2.99.9950-beta - 2019-01-27

Beta-quality pre-release of 3.0.0 for integration/live testing

Note this is not a real release, and there are no guarantees!

Please see the separate file VERSION3.md - there's too much NEWS!

------

* TCP DNS implementation significantly revamped (again) with the DNS

Stateful Operations (DSO) draft in mind, and the testsuite was upgraded

to test it much more exhaustively now. DSO protocol details are not yet

implemented, but all of the basic logic is. The code is also more

efficient, especially in the case of pipelined requests. Timeout

behaviors and various parameter defaults/limits have changed as well.

* EDNS Padding support added, with a new per-listener boolean option

"tcp_pad". Only supported on TCP listeners at this time. Defaults off

for normal TCP listeners and defaults on for "tcp_proxy" listeners.

"tcp_proxy" is intended for testing encrypted transports, and this will

help mitigate length analysis attacks against that traffic.

* Bugfix for the configuration of "tcp_proxy" listeners: the code was meant

to reject this option on a port 53 listener, but instead it was

rejecting the option anytime the global default "dns_port" option was

set to its normal value of 53.

* Forward-ported from 2.4.x: bugfix for FreeBSD IPv6 with traffic routed to

an IP that's bound to the loopback

* Reverted the detection and rejection of post-2018 GeoLite2-City databases

with auto_dc_coords that was added in 2.3.1, as MaxMind later reversed

course and decided to keep the coordinates in the databases.

* Default compiler flags for hardening updated with newer stack-protection

features from recent GCC, and also Intel's CET flow control stuff.

2.99.9949-beta - 2019-01-09

* Bugfix: Pipelined TCP requests should now work properly (these aren't

in common use by recursors yet AFAIK).

* Socket option-setting code refactored substantially, should smooth out

any bumps caused at the kernel level by pointlessly re-setting

already-set options on sockets taken over via replace.

* UDP send and receive buffer sizes are now no longer subject to heuristic

auto-tuning guesswork. If an explicit value is not configured, OS

defaults are left alone.

* TCP PROXY (v1 and v2) protocol support can now be optionally enabled via

the new per-listener option "tcp_proxy". This enables preservation of

recursors' source IP information for GeoIP lookups when proxying in TCP

DNS connections, and is primarily intended for testing DNS-over-TLS

deployment strategies using an external TLS proxy daemon. See the

documentation for the "tcp_proxy" config option for more information.

2.99.9945-beta - 2018-12-21

* Bugfix: Parsing $INCLUDE without an origin argument should work

correctly now (it was setting incorrect origin values)

* On Linux, runtime threads for zone and geoip data reloads now increase

their niceness if the daemon was started with negative niceness (as is

the case in the recommended unit files and init scripts), so that their

heavy lifting doesn't compete so hard with the important DNS I/O

threads for priority.

2.99.9944-beta - 2018-12-12

* Support for building and loading out-of-tree DSO plugins is removed. The

existing "plugins" from the source tree still work exactly as before from

the end-user point of view, but are compiled into the main daemon. We no

longer install DSOs (or other shared libs) or headers for building 3rd

party DSOs against. This is the first compatibility-breaking step

towards overhauling all related things for 4.x in the future.

* RFC 7873 EDNS Cookie support added. Enabled and automatic by default.

There's 3 new optional config params (to disable, to use a persistent

master key for syncing loadbalanced/anycast cookies, and to set a

UDP response size limit for uncookied client requests) and 4 new stats

counters, see docs and/or VERSION3.md for more details!

* RFC 8482 "Refuse ANY" implemented, with a fixed behavior of returning a

synthetic HINFO RR to ANY queries over all protocols. This also removes

our previous behavior of responding with truncation (TC=1) to ANY over

UDP and forcing those queries over to TCP.

* Query packets are now parsed much more robustly, generating more FORMERR

and/or NOTIMP responses to inputs we would've dropped without response

before, and also signalling EDNS support (response OPT RR) in edge cases

where we wouldn't have bothered before, which should help with future

proofing and moving standards forward. This doesn't really impact

live/common traffic from present-day real clients.

* UDPv6: New separate param "max_edns_response_v6" (vs existing

"max_edns_response" which is now v4-only), defaulting to 1212 to avoid

problematic fragmentation issues on the live Internet.

* TCPv6: Hardcoded minimal MTU/MSS to avoid MTU and/or fragmentation issues

that could cause loss or performance impact (tuned similar to above).

* Bugfix for NSID: only respond with NSID when the client requests it!

* "tcp_timeout" min/def/max values changed from 5/15/60 to 5/37/1080.

* Fixed socket option limits: a few cases were inconsistent with the

documented, intended minimum and maximums.

* Removed the auto-serial misfeature

* Removed the gdnsd-specific $ADDR_LIMIT_V[46] zonefile directives

* Killed support for DOS (\r\n) line endings in the config and zone parsers

* The "DNSSEC OK" (DO) bit of client EDNS headers is now tracked as a stat

and reflected in responses.

* New build dependency: libsodium 1.x

* New testsuite dependency: Perl Net::DNS module version 1.03 or higher (we

used to bundle a forked old version, this catches us up with current and

gets the copied code out of our repo, and enables testing future/fancier

things).

* The ragel-generated rfc1035 zonefile parser's generated C code size was

reduced substantially with various tricks and fixups; it's not nearly as

bloated as it was before!

* The djbdns zonefile parser was removed. It never made it past being a

very limited and experimental backend, and the time to remove it is now

during the major-version breakage cycle, instead of later when coming

feature work will necessitate it.

* Various minor / less-notable bugfixes

2.99.9942-beta - 2018-10-11

* Documentation improvements/fixups

* A few minor fixes and docs updates from testing on FreeBSD 11.2

* Dumped any pretense of MacOS support, as it's been untested for many

MacOS and gdnsd releases and unlikely to work anymore, and seems

pointless to support when they sell no servers and don't allow emulation.

