Fri 22 Dec 2017  

getdns-1.3.0 release

920fa2e07c72fd0e5854db1820fa777108009fc5cb702f9aa5155ef58b12adb1

Dear all,

I am pleased to announce the new special Christmas 2017 bugfix release, version 1.3.0 of getdns.

Recently Stubby has seen increased interest. Already after the release of the Windows installer, but even more so after the introduction of Quad9 and the description of how to use DNS-over-TLS with Stubby by Alex Band and Stéphane Borzmeyer.

The increased install base has generated excellent feedback and has also revealed some bugs. This release has those bugs fixed, and also contains a few more configuration options to be able to adapt to more diverse situations.

The bugs fixed with this release are:

  • A segfault with the native DNSSEC validation code when DS and DNSKEY queries timed out,
  • A non RFC compliant edns_client_subnet_private option that caused some upstream EDNS Client Subnet implementations (i.e. Unbound's) to return FORMERR, and
  • Doing the meta queries for Zero configuration DNSSEC with the resolvers from /etc/resolv.conf, which caused Stubby to query itself for this, effectively breaking the possibility to fetch the root trust-anchors and bootstrap DNSSEC.

Besides these fixes, this release allows to configure a getdns_context to be initialized with resolv.conf and hosts at alternative locations, with the getdns_context_set_resolvconf() and getdns_context_set_hosts() functions.

Also, the TLS parameters for DNS-over-TLS are more configurable with this relase.

The getdns_context_get_api_information() function exposes more getdns_context settings, amongst which:

  • The default settings for extensions,
  • The paths for files that were used to initialize a getdns_context (resolv.conf, hosts and trust anchors), and
  • More information about the version, configuration and capabilities of the OpenSSL library in use.

This release includes the 0.2.1 release of Stubby. The most prominent bugfix therein is to not do DNSSEC validation for queries with the CD bit set, when DNSSEC validation was not configured in the first place. This bug caused decreased performance for configurations with unbound forwarding to Stubby.

The 0.2.1 release of Stubby also includes some additional auxiliary functionality which is used by the macOS prototype GUI that was just released: https://dnsprivacy.org/wiki/display/DP/Stubby+GUI+for+macOS


This release has version number 1.3.0 and not 1.2.2, for which the candidate was created, because we comply to the Semantic Versioning 2.0.0 scheme, and a few new functions are introduced into the API. The other change from the release candidate is that the Certificate Authority store location settings are now prepended with tls_, like all other setting influencing DNS-over-TLS.

Merry CHristmas & Happy New year from the getdns team!

Picture of ladybug in Christmas tree courtesy of [David Whelan](https://www.flickr.com/photos/davidpwhelan/31658092252/)


ChangeLog:
* 2017-12-21: Version 1.3.0
  * Bugfix #300: Detect dnsmasq and skip unit test that fails with it.
    Thanks Tim Rühsen and Konomi Kitten
  * Specify default available cipher suites for authenticated TLS
    upstreams with getdns_context_set_tls_ciphers_list()
    An upstream specific available cipher suite may also be given
    with the tls_cipher_list setting in the upstream dict with
    getdns_context_set_upstream_recursive_servers()
  * PR #366: Add support for TLS 1.3 and Chacha20-Poly1305
    Thanks Pascal Ernster
  * Bugfix #356: Do Zero configuration DNSSEC meta queries over on the
    context configured upstreams.  Thanks Andreas Schulze
  * Report default extension settings with
    getdns_context_get_api_information()
  * Specify locations at which CA certificates for verification purposes
    are located: getdns_context_set_tls_ca_path()
    getdns_context_set_tls_ca_file()
  * getdns_context_set_resolvconf() function to initialize a context 
    upstreams and suffices with a resolv.conf file.
    getdns_context_get_resolvconf() to get the file used to initialize
    the context's upstreams and suffixes.
    getdns_context_set_hosts() function to initialize a context's
    LOCALNAMES namespace.
    getdns_context_get_hosts() function to get the file used to initialize
    the context's LOCALNAMES namespace.
  * get which version of OpenSSL was used at build time and at run time
    when available with getdns_context_get_api_information()
  * GETDNS_RETURN_IO_ERROR return error code
  * Bugfix #359: edns_client_subnet_private should set family
    Thanks Daniel Areiza & Andreas Schulze
  * Bugfix getdnsapi/stubby#34: Segfault issue with native DNSSEC
    validation.  Thanks Bruno Pagani
Stubby ChangeLog:
* 2017-12-18: Version 0.2.1
 * Fix use of logging on macos 10.11

* 2017-12-18: Version 0.2.0
 * Add Powershell scripts for Windows 7 that will update the IPv4 DNS resolvers.
 * Add Windows scripts to enable a Scheduled task for stubby
 * Add files to support a separate macOS GUI application to manage stubby
   https://dnsprivacy.org/wiki/x/CIBn
 * Add Quad9 details to the configuration file
 * Bugfix #48: Do not do native DNSSEC validation when cd bit was
   received (for example from an unbound forwarder), but DNSSEC
   validation was not enabled in the first place.
 * Bugfix getdnsapi/getdns#358: Parse config files given with the
   -C option that have an .yaml extension as YAML not JSON.
   Thanks Ollivier Robert

