Versions history | AdGuard

More! More bugfixes! 🧟‍♀️

But this time, for a change, there's a couple of new minor features to go with them. Hope you don't mind 🤷‍♂️

A special thanks to our open-source contributor, @ashishwt, as well as to everyone who filed and inspected issues, added translations, and helped us to test this release!

Added

Support for reinstall (-r) and uninstall (-u) flags in the installation script #2462.

Support for DHCP DECLINE and RELEASE message types #3053.

Changed

Add microseconds to log output.

Fixed

Intermittent "Warning: ID mismatch" errors #3087.

Error when using installation script on some ARMv7 devices #2542.

DHCP leases validation #3107, #3127.

Local PTR request recursion in Docker containers #3064.

Ignoring client-specific filtering settings when filtering is disabled in general settings #2875.

Disallowed domains are now case-insensitive #3115.

Other minor fixes and improvements.

It's not Friday? Not a problem! We defy the tradition of Friday hotfixes by rushing another one out a day earlier 🙌

A special thanks to our open-source contributor, @jankais3r, as well as to everyone who filed issues, added translations, and helped us to test this release!

Fixed

Uniqueness validation for dynamic DHCP leases #3056.

Various other issues #3075, #3077.

We had a release a couple days ago. You all knew it would come to this. 🦸

It's Friday.

It's hotfix time! 🔥

Nothing serious though, we didn't even break anything. Just cleaning up some minor bugs. 🧹

Fixed

Local domain name handling when the DHCP server is disabled #3028.

Normalization of perviously-saved invalid static DHCP leases #3027.

Validation of IPv6 addresses with zones in system resolvers #3022.

Quite a lot of changes this time around, even if there aren't as many standouts as in some of the previous updates. We're sure that you'll be able to find a line or two in the changelog that speaks to you!

And one of the reasons for that is the constant support from the community. 👥👥 Special thanks to our open-source contributors: @jvoisin and @Paraphraser, as well as to everyone who filed issues, added translations, and helped us to test this release! 🙇

The ability to set up custom upstreams to resolve PTR queries for local addresses and to disable the automatic resolving of clients' addresses #2704

This option will improve your DNS privacy when it comes to addressing local resources. Give it a go unless you want to share your private data with googles of the world.

Search by clients' names in the query log #1273

There's not much that can be said about this feature, it's quite self-explanatory: now you can search up queries by specific clients. 🤷‍♀️

However, we wanted to highlight it anyway since so many of you have asked for it for quite a while. Hopefully, we delivered! 😅

Added

The ability to block user for login after configurable number of unsuccessful attempts for configurable time #2826.

$denyallow modifier for filters #2923.

Hostname uniqueness validation in the DHCP server #2952.

Hostname generating for DHCP clients which don't provide their own #2723.

New flag --no-etc-hosts to disable client domain name lookups in the operating system's /etc/hosts files #1947.

Logging of the client's IP address after failed login attempts #2824.

Verbose version output with -v --version #2416.

The ability to set a custom TLD or domain name for known hosts in the local network #2393, #2961.

The ability to serve DNS queries on multiple hosts and interfaces #1401.

ips and text DHCP server options #2385.

SRV records support in $dnsrewrite filters #2533.

Changed

Our DoQ implementation is now updated to conform to the latest standard draft #2843.

Quality of logging #2954.

Normalization of hostnames sent by DHCP clients #2945, #2952.

The access to the private hosts is now forbidden for users from external networks #2889.

The reverse lookup for local addresses is now performed via local resolvers #2704.

Stricter validation of the IP addresses of static leases in the DHCP server with regards to the netmask #2838.

Stricter validation of $dnsrewrite filter modifier parameters #2498.

New, more correct versioning scheme #2412.

Deprecated

Go 1.15 support. v0.107.0 will require at least Go 1.16 to build.

Fixed

Multiple answers for $dnsrewrite rule matching requests with repeating patterns in it #2981.

Root server resolving when custom upstreams for hosts are specified #2994.

Inconsistent resolving of DHCP clients when the DHCP server is disabled #2934.

Comment handling in clients' custom upstreams #2947.

Overwriting of DHCPv4 options when using the HTTP API #2927.

Assumption that MAC addresses always have the length of 6 octets #2828.

Support for more than one /24 subnet in DHCP #2541.

Invalid filenames in the mobileconfig API responses #2835.

Removed

Go 1.14 support.

