This is release 4.5.5 of the Authoritative Server. It contains various small fixes.
docker: upgrade to bullseye¶
References: pull request 11979
axfr-retriever: abort on chunk with TC set¶
References: pull request 12032
LUA records: we only need one IsUpOracle checker thread¶
References: pull request 12034
IXFR-in: Fix a case where an incomplete read caused by network error might result in a truncated zone¶
References: pull request 11454
This is a security fix release for PowerDNS Security Advisory 2022-01. Additionally, because CentOS 8 is End Of Life now, we have switched those builds to Oracle Linux 8. The resulting packages are compatible with RHEL and all derivatives.
Fix validation of incremental zone transfers (IXFRs).¶
References: pull request 11454
This is release 4.5.3 of the Authoritative Server. It mostly contains several robustness fixes for the LMDB backend, and for the zone cache. Please see the full list of fixes here:
2136: improve some log messages¶
References: pull request 11002
lmdb, check if the lookup name is part of the zone (Kees Monshouwer)¶
References: pull request 11158
pdnsutil edit-zone: fix n and e behaviour on increase-serial prompt¶
References: pull request 11146
improve tcp exception handling (Kees Monshouwer)¶
References: pull request 11123
lmdb: fix records removal in deleteDomain() (Kees Monshouwer)¶
References: pull request 11123
2136: apply new TTL to whole RRset, not only to the added record¶
References: pull request 11002
This is release 4.5.2 of the Authoritative Server. It contains several robustness fixes for the bindbackend, and for SOA handling. These fixes are especially important for zone cache users.
bindbackend: skip rejected zones during list and search¶
References: pull request 10968
make the zone cache more robust for bad data and save some SOA queries for DNSSEC zones (Kees Monshouwer)¶
References: pull request 10964
api, check SOA location (Kees Monshouwer)¶
References: pull request 10962
improve dnsname exception handling for SOA records (Kees Monshouwer)¶
References: pull request 10952
improve SOA parse exception handling (Kees Monshouwer)¶
References: pull request 10792
try to reload rejected zones in bind-backend once every bind-check-interval (Kees Monshouwer)¶
References: pull request 10778
This is release 4.5.1 of the Authoritative Server. It is strictly a security fix release for Advisory 2021-01.
auth: correct upper bounds on d_qtypecounters¶
References: pull request 10611
This is release 4.5.0 of the Authoritative Server. This release contains a ton of improvements and bug fixes compared to 4.4, but very few user visible changes.
There are two notable new features:
Since 4.5.0-beta1, the zone cache is enabled by default.
Please make sure to read the upgrade notes before upgrading.
fix building without sqlite (this got broken between RC1 and RC2). Thanks to our trusty FreeBSD port maintainer Ralf van der Enden for noticing and reporting this.¶
References: pull request 10579
This is the second, and hopefully last, release candidate for version 4.5.0 of the Authoritative Server. This release contains a ton of improvements and bug fixes compared to 4.4, but very few user visible changes.
There are two notable new features:
Since 4.5.0-beta1, the zone cache is enabled by default.
Please make sure to read the upgrade notes before upgrading.
bindbackend: purge caches on zone reload; store nsec3 settings at zone load¶
References: pull request 10552
Use correct TTL when caching responses from backends (Robin Geuze)¶
References: pull request 10551
This is the first release candidate for version 4.5.0 of the Authoritative Server. This release contains a ton of improvements and bug fixes compared to 4.4, but very few user visible changes.
The one notable feature is the “zone cache”, which allows PowerDNS to keep a list of zones in memory, updated periodically. With this cache, PowerDNS can avoid hitting the database with queries for unknown domains. In some setups, and some attack scenarios, this can make a serious performance difference.
Since 4.5.0-beta1, the zone cache is enabled by default.
Please make sure to read the upgrade notes before upgrading.
newCAFromRaw(): create ComboAddress from raw 4/16 byte strings, plus test¶
References: pull request 9474
2136: allow placing DNSKEY/CDS/CDNSKEY regardless of direct-dnskey setting¶
References: pull request 10514
pdnsutil add-autoprimary: print error when exiting with 1¶
References: pull request 10512
pdnsutil create-zone: better error if default-soa-content is broken¶
References: pull request 10509
pdnsutil add-zone-key: clarify ZSK default¶
References: pull request 10373
SVCB additional processing: delay inserts to avoid invalidating iterator; do not chase chains outside of zone¶
References: pull request 10522
pdnsutil edit-zone: correctly reask inc-serial question¶
References: pull request 10513
SVCB: on parse error, throw instead of truncate¶
References: pull request 10511
SVCB: Fix auto hints removing non-auto hints¶
References: pull request 10510
This is version 4.5.0-beta1 of the Authoritative Server. This release contains a ton of improvements and bug fixes compared to 4.4, but very few user visible changes.
The one notable feature is the “zone cache”, which allows PowerDNS to keep a list of zones in memory, updated periodically. With this cache, PowerDNS can avoid hitting the database with queries for unknown domains. In some setups, and some attack scenarios, this can make a serious performance difference.
In beta1, the zone cache is enabled by default.
Please make sure to read the upgrade notes before upgrading.
LUA records: add filterForward function, to limit the scope of createForward[6]¶
References: pull request 10463
add/fix getAllDomains() and enable the zone cache by default (Kees Monshouwer)¶
References: pull request 10454
simplify createDomain() (Kees Monshouwer)¶
References: pull request 10461
SVCB: rename echconfig to ech and add test vectors from draft¶
References: pull request 10342
This is version 4.5.0-alpha1 of the Authoritative Server. This release contains a ton of improvements and bug fixes compared to 4.4, but very few user visible changes.
