This release enables some commonly used features by default, and introduces
experimental support for AF_XDP sockets that can be enabled with the
`--enable-xdp` feature flag (see https://nsd.docs.nlnetlabs.nl/en/latest/xdp.html).
Please review this pre-release carefully. If no issues arise, the actual
release will follow on Wednesday 2025-09-03.
1. ALPN/HTTP2 h2, spdy/3.1, http/1.1, grpc-exp, h2-fb, spdy/1, spdy/2, spdy/3, stun.turn, stun.nat-discovery, webrtc, c-webrtc, ftp (offered)
I think, this is unneeded as DoT has nothing to do with HTTPS, it's simply TLS
2. Finite field group: ffdhe2048 ffdhe3072
Most modern TLS stacks support Key-Exchange with Elliptic curves which are much faster and cheaper.
Postfix, for example, offer an option to disable FFDHE at all: https://www.postfix.org/postconf.5.html#tls_ffdhe_auto_groups
Thanks for this release. I appreciate very much the approach of compiling in all the stable features, and allowing the operator to activate them in the configuration as needed. This makes it very easy to package NSD for general use. I also appreciate the --with-dbdir option to specify one place for many of NSD’s runtime files. My “configure” invocation is now much more compact, and the resulting package is also more useful.
It compiles without warnings under Oracle Linux 9, and is running on a test server.
1. ALPN/HTTP2 h2, spdy/3.1, http/1.1, grpc-exp, h2-fb, spdy/1, spdy/2, spdy/3, stun.turn, stun.nat-discovery, webrtc, c-webrtc, ftp (offered)
I think, this is unneeded as DoT has nothing to do with HTTPS, it's simply TLS
2. Finite field group: ffdhe2048 ffdhe3072
Most modern TLS stacks support Key-Exchange with Elliptic curves which are much faster and cheaper.
Postfix, for example, offer an option to disable FFDHE at all: https://www.postfix.org/postconf.5.html#tls_ffdhe_auto_groups
And thanks for reporting this. We'll add it to our TODO list.
Do you think it would be possible to convert
configure --enable-packed
and
configure --disable-radix-tree
into config file options? That way we could save RAM without recompiling.
For --enable-packed it is not possible, as it changes the memory layout
of the types used.
For --disable-radix-tree it would be possible. We haven't done it in the
past for simplicity and speed. But thanks for mentioning this, we will
reconsider whether to keep it as a configure option or to make it
a run-time config option.