There are big flashy updates, and there are seemingly unassuming ones, which constitute, however, the backbone of any successful project. This is the latter, as you may have guessed. You'll find here a heap of bugfixes and a security update for CVE-2021-27935.

Security

Session token doesn't contain user's information anymore (#2470).

Fixed

Incomplete hostnames with trailing zero-bytes handling (#2582).

Wrong DNS-over-TLS ALPN configuration (#2681).

Inconsistent responses for messages with EDNS0 and AD when DNS caching is enabled (#2600).

Incomplete OpenWrt detection (#2757).

DHCP lease's expired field incorrect time format (#2692).

Incomplete DNS upstreams validation (#2674).

Wrong parsing of DHCP options of the ip type (#2688).

Have you ever thought about why traditions are so important?🧙‍♂️ Traditions help us remember that we are part of a history that defines our past, shapes who we are today, and who we are likely to become. This is why we at AdGuard respect our traditions, and the most important one is pushing the inevitable hotfix right after every major update.🔥🔧

Jokes aside, here's the list of things fixed and improved in this hotfix.

Changed

Increased HTTP API timeouts (#2671, #2682).

"Permission denied" errors when checking if the machine has a static IP no longer prevent the DHCP server from starting (#2667).

The server name sent by clients of TLS APIs is not only checked when strict_sni_check is enabled (#2664).

HTTP API request body size limit for the POST /control/access/set and POST /control/filtering/set_rules HTTP APIs is increased (#2666, #2675).

Fixed

Error when enabling the DHCP server when AdGuard Home couldn't determine if the machine has a static IP.

Optical issue on custom rules (#2641).

Occasional crashes during startup.

The field "range_start" in the GET /control/dhcp/status HTTP API response is now correctly named again (#2678).

DHCPv6 server's ra_slaac_only and ra_allow_slaac settings aren't reset to false on update any more (#2653).

The Vary header is now added along with Access-Control-Allow-Origin to prevent cache-related and other issues in browsers (#2658).

The request body size limit is now set for HTTPS requests as well.

Incorrect version tag in the Docker release (#2663).

DNSCrypt queries weren't marked as such in logs (#2662).

We took our sweet time with this update, but you'll most certainly find it to be worth the wait. The changelog contains three absolute 💥bangers and a laundry list of lesser changes.

🕵️‍♂️ Client ID support for DNS-over-HTTPS, DNS-over-QUIC, and DNS-over-TLS #1387

This feature would be really useful to those of you who run an encrypted DNS resolver on a public server. In short, you can now identify your devices not just by their IP address (which is, frankly, not too useful in a public server scenario 🤷‍♀️), but by using a special "Client ID".

Here's how it works:

First, you add a client and specify an arbitrary string as its "Identifier", for instance, my-iphone.

On the client device you can now configure:

DNS-over-HTTPS: https://example.org/dns-query/my-iphone

DNS-over-TLS: tls://my-iphone.example.org (requires a Wildcard certificate)

DNS-over-QUIC: quic://my-iphone.example.org (requires a Wildcard certificate)

Queries and stats are now properly attributed to your device.

🔐 AdGuard as a DNSCrypt-resolver #1361

DNSCrypt was the very first DNS encryption protocol that got some traction. It may not be as popular as DoH/DoT/DoQ now, but it is still viable. Moreover, performance-wise DNSCrypt is better than any of them. And now that v0.105.0 is out, AdGuard Home can be configured to work as a DNSCrypt resolver!

However, here goes the tricky part. We haven't yet exposed these settings to the Web admin panel so if you want to have DNSCrypt, you'll need to follow this instruction and do it via editing the configuration file (AdGuardHome.yaml). Not that it would scare you off, would it? 🤓

Regarding DNSCrypt clients - AdGuard for Android, Windows and iOS support it, Mac will get its support pretty soon. Besides that, here is a long list of client software that supports it as well.

🆎 `$dnsrewrite` and `$dnstype` modifiers #2102 #2337

AdGuard Home now supports two more powerful rule modifiers that will help blocklists' maintainers.

$dnstype lets you narrow down the rule scope and apply it only to queries of a specific type(s). For instance, Apple devices now support HTTPS DNS query type. While being generally a good thing, this new type may sometimes be harmful😲. By using $dnstype you can block it completely using a simple rule like this: $dnstype=HTTPS

$dnsrewrite is another powerful modifier that allows you to modify DNS responses. Note that this modifier is much more powerful compared to something like a hosts file.

