pdns/recursordist/docs/changelog/4.1.rst

   1 Changelogs for 4.1.x
   2 ====================
   3
   4 .. changelog::
   5   :version: 4.1.4
   6   :released: 31st of August 2018
   7
   8   .. change::
   9     :tags: Improvements
  10     :pullreq: 6436
  11
  12     Split ``pdns_enable_unit_tests``. (Chris Hofstaedtler)
  13
  14   .. change::
  15     :tags: Bug Fixes
  16     :pullreq: 6465
  17     :tickets: 6462
  18
  19     Don't account chained queries more than once.
  20
  21   .. change::
  22     :tags: Improvements
  23     :pullreq: 6518
  24
  25     Add a new :ref:`setting-max-udp-queries-per-round` setting.
  26
  27   .. change::
  28     :tags: Bug Fixes
  29     :pullreq: 6557
  30     :tickets: 6536
  31
  32     Make :doc:`rec_control` respect :ref:`setting-include-dir`.
  33
  34   .. change::
  35     :tags: Improvements
  36     :pullreq: 6590
  37
  38     Fix warnings reported by gcc 8.1.0.
  39
  40   .. change::
  41     :tags: Improvements
  42     :pullreq: 6809
  43
  44     Tests: replace awk command by perl.
  45
  46   .. change::
  47     :tags: Bug Fixes
  48     :pullreq: 6812
  49     :tickets: 6567
  50
  51     Load lua scripts only in worker threads.
  52
  53   .. change::
  54     :tags: Improvements
  55     :pullreq: 6720
  56
  57     Allow the snmp thread to retrieve statistics.
  58
  59   .. change::
  60     :tags: Bug Fixes
  61     :pullreq: 6873
  62
  63     Purge all auth/forward zone data including subtree. (@phonedph1)
  64
  65 .. changelog::
  66   :version: 4.1.3
  67   :released: 22nd of May 2018
  68
  69   This release improves the stability and resiliency of the RPZ implementation, prevents metrics gathering from slowing down the processing of DNS queries and fixes an issue related to the cleaning of EDNS Client Subnet entries from the cache.
  70
  71   .. change::
  72     :tags: Bug Fixes
  73     :pullreq: 6469
  74
  75     Respect the ``AXFR`` timeout while connecting to the ``RPZ`` server.
  76
  77   .. change::
  78     :tags: Bug Fixes
  79     :pullreq: 6467
  80
  81     Don't increase the ``DNSSEC`` validations counters when running with ``process-no-validate``.
  82
  83   .. change::
  84     :tags: Bug Fixes
  85     :pullreq: 6313
  86
  87     Count a lookup into an internal auth zone as a cache miss.
  88
  89   .. change::
  90     :tags: Bug Fixes
  91     :pullreq: 6588
  92     :tickets: 6237
  93
  94     Delay the loading of ``RPZ`` zones until the parsing is done, fixing a race condition.
  95
  96   .. change::
  97     :tags: Improvements
  98     :pullreq: 6567
  99
 100     Move carbon/webserver/control/stats handling to a separate thread.
 101
 102   .. change::
 103     :tags: Improvements
 104     :pullreq: 6566
 105
 106     Use a separate, non-blocking pipe to distribute queries.
 107
 108   .. change::
 109     :tags: Improvements
 110     :pullreq: 6562
 111     :tickets: 6550
 112
 113     Add a subtree option to the :doc:`API <../http-api/index>` cache flush endpoint.
 114
 115   .. change::
 116     :tags: Bug Fixes
 117     :pullreq: 6595
 118     :tickets: 6542, 6516, 6358, 6517
 119
 120     Reorder includes to avoid boost ``L`` conflict.
 121
 122   .. change::
 123     :tags: Improvements
 124     :pullreq: 6611
 125     :tickets: 6130, 6610
 126
 127     Update copyright years to 2018 (Matt Nordhoff).
 128
 129   .. change::
 130     :tags: Improvements
 131     :pullreq: 6596, 6478
 132     :tickets: 6474
 133
 134     Fix a warning on botan >= 2.5.0.
 135
 136   .. change::
 137     :tags: Improvements
 138     :pullreq: 6583
 139
 140     Add ``_raw`` versions for ``QName`` / ``ComboAddresses`` to the ``FFI`` API.
 141
 142   .. change::
 143     :tags: Bug Fixes
 144     :pullreq: 6586
 145     :tickets: 6505
 146
 147      Use canonical ordering in the ``ECS`` index.
 148
 149   .. change::
 150     :tags: Bug Fixes
 151     :pullreq: 6514, 6630
 152
 153     Add ``-rdynamic`` to ``C{,XX}FLAGS`` when we build with ``LuaJIT``.
 154
 155   .. change::
 156     :tags: Bug Fixes
 157     :pullreq: 6418
 158     :tickets: 6179
 159
 160     Increase ``MTasker`` stacksize to avoid crash in exception unwinding (Chris Hofstaedtler).
 161
 162   .. change::
 163     :tags: Bug Fixes
 164     :pullreq: 6419
 165     :tickets: 6086
 166
 167     Use the SyncRes time in our unit tests when checking cache validity (Chris Hofstaedtler).
 168
 169   .. change::
 170     :tags: Bug Fixes
 171     :pullreq: 6850
 172     :tickets: 6849
 173
 174     Disable only our own tcp listening socket when reuseport is enabled
 175
 176 .. changelog::
 177   :version: 4.1.2
 178   :released: 29th of March 2018
 179
 180   This release improves the stability and resiliency of the RPZ implementation and fixes several issues related to EDNS Client Subnet.
