Today, the PowerDNS Recursor version 4.0.2 is released. This version fixes several bugs, among which was a regression in 4.x where CNAME records for DNSSEC signed domains were not sorted before the final answers, leading to some clients (notably some versions of Chrome) not being able to extract the required answer from the packet. This happened exclusively for DNSSEC signed domains, but the problem happens even for clients not requesting DNSSEC validation.
This release also features several additions to the RPZ-stack. Most notably the addition of NSDNAME and NSIP triggers and Lua-based access to the policy-decision in the existing hooks, plus a new prerpz hook that is called before preresolve to allow disabling of RPZ lookups.
Source tarball is here(sig) and packages are available from our repositories.
The full changelog is as follows:
Bug fixes
- #4264: Set
dq.rcodebefore calling postresolve - #4294: Honor PIE flags.
- #4310: Fix build with LibreSSL, for which OPENSSL_VERSION_NUMBER is irrelevant
- #4340: Don’t shuffle CNAME records. (thanks to Gert van Dijk for the extensive bug report!)
- #4354: Fix delegation-only
Additions and enhancements
- #4288: Respect the timeout when connecting to a protobuf server
- #4300: allow newDN to take a DNSName in; document missing methods
- #4301: expose SMN toString to lua
- #4318: Anonymize the protobuf ECS value as well (thanks to Kai Storbeck of XS4All for finding this)
- #4324: Allow Lua access to the result of the Policy Engine decision, skip RPZ, finish RPZ implementation
- #4349: Remove unused
DNSPacket::d_qlen - #4351: RPZ: Use query-local-address(6) by default (thanks to Oli Schacher of switch.ch for the feature request)
- #4357: Move the root DNSSEC data to a header file