Changelogs for 5.5.X¶

Before upgrading, it is advised to read the Upgrade Guide.

5.5.0-alpha1¶

Improvements¶

• Add feature to read TLS key info from an encrypted PKCS12 (pfx) file for the embedded web server.

  ¶

  References: pull request 16855

• Rec and dnsdist: Update rustc and cargo to 1.93

  ¶

  References: pull request 16856

• Add feature to optionally use a client certificate for outgoing DoT.

  ¶

  References: pull request 16858

• Save outgoing TLSContext for later re-use.

  ¶

  References: pull request 16905

• Coverity reports

  ¶

  References: pull request 16915, pull request 17128, pull request 17658, pull request 17789

• Drop QR=0 responses from auths.

  ¶

  References: pull request 16936

• RPZ add auto cache flush of packet cache feature on RPZ updates.

  ¶

  References: #14854, pull request 16970

• Add ubuntu-resolute build target.

  ¶

  References: pull request 16986

• Two protobuf logging features: use 4 byte frame size and add strategy.

  ¶

  References: pull request 16995

• Apply specific minimum TTL for root NS records.

  ¶

  References: pull request 16998

• More getRR return value checks.

  ¶

  References: pull request 16999

• Redact more configuration secrets in the /config endpoint.

  ¶

  References: pull request 17011

• Give better error message on api-dir not set.

  ¶

  References: pull request 17016

• Add meson option to not build man pages.

  ¶

  References: pull request 17034

• Harden the DNS parser against malformed records.

  ¶

  References: pull request 17077

• Estimate size and refuse to cache big negcache entries.

  ¶

  References: pull request 17197

• Check bytes received limit immediate after increase.

  ¶

  References: pull request 17285

• Implement a cors flag to set allowed origin in webserver.

  ¶

  References: pull request 17297

• Smarter memory need computation.

  ¶

  References: pull request 17320

• Janitor work on (generated) Rust code.

  ¶

  References: pull request 17359

• Keep cache warm for a list of names.

  ¶

  References: pull request 17360

• Credentials: Try harder to zero out existing data.

  ¶

  References: pull request 17376

• Libssl: Minor fixes.

  ¶

  References: pull request 17398

• Yet more xfr* hardening

  ¶

  References: pull request 17455

• Iputils: Return early when the tree is empty.

  ¶

  References: pull request 17460

• Zap autotools as build system.

  ¶

  References: pull request 17502

• Remote logger: Reconnect if writes have been stalled for too long.

  ¶

  References: pull request 17528

• Protozero: extend test to determine endianness.

  ¶

  References: pull request 17554

• Reject (more) strange headers.

  ¶

  References: pull request 17602

• Set Rust LTO mode automatically, and allow setting RUSTFLAGS.

  ¶

  References: pull request 17659

• Better reporting of filesystem errors.

  ¶

  References: #9090, pull request 17666

• Update our Rust deps.

  ¶

  References: pull request 17696

• Allow explicitly named interface for source address.

  ¶

  References: pull request 17708, pull request 17746

• Emit EDE 33 (Negative Trust Anchor) on NTA-covered responses (Babak Farrokhi).

  ¶

  References: pull request 17737

Bug Fixes¶

• Handle NSEC3 records where hash(owner) > hash(next) in aggressive cache decision.

  ¶

  References: #16199, pull request 16891

• Meson: Add missing checks for TLS_client_method, gnutls_transport_set_fastopen.

  ¶

  References: pull request 16907

• Fix serialization of cached authority records.

  ¶

  References: pull request 16993

• Continue processing response Policies if a discarded policy is hit.

  ¶

  References: pull request 17005

• Prevent dist failure if cargo is in a non-default location.

  ¶

  References: pull request 17019

• Fix lua addRecord function implementation (Sasha Kabenin).

  ¶

  References: #17052, pull request 17053

• Handle malformed pointers in dnswriter.

  ¶

  References: pull request 17076

• Better handling of RFC5155 transitions in the aggressive NSEC cache.

  ¶

  References: pull request 17101

• Fix DNSSEC validation of wildcard-expanded proof.

  ¶

  References: pull request 17156

• Fix DNAME interaction with aggressive use of NSEC3.

  ¶

  References: #17137, pull request 17157

• Skip ZONEMD records in RPZs.

  ¶

  References: pull request 17161

• Limit size of incoming web request.

  ¶

  References: pull request 17194

• Work on a copy of PolicyZoneData while building the new RPZ zone.

  ¶

  References: pull request 17199

• Fix two cases of lacking/wrong max size compares (YWH-PGM6095-90).

  ¶

  References: pull request 17200

• Prevent null-pointer dereference in aggressive NSEC cache.

  ¶

  References: pull request 17201

• Only check cookie if we sent one out (YWH-PGM6095-134).

  ¶

  References: pull request 17202

• Zonemd null pointer dereference on non-standard schemes (#YWH-PGM6095-156).

  ¶

  References: pull request 17203

• Throw if no valid SOA found (YWH-PGM6095-168)

  ¶

  References: pull request 17205

• Check boundary in getUnquotedText() as we do in getText().

  ¶

  References: pull request 17235

• Be more consistent in logging source and remote.

  ¶

  References: #17230, pull request 17283

• Optimize dns64 PTR processing (#YWH-PGM6095-280).

  ¶

  References: pull request 17289

• Ednscookies: Fix timestamp validity check.

  ¶

  References: pull request 17384

• Snmp-agent: Fix a memory leak.

  ¶

  References: pull request 17396

• Only set ACCESS_CONTROL_ALLOW_ORIGIN if auth succeeded (#YWH-PGM-6095-250).

  ¶

  References: pull request 17535

• Reject out of zone records.

  ¶

  References: pull request 17597

• Do not store ECS scope 0 carrying requests/replies in the packetcache.

  ¶

  References: pull request 17598

• Fix validation bypass for ZONEMD (part of YWH-PGM6095-274).

  ¶

  References: pull request 17599

• With catalog zone transfers, check if SOA is defined before using.

  ¶

  References: pull request 17605

• Check RRSIG record is valid in zonemd before processing further (#YWH-PGM6095-275).

  ¶

  References: pull request 17608

• If EDNS is mandatory, do it always in the first iteration (#YWH-PGM6095-290).

  ¶

  References: pull request 17609

• Add handling of new protobuf logging parameter: stalledWriteTimeout.

  ¶

  References: pull request 17693

• Do not use string compare for DNS names.

  ¶

  References: pull request 17728

• Do not attempt to refresh NS records in refresh-almost-expired..

  ¶

  References: pull request 17748

• Correct the EDNS option length bound in queryMatches.

  ¶

  References: pull request 17760

• RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation.

  ¶

  References: pull request 17761

• Wildcard CNAME proof validation bypass.

  ¶

  References: pull request 17762

• Reject NSECs whose next names are out of the zone earlier.

  ¶

  References: pull request 17769

• Bandaid for disabling algo 8 also disables DS digest 2.

  ¶

  References: #17772, pull request 17786

• Dnsname: Properly reject 256-bytes wire-encoded DNS names.

  ¶

  References: pull request 17790

• Dnsname: Account for the existing content when parsing labels.

  ¶

  References: pull request 17797

• Skip unexpected tags when deserializing protobuf messages.

  ¶

  References: pull request 17869

• Fix typo in rec_control command name.

  ¶

  References: pull request 17888