summaryrefslogtreecommitdiff
path: root/net/nsd
AgeCommit message (Collapse)AuthorFilesLines
2012-11-04NSD 3.2.14pettai2-6/+6
Features: * TCP writev support. Bugfixes: * Fix build on OpenBSD (thanks Oliver Peter). * Prioritize notify sender for requesting XFR (thanks Ilya dBakulin). * Fix crash in zonec if TXT string too long (thanks Ilya Bakulin). * tzset before chroot for correct timezone (thanks Camiel Dobbelaar). * Fix --disable-full-prehash bug when nsdc patch happens while ixfr too, it did not rehash the new database. * Bugfix #464: Conditionally define MAXHOSTNAMELEN.
2012-10-23Drop superfluous PKG_DESTDIR_SUPPORT, "user-destdir" is default these days.asau1-3/+1
2012-09-16NSD 3.2.12pettai2-6/+6
Bugfixes: * Bugfix #461 (VU#517036 CVE-2012-2979): NSD denial of service vulnerability from DNS packet when using --enable-zone-stats. * Bugfix #460: man page correction - identity. * Fix for nsd-patch segfault if zone has been removed from nsd.conf
2012-07-20Update to 3.2.12, prompted by Lloyd Parkes in PR 46727.wiz2-6/+6
NSD 3.2.12 Bugfixes Fix for VU#624931 CVE-2012-2978: NSD denial of service vulnerability from non-standard DNS packet from any host on the internet. NSD 3.2.11 Features Fallback to AXFR if IXFR is unknown at the primary. NSD considers IXFR unknown at the primary if there is a negative response for the IXFR RRtype. This does not override the value for 'allow-axfr-fallback'. Allow for reading in new DNSKEY algorithm mnemonics (RFC5155, RFC5702, RFC5933, and RFC6605 (ECDSA)). Zone statistics, enable with --enable-zone-stats. This stores the BIND8 stats per zone in a configurable statistics file. This option does not scale and should therefore not be enabled when serving many zones. Support for TLSA RRtype (DANE). Bugfixes Fix for qtype ANY for a wildcard domain in NSEC signed zone: Don't add the wildcard domain NSEC into the answer section. Instead, put the wildcard expanded NSEC into the answer section and keep the wildcard domain NSEC in the authority section. Fix for accept spinning reported by OpenBSD. Fix restart failed due to bad ixfr packet because of zone removed from nsd.conf. Bugfix #453: typo in nsdc man page. Operational notes NSD uses the query name for dname compression again (Fix #235 had as side effect that this didn't happen anymore and is hereby undone).
2012-06-12Add inet6 to default suggested options. It's 2012.wiz1-1/+2
2012-04-18NSD 3.2.10pettai3-9/+11
Bugfixes: * Bugfix #421: Truncate pidfile on shutdown, before unlink. * Bugfix #423: Fix slow zone transfer processing due to 'Fix is_existing flag for ENT' bugfix. * Bugfix #430: Fix segfault when MAX_INTERFACES set to more than 65K. * Fix configure.ac strptime check for gcc 4.6.2, acx_nlnetlabs.m4 update NSD 3.2.9 Features: * Minimize responses to reduce truncation: NSD will only add optional records to the authority and additional sections when the response size does not exceed the minimal response size. * The minimal response size is 512 (no-EDNS), 1480 (EDNS/IPv4), 1220 (EDNS/IPv6), or the advertized EDNS buffer size if that is smaller than the EDNS default. * The feature is enabled by default. You can disable it by configuring NSD with --disable-minimal-responses. * Less NSEC3 prehashing. This will make NSD handle zone transfers faster, but will decrease the performance of NXDOMAIN and wildcard NODATA responses. Full prehashing is enabled by default. If you want less NSEC3 prehashing, configure NSD with --disable-full-prehash. Thanks Secure64 for the patch. Bugfixes: * Bugfix #302: nsd accepts XFR but refuses to re-read the slave zone. * Bugfix #365: set patch style and zonec verbose for nsdc. * First step of bug #369: RRSIG DNSKEY sets zone to be treated DNSSEC. * Bugfix #375: typos in nsd.conf.5. * Bugfix #381: Binary escaped and transfers. * Bugfix #397: Don't allow relative domain names as origin in $INCLUDE directives. * Fix printout of IPSECKEY by nsd-patch. * Fix is_existing flag for ENT when domain that has a shared ENT is deleted by IXFR. (ENT == Empty Non-Terminal) * Fix bug if the zonefile is changed for a secondary but stored transfers are applied, and stop it from applying ixfr to empty zone. The zone is flagged with error and AXFR-ed. * Fix to have no authority NS set processing for CNAMEs. * Fix nsd-checkconf to check tsig algorithms properly. * Set the AA bit on responses that have an authoritative CNAME. * Fix denial of existence response for empty non-terminal that looks like a NSEC3-only domain (but has data below it). Operational notes: nsd.db version number increased because NSD 3.2.7 and earlier zonec is not compatible due to the TXT strings change. Please run nsdc rebuild before running NSD 3.2.9 and later versions.
