2 * Imported pyldns contribution by Zdenek Vasicek and Karel Slany.
3 Changed its configure and Makefile to fit into ldns.
4 Added its dname_* methods to the rdf_* class (as is the ldns API).
5 Changed swig destroy of ldns_buffer class to ldns_buffer_free.
6 Declared ldns_pkt_all and ldns_pkt_all_noquestion so swig sees them.
7 * Bugfix: parse PTR target of .tomhendrikx.nl with error not crash.
8 * Bugfix: handle escaped characters in TXT rdata.
9 * bug292: no longer crash on malformed domain names where a label is
10 on position 255, which was a buffer overflow by one.
11 * Fix ldns_get_rr_list_hosts_frm_fp_l (strncpy to strlcpy change),
12 which fixes resolv.conf reading badly terminated string buffers.
13 * Fix ldns_pkt_set_random_id to be more random, and a little faster,
14 it did not do value 0 statistically correctly.
15 * Fix ldns_rdf2native_sockaddr_storage to set sockaddr type to zeroes,
17 * bug295: nsec3-hash routine no longer case sensitive.
18 * bug298: drill failed nsec3 denial of existence proof.
21 * Bugfix: allow for unknown resource records in zonefile with rdlen=0.
22 * Bugfix: also mark an RR as question if it comes from the wire
23 * Bugfix: NSEC3 bitmap contained NSEC
24 * Bugfix: Inherit class when creating signatures
27 * Fix Makefile patch from Havard Eidnes, better install.sh usage.
28 * Fix parse error on SOA serial of 2910532839.
29 Fix print of ';' and readback of '\;' in names, also for '\\'.
30 Fix parse of '\(' and '\)' in names. Also for file read. Also '\.'
31 * Fix signature creation when TTLs are different for RRs in RRset.
32 * bug273: fix so EDNS rdata is included in pkt to wire conversion.
33 * bug274: fix use of c++ keyword 'class' for RR class in the code.
34 * bug275: fix memory leak of packet edns rdata.
35 * Fix timeout procedure for TCP and AXFR on Solaris.
36 * Fix occasional NSEC bitmap bogus
37 * Fix rr comparing (was in reversed order since 1.6.0)
38 * bug278: fix parsing HINFO rdata (and other cases).
39 * Fix previous owner name: also pick up if owner name is @.
40 * RFC5702: enabled sha2 functions by default. This requires OpenSSL 0.9.8 or higher.
41 Reason for this default is the root to be signed with RSASHA256.
42 * Fix various LDNS RR parsing issues: IPSECKEY, WKS, NSAP, very long lines
43 * Fix: Make ldns_dname_is_subdomain case insensitive.
44 * Fix ldns-verify-zone so that address records at zone NS set are not considered glue
45 (Or glue records fall below delegation)
46 * Fix LOC RR altitude printing.
47 * Feature: Added period (e.g. '3m6d') support at explicit TTLs.
48 * Feature: DNSKEY rrset by default signed with minimal signatures
49 but -A option for ldns-signzone to sign it with all keys.
50 This makes the DNSKEY responses smaller for signed domains.
53 * --enable-gost : use the GOST algorithm (experimental).
54 * Added some missing options to drill manpage
55 * Some fixes to --without-ssl option
56 * Fixed quote parsing withing strings
57 * Bitmask fix in EDNS handling
58 * Fixed non-fqdn domain name completion for rdata field domain
60 * Fixed chain validation with SHA256 DS records
64 * Addition of an ldns-config script which gives cflags and libs
65 values, for use in configure scripts for applications that use
66 use ldns. Can be disabled with ./configure --disable-ldns-config
67 * Added direct sha1, sha256, and sha512 support in ldns.
