"Fossies" - the Fresh Open Source Software Archive

Member "nsd-4.3.6/doc/RELNOTES" (6 Apr 2021, 88986 Bytes) of package /linux/misc/dns/nsd-4.3.6.tar.gz:


As a special service "Fossies" has tried to format the requested text file into HTML format (style: standard) with prefixed line numbers. Alternatively you can here view or download the uninterpreted source code file. See also the latest Fossies "Diffs" side-by-side code changes report for "RELNOTES": 4.3.5_vs_4.3.6.

    1 NSD RELEASE NOTES
    2 
    3 4.3.6
    4 ================
    5 FEATURES:
    6 	- Fix #146 with #147: DNSTAP log the local address of the server
    7 	  with the dnstap logs.
    8 	- Enable configuring a control-interface by interface name.
    9 	- A -p option to nsd-checkzone to print a successfully read zone.
   10 	- Add Extended DNS Errors RFC8914
   11 	- Per zone Access Control List for queries
   12 	  with an allow-query: option.
   13 BUG FIXES:
   14 	- Prevent a few more yacc clashes.
   15 	- Merge PR #153 from fobser: Repair -fno-common linker errors
   16 	  automatically.
   17 	- Fix uninitialized access of log_buf in error printout on apply ixfr.
   18 	- Fix AF_LOCAL compile error for Solaris.
   19 	- Fix ifaddrs compile error for Solaris.
   20 	- Fix ifaddrs.h compile error for Solaris.
   21 	- Man page documentation for dnstap options.
   22 	- Fix segfault on high verbosity for TLS channels with dnstap log
   23 	  local address.
   24 	- Fix #163: A TSIG noncompliance with RFC 2845.
   25 	- Fix that wildcard is printed as a star instead of escaped, in
   26 	  logs and in written zone files.
   27 	- Fix double config.h include in configlexer.c
   28 	- Fix to remove configyyrename from makedist.sh and also
   29 	  update the flex and bison rules there to add the "c_" prefix.
   30 	- Fix configure to use header checks with compile.
   31 	- Fix warning about unused function log_addr.
   32 	- Fix #154: TXT with parentheses fails in 4.3.5.
   33 	- Align parsing of TXT elements with how bind does it.
   34 	- Fix configure failure for enable systemd because of autoconf.
   35 
   36 
   37 4.3.5
   38 ================
   39 BUG FIXES:
   40 	- Fix #143: xfrd no hysteresis with NOT IMPLEMENTED rcode.
   41 	- Fix #144: Typo fix in nsd.conf.5.in.
   42 	- For #145: Fix that service of remaining TCP and TLS connections
   43 	  does not allow new queries to be made, the connection is closed.
   44 	  Only existing queries and zone transfers are answered, new ones
   45 	  are rejected by a close of the channel.
   46 	- Fix that nsd-control has timeout when connection is down.
   47 	- remove windows socket ifdefs from nsd-control.
   48 	- Fix #148: CNAME need not be followed after a synthesized CNAME
   49 	  for a CNAME query.
   50 	- Fix configure.ac for autoconf 2.70.
   51 	- Fix #150: TXT record validation difference with BIND.
   52 	- Fix #151: DNAME not applied more than once to resolve the query.
   53 	- Fix #152: '*' in Rdata causes the return code to be NOERROR instead
   54 	  of NX.
   55 
   56 
   57 4.3.4
   58 ================
   59 FEATURES:
   60 	- Merge PR #141: ZONEMD RR type.
   61 BUG FIXES:
   62 	- Fix #129: ambiguous use of errno, in log message if sendmmsg fails.
   63 	- Fix #128: Fix that the invalid port number is logged for sendmmsg
   64 	  failed: Invalid argument.
   65 	- Fix #127: two minor `-Wcast-qual` cleanups
   66 	- Fix #126: minor header hygiene
   67 	- Fix #125: include config.h in compat/setproctitle.c and fix
   68 	  prototype of `setproctitle`
   69 	- Fix #133: fix 0-init of local ( stack ) buffer.
   70 	- Fix missing parenthesis on size of fix to init buffer.
   71 	- Fix #134: IPV4_MINIMAL_RESPONSE_SIZE vs EDNS_MAX_MESSAGE_LEN.
   72 	- Fix to add missing closest encloser NSEC3 for wildcard nodata type
   73 	  DS answer.
   74 	- Remove unused init_cfg_parse routine from configlexer.
   75 	- Fix #138: NSD returns non-EDNS answer when QUESTION is empty.
   76 	- Fix #142: NODATA answers missin SOA in authority section after
   77 	  CNAME chain.
   78 	- Fix for CVE-2020-28935 : Fix that symlink does not interfere
   79 	  with chown of pidfile.
   80 
   81 
   82 4.3.3
   83 ================
   84 FEATURES:
   85 	- Follow DNS flag day 2020 advice and
   86 	  set default EDNS message size to 1232.
   87 	- Merged PR #113 with fixes.  Instead of listing an IP-address to
   88 	  listen on, an interface name can be specified in nsd.conf, with
   89 	  ip-address: eth0.  The IP-addresses for that interface are then used.
   90 	- Port TSIG code for openssl 3.0.0-alpha6.
   91 BUG FIXES:
   92 	- Fix make install with --with-pidfile="".
   93 	- Merge #115 from millert: Fix strlcpy() usage. From OpenBSD.
   94 	- Merge #117: mini_event.h (4.3.2 and 4.3.1) on OpenBSD cannot find
   95 	  fd_set - patch.
   96 	- Fix that configure checks for EVP_sha256 to detect openssl, because
   97 	  HMAC_CTX_new is deprecated in 3.0.0.
   98 	- Fix #119: fix compile warnings from new gcc.
   99 	- Fix #119: warn when trying to parse a directory.
  100 	- Merge PR #121: Increase log level of recreated database from
  101 	  WARNING to ERR.
  102 	- Remove unused space from LIBS on link line.
  103 	- Updated date in nsd -v output.
  104 
  105 
  106 4.3.2
  107 ================
  108 FEATURES:
  109 	- Fix #96: log-only-syslog: yes sets to only use syslog, fixes
  110 	  that the default configuration and systemd results in duplicate
  111 	  log messages.
  112 	- Fix #107: nsd -v shows configure line, openssl version and libevent version.
  113 	- Fix #103 with #110: min-expire-time option.  To provide a lower
  114 	  bound for expire period.  Expressed in number of seconds or
  115 	  refresh+retry+1.
  116 BUG FIXES:
  117 	- Fix for posix shell syntax for trap in nsd-control-setup
  118 	- Fix to omit the listen-on lines from log at startup, unless verbose.
  119 	- Fix uninitialised values for bindtodevice option at startup with
  120 	  reuseport and multiple interfaces.
  121 	- Fix #95: Removed make test check because tpkg not included in
  122 	  release tarballs.
  123 	- Fix unused parameter compile warnings.
  124 	- Fix #97: EDNS unknown version: query not in response.
  125 	- Fix #99: Fix copying of socket properties with reuseport enabled.
  126 	- Document default value for tcp-timeout.
  127 	- Merge PR#102 from and0x000: add missing default in documentation
  128 	  for drop-updates.
  129 	- Fix unlink of pidfile warning if not possible due to permissions,
  130 	  nsd can display the message at high verbosity levels.
  131 	- Removed contrib/nsd.service, example is too complicated and not
  132 	  useful.
  133 	- Do not log EAGAIN errors for sendmmsg, to stop log spam on OpenBSD.
  134 	- Merge #108 from Nomis: Make the max-retry-time description clearer.
  135 	- Retry when udp send buffer is full to wait until buffer space is
  136 	  available.
  137 	- Remove errno reset behaviour from sendmmsg and recvmmsg
  138 	  replacement functions.
  139 	- Fix unit test for different nsd-control-setup -h exit code.
  140 	- Merge #112 from jaredmauch: log old and new serials when NSD
  141 	  rejects an IXFR due to an old serial number.
  142 	- Fix #106: Adhere better to xfrd bounds.  Refresh and retry times.
  143 	- Fix #105: Clearing hash_tree means just emptying the tree.
  144 
  145 
  146 4.3.1
  147 ================
  148 BUG FIXES:
  149 	- Fix #70: error: 'fd_set' undeclared.
  150 	- Fix #71: error: 'for' loop initial declaration used outside C99
  151 	  mode.
  152 	- Fix to move declarations out of for loops in event test too.
  153 	- Fix #76: cpuid typedef for Hurd, DragonflyBSD compile.
  154 	- Fix #75: configure test for sched_setaffinity, and use
  155 	  cpuset_setaffinity otherwise.  Also test for presence of sysconf.
  156 	- Fix #74: GNU Hurd fix cast from pointer to integer of different size.
  157 	- Fix for #74, #75: cpuset test for header contents and provide code.
  158 	- Fix #78: Fix SO_SETFIB error on FreeBSD.
  159 	- Merge PR #83 from noloader: Fix GNU HURD sched_setaffinity compile.
  160 	- Fix #80: NetBSD and implicit declaration of reallocarray.
  161 	- Fix unknown u_long in util.c for Issue #80 .
  162 	- Merge PR #86 from noloader: Use precious variables for GREP, EGREP,
  163 	  SED, AWK, LEX and YACC.
  164 	- For PR #86: Fix that programs loaded after CFLAGS and stuff is
  165 	  set, specifically the compiler, so that it can work if it needs
  166 	  special flags from that.  Fix that lex only needs to support -i
  167 	  if actually defined, otherwise the output included in the source
  168 	  tarball can be used.
  169 	- Merge PR #90 by phicoh: O_CLOEXEC should be FD_CLOEXEC.
  170 	- Merge PR #92 by tonysgi: Fix typo.
  171 	- Merge PR #91 by gearnode: nsd-control-setup recreate certificates.
  172 	  The '-r' option recreates certificates.  Without it it creates them
  173 	  if they do not exist, and does not modify them otherwise.
  174 
  175 
  176 4.3.0
  177 ================
  178 FEATURES:
  179 	- Fix to use getrandom() for randomness, if available.
  180 	- Fix #56: Drop sparse TSIG signing support in NSD.
  181 	  Sign every axfr packet with TSIG, according to the latest
  182 	  draft-ietf-dnsop-rfc2845bis-06, Section 5.3.1.
  183 	- Merge pull request #59 from buddyns: add FreeBSD support
  184 	  for conf key ip-transparent.
  185 	- Add feature to pin server processes to specific cpus.
  186 	- Add feature to pin IP addresses to selected server processes.
  187 	- Set process title to identify individual processes.
  188 	- Merge PR#22: minimise-any: prefer polular and not large RRset,
  189 	  from Daisuke Higashi.
  190 	- Add support for SO_BINDTODEVICE on Linux.
  191 	- Add support for SO_SETFIB on FreeBSD.
  192 	- Add feature to drop queries with opcode UPDATE.
  193 BUG FIXES:
  194 	- Fix fname null check of fname in namedb_read_zonefile.
  195 	- Fix implicit cast of size in udb_radnode_array_grow.
  196 	- Fix ignore of return value of ssl_printf in remote.c.
  197 	- Fix unused check of fd in parent_handle_reload_command.
  198 	- Attempt to fix signedness of nscount lookup in ixfr query_process.
  199 	- Fix identical branches for ssl_print of errors in remote.c.
  200 	- Fix type cast bounds, signedness of opt_rdlen in edns_parse_record.
  201 	- Fix to separate header and data lines in parse_zone_list_file.
  202 	- Fix to define max number of EDNS records we are willing to
  203 	  spend time on.
  204 	- Fix size of string len and capacity type cast in udbradtree.
  205 	- Fix to protect rrcount in tsig_find_rr from overflow.
  206 	- Annotate radix_find_prefix_node not reachable trail code.
  207 	- Fix to protect rrcount in packet_find_notify_serial from overflow.
  208 	- Fix to close socket on error in create_tcp_accept_sock.
  209 	- Fix to log on failure to chmod for socket for remote control.
  210 	- Fix to remove unneeded if in open of socket for remote control.
  211 	- Fix to restore input parameter on call failure in create_dirs.
  212 	- Please checker by terminating and initialising string read
  213 	  by remote control.
  214 	- Fix to define upper bounds on rr counts read from untrusted packet
  215 	  data.
  216 	- Separate acl_addr_match_range functions for ip4 and ip6, to
  217 	  please checkers.
  218 	- Avoid unused variable warning in new match_range_v4 function.
  219 	- Fix whitespace in nsd.conf.sample.in, patch from Paul Wouters.
  220 	- use-systemd is ignored in nsd.conf, when NSD is compiled with
  221 	  libsystemd it always signals readiness, if possible.
  222 	- Note that use-systemd is not necessary and ignored in man page.
  223 	- Fix unreachable code in ssl set options code.
  224 	- Fix bad shift in assertion code analyzer complaint.
  225 	- Fix responses for IXFR so that the authority section is not echoed
  226 	  in the response.
  227 	- Merge PR#60: Minor portability fixes from michaelforney, with
  228 	  avoid pointer arithmetic on void* and avoid unnecessary VLA.
  229 	- Fix that the retry wait does not exceed one day for zone transfers.
  230 CHANGES:
  231 	- Set FD_CLOEXEC on opened sockets.
  232 
  233 
  234 4.2.4
  235 ================
  236 FEATURES:
  237 	- Fix #48: Add make distclean that removes config.h made by configure.
  238 	  And add maintainer-clean that removes bison and flex output.
  239 BUG FIXES:
  240 	- Detect fixed time memcmp for openssl 0.9.8 compatibility.
  241 	- Detect EC_KEY_new_by_curve_name for openssl 0.9.8.
