[ldns-users] ldns 1.7.0 released

[Willem Toorop]

Dear maintainers and users of ldns software,

I am pleased to announce that version 1.7.0 of ldns is now available.

This is primarily a bugfix and maintenance release.  For a list of
fixed bugs and maintenance work see the Changelog below.

The most prominent changes of this release are related DANE verification
and OpenSSL 1.1.0 support.

Verification of TLSA RRs with the DANE-TA usage type in previous
versions of ldns had issues.  Also, the DANE verify functions that ldns
exposes do not provide means to address End Entity name verification.
Therefore we strongly recommend to use the DANE verification functions
provided by OpenSSL >= 1.1.0 instead.

ldns has been adapted to deal with this situation as follows:
All ldns DANE verification functions will be mapped directly to
OpenSSL's >= 1.1.0 DANE verification functions.

The ldns-dane example tool will use OpenSSL >= 1.1.0 DANE functions
directly when available.

configure will fail when OpenSSL >= 1.1.0 is not available.

To compile ldns linked with an older version of OpenSSL or with
LibreSSL, one has to either

  - disable the DANE verification functions with the
    --disable-dane-verify configure option
    (the functions to create TLSA RR's will still be available), or

  - disable verification of DANE-TA usage type with the
    --disable-dane-ta-usage configure option.

    In this last case, ldns_dane_verify() will return an
    LDNS_STATUS_DANE_NEED_OPENSSL_GE_1_1_FOR_DANE_TA error code when
    the only TLSA RR's that matched the certificate were of the
    DANE-TA usage type.


GOST support in OpenSSL >= 1.1.0 is now only available through a
separate to be installed engine (see:
https://github.com/gost-engine/engine/wiki ).  ldns configure only
includes support for GOST when available, however with OpenSSL >= 1.1.0,
GOST support might not be available but become available later when an
GOST engine is installed and configured.

Use the --enable-gost-anyway option to configure, to configure ldns with
OpenSSL >= 1.1.0 *and* GOST support, even when it is not available at
compile time.


Because ldns will potentially have a  different set of function
prototypes or supported algorithms (for example when compiled with
--disable-dane-verify, or without GOST support) and because of ABI
breakage in earlier versions, the .so version of this release of ldns is
bumped.  From now on .so versions will no longer follow ldns's own
version number, but will be based on libtool's version information
scheme that we also practice with libunbound and libgetdns.


I hope this release will be useful for you and that you will keep us
informed of your experiences.

Best regards,

Willem


link  : https://nlnetlabs.nl/downloads/ldns/ldns-1.7.0.tar.gz
sha256: c19f5b1b4fb374cfe34f4845ea11b1e0551ddc67803bd6ddd5d2a20f0997a6cc
asc   : https://nlnetlabs.nl/downloads/ldns/ldns-1.7.0.tar.gz.asc