68 With these functions, all NSEC3 functionality can still be
69 used, even if ldns is built without OpenSSL. Thanks to OpenBSD,
70 Steve Reid, and Aaron D. Gifford for the code.
71 * Added reading/writing support for the SPF Resource Record
72 * Base32 functions are now exported
74 * ldns_is_rrset did not go through the complete rrset, but
75 only compared the first two records. Thanks to Olafur
76 Gudmundsson for report and patch
77 * Fixed a small memory bug in ldns_rr_list_subtype_by_rdf(),
78 thanks to Marius Rieder for finding an patching this.
79 * --without-ssl should now work. Make sure that examples/ and
80 drill also get the --without-ssl flag on their configure, if
82 * Some malloc() return value checks have been added
83 * NSEC3 creation has been improved wrt to empty nonterminals,
85 * Fixed a bug in the parser when reading large NSEC3 salt
87 * Made the allowed length for domain names on wire
88 and presentation format the same.
90 * ldns-key2ds can now also generate DS records for keys without
92 * ldns-signzone now equalizes the TTL of the DNSKEY RRset (to
93 the first non-default DNSKEY TTL value it sees)
97 * ldns-signzone was broken in 1.5.0 for multiple keys, this
101 * Removed a small erroneous output warning in
102 examples/configure and drill/configure
106 * fixed a possible memory overflow in the RR parser
107 * build flag fix for Sun Studio
108 * fixed a building race condition in the copying of header
110 * EDNS0 extended rcode; the correct assembled code number
111 is now printed (still in the EDNS0 field, though)
112 * ldns_pkt_rr no longer leaks memory (in fact, it no longer
116 * ldns_key now has support for 'external' data, in which
117 case the OpenSSL EVP structures are not used;
118 ldns_key_set_external_key() and ldns_key_external_key()
119 * added ldns_key_get_file_base_name() which creates a
120 'default' filename base string for key storage, of the
121 form "K<zone>+<algorithm>+<keytag>"
122 * the ldns_dnssec_* family of structures now have deep_free()
123 functions, which also free the ldns_rr's contained in them
124 * there is now an ldns_match_wildcard() function, which checks
125 whether a domain name matches a wildcard name
126 * ldns_sign_public has been split up; this resulted in the
127 addition of ldns_create_empty_rrsig() and
128 ldns_sign_public_buffer()
131 * ldns-signzone can now automatically add DNSKEY records when
132 using an OpenSSL engine, as it already did when using key
134 * added new example tool: ldns-nsec3-hash
135 * ldns-dpa can now filter on specific query name and types
136 * ldnsd has fixes for the zone name, a fix for the return
137 value of recvfrom(), and an memory initialization fix
138 (Thanks to Colm MacCárthaigh for the patch)
139 * Fixed memory leaks in ldnsd
145 * fixed a build issue where ldns lib existence was done too early
146 * removed unnecessary check for pcap.h
147 * NSEC3 optout flag now correctly printed in string output
148 * inttypes.h moved to configured inclusion
149 * fixed NSEC3 type bitmaps for empty nonterminals and unsigned
153 * for that last fix, we added a new function
154 ldns_dname_add_from() that can clone parts of a dname
158 * sig chase return code fix (patch from Rafael Justo, bug id 189)
159 * rdata.c memory leaks on error and allocation checks fixed (patch
160 from Shane Kerr, bug id 188)
161 * zone.c memory leaks on error and allocation checks fixed (patch
162 from Shane Kerr, bug id 189)
163 * ldns-zplit output and error messages fixed (patch from Shane Kerr,
165 * Fixed potential buffer overflow in ldns_str2rdf_dname
166 * Signing code no longer signs delegation NS rrsets
167 * Some minor configure/makefile updates
168 * Fixed a bug in the randomness initialization
169 * Fixed a bug in the reading of resolv.conf
170 * Fixed a bug concerning whitespace in zone data (with patch from Ondrej
172 * Fixed a small fallback problem in axfr client code
175 * added 2str convenience functions:
178 - ldns_rr_type2buffer_str
179 - ldns_rr_class2buffer_str
180 * buffer2str() is now called ldns_buffer2str
181 * base32 and base64 function names are now also prepended with ldns_
182 * ldns_rr_new_frm_str() now returns an error on missing RDATA fields.
