10.2.5

CHANGES:

• dns-tsig: use Eqaf.equal for verifying MAC to allow a constant time comparison
  (#418 #419 @BusyBitsRocks @hannesm)
• dnssec: fix length guard (avoid Invalid_argument in String.sub) (#418 #419
  @BusyBitsRocks @hannesm)
• Add packaging for dns-cli package (FreeBSD/Debian)
  2cadd99 #416 #417 (@reynir @hannesm)
• ozone
  • allow zone name being passed as argument
    bdfaddb
    f9af27a
    (@hannesm)
  • avoid invalid argument if input is empty
    71cc46a (@hannesm)
  • handle zone addition and removal gracefully
    0ce4019 (@hannesm)

10.2.4

CHANGES:

• Dns_resolver: propagate timeouts and errors (always reply to a request); esp.
  for stateful connections (TCP, TLS, OCaml callback) (#411 @reynir)
• DNS: Ptr uses a [`raw] Domain_name.t now, instead of a
  [`host] Domain_name.t (suggested by @samoht #408, #410 @hannesm)

10.2.3

CHANGES:

• DNS: fix port encoding in HTTPS and SVCB records, add tests
  (#399 @nickbetteridge)
• Dns_resolver_root.reserved_zone_records: add private networks, extend with
  IPv6 networks from RFC 6303 (#401 #402 @hannesm)
• Dns_resolver_root.reserved_zones: type is now Rr_map.t Domain_name.Map.t
  (#402 @hannesm)
• resolver: use Dns_resolver_root.reserved_zones to not lookup private zones
  in the authoritative nameservers (#403 @hannesm)
• resolver, stub: guard the usage of Dns_resolver_root.reserved_zones behind the
  boolean flag add_reserved (#404 @hannesm)
• stub: also record clients (if record_clients is provided, default is true)
  (#405 @hannesm)
• stub, resolver: add a stream (Lwt_condition.t) of query_info to display the
  live queries in a web interface (#407 @reynir @hannesm)

10.2.2

CHANGES:

• Expose a module type insotead of a module for Dns_mirage_resolver_shared.S,
  and move it to dns-resolver.mirage.shared ocamlfind library (#396 @dinosaure)
• Expose dns-resolver.shared with Dns_root, Dns_metrics, Dns_block as a public
  ocamlfind library (#396 @dinosaure)
• Mention RFC9460 in README (#397 @nickbetteridge)

10.2.1

CHANGES:

• dns-stub: provide a shared interface with dns-resolver.mirage
  (named Dns_resolver_mirage_shared) (#394 @hannesm)

10.2.0

CHANGES:

• dns: add support for extended DNS error (RFC 8914) (#374 @hannesm)
• dns-resolver: instead of querying a single (ip, query), query up to three
  (#375 @reynir @hannesm)
• dns-cache: fix metrics (#377 #379 @hannesm @reynir)
• dns-cache: support RFC 8020, if there's a NXDomain, nothing is underneath
  (#390 @hannesm)
• dns-trie: canonicalize domain name before insertion, reducing allocations
  (#388 @reynir)
• dns-server: make number of tries in cache (for IXFR) configurable
  (#387 @reynir)
• dns-resolver: add metrics (#376 #378 @hannesm @reynir)
• dns-resolver: allow update to the primary, and the TLS state (#383 @reynir)
• dns-resolver: heuristics to detect blocked domains (#380 @reynir)
• dns-resolver: report extended DNS error when blocking
  (#385 #384 @reynir @hannesm)
• dns-resolver: implement opportunistic TLS (#389 @hannesm)
• dns-resolver: support query name minimisation (RFC 9156) (#391 @hannesm)
• dns-resolver: features via flags (#392 @hannesm)

10.1.0

CHANGES:

• dns-mirage-resolver: adapt API to prepare for DoH (#373 @dinosaure @PizieDust
  @reynir @hannesm)
• resolver: support DNSSEC
  • #372 @reynir @hannesm
  • #361 @reynir @hannesm
• dns: support SVCB and HTTPS resource records (RFC 9460, #359 @nickbetteridge)
• dns-cli: avoid deprecated cmdliner values (#367 @hannesm, fixes #366),
  add app/resolver (#366)
• resolver: add further tests, fix the loop of a cyclic NS (#368 @hannesm)

10.0.0

CHANGES:

• dns-certify: use a pair instead of two separate arguments for the dns-key
  (#357 @hannesm)
• add KSK 2024 (#358 @hannesm)
• update to mirage-crypto 1.2.0 API changes (#362 @hannesm)
• use dune variants, avoid functors (#363 @hannesm)

9.1.0

CHANGES:

• Dns.Dnskey: provide to_string and name_key_to_string (@hannesm, @dinosaure,
  #356 - fixes #355)
• BREAKING: Dns.Dnskey remove pp_name_key (unused, irritating, #356)
• BREAKING Dns_certify_mirage.retrieve_certificate use separate dns_key_name
  and dns_key arguments, avoid string decoding in that function (#356)

9.0.1

CHANGES:

• dns-client-miou: use String.get_uint16_be instead of String.get_int16_be
  (#354 @dinosaure)