Here are some examples:

||example.org^$dnsrewrite=SERVFAIL;; - return SERVFAIL for example.org and all it's subdomains

|test.example.org^$dnsrewrite=NOERROR;TXT;hello_world - add a TXT record for test.example.org

|example.org^$dnsrewrite=example.com - redirect example.org to example.com

|example.org^$dnsrewrite=1.1.1.1 - redirect example.org to example.com

You can find more examples in the documentation.

Added

Added more services to the "Blocked services" list #2224, #2401

ipset subdomain matching, just like dnsmasq does #2179

The host checking API and the query logs API can now return multiple matched rules #2102

Detecting of network interface configured to have static IP address via /etc/network/interfaces #2302

A 5 second wait period until a DHCP server's network interface gets an IP address #2304

HTTP API request body size limit #2305

Changed

Access-Control-Allow-Origin is now only set to the same origin as the domain, but with an HTTP scheme as opposed to * #2484

workDir now supports symlinks.

Stopped mounting together the directories /opt/adguardhome/conf and /opt/adguardhome/work in our Docker images #2589

When dns.bogus_nxdomain option is used, the server will now transform responses if there is at least one bogus address instead of all of them #2394. The new behavior is the same as in dnsmasq.

Post-updating relaunch possibility is now determined OS-dependently #2231, #2391

Made the mobileconfig HTTP API more robust and predictable, add parameters and improve error response #2358

Improved HTTP requests handling and timeouts #2343

Our snap package now uses the core20 image as its base #2306

New build system and various internal improvements #2271, #2276, #2297, #2509, #2552, #2639, #2646

Deprecated

Go 1.14 support. v0.106.0 will require at least Go 1.15 to build.

The darwin/386 port. It will be removed in v0.106.0.

The "rule" and "filter_id" fields in GET /filtering/check_host and GET /querylog responses. They will be removed in v0.106.0 #2102

Fixed

Autoupdate bug in the Darwin (macOS) version #2630

Unnecessary conversions from string to net.IP, and vice versa #2508

Inability to set DNS cache TTL limits #2459

Possible freezes on slower machines #2225

A mitigation against records being shown in the wrong order on the query log page #2293

A JSON parsing error in query log #2345

Incorrect detection of the IPv6 address of an interface as well as another infinite loop in the /dhcp/find_active_dhcp HTTP API #2355

Removed

The undocumented ability to use hostnames as any of bind_host values in the configuration. Documentation requires them to be valid IP addresses, and now the implementation makes sure that that is the case #2508

Dockerfile #2276. Replaced with the script scripts/make/build-docker.sh which uses scripts/make/Dockerfile.

Support for pre-v0.99.3 format of query logs #2102

Bugfixes... 😌 There's something about them that we just can't resist. We always want more! 🧟

When there's nothing more to fix, we just roll out a new major update, introduce some fresh bugs and start all over. It's a circle of life ☯️

Luckily, there are still some to prey upon in v0.104. Have a look at what we've fixed this time:

Fixed

Don't expose the profiler HTTP API #2336

Load query logs from files after loading the ones buffered in memory #2325

Don't show Unnecessary errors in logs when switching between query log files #2324

Don't show 404 Not Found errors on the DHCP settings page on Windows. Show that DHCP is not currently available on that OS instead #2295

Fix an infinite loop in the /dhcp/find_active_dhcp HTTP API method #2301

Various internal improvements

Those who pay close attention to AdGuard Home releases know that we keep hotfixes close to our hearts 🔥♥️ This time we held for as long as we could, but ultimately gave in to the urge 😔

Here's a patch to v0.104 with some fixes and minor improvements.

Fixed

Solve the permission denied error when launching a DHCP server on Linux using Snap #2228. Users experiencing this issue should refresh their snap and call:

snap connect adguard-home:network-control

This won't be required in the future versions.

Use matching fonts in the Custom Filters textarea #2254

Show the correct query type for DNS-over-QUIC queries in query log #2241

Increase the default number of simultaneous requests to improve performance #2257

Always set a secondary DNS in DHCP #1708

Improve stability on DNS proxy restart #2242

Improve logging on DNS proxy restart #2252

Don't show a “Loading” message and don't rerequest logs once we've reached the end of logs on the query log page #2229

Various internal improvements.

We have something special for y'all today. Not just an implementation of a new feature but the first ever implementation of a new feature! 😮 This is about DNS-over-QUIC, a new DNS encryption protocol — read on to learn more.

Ah, yes, there's also a bunch of other good stuff, too: DHCP-related changes, a .mobileconfig generator for iOS and macOS, and a handful of other enhancements and bugfixes.

