[new release] dns, dns-tsig, dns-stub, dns-server, dns-resolver, dns-mirage, dns-client, dns-cli and dns-certify (6.0.0)

[hannesm]

An opinionated Domain Name System (DNS) library

• Project page: https://github.com/mirage/ocaml-dns
• Documentation: https://mirage.github.io/ocaml-dns/

CHANGES:

• use Cstruct.length instead of deprecated Cstruct.len

• avoid deprecated fmt functions

• BREAKING dns: Rr_map.get_ttl is now ttl, and takes 'a key -> 'a -> int32
  (instead of b -> int32), Rr_map.with_ttl now is 'a key -> 'a -> int32 -> 'a
  (instead of b -> int32 -> b) (Dns: revise Rr_map.get_ttl and with_ttl to take 'a key -> 'a instead of b mirage/ocaml-dns#264 @hannesm)

• BREAKING dns: Rr_map.A now uses Ipaddr.V4.Set.t, Aaaa uses Ipaddr.V6.Set.t
  (requires ipaddr 5.2.0) (use set and map from Ipaddr (since 5.2.0) mirage/ocaml-dns#268 @hannesm)

• BREAKING dns.cache: type entry now is polymorphic ('a entry = Entry of 'a ...) (instead of Entry of Rr_map.b) (dns-cache: use a more specific type for get and set mirage/ocaml-dns#263 @reynir and @hannesm)

• BREAKING dns.cache: use a LRU.F.t instead of LRU.M.t (revise cache mirage/ocaml-dns#256 @hannesm)

• dns.cache: provide get_or_cname and get_any function (revise cache mirage/ocaml-dns#256 further fixes for cache and resolver mirage/ocaml-dns#257 @hannesm)

• BUGFIX dns.cache: update if time to live of cached entry expired
  (reported in github.com is unavailable the second time mirage/ocaml-dns#259 by @dinosaure, fix by @reynir and @hannesm)

• dns-client support DNS-over-TLS (RFC 7858): the type io_addr is now a variant
  of Plaintext (Ipaddr.t * int) or Tls (Tls.Config.client * Ipaddr.t * int)
  By default, ca-certs (ca-certs-nss for MirageOS) are used as trust anchors,
  and the certificate is expected to contain the IP address of the resolver.
  The default resolver (anycast.uncensoreddns.org) certificate is verified by
  hostname, since the let's encrypt certificate does not include an IP address
  in SubjectAlternativeNames (DNS-over-TLS implementation for dns-client mirage/ocaml-dns#270 @hannesm)

• BREAKING dns-client.mirage.Make is extended by a Mirage_clock.PCLOCK
  (DNS-over-TLS implementation for dns-client mirage/ocaml-dns#270 @hannesm)

• BREAKING dns-client, dns-stub: use Dns.proto instead of custom [TCP|UDP]
  (client & stub: use Dns.proto ([Tcp|Udp]) instead of [TCP|UDP] mirage/ocaml-dns#266 @hannesm)

• dns-client: use a mutable timeout_ns : int64 instead of
  timeout_ns : int64 ref (github.com is unavailable the second time mirage/ocaml-dns#259 @hannesm)

• BREAKING dns-client: remove ?nameserver from
  getaddrinfo/gethostbyname/gehostbyname6/get_resource_record - if a custom
  nameserver should be queried, a distinct Dns_client.t can be constructed
  (client updates: use a single TCP connection and multiplex over that mirage/ocaml-dns#269 @reynir and @hannesm)

• dns-client: multiplex over TCP connections (client updates: use a single TCP connection and multiplex over that mirage/ocaml-dns#269 @reynir and @hannesm)

• dns-client: use happy-eyeballs to connect to all nameservers from
  /etc/resolv.conf sequentially (lwt and mirage) (client updates: use a single TCP connection and multiplex over that mirage/ocaml-dns#269 @reynir and @hannesm)

• BREAKING dns-client remove UDP support from lwt (DNS-over-TLS implementation for dns-client mirage/ocaml-dns#270 @reynir and @hannesm)

• BREAKING dns-resolver remove "mode" from codebase, default to recursive
  (a stub resolver is available as dns-stub) (resolver: remove "mode" - which defaults to `Recursive mirage/ocaml-dns#260 @hannesm)

• dns-resolver: use dns.cache instead of copy in Dns_resolver_cache
  (revise cache mirage/ocaml-dns#256 @hannesm)

• BUGFIX dns-resolver: fix responses to queries (reported in Bad middle step about DNS resolver on Mirage when we ask a domain-name mirage/ocaml-dns#255 by @dinosaure,
  fix in Resolver fixes mirage/ocaml-dns#258 by @reynir and @hannesm)

• dns-resolver: refactor and cleanup code, remove statistics, remove dead code
  (Resolver fixes mirage/ocaml-dns#258 More resolver fixes mirage/ocaml-dns#261 @reynir @hannesm)

• dns-stub: reconnect to resolver, resend all outstanding queries
  (github.com is unavailable the second time mirage/ocaml-dns#259 @hannesm)

[hannesm]

it is very likely that reverse dependencies are failing, I'll wait for CI and add some upper bounds.

[dinosaure]

Note that I'm currently try to fix lower-bounds on dkim here #19801 - so please don't care about CI errors about lower-bounds error on this specific package.

[dinosaure]

Waiting the CI for few packages but it seems ready to merge.

[hannesm]

indeed that looks very good to me.

[mseri]

dkim is already being fixed here: #19801
conduit-mirage 4 lower bounds can be fixed in a separate PR, could you send a PR for that before we merge this?

The rest look good.

[mseri]

Feel free to merge once that fix is in a PR

[hannesm]

conduit-mirage 4 lower bounds can be fixed in a separate PR, could you send a PR for that before we merge this?

I'm not sure I understand the issue and how to solve it -- it may be that eqaf.cstruct used to be only installed (depopt) if something was installed... imho this PR is fine to merge, and the conduit-mirage 4.0.0 lower bounds can be fixed subsequently (sorry I don't have a fix at my hands, so leaving this for later).

[hannesm]

ok, I pushed a dependency for mirage-crypto-pk 0.8.0 (bigarray-compat) which is needed to get (in eqaf < 0.8.0) eqaf.cstruct. in mirage-crypto-0.8.1+, this dependency is already present. the way forward is to depend on eqaf >= 0.8.0 which does no longer require bigarray-compat for eqaf.cstruct.

[hannesm]

so from my point of view this PR is ready to be merged. remaining CI faliures are unrelated (and dkim is fixed in a separate PR).

[mseri]

I agree

[mseri]

Question, do we need to make mirage-crypto-pk.0.8.0 incompatible with arm32 bit systems?

arm32
    mirage-crypto-pk.0.8.0
        tests (failed: All:3:RSA:3:RSA-OAEP(SHA1)-ENC:2:selftest.)

I merged to avoid retriggering so many builds with the extra fix. This can be fixed separately if needed

[hannesm]

@mseri please don't. it is supposed to work. previous threads: #19754 (comment) #19689 (comment)

if someone has time to look into the CI system and what signal -22 is meaning -- maybe finds a reproducible way with qemu, I'm happy to look into it.