Changelogs for 4.4.x

4.4.3

Released: 25th of March 2022

This is a security fix release for PowerDNS Security Advisory 2022-01. Additionally, because CentOS 8 is End Of Life now, we have switched those builds to Oracle Linux 8. The resulting packages are compatible with RHEL and all derivatives.

Bug Fixes

• Fix validation of incremental zone transfers (IXFRs).

  References: pull request 11453

4.4.2

Released: 25th of November 2021

This is version 4.4.2 of the Authoritative Server. It fixes one issue.

Bug Fixes

• RFC2136/nsupdate: apply new TTL to whole RRset, not only to the added record

  References: pull request 11004

4.4.1

Released: 8th of February 2021

This is version 4.4.1 of the Authoritative Server. This releases fixes several small issues discovered since the release of 4.4.0.

Improvements

• debian packaging update

  References: pull request 9965

• dockerfiles: do not claim equivs-dummy is built from the pdns source package

  References: pull request 9953

• Fix missing #include for gcc-11

  References: pull request 9952

• lmdb: Do a mdb_readers_check to clean up stale readers on database load

  References: pull request 9946

Bug Fixes

• fix TCP answer counters

  References: pull request 10008

• run deleteDomain() inside a transaction

  References: pull request 10039

• lmdb: do not reuse backend that has seen corrupted data

  References: pull request 9985

• lmdb: serialise LMDBBackend construction to ensure only a single schema upgrade is attempted

  References: pull request 9949

• backport some asan/ubsan fixes

  References: pull request 9923

• pdnsutil edit-zone: do not exit on ZoneParser exception

  References: pull request 9912

4.4.0

Released: 18th of December 2020

This is version 4.4.0 of the Authoritative Server.

This release drops GSS/TSIG support, please see PowerDNS Security Advisory 2020-06.

Version 4.4.0 brings a bunch of exciting changes:

• the LMDB backend now supports long record content, making it production ready for everybody
• the SVCB and HTTPS record types are supported, with limited additional processing
• transaction handling in the 2136 handler and the HTTP API was again improved a lot, avoiding various spurious issues users may have noticed if they do a lot of changes
• a new setting (consistent-backends) offers a roughly 30% speedup, subject to conditions
• we finally emit Prometheus metrics!

We want to specifically thank Robin Geuze, Kees Monshouwer, Mischan Toosarani-Hausberger, Chris Hofstaedtler, and Kevin Fleming for their contributions to this release. We are also grateful to all other reporters of bugs, issues, feature requests, and submitters of smaller fixes and features.

Please make sure to read the upgrade notes before upgrading.

Improvements

• don’t log trusted-notification-proxy notify at error level (Kees Monshouwer)

  References: pull request 9866

• Stop using incbin and use od & sed to generate constant string data.

  References: pull request 9853

Bug Fixes

• clear the LMDB set state when performing a new lookup or list to prevent corruption cases (Robin Geuze)

  References: pull request 9884

• SVCB: Correctly parse and print unknown params

  References: pull request 9878

• fix direct-dnskey in AXFR-out (Kees Monshouwer)

  References: pull request 9873

4.4.0-rc1

Released: 7th of December 2020

This is the first Release Candidate for version 4.4.0 of the Authoritative Server. If no trouble surfaces, we will release the actual 4.4.0 within a few weeks.

This release drops GSS/TSIG support, please see PowerDNS Security Advisory 2020-06.

Version 4.4.0 brings a bunch of exciting changes:

• the LMDB backend now supports long record content, making it production ready for everybody
• the SVCB and HTTPS record types are supported, with limited additional processing
• transaction handling in the 2136 handler and the HTTP API was again improved a lot, avoiding various spurious issues users may have noticed if they do a lot of changes
• a new setting (consistent-backends) offers a roughly 30% speedup, subject to conditions
• we finally emit Prometheus metrics!

We want to specifically thank Robin Geuze, Kees Monshouwer, Mischan Toosarani-Hausberger, Chris Hofstaedtler, and Kevin Fleming for their contributions to this release. We are also grateful to all other reporters of bugs, issues, feature requests, and submitters of smaller fixes and features.

Please make sure to read the upgrade notes before upgrading.

Improvements

• pdnsutil add-record: notice when backend does not support replaceRRSet

• add remote to default axfr logging (Kees Monshouwer)

  References: pull request 9765

• Fix the DNSName move assignment operator

  References: pull request 9761

Bug Fixes

• geoip: set netmask on all string formatting types (Kees Monshouwer)

  References: pull request 9816

• api-swagger.json: do not depend on .venv target

  References: pull request 9800

• Ensure socket-dir matches runtime dir on old systemd

  References: pull request 9798

• fix rounding inaccuracy in latency statistics (Kees Monshouwer)

  References: pull request 9785

• APL records: fix endianness problem

  References: pull request 9773

4.4.0-beta1

Released: 23rd of November 2020

This is version 4.4.0-beta1 of the Authoritative Server.

This release drops GSS/TSIG support, please see PowerDNS Security Advisory 2020-06.

