From 0e2d29cb35333859be1feb622416b84d07079504 Mon Sep 17 00:00:00 2001 From: Simon Sigre Date: Thu, 10 Oct 2024 08:31:56 +0000 Subject: [PATCH] Resolves https://github.com/coredns/coredns.io/issues/313 --- content/blog/coredns-1.11.2.md | 53 ++++++++++++++++++++++ content/blog/coredns-1.11.3.md | 59 ++++++++++++++++++++++++ content/plugins/autopath.md | 4 +- content/plugins/bind.md | 4 +- content/plugins/dnstap.md | 12 +++-- content/plugins/forward.md | 19 +++++++- content/plugins/kubernetes.md | 8 ++-- content/plugins/rewrite.md | 83 +++++++++++++++++++++++++++++++++- content/plugins/root.md | 34 ++++++++++++-- content/plugins/tls.md | 6 +-- content/plugins/view.md | 10 ++-- 11 files changed, 266 insertions(+), 26 deletions(-) create mode 100644 content/blog/coredns-1.11.2.md create mode 100644 content/blog/coredns-1.11.3.md diff --git a/content/blog/coredns-1.11.2.md b/content/blog/coredns-1.11.2.md new file mode 100644 index 00000000..66ebff63 --- /dev/null +++ b/content/blog/coredns-1.11.2.md @@ -0,0 +1,53 @@ ++++ +title = "CoreDNS-1.11.2 Release" +description = "CoreDNS-1.11.2 Release Notes." +tags = ["Release", "1.11.2", "Notes"] +release = "1.11.2" +date = "2024-01-26T00:00:00+00:00" +author = "coredns" ++++ + +This release contains some new features, bug fixes, and package updates. +New features include: +* When the _forward_ plugin receives a malformed upstream response that overflows, + it will now send an empty response to the client with the truncated (TC) bit set to prompt the client + to retry over TCP. +* The _rewrite_ plugin can now rewrite response codes. +* The _dnstap_ plugin now supports adding metadata to the dnstap `extra` field. + +## Brought to You By + +Amila Senadheera, +Ben Kochie, +Benjamin, +Chris O'Haver, +Grant Spence, +John Belamaric, +Keita Kitamura, +Marius Kimmina, +Michael Grosser, +Ondřej Benkovský, +P. Radha Krishna, +Rahil Bhimjiani, +Sri Harsha, +Tom Thorogood, +Willow (GHOST), +Yong Tang, +Yuheng, +Zhizhen He, +guangwu, +journey-c, +pschou + +## Noteworthy Changes + +* plugin/tls: respect the path specified by root plugin (https://github.com/coredns/coredns/pull/6138) +* plugin/auto: warn when auto is unable to read elements of the directory tree (https://github.com/coredns/coredns/pull/6333) +* plugin/etcd: the etcd client adds the DialKeepAliveTime parameter (https://github.com/coredns/coredns/pull/6351) +* plugin/cache: key cache on Checking Disabled (CD) bit (https://github.com/coredns/coredns/pull/6354) +* plugin/forward: Use the correct root domain name in the forward plugin's health checks (https://github.com/coredns/coredns/pull/6395) +* plugin/forward: Handle UDP responses that overflow with TC bit (https://github.com/coredns/coredns/pull/6277) +* plugin/rewrite: fix multi request concurrency issue in cname rewrite (https://github.com/coredns/coredns/pull/6407) +* plugin/rewrite: add rcode as a rewrite option (https://github.com/coredns/coredns/pull/6204) +* plugin/dnstap: add support for "extra" field in payload (https://github.com/coredns/coredns/pull/6226) +* plugin/cache: fix keepttl parsing (https://github.com/coredns/coredns/pull/6250) diff --git a/content/blog/coredns-1.11.3.md b/content/blog/coredns-1.11.3.md new file mode 100644 index 00000000..3ccf6c3e --- /dev/null +++ b/content/blog/coredns-1.11.3.md @@ -0,0 +1,59 @@ ++++ +title = "CoreDNS-1.11.3 Release" +description = "CoreDNS-1.11.3 Release Notes." +tags = ["Release", "1.11.3", "Notes"] +release = "1.11.3" +date = "2024-04-24T16:57:00-04:00 +author = "coredns" ++++ + +This release contains some new features, bug fixes, and package updates. Because of the deployment issues with the previous release, all changed features from 1.11.2 have been included in this release. +New features include: +* When the _forward_ plugin receives a malformed upstream response that overflows, + it will now send an empty response to the client with the truncated (TC) bit set to prompt the client + to retry over TCP. +* The _rewrite_ plugin can now rewrite response codes. +* The _dnstap_ plugin now supports adding metadata to the dnstap `extra` field. + +## Brought to You By + +Amila Senadheera, +Ben Kochie, +Benjamin, +Chris O'Haver, +Grant Spence, +John Belamaric, +Keita Kitamura, +Marius Kimmina, +Michael Grosser, +Ondřej Benkovský, +P. Radha Krishna, +Rahil Bhimjiani, +Sri Harsha, +Tom Thorogood, +Willow (GHOST), +Yong Tang, +Yuheng, +Zhizhen He, +guangwu, +journey-c, +pschou +Ted Ford + +## Noteworthy Changes + +* plugin/tls: respect the path specified by root plugin (https://github.com/coredns/coredns/pull/6138) +* plugin/auto: warn when auto is unable to read elements of the directory tree (https://github.com/coredns/coredns/pull/6333) +* plugin/etcd: the etcd client adds the DialKeepAliveTime parameter (https://github.com/coredns/coredns/pull/6351) +* plugin/cache: key cache on Checking Disabled (CD) bit (https://github.com/coredns/coredns/pull/6354) +* plugin/forward: Use the correct root domain name in the forward plugin's health checks (https://github.com/coredns/coredns/pull/6395) +* plugin/forward: Handle UDP responses that overflow with TC bit (https://github.com/coredns/coredns/pull/6277) +* plugin/rewrite: fix multi request concurrency issue in cname rewrite (https://github.com/coredns/coredns/pull/6407) +* plugin/rewrite: add rcode as a rewrite option (https://github.com/coredns/coredns/pull/6204) +* plugin/dnstap: add support for "extra" field in payload (https://github.com/coredns/coredns/pull/6226) +* plugin/cache: fix keepttl parsing (https://github.com/coredns/coredns/pull/6250) +* Return RcodeServerFailure when DNS64 has no next plugin (https://github.com/coredns/coredns/pull/6590) +* Change the log flags to be a variable that can be set (https://github.com/coredns/coredns/pull/6546) +* Bump go version to 1.21 (https://github.com/coredns/coredns/pull/6533) +* replace the mutex locks in logging with atomic bool for the "on" flag (https://github.com/coredns/coredns/pull/6525) +* Enable Prometheus native histograms (https://github.com/coredns/coredns/pull/6524) diff --git a/content/plugins/autopath.md b/content/plugins/autopath.md index b1bd20c5..9e8f8e07 100644 --- a/content/plugins/autopath.md +++ b/content/plugins/autopath.md @@ -4,7 +4,7 @@ description = "*autopath* allows for server-side search path completion." weight = 4 tags = ["plugin", "autopath"] categories = ["plugin"] -date = "2020-10-16T12:42:25.87725810" +date = "2024-10-10T08:30:45.87745810" +++ ## Description @@ -60,7 +60,7 @@ path) in the following case. To properly build the search path of a client *auto the namespace of the a Pod making a DNS request. To do this, it relies on the *kubernetes* plugin's Pod cache to resolve the client's IP address to a Pod. The Pod cache is maintained by an API watch on Pods. When Pod IP assignments change, the Kubernetes API notifies CoreDNS via the API watch. -However, that notification is not instantaneous. In the case that a Pod is deleted, and it's IP is +However, that notification is not instantaneous. In the case that a Pod is deleted, and its IP is immediately provisioned to a Pod in another namespace, and that new Pod make a DNS lookup *before* the API watch can notify CoreDNS of the change, *autopath* will resolve the IP to the previous Pod's namespace. diff --git a/content/plugins/bind.md b/content/plugins/bind.md index d6000f32..c69a7ce5 100644 --- a/content/plugins/bind.md +++ b/content/plugins/bind.md @@ -4,7 +4,7 @@ description = "*bind* overrides the host to which the server should bind." weight = 6 tags = ["plugin", "bind"] categories = ["plugin"] -date = "2023-08-15T20:06:20.8772088" +date = "2024-10-10T08:30:45.87745810" +++ ## Description @@ -16,7 +16,7 @@ If several addresses are provided, a listener will be open on each of the IP pro Each address has to be an IP or name of one of the interfaces of the host. Bind by interface name, binds to the IPs on that interface at the time of startup or reload (reload will happen with a SIGHUP or if the config file changes). -If the given argument is an interface name, and that interface has several IP addresses, CoreDNS will listen on all of the interface IP addresses (including