From jannik at nlnetlabs.nl Wed Sep 3 08:35:01 2025 From: jannik at nlnetlabs.nl (Jannik Peters) Date: Wed, 03 Sep 2025 10:35:01 +0200 Subject: [nsd-users] NSD 4.13.0 release Message-ID: Dear all, NSD 4.13.0 release is available: https://nlnetlabs.nl/downloads/nsd/nsd-4.13.0.tar.gz sha256 83181b9cfee9495076f124926b28259e7f3911c4da80e17883c211c7e17cd04e pgp https://nlnetlabs.nl/downloads/nsd/nsd-4.13.0.tar.gz.asc This release enables some commonly used features by default, and introduces experimental support for AF_XDP sockets that can be enabled with the `--enable-xdp` feature flag (see https://nsd.docs.nlnetlabs.nl/en/latest/xdp.html). 4.13.0 ================ FEATURES: - Use '(all)' and '(none)' for the socket server affinity log output instead of '*' and '-'. - The --enable-bind8-stats feature, was already enabled by default, is described as enabled by default in usage. - The --enable-zone-stats feature is enabled by default. It can be turned on with config like `zonestats: "%s"`. - The --enable-ratelimit feature is enabled by default. The ratelimit value is off by default. It can be turned on with config like `rrl-ratelimit: 200`. - The --enable-dnstap feature is enabled by default. If fstrm-devel or protobuf-c are not found by configure it prints an error. It can be turned on with config like `dnstap-enable: yes`. - Change default for send-buffer-size to 4m, to mitigate a cross-layer issue where the UDP socket send buffers are exhausted waiting for ARP/NDP resolution. Thanks to Reflyable for the report. - Disable TLSv1.2 if TLSv1.3 is available. - Merge #449: Add useful logging for XoT transfers. - Merge #425: Add experimental XDP (AF_XDP) support for UDP traffic - Merge #455: --with-dbdir option for configure to set the base directory for the xfrd zone timer state file, the zone list file and the cookie secrets file. Thanks Simon Josefsson. - Merge #456: Spelling fixes in metrics.c. Thanks Simon Josefsson. BUG FIXES: - Fix punctuation of nsd -h output for the -a option. - Fix checkconf unit test for when metrics are not enabled. - Prometheus metrics tests require --enable-zone-stats. - Add unit test for socket server affinity log output. - Move xfrd-tcp unit test to its own file. - Fix contrib/nsd.spec to omit configure flags that are default or that do not exist. - Fix to remove mention of obsolete root-server option. - Fix mention of draft-rrtypes and root-server configure options. - Fix ci workflow for enable dnstap. - Fix to remove use of sprintf from metrics. - Fix for fstrm and protobuf-c for ci workflow coverity-scan. - Fix for parallel build of dnstap protoc-c output. - Fix to remove unneeded mkdir from Makefile. - Fix dnstap to use protoc and keep dnstap_config.h unchanged if possible. - Fix to provide doc for --enable-systemd. - Fix to remove debug printout for configure dnstap header. - Fix #441: SystemD script for NSD prevents using chroot. - Fix to add checks for compression pointers and too long dnames in internal dname routines, dname_make and ixfr dname_length. - Fix to remove shell assignment operator from Makefile for DATE. - make depend. - Fix bitwise operators in conditional expressions with parentheses. - Fix conditional expressions with parentheses for bitwise and. - Merge #445: contrib/nsd.openrc.in: use supervise-daemon and add `need net`. - Fix #446 nsd_size_db_in_mem_bytes (size.db.mem) metric not updated on reload. - Merge #447: Minimize disruptions on reconfig. - For #447: Updated simdzone to latest commit. With the padding test changes. - For #447: use need_to_send_reload to detect if a reload is issued. - For #447: acl_list_equal already tests for TSIG key changes, so removed the duplicate checks. - For #447: log crypto error with the SSL_write error. - Update simdzone with support for --enable-pie. - Merge #454 from jaredmauch: handle rare case but seen in production where data->query is NULL. simdzone 0.2.3 ================ FEATURES: - check_pie: match nsd support (#253). BUG FIXES: - Fix tests to initialize