183 Since you cannot read QUESTION section RRs with this anymore,
184 there is now a function called ldns_rr_new_question_frm_str()
187 * DS RRs string representation now add bubblebabble in a comment
188 (patch from Jakob Schlyter)
190 * TCP fallback system has been improved
191 * HMAC-SHA256 TSIG support has been added.
192 * TTLS are now correcly set in NSEC(3) records when signing zones
195 * New example: ldns-revoke to revoke DNSKEYs according to RFC5011
196 * ldns-testpkts has been fixed and updated
197 * ldns-signzone now has the option to not add the DNSKEY
198 * ldns-signzone now has an (full zone only) opt-out option for
200 * ldns-keygen can create HMAC-SHA1 and HMAC-SHA256 symmetric keys
201 * ldns-walk output has been fixed
202 * ldns-compare-zones has been fixed, and now has an option
203 to show all differences (-a)
204 * ldns-read-zone now has an option to print DNSSEC records only
209 * Added a new family of functions based around ldns_dnssec_zone,
210 which is a new structure that keeps a zone sorted through an
211 rbtree and links signatures and NSEC(3) records directly to their
212 RRset. These functions all start with ldns_dnssec_
214 * ldns_zone_sign and ldns_zone_sign_nsec3 are now deprecated, but
215 have been changed to internally use the new
216 ldns_dnssec_zone_sign(_nsec3)
218 * Moved some ldns_buffer functions inline, so a clean rebuild of
219 applications relying on those is needed (otherwise you'll get
221 * ldns_dname_label now returns one extra (zero)
222 byte, so it can be seen as an fqdn.
223 * NSEC3 type code update for signing algorithms.
224 * DSA key generation of DNSKEY RRs fixed (one byte too small).
226 * Added support for RSA/SHA256 and RSA/SHA512, as specified in
227 draft-ietf-dnsext-dnssec-rsasha256-04. The typecodes are not
228 final, and this feature is not enabled by default. It can be
229 enabled at compilation time with the flag --with-sha2
231 * Added 2wire_canonical family of functions that lowercase dnames
232 in rdata fields in resource records of the types in the list in
235 * Added base32 conversion functions.
237 * Fixed DSA RRSIG conversion when calling OpenSSL
241 * Chase output is completely different, it shows, in ascii, the
242 relations in the trust hierarchy.
245 * Added ldns-verify-zone, that can verify the internal DNSSEC records
246 of a signed BIND-style zone file
248 * ldns-keygen now takes an -a argument specifying the algorithm,
249 instead of -R or -D. -a list show a list of supported algorithms
251 * ldns-keygen now defaults to the exponent RSA_F4 instead of RSA_3
252 for RSA key generation
254 * ldns-signzone now has support for HSMs
255 * ldns-signzone uses the new ldns_dnssec_ structures and functions
256 which improves its speed, and output; RRSIGS are now placed
257 directly after their RRset, NSEC(3) records directly after the
261 * new contrib/ dir with user contributions
262 * added compilation script for solaris (thanks to Jakob Schlyter)
265 * Added support for HMAC-MD5 keys in generator
266 * Added a new example tool (written by Ondrej Sury): ldns-compare-zones
267 * ldns-keygen now checks key sizes for rfc conformancy
268 * ldns-signzone outputs SSL error if present
269 * Fixed manpages (thanks to Ondrej Sury)
270 * Fixed Makefile for -j <x>
271 * Fixed a $ORIGIN error when reading zones
272 * Fixed another off-by-one error
275 * Fixed an offset error in rr comparison
276 * Fixed ldns-read-zone exit code
277 * Added check for availability of SHA256 hashing algorithm
278 * Fixed ldns-key2ds -2 argument
279 * Fixed $ORIGIN bug in .key files
280 * Output algorithms as an integer instead of their mnemonic
281 * Fixed a memory leak in dnssec code when SHA256 is not available
282 * Updated fedora .spec file
285 * canonicalization of rdata in DNSSEC functions now adheres to the
286 rr type list in rfc3597, not rfc4035, which will be updated
287 (see http://www.ops.ietf.org/lists/namedroppers/namedroppers.2007/msg00183.html)
288 * ldns-walk now support dnames with maximum label length
289 * ldnsd now takes an extra argument containing the address to listen on
290 * signing no longer signs every rrset with KSK's, but only the DNSKEY rrset
291 * ported to Solaris 10
292 * added ldns_send_buffer() function
293 * added ldns-testpkts fake packet server
294 * added ldns-notify to send NOTIFY packets
295 * ldns-dpa can now accurately calculate the number of matches per
297 * libtool is now used for compilation too (still gcc, but not directly)
299 - TSIG signing buffer size
300 - resolv.conf reading (comments)
301 - dname comparison off by one error
302 - typo in keyfetchers output file name fixed (a . too much)
303 - fixed zone file parser when comments contain ( or )
308 * drill prints error on failed axfr.