The one notable feature is the “zone cache”, which allows PowerDNS to keep a list of zones in memory, updated periodically. With this cache, PowerDNS can avoid hitting the database with queries for unknown domains. In some setups, and some attack scenarios, this can make a serious performance difference.
Please make sure to read the upgrade notes before upgrading.
SVCB
improvements, including a new svc-autohints
setting¶
References: pull request 10074
New RRtypes supported: CSYNC
, NID
, L32
, L64
, and LP
¶
References: pull request 10078, pull request 10121, pull request 10172, pull request 10234, pull request 10256
API HTTP cryptokeys: add cds array when configured to do so¶
References: pull request 10217
sdig: DoT support; TCP Fast Opens support for TCP/DoT/DoH¶
References: pull request 10060, pull request 10149, pull request 9995
Serve NSEC3PARAM when asked without DO¶
References: pull request 9958
Add a cache of all zones, avoiding backend lookups for zones that do not exist, and for non-existing subzones. (Chris Hofstaedtler)¶
References: pull request 10432, pull request 9464
gpgsql backend: drop refcursor support (it never worked anyway)¶
References: pull request 10259
remove local-ipv6, query-local-address6, after their deprecation in 4.4¶
References: pull request 10251
Check sizeof(time_t)
to be at least 8. This makes it easier for us to handle times beyond the years 2038 and 2106 safely. This removes support for platforms where time_t
is still only 32 bits wide.¶
References: pull request 10010
Lower max-nsec3-iterations to 100 (Kees Monshouwer)¶
References: pull request 10260
add an option to in/exclude disabled zones in the pdnsutil list-all-zone and list-keys output (Kees Monshouwer)¶
References: pull request 10421
Swagger/OpenAPI improvements (Kevin Fleming)¶
References: pull request 8999, pull request 9788
Ensure socket-dir matches runtimedir on old systemd¶
References: pull request 9574
Various logging improvements (Kees Monshouwer, nzlosh)¶
References: pull request 9764, pull request 9847, pull request 9848, pull request 9910
Various improvements to the Docker image (rytis, james-crowley)¶
References: pull request 10028, pull request 10067, pull request 10068, pull request 10165, pull request 9752, pull request 9803
Build improvements (support for new compilers and boost versions, etc.), improved usage of some library constructs, and architecture specific fixes¶
References: pull request 10016, pull request 10137, pull request 10141, pull request 10216, pull request 10245, pull request 10269, pull request 10271, pull request 10310, pull request 10329, pull request 10336, pull request 10344, pull request 9749, pull request 9819, pull request 9831, pull request 9832, pull request 9857, pull request 9876, pull request 9895, pull request 9911, pull request 9914, pull request 9920, pull request 9930, pull request 9932, pull request 9937, pull request 9955, pull request 9979
Switch to C++17¶
References: pull request 9913
LMDB improvements (better transaction safety; support for the disabled
field; better upgrade handling; stale reader cleanup; other bug fixes) (Robin Geuze, Kees Monshouwer)¶
References: pull request 10013, pull request 10099, pull request 10107, pull request 10186, pull request 9885, pull request 9888, pull request 9933
Implement priority levels in the AXFR queue (Robin Geuze)¶
References: pull request 10196
pdns.conf, pdnsutil, pdns_control: add modern aliases for words like master and slave. Add a setting to ignore unknown settings, to make mixed-version testing easier. (Chris Hofstaedtler, Kees Monshouwer)
While changing names, Kees Monshouwer also renamed ‘domain’ to ‘zone’ in a ton of places.
¶References: pull request 10430, pull request 9658, pull request 9669
When rectifying, do not update ordernames/auth when there is no need (Kees Monshouwer)¶
References: pull request 10236
memory usage reporting: use RES instead of “data” size¶
References: pull request 10161
pdnsutil: Warn on CNAME targets for NS, MX and SRV¶
References: pull request 10087
Also disable PMTU for IPv6 (it was disabled for IPv4 already)¶
References: pull request 10264
Make check-zone also check whether there are duplicate key value pair metadatas for the zone (RobinGeuze)¶
References: pull request 8813
detect possible metadata cache pollution (Kees Monshouwer)¶
References: pull request 9520
change the consistent-backends default to ‘yes’¶
References: pull request 10401
Make sure we recheck failed SOA lookups for notifies (Kees Monshouwer)¶
References: pull request 10399
geoip: set netmask on all string formatting types¶
References: pull request 9813
fix rounding inaccuracy in latency statistics (Kees Monshouwer)¶
References: pull request 9768
pdnsutil add-record: notice when backend does not support replaceRRSet¶
References: pull request 9775
Fixed bugs in the implementations of the SVCB
, HTTPS
, IPSECKEY
and APL
types.¶
References: pull request 9766, pull request 9844, pull request 9919
ALIAS: Ensure A and AAAA are in the NSEC bitmap¶
References: pull request 10155
pdnsutil load-zone: reject zones with broken rrs¶
References: pull request 10081
pdnsutil edit-zone: do not exit on ZoneParser exception¶
References: pull request 9826
fix tcp answer counters (Kees Monshouwer)¶
References: pull request 10007
run deleteDomain() inside a transaction (Kees Monshouwer)¶
References: pull request 10037
gsqlite3: handle escaping correctly for API search¶
References: pull request 8829
fix direct-dnskey in AXFR-out (Kees Monshouwer)¶
References: pull request 9872
auth: Don’t choke on non-base64 values when importing zone keys¶
References: pull request 10364
gpgsql: use SELECT .. RETURNING to get inserted row ID¶
References: pull request 10392