  242 	- include limits.h for UINT_MAX.
  243 	- If no recvmmsg, dont use msg_flags member, but errno for error,
  244 	  where our fallback function left it, msg_flags also does not exist
  245 	  on some systems.
  246 	- Remove unused variable warning for portability.
  247 	- Fix #52: do not log transient network full errors unless higher
  248 	  verbosity is set.
  249 	- Fix regressions in configparser.y where global variables were not
  250 	  set for minimal-responses, round-robin and log-time-ascii.
  251 
  252 
  253 4.2.3
  254 ================
  255 FEATURES:
  256 	- For #39: confine-to-zone configures NSD to not return out-of-zone
  257 	  additional information. Contributed by Greg Bock.
  258 	- For #21: pidfile "" allows to run NSD without a pidfile, for
  259 	  startup management tools like daemontools.
  260 	- For #21 add
  261 	  contrib/patch_for_s6_startup_and_other_service_supervisors.diff
  262 	  that adds support for readiness notification with READY_FD from
  263 	  Cameron Nemo.
  264 BUG FIXES:
  265 	- Fix #35: excessive logging of ixfr failures, it stops the log when
  266 	  fallback to axfr is possible. log is enabled at high verbosity.
  267 	- Fixup warnings during --disable-ipv6 compile.
  268 	- The nsd.conf includes are sorted ascending, for include statements
  269 	  with a '*' from glob.
  270 	- Fix #38: log address and failure reason with tls handshake errors,
  271 	  squelches (the same as unbound) some unless high verbosity is used.
  272 	- Fixup clang analysis warning in xfrd_parse_received_xfr_packet
  273 	  master dereference.
  274 CHANGES:
  275 	- Number of different UDP handlers has been reduced to one. recvmmsg
  276 	  and sendmmsg implementations are now used on all platforms.
  277 	  Compatible implementations are in place for systems that lack the
  278 	  system calls.
  279 	- Socket options are now set in designated functions for easy reuse.
  280 	- Socket setup has been simplified for easy reuse.
  281 	- Configuration parser is now aware of the context in which an option
  282 	  was specified.
  283 	- Fix #44: document that remote-control is a top-level nsd.conf
  284 	  attribute.
  285 
  286 
  287 4.2.2
  288 ================
  289 BUG FIXES:
  290 	- Fix #20: CVE-2019-13207 Stack-based Buffer Overflow in the
  291 	  dname_concatenate() function.  Reported by Frederic Cambus.
  292 	  It causes the zone parser to crash on a malformed zone file,
  293 	  with assertions enabled, an assertion catches it.
  294 	- Fix #19: Out-of-bounds read caused by improper validation of
  295 	  array index.  Reported by Frederic Cambus.  The zone parser
  296 	  fails on type SIG because of mismatched definition with RRSIG.
  297 	- PR #23: Fix typo in nsd.conf man-page.
  298 	- Fix that NSD warns for wrong length of the hash in SSHFP records.
  299 	- Fix #25: NSD doesn't refresh zones after extended downtime,
  300 	  it refreshes the old zones.
  301 	- Set no renegotiation on the SSL context to stop client
  302 	  session renegotiation.
  303 	- Fix #29: SSHFP check NULL pointer dereference.
  304 	- Fix #30: SSHFP check failure due to missing domain name.
  305 	- Fix to timeval_add in minievent for remaining second in microseconds.
  306 	- PR #31: nsd-control: Add missing stdio header.
  307 	- PR #32: tsig: Fix compilation without HAVE_SSL.
  308 	- Cleanup tls context on xfrd exit.
  309 	- Fix #33: Fix segfault in service of remaining streams on exit.
  310 	- Fix error message for out of zone data to have more information.
  311 
  312 
  313 4.2.1
  314 ================
  315 FEATURES:
  316 	- Added num.tls and num.tls6 stat counters.
  317 	- PR #12: send-buffer-size, receive-buffer-size,
  318 	  tcp-reject-overflow options for nsd.conf, from Jeroen Koekkoek.
  319 	- Fix #14, tcp connections have 1/10 to be active and have to work
  320 	  every second, and then they get time to complete during a reload,
  321 	  this is a process that lingers with the old version during a version
  322 	  update.
  323 BUG FIXES:
  324 	- Fix #13: Stray dot at the end of some log entries, removes dot
  325 	  after updated serial number in log entry.
  326 	- Fix TLS cipher selection, the previous was redundant, prefers
  327 	  CHACHA20-POLY1305 over AESGCM and was not as readable as it
  328 	  could be.
  329 	- Consolidate server tls context create and remote control context
  330 	  create, with hardening for the remote control tls context too.
  331 	- Fix to init event structure for reassignment.
  332 	- Fix to init event not pointer, in reassignment.
  333 	- Fix #15: crash in SSL library, initialize variables for TCP access
  334 	  when TLS is configured.
  335 	- Fix tls handshake event callback function mistake, reported
  336 	  by Mykhailo Danylenko.
  337 	- Initialize event structures before event_set, to stop uninitialized
  338 	  values from setting event library lists and assertions, that would
  339 	  sometimes also show after event_del.
  340 	- Do not use symbol from libc, instead use own replacement, if not
  341 	  available, for accept4.
  342 	- Fix output of nsd-checkconf -h.
  343 
  344 
  345 4.2.0
  346 ================
  347 FEATURES:
  348 	- Print IP address when bind socket fails with error.
  349 	- Fix #4249: The option hide-identity: yes stops NSD from responding
  350 	  with the hostname for chaos class queries.  Implements the RFC4892
  351 	  security considerations.
  352 	- Patch to add support for TCP Fast Open, from Sara
  353 	  Dickinson (Sinodun).
  354 	- Patch to add support for tls service on a specified tls port,
  355 	  from Sara Dickinson (Sinodun).
  356 	- Use travis for build check, initial unit test and clang analysis.
  357 	- TLS OCSP stapling support, enabled with tls-service-ocsp: filename,
  358 	  patch from Andreas Schulze.
  359 BUG FIXES:
  360 	- Fix to delete unused zparser.default_apex member.
  361 	- Fix that the TLS handshake routine sets the correct event to
  362 	  continue when done.
  363 	- Fix that TLS renegotiation calls the read and write routines again
  364 	  with the same parameters when the desired event has been satisfied.
  365 	- Fix that TCP Fastopen has better error message and supports OSX.
  366 	- Fix to avoid buffer alloc with global buffer in tls write handler.
  367 	- Fix to initialize event structure when accepting TCP connection.
  368 	- Disable TLS1.0, TLS1.1 and weak ciphers, enable
  369 	  CIPHER_SERVER_PREFERENCE, patch from Andreas Schulze.
  370 	- further setup ssl ctx after the keys are loaded, for ECDH.
  371 	- Fix #10: Fix memory leaks caused by duplicate rr and include
  372 	  instructions.
  373 	- Fix to define _OPENBSD_SOURCE to get reallocarray on NetBSD.
  374 
  375 
  376 4.1.27
  377 ================
  378 FEATURES:
  379 	- Deny ANY with only one RR in response, by default.  Patch from
  380 	  Daisuke Higashi.  The deny-any statement in nsd.conf sets ANY
  381 	  queries over UDP to be further moved to TCP as well.
  382 	  Also no additional section processing for type ANY, reducing
  383 	  the response size.
  384 	- Fix #4215: on-the-fly change of TSIG keys with patch from Igor, adds
  385 	  nsd-control print_tsig, update_tsig, add_tsig, assoc_tsig
  386 	  and del_tsig.  These changes are gone after reload, edit the
  387 	  config file (or a file included from it) to make changes that
  388 	  last after restart.
  389 BUG FIXES:
  390 	- Fix #4213: disable-ipv6 and dnstap compile error.
  391 	- Fix to reduce region_log_stats if condition, this removes a
  392 	  debug statement.
  393         - Fix for FreeBSD port with dnstap enabled.
  394 	- Fix to remove unused code.
  395 	- Fix #6: nsd-control-setup: Change validity time to a shorter
  396 	  period (<2038).
  397 	- Fix unused definition in header remote.h.
  398 	- Fix #4236: IPV4_MINIMAL_RESPONSE_SIZE=1480 is slightly too big.
  399 	- Fix #4235: IP_PMTUDISC_OMIT on IPv4/UDP sockets.
  400 	- Fixed radtree_insert memory leak.
  401 	- Fixed access recycled variable.
  402 
  403 
  404 4.1.26
  405 ================
  406 FEATURES:
  407 	- DNSTAP support for NSD, --enable-dnstap and then config in nsd.conf.
  408 	- Support SO_REUSEPORT_LB in FreeBSD 12 with the reuseport: yes
  409 	  option in nsd.conf.
  410 	- Added nsd-control changezone.  nsd-control changezone name pattern
  411 	  allows the change of a zone pattern option without downtime for
  412 	  the zone, in one operation.
  413 BUG FIXES:
  414 	- Fix #4194: Zone file parser derailed by non-FQDN names in RHS of
  415 	  DNSSEC RRs.
  416 	- Fix #4202: nsd-control delzone incorrect exit code on error.
  417 	- Tab style fix to use tab for 8 spaces, from Xiaobo Liu.
  418 	- Fix #4205: enable-recvmmsg in mixed IPv4/IPv6 environment fails.
  419 	  This sets the msg_hdr.msg_namelen correctly after receipt.
  420 	- Fix to not set GLOB_NOSORT so the nsd.conf include: files are
  421 	  sorted and in a predictable order.
  422 	- Fix #3433: document that reconfig does not change per-zone stats.
  423 
  424 
  425 4.1.25
  426 ================
  427 FEATURES:
  428 	- nsd-control prints neater errors for file failures.
  429 BUG FIXES:
  430 	- Fix that nsec3 precompile deletion happens before the RRs of
  431 	  the zone are deleted.
  432 	- Fix printout of accepted remote control connection for unix sockets.
  433 	- Fix use_systemd typo/leftover in remote.c.
  434 	- Fix codingstyle in nsd-checkconf.c in patch from Sharp Liu.
  435 	- append_trailing_slash has one implementation and is not repeated
  436 	  differently.
  437 	- Fix coding style in nsd.c
  438 	- Fix to combine the same error function into one, from Xiaobo Liu.
  439 	- Fix initialisation in remote.c.
  440 	- please clang analyzer and fix parse of IPSECKEY with bad gateway.
  441 	- Fix nsd-checkconf fail on bad zone name.
  442 	- Annotate exit functions with noreturn.
  443 	- Remove unused if clause during server service startup.
  444 	- Fix #4156: Fix systemd service manager state change notification
  445 	  When it is compiled, systemd readiness signalling is enabled.
  446 	  The option in nsd.conf is not used, it is ignored when read.
  447 
  448 
  449 4.1.24
  450 ================
  451 FEATURES:
  452 	- #4102: control interface via local socket.
  453 	  configure it with control-interface: "/path/nsd.ctl"  The path
  454 	  has to start with a / to separate it from an IP address.
  455 	  The local socket does not use SSL, but unencrypted traffic, use
  456 	  file and containing directory permissions to restrict access.
  457 	- configure --enable-systemd (needs pkg-config and libsystemd) can
  458 	  be used to then use-systemd: yes in nsd.conf and have readiness
  459 	  signalling with systemd.
  460 	- RFC8162 support, for record type SMIMEA.
  461 BUG FIXES:
  462 	- Patch to fix openwrt for mac os build darwin detection in configure.
  463 	- Fix that first control-interface determines if TLS is used.  Warn
  464 	  when IP address interfaces are used without TLS.
  465 	- #4106: Fix that stats printed from nsd-control are recast from
  466 	  unsigned long to unsigned (remote.c).
  467 	- Fix that type CAA (and URI) in the zone file can contain
  468 	  dots when not in quotes.
  469 	- #4133: Fix that when IXFR contains a zone with broken NSEC3PARAM
  470 	  chain, NSD leniently attempts to find a working NSEC3PARAM.
  471 
  472 
  473 4.1.23
  474 ================
  475 BUG FIXES:
  476 	- Fix NSD time sensitive TSIG compare vulnerability.
  477 
  478 
  479 4.1.22
  480 ================
  481 FEATURES:
  482 	- refuse-any sends truncation (+TC) in reply to ANY queries over UDP,
  483 	  and allows TCP queries like normal.
  484 	- Use accept4 to speed up answer of TCP queries, on Linux, FreeBSD
  485 	  and OpenBSD.
  486 BUG FIXES:
  487 	- Fix nsec3 hash of parent and child co-hosted nsec3 enabled zones.
  488 	- Fix to use same condition for nsec3 hash allocation and free.
  489 
  490 
  491 4.1.21
  492 ================
  493 FEATURES:
  494 	- --enable-memclean cleans up memory for use with memory checkers,
  495 	  eg. valgrind.
  496 	- refuse-any nsd.conf option that refuses queries of type ANY.
  497 	- lower memory usage for tcp connections, so tcp-count can be higher.
  498 BUG FIXES:
  499 	- Fix unused variable warnings and uninit variable in statistics
  500 	  printout from clang analyzer.
  501 	- Fix spelling error in xfr-inspect.
  502 	- Fix #3562: explain build error when flex missing.
  503 	- Fix buffer size warnings from compiler on filename lengths.
  504 	- Fix #4093: Release notes not using 2018.
  505 
  506 
  507 4.1.20
  508 ================
  509 BUG FIXES:
  510 	- Fix memory leak in zone file read of unknown rr formatted RRs.
  511 	- Fix memory leak when rehashing nsec3 after axfr or zonefile read,
  512 	  in the selectively allocated precompiled nsec3 hashes.
