Changeset 1921

Show
Ignore:
Timestamp:
01/27/11 23:20:36 (2 years ago)
Author:
ahu
Message:

release notes for 3.0

Files:
1 modified

Legend:

Unmodified
Added
Removed

  • trunk/pdns/pdns/docs/pdns.xml

    r1917 r1921  
    116116      </para> 
    117117      <para> 
    118         Other major new features include: 
     118        This release has received exceptional levels of community support, and we'd like to thank the following people  
     119        in addition to those mentioned explicitly below: 
     120        Peter Koch (DENIC), Olaf Kolkman (NLNetLabs), Wouter Wijngaards (NLNetLabs), Marco Davids (SIDN), Markus Travaille (SIDN), 
     121        Antoin Verschuren (SIDN), Olafur Gudmundsson (IETF), Dan Kaminsky (Recursion Ventures), Roy Arends (Nominet),   
     122        Miek Gieben (SIDN), Stephane Bortzmeyer (AFNIC), Michael Braunoeder (nic.at), Peter van Dijk, Maik Zumstrull, 
     123        Jose Arthur Benetasso Villanova (Locaweb), Stefan Schmidt, Roland van Rijswijk (Surfnet), Paul Bakker (Brainspark/Fox-IT), 
     124        Mathew Hennessy, Johannes Kuehrer (Austrian World4You GmbH), Marc van de Geijn (bHosted.nl), Stefan Arentz and  
     125        Martin van Hensbergen (Fox-IT) 
     126      </para> 
     127      <para> 
     128        On to the release notes. Next to DNSSEC, other major new features include: 
    119129      </para> 
    120130      <para> 
    121131      <itemizedlist> 
    122132        <listitem> 
    123          
    124133          <para> 
    125134            Long TXT records are now split into 255-byte components automatically. Implemented in c1340, reported by Darren Gamble 
    … …  
    127136          </para> 
    128137        </listitem> 
     138        <listitem> 
     139          <para> 
     140            Per zone AXFR ACLs, implemented in c1360. 
     141          </para> 
     142        </listitem> 
     143        <listitem> 
     144          <para> 
     145            "Also-notify" support, implemented by Aki Tuomi in c1400. Support for Generic SQL backends and  
     146            for the BIND backend. 
     147          </para> 
     148        </listitem> 
     149        <listitem> 
     150          <para> 
     151            Support for binding to thousands of IP addresses, code in c1443. 
     152          </para> 
     153        </listitem> 
     154        <listitem> 
     155          <para> 
     156            Massively parallel slaving infrastructure, able to check the freshness of thousands of remote 
     157            zones per second, plus perform many incoming zone transfers simultaneously. Sponsored by Tyler Hall, 
     158            code in C1449, C1500, C1859 
     159          </para> 
     160        </listitem> 
     161        <listitem> 
     162          <para> 
     163            Core DNS logic replaced completely to deal with the brave new world of DNSSEC.  
     164          </para> 
     165        </listitem> 
     166         
    129167      </itemizedlist> 
    130168      Bugs fixed: 
    … …  
    132170        <listitem> 
    133171          <para> 
    134             .. 
     172            sqlite2 and sqlite3 backends used MySQL-style escaping, leading to SQL 
     173errors in some cases. Discovered by Sten Spans. Fixed in c1342. 
     174          </para> 
     175        </listitem> 
     176        <listitem> 
     177          <para> 
     178            Internal webserver no longer prints '1e2%'. Bug rediscovered by Jeff Sipek. Fixed in c1342. 
     179          </para> 
     180        </listitem> 
     181        <listitem> 
     182          <para> 
     183            In some cases, we would include duplicate CNAMEs. In addition, we would hand out 
     184            a full root-referral when not configured to in some cases (t223). Discovered by Andreas Jakum, fixed in c1344. 
     185          </para> 
     186        </listitem> 
     187        <listitem> 
     188          <para> 
     189            Shane Kerr discovered we would corrupt DNS transaction IDs from the packet cache on big endian systems. 
     190            Fix in c1346, closing t222. 
     191          </para> 
     192        </listitem> 
     193        <listitem> 
     194          <para> 
     195            BIND backend got confused of a zone's filename changed after a configuration reload.  
     196            Fix in c1347, closing t228. 