2.99.9930-beta - 2018-10-05

* New config option 'nsid_ascii', as a simpler variant for defining NSID

data bytes which happen to map to ASCII printable strings.

* Old config option 'edns_client_subnet' restored (was removed in

previous betas), allows turning off edns-client-subnet support.

* Minor change to edns-client-subnet RFC interpretations: send FORMERR

in all cases when the family field is not IPv4 or IPv6 (has no

practical impact on real world requests).

* Minor updates to the example initscript

* Minor QA-related updates to the source

2.99.9161-beta - 2018-10-03

* Daemon replacement is now much more operationally transparent:

** Stats counter data is handed off; it no longer rolls over to zero like

it would on a full stop -> start. The "uptime" stat now reflects the

uptime of the stats themselves, which could be considerably longer

than the uptime of the current daemon process.

** ACME DNS-01 challenge data is handed off as well, so that replacement

doesn't effectively flush all the active ephemeral challenge data.

** gdnsdctl now actually enforces its timeout, at least loosely.

** The server's control socket now correctly and effectively blocks all

state-changing operations that it should during the critical window of

the replacement process (pretty much everything but the gdnsdctl

commands "stats", "states", and "status"), and it does so with a

unique response type (RESP_LATR) that lets the client know it's being

denied for this reason instead of some other generic failure and it

can/should retry on a fresh connection later.

** gdnsdctl pays attention to the above RESP_LATR (and other "soft"

communication failures which could be caused by really bad timing with

a replace/stop operation on the daemon) and retries the transaction on

a fresh connection once per second until it goes through successfully

(or truly fails), or until it reaches its overall timeout.

** The net effect of these changes is that they closed up the final

loopholes to make gdnsdctl<->daemon operations fully reliable for

multiple indepedent actors. You could have several different admins,

scripts, CM tools, and cronjobs firing off concurrent or overlapping

state-changing gdnsdctl commands like "replace" (for config updates or

a package/binary update), "reload-zones", "acme-dns-01", etc, and all

of them will eventually succeed or fail correctly (i.e. they won't

artificially fail because of conflict). None of them will ever lie

about the real, user-facing meaning of their successful exit values

(e.g. that when "gdnsdctl reload-zones" exits successfully, the new

data is already visible to queries, regardless of whatever else was

going on).

* gdnsd has a new flag '-i' for idempotent start/daemonize (reports

success instead of failure if it detects another running instance)

* gdnsdctl has a similar new flag '-i' which means "ignore dead daemon"

for certain actions where that makes sense, returning success if

there's no live daemon to connect to. "gdnsdctl -i stop" is

effectively an idempotent stop, but "idempotent" is the wrong word for

what it does to "replace", "reload-zones", and "acme-dns-01-flush".

For those actions, it's more like "succeed if the daemon is dead,

because a new daemon in the future will implicitly start with the state

changes I was trying to notify any optionally-alive daemon of"

* gdnsdctl also gained the new flag "-o" for one-shot mode, which disables

retries, causing commands to (pointlessly?) fail if they collide with

the critical time window of a replace operation.

* An example Linux LSB-style sysv initscript is provided that does

most of the same setup/security stuff as the example systemd unit

* Version and PID info are now always logged at startup

* Builds for the x32 ABI (x86_64 ILP32) now get 64-bit stat counters,

which are otherwise only generally available in builds for *P64 ABIs.

* Several corner-case bugfixes for the control socket code

* Lots of other cleanup and minor correction

2.99.1729-beta - 2018-09-21

* Systemd unit file example updated to add required declarations about

managing the run directory

* Fixed failure to start if no zone data was defined

* A few other minor and relatively-invisible resiliency fixes

2.99.42-beta - 2018-09-20

* Fixed various pedantic and/or racy issues around permissions of the run

directory and the control socket.

* A couple minor cleanups for error messages and docs

2.99.9-beta - 2018-09-18

* Fixed three related bugs in MX/SRV record validation during zone

loading which could have caused duplicated warnings, negated the

intended effect of zones_strict_data just for the MX/SRV case, and

also failed to reject huge MX/SRV RR sets, if zones_strict_data

was true.

* Main daemon now ignores old options '-f', '-s', and '-x' to ease

transition of scripts/tools

* 'make install' no longer checks for the 'gdnsd' user

* Various documentation fixups and minor cleanup

2.99.8-beta - 2018-09-17

*** Bugfixes:

* Fixed bug where ancillary programs like gdnsdctl were using the same

syslog identifier 'gdnsd' as the main daemon, which was confusing.

* Fixed a very long-standing bug (back to 1.x somewhere) that allowed

zonefiles to specify CNAME alongside other RRs in certain ways while

evading the intended failure to load the zone. CNAMEs created in this

manner wouldn't actually be used for real CNAME aliasing at runtime,

but could be seen in direct queries for qtype=CNAME. Doesn't seem

worth a separate bugfix release for 2.x.

*** Feature changes:

* Zone-local CNAMEs are (once again, like 2.x) followed when generating

response packets.

* Dynamic CNAME target values emitted via DYNC RRs can no longer point

into same-zone data.

* VERSION3.md was updated to reflect these. See previous commit c9fc7de

for a fuller explanation of these changes.

* CLI option '-T' renamed to '-R' to reduce confusion, and all log

outputs related to the replace process had their clarity improved.

2.99.7-beta - 2018-09-13

* Fixed bugs that would cause an error exit on startup when

certain plugin configuration stanzas were (legally) empty sets.