Version 4.4.0 brings a bunch of exciting changes:

• the LMDB backend now supports long record content, making it production ready for everybody
• the SVCB and HTTPS record types are supported, with limited additional processing
• transaction handling in the 2136 handler and the HTTP API was again improved a lot, avoiding various spurious issues users may have noticed if they do a lot of changes
• a new setting (consistent-backends) offers a roughly 30% speedup, subject to conditions
• we finally emit Prometheus metrics!

We want to specifically thank Robin Geuze, Kees Monshouwer, Mischan Toosarani-Hausberger, Chris Hofstaedtler, and Kevin Fleming for their contributions to this release. We are also grateful to all other reporters of bugs, issues, feature requests, and submitters of smaller fixes and features.

Please make sure to read the upgrade notes before upgrading.

New Features

• allow ip ranges as trusted-notification-proxy

  References: pull request 9713

• Add ‘/api/docs’ endpoint to Auth server (Kevin Fleming)

  References: pull request 8911

• geoipbackend: accept custom lookup mapping (criteo-forks)

  References: pull request 8608

• make it possible to replace now supported TYPExx records (Kees Monshouwer)

  References: pull request 9693

• Add pdns_control command to the list of XFR domains in queue

  References: pull request 9239

Improvements

• nxdomain performance (Kees Monshouwer)

  References: pull request 9704

• logging: put quotes around some IPs to make messages easier to read

  References: pull request 9731

• Use Python 3 in build system (Kevin Fleming)

  References: pull request 9712

• adjust AXFR, IXFR events loglevels (Kees Monshouwer)

  References: pull request 9688

• pdnsutil zone key improvements (Chris Hofstaedtler)

  References: pull request 9692

• add some missing counters. Fixes #9675

  References: pull request 9685

Bug Fixes

• pdnsutil check-zone: DNAME fixes

  References: pull request 9735

• lmdb: fill di.serial (this fixes the ‘serial=0’ API bug)

  References: pull request 8707

• disable mysql automatic charset detection (see upgrade notes)

  References: pull request 9714

• tinydnsbackend: Ignore duplicate SOA in getAllDomains()

  References: pull request 9174

4.4.0-alpha3

Released: 5th of November 2020

This is version 4.4.0-alpha3 of the Authoritative Server.

Alpha 2 was not released due to the LMDB encoding bug mentioned below, found shortly after starting the Alpha 2 release process.

This release drops GSS/TSIG support, please see PowerDNS Security Advisory 2020-06.

Version 4.4.0 brings a bunch of exciting changes:

• the LMDB backend now supports long record content, making it production ready for everybody
• the SVCB and HTTPS record types are supported, with limited additional processing
• transaction handling in the 2136 handler and the HTTP API was again improved a lot, avoiding various spurious issues users may have noticed if they do a lot of changes
• a new setting (consistent-backends) offers a roughly 30% speedup, subject to conditions
• we finally emit Prometheus metrics!

We want to specifically thank Robin Geuze, Kees Monshouwer, Mischan Toosarani-Hausberger, and Chris Hofstaedtler for their contributions to this release. We are also grateful to all other reporters of bugs, issues, feature requests, and submitters of smaller fixes and features.

Please make sure to read the upgrade notes before upgrading.

New Features

• auth: add support for dnssec removal to CDS/CDNSKEY (Kees Monshouwer)

  References: pull request 9631

• pdns_control: add show <prefix> (Chris Hofstaedtler)

  References: pull request 9549

Removed Features

• Auth: remove SOA autofilling, remove set-ptr feature from API (Kees Monshouwer)

  References: pull request 9593

Improvements

• When consistent-backends is enabled, use ANY queries toward backends whenever possible. (Kees Monshouwer)

  References: pull request 9483, pull request 9656

• Deprecate local-ipv6 and query-local-address6, to prepare for removal in 4.5.0 (Chris Hofstaedtler, Kees Monshouwer)

  References: pull request 9552, pull request 9625

• pdns: bind-backend speedup feedRecord() (Kees Monshouwer)

  References: pull request 9611

• auth: Speedup presigned signature lookups. (Kees Monshouwer)

  References: pull request 9568

• auth: bindbackend: ‘rediscover’ changes to ‘type’ (Roald Stolte)

  References: pull request 9645

• gsql,bind: allow seamless serving of newly-supported TYPExx records (Chris Hofstaedtler)

  References: pull request 9623

Bug Fixes

• LMDB: Fix encoding of deleted RRsets (Kees Monshouwer)

  References: pull request 9664, pull request 9665

• auth lmdb: fill di.backend in getUnfreshSlaveInfos and getAllDomains (this makes the right serial appear in API calls)

  References: pull request 9647

• auth: change “misconfigured” SOA MNAME to not mention powerdns and be RFC6761 compliant

  References: pull request 9627

• LUA records: handle a potentially uncaught exception

  References: pull request 9613

• Fixes for APL records pointing to fe80 (Chris Hofstaedtler)

  References: pull request 9550, pull request 9580

• svc-records: Initialize d_port

  References: pull request 9544

4.4.0-alpha1

Released: 30th of September 2020

This is version 4.4.0-alpha1 of the Authoritative Server. This release drops GSS/TSIG support, please see PowerDNS Security Advisory 2020-06.