  513 
  514 
  515 4.1.19
  516 ================
  517 BUG FIXES:
  518 	- ignore fallthrough compiler warning in flex EOF rule.
  519 	- Fix warnings emitted by clang for --enable-packed.  Alignment is not
  520 	  a problem for x86_64, don't enable packed when the platform
  521 	  requires aligned access.
  522 	- Fix spelling error in xfr-inspect.
  523 	- Fix 3392: Fix regression in 4.1.18 for notify lists with ip4
  524 	  and ip6 targets.
  525 	- Add test for support of -Wno-address-of-packed-member for
  526 	  --enable-packed.
  527 
  528 
  529 4.1.18
  530 ================
  531 FEATURES:
  532 	- xfr-inspect, it is not installed, it prints xfr files from /tmp
  533 	  made with 'make xfr-inspect' in the source dir.
  534 	- retry timeout between sending notifies dropped from 15 to 3 sec.
  535 	- NSD sends 16 notifies simultaneously.
  536 	- configure --enable-packed reduces memory usage, at expense of
  537 	  unaligned reads.  Saves about 17%.
  538 	- Save memory by selectively allocate precompiled nsec3 hashes,
  539 	  saves about 16% memory.
  540 	- make ip-transparent option work on OpenBSD.
  541 	- Save about 2% memory by changing usage count size in name tree.
  542 	- Fix #2871: Increase number of sockets for xfrd transfers.
  543 BUG FIXES:
  544 	- Fix gcc 7.1.1 warnings.
  545 	- Fix writev compile warning on FreeBSD.
  546 	- Fix #1446: A corrupted zone file "propagates" to good ones.
  547 	- nsd-control zonestatus prints wait time between attempts, for zones
  548 	  that are in that waiting time.
  549 	- Fix collision printout of nsec3 to print name, hash and reverse.
  550 	- Fix #1567: Change crit to err log level for gettimeofday failure.
  551 	  Add defines for compile without syslog.
  552 	- Fix crash for DS query when parent and child zones both configured
  553 	  in nsd.conf and parent zone has not loaded properly.
  554 
  555 
  556 4.1.17
  557 ================
  558 FEATURES:
  559 	- zone parser parses type AVC (it has TXT format).
  560 	- Fix #1272: use writev to put tcp length field with data for outgoing
  561 	  zone transfer requests.
  562 BUG FIXES:
  563 	- Fix potential null pointer in nsec3 adjustment tree.
  564 	- Fix text format of deletes for CDS and CDNSKEY, single 0 to represent
  565 	  empty base64 or hex string.
  566 
  567 
  568 4.1.16
  569 ================
  570 FEATURES:
  571 	- zone parser can parse acronyms for algorithms ED25519 and ED448.
  572 	- Fix 1243: Option to make NSD emit really minimal responses,
  573 	  minimal-responses: yes in nsd.conf.
  574 BUG FIXES:
  575 	- Calculate new udb index after growing the array, fix from
  576 	  Chaofeng Liu.
  577 	- Fix missing _t to _type conversion for disable-radix-tree option.
  578 	- Printout serial error with hint it may be too big.
  579 	- Fix 1228: OpenSSL include is not guarded with HAVE_SSL
  580 	- Patch for expire state in multi-master when masters includes
  581 	  broken master, from Manabu Sonoda.
  582 	- minor manpage fix.
  583 
  584 
  585 4.1.15
  586 ================
  587 BUG FIXES:
  588 	- Fix nsd-control and ipv6 only.
  589 	- Squelch zone transfer error address family not supported by protocol
  590 	  at low verbosity levels.
  591 	- Fix #1195: Fix so that NSD fails on non-compliant values for Serial.
  592 	- Fix to rename _t typedefs because POSIX reserves them.
  593 	- Fix that nsec3 hash collisions only reported on verbosity level 3.
  594 
  595 
  596 4.1.14
  597 ================
  598 FEATURES:
  599 	- Fix #1132 for SERVFAIL zones perform backoff, and remembers the
  600 	  timeout on next startup.
  601 BUG FIXES:
  602 	- Fix null memcpy for radixtree with single link element.
  603 	- Robust fix against missing master in tcp_open for xfrd.
  604 	- Fix wildcards in include: config statements with chroot enabled.
  605 	- suppress compile warning in lex files.
  606 	- Fix to try every master once, then wait for timeout or notify.
  607 	- Save backoff timeout into xfrd.state file, this file has a higher
  608 	  version number now.  Old files are skipped silently (causes
  609 	  refresh) and created as new files upon exit.
  610 	- Fix restart of zone transfers when new config becomes available.
  611 
  612 
  613 4.1.13
  614 ================
  615 FEATURES:
  616 	- multi-master-check: yes can be used to check all masters for the
  617 	  last version, using the higher version from the configured masters,
  618 	  from Manabu Sonoda.
  619 	- Support RR type OPENPGPKEY from RFC 7929.
  620 	- Can config key algorithms with the digest name, eg. 'sha256'.
  621 	- configure --disable-radix-tree for about 15% lower memory usage.
  622 	- for type SRV add A/AAAA to the additional section (if possible),
  623 	  just like we already do for type MX.
  624 	- more extensible edns option handling.
  625 BUG FIXES:
  626 	- Fix compile warnings about unused result from write and strtol.
  627 	  and signcompare in minmax retrytime.
  628 	- Fix #812: fix that make depend fails after distribution.
  629 	- Fix #817: xfrd update failed loop.
  630 	- Add robustness against unallocated data in nsec3 trees.
  631 	- Fix README spelling error of BSD license (reported by Joerg Jung).
  632 	- Fix multimaster for not tried full zone transfer for a expired zone.
  633 	- Fix #827: fix compile with openssl 1.1.0 with api=1.1.0.
  634 
  635 
  636 4.1.12
  637 ================
  638 BUG FIXES:
  639 	- Fix malformed edns query assertion failure, reported by
  640 	  Michal Kepien (NASK).
  641 
  642 
  643 4.1.11
  644 ================
  645 FEATURES:
  646 	- When tcp is more than half full, use short timeout for tcp session.
  647 	- Patch for {max,min}-{refresh,retry}-time from YAMAGUCHI Takanori.
  648 	- Fix #790: size-limit-xfr can stop NSD from downloading infinite zone
  649 	  transfer data size, from Toshifumi Sakaguchi.  Fixes CVE-2016-6173
  650 	  JVN#63359718 JPCERT#91251865.
  651 BUG FIXES:
  652 	- Fix build without IPv6, patch from Zdenek Kaspar.
  653 	- Fix #783: Trying to run a root server without having configured it
  654 	  silently gives wrong answers.
  655 	- Fix #782: Serve DS record but parent zone has no NS record.
  656 	- Fix nsec3 missing for nsec3 signed parent and child for DS at zonecut.
  657 
  658 
  659 4.1.10
  660 ================
  661 FEATURES:
  662 	- ip-freebind: yesno option in nsd.conf sets IP_FREEBIND socket option
  663 	  for Linux, binds to interfaces and addresses that are down.
  664 	- NSD includes AAAA before A for queries over IPV6 (in delegations).
  665 	  And TC is set if no glue can be provided with a delegation because
  666 	  of packet size.
  667 	- print notice that nsd is starting before taking off.
  668 BUG FIXES:
  669 	- Fix for openssl 1.1.0, HMAC_CTX size not exported from openssl.
  670 	- Fix #751: NSD fails to occlude names below a DNAME.
  671 	- If set without nsd.db print "" as the default in the man pages.
  672 	- Fix #755: NSD spins after a zone update and a lot of TCP queries.
  673 	- Fix for NSEC3 with zone signed without exact match for empty
  674 	  nonterminals, the answer for that domain gets closest encloser.
  675 	- #772 Document that recvmmsg has IPv6 problems on some linux kernels.
  676 
  677 
  678 4.1.9
  679 ================
  680 BUG FIXES:
  681 	- Change the nsd.db file version because of nanosecond precision fix.
  682 
  683 
  684 4.1.8
  685 ================
  686 FEATURES:
  687 	- #732: tcp-mss, outgoing-tcp-mss options for nsd.conf, patch
  688 	  from Daisuke Higashi.
  689 	- #739: zonefile changes when mtime is small are detected on reload,
  690 	  if filesystem supports precision mtime values.
  691 	- RR type CSYNC (RFC7477) syntax is supported.
  692 BUG FIXES:
  693 	- take advantage of arc4random_uniform if available, patch from
  694 	  Loganaden Velvindron.
  695 	- Fix flto check for OSX clang.
  696 	- Define _DEFAULT_SOURCE with _BSD_SOURCE for glibc 2.20 on Linux.
  697 	- Fix #736: segfault during zone transfer.
  698 	- Fix #744: Fix that NSD replies for configured but unloaded zone
  699 	  with SERVFAIL, not REFUSED.
  700 
  701 
  702 4.1.7
  703 ================
  704 FEATURES:
  705 	- support configure --with-dbfile="" for nodb mode by default, where
  706 	  there is no binary database, but nsd reads and writes zonefiles.
  707 	- reuseport: no is the default, because the feature is not troublefree.
  708 	- configure --enable-ratelimit-default-is-off with --enable-ratelimit
  709 	  to set the default ratelimit to disabled but available in nsd.conf.
  710 	- version: "string" option to set chaos version query reply string.
  711 BUG FIXES:
  712 	- Fix zones updates from nsd parent event loop when there are a lot
  713 	  of interfaces.
  714 	- portability fixes.
  715 	- patch from Doug Hogan for SSL_OP_NO_SSLvx options, for the new
  716 	  defaults in the ssl libraries.
  717 	- updated contrib/nsd.spec, from Bálint Szigeti, with new configure
  718 	  options.
  719 	- Allocate less memory for TSIG digest.
  720 	- Fix #721: Fix wrong error code (FORMERR) returned for unknown
  721 	  opcode.  NOTIMP expected.
  722 	- Fix zonec ttl mismatch printout to include more information.
  723 	- Fix TCP responses when REUSEPORT is in use by turning it off.
  724 	- Document default in manpage for rrl-slip, ip4 and 6 prefixlength.
  725 	- Explain rrl-slip better in documentation.
  726 	- Document that ratelimit qps and slip are updated in reconfig.
  727 	- Fix up defaults in manpage.
  728 
  729 
  730 4.1.6
  731 ================
  732 BUG FIXES:
  733 	- Fix #701: Fix that AD=1 set in a BADVERS response.
  734 	- Fix typo in zonec.c inside error message.
  735 	- Fix #711: Document that debug-mode yes is used for staying
  736 	  attached to the supervisor console.
  737 	- Document verbosity 3 prints more information.
  738 	- nsd-checkconf warns for master zones with no zonefile statement.
  739 	- Fix start failure when many file descriptors are in use.
  740 	- The servfail rcode is not printed with a space in the middle.
  741 	- print failed token for config syntax error or parse error.
  742 
  743 
  744 4.1.5
  745 ================
  746 BUG FIXES:
  747 	- Fix #706: default port 53 not opened on ip4 because of getaddrinfo
  748 	  hints initialisation failure.
  749 
  750 
  751 4.1.4
  752 ================
  753 FEATURES:
  754 	- RFC7553 RR Type URI support.
  755 	- removed hardcoded interface limit, --with-max-ips removed.
  756 	- SO_REUSEPORT support, by default on Linux, or with reuseport: yes.
  757 	- Admitted axfrs are logged at verbosity 1.  Refused at verbosity 2.
  758 	- --enable-pie and --enable-relro-now options for a safer executable.
  759 BUG FIXES:
  760 	- Fix NSID response for short edns sizes.
  761 	- Fix that for expired zones NSD performs an AXFR and accepts newer
  762 	  and older serial numbers.
  763 	- Document that minimal responses only minimizes responses to fit
  764 	  in one datagram.  It does not minimize smaller responses.
  765 	- Fix #618: documented need to list ip-addresses separately in
  766 	  nsd.conf if there are multiple, because the source address of
  767 	  replies can otherwise go wrong.
  768 	- Fix that notify from nsd-control contains soa serial.
  769 	- Fix #698 formatting errors and typos in nsd.8.in.
  770 
  771 
  772 4.1.3
  773 ================
  774 FEATURES:
  775 	- nsd-control addzones and delzones read list of zones from stdin.
  776 	- hmac sha224, sha384 and sha512 support, patch from David Gwynne.
  777 	- max-interfaces raised to 32.
  778 BUG FIXES:
  779 	- Fix #665: when removing subdomain, nsd does not reparse parent zone.
  780 	- Fix task and zonestat files to be stored in a subdirectory in tmp
  781 	  to stop privilege elevation.
  782 	- Fix crash in zone parser for relative dname after error in origin.
  783 	- Fix that formerrors are ratelimited.
  784 
  785 
  786 4.1.2
  787 ================
  788 FEATURES:
  789 	- Incoming notifies have serial number logged (at verbosity 1).
  790 BUG FIXES:
  791 	- Remove some duplicate header includes (from Brad Smith).
  792 	- Fix tcp waiting list for zone transfers where the bind and connect
  793 	  calls fail.
  794 	- Fix segfault in zone reader on invalid input. (thanks John Van de
  795 	  Meulebrouck Brendgard)
  796 	- Fix segfault on double origin in zone reader (thanks John Van de
  797 	  Meulebrouck Brendgard).
  798 	- Fix b64pton out of bounds error on invalid zonefile input.
  799 	  (thanks John Van de Meulebrouck Brendgard)
  800 	- Fix origin directive from unused old value and subdomain parser
  801 	  failure, reported by John Van de Meulebrouck Brendgard.
  802 	- Fix use after free after zonefile syntax error followed by ttl
  803 	  or origin directive, reported by John Van de Meulebrouck Brendgard.