* SIGUSR1 properly handled for extmon_helper as well

2.99.6-beta - 2018-09-12

* Minor cleanups from Coverity analysis: mostly workarounds to

avoid false positives, but also two actual resource leaks fixed

(memory and directory handles when reload-zones failed)

* SIGUSR1 properly handled during takeover replacement spawn

2.99.5-beta - 2018-09-11

Beta-quality pre-release of 3.0.0 for integration/live testing

Note this is not a real release, and there are no guarantees!

Please see the separate file VERSION3.md - there's too much NEWS!

2.4.0 - 2018-02-15

* plugin_multifo: added "ignore_health" parameter. If "ignore_health" is

true, all addresses are added to the result set regardless of health, but

the up_thresh and TTL effects still happen, and the final resource-level

state still reflects the overall state as it would without

"ignore_health", for meta-plugin consumption.

2.3.1 - 2018-02-15

* GeoIP2: Detect coordinate-free post-2018 GeoLite2-City databases, and

refuse to use them with auto_dc_coords. cf:

https://blog.maxmind.com/2018/01/02/discontinuation-of-the-geolite-legacy-databases/

* GeoIP2: fixed the handling of automatic, coordinate-based mapping for

networks with no coordinates (e.g. anon-proxy, satellite). These now

return the default datacenter ordering as documented, which is how GeoIP1

has always behaved. The GeoIP2 code was calculating distances for these

networks based on literal 0,0 coordinates since the code was introduced.

* Removed illegal malloc function attributes (could cause optimizer bugs?

no known reports)

* Removed useless/invalid syslog.target dependency from systemd unit

* Fix testsuite breakage with system Net::DNS

* Various minor code-quality / docs / logs / errmsg / spelling fixups

2.3.0 - 2017-11-20

*** Bugfixes:

* Comments at the end of RRs using RFC 3597 syntax now work properly with

whitespace, fixes Github issue 147.

* UDPv6 listening sockets no longer fail fatally if IPV6_DONTFRAG cannot be

set on them, possibly fixing Github issue 115 for some OpenVZ+Debian

installations.

*** Features:

* any_mitigation - New boolean config option, default true. When

enabled, gdnsd sends empty truncated responses to ANY queries over

UDP, which mitigates their use in amplified reflection attacks and

forces legitimate clients to use TCP for these queries. In the

future, the behavior of this option may be relaxed in combination with

other more-general mitigation strategies such as RRL and/or cookies.

* The configuration language's $include{} directive now supports

including whole directories or glob wildcards. The previous behavior

was to treat the include pathname as a singular literal filename. The

new behavior first checks whether the pathname is the literal name of

an existing directory. If so, all files within will be included (as

if the glob pattern "/*" were appended), and it will not be an error

if no matching files exist. Otherwise, the pathname is treated as a

glob wildcard match, and it will be an error if no matches exist.

* plugin_extmon has a new per-service option 'max_proc' which defaults to

zero. If non-zero, this sets the limit on the number of concurrent

commands that will be run. If the limit is exceeded, excess commands are

rescheduled for 0.1 seconds later. After a few runs, the processes will

be spread out enough to run without running into the limit. This avoids

thundering herds of subprocess executions at startup in large

configurations. Contributed by ScaleEngine / Alan Jude.

* CAA records are now natively supported in the normal rdata format from

RFC 6844. CAA records continue to be supported in RFC 3597 generic

format as well, although this is not recommended going forward.

* plugin_geoip has a new top-level option "undefined_datacenters_ok", which

allows resources to leave some of their map's datacenters undefined.

Enabling this can be dangerous, see warnings in the documentation.

2.2.4 - 2016-04-14

* libmaxminddb 1.2.0+ compatibility, using the new interface.

* Note that libmaxminddb's 1.2.0 release is a shared library runtime

compatibility barrier for gdnsd; compiling gdnsd against <1.2.0 and

running against >= 1.2.0 (or vice-versa) is not supported, and the

daemon will exit with an error message indicating this if it happens.

For distributions, you may simply want to make 1.2.0 a required

minimum for gdnsd going forward. This situation is unfortunate, but

there's no clean way to avoid it given upstream broke the undocumented

(but only!) database iteration interface's assumptions in 1.1.5, then

broke them again in 1.2.0 while introducing the new interface.

2.2.3 - 2016-03-23

* Workaround for libmaxminddb 1.1.5 compatibility

* Added a Documentation= tag in the systemd unit file template

* A few typo fixes in the documentation

2.2.2 - 2016-01-06

*** Bugs fixed:

* Fixed a bug (introduced in 2.2.1) in HTTP monitoring when using the

"vhost" parameter.

* The code now falls back from F_OFD_SETLK to F_SETLK at runtime if the

runtime environment differs from the compile-time one.

* Changed the binary "Build Info" string to make the build

reproducible (do not include e.g. host or date information).

* Several updates to qa scripts/tools to keep up with recent changes

* A few trivial warning/analysis cleanups that should be no-op

2.2.1 - 2015-08-05

*** Bugs fixed:

* extfile plugin - if the addresses/CNAMEs for a given extfile

service_type are not listed in natural sort order in the configuration,

extfile will update the wrong items (sorting bug).

* rfc1035 zonefile reloading - Directory scanning (SIGUSR1, or automatic

periodic scanning on a non-inotify system) would treat all zonefiles as

changed and reload them all, without first filtering them on whether

their stat() data had changed since the previous scan. Not really a

functional issue, but certainly wasteful and noisy.

* HTTP monitoring - was not sending any User-Agent string, now sends

"User-Agent: gdnsd-monitor"

2.2.0 - 2014-12-30

*** Bugfixes:

* fix for zero-length configuration strings causing assertion failure

in developer-debug builds

* fix for crash/assertfail if admin_state file contents are

defined by the user as an array instead of a hash

* restored the logging of monitored state transitions, which was

omitted in earlier 2.x releases but present in 1.x.