padding (#252). - Fix for #253, add acx_nlnetlabs.m4 in the repo and allow CFLAGS passed to configure to set the flags. -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 228 bytes Desc: not available URL: From jannik at nlnetlabs.nl Wed Sep 3 08:40:03 2025 From: jannik at nlnetlabs.nl (Jannik Peters) Date: Wed, 03 Sep 2025 10:40:03 +0200 Subject: [nsd-users] NSD 4.13.0rc1 pre-release In-Reply-To: <88216604-9231-476c-a60a-654bb9e207fc@andreasschulze.de> References: <88216604-9231-476c-a60a-654bb9e207fc@andreasschulze.de> Message-ID: Hi, Thanks for testing the pre-release. > 1. ALPN/HTTP2 h2, spdy/3.1, http/1.1, grpc-exp, h2-fb, spdy/1, spdy/2, spdy/3, stun.turn, stun.nat-discovery, webrtc, c-webrtc, ftp (offered) > I think, this is unneeded as DoT has nothing to do with HTTPS, it's simply TLS > > 2. Finite field group: ffdhe2048 ffdhe3072 > Most modern TLS stacks support Key-Exchange with Elliptic curves which are much faster and cheaper. > Postfix, for example, offer an option to disable FFDHE at all: https://www.postfix.org/postconf.5.html#tls_ffdhe_auto_groups And thanks for reporting this. We'll add it to our TODO list. Best, Jannik From simon at josefsson.org Thu Sep 4 07:46:54 2025 From: simon at josefsson.org (Simon Josefsson) Date: Thu, 04 Sep 2025 09:46:54 +0200 Subject: [nsd-users] NSD - enable XDP in Debian? Message-ID: <87h5xid5ht.fsf@josefsson.org> Hi I have uploaded nsd 4.13.0 to Debian unstable. According to your blog post I noticed you added XDP support, but that it requires building with --enable-xdp, see discussion: https://blog.nlnetlabs.nl/enabling-more-default-features-in-nsd-4-13-0/ https://blog.nlnetlabs.nl/experimental-support-for-af_xdp-sockets-in-nsd/ What do you think about building with this flag in the Debian package? Any reasons this may break unrelated things? I think we are years away from a new Debian release, so it will only be used by people tracking Debian unstable and testing, which I suspect few use in production. Which may be a good fit to get wider testing. /Simon -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 1251 bytes Desc: not available URL: From jannik at nlnetlabs.nl Mon Sep 8 09:54:55 2025 From: jannik at nlnetlabs.nl (Jannik Peters) Date: Mon, 08 Sep 2025 11:54:55 +0200 Subject: [nsd-users] NSD - enable XDP in Debian? In-Reply-To: <87h5xid5ht.fsf@josefsson.org> References: <87h5xid5ht.fsf@josefsson.org> Message-ID: Hi, > What do you think about building with this flag in the Debian package? > [...] Which may be a good fit to get wider testing. Building with XDP enabled in Debian testing would be great and indeed a good fit to get wider testing. > Any reasons this may break unrelated things? I don't think building with this flag would break anything unrelated. (Our reason for the build flag was the introduction of additional dependencies, which some people may find undesirable.) Best, Jannik From klaus.darilion at nic.at Mon Sep 8 21:20:29 2025 From: klaus.darilion at nic.at (Klaus Darilion) Date: Mon, 8 Sep 2025 21:20:29 +0000 Subject: [nsd-users] NSD 4.13.0rc1 pre-release In-Reply-To: References: Message-ID: Hi Jannik! Do you think it would be possible to convert configure ?enable-packed and configure ?disable-radix-tree into config file options? That way we could save RAM without recompiling. Thanks Klaus From: nsd-users On Behalf Of Anand Buddhdev via nsd-users Sent: Saturday, August 30, 2025 4:50 PM To: nsd-users at lists.nlnetlabs.nl Subject: Re: [nsd-users] NSD 4.13.0rc1 pre-release Hi Jannik, Thanks for this release. I appreciate very much the approach of compiling in all the stable features, and allowing the operator to activate them in the configuration as needed. This makes it very easy to package NSD for general use. I also appreciate the --with-dbdir option to specify one place for many of NSD's runtime files. My "configure" invocation is now much more compact, and the resulting package is also more useful. It compiles without warnings under Oracle Linux 9, and is running