Previous topic

PowerDNS Security Advisory 2022-02: incomplete exception handling related to protobuf message generation

Next topic


This Page

Upgrade Guide

Before upgrading, it is advised to read the Changelogs. When upgrading several versions, please read all notes applying to the upgrade.

4.7.0 to master

Structured logging

All logging (except query tracing) has been converted to structured logging. Switch to old style logging by setting the structured-logging setting to no. When using systemd, structured logging information will be sent to journald using formatted text strings that list the key-value pairs and are human readable. Switch to native key-value pair logging (more suitable for automated log processing) by setting structured-logging-backend on the command line to systemd-journal.

New settings

pdns_recursor changes

THe --config command line option now implements the check, default and diff keywords.

rec_control changes

The dump-throttle and dump-edns subcommands no longer produces a table per thread, as the corresponding tables are now shared by all threads. Additionally, the dump-edns command now only lists IPs that have a not OK status. The dump-nsspeeds command has changed format to make it more readable and lists the last round trip time recorded for each address. The get-proxymapping-stats and get-remotelogger-stats subcommands have been added.

4.7.2 to 4.7.3

New settings

  • The max-ns-per-resolve setting to limit the number of NS records processed to resolve a name has been introduced.

4.6.2 to 4.7.0

Zone to Cache Changes

The Zone to Cache feature now validates ZONEMD records. This means that zones containing invalid ZONEMD records will be rejected by default, while previously the ZONEMD records would be ignored. For more detail, refer to Zone to Cache.

Asynchronous retrieval of AAAA records for nameservers

If IPv6 is enabled for outgoing queries using query-local-address, the Recursor will schedule an asynchronous task to resolve IPv6 addresses of nameservers it did not otherwise learn. These addresses will then be used (in addition to IPv4 addresses) for future queries to authoritative nameservers. This has the consequence that authoritative nameservers will be contacted over IPv6 in more case than before.

New Lua Configuration Functions

  • The addAllowedAdditionalQType() Lua configuration function was added to make the Recursor add additional records to answers for specific query types.
  • The addProxyMapping() Lua configuration function was added to map source addresses to alternative addresses.

Post Resolve FFI Function

A new postresolve_ffi() Lua callback function has been introduced.

New settings

  • The save-parent-ns-set setting has been introduced, enabling fallback cases if the parent NS set contains names not in the child NS set.
  • The max-busy-dot-probes settings has been introduced, enabling the Recursor probe for DoT support of authoritative servers. This is an experimental function, use with care.

rec_control changes

The dump-nsspeeds, dump-failedservers and dump-non-resolving subcommands no longer produce a table per thread, as the corresponding tables are now shared by all threads. They also use a better readable and sortable timestamp format.

4.6.3 to 4.6.4

New settings

  • The max-ns-per-resolve setting to limit the number of NS records processed to resolve a name has been introduced.

4.6.1 to 4.6.2

Deprecated and changed settings

  • The hint-file gained a special value no to indicate that no hint file should be processed. The hint processing code is also made less verbose.

4.5.x to 4.6.1

Offensive language

Using the settings mentioned in Offensive language now generates a warning. Please start using the new names.

File descriptor usage

The number of file descriptors used by the Recursor has increased because the Recursor now keeps idle outgoing TCP/DoT connections open for a while. The extra file descriptors used in comparison to previous versions of the Recursor is tcp-out-max-idle-per-thread times the number of worker threads (threads).

New settings

Deprecated and changed settings

  • The api-key and webserver-password settings now accept a hashed and salted version (if the support is available in the openssl library used).

Privileged port binding in Docker

In our Docker image, our binaries are no longer granted the net_bind_service capability, as this is unnecessary in many deployments. For more information, see the section “Privileged ports” in Docker-README.

4.5.10 to 4.5.11

New settings

  • The max-ns-per-resolve setting to limit the number of NS records processed to resolve a name has been introduced.

4.5.1 to 4.5.2

Deprecated and changed settings

4.4.x to 4.5.1

Offensive language

Synonyms for various settings names containing master, slave, whitelist and blacklist have been introduced.

Currently, the older setting names are also accepted and used. The next release will start deprecating them. Users are advised to start using the new names to avoid future trouble.