  804 	- Fix syntax error followed by too many TXT elements parse crash
  805 	  reported by John Van de Meulebrouck Brendgard.
  806 	- Fix buffer overflow in config parse of domain name,
  807 	  reported by John Van de Meulebrouck Brendgard.
  808 	- Use reallocarray for integer overflow protection, patch submitted
  809 	  by Loganaden Velvindron.
  810 	- Fix allocation integer overflow checks.
  811 	- Fix #654: Fix contradiction in notify logging verbosity level.
  812 	- Fix #655: Fix contradiction in verbosity for zone transfers.
  813 	- Made log message more consistent, changed 'axfr refused' log message
  814 	  to be more consistent with other messages.  Also notify refused.
  815 	- verbosity 2 logs axfr refused and notify refused.
  816 	  verbosity 1 contains less log messages.
  817 
  818 
  819 4.1.1
  820 ================
  821 FEATURES:
  822 	- RFC 7344: CDS and CDNSKEY (read record types).
  823 	- per zone statistics with --enable-zone-stats, config zone with
  824 	  zonestats: "name", zones configured with the same string are added.
  825 	- Disabled use of SSLv3 in nsd-control.
  826 	- nsd-checkconf -f prints out full name of pidfile (with dir).
  827 	- Synthesize CNAMEs with same TTL as DNAME.
  828 BUG FIXES:
  829 	- Fix that expired zones stay expired after a server restart.
  830 	- Fix "xfrd_handle_ipc: bad mode" log errors when compiled 
  831 	  with --disable-bind8-stats.
  832 	- Fix #616: retry xfer for zones with no content after command.
  833 	- Fix char used as array index warnings on NetBSD.
  834 	- Fix that queries for noname CH TXT are REFUSED instead of nodata.
  835 	- Fixes for wildcard addition and deletion, speedup for some cases.
  836 	- Fix that failure to add tcp to tcp base does not leak the socket.
  837 	- Patch nsd_munin_ from Philip Paeps to use type ABSOLUTE.
  838 	- Fix spinning NSD with lots of failing transfers, due to pointer
  839 	  comparison using void pointer subtraction (from Otto Moerbeek).
  840 	- Fix bug#637: fix that nsd.db grows limitlessly, an off by one
  841 	  on one megabyte free chunks, created during AXFRs of large zones,
  842 	  that caused the one megabyte chunk to be leaked.
  843 	- Fix casts for ctype functions (from Todd Miller).
  844 	- correct some hyphen-used-as-minus-sign (from Andreas Schulze) in
  845 	  man pages.
  846 	- Fix zonesdir chroot error message.
  847 
  848 
  849 4.1.0
  850 ================
  851 FEATURES:
  852 	- database: "" starts without mmap of database.  Less memory is used,
  853 	  zones are read from text zonefile.
  854 	- optimised zonefile parse code and zonefile write code.
  855 	- zonefiles-write option in nsd.conf, enabled when database is "".
  856 	  The server writes changed zonefiles to disk every hour.
  857 	- xfrdfile: "" disables xfrd.state.  If enabled, zones that are
  858 	  same as before are not checked for a serial update at server start.
  859 	- include: "foo/nsd.d/*.conf" works, wildcard glob on includes.
  860 	- nsd shuts down during init process if given signal.
  861 	- log-time-ascii option, default yes, with readable timestamp in log.
  862 	- nsd-control addzone reports if zone already exists.
  863 	- Fix #564: add nsd-checkzone tool to check zonefile correctness.
  864 	- Increased default --with-max-ips from 8 to 16, this increases the
  865 	  number of interfaces you can specify in nsd.conf to listen to.
  866 BUG FIXES:
  867 	- Fixed shutdown message sporadically not printed on exit
  868 	  (Thanks Anand Buddhdev).
  869 	- Documented zonefile %s syntax in nsd.conf man page.
  870 	- Fix manpage to put colon after zonefiles check and write.
  871 	- Change from 'Zone" to "zone" with ".. serial .. is updated" log
  872 	  message.
  873 	- Changed maxbackoff for no-content secondary zones from 4h to 24h.
  874 	- Fix print filename of encompassing config file on read failure.
  875 	- Fix delete or rename of a lot of zones and make it take a
  876 	  non-enormous time.
  877 	- Speed up deletion of zone contents a lot, (56s to 1s), speeds up
  878 	  delete, rename and AXFR for zones.
  879 	- Fix #571: unused variable and incompatible pointer warnings when
  880 	  compiled on a system without INET6.
  881 	- Fix write_socket return value check in server.c (Thanks Brad Smith,
  882 	  Mark Kettenis).
  883 	- Fix that xfrd reaps children also if the signal is lost.
  884 	- Fix #577: makefile incorrectly installed manpages from srcdir.
  885 	- Fix #587: Default value for statistics is 0.
  886 	- Fix #553: Improve TXT parsing.
  887 	- Fix #590: rrl log does not print wildcard as a star but escaped.
  888 	- Fix #591: rrl log messages at verbosity level 1.
  889 	- fix strptime implicit declaration error on OpenBSD.
  890 	- Fix -O3 compile flag to -O2 to avoid miscompilations.
  891 	- Allow user to override the -g -O2 CFLAGS in ./configure.
  892 	- Fix endian.h include for OpenBSD.
  893 	- Fix #600: document that provide-xfr provides AXFR and not IXFR.
  894 	- Fix rising-load-average or memory-leaks in OSes (Linux since 2.6),
  895 	  that keep track of all past process parents, or leak memory
  896 	  for them.  Fix makes it so there is no very deep string of
  897 	  process parents.
  898 	- Remove .LP after .SH in man pages.
  899 
  900 
  901 4.0.3
  902 ================
  903 BUG FIXES:
  904 	- Fix nsd.db unclean close check.  Previous databases are considered
  905 	  unclean by the code and are created anew.
  906 	- Adds nsd.db larger than 400Tb check for sanity. Also test if
  907 	  filesize as documented in the file is correct.
  908 	- nsd waits for tasks to complete on stop, prevents nsd.db corruption.
  909 	- fix to not delete tmpdir too early in shutdown process.
  910 	- disabled udb checking functionality that made it very slow,
  911 	  this was enabled when enable-checking was turned on.
  912 
  913 
  914 4.0.2
  915 ================
  916 FEATURES:
  917 	- Return REFUSED for queries to non-hosted zones.
  918 
  919 BUG FIXES:
  920 	- Fix expired zones to give SERVFAIL, also when parent zone loaded.
  921 	- documented nsd-control zonestatus output in nsd-control manpage.
  922 	- remove mention of nsdc from nsd-checkconf manpage.
  923 	- Disabled recvmmsg and sendmmsg usage by default because kernel
  924 	  versions have implementation issues: ipv6 ignored, security issues.
  925 	- Detect libevent2 install automatically by configure, and use
  926 	  event2 header files if necessary.
  927 	- Fix #551: change Regent to Copyright holder in the LICENSE,
  928 	  to match the definition on opensource.org for the BSD License.
  929 	- Fix #552: zonefile loads on nsd-control reconfig when the name
  930 	  of the file has changed.
  931 	- Fix leak of zone name after zonefile read and fix malloc too
  932 	  large that would be leaked in the radix tree.
  933 	- Fix from 3.2: make SOA RDATA comparisons in XFR more lenient (only
  934 	  check serial).
  935 	- Fix that NSD will delete and recreate not-clean-closed databases.
  936 
  937 
  938 4.0.1
  939 ================
  940 FEATURES:
  941 	- recognizes ip-address and interface as synonyms for convenience.
  942 	- Support for EUI48 and EUI64 RR types enabled by default (RFC 7043).
  943 	- Support for CAA RRtype (RFC 6844).
  944 	- NSID can be set with "ascii_somestring" in ascii.
  945 	
  946 BUG FIXES:
  947 	- Fix xfrd when zone transfer TCP contains zero length packets.
  948 	- Fix for NSEC3 zones where parent zone is co-hosted, also NSEC3,
  949 	  because AXFRs overwrote nsec3 administration in the child zone.
  950    	- Fix that bad IXFR updates do not result in double SOA records,
  951 	  and that an AXFR is started (attempted) when the zone state seems
  952 	  to be inconsistent with the master's zone state.
  953 	- Log ip address for sendto and sendmmsg failures.
  954 	- Fix segfaults after read of zones with rr type WKS from zonefile.
  955 	- Seed PRNG for openssl at start of daemon, fixes SSL connection issue.
  956 	- Bugfix #534: IXFR query loop over UDP for zones that are unchanged.
  957 	- (same as in 3.2.16): fix wildcard cname to nxdomain repeated rrset.
  958 	- (same as in 3.2.16): Bugfix #542: Match RRSIG TTL with SOA TTL in
  959 	  negative response.
  960 	- Check if configure in srcdir collides with outofdir build.
  961 	- Fix #546:  output format errors in nsd_munin_ (Thanks Tom Hendrikx).
  962 	- Fix printout of high-chars in TXT on NetBSD.
  963 
  964 4.0.0	NSD 4.0
  965 ===============
  966 FEATURES:
  967 	- documented in doc/NSD-4-features. Change configuration without
  968 	  restart, direct nameserver control with nsd-control, support a
  969 	  higher number of zones. Higher performance (compared to NSD3).
  970 	- nsdc is gone. Use kill -HUP for reload (also checks if zonefiles
  971 	  have changed and rereads them), and kill -TERM for quit. Or use
  972 	  nsd-control for detailed control.
  973 	- cron job for nsdcpatch is gone. nsd-control write creates zonefiles.
  974 	- nsd.db has a new format that compacts itself when it is changed,
  975 	  thus nsdc patch is no longer necessary.
  976 	- nsd.db is memory mapped, NSD needs (part of) that mmap in ram.
  977 	- tcp-count can go above 1000; epoll/kqueue support with libevent.
  978 	- nsd-control reconfig for updates with no restart (zones, keys, ..)
  979 	- nsd-control-setup to create keys for nsd-control (enable nsd-control
  980 	  with remote-control: yes in nsd.conf).
  981 	- the NSD 3 feature of special zone stats are not ported to 4 yet,
  982 	  as it would entail a complete reimplementation of the feature.
  983 FEATURES (incremental from BETA5):
  984 	- configure --disable-recvmmsg for compat with older Linux kernels,
  985 	  by default it autodetects support in the kernel on the buildmachine.
  986 	- Fix time at 2038, uint32s changed to time_t, support 64bit time_t.
  987 	- Fix use of 32bit time, for 2038, thanks to Theo de Raadt for patch.
  988 BUG FIXES (incremental from BETA5):
  989 	- Bugfix #518 Incorrect RRL prefix length option names in nsd.conf
  990 	  man page from Ville Mattila.
  991 	- Fix that xfrd, and nsd-control, does not stop responding when reload
  992 	  errors out. The pid is sent like it should by server_main.
  993 	- Fix that EOF in quoted string error does not cause reload to exit.
  994 	- Fixup errors from the stack code checker.
  995 	- Removed use of random when arc4random is available. Thus, random
  996 	  and srandom are then not linked with the executable.
  997 	- Fix segfault with no logfile and chroot (Thanks Patrik Lundin).
  998 
  999 4.0.0b5   BETA 5 release of NSD 4.0
 1000 ==================================
 1001 FEATURES:
 1002 	- Optimizations for startup, qps and tcp speed, beta bug fixes and
 1003 	  merge with code changes with NSD 3.2.16.
 1004 	- nsd-mem tool (make nsd-mem) to estimate memory usage.
 1005 	- Same as NSD 3.2.16: --enable-draft-rrtypes(EUI48, EUI64), rr-slip,
 1006 	  rrl-ipv[46]-prefix-length, ip-transparent config options.
 1007 	- configure option --disable-flto.
 1008 	- improved RRL logging (query details that caused blockage).
 1009 	- nsd-control status prints out ratelimit if ratelimit is enabled.
 1010 	- nsd-control verbosity prints out verbosity level without argument.
 1011 	- Fix #491: pick program name (of executable) as syslog identity.
 1012 	- printout percentage for long activities (to log).  After about 5
 1013 	  seconds have passed.
 1014 BUG FIXES:
 1015 	- The same fixes up to NSD 3.2.16.
 1016 	- Fix that old zonefile does not override newer AXFR for slave zones.
 1017 	- Nicer printout of notify.
 1018 	- Fix tcp zonetransfer pipeline lookup function.
 1019 	- Fix compile on bigendian netbsd alpha.
 1020 	- Fixup the growth and shrinkage of nsd.db.  This should use less
 1021 	  calls to remap and change the file and mmap size.
 1022 	- notify information is logged at correct verbosity level, 1.
 1023 	- Fix memory statistics in nsd_munin_.
 1024 	- faster nsec3 updates.
 1025 	- Fixup contrib/bug390.patch for 4.0.0b4.
 1026 	- remove leak of nsec3.
 1027 	- allocate radixtree in region for small (5%) total savings and
 1028 	  about 15% savings in the radixtree itself (due to many small alloc
 1029 	  savings in region).
 1030 	- Patch from Lukas Wunner that makes nsd.conf include files work
 1031 	  inside chroot/etc environments on repattern and reconfig.
 1032 	- Fix race on exit of nsd, for restarts, so that the pidfile-pid
 1033 	  process waits until port53 has been closed before exiting.
 1034 	- Patch from Lukas Wunner that makes chroot more consistent.
 1035 	  Make all paths absolute with the chrootdir in front, or use
 1036 	  an absolute zonesdir with other paths relative to that.
 1037 	- Fix segfault on repeated reconfigs, double free of zone apex name.
 1038 	- Fix zone parser allocations are put in the db region.
