Release 10.2.5

CHANGES:

* dns-tsig: use Eqaf.equal for verifying MAC to allow a constant time comparison
  (#418 #419 @BusyBitsRocks @hannesm)
* dnssec: fix length guard (avoid Invalid_argument in String.sub) (#418 #419
  @BusyBitsRocks @hannesm)
* Add packaging for dns-cli package (FreeBSD/Debian)
  2cadd99 #416 #417 (@reynir @hannesm)
* ozone
  - allow zone name being passed as argument
    bdfaddb
    f9af27a
    (@hannesm)
  - avoid invalid argument if input is empty
    71cc46a (@hannesm)
  - handle zone addition and removal gracefully
    0ce4019 (@hannesm)

Release 10.2.4

CHANGES:

* Dns_resolver: propagate timeouts and errors (always reply to a request); esp.
  for stateful connections (TCP, TLS, OCaml callback) (#411 @reynir)
* DNS: Ptr uses a `` [`raw] Domain_name.t `` now, instead of a
  `` [`host] Domain_name.t `` (suggested by @samoht #408, #410 @hannesm)

Release 10.2.3

CHANGES:

* DNS: fix port encoding in HTTPS and SVCB records, add tests
  (#399 @nickbetteridge)
* Dns_resolver_root.reserved_zone_records: add private networks, extend with
  IPv6 networks from RFC 6303 (#401 #402 @hannesm)
* Dns_resolver_root.reserved_zones: type is now Rr_map.t Domain_name.Map.t
  (#402 @hannesm)
* resolver: use Dns_resolver_root.reserved_zones to not lookup private zones
  in the authoritative nameservers (#403 @hannesm)
* resolver, stub: guard the usage of Dns_resolver_root.reserved_zones behind the
  boolean flag `add_reserved` (#404 @hannesm)
* stub: also record clients (if `record_clients` is provided, default is true)
  (#405 @hannesm)
* stub, resolver: add a stream (Lwt_condition.t) of query_info to display the
  live queries in a web interface (#407 @reynir @hannesm)

Release 10.2.2

CHANGES:

* Expose a module type insotead of a module for Dns_mirage_resolver_shared.S,
  and move it to dns-resolver.mirage.shared ocamlfind library (#396 @dinosaure)
* Expose dns-resolver.shared with Dns_root, Dns_metrics, Dns_block as a public
  ocamlfind library (#396 @dinosaure)
* Mention RFC9460 in README (#397 @nickbetteridge)

Release 10.2.1

CHANGES:

* dns-stub: provide a shared interface with dns-resolver.mirage
  (named Dns_resolver_mirage_shared) (#394 @hannesm)

Release 10.2.0

CHANGES:

* dns: add support for extended DNS error (RFC 8914) (#374 @hannesm)
* dns-resolver: instead of querying a single (ip, query), query up to three
  (#375 @reynir @hannesm)
* dns-cache: fix metrics (#377 #379 @hannesm @reynir)
* dns-cache: support RFC 8020, if there's a NXDomain, nothing is underneath
  (#390 @hannesm)
* dns-trie: canonicalize domain name before insertion, reducing allocations
  (#388 @reynir)
* dns-server: make number of tries in cache (for IXFR) configurable
  (#387 @reynir)
* dns-resolver: add metrics (#376 #378 @hannesm @reynir)
* dns-resolver: allow update to the primary, and the TLS state (#383 @reynir)
* dns-resolver: heuristics to detect blocked domains (#380 @reynir)
* dns-resolver: report extended DNS error when blocking
  (#385 #384 @reynir @hannesm)
* dns-resolver: implement opportunistic TLS (#389 @hannesm)
* dns-resolver: support query name minimisation (RFC 9156) (#391 @hannesm)
* dns-resolver: features via flags (#392 @hannesm)

Release 10.1.0

CHANGES:

* dns-mirage-resolver: adapt API to prepare for DoH (#373 @dinosaure @PizieDust
  @reynir @hannesm)
* resolver: support DNSSEC
  - #372 @reynir @hannesm
  - #361 @reynir @hannesm
* dns: support SVCB and HTTPS resource records (RFC 9460, #359 @nickbetteridge)
* dns-cli: avoid deprecated cmdliner values (#367 @hannesm, fixes #366),
  add app/resolver (#366)
* resolver: add further tests, fix the loop of a cyclic NS (#368 @hannesm)

Release 10.0.0

CHANGES:

* dns-certify: use a pair instead of two separate arguments for the dns-key
  (#357 @hannesm)
* add KSK 2024 (#358 @hannesm)
* update to mirage-crypto 1.2.0 API changes (#362 @hannesm)
* use dune variants, avoid functors (#363 @hannesm)

Release 9.1.0

CHANGES:

* Dns.Dnskey: provide to_string and name_key_to_string (@hannesm, @dinosaure,
  #356 - fixes #355)
* BREAKING: Dns.Dnskey remove pp_name_key (unused, irritating, #356)
* BREAKING Dns_certify_mirage.retrieve_certificate use separate dns_key_name
  and dns_key arguments, avoid string decoding in that function (#356)

Release 9.0.1

CHANGES:

* dns-client-miou: use String.get_uint16_be instead of String.get_int16_be
  (#354 @dinosaure)