309 * drill now accepts mangled packets with -f
310 * old -c option (use tcp) changed to -t
311 * -c option to specify alternative resolv.conf file added
312 * feedback of signature chase improved
313 * chaser now stops at root when no trusted keys are found
314 instead of looping forever trying to find the DS for .
316 - wildcard on multiple labels signature verification
317 - error in -f packet writing for malformed packets
318 - made KSK check more resilient
320 7 Jul 2006: 1.1.0: ldns-team
321 * Added tutorials and an introduction to the documentation
322 * Added include/ and lib/ dirs so that you can compile against ldns
323 without installing ldns on your system
325 * Starting usage of assert throughout the library to catch illegal calls
326 * Solaris 9 testing was carried out. Ldns now compiles on that
327 platform; some gnuism were identified and fixed.
328 * The ldns_zone structure was stress tested. The current setup
329 (ie. just a list of rrs) can scale to zone file in order of
330 megabytes. Sorting such zone is still difficult.
331 * Reading multiline b64 encoded rdata works.
332 * OpenSSL was made optional, configure --without-ssl.
333 Ofcourse all dnssec/tsig related functions are disabled
334 * Building of examples and drill now happens with the same
335 defines as the building of ldns itself.
336 * Preliminary sha-256 support was added. Currently is your
337 OpenSSL supports it, it is supported in the DS creation.
338 * ldns_resolver_search was implemented
339 * Fixed a lot of bugs
342 * -r was killed in favor of -o <header bit mnemonic> which
343 allows for a header bits setting (and maybe more in the
345 * DNSSEC is never automaticaly set, even when you query
346 for DNSKEY/RRSIG or DS.
347 * Implement a crude RTT check, it now distinguishes between
348 reachable and unreachable.
349 * A form of secure tracing was added
350 * Secure Chasing has been improved
351 * -x does a reverse lookup for the given IP address
354 * ldns-dpa was added to the examples - this is the Dns Packet
356 * ldnsd - as very, very simple nameserver impl.
357 * ldns-zsplit - split zones for parrallel signing
358 * ldns-zcat - cat split zones back together
359 * ldns-keyfetcher - Fetches DNSKEY records with a few (non-strong,
360 non-DNSSEC) anti-spoofing techniques.
361 * ldns-walk - 'Walks' a DNSSEC signed zone
362 * Added an all-static target to the makefile so you can use examples
363 without installing the library
364 * When building in the source tree or in a direct subdirectory of
365 the build dir, configure does not need --with-ldns=../ anymore
368 * All networking code was moved to net.c
369 * rdata.c: added asserts to the rdf set/get functions
370 * const keyword was added to pointer arguments that
375 * renamed ldns/dns.h to ldns/ldns.h
376 * ldns_rr_new_frm_str() is extented with an extra variable which
377 in common use may be NULL. This trickles through to:
379 o ldns_rr_new_frm_fp_l
380 Which also get an extra variable
381 Also the function has been changed to return a status message.
382 The compiled RR is returned in the first argument.
383 * ldns_zone_new_frm_fp_l() and ldns_zone_new_frm_fp() are
384 changed to return a status msg.
