GitLab

CPPFLAGS is a traditional build environment variable used to set C
pre-processor flags.  Accept these flags during the build if they've
been set.

iterate: update zone cut when NS is authoritative for both parent and child

See merge request knot/knot-resolver!543

In some cases the NS is authoritative for both parent and the child side of
the delegation (e.g. nrl.navy.mil). When it gets the query for such NS,
it can respond from the child side with an NS record in the answer and AA=1.
The resolver should update the zone cut accordingly, otherwise it would fail
validation in cases when the child-side of the delegation is insecure,
but parent side  of the delegation is secure, because the child side
would respond without DNSSEC records, and it wouldn't indicate that
the zone cut needs updating (when using minimal answers) (e.g. www.nrl.navy.mil).

lib/resolve: cut fetching: don't use root hints if no keys fetched, but glue addresses found

See merge request knot/knot-resolver!513

Nitpicks

See merge request knot/knot-resolver!537

- clickable module references
- clickable RFC references via :rfc:`NNN#anchor`

and make docs conform to the reality.

validator: fix CNAME to NXDOMAIN in a single answer

See merge request knot/knot-resolver!538

Real example: cname.nohats.ca
This case was handled for forwarding only, presumably because it
happened more often (no need to be withing single zone to be within
single answer); now the approach is the same.

Release 2.2.0

See merge request knot/knot-resolver!535

Serve stale with reputation cache: version 1

See merge request knot/knot-resolver!534

lib/nsrep: tuning of serve-stale parameters; valid NS's sometimes been ignored by ns election algorithm, fixed

cache: fixed crash with RR sets with over 255 records

See merge request knot/knot-resolver!532

The previous cache version encoded RR count as uint8_t, which doesn't
work with RR sets with over 255 records. This caused cache writes
to fail and subsequently ending in an assertion failure.
It is not very common to have large RR sets, but it has legitimate
use cases such as a lot of SRV or address records for large container
deployments etc.

daemon/worker: allow large responses for outbound over TCP

See merge request knot/knot-resolver!526

This was previously fixed in e25358d4,
but broken in the rewrite. The answer buffer size must be a maximum size,
otherwise payloads larger than configured UDP buffer size can't be
transmitted over TCP.

debian: build dev packages without symbols file

See merge request knot/knot-resolver!524