sean/zdns
Watch
1
0
Fork
You've already forked zdns
 0
Code Issues Pull requests 2 Projects Releases 12 Packages Wiki Activity
12 releases 12 tags
  • v0.1.11 bb8e3d2500

    zdns v0.1.11 Stable

    pipeline-bot released this 2026-07-08 13:51:53 +00:00 | 0 commits to main since this release

    Fixed

    • recursor --help now documents --http-listen <addr:port> (was <addr>).
      The flag is parsed by parseListenAddr, which requires a port, so the old
      help led users to --http-listen 127.0.0.1, which fails with InvalidAddress.
    • parseListenAddr now rejects an empty address with error.InvalidAddress
      instead of indexing addr[0] out of bounds (a panic in safe builds). A bare
      listen= in a config file, or --listen "", hit this. Added a test.

    Changed

    • README quick-start config example now uses listen=127.0.0.1:5354, matching
      the port used by make docker-serve / docker-compose so a copied example
      lines up with the documented dig -p 5354 smoke test.
    Downloads
  • v0.1.10 e851973c38

    zdns v0.1.10 Stable

    gitea_admin released this 2026-07-01 21:20:36 +00:00 | 14 commits to main since this release

    Added

    • Authoritative systemd service zdns@.service (a template, one instance per
      zone). Drop a zone at /etc/zdns/zones/<name>.zone and run
      systemctl enable --now zdns@<name> to serve it via zdns-serve using
      /etc/zdns/serve.conf. Same hardening as the recursor unit (DynamicUser, only
      CAP_NET_BIND_SERVICE, ProtectSystem=strict). Ships a default serve.conf
      (safe listen=127.0.0.1:5301; set 0.0.0.0:53 for public serving) and an
      example zone at /usr/share/doc/zdns/examples/example.com.zone. Note:
      zdns-serve is single-zone and binds a fixed metrics port, so run one instance
      per host. Completes the PowerDNS daemon pair (authoritative + recursor).
    Downloads
  • v0.1.9 97c2977f6c

    zdns v0.1.9 Stable

    gitea_admin released this 2026-07-01 20:58:38 +00:00 | 18 commits to main since this release

    Added

    • man pages for all four binaries — zdns-recursor(8), zdns-serve(8),
      zdns-serve-tcp(8), and zdist(8) — installed by the Debian/RPM packages under
      /usr/share/man/man8. Each documents the synopsis, options (including the new
      --version), configuration keys, and files, so man zdns-recursor now works.
      Sources live in packaging/man/; the release version is substituted in at build
      time.
    Downloads
  • v0.1.8 cc47071ce9

    zdns v0.1.8 Stable

    gitea_admin released this 2026-07-01 20:38:12 +00:00 | 22 commits to main since this release

    Added

    • --version (and -V) on every binary. zdns-serve, zdns-serve-tcp,
      zdns-recursor, and zdist now print <name> <version> and exit, so an
      operator (and the CI smoke gate) can ask a build what it is. The version is
      wired in at build time via -Dversion (the release pipeline passes the
      build.zig.zon version; a plain zig build reports 0.0.0-dev). Implemented
      as a small shared src/version.zig helper with unit tests.
    Downloads
  • v0.1.7 1adc1774b8

    zdns v0.1.7 Stable

    gitea_admin released this 2026-07-01 19:58:26 +00:00 | 26 commits to main since this release

    Added

    • The Debian/RPM packages now install a systemd service. The recursive
      resolver ships as zdns-recursor.service — hardened (DynamicUser, only
      CAP_NET_BIND_SERVICE, ProtectSystem=strict, NoNewPrivileges) — with a
      default config at /etc/zdns/recursor.conf. The safe default binds
      127.0.0.1:5300 (never an open resolver, no clash with systemd-resolved on
      :53); set listen=0.0.0.0:53 to serve a network (the unit already grants the
      privileged-port capability). apt install zdns / dnf install zdns now enable
      and start the recursor. Unit, config, and maintainer scripts live in packaging/.

    Added

    • edns/clampUdpPayloadSize: a test exercising the RFC 6891 EDNS0 UDP
      requestor's payload-size clamp branches — a value below the 512-byte floor
      clamps up to 512, a value above the 4096-byte ceiling clamps down to 4096,
      and an in-range value passes through unchanged. The clamp bounds were
      previously unpinned, so an off-by-one at either edge would have passed
      silently.
    Downloads
  • v0.1.6 8009e4697b

    zdns v0.1.6 Stable

    gitea_admin released this 2026-07-01 13:56:01 +00:00 | 28 commits to main since this release

    Added

    • edns/clampUdpPayloadSize: a test exercising the RFC 6891 EDNS0 UDP
      requestor's payload-size clamp branches — a value below the 512-byte floor
      clamps up to 512, a value above the 4096-byte ceiling clamps down to 4096,
      and an in-range value passes through unchanged. The clamp bounds were
      previously unpinned, so an off-by-one at either edge would have passed
      silently.
    Downloads
  • v0.1.5 17371e869c

    zdns v0.1.5 Stable

    gitea_admin released this 2026-07-01 11:57:02 +00:00 | 31 commits to main since this release

    Added

    • dnssec/keytag: a correctness test pinning computeKeytag to the canonical
      RFC 4034 Appendix B.1 vector (example. DNSKEY 256/3/5 → key id 60485). The
      existing tests only asserted keytag > 0, so a carry/byte-order regression
      would have passed silently.
    Downloads
  • v0.1.4 f3cb18ed83

    zdns v0.1.4 Stable

    gitea_admin released this 2026-06-28 15:26:28 +00:00 | 35 commits to main since this release

    Changed

    • First release shipped through the consolidated, ArgoCD-delivered pipeline —
      shared ClusterWorkflowTemplates from sean/pipelines driven by the
      registry ApplicationSet, instead of the per-project scripts/zdns
      kubectl-apply set. The promote now git fetch --unshallows before the
      ancestry check (the ReleasedOnFullClone contract invariant).
    Downloads
  • v0.1.3 b9ecb32c5d

    zdns v0.1.3 Stable

    gitea_admin released this 2026-06-27 19:25:11 +00:00 | 37 commits to main since this release

    Security

    • rdata parsers (CERT, IPSECKEY, CSYNC, ZONEMD, SVCB): guard rdlength - consumed
      against integer underflow. A malformed record whose rdlength is shorter than its
      fixed header made the length computation wrap — a panic in safe builds (a DoS on a
      crafted packet), or an over-large read otherwise. These five now reject it with
      PacketTooShort, matching the guard the other rdata parsers already had.
    Downloads
  • v0.1.1 c0b7d650ab

    zdns v0.1.1 Stable

    gitea_admin released this 2026-06-27 19:02:53 +00:00 | 41 commits to main since this release

    Automated release. Install (signed): apt/dnf at pkg.sean.farm/zdns

    Downloads