Related

  How to keep your ISP’s nose out of your browser history with encrypted DNS
  Sun 08 Apr 2018
  Media   DNS Privacy   Stubby
Blog post on DNS privacy by Sean Gallagher on Ars Technica
  How to Use Pihole With Stubby
  Mon 08 Jan 2018
  Media   DNS Privacy   Stubby
Guide by Frank Santoso describing how to use Stubby in the blockhole for Internet advertisements solution Pi-HOLE
  First release candidate for getdns-1.2.2
  Thu 14 Dec 2017
  Stubby   Zero config DNSSEC
Bug-, robustness- and stability-fixes that came out of Stubby usage
  Quad9, a Public DNS Resolver - with Security
  Tue 21 Nov 2017
  Media   DNS Privacy   Stubby
Blog post on how to configure Stubby for use with Quad9 by Stéphane Bortzmeyer on RIPE Labs
  Privacy: Using DNS-over-TLS with the Quad9 DNS Service
  Mon 20 Nov 2017
  Media   DNS Privacy   Stubby
Blog post on how to configure Stubby for use with Quad9 by Alex Band
  getdns-1.2.1 release
  Sat 11 Nov 2017
  Stubby
Just bug-, robustness- and stability-fixes
  First release candidate for getdns-1.2.1
  Fri 03 Nov 2017
  Stubby
Just bug-, robustness- and stability-fixes
  getdns-1.2.0 release
  Fri 29 Sep 2017
  Stubby   Zero config DNSSEC
Zero configuration DNSSEC, Stubby config in YAML format and resilient TLS upstream management
  First release candidate for getdns-1.2.0
  Fri 22 Sep 2017
  Stubby   Zero config DNSSEC
Zero configuration DNSSEC, YAML config files and resilient TLS upstream management
  KSK rollover impact on getdns
  Tue 12 Sep 2017
  Willem Toorop   Announcement   Zero config DNSSEC
How does the upcoming root KSK impact getdns
  DNS over TLS: experience from the Go6lab
  Tue 05 Sep 2017
  Media   DNS Privacy   Stubby
Jan Žorž giving Stubby a spin in this excellent article on ISOC's Deploy360 blog
  getdns-1.1.3 release
  Mon 04 Sep 2017
  Stubby
Bugfixes and Stubby in its own repository
  First release candidate for getdns-1.1.3
  Fri 25 Aug 2017
  Stubby
Bugfixes and Stubby in its own repository
  DNS Privacy daemon - Stubby
  Wed 23 Aug 2017
  Sara Dickinson   Stubby   DNS Privacy
A reference page on how to get up and running with Stubby!
  Der coole Stubby
  Fri 18 Aug 2017
  Media   DNS Privacy   Stubby
Stubby mentioned in article about progress in DNS privacy in c't magazine
  getdns-1.1.2 release
  Mon 03 Jul 2017
  Stubby
At runtime upstream statistics logging
  First release candidate for getdns-1.1.2
  Wed 28 Jun 2017
  Stubby
At runtime upstream statistics logging
  getdns-1.1.1 release
  Thu 15 Jun 2017
  Stubby
stubby.conf and DNS setup script + guidance
  First release candidate for getdns-1.1.1
  Thu 08 Jun 2017
  Stubby
stubby.conf and DNS setup script + guidance
  getdns-1.1.0 release
  Thu 13 Apr 2017
  1.1.0 release   Stubby
New features release. Functions for serving DNS. Stubby on board!
  Second release candidate for getdns-1.1.0
  Thu 06 Apr 2017
  1.1.0 release   Stubby
Fixes for things uncovered during IETF98 Hackathon.
  First release candidate for getdns-1.1.0
  Thu 23 Mar 2017
  1.1.0 release   Stubby
New features release. Functions for serving DNS. Stubby on board!
  Another mention of Stubby in the register
  Tue 06 Dec 2016
  Media   Stubby   DNS Privacy
Stubby in The Register again in an article about IETF pervasive monitoring work
  The Register article about Stubby
  Tue 22 Nov 2016
  Media   Stubby   DNS Privacy
The popular UK online computer magazine theregister.co.uk published an article about Stubby
  heise.de article about Stubby
  Thu 17 Nov 2016
  Media   Stubby   DNS Privacy
The popular German online computer magazine Heise.de published an article about Stubby
  DNS Privacy
  Sun 13 Nov 2016
  Tutorial @ IETF97
  Sara Dickinson   Stubby   DNS Privacy
DNS Privacy tutorial mentioning stubby at the IETF97 in Seoul
  Stubby
  Wed 19 Oct 2016
  NANOG68
  Willem Toorop   Stubby
Introducting Stubby at the NANOG68 in Dallas