*** Features:

* If the admin_state file exists but doesn't parse correctly, that will

now be a fatal error for startup or checkconf. Previously the error was

logged but startup/checkconf was successful.

* plugin_geoip: Support for MaxMind GeoIP2 databases. Requires

libmaxminddb at build time to enable, which is a new optional build

dependency.

* plugin_geoip: Added v6->v4 translations for 64:ff9b::/96, the 'Well

Known Prefix' from RFC6052 used for e.g. NAT64.

* The http stats server now supports atomic flush-after-fetch behavior if

given the query argument '?f=1', so that the stat counts are 'since last

flush' instead of 'since startup'. The flushed state is shared between

all clients using the argument. Does not affect stats for clients not

using the argument.

* New optional compile-time dependency on libunwind. If available,

dmn_assert() in developer builds and certain fatal errors in production

builds will produce stack backtraces before terminating the process.

* Security is a little tighter by default now on Linux due to prctl()

PR_SET_NO_NEW_PRIVS, which may interfere with existing plugin_extmon

configurations if they're running privileged binaries (set[ug]id,

capabilities). If this interferes with your configuration, it can be

disabled via the global option 'weaker_security => true'.

* The shipped gdnsd.service systemd unit file now defaults to more secure

settings (e.g. private tmp, no homedir access, readonly system fs, no

device access, etc). These can be overridden by the user without

editing the defaults in e.g. /etc/systemd/system/gdnsd.d/custom.conf.

*** Other:

* The range, default, and effects of the zones_rfc1035_quiesce option

have changed. The zones_rfc1035_min_quiesce option is now deprecated

and useless and will generate a harmless warning on startup. This

shouldn't be a pragmatic issue for most users.

* Related to the above: the code no longer makes heuristic attempts to

determine the effective filesystem timestamp accuracy of the zones

directory on startup by writing temporary test files to it.

* A warning is now generated if the 'zones_rfc1035_auto' option is not set

explicitly, because the default value is likely to change from 'true' to

'false' in a future version.

* The 'listen => scan' feature is now deprecated, but continues to

function and issues a deprecation warning when used. Please either

migrate to 'listen => any' (the current default) or file a bug

indicating why that doesn't work for your platform/use-case!

* Ragel 6.x is now a hard build dependency for all builds. Previously it

was required for building from git, but not from tarballs.

* Perl version dependency has been raised from 5.8.1 to 5.10.1

* Testsuite now also requires JSON::PP (which comes with Perl 5.13.9+, but

may need to be installed for older ones).

* sysd/gdnsd.service is now always generated in the build tree from the

template, even if --without-systemdsystemunitdir and/or no systemd

detected at all, to give more options for how packagers handle things.

* Minor plugin API updates (most would just need a recompile).

* A number of less-visible refactorings for quality and/or performance.

2.1.1 - 2014-12-30

*** Bugfixes backported from master branch:

* Fixed incorrect error-handling code for the sendmmsg() syscall, which

could have caused an unnecessary additional dropped packet and/or

bad error messages after failing to send one or more packets from a set.

* The per-address level udp_recv_width option is now correctly limited to

a value of 64 (previously it was being incorrectly limited to 32).

* plugin_multifo no longer pointlessly limits to 64 addrs per family

* plugin_extmon bugfix for bad timeout/interval behavior if either >255s

* if the stats http socket failed to bind() on startup, the daemon

could carry on anyways, causing it to bind to a different, arbitrary

port number

* Fixed autoconf 2.63 compat when running autoreconf (broken in 2.1.0)

2.1.0 - 2014-10-14

*** Bugfixes:

* Fixed JSON stats output (was malformed; missing commas

in the service state portion of the output).

* Several relatively-benign deficiencies related to

daemonization, logging, and/or process control were fixed

throughout the source tree.

* Path MTU Discovery is now properly disabled on UDPv6 sockets

* Syslog output was not being generated if compiled using

--with-systemd, but not actually running under systemd.

(obviated/fixed by the changes below)

*** Systemd build/install changes:

* The --with-systemd configure flag no longer exists,

there is no dependency on systemd libraries or headers,

and all Linux builds inherently support detecting systemd

and being compatible with it.

* Support for systemd watchdog timers was removed as the

gdnsd implementation served zero functional purpose

other than to add more systemd-related code bloat.

* A (path-templated) unit file for gdnsd is now generated

and installed on applicable systems. If gdnsd will be

run as a systemd service, this unit file *must* be used!

Some of the settings within are critical to the proper

operation of gdnsd under systemd. The installation

path can be overridden from the pkg-config-based default

via --with-systemdsystemunitdir=DIR. Generation and

installation can be avoided on systems which have

systemd installed via --without-systemdsystemunitdir.

*** syslog/stdio behavior (relevant mostly for initscripts):

* New commandline flag "-x" suppresses syslog output completely.

(This is intended for testsuites and linting invocations of

checkconf and such, not for runtime use).

* When the gdnsd binary hasn't fully daemonized yet (meaning the

initial process has not yet exited, regardless of command/mode),

Info- and Debug- level messages are output to stdout, while

messages of severity Warning and higher are output to stderr

(unless we're running under systemd, in which case we stop using

stdio as soon as syslog is open to avoid journal duplicates).

Everything is mirrored to syslog regardless unless the -x cmdline

flag is used.

* If you don't want any gdnsd command output interfering with e.g.

your consistent ANSI-colored init system output, redirect both to

/dev/null. If you'd rather not have "normal" noise, but would

still like errors and serious issues to show through to the user,

just direct stdout to /dev/null.

* (The previous behavior was nothing to stdout, warning+ to stderr

and sometimes info and debug to stderr as well, but sometimes

nothing was output to any stdio anywhere, and was inconsistent

depending on flags/command/situation).