 181
 182   .. change::
 183     :tags: Improvements
 184     :pullreq: 6298, 6303, 6290, 6268
 185
 186     Add the option to set the AXFR timeout for RPZs.
 187
 188   .. change::
 189     :tags: Bug Fixes
 190     :pullreq: 6336, 6237, 6293
 191     :tickets: 6238
 192
 193     Retry loading RPZ zones from server when they fail initially.
 194
 195   .. change::
 196     :tags: Improvements
 197     :pullreq: 6172
 198
 199     IXFR: correct behavior of dealing with DNS Name with multiple records and speed up IXFR transaction (Leon Xu).
 200
 201   .. change::
 202     :tags: Bug Fixes
 203     :pullreq: 6300
 204
 205     Fix ECS-based cache entry refresh code.
 206
 207   .. change::
 208     :tags: Bug Fixes
 209     :pullreq: 6320
 210     :tickets: 6319
 211
 212     Fix ECS-specific NS AAAA not being returned from the cache.
 213
 214   .. change::
 215     :tags: Improvements
 216     :pullreq: 6379
 217     :tickets: 6225
 218
 219     Add :doc:`RPZ statistics endpoint <../http-api/endpoint-rpz-stats>` to the :doc:`API <../http-api/index>`.
 220
 221   .. change::
 222     :tags: New Features
 223     :pullreq: 6344
 224
 225     Add FFI version of :func:`gettag`.
 226
 227 .. changelog::
 228   :version: 4.1.1
 229   :released: 22nd of January 2018
 230
 231   This is the second release in the 4.1 train.
 232
 233   This release fixes PowerDNS Security Advisory :doc:`2018-01 <../security-advisories/powerdns-advisory-2018-01>`.
 234
 235   The full release notes can be read `on the blog <https://blog.powerdns.com/2018/01/22/powerdns-recursor-4-1-1/>`__.
 236
 237   This is a release on the stable branch, containing a fix for the
 238   abovementioned security issue and several bug fixes from the
 239   development branch.
 240
 241   .. change::
 242     :tags: DNSSEC, Bug Fixes
 243     :pullreq: 6215
 244
 245     Correctly handle ancestor delegation NSEC{,3} for children. Fixes
 246     the DNSSEC validation issue found in Knot Resolver, where a NSEC{3}
 247     ancestor delegation is wrongly use to prove the non-existence of a
 248     RR below the delegation.
 249     We already had the correct check for the exact owner name, but not
 250     for RRs below the delegation.
 251     (Security Advisory :doc:`2018-01 <../security-advisories/powerdns-advisory-2018-01>`)
 252
 253   .. change::
 254     :tags: Internals, Bug Fixes
 255     :pullreq: 6209
 256     :tickets: 6212
 257
 258     Fix to make ``primeHints`` threadsafe, otherwise there's a small
 259     chance on startup that the root-server IPs will be incorrect.
 260
 261   .. change::
 262     :tags: Internals, Improvements
 263     :pullreq: 6085
 264     :tickets: 6198
 265
 266     Don't process records for another class than IN. We don't use
 267     records of another class than IN, but we used to store some of them
 268     in the cache which is useless. Just skip them.
 269
 270   .. change::
 271     :tags: DNSSEC, Bug Fixes
 272     :pullreq: 6092
 273     :tickets: 6199
 274
 275     Fix the computation of the closest encloser for positive
 276     answers. When the positive answer is expanded from a wildcard with
 277     NSEC3, the closest encloser is not always parent of the qname,
 278     depending on the number of labels in the initial wildcard.
 279
 280   .. change::
 281     :tags: DNSSEC, Bug Fixes
 282     :pullreq: 6095
 283     :tickets: 6200
 284
 285     Pass the correct buffer size to ``arecvfrom()``. The incorrect size
 286     could possibly cause DNSSEC failures.
 287
 288   .. change::
 289     :tags: Bug Fixes
 290     :pullreq: 6137
 291     :tickets: 6201
 292
 293     Don't validate signature for "glue" CNAME, since anything else than
 294     the initial CNAME can't be considered authoritative.
