public release 948 949 Fixes: 950 - fixed a log incorrectly reporting an error when the client didn't close the TCP connection fast enough 951 - fixed an issue with the statistics on TCP queries 952 953 Known issue: 954 - removing the last key of a signed zone is permitted by YADIFA but triggers some chicken-egg issue with signatures. 955 95620140829: 957 YADIFA 2.0.0-beta3-public 958 959 This release is a public release 960 961 - --disable-master feature at configure now builds a secondary-only server 962 963 Fixes: 964 - fixed an issue with TSIG signed queries 965 - fixed an issue with thread pool live resizing 966 - fixed an issue where reading an undeleted obsolete journal ending at the start of a newly transferred zone from the primary would incorrectly trigger an error 967 968 Known issue: 969 - removing the last key of a signed zone is permitted by YADIFA but triggers some chicken-egg issue with signatures. 970 971 97220140630: 973 YADIFA 2.0.0-beta2-public 974 975 This release is a public release 976 977 - basepath disabled 978 - pidpath removed, only pidfile remains 979 - log reopen notification is now timestamped 980 - secondary zones no longer complain about missing NSEC/NSEC3 private keys 981 - the error code ZRE_FILE_NOT_FOUND has been replaced by the more accurate code ZRE_NO_VALID_FILE_FOUND 982 - default logging settings no longer output debug 983 984 Fixes: 985 - fixed issue in flag computation (AD,CD) 986 - fixed an issue with journal truncation sometimes leading to a crash 987 - zone parsing now correctly accepts '#' as a comment marker 988 - zone parsing now rejects wrong fqdn as soon as it reads them, leading to a more accurate error message 989 - removing the last dnskey of a zone no longer crashes the server 990 991 Known issue: 992 - removing the last key of a signed zone is permitted by YADIFA but triggers some chicken-egg issue with signatures. 993 994 yadifa remote client commands prototype is now available with the following supported commands: 995 996 -shutdown 997 shuts down yadifa 998 e.g. ./yadifa -s "192.0.2.1 port 53" -t shutdown 999 1000 -cfgreload 1001 reloads the <key> and <zone> sections of the yadifad configuration 1002 1003 e.g. ./yadifa -s "192.0.2.1 port 53" -t cfgreload 1004 1005 -logreopen 1006 closes and reopen the log files 1007 1008 e.g. ./yadifa -s "192.0.2.1 port 53" -t logreopen 1009 1010 -freezeall 1011 prevents all zones from being updated dynamically with nsupdate 1012 1013 e.g. ./yadifa -s "192.0.2.1 port 53" -t freezeall 1014 1015 -freeze 1016 prevents a zone from being updated dynamically with nsupdate 1017 1018 e.g. ./yadifa -s "192.0.2.1 port 53" -t freeze -q somedomain.eu 1019 1020 -unfreezeall 1021 enables updates of all zones again 1022 1023 e.g. ./yadifa -s "192.0.2.1 port 53" -t unfreezeall 1024 1025 -unfreeze 1026 enables updates of a zone again 1027 1028 e.g. ./yadifa -s "192.0.2.1 port 53" -t unfreeze -q somedomain.eu 1029 1030 In order to work, the allow-control ACL must be defined either in <main> for the global commands and 1031 may also be defined in <zone> for the ones targeting a specific zone. 1032 1033 e.g. allow-control 127.0.0.1 1034 1035 Note that tsig is not supported in the client yet. 1036 103720140528: 1038 YADIFA 2.0.0-beta1-public 1039 1040 This release is a public release 1041 1042 - NSID implemented (enabled at ./configure time with --enable-nsid 1043 - generic parser for: 1044 - getops 1045 - zone file 1046 - resolv.conf 1047 - configuration 1048 - '@' can now be used in a zone file 1049 - new binary for controlling 'yadifad' (yadifa) 1050 - framework is rewritten for multi core systems 1051 - single core server has been removed 1052 1053 Fixes: 1054 - fixed several minor issues 1055 1056 Know issues: 1057 - removing all dnskeys from a zone file crashes the server 1058 - yadifa has some issues with nodelay, nocork 1059 106020130424: 1061 YADIFA 1.1.0 1062 _ added DSA signature 1063 _ added SHA-256 SHA-384 SHA-512 digest algorithms 1064 _ now supports additional DNSSEC algorithms: 1065 DSASHA1 1066 DSASHA1_NSEC3 1067 RSASHA256_NSEC3 1068 RSASHA512_NSEC3 1069 _ Respone Rate Limitation implemented (enabled at ./configure time with --enable-rrl) 1070 _ --enable-tiny-footprint now reduces the memory usage further by reducing the standard log queue from 2^20 to 2^12 entries 1071 _ the general speed has been slightly improved 1072 _ dynamic updates pending for more than 3 seconds are now dropped with an error 1073 _ dynamic provisioning 1074 Fixes: 1075 _ fixed a memory leak that could occur at NSEC3 generation when loading the zone failed in a particular way 1076 _ fixed a memory leak at ixfr send 1077 _ fixed handling of '_' character that was improperly stored in the database 1078 _ fixed bandwidth limit settings (tcp stream