NEWS 7.96 KB
Newer Older
1 2 3 4 5 6
Knot Resolver 1.3.2 (2017-07-xx)
================================

Bugfixes
--------
- daemon: check existence of config file even if rundir isn't specified
7
- policy.FORWARD and STUB: use RTT tracking to choose servers (#125, #208)
8 9


Vladimír Čunát's avatar
Vladimír Čunát committed
10
Knot Resolver 1.3.1 (2017-06-23)
11 12 13 14 15
================================

Bugfixes
--------
- modules/http: fix finding the static files (bug from 1.3.0)
16
- policy.FORWARD: fix some cases of CNAMEs obstructing search for zone cuts
17 18


19
Knot Resolver 1.3.0 (2017-06-13)
20 21 22 23 24 25 26 27 28
================================

Security
--------
- Refactor handling of AD flag and security status of resource records.
  In some cases it was possible for secure domains to get cached as
  insecure, even for a TLD, leading to disabled validation.
  It also fixes answering with non-authoritative data about nameservers.

29 30
Improvements
------------
31 32 33
- major feature: support for forwarding with validation (#112).
  The old policy.FORWARD action now does that; the previous non-validating
  mode is still avaliable as policy.STUB except that also uses caching (#122).
34
- command line: specify ports via @ but still support # for compatibility
35
- policy: recognize 100.64.0.0/10 as local addresses
36 37
- layer/iterate: *do* retry repeatedly if REFUSED, as we can't yet easily
  retry with other NSs while avoiding retrying with those who REFUSED
38 39
- modules: allow changing the directory where modules are found,
  and do not search the default library path anymore.
40

41 42 43
Bugfixes
--------
- validate: fix insufficient caching for some cases (relatively rare)
44 45
- avoid putting "duplicate" record-sets into the answer (#198)

46

47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67
Knot Resolver 1.2.6 (2017-04-24)
================================

Security
--------
- dnssec: don't set AD flag for NODATA answers if wildcard non-existence
  is not guaranteed due to opt-out in NSEC3

Improvements
------------
- layer/iterate: don't retry repeatedly if REFUSED

Bugfixes
--------
- lib/nsrep: revert some changes to NS reputation tracking that caused
  severe problems to some users of 1.2.5 (#178 and #179)
- dnssec: fix verification of wildcarded non-singleton RRsets
- dnssec: allow wildcards located directly under the root
- layer/rrcache: avoid putting answer records into queries in some cases


68
Knot Resolver 1.2.5 (2017-04-05)
Ondřej Surý's avatar
Ondřej Surý committed
69 70 71 72 73 74 75 76 77 78 79 80 81 82 83
================================

Security
--------
- layer/validate: clear AD if closest encloser proof has opt-outed
  NSEC3 (#169)
- layer/validate: check if NSEC3 records in wildcard expansion proof
  has an opt-out
- dnssec/nsec: missed wildcard no-data answers validation has been
  implemented

Improvements
------------
- modules/dnstap: a DNSTAP support module
  (Contributed by Vicky Shrestha)
84
- modules/workarounds: a module adding workarounds for known
Ondřej Surý's avatar
Ondřej Surý committed
85 86
  DNS protocol violators
- layer/iterate: fix logging of glue addresses
87 88
- kr_bitcmp: allow bits=0 and consequently 0.0.0.0/0 matches in view
  and renumber modules.
Ondřej Surý's avatar
Ondřej Surý committed
89 90
- modules/padding: Improve default padding of responses
  (Contributed by Daniel Kahn Gillmor)
Ondřej Surý's avatar
Ondřej Surý committed
91
- New kresc client utility (experimental; don't rely on the API yet)
Ondřej Surý's avatar
Ondřej Surý committed
92 93 94 95 96 97 98 99 100

Bugfixes
--------
- trust anchors: Improve trust anchors storage format (#167)
- trust anchors: support non-root TAs, one domain per file
- policy.DENY: set AA flag and clear AD flag
- lib/resolve: avoid unnecessary DS queries
- lib/nsrep: don't treat servers with NOIP4 + NOIP6 flags as timeouted
- layer/iterate: During packet classification (answer vs. referral)
101
  don't analyze AUTHORITY section in authoritative answer if ANSWER
Ondřej Surý's avatar
Ondřej Surý committed
102 103
  section contains records that have been requested

104

Ondřej Surý's avatar
Ondřej Surý committed
105
Knot Resolver 1.2.4 (2017-03-09)
Ondřej Surý's avatar
Ondřej Surý committed
106 107
================================

Ondřej Surý's avatar
Ondřej Surý committed
108 109
Security
--------
Ondřej Surý's avatar
Ondřej Surý committed
110
- Knot Resolver 1.2.0 and higher could return AD flag for insecure
Ondřej Surý's avatar
Ondřej Surý committed
111 112
  answer if the daemon received answer with invalid RRSIG several
  times in a row.
Ondřej Surý's avatar
Ondřej Surý committed
113

Ondřej Surý's avatar
Ondřej Surý committed
114 115
Improvements
------------
Ondřej Surý's avatar
Ondřej Surý committed
116 117
- modules/policy: allow QTRACE policy to be chained with other
  policies
Ondřej Surý's avatar
Ondřej Surý committed
118 119 120 121
- hints.add_hosts(path): a new property
- module: document the API and simplify the code
- policy.MIRROR: support IPv6 link-local addresses
- policy.FORWARD: support IPv6 link-local addresses
Ondřej Surý's avatar
Ondřej Surý committed
122 123
- add net.outgoing_{v4,v6} to allow specifying address to use for
  connections
Ondřej Surý's avatar
Ondřej Surý committed
124 125 126 127

