PowerDNS Authoritative 4.3.1, 4.2.3 and 4.1.14

Today we have released PowerDNS Authoritative Server versions 4.3.1, 4.2.3 and 4.1.14, containing a fix for PowerDNS Security Advisory 2020-05.

Additionally, we are publishing PowerDNS Security Advisory 2020-06 today (‘Various issues have been found in our GSS-TSIG support, where an unauthorized attacker could cause crashes, possibly leak uninitialised memory, and possibly execute arbitrary code.’). Our GSS-TSIG support was never shipped in any packages by us or, to our knowledge, any other distributions. The GSS-TSIG code will be gone in version 4.4.0. We’ve chosen to leave the code intact for older versions, so that users that do rely on it today can keep doing so, keeping in mind the risks detailed in Advisory 2020-06.

Regarding 2020-05: an issue has been found in PowerDNS Authoritative Server where an authorized user with the ability to insert crafted records into a zone might be able to leak the content of uninitialized memory. Such a user could be a customer inserting data via a control panel, or somebody with access to the REST API. Crafted records cannot be inserted via AXFR. This issue is resolved in the versions mentioned above. (4.1.14 changelog, 4.2.3 changelog)

Version 4.3.1 also contains various other bug fixes and improvements, please see the changelog for all details.

The 4.3.1 tarball (signature), 4.2.3 tarball (signature) and 4.1.14 tarball (signature) are available at downloads.powerdns.com and packages for various Linux distributions are available from our repository.

4.0 and older releases are EOL, refer to the documentation for details about our release cycles.

Please send us all feedback and issues you might have via the mailing list or our IRC channel, or in case of a bug, via GitHub.

First Release Candidate of PowerDNS Recursor 4.4.0

Hello!

We are proud to announce the first release candidate of what should become PowerDNS Recursor 4.4.0.

Compared to the beta release, this release fixes two bugs:

• Only do QName Minimization for the names inside a forwarded domain,
• Fix the parsing of dont-throttle-netmasks in the presence of dont-throttle-names.

Please refer to the changelog for details.

We want to thank everyone that contributed to the testing of the beta release, and invite you to contribute to the testing of this release candidate!

The tarball (signature) is available at downloads.powerdns.com and packages for CentOS 6, 7 and 8, Debian Stretch and Buster, Ubuntu Xenial, Bionic and Focal are available from repo.powerdns.com.

Please send us all feedback and issues you might have via the mailing list, or in case of a bug, via GitHub.

PowerDNS Recursor 4.3.4 Released

Hello!,

Today we are releasing PowerDNS Recursor 4.3.4.

This release:

  • fixes an issue where certain CNAMEs could lead to resolver failure,
  • fixes an issue with the hostname reported in Carbon messages,
  • allows for multiple recursor services to run under systemd.

Please refer to the 4.3.4 changelog for details.

The 4.3.4 tarball (signature) is available at downloads.powerdns.com and packages for CentOS 6, 7 and 8, Debian Stretch and Buster, Ubuntu Xenial, Bionic and Focal are available from repo.powerdns.com.

4.0 and older releases are EOL, refer to the documentation for details about our release cycles.

Please send us all feedback and issues you might have via the mailing list, or in case of a bug, via GitHub.

First Beta Release of PowerDNS Recursor 4.4.0

Hello!,

We are proud to announce the first beta release of what should become PowerDNS Recursor 4.4.0.

Compared to the last alpha release, this release contains new features with respect to RPZ processing (in particular chasing of CNAMES from an RPZ and better logging of RPZ hit information in protobuf, Lua bindings and the trace log) and improved ability to use a local root-zone.

Please refer to the changelog for additional details.

The tarball (signature) is available at downloads.powerdns.com and packages for CentOS 6, 7 and 8, Debian Stretch and Buster, Ubuntu Xenial, Bionic and Focal are available from repo.powerdns.com.

We would like to thank all contributors (in particular Josh Soref and phonedph1) for their efforts in creating this release.

Please send us all feedback and issues you might have via the mailing list, or in case of a bug, via GitHub.

dnsdist 1.5.0 released

After four release candidates, we are thrilled to announce the final release of dnsdist 1.5.0! This new release contains several new exciting features and a few breaking changes since 1.4.0, so please read the upgrade guide if you are upgrading from 1.4.0 or earlier. We described the changes made since 1.4.0 in details in the blog post announcing the first release candidate so will only do a quick summary below.