in and out) not always being taken from the configuration 1079 _ fixed TSIG answer verification for notifies 1080 _ fixed error codes not being registered and thus logged as unknown hexadecimal error code. 1081 _ other minor fixes 1082 108320130612: 1084 YADIFA 1.0.3 1085 Fixes only (backports from 1.1.0) 1086 1087 Fixes: 1088 _ fixed an issue preventing YADIFA from being build from another directory 1089 _ fixed an issue with OSX systems where gsed has to be used instead of sed 1090 _ fixed an issue with the '_' character not being properly handled 1091 _ fixed an issue where reading MX record from a zone file would incorrecly be rejected as invalid 1092 _ fixed an issue where the OPT record would not be properly written 1093 _ fixed an issue where an undefined ACL reference would be silently ignored 1094 _ fixed missing code tags for several error codes. From now on unregistered codes are dumped in hexadicimal. 1095 _ fixed portability issues with BSD and OSX 1096 _ fixed several minor issues 1097 1098 109920120921: 1100 YADIFA 1.0.2 1101 Fixes only 1102 1103 Fixes: 1104 _ fixed an issue where the journal file was sometimes not properly closed at the end of a task 1105 _ fixed an issue where the TCP usage slots would sometimes wrongly return that they were all being used 1106 _ fixed an issue on IXFR processing (secondary side) where the type of answer from the primary would not be properly detected 1107 _ fixed an issue with TSIG on secrets not exactly 16 bytes long (binary form) 1108 _ fixed an issue on 32 bits architectures where the sig-validity-* fields would not be properly handled if not set 1109 on each zone section. 1110 _ slightly improved the replay time of big journal files 1111 _ fixed several minor issues 1112 1113 Known issues: 1114 _ if the serial of a zone is changed in a way that it goes beyond a value such as 1115 the journal serial start is bigger than the journal serial end, issues are expected 1116 for IXFR answers. 1117 _ notify is ignored on TCP 1118 111920120709: 1120 YADIFA 1.0.1 1121 _ logging repeat compression is now by channel instead of global 1122 1123 Fixes: 1124 _ fixed an issue where glibc whould assert if libgcc_s.so (libgcc_s.so.1) and libc.so (libc.so.6) where not 1125 available inside the chrooted directory of YADIFA 1126 _ fixed an issue in the syslog module 1127 1128 Known issues: 1129 _ on 32 bits architectures, the sig-validity-* fields are not properly copied from <main> to <zone> 1130 as a workaround, set the sig-validity fields in each <zone> container in 32 bits architectures 1131 1132 ie: 1133 sig-validity-interval 7 1134 sig-validity-regeneration 168 1135 sig-validity-jitter 3600 1136 _ if the serial of a zone is changed in a way that it goes beyond a value such as 1137 the journal serial start is bigger than the journal serial end, issues are expected 1138 for IXFR answers. 1139 _ notify is ignored on TCP 1140 114120120625: 1142 YADIFA 1.0.0 1143 _ LTO support can be enabled with --enable-lto but this is not working with clang. LTO does not increase 1144 the performance significally 1145 _ parallel processing of listening addresses can now be enabled. 1146 It can be set using thread-count-by-address in the <main> section. 1147 By default YADIFA will not use parallel processing as this feature has not been 1148 as thoroughly tested as the single-thread processing model 1149 _ default parameters tuning 1150 _ fixes 1151 1152 Known issue: 1153 _ on 32 bits architectures, the sig-validity-* fields are not properly copied from <main> to <zone> 1154 as a workaround, set the sig-validity fields in each <zone> container in 32 bits architectures 1155 1156 ie: 1157 sig-validity-interval 7 1158 sig-validity-regeneration 168 1159 sig-validity-jitter 3600 1160 116120120530: 1162 YADIFA 1.0.0RC3 1163 _ the configuration parser now ignores undefined logger names and 1164 report them with a warning 1165 _ syslog messages are now put in the name of "yadifad" instead of the name used for the "syslog" channel 1166 _ syslog messages do not print the time from YADIFA anymore 1167 _ improved the steps involved in loading a locally cached secondary zone 1168 _ zones are now loaded in background 1169 _ man page yadifad-conf.man5 renamed into yadifad.conf.man5 1170 1171 Fixes: 1172 _ AXFR/IXFR answers with the RA bit set are nolonger rejected as invalid 1173 _ YADIFA now answers to SIGINT again (shutdown) 1174 _ fixed an issue where obsolete AXFR files were not always being deleted 1175 _ fixed an issue occurring when both IPv4 and IPv6 were available to handle a notify 1176 _ fixed journal replay issue where some RRSIGs records were not properly removed 1177 _ fixed an issue occurring with IPv6 queries 1178 _ fixed an issue in the generation of a specific NSEC3 error answer 1179 _ fixed named query style layout 1180 1181 Known issue: 1182 _ if the serial of a zone is changed in a way that it goes beyond a value such as 1183 the journal serial start is bigger than the journal serial end, issues are expected 1184 for IXFR answers. 