Bugfixes
--------
- layer/iterate: some improvements in cname chain unrolling
Ondřej Surý's avatar
Ondřej Surý committed
128 129
- layer/validate: fix duplicate records in AUTHORITY section in case
  of WC expansion proof
Ondřej Surý's avatar
Ondřej Surý committed
130
- lua: do *not* truncate cache size to unsigned
131 132
- forwarding mode: correctly forward +cd flag
- fix a potential memory leak
Ondřej Surý's avatar
Ondřej Surý committed
133 134
- don't treat answers that contain DS non-existance proof as insecure
- don't store NSEC3 and their signatures in the cache
Ondřej Surý's avatar
Ondřej Surý committed
135 136
- layer/iterate: when processing delegations, check if qname is at or
  below new authority
Ondřej Surý's avatar
Ondřej Surý committed
137 138


Ondřej Surý's avatar
Ondřej Surý committed
139 140 141 142 143 144 145 146 147 148 149
Knot Resolver 1.2.3 (2017-02-23)
================================

Bugfixes
--------
- Disable storing GLUE records into the cache even in the
  (non-default) QUERY_PERMISSIVE mode
- iterate: skip answer RRs that don't match the query
- layer/iterate: some additional processing for referrals
- lib/resolve: zonecut fetching error was fixed

Ondřej Surý's avatar
Ondřej Surý committed
150

Ondřej Surý's avatar
Ondřej Surý committed
151 152 153 154 155 156 157 158 159 160
Knot Resolver 1.2.2 (2017-02-10)
================================

Bugfixes:
---------
- Fix -k argument processing to avoid out-of-bounds memory accesses
- lib/resolve: fix zonecut fetching for explicit DS queries
- hints: more NULL checks
- Fix TA bootstrapping for multiple TAs in the IANA XML file

Ondřej Surý's avatar
Ondřej Surý committed
161 162 163 164
Testing:
--------
- Update tests to run tests with and without QNAME minimization

Ondřej Surý's avatar
Ondřej Surý committed
165

Vladimír Čunát's avatar
Vladimír Čunát committed
166 167 168 169 170 171 172 173 174
Knot Resolver 1.2.1 (2017-02-01)
====================================

Security:
---------
- Under certain conditions, a cached negative answer from a CD query
  would be reused to construct response for non-CD queries, resulting
  in Insecure status instead of Bogus.  Only 1.2.0 release was affected.

Ondřej Surý's avatar
Ondřej Surý committed
175 176 177 178 179 180 181 182 183
Documentation
-------------
- Update the typo in the documentation: The query trace policy is
  named policy.QTRACE (and not policy.TRACE)

Bugfixes:
---------
- lua: make the map command check its arguments

Ondřej Surý's avatar
Ondřej Surý committed
184

Ondřej Surý's avatar
Ondřej Surý committed
185
Knot Resolver 1.2.0 (2017-01-24)
186
====================================
187 188 189

Security:
---------
190 191
- In a policy.FORWARD() mode, the AD flag was being always set by mistake.
  It is now cleared, as the policy.FORWARD() doesn't do DNSSEC validation yet.
192

193 194 195 196
Improvements:
-------------
- The DNSSEC Validation has been refactored, fixing many resolving
  failures.
197 198 199
- Add module `version` that checks for updates and CVEs periodically.
- Support RFC7830: EDNS(0) padding in responses over TLS.
- Support CD flag on incoming requests.
200 201
- hints module: previously /etc/hosts was loaded by default, but not anymore.
  Users can now actually avoid loading any file.
202 203 204
- DNS over TLS now creates ephemeral certs.
- Configurable cache.{min,max}_tll option, with max_ttl defaulting to 6 days.
- Option to reorder RRs in the response.
Ondřej Surý's avatar
Ondřej Surý committed
205
- New policy.QTRACE policy to print packet contents
206 207 208 209 210 211

Bugfixes:
---------
- Trust Anchor configuration is now more robust.
- Correctly answer NOTIMPL for meta-types and non-IN RR classes.
- Free TCP buffer on cancelled connection.
212
- Fix crash in hints module on empty hints file, and fix non-lowercase hints.
213

214 215 216 217
Miscelaneous:
-------------
- It now requires knot >= 2.3.1 to link successfully.
- The API+ABI for modules changed slightly.
218
- New LRU implementation.
219

220

221 222 223 224 225 226 227 228
Knot Resolver 1.1.1 (2016-08-24)
================================

Bugfixes:
---------
 - Fix 0x20 randomization with retransmit
 - Fix pass-through for the stub mode
 - Fix the root hints IPv6 addresses
Ondřej Surý's avatar
Ondřej Surý committed
229
 - Fix dst addr for retries over TCP
230 231 232 233 234 235 236 237

Improvements:
-------------
 - Track RTT of all tried servers for faster retransmit
 - DAF: Allow forwarding to custom port
 - systemd: Read EnvironmentFile and user $KRESD_ARGS
 - systemd: Update systemd units to be named after daemon

238

239 240 241
Knot Resolver 1.1.0 (2016-08-12)
================================

242 243 244 245 246 247 248 249 250 251 252
Improvements:
-------------
 - RFC7873 DNS Cookies
 - RFC7858 DNS over TLS
 - HTTP/2 web interface, RESTful API
 - Metrics exported in Prometheus
 - DNS firewall module
 - Explicit CNAME target fetching in strict mode
 - Query minimisation improvements
 - Improved integration with systemd

253 254 255 256

Knot Resolver 1.0.0 (2016-05-30)
================================

257 258 259
Initial release:
----------------
 - The first initial release