*** Misc changes:

* Documentation added for log_stats option

* Final stats output at daemon shutdown restored; was removed during a

refactor some time ago and I forgot to get it working again.

* Lots of misc improvements to the build and qa stuff. Notably the

default build will now use aggressive security-hardening flags on

modern GNU(-like) toolchains which support them.

*** The canonical HTTP and git-clone URL locations for the project

have changed to http://github.com/gdnsd/gdnsd . The old URLs

and git remotes will work correctly for some time, but not

indefinitely.

2.0.0 - 2014-10-02

*** Commandline / Signal changes:

* The signal for zone data reloads is now SIGUSR1, not SIGHUP.

* The action "reload" has been renamed to "reload-zones",

and sends the new SIGUSR1 signal.

* The action "force-reload" has been removed. Replace it

with invocations of "restart" if that's what you need.

* The point of the above changes is to free up SIGHUP and

"reload" for future reuse for a new reload behavior, but

get the compatibility breaking out of the way now with

the major version bump.

*** Other

* The hacky support for attempting fast reloads under systemd

has been removed completely. It's not worth the pain, and

better ideas are coming in the long run.

* UDP requests with a source port of zero will now count

as UDP "recvfail" in stats and will not be processed for reply.

Previously we tried to reply to these and ended up failing

the related sendmsg call and incrementing "sendfail".

* Default 'max_edns_response' raised from 1280 to 1410.

* UDP socket buffer default negotiation improvements

* Various perf tweaks and code cleanups

*** Please read the 2.0.0-beta news below for everything

else that's changed since 1.x.

2.0.0-beta - 2014-09-10

*** This is a beta release to get more people to try it in

tarball form prior to the official 2.0.0 release.

Please do not release stable distro packages based on this

release!

*** General feature changes:

* Static address RR-sets in zonefiles are no longer limited

to 256 RRs per-family

* Dynamic address RR-sets from plugins are no longer limited

to 64 RRs per-family.

* The default 'listen' setting is now 'any', which listens on

the IPv4 and IPv6 (if available) ANY-addresses 0.0.0.0 and

[::]. The previous interface-scanning mode can be enabled

via 'listen = scan'.

* New TTL-related options: max_ttl, min_ttl, and max_ncache_ttl

cause clamping (and warning) of zone TTL values. There is

a hard maximum on max_ttl of 268435455 (2^28-1, ~8.5 years).

* New config option 'max_edns_response' to cap edns0 response

sizes to a value smaller than that advertised by clients,

defaults to 1280.

* The timeout parameter of a service_type now defaults to

half of the specified interval.

* New service_types plugin "extfile" - allows for the consumption

of outside monitoring data via disk file in vscf format.

* Experimental support for djbdns zonefiles

* IPv6 runtime support is now a requirement, and the related

option monitor_force_v6_up was removed.

* Output data from the stats http listener has changed, please

update any parsers.

*** Dynamic address resolution changes:

* The 'DYNC' rr-type can now dynamically return address or

CNAME data at the plugin's discretion.

* The zonefile syntax for the TTLs of DYNA and DYNC RRs has changed.

It now accepts the form MAX[/MIN], where MIN defaults to half

of MAX.

* The TTL behavior for DYNA/DYNC has changed substantially:

Previously the zonefile TTL would be served as-is for 'UP'

resources, and cut in half for 'DANGER' or 'DOWN' resources.

Now, an internal TTL is calculated based on the minimum time

to the next state change between 'UP' and 'DOWN' according to

the normal monitoring intervals and anti-flap code.

This internal TTL is then clamped to the maximum and minimum

TTL values from the relevant zonefile RR.

* In cases where multiple monitored resources participate in a

plugin's decision and/or response (e.g. multifo), the internal

TTL will generally be the minimum of all involved internal

monitoring TTLs.

*** Service monitoring changes:

* CNAMEs can now be monitored entities in the general sense.

Note that this does not imply resolving external CNAMEs

for direct service checks, at least not with any current

plugins. It just means things like extmon/extfile can

provide custom monitor feedback, and they can be administrated

through the admin_state interface described below.

* plugin_static now also acts as a monitoring plugin. It sets a

fixed up/down value and optionally a fixed internal TTL value.

* The extmon, extfile, static, and null plugins support the

monitoring of CNAME resources.

* The metafo, geoip, and weighted plugins make use of CNAME

monitoring for their CNAME-based resources.

* Monitored service states are now labeled with just their

service_type and address (or CNAME), but not the plugin

and/or resource name which (first) configured them.

* Empty service_types ('service_types = []') is now legal,

and suppresses the use of the default 'up' service_type.

* The 'DANGER' state no longer exists in the built-in monitoring

system. A resource is either 'UP' or 'DOWN' at any given

time. The monitoring algorithms and thresholds haven't

changed; 'DANGER' just isn't exposed as a separate state

from 'UP'.

* plugin_extmon: the value 'fail_once' for the option

'helper_failure_action' no longer exists, as it no longer

makes sense without a visible DANGER state. The new default

is 'stasis'.

* The special service_type 'danger' no longer exists.

* The special service_type 'none' as an alias for 'up' no

longer exists. Use 'up' instead.

* The special default service_type 'default' (which used

plugin_http) no longer exists. The new default is 'up'.

*** Administrative state-forcing:

* All monitored entities can be administratively forced

UP or DOWN (optionally, with a specific monitored TTL) at

runtime.

* Additionally, plugins can register virtual entities which

have no separate real monitoring, but can be administratively

forced into a non-default state.

* The current virtual entities in use are the datacenters of

plugin_metafo and plugin_geoip. In the plugin_geoip case,

there are two levels of state-forcing for datacenters: at

the per-resource level or the map level. The more-specific

per-resource level state takes precedence over the map-

level state, and both override any state from lower-level

monitored (or forced) resources within a datacenter.