     197          </para> 
     198        </listitem> 
     199        <listitem> 
     200          <para> 
     201            When restarted by the Guardian, PowerDNS will perform a full multi-threaded cache cleanup, which  
     202            took a long time and could crash. Fix in c1364. 
     203          </para> 
     204        </listitem> 
     205        <listitem> 
     206          <para> 
     207            Under artificial circumstances, PowerDNS would never clean its packet cache. Found by Marcus Goller, fix in 
     208            c1399 and c1408. This update also retunes the cleanup frequency. 
     209          </para> 
     210        </listitem> 
     211        <listitem> 
     212          <para> 
     213            Packetcache would cache things it should not have been caching. Fixes in commits C1407, C1488, C1869, C1880 
     214          </para> 
     215        </listitem> 
     216        <listitem> 
     217          <para> 
     218            When processing incoming notifications, the BIND backend was case-sensitive, and would disregard 
     219            notifications in the wrong case. Discovered by 'Dolphin', fix in c1420. 
     220          </para> 
     221        </listitem> 
     222        <listitem> 
     223          <para> 
     224            The init.d script did not mention the 'reload' command. Code in c1463, closes t233. 
     225          </para> 
     226        </listitem> 
     227        <listitem> 
     228          <para> 
     229            PowerDNS would be confused by embedded NULs in domain names, and would also 
     230            mess up the escaping of some characters. Fix in c1468, c1469, c1478, c1480,  
     231          </para> 
     232        </listitem> 
     233        <listitem> 
     234          <para> 
     235            SOA queries for the name of a delegation point were not referred. Fix in c1466, closing t224. 
     236            In addition, queries for AAAA for a CNAMEd record pointing to a name with no AAAA would deliver  
     237            a direct SOA, without the CNAME in between. Fix in c1542, c1607. 
     238            Also, wildcard CNAMEs pointing to a record without the type requested suffered from the same issue, fix in c1543. 
     239          </para> 
     240        </listitem> 
     241        <listitem> 
     242          <para> 
     243            On processing an incoming AXFR, once an MX or SRV record had been seen, all future fields 
     244            got a 'priority' entry as well. This had no operational impact, but looked messy. Fixed in c1437. 
     245          </para> 
     246        </listitem> 
     247        <listitem> 
     248          <para> 
     249            Aki Tuomi discovered that the BIND zonefile parser would misrepresent 'something IN MX 15 @'. Fix in c1621. 
     250          </para> 
     251        </listitem> 
     252        <listitem> 
     253          <para> 
     254            Marco Davids discovered the BIND zonefile parser would trip over really long lines. Fix in c1624, c1625. 
     255          </para> 
     256        </listitem> 
     257        <listitem> 
     258          <para> 
     259            Thomas Mieslinger discovered that our webserver would only be started after dropping privileges, 
     260            which could cause problems. Fix in c1629. 
     261          </para> 
     262        </listitem> 
     263        <listitem> 
     264          <para> 
     265            An Ubuntu user discovered in Launchpad bug 600479 that restarting database threads 
     266            cost a lot of memory. Normally this is rare, except in case of problems. Addressed in c1676.  
     267          </para> 
     268        </listitem> 
     269        <listitem> 
     270          <para> 
     271            BIND backend could crash under (very) high load with very large numbers of zones (hundreds of thousands). 
     272            Fixed in c1690. 
     273          </para> 
     274        </listitem> 
     275        <listitem> 
     276          <para> 
     277            Miek Gieben and Marco Davids spotted that PowerDNS would answer the version.bind query in the IN class too. 
     278            Bug reported via twitter! Fix in c1709. 
     279          </para> 
     280        </listitem> 
     281        <listitem> 
     282          <para> 