 1039 	- Fix memory leak in zone parser for txt record.
 1040 	- Optimizations: -O3 if possible (user can override CFLAGS), udp
 1041 	  buffers are set to 1m by default (if socket options exist),
 1042 	  use recvmmsg and sendmmsg, or only recvmmsg, or recvfrom.
 1043 	- nsd.db 12% smaller, no nsec3 hash storage.  Also ups udb version
 1044 	  because of the format change.  The nsd.db is recreated when a 
 1045 	  different version number is detected on startup.
 1046 	- Fix region-allocator for speedup of load and change of large data.
 1047 	- Increase tcpbacklog default to 256 (silently capped to 128 on BSD).
 1048 	  For remote control keep it at 16, it has less TCP load.
 1049 	  It does not actually increase TCP performance (some except), but
 1050 	  reduces connection loss when there is a spike in TCP connections.
 1051 	- unlink xfr file if transfer is stopped, timeouted or interrupted.
 1052 	  And unlink xfr file in progress when the zone is deleted.
 1053 
 1054 4.0.0b4   BETA 4 release of NSD 4.0
 1055 ==================================
 1056 BUG FIXES:
 1057 	- remove -fwhole-program gcc flag usage.  We cannot reliably detect
 1058 	  if it works without failure.
 1059 	- fix zonefiles-check: entry in nsd.conf
 1060 	- fix gcc warning, do not use uninit value for rng init.
 1061 	- remove printout of "bad transfer" to the log for notimpl.
 1062 	- printout log less verbosely, not every axfr packet.
 1063 	- RRL documented in nsd.conf.sample
 1064 	- Fix is_apex flag for zones read from udb.
 1065 	- Fix that nsec3 zones are precompiled when read from udb.  This
 1066 	  caused assertion failures.
 1067 	- Less printout of 'bad transfer'.
 1068 	- Fix AXFR of NSEC3 slave zone.
 1069 	- Fix that old zonefile does not override newer AXFR for slave zones.
 1070 	- Nicer printout of notify on verbosity 2.
 1071 
 1072 4.0.0b3   BETA 3 release of NSD 4.0
 1073 ==================================
 1074 BUG FIXES:
 1075 	- applied patch from Robin Hack to remove double pid file truncation.
 1076 	- repattern is called reconfig (because most config options are
 1077 	  picked up, except for superuser options (chroot, logfile, port))
 1078 	- document that the zonefile attribute can be empty.
 1079 	- documented that the _implicit_ pattern names are used internally.
 1080 	- Added zonefiles-check option, default yes, check mtimes of zone files
 1081 	  on sighup and startup (from Robin Hack).
 1082 	- Fix spurious assertion failure for some rrl blocks.
 1083 	- Tabs and spaces nicer in nsd.conf.sample.
 1084 	- List libevent in README.
 1085 	- Fix configure for gentoo gcc and headers.
 1086 	- do-ip4 and do-ip6 nsd.conf options just like unbound.
 1087 	- do not leave task files in /tmp if nsd fails to startup because
 1088 	  of file permissions.
 1089 	- create xfrdir on make install (does not remove on make uninstall,
 1090 	  because this could be /tmp).
 1091 	- Fix segv if xfrdir does not exit.
 1092 	- log ip address with tcp failure.
 1093 	- Fix time calculation of zone transfer.
 1094 
 1095 4.0.0b2   BETA 2 release of NSD 4.0
 1096 ==================================
 1097 FEATURES:
 1098 	- Add and remove zones from nsd.conf with nsd-control repattern.
 1099 	- Merge changes from 3.2.15 (such as xname-rcode fix).
 1100 
 1101 BUG FIXES:
 1102 	- Fix for use with libev.
 1103 	- 'nsd-control start' runs an absolute path to start sbin/nsd.
 1104 	- Fix for use with libevent-2.1.2.
 1105 	- --with-logfile sets the logfile inside the example documentation.
 1106 	- Fixed addzone and delzone inside chroot (thanks Will Pressly).
 1107 	- Fix make outside of source directory.
 1108 
 1109 4.0.0b1   BETA 1 release of NSD 4.0
 1110 ==================================
 1111 FEATURES:
 1112 	- add and remove zones without restart.
 1113 	- nsdc is gone, use nsd-control for direct server control.
 1114 	- performance increases
 1115 	- support lots of zones
 1116 	- and more ...
 1117 	- longer desc in doc/NSD-4-features
 1118 
 1119 BUG FIXES:
 1120 	- core code is fixed like 3.2.15r3763 (12 dec 2012).
 1121 
 1122 
 1123 3.2.16 (development branch)
 1124 =================================
 1125 
 1126 FEATURES:
 1127 	- New config option "ip-transparent:" to allow NSD to bind to
 1128 	  non local addresses. Default no.
 1129 	- Use IPV6 minimum MTU settings with TCP to reduce failures that
 1130 	  are caused by delays in learning working PMTU when communicating
 1131 	  through a tunnel.
 1132 	- Bugfix #496: Support for EUI48 and EUI64 RR types. Experimental,
 1133 	  turned off by default. Enable with --enable-draft-rrtypes.
 1134 	- New config option "rrl-slip:" to set the average number of
 1135 	  packets discarded before we send back a truncated response.
 1136 	- New config option "rrl-ipv4-prefix-length:" and
 1137 	  "rrl-ipv6-prefix-length:" to set the prefix lengths.
 1138 	- Improved RRL logging, also print triggering query src address and
 1139 	  QTYPE.
 1140 	- Provide RRL documentation in nsd.conf.sample.
 1141 
 1142 BUG FIXES:
 1143 	- Bugfix #357: Parent process waits until children closed down
 1144 	  sockets, to prevent NSD failing to bind to sockets when restarting.
 1145 	- Bugfix #487: lookup3.c determine endianness for BSD systems.
 1146 	- Bugfix #491: pick program name (0th argument) as syslog identity.
 1147 	- Bugfix #494: Exit with return code 1 if socket code fails.
 1148 	- RRtypes ASFDB, RP, RT should not compress dnames.
 1149 	- Fix outgoing-interface: Don't fail if family is IPv6 but
 1150 	  only IPv4 outgoing-interface is set, or vice versa.
 1151 	- RRtypes ASFDB, RP, RT should not compress dnames.
 1152 	- Check that zone directory is within chroot directory.
 1153 	- Better XFR checking, fallback to AXFR (if allowed) if three
 1154 	  malformed XFR packets have been seen.
 1155 
 1156 
 1157 3.2.15
 1158 =================================
 1159 
 1160 FEATURES:
 1161 	- Support for ILNP RR types: NID, L32, L64, LP (RFC6742).
 1162 	- RRL, --enable-ratelimit at configure time and config options.
 1163 	- TSIG initialization only fails when there is no digest found
 1164 	  at all.
 1165 
 1166 BUG FIXES:
 1167 	- Bugfix #478: Declaration after statement (for gcc 2.95).
 1168 	- Bugfix #483: Better error message in case of TSIG error.
 1169 	- Bugfix #485: TTL should not be greater than 2^31 - 1.
 1170 	- Fix RCODE when CNAME loop final answer does not exist, should
 1171 	  return NXDOMAIN as stated by RFC 6604.
 1172 	- Fix --disable-full-prehash bug, where after multiple incoming
 1173 	  IXFRs, NSEC3 can be removed unjustified.
 1174 
 1175 3.2.14
 1176 ================
 1177 
 1178 FEATURES:
 1179 	- TCP writev support.
 1180 
 1181 BUG FIXES:
 1182 	- Fix build on OpenBSD (thanks Oliver Peter).
 1183 	- Prioritize notify sender for requesting XFR (thanks Ilya Bakulin).
 1184 	- Fix crash in zonec if TXT string too long  (thanks Ilya Bakulin).
 1185 	- tzset before chroot for correct timezone (thanks Camiel Dobbelaar).
 1186 	- Fix --disable-full-prehash bug when nsdc patch happens while ixfr too,
 1187 	  it did not rehash the new database.
 1188 	- Bugfix #464: Conditionally define MAXHOSTNAMELEN.
 1189 
 1190 3.2.13
 1191 ================
 1192 
 1193 BUG FIXES:
 1194 	- Fix for nsd-patch segfault if zone has been removed from nsd.conf
 1195 	  (thanks Ilya Bakulin).
 1196 	- Bugfix #460: man page correction - identity.
 1197 	- Bugfix #461: NSD child segfaults when asked for out-of-zone data
 1198 	  with --enable-zone-stats. [VU#517036 CVE-2012-2979]
 1199 
 1200 
 1201 3.2.12
 1202 ================
 1203 
 1204 BUG FIXES:
 1205 	- Fix for VU#624931 CVE-2012-2978: NSD denial of service 
 1206 	  vulnerability from non-standard DNS packet from any host
 1207 	  on the internet.
 1208 	  http://www.nlnetlabs.nl/downloads/CVE-2012-2978.txt
 1209 
 1210 
 1211 3.2.11
 1212 ================
 1213 
 1214 FEATURES:
 1215 	- Fallback to AXFR if IXFR is unknown at the primary. NSD considers
 1216 	  IXFR unknown at the primary if there is a negative response for the
 1217 	  IXFR RRtype. This does not override the value for
 1218 	  'allow-axfr-fallback'.
 1219 	- Allow for reading in new DNSKEY algorithm mnemonics (RFC5155,
 1220 	  RFC5702, RFC5933, and RFC6605 (ECDSA)).
 1221 	- Zone statistics, enable with --enable-zone-stats. This stores the
 1222 	  BIND8 stats per zone in a configurable statistics file. This option
 1223 	  does not scale and should therefore not be enabled when serving
 1224 	  many zones.
 1225 	- Support for TLSA RRtype (DANE).
 1226 
 1227 BUG FIXES:
 1228 	- Fix for qtype ANY for a wildcard domain in NSEC signed zone: Don't
 1229 	  add the wildcard domain NSEC into the answer section. Instead,
 1230 	  put the wildcard expanded NSEC into the answer section and keep the
 1231 	  wildcard domain NSEC in the authority section.
 1232 	- Fix for accept spinning reported by OpenBSD.
 1233 	- Fix restart failed due to bad ixfr packet because of zone removed
 1234 	  from nsd.conf.
 1235 	- Bugfix #453: typo in nsdc man page.
 1236 
 1237 OPERATIONAL NOTES:
 1238 	- NSD uses the query name for dname compression again (Fix #235 
 1239 	  had as side effect that this didn't happen anymore and is hereby
 1240 	  undone).
 1241 
 1242 
 1243 3.2.10
 1244 ================
 1245 
 1246 BUG FIXES:
 1247 	- Bugfix #421: Truncate pidfile on shutdown, before unlink.
 1248 	- Bugfix #423: Fix slow zone transfer processing due to
 1249 	  'Fix is_existing flag for ENT' bugfix.
 1250 	- Fix bug #430: segfault when MAX_INTERFACES set to more than 65K.
 1251 	- Fix configure.ac strptime check for gcc 4.6.2, acx_nlnetlabs update.
 1252 
 1253 
 1254 3.2.9
 1255 ================
 1256 
 1257 FEATURES:
 1258 	- Minimize responses to reduce truncation: NSD will only add optional
 1259 	  records to the authority and additional sections when the response
 1260 	  size does not exceed the minimal response size.
 1261 
 1262 	  The minimal response size is 512 (no-EDNS), 1480 (EDNS/IPv4),
 1263 	  1220 (EDNS/IPv6), or the advertized EDNS buffer size if that is
 1264 	  smaller than the EDNS default. 
 1265 
 1266 	  The feature is enabled by default. You can disable it by configuring 
 1267 	  NSD with --disable-minimal-responses.
 1268 
 1269 	- Less NSEC3 prehashing. This will make NSD handle zone transfers
 1270 	  faster, but will decrease the performance of NXDOMAIN and wildcard
 1271 	  NODATA responses. Full prehashing is enabled by default. If you want
 1272 	  less NSEC3 prehashing, configure NSD with --disable-full-prehash.
 1273 	  Thanks Secure64 for the patch.
 1274 
 1275 BUG FIXES:
 1276 	- Bugfix #302: nsd accepts XFR but refuses to re-read the slave zone.
 1277 	- Bugfix #365: set patch style and zonec verbose for nsdc.
 1278 	- First step of bug #369: RRSIG DNSKEY sets zone to be treated DNSSEC.
 1279 	- Bugfix #375: typos in nsd.conf.5.
 1280 	- Bugfix #381: Binary escaped and transfers.
 1281 	- Bugfix #397: Don't allow relative domain names as origin in $INCLUDE
 1282 	  directives.
 1283 	- Fix printout of IPSECKEY by nsd-patch.
 1284 	- Fix is_existing flag for ENT when domain that has a shared ENT
 1285 	  is deleted by IXFR. (ENT == Empty Non-Terminal)
 1286 	- Fix bug if the zonefile is changed for a secondary but stored
 1287 	  transfers are applied, and stop it from applying ixfr to empty zone.
 1288 	  The zone is flagged with error and AXFR-ed.
 1289 	- Fix to have no authority NS set processing for CNAMEs.
 1290 	- Fix nsd-checkconf to check tsig algorithms properly.
 1291 	- Set the AA bit on responses that have an authoritative CNAME.
 1292 	- Fix denial of existence response for empty non-terminal that looks
 1293 	  like a NSEC3-only domain (but has data below it).
 1294 
 1295 OPERATIONAL NOTES:
 1296 	- nsd.db version number increased because NSD 3.2.7 and earlier
 1297 	  zonec is not compatible due to the TXT strings change. Please
 1298 	  run nsdc rebuild before running NSD 3.2.9 and later versions.