Important changes

In systemd environments, dnsdist used to be started as root before dropping privileges and switching to an unprivileged user, which could lead to weird issues where files where readable during startup but not after, or the other way around. This is no longer the case, and dnsdist is now directly started as an unprivileged user. This might require updating the permissions on the files accessed during startup.

We updated the default behavior of our DNS over HTTPS implementation. DoH endpoints specified in the fourth parameter of addDOHLocal() are now specified as exact paths instead of path prefixes. The default endpoint also switched from / to /dns-query. That can be overridden through the fourth parameter of addDOHLocal().

An ACL was added to the internal web server to further restrict access to authorized users.

The default SSL/TLS library used for DNS over TLS was changed from GnuTLS to OpenSSL / LibreSSL, based on the feedback we received from our users.

New features and improvements

The most exciting new feature is the implementation of the Proxy Protocol between dnsdist and its backends. Aimed to replace the use of EDNS Client Subnet and our own XPF, the Proxy Protocol is an existing standard where a small header is prepended to the query, passing not only the source and destination addresses and ports along to the backend, but also custom values. Support for parsing the Proxy Protocol is already available in the development tree of the PowerDNS Recursor ;

We implemented a new spoofRawAction(), which makes it possible to spoof any kind of response from dnsdist, instead of the existing limitation to A, AAAA and CNAME records. This new action requires submitting the response in DNS wire-format.

While it has always been possible to write custom selectors and actions in Lua, there was a huge performance gap between built-in rules written in C++ and the Lua ones. This release adds the ability to use the Lua FFI interface available in LuaJIT to write high-performance selectors and rules, as well as load-balancing policies. With carefully written Lua, this delivers performance almost on par with the built-in C++ rules and actions, with greater flexibility.

Several very large-scale users reported that the load-balancing policies based on a hash of the qname could lack a bit of fairness when the traffic was heavily skewed toward a few names, leading to some backends receiving much more traffic than others. In order to address this shortcoming, we added the ability to set load bounds to the chashed and whashed policies so that queries will be dispatched to a different backend if the one selected based on the qname is already handling more queries than it should.

Our DNS over HTTPS implementation received several improvements, including the ability to send cache-control headers, and to parse X-Forwarded-For headers sent by a frontend.

Users with a large number of backends will be happy to know that we refactored the handling of health checks so that they can now be performed in parallel instead of sequentially, leading to a huge performance improvement.

Finally our remote logging features using DNSTAP or our own protobuf saw several performance enhancements, a better handling of re-connection events, and the addition of the source and destination ports of the query whenever possible.

Bug Fixes

Several issues were fixed, most of them about compilation on very specific systems or setups. One notable fix was a regression introduced in 1.4.0 for DNSCrypt users, with our thanks to Frank Denis for reporting the issue and suggesting ways to fix it.

We want to once again thank everyone that contributed to the testing of the previous release candidates!

Please see the dnsdist website for the more complete changelog and the current documentation.

Release tarballs are available on the downloads website.

Several packages are also available in our repository. Please be aware that we have enabled a few additional features in our packages, like DNS over HTTPS, DNS over TLS and DNSTAP support, on distributions where the required dependencies were available. Building packages for Raspberry Pi OS (previously called Raspbian) takes a bit longer so those might only become available in a couple days.

Second Alpha Release of PowerDNS Recursor 4.4.0

Hello!,

We are proud to announce the second alpha release of what should become PowerDNS Recursor 4.4.0.

Compared to the first alpha release, this release mostly contains bug fixes and code cleanup. In particular, fixes already backported to the 4.3 release branch are included and a bug in the new shared cache code is fixed.

Please refer to the changelog for additional details.

The tarball (signature) is available at downloads.powerdns.com and packages for CentOS 6, 7 and 8, Debian Stretch and Buster, Ubuntu Xenial, Bionic and Focal are available from repo.powerdns.com.

Please send us all feedback and issues you might have via the mailing list, or in case of a bug, via GitHub.

PowerDNS Recursor 4.3.3 and 4.2.4 Released

Hello!,

Today we are releasing PowerDNS Recursor 4.3.3 and 4.2.4.