on a test server. Regards, Anand Buddhdev RIPE NCC On Tue, 26 Aug 2025 at 14:52, Jannik Peters via nsd-users > wrote: Dear all, NSD 4.13.0 pre-release is available: https://nlnetlabs.nl/downloads/nsd/nsd-4.13.0rc1.tar.gz sha256 b5b48013eaf72f84c6feddbf452899909970a0194b1dc002a3aea97e70aacd09 pgp https://nlnetlabs.nl/downloads/nsd/nsd-4.13.0rc1.tar.gz.asc This release enables some commonly used features by default, and introduces experimental support for AF_XDP sockets that can be enabled with the `--enable-xdp` feature flag (see https://nsd.docs.nlnetlabs.nl/en/latest/xdp.html). Please review this pre-release carefully. If no issues arise, the actual release will follow on Wednesday 2025-09-03. 4.13.0 ================ FEATURES: - Use '(all)' and '(none)' for the socket server affinity log output instead of '*' and '-'. - The --enable-bind8-stats feature, was already enabled by default, is described as enabled by default in usage. - The --enable-zone-stats feature is enabled by default. It can be turned on with config like `zonestats: "%s"`. - The --enable-ratelimit feature is enabled by default. The ratelimit value is off by default. It can be turned on with config like `rrl-ratelimit: 200`. - The --enable-dnstap feature is enabled by default. If fstrm-devel or protobuf-c are not found by configure it prints an error. It can be turned on with config like `dnstap-enable: yes`. - Change default for send-buffer-size to 4m, to mitigate a cross-layer issue where the UDP socket send buffers are exhausted waiting for ARP/NDP resolution. Thanks to Reflyable for the report. - Disable TLSv1.2 if TLSv1.3 is available. - Merge #449: Add useful logging for XoT transfers. - Merge #425: Add experimental XDP (AF_XDP) support for UDP traffic - Merge #455: --with-dbdir option for configure to set the base directory for the xfrd zone timer state file, the zone list file and the cookie secrets file. Thanks Simon Josefsson. - Merge #456: Spelling fixes in metrics.c. Thanks Simon Josefsson. BUG FIXES: - Fix punctuation of nsd -h output for the -a option. - Fix checkconf unit test for when metrics are not enabled. - Prometheus metrics tests require --enable-zone-stats. - Add unit test for socket server affinity log output. - Move xfrd-tcp unit test to its own file. - Fix contrib/nsd.spec to omit configure flags that are default or that do not exist. - Fix to remove mention of obsolete root-server option. - Fix mention of draft-rrtypes and root-server configure options. - Fix ci workflow for enable dnstap. - Fix to remove use of sprintf from metrics. - Fix for fstrm and protobuf-c for ci workflow coverity-scan. - Fix for parallel build of dnstap protoc-c output. - Fix to remove unneeded mkdir from Makefile. - Fix dnstap to use protoc and keep dnstap_config.h unchanged if possible. - Fix to provide doc for --enable-systemd. - Fix to remove debug printout for configure dnstap header. - Fix #441: SystemD script for NSD prevents using chroot. - Fix to add checks for compression pointers and too long dnames in internal dname routines, dname_make and ixfr dname_length. - Fix to remove shell assignment operator from Makefile for DATE. - make depend. - Fix bitwise operators in conditional expressions with parentheses. - Fix conditional expressions with parentheses for bitwise and. - Merge #445: contrib/nsd.openrc.in: use supervise-daemon and add `need net`. - Fix #446 nsd_size_db_in_mem_bytes (size.db.mem) metric not updated on reload. - Merge #447: Minimize disruptions on reconfig. - For #447: Updated simdzone to latest commit. With the padding test changes. - For #447: use need_to_send_reload to detect if a reload is issued. - For #447: acl_list_equal already tests for TSIG key changes, so removed the duplicate checks. - For #447: log crypto error with the SSL_write error. - Update simdzone with support for --enable-pie. - Merge #454 from jaredmauch: handle rare case but seen in production where data->query is NULL. simdzone 0.2.3 ================ FEATURES: - check_pie: match