Special domains

Queries for all names in the .localhost domain will answer in accordance with RFC 6761 section 6.3 point 4. That means that they will be answered with, ::1 or a negative response.

rec_control command writing to a file

For the commands that write to a file, the file to be dumped to is now opened by the rec_control command itself using the credentials and the current working directory of the user running rec_control. A single minus - can be used as a filename to write the data to the standard output stream. Additionally, a single minus - can be used as a filename to write the data to the standard output stream. Previously the file was opened by the recursor, possibly in its chroot environment.

New settings

Deprecated and changed settings

Removed settings

4.3.x to 4.4.0

Response Policy Zones (RPZ)

To conform better to the standard, RPZ processing has been modified. This has consequences for the points in the resolving process where matches are checked and callbacks are called. See Response Policy Zones (RPZ) for details. Additionally a new type of callback has been introduced: policyEventFilter().

Dropping queries from Lua callbacks

The method to drop a query from a Lua callback has been changed. Previously, you could set rcode to pdns.DROP. See Callback Semantics for the new method.

Parsing of unknown record types

The parsing (from zone files) of unknown records types (of the form \# <length> <hex data>) has been made more strict. Previously, invalid formatted records could produce inconsistent results.

Deprecated and changed settings

New settings

  • The dns64-prefix setting has been added, enabling common cases of DNS64 handling without having to write Lua code.
  • The proxy-protocol-from and proxy-protocol-maximum-size settings have been added to allow for passing of Proxy Protocol Version 2 headers between a client and the recursor.
  • The record-cache-shards setting has been added, enabling the administrator to change the number of shards in the records cache. The value of the metric record-cache-contended divided by record-cache-acquired indicates if the record cache locks are contended. If so, increasing the number of shards can help reducing the contention.

4.2.x to 4.3.0

Lua Netmask class methods changed

  • Netmask class methods isIpv4 and isIpv6 have been deprecated in Lua, use Netmask.isIPv4() and Netmask.isIPv6() instead. In C++ API these methods have been removed.

socket-dir changed

The default socket-dir has changed to include pdns-recursor in the path. For non-chrooted setups, it is now whatever is passed to --with-socketdir during configure (/var/run by default) plus pdns-recursor. The systemd unit-file is updated to reflect this change and systemd will automatically create the directory with the proper permissions. The packaged sysV init-script also creates this directory. For other operating systems, update your init-scripts accordingly.

Systemd service and permissions

The systemd service-file that is installed no longer uses the root user to start. It uses the user and group set with the --with-service-user and --with-service-group switches during configuration, “pdns” on Debian and “pdns-recursor” on CentOS by default. This could mean that PowerDNS Recursor cannot read its configuration, lua scripts, auth-zones or other data. It is recommended to recursively chown directories used by PowerDNS Recursor:

# For Debian-based systems
chown -R root:pdns /etc/powerdns

# For CentOS and RHEL based systems
chown -R root:pdns-recursor /etc/pdns-recursor

Packages provided on the PowerDNS Repository will chown directories created by them accordingly in the post-installation steps.

New settings

  • The allow-trust-anchor-query setting has been added. This setting controls if negative trust anchors can be queried. The default is no.
  • The max-concurrent-requests-per-tcp-connection has been added. This setting controls how many requests are handled concurrently per incoming TCP connection. The default is 10.
  • The max-generate-steps setting has been added. This sets the maximum number of steps that will be performed when loading a BIND zone with the $GENERATE directive. The default is 0, which is unlimited.
  • The nothing-below-nxdomain setting has been added. This setting controls the way cached NXDOMAIN replies imply non-existence of a whole subtree. The default is dnssec which means that only DNSSEC validated NXDOMAINS results are used.
  • The qname-minimization setting has been added. This options controls if QName Minimization is used. The default is yes.

4.1.x to 4.2.0

Two new settings have been added:

4.0.x to 4.1.0

loglevel defaulted to 4 but was always overridden to 6 during the startup. The issue has been fixed and the default value set to 6 to keep the behavior consistent.

The --with-libsodium configure flag has changed from ‘no’ to ‘auto’. This means that if libsodium and its development header are installed, it will be linked in.

4.0.3 to 4.0.4

One setting has been added to limit the risk of overflowing the stack:

4.0.0 to 4.0.1

Two settings have changed defaults, these new defaults decrease CPU usage: