Semi-automatic update. These checks were performed:
- built on NixOS
- ran `/nix/store/4za086gx5nlvf44i0syc2y6lprhh49kz-nsd-4.1.20/bin/nsd -h` got 0 exit code
- ran `/nix/store/4za086gx5nlvf44i0syc2y6lprhh49kz-nsd-4.1.20/bin/nsd -v` and found version 4.1.20
- ran `/nix/store/4za086gx5nlvf44i0syc2y6lprhh49kz-nsd-4.1.20/bin/nsd -h` and found version 4.1.20
- ran `/nix/store/4za086gx5nlvf44i0syc2y6lprhh49kz-nsd-4.1.20/bin/nsd-checkzone -h` got 0 exit code
- ran `/nix/store/4za086gx5nlvf44i0syc2y6lprhh49kz-nsd-4.1.20/bin/nsd-checkzone -h` and found version 4.1.20
- found 4.1.20 with grep in /nix/store/4za086gx5nlvf44i0syc2y6lprhh49kz-nsd-4.1.20
- found 4.1.20 in filename of file in /nix/store/4za086gx5nlvf44i0syc2y6lprhh49kz-nsd-4.1.20
cc "@hrdinka"
* Fix #1132 for SERVFAIL zones perform backoff, and remembers the timeout on next startup.
* Fix null memcpy for radixtree with single link element.
* Robust fix against missing master in tcp_open for xfrd.
* Fix wildcards in include: config statements with chroot enabled.
* suppress compile warning in lex files.
* Fix to try every master once, then wait for timeout or notify.
* Save backoff timeout into xfrd.state file, this file has a higher version number now. Old files are skipped silently (causes refresh) and created as new files upon exit.
* Fix restart of zone transfers when new config becomes available.
4.1.12
======
Bugfixes
--------
Fix malformed edns query assertion failure, reported by Michal Kepien (NASK).
4.1.11
======
Features
--------
* When tcp is more than half full, use short timeout for tcp session.
* Patch for {max,min}-{refresh,retry}-time from YAMAGUCHI Takanori.
* Fix #790: size-limit-xfr can stop NSD from downloading infinite zone transfer data size, from Toshifumi Sakaguchi. Fixes CVE-2016-6173 JVN#63359718 JPCERT#91251865.
Bugfixes
--------
* Fix build without IPv6, patch from Zdenek Kaspar.
* Fix #783: Trying to run a root server without having configured it silently gives wrong answers.
* Fix #782: Serve DS record but parent zone has no NS record.
* Fix nsec3 missing for nsec3 signed parent and child for DS at zonecut.
4.1.10
======
Features
--------
* ip-freebind: yesno option in nsd.conf sets IP_FREEBIND socket option for Linux, binds to interfaces and addresses that are down.
* NSD includes AAAA before A for queries over IPV6 (in delegations). And TC is set if no glue can be provided with a delegation because of packet size.
* print notice that nsd is starting before taking off.
Bugfixes
--------
* Fix for openssl 1.1.0, HMAC_CTX size not exported from openssl.
* Fix #751: NSD fails to occlude names below a DNAME.
* If set without nsd.db print "" as the default in the man pages.
* Fix #755: NSD spins after a zone update and a lot of TCP queries.
* Fix for NSEC3 with zone signed without exact match for empty nonterminals, the answer for that domain gets closest encloser.
* #772 Document that recvmmsg has IPv6 problems on some linux kernels.
4.1.9
=====
Bugfixes
--------
* Change the nsd.db file version because of nanosecond precision fix.
Features
========
* Fix #732: tcp-mss, outgoing-tcp-mss options for nsd.conf, patch from Daisuke Higashi.
* Fix #739: zonefile changes when mtime is small are detected on reload, if filesystem supports precision mtime values.
* RR type CSYNC (RFC7477) syntax is supported.
Bugfixes
========
* Change the nsd.db file version because of nanosecond precision fix.
* take advantage of arc4random_uniform if available, patch from Loganaden Velvindron.
* Fix flto check for OSX clang.
* Define _DEFAULT_SOURCE with _BSD_SOURCE for glibc 2.20 on Linux.
* Fix #736: segfault during zone transfer.
* Fix #744: Fix that NSD replies for configured but unloaded zone with SERVFAIL, not REFUSED.
The most complex problems were from dealing with switches reverted in
the meantime (gcc5, gmp6, ncurses6).
It's likely that darwin is (still) broken nontrivially.
Allowing to use nixpkgs config to provide different defaults is not
going to help us here, so we would like to use nsd.override {} in order
to supply the correct options in the module.
Eventually removing the nixpkgs config option would make sense here as
well.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
