Real example: cname.nohats.ca
This case was handled for forwarding only, presumably because it
happened more often (no need to be withing single zone to be within
single answer); now the approach is the same.

Release 2.2.0

See merge request !535

Serve stale with reputation cache: version 1

See merge request !534

Grigorii Demidov authored 7 years ago and Petr Špaček committed 7 years ago

lib/nsrep: tuning of serve-stale parameters; valid NS's sometimes been ignored by ns election algorithm, fixed

cache: fixed crash with RR sets with over 255 records

See merge request !532

The previous cache version encoded RR count as uint8_t, which doesn't
work with RR sets with over 255 records. This caused cache writes
to fail and subsequently ending in an assertion failure.
It is not very common to have large RR sets, but it has legitimate
use cases such as a lot of SRV or address records for large container
deployments etc.

daemon/worker: allow large responses for outbound over TCP

See merge request !526

Marek Vavruša authored 7 years ago and Grigorii Demidov committed 7 years ago

This was previously fixed in e25358d4,
but broken in the rewrite. The answer buffer size must be a maximum size,
otherwise payloads larger than configured UDP buffer size can't be
transmitted over TCP.

debian: build dev packages without symbols file

See merge request !524

packaging: tests - explicitly specify repository for testing

See merge request !525

daemon/tls: downgraded TLS logging to verbose

See merge request !531

Logging handshake and connection failures should be verbose, as
it's not really a server failure if client errors, or uses a wrong
SPKI pin to the certificate. It is however not ideal to flood logs.

README: update package information

See merge request !529

ci: execute OBS build nightly instead of after every change

See merge request !528

There are couple reasons to prefer nightly builds:
- to conserve hw resources
- automated builds at predictable times make it easier to use the devel
repo for manual testing builds

This is just annoying for development.  You want -O0 or -Og,
and consequently you get lots of warnings that are difficult to disable.

I believe hardening options are more of a responsibility/choice of the
caller, typically distributions have some general policies and pass the
flags (almost) uniformly to all packages.  I can't see any part of kresd
being so specific to warrant explicit hardening.

The file is new here, but it has a long history upstream.
Thanks to Leo Vandewoestijne for finding the problem on FreeBSD.

NDEBUG has no effect on this, for a long time.

ci: respdiff - plot histogram

See merge request !521

rpm: don't turn off selinux

See merge request !520