$Id$ OpenDNSSEC 1.4.0 - Known Restrictions The following are the known problems and/or restrictions of release 1.4.0 of OpenDNSSEC. BUGS: ----- OPENDNSSEC-332: Statistics on average sigs/sec not accurate OPENDNSSEC-437: Problem with invalid signatures on SOA RRset. Limitations on Number of Zones ------------------------------ Owing to contention in the key management database, performance is degraded if OpenDNSSEC is used to sign large numbers of zones that do not share common keys. The problem is worse if SQLite is used for the key and signature manager database. As a workaround, we suggest that either the same key is used for all zones, or that the number of zones be limited to about 5,000. This will be addressed in a future release of the software. Issue with rolling from one algorithm to another ------------------------------------------------ The current version will handle key rollovers that also change algorithm just the same as any other key rollover. This is not sufficient; and so rolling between algorithms is broken and should not be done with the current system. Handling of external command calls ---------------------------------- External commands (e.g. NotifyCommand or DelegationSignerSubmitCommand) are called with popen. This can lead to errors with these external scripts not being noticed by OpenDNSSEC. It is therefore recommended that when writing scripts like these that they log enough information for the user to tell independently if they failed. Maximum number of HSMs ---------------------- The datatype of the column storing HSMs in the kasp database is only large enough to store 127 separate HSMs (with a MySQL backend). Quotation marks in strings -------------------------- Enforcer does not remove/handle any quotation marks in the imported strings. This will create a problem when importing the information from e.g. the policy description field into the Enforcer database. Intermittent segmentation faults on FreeBSD 9 amd64 ------------------------------------------------- Segmentation faults in _pthread_mutex_init_calloc_cb () from /lib/libc.so.7 have been intermittently seen when running regression tests on our FreeBSD test server (amd64, FreeBSD 9.0-RELEASE-p3). The segfaults have been seen to originate in the enforcer, the signer and SQLite on different occasions. These appear to be due to a bug in the FreeBSD malloc/pthread implementation and are not due to issues in the OpenDNSSEC code.