DNS-over-QUIC support #2049

AdGuard Home now natively supports a new DNS encryption protocol called DNS-over-QUIC. DoQ standard is currently in the draft state, and AdGuard Home (and dnsproxy) is it's first open-source implementation.🥇

So what's good about it? 🤔 Unlike DoH and DoT, it uses QUIC as a transport protocol and finally brings DNS back to its roots — working over UDP. It brings all the good things that QUIC has to offer — out-of-the-box encryption, reduced connection times, better performance when data packets are lost. Also, QUIC is supposed to be a transport-level protocol and there are no risks of metadata leaks that could happen with DoH. 🔒

At this moment, the only major public DNS resolver that provides DNS-over-QUIC is AdGuard DNS. 😎 Use quic://dns-unfiltered.adguard.com in the upstreams settings to start using AdGuard DNS "Non-Filtering".

DHCP rework: DHCP6 support, custom DHCP options

We did a huge rework of our DHCP server implementation. Thanks to it, AdGuard Home now supports DHCP6 and allows setting custom DHCP options.

Please note that in order to set DHCP options, you'll need to edit the configuration file.

Add support for DHCPv6: #779

DHCPv6 RA+SLAAC: #2076

DHCP: automatic hostnames: #1956

Add DHCP Options: #1585

iOS and MacOS .mobileconfig generator: #2110

iOS 14 and macOS Big Sur natively support DNS-over-HTTPS and DNS-over-TLS. However, it's not that simple to configure them — you need to install a special "configuration profile" for that. 🤯 In order to make things easier, AdGuard Home can generate these configuration profiles for you. Just head to "Setup Guide" -> "DNS Privacy" and scroll to iOS.

Binary transparency

AdGuard Home binaries are now signed with our GPG key and you can now easily verify that they really come from us: https://github.com/AdguardTeam/AdGuardHome/wiki/Verify-Releases

Other improvements

Allow entering comments to the Upstreams box: #2083

Load upstreams list from a file: #1680

Add ARMv8 to future releases, potentially append a v8 binary to the most recent non-beta release: #2125

Redesign query logs block/unblock buttons: #2050

Treat entries starting with "/" as "://" under specific circumstances: #1950

Use "Null IP" instead of NXDOMAIN by default: #1914

Bootstrap with TCP upstreams: #1843

Add block and unblock buttons to 'check the filtering' result: #1734

ipset feature support: #1191

Add Belarusian and Chinese Traditional HK languages: #2106

Add new language: en-silk: #1796

Use DOH or DOT as bootstrap: #960

Fixed

Reverse lookups return empty answers for hosts from /etc/hosts: #2085

Static lease hostnames are overridden by client-identifier: #2040

Query log doesn't display name for blocked services: #2038

Custom filter editor works with delay: #1657

Incorrect link address: #2209

Smartphone compatible design for user interface: #2152

Misleading information during service installation: #2128

Remove the limit on cache-min-ttl, 3600: #2094

Cannot change minimum TTL override in UI: #2091

Optical Issue on mobile phone: #2090

Setting a large DNS Cache Size in the Web GUI will exceed the unit32 range.: #2056

Clients requests aren't counted properly: #2037

Publish privacy policy on front page (README.md): #1960

Sorting various IP Address Columns in the UI (eg in dhcp static leases) does not sort correctly. They are treated as strings instead of numeric.: #1877

Requests count for clients with CIDR IP addresses: #1824

Home Release - AdGuard versions

Added

Changed

Fixed

Fixed

Fixed

The ability to set up custom upstreams to resolve PTR queries for local addresses and to disable the automatic resolving of clients' addresses #2704

Search by clients' names in the query log #1273

Added

Changed

Deprecated

Fixed

Removed

Security

Fixed

Changed

Fixed

🕵️‍♂️ Client ID support for DNS-over-HTTPS, DNS-over-QUIC, and DNS-over-TLS #1387

🔐 AdGuard as a DNSCrypt-resolver #1361

🆎 $dnsrewrite and $dnstype modifiers #2102 #2337

Added

Changed

Deprecated

Fixed

Removed

Fixed

Fixed

DNS-over-QUIC support #2049

DHCP rework: DHCP6 support, custom DHCP options

iOS and MacOS .mobileconfig generator: #2110

Binary transparency

Other improvements

Fixed

🆎 `$dnsrewrite` and `$dnstype` modifiers #2102 #2337