2011-09-12Fix build problem on NetBSD current (5.99.55).taca2-1/+17
2011-06-19NSD 3.2.8:pettai2-6/+6
Bugfixes: * Do setusercontext before chroot, otherwise login.conf etc. are required inside chroot. * Bugfix #216: Fix leak of compressiontable when the domain table increases in size. * Bugfix #348: Don't include header/library path if OpenSSL is in /usr. * Bugfix #350: Refused notifies should log client ip. * Bugfix #352: Fix hard coded paths in man pages. * Bugfix #354: The realclean target deletes a bit too much. * Bugfix #357, make xfrd quit with many zones. * Bugfix #362: outgoing-interface and v4 vs. v6 leads to spurious warning messages. * Bugfix #363: nsd-checkconf -v does not print outgoing-interface ok. * Bugfix: nsd-checkconf -o outgoing-interface omits NOKEY. * Undo Bugfix #235: Don't skip dname compression, messes up packets that do need compression. Operational notes: * Use 'make clean' to clean up files that make created. * Use 'make realclean' to also clean up files that were generated by running ./configure. * Use 'make devclean' to also clean up autoconf, autoheader files. NSD 3.2.7: Bugfixes: * Bugfix #253: Don't put NS RRs in a response with QTYPE=DS. * Bugfix #320: use arcrandom(4) for QID generation if available. * Bugfix #328: nsd-checkconf overrun. * Bugfix #343: nsdc update fix. * Bugfix #347: Wrong NSEC3 returned for nodata response QTYPE=DS no delegation. * Bugfix: Allow for huge amount of strings in TXT (and other) records. * Bugfix: nsdc can now deal with tsig algorithms other than hmac-md5. * Fixed several parts in the documentation, including #306, #345.
2010-08-30NSD 3.2.6:pettai2-6/+6
Features: * Expand command line option '-a' and config option 'ip-address:' with port number. Bugfixes: * Bugfix #314: correctly print NSEC next field, escape spaces and fix label overflows. Operational notes: * Configure options --disable-dnssec, --disable-nsid, --disable-tsig are removed * Configure option --max-interfaces is renamed to --max-ips
2010-05-06nsd 3.2.5:pettai2-6/+6
Features: * New option 'nsid:', to specify the NSID (Bugfix #298). * The default chroot can be set with --with-chroot=dir. If not set, by default chroot will not be used. * Optimized zonec and b64_pton compatibility code. * Optimized memory allocations. Use mmap/munmap instead of malloc/free. Experimental, by default off. Enable it at build time with --enable-mmap. Bugfixes: * NSD will not start if chroot is configured, but changing root is not possible * Make use of the more secure strl* functions. * Bugfix #303: spelling error. Operational notes: * NSID support is now enabled by default.
2010-02-04nsd 3.2.4:joerg2-7/+6
* Support DLV records. * New option 'tcp-query-count:', to limit the maximum number of DNS queries on a single tcp connection. * New option 'tcp-timeout:', to override the default tcp timeout. The option can also be set at build time, --with-tcp-timeout. * New option 'notify-retry:', to configure how many times NSD should retry a NOTIFY message. * New options 'ipv4-edns-size:' and 'ipv6-edns-size:', to set your preferred EDNS buffer size. * Ignore SIGHUP to child processes. * UDP/IPv4 sockets have new options set that will disable the DF flag in IP packets.
2010-01-17Recursive PKGREVISION bump for jpeg update to 8.wiz1-1/+2
2009-11-05nsd-3.2.3:joerg3-26/+6
* Bug #236: Allow RRs before the SOA in a zonefile. * Bug #229: Remove the C99 code. * Bug #253: Don't put NS RRs in a response with QTYPE=DNSKEY. * Bug #263: Make TSIG algorithm comparison case insensitive. * Bug #266: Build failed on systems without strptime. * Fix install hickup. * Fix to use 4096 EDNS limit for IPv6 on Linux.