1185 _ notify is ignored on TCP 1186 118720120328: 1188 YADIFA 1.0.0RC2 1189 _ fixed logging issue on work file creation error 1190 _ fixed an issue where IXFR queries could be rejected as being wrongly formatted 1191 _ fixed an issue in the query logging text 1192 _ enabled command line options ( -u uid -g gid -d ) 1193 119420120319: 1195 YADIFA 1.0.0RC1 1196 1197 Is a full functional authoritative name server: 1198 1199 - works as primary or secondary name server 1200 - AXFR 1201 - IXFR 1202 - NOTIFY 1203 - NSUPDATE 1204 - TSIG 1205 - CLASSES: 1206 - IN 1207 - CH (just for version) 1208 - TYPES: 1209 - AAAA 1210 - CNAME 1211 - DNSKEY 1212 - DS 1213 - HINFO 1214 - MX 1215 - NAPTR 1216 - NS 1217 - NSEC3 1218 - NSEC3PARAM 1219 - NSEC 1220 - PTR 1221 - RRSIG 1222 - SOA 1223 - SRV 1224 - SSHFP 1225 - TXT 1226 - Automatic resigning 1227 - DNSSEC algorithms: 1228 - 5 (RSASHA1) 1229 - 7 (RSASHA1-NSEC3 1230 - ACL's 1231 1232 1233 KNOWN ISSUES: 1234 1235 NSEC3: _ cannot work with multiple NSEC3PARAM chains with mixed OPT-IN/OUT settings 1236 1237 _ adding a new NSEC3 chain expects that the primary sends the NSEC3PARAM first (it does not seems to be always the case) 1238 We have a case where a primary starts with 2 thousands NSEC3 opt-out records then adds 6 millions NSEC3 opt-in records but does not give the NSEC3PARAM record 1239 first. The secondary server rejects them all because it's unable to link them to a chain. (This one has high priority) 1240 1241 DNSSEC: _ it is not allowed to change the zone security mode (unsecure, NSEC, or NSEC3). Once the zone is loaded it keeps its security mode. 1242 1243 _ dynamic updates of NSEC as well as NSEC3 records are refused 1244 1245 QUIT: the server will shutdown on the following conditions: 1246 1247 _ detection of an impossible situation or an internal integrity issue (ie: for any reason the SOA has vanished from a zone) 1248 1249 _ memory limit reached which prevents any more work 1250 1251 _ ipc issue which prevent internal services communication 1252 1253 ACL: _ since the access control is set by zone and CHAOS class is not implemented as a configurable zone, it is not possible (yet) to specifically block CHAOS queries. 1254 125520111121: 1256 YADIFA 0.5.5 1257 - many fixes 1258 1259 KNOWN ISSUE: NSEC3 secondary zone replay fails. 1260 126120110706: 1262 YADIFA 0.5.0 1263 - secondary mode, AXFR/IXFR (no TSIG yet for the secondary-side transfer) 1264 - answers to a notify from the primary 1265 - polls the (first) primary on the primaries list 1266 - maintains the .axfr & .ix files (deletes the obsoletes ones) 1267 - TSIG queries are checked 1268 - Replays the zone journal on startup after the zone load (journaling) 1269 - Answers IXFR queries (journaling) 1270 127120110601: 1272 YADIFA 0.4.0 1273 Operational: 1274 - It works as a no dnssec name server 1275 - No notifies to secondary name servers 1276 - daemon 1277 - Answers AXFR queries with TSIG 1278 - nsupdate functionality (journaling) 1279 - TSIG on client server side will be transmitted, but not checked 1280 - ACL works 1281 - The zone has SOA, NS A resource records. 1282 128320110524: 1284 YADIFA 0.3.0 1285 First release internally of yadifad 20110524115500 GMT+1. 1286 1287 Operational: 1288 - It works as a no dnssec name server 1289 - No notifies to secondary name servers 1290 - daemon 1291 - Answers AXFR queries 1292 - The zone has SOA, NS A resource records. 1293 1294 129520091224: 1296 YADIFA 0.2.0 1297 _ Answers AXFR queries 1298 _ ACL based on IP and TSIG (not all query types are ACL'ed yet) 1299 130020091104: 1301 YADIFA 0.1.0 1302 1303 YADIFA is a work in progress. The main goal is to have an alternative for BIND or NSD. 1304 1305 Version 0.1.0 is an authoritative server only. 1306 1307 It has no: 1308 - AXFR/IXFR functionality 1309 - dynupdate 1310 - support for NSEC 1311 - support for NSEC3 1312 - caching mechanism 1313 - additional tools (eg.dig, dnssectools, drill,...) 1314 1315 It has: 1316 - a very fast way to give authoritative answer 1317 - a very fast method for loading the database and checking the zone files 1318 1319 This first release is to have a feeling how it works in an operational environment. 1320 1321 TODO 1322 1323 Everything what is not implemented, has to be implemented. Most of the code is there, but is not activated. 1324 1325 No comformity tests has been done. (This of course is on the todo list) 1326 1327 1328 1329Bug Reports and Mailing Lists 1330 1331 Bugs reports should be sent to 1332 1333 bugreport@yadifa.eu 1334 1335