385 * ldns_key_new_frm_fp is changed to return ldns_status and
386 the actual key list in the first argument
387 * ldns_rdata_new_frm_fp[_l]() are changed to return a status.
388 the rdf is return in the first argument
389 * ldns_resolver_new_frm_fp: same treatment: return status and
390 the new resolver in the first argument
391 * ldns_pkt_query_new_frm_str(): same: return status and the
392 packet in the first arg
393 * tsig.h: internal used functions are now static:
394 ldns_digest_name and ldns_tsig_mac_new
395 * ldns_key_rr2ds has an extra argument to specify the hash to
397 * ldns_pkt_rcode() is renamed to ldns_pkt_get_rcode, ldns_pkt_rcode
398 is now the rcode type, like ldns_pkt_opcode
400 * ldns_resolver_searchlist_count: return the searchlist counter
401 * ldns_zone_sort: Sort a zone
402 * ldns_bgsend(): background send, returns a socket.
403 * ldns_pkt_empty(): check is a packet is empty
404 * ldns_rr_list_pop_rr_list(): pop multiple rr's from another rr_list
405 * ldns_rr_list_push_rr_list(): push multiple rr's to an rr_list
406 * ldns_rr_list_compare(): compare 2 ldns_rr_lists
407 * ldns_pkt_push_rr_list: rr_list equiv for rr
408 * ldns_pkt_safe_push_rr_list: rr_list equiv for rr
410 * ldns_resolver_bgsend(): was not used in 1.0.0 and is not used now
411 * ldns_udp_server_connect(): was faulty and isn't really part of
412 the core ldns idea any how.
413 * ldns_rr_list_insert_rr(): obsoleted, because not used.
414 * char *_when was removed from the ldns_pkt structure
416 18 Oct 2005: 1.0.0: ldns-team
417 * Commited a patch from Håkan Olsson
418 * Added UPDATE support (Jakob Schlyter and Håkan Olsson)
419 * License change: ldns is now BSD licensed
420 * ldns now depends on SSL
421 * Networking code cleanup, added (some) server udp/tcp support
422 * A zone type is introduced. Currently this is a list
423 of RRs, so it will not scale well.
424 * [beta] Zonefile parsing was added
425 * [tools] Drill was added to ldns - see drill/
426 * [tools] experimental signer was added
427 * [building] better check for ssl
428 * [building] major revision of build system
429 * [building] added rpm .spec in packaging/ (thanks to Paul Wouters)
430 * [building] A lot of cleanup in the build scripts (thanks to Jakob Schlyter
433 28 Jul 2005: 0.70: ldns-team
434 * [func] ldns_pkt_get_section now returns copies from the rrlists
435 in the packet. This can be freed by the user program
436 * [code] added ldns_ prefixes to function from util.h
437 * [inst] removed documentation from default make install
438 * Usual fixes in documentation and code
440 20 Jun 2005: 0.66: ldns-team
441 Rel. Focus: drill-pre2 uses some functions which are
443 * dnssec_cd bit function was added
444 * Zone infrastructure was added
445 * Usual fixes in documentation and code
447 13 Jun 2005: 0.65: ldns-team
448 * Repository is online at:
449 http://www.nlnetlabs.nl/ldns/svn/
450 * Apply reference copying throuhgout ldns, except in 2
451 places in the ldns_resolver structure (._domain and
453 * Usual array of bugfixes
454 * Documentation added
455 * keygen.c added as an example for DNSSEC programming
457 23 May 2005: 0.60: ldns-team
458 * Removed config.h from the header installed files
459 (you're not supposed to include that in a libary)
461 - DNSSEC signing/verification works
462 - Assorted bug fixes and tweaks (memory management)
464 May 2005: 0.50: ldns-team
465 * First usable release
466 * Basic DNS functionality works
467 * DNSSEC validation works