 1299 
 1300 
 1301 3.2.8
 1302 =============
 1303 
 1304 BUG FIXES:
 1305 	- Do setusercontext() before chroot(), otherwise login.conf etc. are
 1306 	  required inside chroot.
 1307 	- Bugfix #216: Fix leak of compressiontable when the domain table increases
 1308 	  in size.
 1309 	- Bugfix #348: Don't include header/library path if OpenSSL is in /usr
 1310 	- Bugfix #350: Refused notifies should log client ip.
 1311 	- Bugfix #352: Fix hard coded paths in man pages.
 1312 	- Bugfix #354: The realclean target deletes a bit too much.	
 1313 	- Bugfix #357, make xfrd quit with many zones.
 1314 	- Bugfix #362: outgoing-interface and v4 vs. v6 leads to spurious
 1315 	  warning messages.
 1316 	- Bugfix #363: nsd-checkconf -v does not print outgoing-interface ok.
 1317 	- Bugfix: nsd-checkconf -o outgoing-interface omits NOKEY.
 1318 
 1319 OPERATIONAL NOTES:
 1320 	- Use 'make clean' to clean up files that make created.
 1321 	- Use 'make realclean' to also clean up files that were generated by
 1322 	  running ./configure.
 1323 	- Use 'make devclean' to also clean up autoconf, autoheader files.
 1324 
 1325 3.2.7
 1326 =============
 1327 
 1328 BUG FIXES:
 1329 	- Bugfix #253: Don't put NS RRs in a response with QTYPE=DS.	
 1330 	- Bugfix #320: use arcrandom(4) for QID generation if available.
 1331 	- Bugfix #328: nsd-checkconf overrun.
 1332 	- Bugfix #343: nsdc update fix.
 1333 	- Bugfix #347: Wrong NSEC3 returned for nodata response QTYPE=DS no delegation.
 1334 	- Bugfix: Allow for huge amount of strings in TXT (and other) records.
 1335 	- Bugfix: nsdc can now deal with tsig algorithms other than hmac-md5.
 1336 	- Fixed several parts in the documentation, including #306, #345.
 1337 
 1338 3.2.6
 1339 =============
 1340 
 1341 BUG FIXES:
 1342 	- Bugfix #314: correctly print NSEC next field, escape spaces and
 1343 	  fix label overflows.
 1344 
 1345 FEATURES:
 1346 	- Expand command line option '-a' and config option 'ip-address:'
 1347 	  with port number.
 1348 
 1349 OPERATIONAL NOTES:
 1350 	- Configure options --disable-dnssec, --disable-nsid, --disable-tsig
 1351 	  are removed.
 1352 	- Configure option --max-interfaces is renamed to --max-ips.
 1353 
 1354 3.2.5
 1355 =============
 1356 BUG FIXES:
 1357 	- NSD will not start if chroot is configured, but changing root is
 1358 	  not possible (it used to ignore the badly configured chroot).
 1359 	- Make use of the more secure strl* functions.
 1360 	- Bugfix #303: spelling error.
 1361 
 1362 FEATURES:
 1363 	- New option 'nsid:', to specify the NSID (Bugfix #298).
 1364 	- The default chroot can be set with --with-chroot=<dir>.
 1365 	  If not set, by default chroot will not be used (thanks Jakob Schlyter).
 1366 	- Optimized zonec and b64_pton compatibility code (thanks Martin Svec).
 1367 	- Optimized memory allocations. Use mmap/munmap instead of malloc/free.
 1368 		Experimental, by default off. Enable it at build time with
 1369 		--enable-mmap (thanks Martin Svec).
 1370 
 1371 OPERATIONAL NOTES:
 1372 	- NSID support is now enabled by default.
 1373 
 1374 3.2.4
 1375 =============
 1376 BUG FIXES:
 1377 	- Bugfix #269: Additional C99 syntax.
 1378 	- Bugfix #276: Zonec prints debug data to stderr.
 1379 	- Bugfix #286: Document verbosity levels in nsd.conf manual page.
 1380 	- Bugfix #288: Ignore SIGHUP to child processes.
 1381 	- Fix typo in include file for setusercontext.
 1382 
 1383 FEATURES:
 1384 	- Support DLV records.
 1385 	- New option 'tcp-query-count:', to limit the maximum number of
 1386 		DNS queries on a single tcp connection.
 1387 	- New option 'tcp-timeout:', to override the default tcp timeout.
 1388 		The default can also be set at build time, --with-tcp-timeout=<number>.
 1389 	- New option 'notify-retry:', to configure how many times NSD should retry
 1390 		a NOTIFY message.
 1391 	- New options 'ipv4-edns-size:' and 'ipv6-edns-size:'. to set your preferred
 1392 		EDNS buffer size.
 1393 
 1394 OPERATIONAL NOTES:
 1395 	- UDP/IPv4 sockets have new options set that will disable the DF flag in IP
 1396 		packets.
 1397 
 1398 3.2.3
 1399 =============
 1400 BUG FIXES:
 1401 	- Bugfix #236: Allow RRs before the SOA in a zonefile.
 1402 	- Bugfix #249: Remove the C99 code.
 1403 	- Bugfix #253: Don't put NS RRs in a response with QTYPE=DNSKEY.
 1404 	- Bugfix #263: Make TSIG algorithm comparison case insensitive.
 1405 	- Bugfix #266: Build failed on systems without strptime.
 1406 	- Bugfix: install hickup.
 1407 	- Fix to use 4096 EDNS limit for IPv6 on Linux.
 1408 
 1409 3.2.2
 1410 =============
 1411 BUG FIXES:
 1412 	- Off-by-one buffer overflow fix while processing the QUESTION section.
 1413 	- Return BADVERS when NSD does not implement the VERSION level of the 
 1414 	  request, instead of 0x1<FORMERR>.
 1415 	- Bugfix #234.
 1416 	- Bugfix #235.
 1417 	- Reset 'error occurred' after notifying an error occurred at the $TTL or
 1418 		$ORIGIN directive (Otherwise, the whole zone is skipped because the
 1419 		error is reset after reading the SOA).
 1420 	- Minor bugfixes.
 1421 
 1422 3.2.1
 1423 =============
 1424 OPERATIONAL NOTES:
 1425 	- NSD will now fallback to AXFR, only if the master does not support IXFR.
 1426 	- You can adjust nsdc patch to skip textfile patching. This will 
 1427 	  increase the patching process, but will not output to zonefiles 
 1428 	  anymore. By default, this is off.
 1429 
 1430 BUG FIXES:
 1431 	- When configuring, don't do strptime test when cross-compiling.
 1432 	- Bug #230: Output non-error messages to stdout.
 1433 	- Better error message when ixfr.db old file format is read.
 1434 	- Bug #218: shared UDP query for all interfaces.
 1435 	- Bug #222: Remove bashism from nsdc script.
 1436 	- Nicer check for SHA-256 functionality.
 1437 	- Fixed some minor memory leaks that occurred on reload.
 1438 	- nsdc: check if a lockfile has not gone stale, when lock failed.
 1439 	- Bugfix strptime compatibility function
 1440 
 1441 FEATURES:
 1442 	- New configuration option 'allow-afxr-fallback', "yes" by default. If
 1443 		set to "no", NSD will never do AXFR fallback, even if the master 
 1444 		does not support IXFR.
 1445 	- Allow file rotation on nsd.log.
 1446 	- The new nsd-patch options -s and -o allows you to skip writing 
 1447 		zonefiles and store the output directly to a database file, 
 1448 		respectively.
 1449 
 1450 3.2.0
 1451 =============
 1452 OPERATIONAL NOTES:
 1453 	- Format of ixfr.db has changed. When you are planning an upgrade to the 
 1454 	  new NSD release, make sure to process the old ixfr.db before starting 
 1455 	  the new release (by running nsdc patch).
 1456 	- IXFR is transmitted over TCP by default instead of UDP. If you want to 
 1457 	  continue the use of IXFR/UDP, please modify your zone configuration 
 1458 	  file to:
 1459 		request-xfr: UDP 1.2.3.4 tsigkey
 1460 	  We strongly recommend to enable TSIG if you send IXFR over UDP.
 1461 	  When all masters fail to transmit IXFR/UDP, slave will fallback to 
 1462 		IXFR/TCP and eventually AXFR/TCP.
 1463 	- nsd-patch prints errors to stderr instead of stdout.
 1464 
 1465 BUG FIXES:
 1466 	- Only normalize dnames in rdatas when rrtype is listed in RFC 4034, 
 1467 	  section 6.2: Canonical RR Form, following
 1468 	  draft-ietf-dnsext-dnssec-bis-updates (affects RRSIG and NSEC records).
 1469 	- Typo in zonec manpage.
 1470 	- Bugfix in log_finalize.
 1471 	- Fix race condition between nsdc patch and server reload.
 1472 
 1473 FEATURES:
 1474 	- AXFR/TCP fallback in case of failing IXFR zone transfers.
 1475 	- RFC 4635: support for hmac-sha1 and hmac-sha256 TSIG algorithm 
 1476 		identifiers, "Bugfix #130".
 1477 	- Configure the source ip-address for notifies (master) and zone
 1478 		requests (slave) in nsd.conf, "Bugfix #148".
 1479 	- nsd-notify and nsd-xfer allow you to configure the outgoing 
 1480 		hostname and source port, in addition to the source address.
 1481 	- Additional debug and verbose log messages.
 1482 
 1483 3.1.1
 1484 =============
 1485 BUG FIXES:
 1486 	- Try to avoid race conditions with NSD reloading and nsdc running, 
 1487 		by writing pidfile before closing old parent process.
 1488 	- Fixed NSEC3 memory leak in the case NSEC3 is not needed.
 1489 	- Fixed some memory leaks that happened on error, mostly on
 1490 		zone transfer errors.
 1491 	- Bugfix #191: nsd-checkconf allowed only (max_interfaces-1) interfaces.
 1492 
 1493 FEATURES:
 1494 	- The number of maximum interfaces allowed is configurable with
 1495 		--with-max_interfaces=<number> (thanks John Lightsey).
 1496 
 1497 3.1.0
 1498 =============
 1499 OPERATIONAL NOTES:
 1500 	- Default locations of nsd.db, ixfr.db & xfrd.state are changed to
 1501           the /var/db/nsd directory.
 1502 
 1503 BUG FIXES:
 1504 	- Zone compiler gives more sane error messages when out of
 1505 	  diskspace and bug #172: when compiling single zone file.
 1506 	- Changed man pages format from mdoc to mansun, to support the Solaris OS.
 1507 	- Log tcp read error only when connection not reset by peer or when 
 1508 	  verbosity level is high.
 1509 	- RRs are compared without checking the TTL value.
 1510 
 1511 FEATURES:
 1512 	- NSD is now NSEC3 enabled by default. You can disable it by configuring 
 1513 		NSD with --disable-nsec3.
 1514 	- Added "hide-version" configuration setting. Enabling this feature 
 1515 		stops NSD from answering to CHAOS class version requests.
 1516 	- Added bind2nsd 0.5.0 (http://bind2nsd.sourceforge.net) in contrib/.
 1517 	- Report source and zone for denied AXFR attempts.
 1518 
 1519 3.0.8
 1520 =============
 1521 FEATURES:
 1522 	- Better logging for nsd-notify (show 'broken' zone)
 1523 	- Add configuration for chkconfig to control nsd service.
 1524 
 1525 BUG FIXES:
 1526 	- Fixed nsdc start when nsd already running: do not initialize server, 
 1527 		since it is already running.
 1528 	- Fixup bug where data related files are looked up in the wrong
 1529 	  directory when chrooted with chrootdir ending with a slash.
 1530 	- Fixup bug where nsd would return FORMERR if received an edns
 1531 	  query with version set to zero and rdlen larger than zero.
 1532 	- Fixed strptime, so that zonec will also work on systems with broken 
 1533 		strptime (like leopard :-))
 1534 	- Do not answer nsec3 wildcard information when DO bit is not set
 1535 	- Better logging when creating database failed.
 1536 	- Various spelling errors
 1537 
 1538 3.0.7
 1539 =============
 1540 BUG FIXES:
 1541 	- Error handling for malformed IXFRs improved.
 1542 	- Fixed man pages, consistent syntax.
 1543 
 1544 3.0.6
 1545 =============
 1546 FEATURES:
 1547 	- Report source and zone for denied AXFR attempts.
 1548 
 1549 BUG FIXES:
 1550 	- More elegant handling of malformed nsec3 records from a zone 
 1551 	  transfer.
 1552 	- Fixup ignored return value in region-allocator.
 1553         - Added bind2nsd 0.5.0 (http://bind2nsd.sourceforge.net) in contrib/.
 1554 
 1555 3.0.5
 1556 =============
 1557 BUG FIXES:
 1558 	- Fixed problem with reload waiting very long. If the OS has a 
 1559 	  raging herd problem, NSD could block in a UDP operation and
 1560 	  that process would stop reload from finishing. Made UDP sockets 
 1561 	  nonblocking. 
 1562 	- Made TCP listen sockets nonblocking. NSD could block in accept.
 1563 	- Handle the new CERT RDATA types defined in RFC 4398 (submitted by 
 1564 	  Mans Nilsson).
 1565 	- Fixed a bug where zonec would choke on unknown CERT RDATA types.
 1566 	- Change nsd-notify retry timer from linear into exponential
 1567 	  backoff (submitted by Mans Nilsson).
 1568 	- Debug flag (-d) behavior changed. Nsd now also forks children when 
 1569 	  run in debug mode.
 1570 	- Added verbosity mode (-V <level>) for extra operational logging.