2009-07-24Redirecting stdout and stderr with &> is not portable, fix this.joerg3-2/+22
Issue raised by Koh-ichi Ito on nsd-users.
2009-06-14Remove @dirrm entries from PLISTsjoerg1-2/+1
2009-05-20Update to NSD 3.2.2.joerg2-6/+6
Allows nsd-patch to directly work on the database without intermediate zonefile. Allow file rotation for nsd.log. Allow disabling AXFR fallback. Fix off-by-one during query processing.
2008-12-17Update to nsd-3.2.0:joerg2-6/+6
- improved IXFR support - support for hmac-sha1 and hmac-sha256 in TSIG - selection of source ip for notifies and zone requests - NSEC3 is enabled by default - option to disable CHAOS version support - bugfixes
2008-06-01Update to nsd-3.0.8:joerg2-7/+6
- better logging for nsd-notify and db creation failures - nsdc start checks if nsd is already running - fix loading data from files with relative names when chrootdir ends with a slash - fix a case when nsd would return FORMERR for edns queries with version 0 and rdlen larger than 0. - don't answer nsec3 wildcard information when DO bit is not set
2008-04-24Don't hard-code /usr/pkg. Bump revision.joerg2-4/+4
2008-01-18Per the process outlined in revbump(1), perform a recursive revbumptnn1-1/+2
on packages that are affected by the switch from the openssl 0.9.7 branch to the 0.9.8 branch. ok jlam@
2007-11-30Update to nsd-3.0.7:joerg2-6/+6
- fix man pages and improve consistency - improved handling for malformed IXFRs - report source and zone for denied AXFR requests - improved handling of malformed nsec3 records - fix ignored return value in region-allocator.
2007-09-07Convert packages that test and use USE_INET6 to use the options frameworkjlam1-4/+8
and to support the "inet6" option instead. Remaining usage of USE_INET6 was solely for the benefit of the scripts that generate the README.html files. Replace: BUILD_DEFS+= USE_INET6 with BUILD_DEFS+= IPV6_READY and teach the README-generation tools to look for that instead. This nukes USE_INET6 from pkgsrc proper. We leave a tiny bit of code to continue to support USE_INET6 for pkgsrc-wip until it has been nuked from there as well.
2007-08-11Update nsd to 3.0.5:joerg6-57/+47
NOTE: the configuration file format has changed. Don't update blindly. Major changes: - integrated AXFR/IXFR support for zone transfer. IXFR is not supported when acting as master. - TSIG authentication support for queries, notifies and zone transfers. - full NOTIFY support - DNAME type is supported - experimental support for NSEC3 and NSID, not enabled in pkgsrc - various bug fixes.
2006-07-03Update to nsd-2.3.5. This fixes a number of minor bugs.joerg3-16/+16
2006-05-02Check the right directory for OpenSSL.joerg1-1/+2
2006-04-23Modify packages that set PKG_USERS and PKG_GROUPS to follow the newjlam1-4/+4
syntax as specified in pkgsrc/mk/install/bsd.pkginstall.mk:1.47.
2006-04-06Over 1200 files touched but no revisions bumped :)reed1-2/+2
RECOMMENDED is removed. It becomes ABI_DEPENDS. BUILDLINK_RECOMMENDED.foo becomes BUILDLINK_ABI_DEPENDS.foo. BUILDLINK_DEPENDS.foo becomes BUILDLINK_API_DEPENDS.foo. BUILDLINK_DEPENDS does not change. IGNORE_RECOMMENDED (which defaulted to "no") becomes USE_ABI_DEPENDS which defaults to "yes". Added to obsolete.mk checking for IGNORE_RECOMMENDED. I did not manually go through and fix any aesthetic tab/spacing issues. I have tested the above patch on DragonFly building and packaging subversion and pkglint and their many dependencies. I have also tested USE_ABI_DEPENDS=no on my NetBSD workstation (where I have used IGNORE_RECOMMENDED for a long time). I have been an active user of IGNORE_RECOMMENDED since it was available. As suggested, I removed the documentation sentences suggesting bumping for "security" issues. As discussed on tech-pkg. I will commit to revbump, pkglint, pkg_install, createbuildlink separately. Note that if you use wip, it will fail! I will commit to pkgsrc-wip later (within day).
