PowerDNS Recursor 4.0.2 released

Today, the PowerDNS Recursor version 4.0.2 is released. This version fixes several bugs, among which was a regression in 4.x where CNAME records for DNSSEC signed domains were not sorted before the final answers, leading to some clients (notably some versions of Chrome) not being able to extract the required answer from the packet. This happened exclusively for DNSSEC signed domains, but the problem happens even for clients not requesting DNSSEC validation.

This release also features several additions to the RPZ-stack. Most notably the addition of NSDNAME and NSIP triggers and Lua-based access to the policy-decision in the existing hooks, plus a new prerpz hook that is called before preresolve to allow disabling of RPZ lookups.

Source tarball is here(sig) and packages are available from our repositories.

The full changelog is as follows:

Bug fixes

  • #4264: Set dq.rcode before calling postresolve
  • #4294: Honor PIE flags.
  • #4310: Fix build with LibreSSL, for which OPENSSL_VERSION_NUMBER is irrelevant
  • #4340: Don’t shuffle CNAME records. (thanks to Gert van Dijk for the extensive bug report!)
  • #4354: Fix delegation-only

Additions and enhancements

  • #4288: Respect the timeout when connecting to a protobuf server
  • #4300: allow newDN to take a DNSName in; document missing methods
  • #4301: expose SMN toString to lua
  • #4318: Anonymize the protobuf ECS value as well (thanks to Kai Storbeck of XS4All for finding this)
  • #4324: Allow Lua access to the result of the Policy Engine decision, skip RPZ, finish RPZ implementation
  • #4349: Remove unused DNSPacket::d_qlen
  • #4351: RPZ: Use query-local-address(6) by default (thanks to Oli Schacher of switch.ch for the feature request)
  • #4357: Move the root DNSSEC data to a header file

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s