 1571 	- zonesdir default is /etc/nsd.  This can be overridden in nsd.conf.
 1572 	- if clients drop the tcp connection this does not result in a logfile
 1573 	  entry, unless verbosity is set 2 or more.
 1574 
 1575 3.0.4
 1576 =============
 1577 BUG FIXES:
 1578 	- zonec will print an error when other data is put next to a CNAME.
 1579 	- Fixup unaligned memory access that could occur when reading ixfr.db
 1580 	  with a partial transfer inside.
 1581 	- Fixup for the WKS RR type printout by nsd-patch and nsd-xfer.
 1582 	- Error message 'could not read database CRC' now only given on error.
 1583 	- ./configure --zonesdir=<directory for zone files> now works to
 1584 	  set a default value for the zonesdir: <dir> nsd.conf directive.
 1585 	  Set zonesdir: "" to disable the change of directory.
 1586 	- Bug: reload crashes with log message 'continuing with old database',
 1587 	  and after that no more zone updates. Manual fix is to kill -HUP,
 1588 	  but now fixed in software to try to reload again (and again).
 1589 	- Small speedup where xfrd could briefly be busy-waiting.
 1590 	- If master sends IXFR with glue that is already present in the zone
 1591 	  this is silently accepted. Printed in debug mode -L 2. To make
 1592 	  the log file smaller.
 1593 	- Exponential backoff for zones that never worked to max of 4 hours.
 1594 	  For expired zones the SOA retry values are used.
 1595 	- allow-notify acl entries 'NOKEY' match only queries without TSIG.
 1596 	- Answers to valid notifies contained wrong RR counts in the header.
 1597 	  The notifies were processed correctly, but now the acknowledgement
 1598 	  reply is in correct DNS format.
 1599 FEATURES:
 1600 	- Added contrib/nsd.zones2nsd.conf python script to convert NSD 2 to
 1601 	  NSD 3 config files, contributed by Stephane Bortzmeyer.
 1602 	- The nsdc control script will print 'nsd startup failed' if the nsd
 1603 	  executable does not start (due to bad permissions, bad config, ...).
 1604 
 1605 3.0.3
 1606 =============
 1607 BUG FIXES:
 1608 	- Bug #152: NSD would not use the identity from nsd.conf, fixed.
 1609 	- Bug #153: When running with thousands of secondary zones, NSD would
 1610 	  run out of UDP sockets. Caused crash on FreeBSD, errors on Linux
 1611 	  ('out of file descriptors'), depending on ulimits. Fixed.
 1612 	- Fixed getaddrinfo error message to be more descriptive.
 1613 	- Fallback to ip4 if getaddrinfo fails for ip6.
 1614 	- Will no longer lose a notify message during reloads (IPC).
 1615 	- Will no longer lose transfer in progress when notified for that zone.
 1616 	- Nicer error when operator forgets to rebuild after deleting a zone.
 1617 
 1618 3.0.2
 1619 =============
 1620 BUG FIXES:
 1621 	- Nice error from zonec on a wrong configuration zone name.
 1622 	- Nicer warning from zonec when starting secondary zone with
 1623 	  no zone file for the first time.
 1624 	- nsdc makes more portable use of 'which' (for SunOS5.9/bash2.05).
 1625 	- Bug #143: Improved handling of zonesdir: directive and relative 
 1626 	  pidfile, database, diff file, xfrdfile paths in nsdc.sh and 
 1627 	  nsd-patch. They would not find the files.
 1628 	- Bug #144: LOC RRtype default values for precision wrong. Fixed.
 1629 	- Bug #145: NSD failed to reload cases of simultaneous zone transfer.
 1630 	- Bug #146: NSD fails to write to xfrdfile when chrooted. Fixed.
 1631 		Also fix for difffile when chrooted.
 1632 	- Bug #147: NSD runs out of memory. Fixed, memory is reused.
 1633 	  Occurred when running NSD with very big zones and large updates.
 1634 	- nsd -L 1 logging is smaller, -L 2 contains all debug information.
 1635 	  (only available for debug compiles).
 1636 	- Bug #149: Fixed text for NOTAUTH error code. When notify is not
 1637 	  authorised REFUSED error code returned instead.
 1638 
 1639 3.0.1
 1640 =============
 1641 BUG FIXES:
 1642 	- nsd-patch prints SOA record at start of zone files.
 1643 
 1644 3.0.0
 1645 =============
 1646 FEATURES:
 1647 	- AXFR/IXFR zone transfer supported.
 1648 		- NSD requests but does not provide IXFR transfers.
 1649 		- NSD keeps track of SOA timeouts for secondary zones.
 1650 	- TSIG authentication supported.
 1651 		- For queries, for notifies, for zone transfers.
 1652 	- NOTIFY messages of zone updates, incoming and outgoing.
 1653 	- DNAME type is supported, including CNAME synthesis.
 1654 	- config file, nsd.conf(5), place to put TSIG keys, server settings,
 1655 	  and lists of ip-addresses/ranges for AXFR/IXFR and NOTIFY.
 1656 	- prepared for NSEC3 (--enable-nsec3), experimental code for testing
 1657 	  in workshops.
 1658 	- prepared for NSID (--enable-nsid), experimental code for testing in 
 1659 	  workshops.
 1660 
 1661 OPERATIONAL NOTES:
 1662 	- config file needed, nsd.conf(5) supersedes nsd.zones and nsdc.conf.
 1663 	- AXFR transfers are denied by default. Allow in config file.
 1664 	- Zones only become secondary with "request-xfr:" items in config file.
 1665 	- NSD produces "ixfr.db" file with a journal of zone transfers.
 1666 	  Use nsdc patch to merge changes back to zone files and remake db.
 1667 	- NSD produces "xfrd.state" file with zone timeout information.
 1668 	  The file is text formatted.
 1669 	- NSD sends notifies automatically,
 1670 	  nsd-notify is deprecated and will be removed from the package. 
 1671 	- NSD requests AXFR/IXFR and reloads the updates automatically, 
 1672 	  nsd-xfer is deprecated and will be removed from the package.
 1673 	- Check your config file with nsd-checkconf.
 1674 
 1675 BUG FIXES: 
 1676 	- contains all bug fixes from 2.3.5 and before.
 1677 	- The sighandler() bug is fixed more thoroughly,
 1678 	  by using pipes for interprocess communication.
 1679 	- CNAMEs are followed by the server to different zones and
 1680 	  information from that zone is returned. This saves a followup
 1681 	  query.
 1682 	- bug fixes (ported) 2.3.6.
 1683 		- nsd-notify will retry max 15 times 5 second retries.
 1684 		- Bug #105: nsdc lacks locking, fixed locking for root user.
 1685 		- Bug #134: nsd: make -N <large number> work again
 1686 		- Bug #135: Typo in locking code for nsdc, fixed.
 1687 		- uninitialised variable fixed.
 1688 		- unaligned memory access (on Solaris SPARC), in zonec 
 1689 		  LOC parsing, fixed.
 1690 		- Bug #138: nsd aborts trying to bind all interfaces if ip6 
 1691 		  is not enabled, instead it will fallback to ip4.
 1692 		- Bug #139: resync timer for stats to whole minute.
 1693 		- Bug #140: NSD did not clear CD bit on authoritative answers.
 1694 		- Bug #141: NSD did not clear flags on a formerror reply.
 1695 
 1696 2.3.5
 1697 =============
 1698 BUG FIXES:
 1699         - Bug #132: regression, nsd: fix compile with --disable-ipv6
 1700         - Makefile: remove gnuisms
 1701 
 1702 2.3.4
 1703 =============
 1704 BUG FIXES:
 1705         - Unknown type codes for type code numbers > 48 and < 97 work again.       
 1706           (this implies --enable-checking can be enabled again)
 1707         - nsd: sighandler() fixes
 1708 	- Bug #118: nsd: nsd_notify waits for a response. Will retry the notify
 1709 	  after a timeout.
 1710         - Bug #124: $(DESTDIR) was added to Makefile.in. 
 1711 	- Bug #128: zonec: parser can handle \\ at the end of a string.
 1712         - zonec: lexer: add \r to the newline delimeter
 1713         - zonec: use strtol with an explicit base 10 as parameter.
 1714           (Scott Rose, Roy Arends)
 1715         - nsd-xfer: print human readable error codes. Change logging to 
 1716           be more in line with the rest
 1717 
 1718 2.3.3
 1719 =============
 1720 BUG FIXES:
 1721         - Apply the correct patch to nsdc.sh.in. 
 1722 
 1723 2.3.2
 1724 =============
 1725 FEATURES:
 1726         - Bug #101: add support for the SPF record.
 1727 
 1728 BUG FIXES:
 1729         - Bug #100: replaced non-portable use of timegm(3) with
 1730           portable implementation (mktime_from_utc).
 1731         - Bug #103: nsd: trim the SOA's TTL to the MINIMUM value when returning a 
 1732           negative answer.
 1733         - Bug #104: nsd: add a time_t timestamp to the log when logging to
 1734           a file.
 1735         - Bug #105: nsdc: use a lock file when rebuilding the database (patch by
 1736           Jakob Schlyter/Ted Lindgreen/Sebastian/Ondrej Sury).
 1737         - Bug #106: zonec: don't walk all 256 NSEC windows when that is not
 1738           needed.
 1739         - Bug #107: zonec: fixed a crash when encountering bad unknown rdata.
 1740         - nsd: Don't print: "error: nsd is already running as <pid>, stopping"
 1741           when in fact NSD continues to run.
 1742         - nsd: Minimize the race window in sig_handler().
 1743 
 1744 2.3.1
 1745 =============
 1746 BUG FIXES:
 1747         - zonec: Don't crash when generating error messages outside of zone
 1748           files.
 1749         - nsd: when logging to a file the pid is now printed.
 1750         - nsd: Reset 'boot' time in statistics when reloading the database,
 1751           since the statistics are reset to 0 on a reload.
 1752         - nsd-xfer.c: Added '-a' option to specify local address to connect
 1753           from.  Original patch supplied by Walter Hop <nsd@walter.transip.nl>.
 1754         - Bug #98: Allow mnemonics for DS and RRSIG algorithm field.
 1755 
 1756 2.3.0
 1757 =============
 1758 FEATURES:
 1759         - DNSSEC is now enabled by default. NSD should be fully
 1760           compliant with RFC4033, RFC4034, and RFC4035.
 1761 
 1762 BUG FIXES:
 1763         - nsd: Ensure that the number of -a flags does not exceed the
 1764           maximum specified by MAX_INTERFACES in config.h.
 1765         - nsd-xfer: Use serial number arithmetic (RFC1982) for the
 1766           zone serial check
 1767         - nsdc: Don't pass (fake) serial number to nsd-xfer if the
 1768           zone file does not exist.
 1769         - zonec: Loading many zones would cause namedb_find_zone to
 1770           slow down, performance patch by Kazunori Fujiwara.
 1771         - Bug #96: nsd-xfer did not handle 8-bit domain names
 1772           correctly.
 1773 
 1774 2.2.1
 1775 =============
 1776 FEATURES:
 1777         - The message priority is now included when logging to a file.
 1778 
 1779 BUG FIXES:
 1780         - Zero length RDATA using the unknown RR notation was not
 1781           working (except for the APL RR type).
 1782         - Bug #93: './configure' error message containing a comma must
 1783           be properly bracketed.
 1784         - Bug #94: nsd-xfer: Handle unexpected EOF when receiving AXFR
 1785           data.  Timeout if no data is received for more than 120
 1786           seconds (see the TCP_TIMEOUT parameter in config.h).
 1787         - Bug #95: An owner starting with an asterisk label ("*") was
 1788           being treated as its own wildcard child.
 1789 
 1790 2.2.0
 1791 =============
 1792 FEATURES:
 1793         - nsd-xfer: replacement program for named-xfer to perform zone
 1794           transfers using AXFR. TSIG is supported by nsd-xfer but not
 1795           yet by the nsd server. DNSSEC is also supported.  TSIG
 1796           requires OpenSSL version 0.9.7 or higher, configure using
 1797           --disable-tsig if you do not have OpenSSL installed.
 1798           Configure using --with-ssl=path if OpenSSL is not installed
 1799           at a standard location.
 1800 
 1801 CODE CHANGES:
 1802         - New data structure 'buffer_type' for representing binary
 1803           buffers that can be read, written, and resized.  Data in
 1804           these buffers is stored in network byte order.  This data
 1805           structure replaces the iobuf field of 'struct query'.
 1806 
 1807 BUG FIXES:
 1808         - Fixed endian problem in WKS record.
 1809         - Protocol can now be specified numerically in WKS record.
 1810         - Allow escape sequences (\DDD) in TTL, RR class, and RR type.
 1811         - The zone compiler now accepts many more characters in
 1812           unquoted strings such as domain name labels.  The characters
 1813           no longer need to be escaped with a backslash.
 1814         - Close included files after reading.
 1815         - Maximum TCP message size is now 65535 bytes.  AXFR response
 1816           packets are still limited to 16383 bytes for optimal
 1817           compression of dnames.
 1818         - The TSIG key for AXFRs can now also be stored in the file
 1819           <zonename>.tsiginfo.  This makes it possible to use TSIG
 1820           with multiple master servers.
 1821         - Signals are no longer blocked while performing I/O so the
 1822           server should respond quicker to signals.
 1823         - Fixed parsing of LOC rdata.  Fractions and altitude were not
 1824           handled correctly.
 1825 
 1826 2.1.5
 1827 =============
 1828 BUG FIXES:
 1829         - Bug #90: handle \000 in TXT records correctly
 1830         - Fixed undefined behavior in the use of vsnprintf when
 1831           logging messages.  This caused crashes on Linux/PPC.