IPv4 and IPv6), except for IPv6 link-local addresses on that interface. +If the given argument is an interface name, and that interface has several IP addresses, CoreDNS will listen on all of the interface IP addresses (including IPv4 and IPv6). ## Syntax diff --git a/content/plugins/dnstap.md b/content/plugins/dnstap.md index d529f41a..2b8aaf1a 100644 --- a/content/plugins/dnstap.md +++ b/content/plugins/dnstap.md @@ -4,7 +4,7 @@ description = "*dnstap* enables logging to dnstap." weight = 15 tags = ["plugin", "dnstap"] categories = ["plugin"] -date = "2023-08-15T20:06:20.8772088" +date = "2024-10-10T08:30:45.87745810" +++ ## Description @@ -18,7 +18,7 @@ Every message is sent to the socket as soon as it comes in, the *dnstap* plugin ## Syntax ~~~ txt -dnstap SOCKET [full] { +dnstap SOCKET [full] [writebuffer] [queue] { [identity IDENTITY] [version VERSION] [extra EXTRA] @@ -41,6 +41,12 @@ Log information about client requests and responses to */tmp/dnstap.sock*. dnstap /tmp/dnstap.sock ~~~ +Log information about client requests and responses and tcp write buffer is 1024*Mb and queue is 2048*10000. + +~~~ txt +dnstap /tmp/dnstap.sock full 1024 2048 +~~~ + Log information including the wire-format DNS message about client requests and responses to */tmp/dnstap.sock*. ~~~ txt @@ -98,7 +104,7 @@ dnstap tcp://example.com:6000 ## Command Line Tool Dnstap has a command line tool that can be used to inspect the logging. The tool can be found -at Github: . It's written in Go. +at GitHub: . It's written in Go. The following command listens on the given socket and decodes messages to stdout. diff --git a/content/plugins/forward.md b/content/plugins/forward.md index 77ca0b54..9c29c634 100644 --- a/content/plugins/forward.md +++ b/content/plugins/forward.md @@ -4,7 +4,7 @@ description = "*forward* facilitates proxying DNS messages to upstream resolvers weight = 20 tags = ["plugin", "forward"] categories = ["plugin"] -date = "2023-08-15T20:06:20.8772088" +date = "2024-10-10T08:30:45.87745810" +++ ## Description @@ -53,6 +53,7 @@ forward FROM TO... { policy random|round_robin|sequential health_check DURATION [no_rec] [domain FQDN] max_concurrent MAX + next RCODE_1 [RCODE_2] [RCODE_3...] } ~~~ @@ -98,6 +99,7 @@ forward FROM TO... { response does not count as a health failure. When choosing a value for **MAX**, pick a number at least greater than the expected *upstream query rate* * *latency* of the upstream servers. As an upper bound for **MAX**, consider that each concurrent query will use about 2kb of memory. +* `next` If the `RCODE` (i.e. `NXDOMAIN`) is returned by the remote then execute the next plugin. If no next plugin is defined, or the next plugin is not a `forward` plugin, this setting is ignored Also note the TLS config is "global" for the whole forwarding proxy if you need a different `tls_servername` for different upstreams you're out of luck. @@ -271,6 +273,21 @@ Or when you have multiple DoT upstreams with different `tls_servername`s, you ca } ~~~ +The following would try 1.2.3.4 first. If the response is `NXDOMAIN`, try 5.6.7.8. If the response from 5.6.7.8 is `NXDOMAIN`, try 9.0.1.2. + +~~~ corefile +. { + forward . 1.2.3.4 { + next NXDOMAIN + } + forward . 5.6.7.8 { + next NXDOMAIN + } + forward . 9.0.1.2 { + } +} +~~~ + ## See Also [RFC 7858](https://tools.ietf.org/html/rfc7858) for DNS over TLS. diff --git a/content/plugins/kubernetes.md b/content/plugins/kubernetes.md index b039009e..2f819f4a 100644 --- a/content/plugins/kubernetes.md +++ b/content/plugins/kubernetes.md @@ -4,7 +4,7 @@ description = "*kubernetes* enables reading zone data from a Kubernetes cluster. weight = 28 tags = ["plugin", "kubernetes"] categories = ["plugin"] -date = "2023-08-15T20:06:20.8772088" +date = "2024-10-10T08:30:45.87745810" +++ ## Description @@ -210,9 +210,11 @@ plugin is also enabled: * `kubernetes/service`: the service name in the query * `kubernetes/client-namespace`: the client pod's namespace (see requirements below) * `kubernetes/client-pod-name`: the client pod's name (see requirements below) + * `kubernetes/client-label/