     283            Marcus Lauer and the OpenDNSSEC project discovered that outgoing notifications did not carry the 'aa' flag. 
     284            Fixed in c1746. 
     285          </para> 
     286        </listitem> 
     287        <listitem> 
     288          <para> 
     289            Debugging PowerDNS, or backgrounding it, could cause crashes. Fixed by Anders Kaseorg in c1747. 
     290          </para> 
     291        </listitem> 
     292        <listitem> 
     293          <para> 
     294            Fixed a bug that could cause crashes on launching thousands of backend connections. Never observed to occur, 
     295            but who knows. Fix in c1792. 
     296          </para> 
     297        </listitem> 
     298        <listitem> 
     299          <para> 
     300            Under some circumstances, large answers could be truncated in mid-record. While technically legal, 
     301            this upset a number of resolver implementations (including the PowerDNS Recursor!). Fixed in c1830, re-closes 
     302            t200. 
    135303          </para> 
    136304        </listitem> 
    … …  
    140308        <listitem> 
    141309          <para> 
    142             .. 
     310            Fixed compilation on newer compilers and newer versions of Boost.  
     311            Changes in C1345 (t227), C1391, C1394, C1425, C1427, C1428, C1429, C1440, C1653, thanks to Ruben Kerkhof and others. 
    143312          </para> 
    144313        </listitem> 
     314        <listitem> 
     315          <para> 
     316            Compilation fixes for Mac OS X 10.5.7 in c1389, thanks to Tobias Markmann. 
     317          </para> 
     318        </listitem> 
     319        <listitem> 
     320          <para> 
     321            Allow for timestamps to explicitly be specified in (s)econds. Code in c1398, closing t250. 
     322          </para> 
     323        </listitem> 
     324        <listitem> 
     325          <para> 
     326            Internal support for TSIG, not yet hooked up. Commits C1417, C1485 and beyond. 
     327          </para> 
     328        </listitem> 
     329         
     330        <listitem> 
     331          <para> 
     332            Zones with URL and MBOXFW records can be transferred over AXFR, code in c1464. 
     333          </para> 
     334        </listitem> 
     335         
     336        <listitem> 
     337          <para> 
     338            Maik Zumstrull cleaned up the BIND Backend makefile, plus taught our init.d script to read /etc/default/pdns. 
     339            Code in c1601, c1602. 
     340          </para> 
     341        </listitem> 
     342         
     343        <listitem> 
     344          <para> 
     345            Generic SQL backends now support multiple masters in the domains table. Code in c1857. Additionally, 
     346            masters can also have :port numbers. Code in c1858. 
     347          </para> 
     348        </listitem> 
     349         
    145350      </itemizedlist> 
    146351      </para> 
    … …  
    90259230  </para> 
    90269231  <para> 
    9027     In PowerDNSSEC, DNS and signatures and keys are treated as separate entities. The domain &amp; record 
     9232    In PowerDNSSEC, DNS and signatures and keys are (usually) treated as separate entities. The domain &amp; record 
    90289233    storage is thus almost completely devoid of DNSSEC record types. 
    90299234  </para> 
    … …  
    90439248$ pdnssec rectify-zone     
    90449249    </screen> 
     9250  </para> 
     9251  <para> 
     9252    Alternatively, PowerDNS can serve pre-signed zones, without knowledge of private keys. 
    90459253  </para> 
    90469254  <section id="dnssec-introduction"> 
    … …  
    92199427      PowerDNS needs to know if a zone should receive DNSSEC processing. To configure, run 'pdnssec set-presigned zone'. 
    92209428    </para> 
     9429    <para><warning><para>Right now, you will also need to configure NSEC(3) settings for pre-signed zones using 'pdnssec set-nsec3'. Default 
     9430    is NSEC, in which case no further configuration is necessary.</para></warning></para> 
    92219431    </section> 
    92229432    <section id="dnssec-dnssec-migration-live"><title>From existing DNSSEC non-PowerDNS setups, live signing</title> 
    … …  
    94159625                Sets NSEC3 parameters for this zone. A sample commandline is: "pdnssec set-nsec3 powerdnssec.org '1 0 1 ab' narrow". 