These releases fix an issue where the refresh time of a loaded RPZ zone was ignored. A DNSSEC issue that could lead to zones being marked Bogus wrongly and a few other DNSSEC related issues were also fixed.

Please refer to the 4.3.3 changelog and 4.2.4 changelog for details.

The 4.3.3 tarball (signature) and 4.2.4 tarball (signature) are available at downloads.powerdns.com and packages for CentOS 6, 7 and 8, Debian Stretch and Buster, Ubuntu Xenial and Bionic are available from repo.powerdns.com.

4.0 and older releases are EOL, refer to the documentation for details about our release cycles.

Please send us all feedback and issues you might have via the mailing list, or in case of a bug, via GitHub.

Fourth release candidate for dnsdist 1.5.0

While we expected the third release candidate for dnsdist 1.5.0 to be the last one, a race condition that could lead to a crash was discovered by Tomas Krizek from CZ.NIC with the DNS Shotgun tool, leading to a new release candidate. This new release candidate has no changes except for the fix for this issue.

We want to once again thank everyone that contributed to the testing of the alpha and the first three release candidates! Many thanks to Tomas in particular this time!

Please see the dnsdist website for the more complete changelog and the current documentation.

Release tarballs are available on the downloads website.

Several packages are also available in our repository. Please be aware that we have enabled a few additional features in our packages, like DNS over HTTPS, DNS over TLS and DNSTAP support, on distributions where the required dependencies were available.

PowerDNS Recursor 4.3.2, 4.2.3 and 4.1.17 Released

Hello!,

Today we are releasing PowerDNS Recursor 4.3.2, 4.2.3. and 4.1.17, containing a security fix for CVE-2020-14196: Access restriction bypass.

An issue has been found in PowerDNS Recursor where the ACL applied to the internal web server via `webserver-allow-from` is not properly enforced, allowing a remote attacker to send HTTP queries to the internal web server, bypassing the restriction.

Note that the web server is not enabled by default. Only installations using a non-default value for webserver and webserver-address are affected.

Workarounds are: disable the webserver or set a password or an API key. Additionally, restrict the binding address using the webserver-address setting to local addresses only and/or use a firewall to disallow web requests from untrusted sources reaching the webserver listening address.

As usual, there were also other smaller enhancements and bugfixes. In particular, the 4.3.2 release contains fixes that allow long CNAME chains to resolve properly, where previously they could fail if qname minimization is enabled.
Please refer to the 4.3.2 changelog, 4.2.3 changelog and 4.1.17 changelog for details.

The 4.3.2 tarball (signature), 4.2.3 tarball (signature) and 4.1.17 tarball (signature) are available at downloads.powerdns.com and packages for CentOS 6, 7 and 8, Debian Stretch and Buster, Ubuntu Xenial and Bionic are available from repo.powerdns.com.

4.0 and older releases are EOL, refer to the documentation for details about our release cycles.

Please send us all feedback and issues you might have via the mailing list, or in case of a bug, via GitHub.

Third release candidate for dnsdist 1.5.0

We are very happy to announce the third release candidate of dnsdist 1.5.0. 1.5.0 contains several new exciting features and a few breaking changes since 1.4.0 that were detailed in the announcement of alpha1. If you upgrade from 1.4.0, please see the upgrade guide for more information.
This new release candidate has very few changes since the second release candidate except an important bug fix in DoH processing, and a few minor improvements and cleanups:

  • DoH processing could stop working if too many responses were processed at the same time, filling the internal pipe (9211) ;
  • compilation was broken on systems that do not define HOST_NAME_MAX (9127) ;
  • the detection of std::string has been enhanced by Rosen Penev (9207, 9213) ;
  • optional masks were added to KeyValueLookupKeySourceIP (9144) ;
  • an ACL was added to the internal web server (9229) ;
  • and finally the sample configuration file was cleaned up to be more helpful to new installations (9238).

The DoH processing issue was the last pending one we were aware of, so hopefully this release candidate should be the last one!

We want to once again thank everyone that contributed to the testing of alpha1 and the first two release candidates!

Please see the dnsdist website for the more complete changelog and the current documentation.

Release tarballs are available on the downloads website.

Several packages are also available in our repository. Please be aware that we have enabled a few additional features in our packages, like DNS over HTTPS, DNS over TLS and DNSTAP support, on distributions where the required dependencies were available.