 1832 
 1833 2.1.4
 1834 =============
 1835 BUG FIXES:
 1836         - nsdc: Fixed a typo that caused AXFRs to stop working.
 1837 
 1838 2.1.3
 1839 =============
 1840 FEATURES:
 1841         - nsd: The pidfile can be specified using the '-P' option.
 1842 
 1843 BUG FIXES:
 1844         - Bug #87: allow @ in the rdata
 1845         - Bug #88: allow ::FFFF:ipv4addr in AAAA records
 1846         - Bug #89: Count the number of queries received over TCP,
 1847           instead of the number of TCP connections.
 1848         - Zonec: when - is used as input, set the filename to 'STDIN'.
 1849         - The nsdc script handles failed AXFRs more gracefully.
 1850         - NSD emits an error when it sees bitlabels (RFC 2673).
 1851         - Only copy the CD bit when DNSSEC is enabled.
 1852 
 1853 2.1.2
 1854 =============
 1855 FEATURES:
 1856         - NSD now fully supports unknown record types using the
 1857           notation specified in RFC3597.
 1858         - Support for the following RR types has been added: WKS, X25,
 1859           ISDN, RT, NSAP, PX, NAPTR, KX, CERT, DNAME, and APL.  DNAME
 1860           special processing is not supported.
 1861 
 1862 BUG FIXES:
 1863         - Bug #84: NSD now uses SIGUSR1 instead of SIGILL to report stats.
 1864         - Bug #85: Support for WKS records.
 1865         - Bug #86: The characters "#%&^[]?" can now be used without
 1866           backslash in zone file domain names.
 1867         - Plugin callback return type fixed.
 1868         - The maximum message length for IPv6 UDP packets is now
 1869           limited to the IPv6 minimum MTU (1280) unless the
 1870           IPV6_USE_MIN_MTU socket option is supported.
 1871 
 1872 2.1.1
 1873 =============
 1874 BUG FIXES:
 1875         - Bug #81: Handle unknown types correctly.
 1876         - Bug #82: Zonec: don't report "0 errors" unless -v is
 1877           specified.
 1878         - Bug #83: Close zone files after parsing.
 1879         - Handle AFSDB RR type.
 1880 
 1881 2.1.0
 1882 =============
 1883 FEATURES:
 1884         - New networking code allows a single server to handle both
 1885           UDP and TCP connections.  By default up to 10 simultaneous
 1886           TCP connections are supported.  Use the '-n' flag to change
 1887           the default.
 1888 
 1889 2.0.2
 1890 =============
 1891 BUG FIXES:
 1892         - Allow the use of a mnemonic for the algorithm field of a
 1893           DNSKEY record.
 1894         - Behavior of the zonec -v flag has been modified.  By default
 1895           zonec will only print a single line with a summary of the
 1896           error count.
 1897         - Bug #75: Fixed typo in previous "fix".
 1898 
 1899 2.0.1
 1900 =============
 1901 BUG FIXES:
 1902         - Queries for QTYPE DS (DNSSEC) were not handled correctly in
 1903           certain cases.
 1904         - Partial support for unknown RRs.  Known RR types with
 1905           unknown RR data format is not yet supported.
 1906         - Bug #75: Fixed bad error message when nsdc update is run for
 1907           the first time.
 1908         - Bug #78: Multiple zones, each with include directives, are
 1909           now compiled correctly.
 1910 
 1911 2.0.0
 1912 =============
 1913 FEATURES:
 1914         - Experimental DNSSEC support implemented, but disabled by
 1915           default.  Enable using the --enable-dnssec configuration
 1916           option.
 1917         - IPv6 enabled by default.  Disable using the --disable-ipv6
 1918           configuration option.
 1919 
 1920 BUG FIXES:
 1921         - Bug #47: Domain name is now logged when a notify is
 1922           received.
 1923         - Bug #70: First include all A records in the additional
 1924           section, followed by AAAA records.
 1925         - Bug #77: Check length of domain name and label.
 1926         - LOC records are supported again.
 1927 
 1928 1.4.0-alpha1
 1929 =============
 1930 FEATURES:
 1931         - New database format that is much more compact and portable
 1932           across architectures.
 1933         - The new zone compiler is now the default and the old zone
 1934           compiler has been removed.
 1935         - Name compression is done dynamically, removing one other
 1936           difference with BIND in the responses generated (the full
 1937           query name is now used for compression).
 1938         - CNAME target records are now generated from wildcard
 1939           records if necessary.
 1940 
 1941 REGRESSIONS:
 1942         - mmap(2) isn't currently supported.
 1943         - Not all RR types are supported by zonec (such as LOC).
 1944 
 1945 1.3.0-alpha1
 1946 =============
 1947 FEATURES:
 1948         - New name lookup algorithm.  This required a change to the
 1949           database format.  Performance should increase at the expense
 1950           of database size and memory usage.
 1951         - New zone compiler (zonec2) based on flex and yacc, fully RFC
 1952           compliant (still in alpha).
 1953         - Database can be loaded using mmap(2) (use the --enable-mmap
 1954           configure option to enable).  This is useful on operating
 1955           systems such as Solaris that do not allow memory overcommit.
 1956         - Region based memory allocation and resource management.
 1957         - New internal format for storing domain names.  Each dname
 1958           now includes an array of label offsets within the domain
 1959           name.
 1960         - Updates to the plugin API.
 1961 
 1962 BUG FIXES:
 1963         - Bug #65: The syslog facility is now a compile time option
 1964           (--with-facility=FACILITY).  The default facility is DAEMON.
 1965         - Bug #66: Automatic periodic dumping of the statistics (using
 1966           the -s option) is now continued after a database reload.
 1967 
 1968 1.2.4
 1969 =============
 1970 BUG FIXES:
 1971         - Bug #72: If an RRset for a child domain is defined before
 1972           the RRset of the parent domain the parent's RRset would be
 1973           "lost".
 1974 
 1975 1.2.3
 1976 =============
 1977 BUG FIXES:
 1978         - Bug #65: The syslog facility is now a compile time option
 1979           (--with-facility=FACILITY).  The default facility is DAEMON.
 1980         - Bug #66: Automatic periodic dumping of the statistics (using
 1981           the -s option) is now continued after a database reload.
 1982         - NSD would try to kill pid -1 on startup if forking of a child
 1983           process failed.
 1984         - Do not log EAGAIN errors on calls to recvfrom.  These errors
 1985           should be harmless.
 1986 
 1987 1.2.2
 1988 =============
 1989 BUG FIXES:
 1990         - Bug #59: NSD returns FORMERR when the query name is >= 246
 1991           bytes.
 1992         - Bug #60: Zonec runs out of file descriptors with many zones.
 1993         - Bug #61: nsdc uses /bin/sh hardwired (and should not).
 1994         - Bug #62: NSD is not able to log to a file.
 1995         - Bug #63: nsdc update and zonec are too talkative.
 1996         - Bug #64: Answer for request of a host resolved by a
 1997           wildcard-resource-record is not understandable by dig.
 1998 
 1999 1.2.1
 2000 =============
 2001 BUG FIXES:
 2002         - AXFR terminates early if a zone contains a CNAME pointing
 2003           the the zone's domain name (SOA record) (bug #56).
 2004         - During an AXFR memory above the top of the stack was
 2005           accessed.  This could lead to occasional AXFR errors (bad
 2006           packets).
 2007         - NSD now prints its version number and exits when invoked
 2008           with the -v flag (bug #57).
 2009         - NSD prints help information and exits when invoked with the
 2010           -h flag.
 2011 
 2012 1.2.0
 2013 =============
 2014 FEATURES:
 2015         - NSD is now a single parent process (handling child
 2016           termination and database reloads) plus multiple UDP and TCP
 2017           child processes handling queries.  Before the parent process
 2018           also handled UDP queries.  This change simplifies the parent
 2019           and child processes and allows the use of multiple
 2020           concurrent UDP servers.
 2021         - Experimental plugin support.  This required a minor,
 2022           incompatible change to the database format.  Make sure you
 2023           recompile your database.  Use --enable-plugins to enable.
 2024         - Full IPv6 support (for multi-homing and for Linux, thanks to
 2025           Colm MacCárthaigh and Jun-ichiro itojun Hagino).  Use
 2026           --enable-ipv6 to enable.
 2027         - Support for multi-homing with TCP connections.
 2028         - Support for SunOS 4.x has been dropped.
 2029 
 2030 CODE CHANGES:
 2031         - NSD should now conform to the Single Unix Specification
 2032           (http://www.unix.org/).
 2033         - Const correctness for strings and some other data types.
 2034         - Removed code for Berkeley DB, hash tables, and mmap(2).
 2035         - Separate preprocessor flags from code flags (CPPFLAGS and
 2036           CFLAGS).
 2037         - Use uint8_t instead of u_char, uint{16,32}_t instead of
 2038           u_int{16,32}_t.
 2039         - Fixed warnings from mixing signed and unsigned types.
 2040         - Use sigaction(2) instead of signal(2).
 2041         - The query_process function has been split up for clarity.
 2042 
 2043 BUG FIXES:
 2044         - CHAOS TXT queries failed on big-endian machines.
 2045         - Portability fixes for Tru64 (thanks to Stephane Bortzmeyer),
 2046           HP-UX, and MacOS X (thanks to Ronald van der Pol).
 2047         - Removed compile time limit on maximum number of TCP child
 2048           servers.
 2049         - Support for debugging UDP and TCP queries.
 2050         - Always ensure there is enough room for the EDNS record when
 2051           answering a query with EDNS enabled.
 2052 
 2053 1.1
 2054 =============
 2055 FEATURES:
 2056         - ANSI C
 2057         - autoconf/configure
 2058         - new parser
 2059         - support for various RR types in zonec
 2060         - support for UNKN RR types
 2061 
 2062 BUG FIXES:
 2063         - lots of zone parsing errors eliminated
 2064         - empty node matching bug gives NXDOMAIN
 2065 
 2066 1.0.3
 2067 =============
 2068 This release is a bug fix release and does not add any new features.
 2069 
 2070 BUG FIXES:
 2071         - Ignore SIGPIPE errors (bug #43).
 2072         - Keep track of TCP child servers and restart if necessary.
 2073           (bug #55)
 2074         - Handle database reload failures correctly.
 2075         - Close UDP sockets in TCP child servers.
 2076         - Handle escaped characters (besides \.) in labels.
 2077         - Preserve the query's RD flag in the answer.
 2078 
 2079 1.0.2
 2080 =============
 2081 FEATURES:
 2082         - -DBIND8_STATS to enable bind8 like [NX]STATS
 2083         - -t flag to make nsd chroot to a certain directory
 2084         - -s flag to make nsd produce statistics every s seconds
 2085         - /etc/nsd/nsdc.conf to overwrite default variables
 2086           for nsdc.sh
 2087         - less loggin and more radical tcp connection (mis)handling
 2088         - prefork -n processes to handle tcp connections
 2089         - multiple -a flags
 2090 
 2091 CHANGES:
 2092         - named.stats file functionality is removed
 2093 
 2094 BUG FIXES:
 2095         - couple of pedantic fixes in C code
 2096         - last zone in database axfr bug fixed
 2097         - nsdc update wont update bug fixed
 2098 
 2099 1.0.1
 2100 =============
 2101 
 2102 FEATURES:
 2103         - NSD drops permissions after binding the sockets
 2104         - ``cache'' zones are no longer allowed
 2105         - ID.Server & Version.Server compile time options
 2106         - AXFR implemented (with tcpwrapper for access control)
 2107         - nsdc update and nsdc notify functionality
 2108         - using named-xfer with TSIG for inbound axfr
 2109 
 2110 
 2111 CHANGES:
 2112         - the order of records in the database is from now
 2113           on significant
 2114         - since Berkeley DB doesnt define order for sequential
 2115           access it is no longer supported
 2116 
 2117 BUG FIXES:
 2118         - white space problem in zonec is fixed
 2119 
 2120 KNOWN BUGS:
 2121         - please see appropriate man pages for the known bugs
 2122 
 2123 1.0.0 RELEASE
 2124 =============
 2125 
 2126 KNOWN BUGS:
 2127 
 2128 - Although NSD allows one to configure a zone without SOA record and
 2129   use it as so called ``cached'' non-authoritative data, it is decided
 2130   that having this functionality is wrong, dangerous and will be removed
 2131   from the further versions.
 2132 
 2133 - If while processing EDNS(0) OPT record NSD encounters bad EDNS(0)
 2134   version it will answer with Format Error instead of EDNS(0) BADVERS
 2135 
 2136 PLATFORMS:
 2137 
 2138         Tested and working on i386 FreeBSD-4.4, i386 Linux, dec alpha Linux,
 2139         sparc SunOS 4.x
 2140 
 2141 
 2142 1.0.0-BETA2
 2143 ===========
 2144 
 2145 FIXES:
 2146         - wildcards bug fixed
 2147         - AA bit for class ANY bug fixed
 2148         - minor coredumps with really broken zones in zonec fixed
 2149         - linux & SunOS port
 2150 
 2151 1.0-ALPHA2
 2152 ==========
 2153 FIXES:
 2154         - IPv6 transport support added by Jun-ichiro itojun Hagino (Use -DINET6)
 2155         - Makefile modified for easier compile time configuration
 2156         - EDNS(0) bug fixed
 2157         - Default database changed to all lowercase, red-black tree to make nsd
 2158           DNSSEC ready
 2159         - REQUIREMENTS are cleaned up and updated
 2160         - Signal names changed in nsdc.sh.in
 2161         - Default compile options dont include -DMIMIC_BIND8