    94169626                The NSEC3 parameters must be quoted on the command line. 
    9417                 WARNING: This requires updating the 'DS" over at the parent zone! 
     9627                <warning><para>If running in RSASHA1 mode (algorithm 5 or 7), switching from NSEC to NSEC3 will require a DS update at the parent zone! </para></warning> 
    94189628              </para> 
    94199629            </listitem> 
    … …  
    94399649            <listitem> 
    94409650              <para> 
    9441                 Converts a zone to NSEC operations. WARNING: This requires updating the 'DS" over at the parent zone! 
     9651                Converts a zone to NSEC operations.  
     9652                <warning><para>If running in RSASHA1 mode (algorithm 5 or 7), switching from NSEC to NSEC3 will require a DS update at the parent zone! </para></warning> 
    94429653              </para> 
    94439654            </listitem> 
    … …  
    94539664      </variablelist> 
    94549665    </para> 
     9666  </section> 
     9667  <section id="dnssec-advice-precautions"> 
     9668  <title>DNSSEC advice &amp; precautions</title> 
     9669  <para> 
     9670    DNSSEC is a major change in the way DNS works. Furthermore, there is a bewildering array of settings  
     9671    that can be configured.  
     9672  </para> 
     9673  <para> 
     9674    It is well possible to configure DNSSEC in such a way that your domain will not operate reliably, or even, at all. 
     9675  </para> 
     9676  <para> 
     9677    We advise operators to stick to the keying defaults of 'pdnssec secure-zone': RSASHA256 (algorithm 8), 
     9678    1 Key Signing Key of 2048 bits, 1 active Zone Signing Key of 1024 bits, 1 passive Zone Signing Key of 1024 bits. 
     9679  </para> 
     9680  <para> 
     9681    While the 'GOST' and 'ECDSA' algorithms are better choices in theory, not many DNSSEC resolvers can validate answers 
     9682    signed with such keys. Much the same goes for RSASHA512, except that it does not offer better performance either. 
     9683  </para> 
     9684  <para> 
     9685    <note><para>GOST may be more widely available in Russia, because it might be mandatory to implement this regional standard there.</para></note> 
     9686  </para> 
     9687  <para> 
     9688    It is possible to operate a zone with different keying algorithms simultaneously, but it has also been observed that this is not reliable. 
     9689  </para> 
     9690  <section id="dnssec-packet-size-tcp"><title>Packet sizes, fragments, TCP/IP service</title> 
     9691  <para> 
     9692    DNSSEC answers contain (bulky) keying material and signatures, and are therefore a lot larger than regular DNS answers. 
     9693    Normal DNS responses almost always fit in the 'magical' 512 byte limit previously imposed on DNS. 
     9694  </para> 
     9695  <para> 
     9696    In order to support DNSSEC, operators must make sure that their network allows for: 
     9697    <itemizedlist> 
     9698      <listitem><para>&gt;512 byte UDP packets on port 53</para></listitem> 
     9699      <listitem><para>Fragmented UDP packets</para></listitem> 
     9700      <listitem><para>ICMP packets related to fragmentation</para></listitem> 
     9701      <listitem><para>TCP queries on port 53</para></listitem> 
     9702      <listitem><para>EDNS0 queries/responses (filtered by some firewalls)</para></listitem> 
     9703    </itemizedlist> 
     9704  </para> 
     9705  <para> 
     9706    If any of the conditions outlined above is not met, DNSSEC service will suffer or be completely unavailable. 
     9707  </para> 
     9708  <para> 
     9709    In addition, the larger your DNS answers, the more critical the above becomes. It is therefore advised not to provision too many keys, 
     9710    or keys that are unneccessarily large. 
     9711  </para> 
     9712  </section> 
    94559713  </section> 
    94569714  <section id="dnssec-operational-doctrine"> 
    … …  
    96289886    <listitem><para>Stefan Arentz</para></listitem> 
    96299887    <listitem><para>Martin van Hensbergen (Fox-IT)</para></listitem> 
     9888    <listitem><para>Christoph Meerwald</para></listitem> 
    96309889    <listitem><para>.. this list is far from complete yet .. </para></listitem> 
    96319890    </itemizedlist>