PowerDNS Authoritative Server 3.4.9
===================================
This is a minor bugfix and performance release. Two contributions
by Kees Monshouwer make 3.4.9 fully compatible with the new single
key ECDSA default that is coming in version 4.0.0.
Changes since 3.4.8:
- use OpenSSL for ECDSA signing where available (Kees Monshouwer)
- allow common signing key (Kees Monshouwer)
- Add a disable-syslog setting
- fix SOA caching with multiple backends (Kees Monshouwer)
- whitespace-related zone parsing fixes ticket #3568
- bindbackend: fix, set domain in list() (Kees Monshouwer)
PowerDNS Authoritative Server 3.4.8
===================================
This is a small bugfix release. Additionally, the deb/RPM packages
on downloads.powerdns.com (those with -static in the name) for
3.4.8 have been built against Botan 1.10.11 instead of Botan
1.10.3 like previous packages. Please see the Botan Security page
for more information on the fixes in Botan 1.10.11. As a PowerDNS
user, these issues only affect you if you ran our -static packages
and allowed your users to upload private keys to your
configuration.
Changes since 3.4.7:
- Use AC_SEARCH_LIBS (Ruben Kerkhof)
- Check for inet_aton in libresolv (Ruben Kerkhof)
- Remove hardcoded -lresolv, -lnsl and -lsocket (Ruben Kerkhof)
- pdnssec: don't check disabled records (Pieter Lexis)
- pdnssec: check all records (including disabled ones) only in
verbose mode (Kees Monshouwer)
- traling dot in DNAME content (Kees Monshouwer)
- Fix luabackend compilation on FreeBSD i386 (RvdE)
- silence g++ 6.0 warnings and error (Kees Monshouwer)
- add gcc 5.3 and 6.0 support to boost.m4 (Kees Monshouwer)
PowerDNS Authoritative Server 3.4.7
===================================
This is a security release fixing Security Advisory 2015-03
Bug fixes:
- Ignore invalid/empty TKEY and TSIG records (Christian
Hofstaedtler)
- Don't reply to truncated queries (Christian Hofstaedtler)
- don't log out-of-zone ents during AXFR in (Kees Monshouwer)
- Prevent XSS by escaping user input. Thanks to Pierre Jaury and
Damien Cauquil at Sysdream for pointing this out.
- Handle NULL and boolean properly in gPGSql (Aki Tuomi)
- Improve negative caching (Kees Monshouwer)
- Do not divide timeout twice (Aki Tuomi)
- Correctly sort records with a priority.
Improvements:
- Direct query answers and correct zone-rectification in the GeoIP
backend (Aki Tuomi)
- Use token names to identify PKCS#11 keys (Aki Tuomi)
- Fix typo in an error message (Arjen Zonneveld)
- limit NSEC3 iterations in bindbackend (Kees Monshouwer)
- Initialize minbody (Aki Tuomi)
New features:
- OPENPGPKEY record-type (James Cloos and Kees Monshouwer)
- add global soa-edit settings (Kees Monshouwer)
This is a security release fixing CVE-2015-5230.
Bug fixes:
- Avoid superfluous backend recycling
- Removal of dnsdist from the authoritative server distribution
- Add EDNS unknown version handling and tests EDNS unknown version handling
Improvements:
- Update YaHTTP to v0.1.7
- Make trailing/leading spaces stand out in pdnssec check_zone
- GCC 5.2 support and sync boost.m4 macro with upstream
- Log answer packets only if log-dns-details is enabled
pkgsrc changes:
- SQLite 2.x support no longer exists
- SQLite 3.x support cannot be compiled outside the main package because
of how symbols are distributed, so making it a compile time option
for net/powerdns now.
Too many changes since 2.9.22.5 (over 2 years ago), see the full changelog:
http://doc.powerdns.com/md/changelog/
Upgrade notes:
- PowerDNS 3.4 comes with a mandatory database schema upgrade coming from
any previous 3.x release.
- PowerDNS 3.1 introduces native SQLite3 support for storing key material for
DNSSEC in the bindbackend. With this change, support for bind+gsql-setups
('hybrid mode') has been dropped.
- PowerDNS 3.0 introduces full DNSSEC support which requires changes
to database schemas. By default, old non-DNSSEC schema is assumed.
Please see the docs on upgrading for particular steps that need to be taken:
http://doc.powerdns.com/md/authoritative/upgrading/
The PowerDNS nameserver is a modern, advanced and high performance
authoritative-only nameserver. It is written from scratch and conforms
to all the relevant DNS standards documents. PowerDNS is open source.
The PowerDNS nameserver utilizes a flexible backend architecture that
can access DNS information from any data source. This includes file
formats, BIND zone files, relational databases or LDAP directories.
This packages provides the LDAP backend module.