Version 4.4.0 brings a bunch of exciting changes:

• the LMDB backend now supports long record content, making it production ready for everybody
• the SVCB and HTTPS record types are supported, with limited additional processing
• transaction handling in the 2136 handler and the HTTP API was again improved a lot, avoiding various spurious issues users may have noticed if they do a lot of changes
• we finally emit Prometheus metrics!

We want to specifically thank Robin Geuze, Kees Monshouwer, Mischan Toosarani-Hausberger, and Chris Hofstaedtler for their contributions to this release. We are also grateful to all other reporters of bugs, issues, feature requests, and submitters of smaller fixes and features.

Please make sure to read the upgrade notes before upgrading.

New Features

• Allow forced secondary zone retrieval

  References: pull request 8824

• Add a new command to add a super-master to SQL backends (Godwottery)

  References: pull request 7963

• API: Allow rectifying Slave zones (Chris Hofstaedtler)

  References: pull request 9183

• Implemented prometheus metrics-endpoint for auth (supervacuus)

  References: pull request 9182

Removed Features

• Remove GSS/TSIG support

  References: pull request 9385

Improvements

• New RRtypes: SVCB, HTTPS, APL. Fixed RRtypes: IPSECKEY.

  References: pull request 8638, pull request 9337, pull request 9369

• LMDB: new schema that supports long records (Robin Geuze)

  References: pull request 9389

• bindbackend: ‘rediscover’ changes to master and also-notifies (Matti Hiljanen)

  References: pull request 9524

• quote/escape PG connection parameters

  References: pull request 9039

• lua: add backtraces to errors

  References: pull request 8942

• Skip EDNS Cookies in the packet cache

  References: pull request 8993

• Use more of systemd’s sandboxing options when available

  References: pull request 8969

• auth slave: log successful NOTIFY (Chris Hofstaedtler)

  References: pull request 9387

• sdig: Increment the DNS message IDs when pipelining, report ID mismatches

  References: pull request 9419, pull request 9430

• Add support for FreeBSD’s SO_REUSEPORT_LB

  References: pull request 9157

• LUA records: two improvements to createForward

  References: pull request 9101

• geoipbackend: top looking after first weighted match, propagate weighted rounding gap fix (criteo-forks)

  References: pull request 8564, pull request 8565

• Make a combination of delete and replace for rrset possible (jonathaneen)

  References: pull request 8623

• log more pdns_control actions (Chris Hofstaedtler)

  References: pull request 9218

• gsqlbackend: allow backend-specific queries (Chris Hofstaedtler)

  References: pull request 9318

• add used master address to slave check logs (Chris Hofstaedtler)

  References: pull request 9265

• immediately fill account, kind, masters on zone create (Chris Hofstaedtler)

  References: pull request 9280

• fetch all metadata at once (Kees Monshouwer)

  References: pull request 9169

• Add version ‘statistic’ to prometheus

  References: pull request 9252

• PKCS11 improvements

  References: pull request 9215

• gpgsqlbackend: add parameters to query logging (Chris Hofstaedtler)

  References: pull request 9189

• Set SyslogIdentifier for multiple instances (Chris Hofstaedtler)

  References: pull request 9187

• Optimize IXFR-to-AXFR fallback path (Chris Hofstaedtler)

  References: pull request 9163

• auth smysql: mimic error message format from mysql tooling

  References: pull request 9024

• improve sql schema updates (Kees Monshouwer)

  References: pull request 8975

• NSEC fixes for unpublished DNSKEY (RobinGeuze)

  References: pull request 8925, pull request 8939

• make sure we look at 10% of all cached items during cleanup (Kees Monshouwer)

  References: pull request 8929

• Reduce the number of temporary memory allocations

  References: pull request 8714

Bug Fixes

• Improved transaction handling, especially around the metadata cache (Kees Monshouwer)

  References: pull request 9407, pull request 9409, pull request 9427, pull request 9518

• ignore cryptokeys in presigned zones (Kees Monshouwer)

  References: pull request 9496

• remove a ‘// HACK FIXME400’ and fix the bugs it was hiding (Kees Monshouwer)

  References: pull request 9478

• Fix the sample ‘geoip.conf’ for Debian-based packages

  References: pull request 9439

• Fix building with LLVM11 (RvdE)

  References: pull request 9408

• Ensure qtype is set before calling setContent() in axfrfilter()

  References: pull request 8928

• Auth API: Allow removal of NSEC3PARAM metadata

  References: pull request 9340

• pdnsutil: make sure we let all destructors run.

  References: pull request 9253

• Remote Backend: Throw DBException in functions that allow it

  References: pull request 8943

• Ensure runtime dirs for virtual services differ

  References: pull request 9073

• better (actual) fix for mem leak in SSQLite3::execute()

  References: pull request 9080

• Avoid “pthread_rwlock_destroy on rwlock with waiters!” on OpenBSD

  References: pull request 9069

• BIND-DOMAIN-EXTENDED-STATUS: don’t look for a domain called BIND-DOMAIN-EXTENDED-STATUS

  References: pull request 9060