nsd support (#253). BUG FIXES: - Fix tests to initialize padding (#252). - Fix for #253, add acx_nlnetlabs.m4 in the repo and allow CFLAGS passed to configure to set the flags. _______________________________________________ nsd-users mailing list nsd-users at lists.nlnetlabs.nl https://lists.nlnetlabs.nl/mailman/listinfo/nsd-users -------------- next part -------------- An HTML attachment was scrubbed... URL: From jannik at nlnetlabs.nl Wed Sep 10 06:58:53 2025 From: jannik at nlnetlabs.nl (Jannik Peters) Date: Wed, 10 Sep 2025 08:58:53 +0200 Subject: [nsd-users] NSD 4.13.0rc1 pre-release In-Reply-To: References: Message-ID: Hi Klaus, > Do you think it would be possible to convert > configure --enable-packed > and > configure --disable-radix-tree > into config file options? That way we could save RAM without recompiling. For --enable-packed it is not possible, as it changes the memory layout of the types used. For --disable-radix-tree it would be possible. We haven't done it in the past for simplicity and speed. But thanks for mentioning this, we will reconsider whether to keep it as a configure option or to make it a run-time config option. Best, Jannik From simon at josefsson.org Wed Sep 10 20:25:35 2025 From: simon at josefsson.org (Simon Josefsson) Date: Wed, 10 Sep 2025 22:25:35 +0200 Subject: [nsd-users] NSD - enable XDP in Debian? In-Reply-To: (Jannik Peters's message of "Mon, 08 Sep 2025 11:54:55 +0200") References: <87h5xid5ht.fsf@josefsson.org> Message-ID: <87qzwe5a2o.fsf@josefsson.org> "Jannik Peters" writes: > Hi, > >> What do you think about building with this flag in the Debian package? >> [...] Which may be a good fit to get wider testing. > > Building with XDP enabled in Debian testing would be great and indeed > a good fit to get wider testing. Thanks for confirming. I tried to enable it but ran into build errors: https://salsa.debian.org/jas/nsd/-/jobs/8255756 As far as I some XDP objects are needed during linking, this patch fixed it for us: https://github.com/NLnetLabs/nsd/pull/460 With that it builds reasonable well: https://salsa.debian.org/jas/nsd/-/pipelines/933804 Also, by default, it seems some *.o files are installed into $(sharedfilesdir) which became /usr/share/nsd for me, see Makefile.in: if test -n "@xdp@"; then $(INSTALL_DATA) xdp-dns-redirect_kern.o $(DESTDIR)$(sharedfilesdir)/xdp-dns-redirect_kern.o; fi if test -n "@xdp@"; then $(INSTALL_DATA) xdp-dns-redirect_kern_pinned.o $(DESTDIR)$(sharedfilesdir)/xdp-dns-redirect_kern_pinned.o; fi These are architecture-dependent files, aren't they? Is there some standard non-/usr/share location for these files that you could use? This may be a Debian-specific concern, I asked the same here: https://lists.debian.org/debian-devel/2025/09/msg00143.html /Simon -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 1251 bytes Desc: not available URL: From jannik at nlnetlabs.nl Thu Sep 11 09:26:23 2025 From: jannik at nlnetlabs.nl (Jannik Peters) Date: Thu, 11 Sep 2025 11:26:23 +0200 Subject: [nsd-users] NSD - enable XDP in Debian? In-Reply-To: <87qzwe5a2o.fsf@josefsson.org> References: <87h5xid5ht.fsf@josefsson.org> <87qzwe5a2o.fsf@josefsson.org> Message-ID: Hi Simon, > Also, by default, it seems some *.o files are installed into > $(sharedfilesdir) which became /usr/share/nsd for me, see Makefile.in: > > if test -n "@xdp@"; then $(INSTALL_DATA) xdp-dns-redirect_kern.o $(DESTDIR)$(sharedfilesdir)/xdp-dns-redirect_kern.o; fi > if test -n "@xdp@"; then $(INSTALL_DATA) xdp-dns-redirect_kern_pinned.o $(DESTDIR)$(sharedfilesdir)/xdp-dns-redirect_kern_pinned.o; fi > > These are architecture-dependent files, aren't they? Is there some > standard non-/usr/share location for these files that you could use? Although these files are technically for a specific architecture (that being eBPF), they are architecture-*in*dependent with regard to x86, ARM, etc. eBPF programs are compatible across CPU architectures, as they get executed by the eBPF "VM" inside the Linux kernel. Best, Jannik