[1.87.0] - 2026-10-12
- ADDED: A set can remove ECH keys from DNS answers, so a browser opens sites such as those on Cloudflare where the network drops connections that use ECH - the switch is under DNS & Routing, DNS Redirect, Encrypted ClientHello (ECH) in the set editor, and a set that lists cloudflare-ech.com with it on covers every Cloudflare site. Discovery proposes such a set, which changes no packets, for a site that loads only without ECH.
- CHANGED: On Keenetic, and on routers with an older kernel where b4 cannot hold DNS queries ahead of the kernel's connection tracking, DNS queries go on to the resolver the device asked, and b4 takes over that resolver's reply for the names a set blocks, pins or sends to its own resolver - that resolver and the servers it asks still see those names, also for a set with an encrypted resolver. System Info shows the row DNS queries copied, not held (NFLOG).
- FIXED: On Keenetic, a device that asked for a name's IPv4 and IPv6 addresses at once, and the router itself, still often lost the second answer after 1.85.1, while System Info showed DNS queries queued before conntrack (raw) as available or the log suggested kmod-ipt-raw, an OpenWrt package - KeeneticOS runs the raw table, where b4 queued DNS queries from 1.85.1 on, only after the kernel's connection tracking has registered them. #402
- FIXED: On routers with an older kernel, a device occasionally got only one of the two answers it asked for at once, IPv4 or IPv6, for a name in a set with a DNS redirect - b4 sent both answers at the same moment, and the kernel's connection tracking dropped one of them as a duplicate of the other.
- FIXED: On routers with iptables and an older kernel, such as Keenetic, connections through a set with SYN Fake Packets on took about a second longer to open, and with the UDP mode Fake & Fragment most of the fakes were lost, often along with the real first QUIC packet - since 1.25.0, b4 put the packets it sends itself through its own queue a second time, and the kernel's connection tracking on such a router dropped some of them.
- FIXED: A device that sends several DNS lookups from one socket, such as a DNS server on the local network, had its later lookups skip b4 once b4 had answered one of them itself or changed one of its answers, for example by removing the IPv6 addresses - b4's firewall rules marked the device's connection as one of b4's own when b4 sent the device an answer as a packet of its own.
- FIXED: Discovery reported a site, such as one on Cloudflare, as loading without b4 while Chrome could not open it - its probes never used ECH, which a browser such as Chrome uses for every site that publishes an ECH key and which some networks block.
- FIXED: Discovery could propose a packet strategy remembered from an earlier run for a site that only needed its DNS answer corrected - a remembered strategy that also loaded the site won over the DNS fix.
- FIXED: System Info listed tools such as jq, sha256sum and ipset without a version when they were on the USB drive b4 is installed on - b4 asked a tool for its version only when it sat in a standard system directory such as
/usr/binor/opt/bin.
What's Changed
- feat(tools): enhance tool version reporting for tools on USB drives by @DanielLavrushin in #419
- Add ECH support and DNS nameserver configuration by @DanielLavrushin in #420
- Implement DNS kernel handling and testing by @DanielLavrushin in #418
- DNS follow-ups to #418: CONNMARK save, escalation answers, nft DNS-over-TCP monitor, heal learning by @DanielLavrushin in #421
Full Changelog: v1.86.0...v1.87.0rc1