Changelog:
==========
* Fix lookup of relative names in ldns_resolver_search.
* bugfix #548: Double free for answers > 4096 in ldns_resolver_send_pkt
* Follow CNAME's when tracing with drill (TODO dnssec trace)
* Fix #551 change Regent to Copyright holder in BSD license in
  some of the headings of the file, to match the opensource.org
  BSD license.
* -e option makes ldns-compare-zones exit with status code 2 on
  difference
* Filter out specified RR types with ldns-read-zone -e and -E options
* bugfix #563: Correct DNSKEY from DSA private key. Thanks Peter Koch.
* bugfix #562: ldns-keygen match DSA key maximum size with library.
  And check keysizes with all algorithms. Thanks Peter Koch.
* ldns-verify-zone accepts only one single zonefile as argument.
* bugfix #573: ldns-keygen write private keys with mode 0600.
  Thanks Leon Weber
* Fix configure to make ldns compile with LibreSSL 2.0
* drill now also accepts dig style -y option
  (-y <[algo:]name:key> i.s.o. -y <name:key[:algo]>)
* OPENPGPKEY draft rr types. Enable with: --enable-rrtype-openpgpkey
* bugfix #608: Correct comment about escaped characters
* CDS and CDNSKEY rr type from RFC 7344.
  --enable-rrtype-cds configure option removed
* fix: Memory leak in ldns_pkt_rr_list_by_name()
  Thanks Johannes Naab
* fix: Memory leak in ldns_dname2buffer_wire_compress()
  Thanks Max Liebkies
* bugfix #613: Allow tab as whitespace too in last rdata field of types
  of variable length.  Thanks Xiali Yan
* bugfix: strip trailing whitespace from $ORIGIN lines in zone files
* Let ldns-keygen output .ds files only for KSK keys
* Parse RFC7218 TLSA mnemonics, but do not output them
* Let ldns-dane use SPKI as the default selector i.s.o. Cert
* bugfix: Fit left over NSEC3s once more before adding empty non
  terminals.  Thanks Stuart Browne
* bugfix #605: Determine default trust anchor location at compile time
  Thanks Peter Koch
* bugfix #697: Double free with ldns-dane create
  Thanks Carsten Strotmann
* bugfix #623: Do not redefine bool type and boolean values
  Thanks Jakob Petsovits
* bugfix #570: Add TLSA, CDS, CDNSKEY and OPENPGPKEY RR types to ldnsx
  Thanks Shussain
* bugfix #575: ldns_pkt_clone() does not copy timestamp field
  Thanks Calle Dybedahl
* bugfix #584: ldns-update fixes.  Send update to port 53, bring manpage
  in sync with the usage text, and don't alter the ldns_resolver passed
  to ldns_update_soa_zone_mname().  Created a ldns_resolver_clone()
  function in the process.  Thanks Nicholas Riley.
* bugfix #633: ldns_pkt_clone() parameter isn't const.
  Thanks Jakop Petsovits
* bugfix: ldns-dane manpage correction
  Thanks Erwin Lansing
* Spelling fixes.  Thanks Andreas Schulze
* Hyphen used as minus in manpages.  Thanks Andreas Schulze.
* RFC7553 RR Type URI is supported by default.
* Fix ECDSA signature generation, do not omit leading zeroes.
* bugfix: Get rid of superfluous newline in ldns-keyfetcher
  Thanks Jan-Piet Mens
* bugfix: -U option to ldns-signzone to sign with every algorithm
  Thanks Guido Kroon
* const function parameters whenever possible.
  Thanks Ray Bellis
* bugfix #725: allow RR-types on the type bitmap window border
  Thanks Pieter Lexis
* bugfix #726: 2 typos in drill manpage.
  Thanks Hugo Lombard
* Add type CSYNC support, RFC 7477.
* Prepare for ED25519, ED448 support: todo convert* routines in
  dnssec.h, once openssl has support for signing with these algorithms.
  The dns algorithm number is not yet allocated. These features are
  not fully implemented yet, openssl (1.1) does not support the
  algorithms enough to generate keys and sign and verify with them.
* Fix _answerfrom comment in ldns_struct_pkt.
* Fix drill axfr ipv4/ipv6 queries.
* Fix comment referring to mk_query in packet.h to pkt_query_new.
* Fix description of QR flag in packet.h.
* Fix for openssl 1.1.0 API changes.
* Remove commented out macro.  Thanks Thiago Farina
* bugfix #641: Include install-sh in .gitignore
* bugfix #825: Module import breaks with newer SWIG versions.
  Thanks Christoph Egger
* bugfix #796 - #792: Fix miscellaneous compiler warning issues.
  Thanks Ngie Cooper
* bugfix #769: Add support for :: in an IPv6 address
  Thanks Hajimu UMEMOTO
* bugfix #760: Detect superfluous text in presentation format
  Thanks Xiali Yan
* bugfix #708: warnings and errors with xcode 6.1/7.0
* bugfix #754: Memory leak in ldns_str2rdf_ipseckey
  Thanks Xiali Yan
* bugfix #661: Fail NSEC3 signing when NSEC domainname length
  would overflow.  Thanks Jan-Piet Mens.
* bugfix #771: hmac-sha224, hmac-sha384 and hmac-sha512 keys.
  Thanks Harald Jenny
* bugfix #680: ldns fails to reject invalidly formatted
  RFC 7553 URI RRs.  Thanks Robert Edmonds
* bugfix #678: Use poll i.s.o. select to support > 1024 fds
  Thanks William King
* Use OpenSSL DANE functions for verification (unless explicitly
  disabled with --disable-dane-ta-usage).
* Bumb .so version
* Include OPENPGPKEY RR type by default
* rdata processing for SMIMEA RR type
* Fix crash in displaying TLSA RR's.
  Thanks Andreas Schulze
* Update ldns-key2ds man page to mention GOST and SHA384 hash
  functions.  Thanks Harald Jenny
* Add sha384 and sha512 tsig algorithm. Thanks Michael Weiser
* Clarify data ownership with consts for tsig parameters.
  Thanks Michael Weiser
* bugfix: Fix detection of DSA support with OpenSSL >= 1.1.0
* bugfix #1160: Provide sha256 for release tarballs
* --enable-gost-anyway compiles GOST support with OpenSSL >= 1.1.0
  even when the GOST engine is not available.