2005-12-29Remove USE_PKGINSTALL from pkgsrc now that mk/install/pkginstall.mkjlam1-2/+1
automatically detects whether we want the pkginstall machinery to be used by the package Makefile.
2005-12-12Update NSD to 2.3.3.joerg2-7/+6
Notable changes: - DNSSEC enabled by default - many bugfixes for edge cases - more portable time handling - some performance improvements
2005-12-05Fixed pkglint warnings. The warnings are mostly quoting issues, forrillig1-2/+2
example MAKE_ENV+=FOO=${BAR} is changed to MAKE_ENV+=FOO=${BAR:Q}. Some other changes are outlined in http://mail-index.netbsd.org/tech-pkg/2005/12/02/0034.html
2005-11-06Don't advertise RC script and forget it in the PLIST. Bump revision.joerg2-3/+4
2005-11-05Add a RC script for NSD. Set default database location tojoerg6-13/+54
${VARBASE}/db/nsd.db on all platforms and use user/group nsd for the daemon to run as. Install sample configuration without .sample extension. Take maintainership. Bump revision.
2005-04-28Apply parts of patch from PR 29983 by ISIHARA Takanori:wiz1-2/+3
* OpenSSL 0.9.7 or higher is required for TSIG support. (README) * --with-namedxfer configure option is obsolete option.
2005-04-19Sort.wiz1-11/+11
2005-04-11Remove USE_BUILDLINK3 and NO_BUILDLINK; these are no longer used.tv1-2/+1
2005-02-24Add RMD160 digests.agc1-1/+2
2005-01-19update to 2.2.0.itojun4-10/+31
- nsd-xfer is now in package - bug fixes - pidfile can be specified by -P
2004-12-29Use VARBASE.minskim1-2/+2
2004-10-03Libtool fix for PR pkg/26633, and other issues. Update libtool to 1.5.10tv1-1/+2
in the process. (More information on tech-pkg.) Bump PKGREVISION and BUILDLINK_DEPENDS of all packages using libtool and installing .la files. Bump PKGREVISION (only) of all packages depending directly on the above via a buildlink3 include.
2004-07-31nsd 2.1.2.itojun2-5/+5
FEATURES: - NSD now fully supports unknown record types using the notation specified in RFC3597. - Support for the following RR types has been added: WKS, X25, ISDN, RT, NSAP, PX, NAPTR, KX, CERT, DNAME, and APL. DNAME special processing is not supported. and bug fixes.
2004-04-25Convert to buildlink3 and correct a typo in DESCR.snj2-4/+4
2004-04-23upgrade to 2.0.2.itojun2-5/+5
2.0.2 ============= BUG FIXES: - Allow the use of a mnemonic for the algorithm field of a DNSKEY record. - Behavior of the zonec -v flag has been modified. By default zonec will only print a single line with a summary of the error count. - Bug #75: Fixed typo in previous "fix".
2004-03-16upgrade to 2.0.1.itojun2-6/+5
NSD 2.0.1 release notes: BUG FIXES: - Queries for QTYPE DS (DNSSEC) were not handled correctly in certain cases. - Partial support for unknown RRs. Known RR types with unknown RR data format is not yet supported. - Bug #75: Fixed bad error message when nsdc update is run for the first time. - Bug #78: Multiple zones, each with include directives, are now compiled correctly.
2004-02-22Correct path to files to install.kristerw1-2/+2
2004-02-16Bump PKGREVISION for previous (more files installed).wiz1-1/+2
2004-02-16install readme. link w/ libwrap. and other tweaks. PR 24034itojun2-2/+36
2004-02-15update to 2.0.0. IPv6 enabled by default, experimental DNSSEC supportitojun3-6/+11
(disabled by default).
2003-07-281.2.2itojun3-28/+5
============= BUG FIXES: - Bug #59: NSD returns FORMERR when the query name is >= 246 bytes. - Bug #60: Zonec runs out of file descriptors with many zones. - Bug #61: nsdc uses /bin/sh hardwired (and should not). - Bug #62: NSD is not able to log to a file. - Bug #63: nsdc update and zonec are too tallkative. - Bug #64: Answer for request of a host resolved by a wildcard-resource-record is not understandable by dig.
2003-07-21COMMENT should start with a capital letter.martti1-2/+2
2003-07-17s/netbsd.org/NetBSD.org/grant1-2/+2
generated by cgit v1.2.3 (git 2.39.1) at 2024-08-06 04:27:42 +0000