* The mechanism for forcing state is via writing to a file

named e.g. /var/lib/gdnsd/admin_state in vscf format

with lines like "192.0.2.*/http => DOWN/300", or

"geoip/map3/dc-us => UP". As shown in the first example,

glob patterns are allowed for matching entity names.

*** Daemonization changes:

* The argument "-d <rootdir>" has been replaced by "-c <cfgdir>",

e.g. "gdnsd -c /etc/gdnsd start", with a default of

${sysconfdir}/gdnsd.

* Two new configuration options for run_dir and state_dir to

override the autoconf-based defaults of e.g. [/var]/run/gdnsd

and /var/lib/gdnsd, respectively. It's probably better to

change these via ./configure args in the normal case; this

is mostly for testsuite-like stuff or multiple instances on

a single machine.

* Direct, inbuilt support for chroot() has been removed. There

are much better security container options out there today that

can be configured externally to wrap gdnsd and/or limit its

privileges. Use them!

* debug-mode is now enabled on the commandline via "-D",

and even production builds now produce some level of

debug log output.

* "startfg" has been replaced with the flag "-f", which can

be used with any of the start or restart -like actions

to remain in the foreground.

* initgroups() is now called during privdrop operations,

allowing the daemon to have the secondary group permissions

assigned to its user in /etc/group or equivalent.

* Foreground daemons participate fully in all other aspects

of daemonization (e.g. privdrop and pidfile locking)

* It is possible to properly restart a daemon instance from

background to foreground and back again; meaning "-f restart"

can take over from a regular daemon into the foreground,

and then a regular "restart" in another terminal can replace

the foreground daemon with a new background one.

* Restarts are now even more seamless than they were before.

All expensive operations are completed before attempting to

kill the previous daemon instance (even monitor initialization),

leaving only the timing gap of waiting for the old daemon to

exit in response to its death signal before binding the

listening sockets in the new daemon, however:

* In cases where SO_REUSEPORT works, the new daemon's listeners

will be bound just *before* sending that death signal to reduce

lost requests even further. Note that you'll probably

still lose a handful of requests that were in the old daemon's

socket buffers at the time of its death.

*** Trivial, previously-deprecated incompatibilities:

* plugin_weighted: no longer allows 'cnames' alongside

'addrs_v4' or 'addrs_v6' in the same resource.

* plugin_weighted: the pointless 'cnames' singleton substanza is

no longer supported; just place the entries directly in the

top level of the resource.

* The 'late_bind_secs' option was removed.

* The 'tcp_clients_per_socket' option is removed. Use

'tcp_clients_per_thread' instead.

* The 'disble_tcp' option is removed. Use 'tcp_threads = 0' instead.

* The 'zones_rfc1035_strict_startup' option is removed. Use

'zones_strict_startup' instead.

* plugin_extmon: %%IPADDR%% replaced by %%ITEM%%

* Direct support for the SPF RR-type (99) has been removed.

*** Other misc incompatibilities

* The plugin API has changed substantially; any third-party

plugins will need substantial source-level updates. See the

gdnsd-plugin-api docs.

* Support for the old, experimental edns-client-subnet option code

0x50fa has been removed; gdnsd now only supports the official,

IANA-assigned option code 0x0008.

*** Build changes

* libcap is no longer used on Linux

* --without-libcap doesn't exist anymore

* --with-rootdir doesn't exist anymore

* Perl 5.8.1+ and "perldoc" is required for building

* Preliminary systemd support via --with-systemd

1.11.5 - 2014-09-10

Bugfixes:

Remove F_PURE from rfc1035 out-of-zone check

This was causing out-of-zone data checks during

the loading of rfc1035 zonefiles to be skipped

sometimes, depending on compiler/optimizations.

Change down_thresh min value from 1 to 2.

The value "1" leads to buggy behavior, and was

never intended to be possible in the state

machine's design.

Only use EPROTO if it's available.

Build-time bugfix for OpenBSD support.

Fix Linux version detection for initial 3.x kernels

Runtime checks of the Linux kernel version

for feature support were failing on 3.x.0 kernel

versions which do not include the ".0" in the

version string.

Deprecations:

extmon: add %%ITEM%%, deprecate %%IPADDR%%

plugin_weighted: deprecate "cnames" stanza

(both of these are to smooth out the 2.x transition)

1.11.4 - 2014-07-18

Major bugfix: The SOA record returned in the auth section of

negative responses (NXDOMAIN and NODATA) had an incorrect TTL.

RFC 2308 says that auth servers should set the SOA record's

own TTL to the minimum of the real SOA TTL and the SOA

"minimum" field (aka ncache field), but gdnsd was simply using

the real SOA TTL and assuming caches looked at the

minimum/ncache field directly (which they do not).

The fallout is that if you specified a minimum/ncache

value of 3H but the TTL of the SOA record itself

was 24H, your negative answers to caches would indicate

that the answer should be cached for 24H. Luckily

many caches limit ncache durations (e.g. BIND9 defaults to

a limit of 3H), mitigating the issue somewhat, but

it's still a pretty big deal.

Bugfix: plugin_geoip was not correctly runtime-reloading

geoip databases from geoip_db_v4_overlay due to a simple

code error, which is now fixed.

1.11.3 - 2014-05-14

Important code fixes: ----------------------------------

GeoIP country code support for South Sudan

(SS) added, to support newer upstream GeoIP data.

GeoIP country code routines updated to handle

unknown country codes more gracefully.

Trivial code fixes: ------------------------------------

Avoid listening on a random pointless socket

when bind() fails on an address from interface scan.

Improved pathname formatting in various error

and warning log outputs.

Fixed two small leaks on failed reloads of plugin_geoip

'nets' database files.

Fixed another small leak on bad resource values

for geoip/metafo RR's in failed zonefiles.

Fixed some bad libev state assertions related to

timers, which may have caused racy failures in rare

cases in debug builds.

Fixed a crash-on-startup when loading certain forms of

invalid configuration input to the meta-plugins.

Build process fixes: -----------------------------------

autoconf detection of pthreads flags on newer

versions of clang improved.

automake use of objects in subdirectories has

been removed, hopefully increasing compatibility.

directory creation during "make install" cleaned up

New deprecations: -------------------------------------

The SPF RR-type has been deprecated and will generate

a warning on zonefile loading.

*** This really will be the very last release of 1.x

before 2.0.0, barring the necessity of serious

bugfixes in the 1.x code. Please pay attention

to the deprecation warnings in your log output;

all of those things will become real issues when

you upgrade to 2.x.

1.11.2 - 2014-02-27

Bugfix: HTTP stats output network send code was horribly

broken in theory, but the bugs were difficult to hit

in practice. Triggering required the combination of

a large-enough set of monitored services and smallish

TCP send buffers, such that the data wouldn't be

completely sent by the first writev() call. Was finally

noticed by someone monitoring 50+ services on a certain

type of VM instance (thanks YTS for the report!)

Bugfix: Stats output buffer calculations made more-robust.

They were too small in some very corner cases, but I

don't believe anyone ever hit this bug; it was found

via source analysis.

Bugfix: plugin_simplefo now works correctly with no

service_types specified (default http checks). This

has been broken for years. Apparently nobody uses it

this way, if at all.

*** This is a good time to re-iterate that v2.0.0 is due

sometime "soon". 2.x will have some substantial

backwards-compatibility breaks with 1.x, especially for

any 3rd party plugin. Anything that currently gives a

deprecation notice in 1.x will be removed/changed in 2.x

for sure, so look out for those in your log output. The

branch is available as it progresses at:

https://github.com/blblack/gdnsd/tree/2.x

1.11.1 - 2014-02-11

Bugfix for plugin_geoip's normalization of "nets" input data.

This bug affected some forms of un-normalized "nets" inputs,

resulting in incorrect responses (or assertfail in debug builds).

The replacement code is much simpler and more reliable, but

also slower.

Build Bugfix: plugins' dependencies on libm were being met

indirectly via libgdnsd's library deps in automake/libtool

terms. However, due to platform variances as to which

math functions are inlined, combined with the "--as-needed"

linker flag, sometimes libm was not linked for libgdnsd,

which could result in plugins not finding math symbols.

This has caused build problems on at least Ubuntu/i386 and

Ubuntu/ppc64el. The fix moved the libm deps to their

proper places in the respective Makefile.am's.

The official tarball download URLs are moving back to github

at https://github.com/blblack/gdnsd/releases/ . The old

location will continue to host the tarballs that exist

there for a while, so as not to disrupt automated things,

and this bugfix release will also be published in both

places just in case.

1.11.0 - 2013-12-06

Bugfixes:-----------

fixed edns-client-subnet issue with configurations that

enclose a geoip resource within a metafo resource: the

metafo plugin would clear the edns scope mask set by

the geoip plugin in this case, but no longer does so.

fixed a segfault that could occur when parsing an illegal

configuration for the metafo and geoip plugins.

misc improvements to warning/error outputs

misc doc fixups

Features/Changes:---

New options 'udp_threads' and 'tcp_threads' (global or

per-listen-address). Both default to 1, which is

the previous behavior. If increased, SO_REUSEPORT

is set on the affected listening sockets, and multiple

sockets are bound to the same address with separate

listening threads. If SO_REUSEPORT is not available

(as is the case for Linux kernels < 3.9), the options

will be forced down to 1.

New option 'zones_strict_data', similar to the old

'strict_data' option, upgrades zone data warnings to

full errors. Defaults false.

New commandline option '-S' temporarily enables

'zones_strict_data' regardless of config-file setting,

mostly useful for 'checkconf'

New commandline option '-s', as above for 'zones_strict_startup'

'listen' option: new values 'any' and 'scan'. 'any' uses

the ANY-addresses (IPv4 + v6 as applicable), and 'scan'

scans the interface list via getifaddrs() and configures

each valid address as a separate listener, which is still

the default behavior. A warning has been added when using

the implicit default 'scan' behavior, indicating that the

default will change to the 'any' behavior in a future

release.

PTR records no longer do additional-section processing, as

per the RFCs (not that any practical config ever made use

of it anyways)

Deprecations:-------

The use of 'cnames' in the same resource as 'addrs_v[46]'

in the 'weighted' plugin is deprecated. Please migrate

away from this by placing the cnames in a separate

resource.

'late_bind_secs' feature is deprecated, and should be

unnecessary now that we fallback to attempting

IP_FREEBIND (or the BSD equivalent) on initial bind()

failure.

'zones_rfc1035_strict_startup' option was renamed to

'zones_strict_startup' with deprecated support for

the old name.

'tcp_clients_per_socket' option was renamed to

'tcp_clients_per_thread' with deprecated support

for the old name.

'tcp_disabled' option deprecated in favor of setting

the new 'tcp_threads' option to zero.

*** NOTE *** Version 2.0.0 will be coming up soon, it could

even potentially be the very next release. 2.0.0 will contain

major feature work related to plugins, and (as the bump of

the leading version number indicates) it won't be a fully

backwards-compatible release.

Most things that have become "deprecated" over the past

several releases will have their backwards-compatibility

removed in 2.0.0, and notably the plugin API will have

substantial changes for any 3rd-party plugin code to

accommodate. You have been warned!

1.10.1 - 2013-10-04

Bugfixes:

A faulty assert() was removed from the plugin_geoip code:

This assert failure could be triggered in a debug build

of the daemon by a carefully crafted request packet, but a

normal cache would never generate such a packet intentionally.

No known problems for non-debug builds (which should include all

"normal" builds from debs/rpms, etc), but if you're running

a debug build on the internet, it can be DoS'd with this.

plugin_geoip "nets" data normalization was buggy when presented

with certain odd sets of un-normalized networks which had

overlapping and/or mergeable subnets in the data. All known cases

are now handled correctly. In the case of a complete conflict

(exact same subnet/mask mapped to two different results explicitly),

the choice between the two variants is arbitrary and a warning is

issued (before, this resulted in load failure).

Removed debugging and gdnsd_geoip_test text output length limitations

on very long dclists.

Fixed a testsuite bug which resulted in a false failure if

the system's /usr/share/GeoIP/ contained database

formats other Country, Region, and City.

1.10.0 - 2013-09-04

Features:

The configuration syntax now supports include files.

Bugfixes:

Responses to type=ANY queries on CNAME RRs were incorrect

per the relevant RFCs. Now they're correct. I don't

believe the broken cases were broken in ways that would

matter for most users in production queries, though.

When the final line of a zonefile contained a data record

with no terminating newline, the unterminated data was

silently ignored. This now produces a proper parse error.

Made testsuite more likely to succeed when run as root,

which is still a bad idea. Also warns loudly in an

effort to reduce bug reports about testsuite failures

when running as root.

Several smaller bugfixes - minor code issues never seen in

the wild, found via valgrind, clang-analyzer, and/or Coverity.

Meta-stuff:

Travis (http://travis-ci.org) support added to automatically

run the build+test process for incoming pull requests

and new pushes to the main branches as well.

Started using Coverity's free scan tool for open source

projects, which has helped spot additional defects.

Moved general info out of README.md and into http://gdnsd.org

hosted on github pages or the INSTALL file as appropriate.

Tarball downloads are now at http://downloads.gdnsd.org as

well, but the old downloads.gdnsd.net URLs will redirect there.

Removed the pkg/ subdirectory and RPM specfiles. I'm not

really using or maintaining these personally anymore, and

they really don't belong in the upstream source anyways, as

there are too many distro/version differences to account for.

Leave that stuff to the distro packagers.

1.9.0 - 2013-07-09

Added support for the new IANA-assigned edns-client-subnet option

code, while keeping backwards compatibility with the deprecated

experimental option code as well.

JSON output format added to the HTTP stats stuff at /json (Tom Walsh)

Autotools dependencies lowered (ac-2.63, am-1.11.1, lt-2.2.6)

Bugfixes:

Weighted plugin didn't always do whole-datacenter failover correctly

when used as a sub-plugin for e.g. metafo/geoip (Alexander Clouter)

RPM specfiles updated for various package bugs (Matthias Saou)

1.8.3 - 2013-05-30

Bugfix: bad default rootdir; did not start without explicit "-d".

This bug was introduced in 1.8.2, and breaks most normal use-cases,

but unfortunately didn't break the testsuite since it always uses -d.

If 1.8.2 was failing to start for you and complaining about a failed

mkdir(), this was why.

Added t/README-NETDNS to the tarballs, was missing due to oversight.

1.8.2 - 2013-05-06

Syslog output improvements on startup, to reduce confusion:

The location of the config file is always logged

Whether the config file was found or not is always logged

The location of the rfc1035 zones directory is always logged

The count of zonefiles loaded from that directory is always logged

The log messages about failures related to ".mtime_test" have

been expanded to be clearer about how unimportant this is.

If the (existing) IPv6 basic socket test peformed at startup fails,

which tends to indicate that IPv6 has been disabled somehow or

other on the host as a whole, the default getifaddrs()-based

interface scanner will now skip over any detected IPv6 interfaces

and log a warning about the condition exactly once. Previously

it would try to bring these up, usually resulting in a fatal error.

Illegal (according to the docs and intent) "listen" option

strings of the form ":port" were succeeding with some

implementations of getaddrinfo(), which would translate

the empty address to "::1". These are now rejected correctly.

The correct way to change the default port while still using

the default interface scanning is to use the "dns_port" option.

Fixed a 64-bit unaligned access issue which cropped up in the

Debian sparc64 port.

Meta-changes (not runtime code):

Various build/test deps improved:

Ragel dep changed from 6.[67] to 6.x

autoconf lowered from 2.69 to 2.68

automake lowered from 1.11.6 to 1.11.3

Tarballs now include autogen.sh and qa/ from the repo

Testsuite made somewhat more resilient against timing

failures on very slow or overloaded hosts

Testsuite now bundles Net::DNS 0.68, and the external

dependency is removed. This solves major compatibility

problems with installed later versions of Net::DNS.

"make install" now creates various empty subdirectories

that might be useful to (or required by) the runtime daemon

"make install" warns if the default privdrop user "gdnsd"

doesn't yet exist.

1.8.1 - 2013-03-14

Bugfix: extmon configurations with more than 255 specific commands

should no longer fail on startup.

Bugfix: code should now work correctly on targets that do not allow

unaligned memory access (e.g. Sparc). 1.8.0 detected this early

in the configure process and aborted the build. Note that the

new solution relies on the non-standard gcc "packed" structure

attribute, which at least some other useful/compatible compilers

support. Patches welcome if this is an issue on others.

A few small doc updates, most notably that our versioning policy

going forward will follow http://semver.org/ , at least for

user-level changes (not necessarily the plugin API very strictly

at this time, due to its documented state of flux).

1.8.0 - 2013-02-04

Start of new stable series, 1.8.x will mostly be just bugfixes.

This entry is just a highlight of the changes from 1.6.x -> 1.8.x.