 295
 296 .. changelog::
 297   :version: 4.1.0
 298   :released: 4th of December 2017
 299
 300   This is the first release in the 4.1 train.
 301
 302   The full release notes can be read `on the blog <https://blog.powerdns.com/2017/12/04/powerdns-recursor-4-1/>`__.
 303
 304   This is a major release containing significant speedups (both in throughput and latency), enhanced capabilities and a highly conformant and robust DNSSEC validation implementation that is ready for heavy production use. In addition, our EDNS Client Subnet implementation now scales effortlessly to networks needing very fine grained scopes (as used by some ‘country sized’ service providers).
 305
 306   - Improved DNSSEC support,
 307   - Improved documentation,
 308   - Improved RPZ support,
 309   - Improved EDNS Client Subnet support,
 310   - Support for Botan 2.x (and removal of support for Botan 1.10),
 311   - SNMP support,
 312   - Lua engine has gained access to more parts of the recursor,
 313   - CPU affinity can now be specified,
 314   - TCP Fast Open support,
 315   - New performance metrics.
 316
 317   Changes since 4.1.0-rc3:
 318
 319   .. change::
 320     :tags: Internals, DNSSEC, Bug Fixes
 321     :pullreq: 5972
 322
 323     Dump the validation status of negcache entries, fix DNSSEC type.
 324
 325   .. change::
 326     :tags: Internals, Bug Fixes
 327     :pullreq: 5980
 328
 329     Cache Secure validation state when inserting negcache entries.
 330
 331   .. change::
 332     :tags: DNSSEC, Bug Fixes
 333     :pullreq: 5978
 334
 335     Fix DNSSEC validation of DS denial from the negative cache.
 336
 337   .. change::
 338     :tags: DNSSEC, Bug Fixes
 339     :pullreq: 5997
 340
 341     Store additional records as non-auth, even on AA=1 answers.
 342
 343   .. change::
 344     :tags: DNSSEC, Bug Fixes
 345     :pullreq: 6008
 346
 347     Don't leak when the loading a public ECDSA key fails.
 348
 349   .. change::
 350     :tags: DNSSEC, Bug Fixes
 351     :pullreq: 6009
 352
 353     When validating DNSKeys, the zone should be part of the signer.
 354
 355 .. changelog::
 356   :version: 4.1.0-rc3
 357   :released: 17th of November 2017
 358
 359   The third Release Candidate adds support for Botan 2.x (and removes
 360   support for Botan 1.10!), has a lot of DNSSEC fixes, features a
 361   cleaned up web UI and has miscellaneous minor improvements.
 362
 363   .. change::
 364     :tags: Internals, Bug Fixes
 365     :pullreq: 5877
 366     :tickets: 1066
 367
 368     Sort NS addresses by speed and remove old ones.
 369
 370   .. change::
 371     :tags: Internals, Improvements
 372     :pullreq: 5498
 373     :tickets: 2250, 5797
 374
 375     Add support for Botan 2.x and remove support for Botan 1.10.
 376
 377   .. change::
 378     :tags: Internals, Bug Fixes
 379     :pullreq: 5896
 380
 381     Purge ``nsSpeeds`` entries even if we get less than 2 new entries.
 382
 383   .. change::
 384     :tags: DNSSEC, Bug Fixes
 385     :pullreq: 5889
 386
 387     Prevent possible downgrade attacks in the recursor.
 388
 389   .. change::
 390     :tags: Improvements
 391     :pullreq: 5876
 392
 393     Print more details of trust anchors. In addition, the
 394     :ref:`setting-trace` output that mentions if data from authoritative
 395     servers gets accepted now also prints the TTL and clarifies the
 396     'place' number previously printed.
 397
 398   .. change::
 399     :tags: DNSSEC, Bug Fixes
 400     :pullreq: 5885
 401     :tickets: 5882
 402
 403     Split NODATA / NXDOMAIN NSEC wildcard denial proof of
 404     existence. Otherwise there is a very real risk that a NSEC will
 405     cover a more specific wildcard and we end up with what looks like a
 406     NXDOMAIN proof but is a NODATA one.
 407
 408   .. change::
 409     :tags: DNSSEC, Bug Fixes
 410     :pullreq: 5904
 411
 412     Fix incomplete validation of cached entries.
 413
 414   .. change::
 415     :tags: DNSSEC, Bug Fixes
 416     :pullreq: 5912
 417
 418     Fix going Insecure on NSEC3 hashes with too many iterations, since
 419     we could have gone Bogus on a positive answer synthetized from a
 420     wildcard if the corresponding NSEC3 had more iterations that we were
 421     willing to accept, while the correct result is Insecure.
 422
 423   .. change::
 424     :tags: Internals, Bug Fixes
 425     :pullreq: 5881
 426     :tickets: 5618
 427
 428     Add EDNS to truncated, servfail answers.
 429
 430   .. change::
 431     :tags: Internals, Improvements
 432     :pullreq: 5616
 433
 434     Better support for deleting entries in ``NetmaskTree`` and
 435     ``NetmaskGroup``.
 436
 437   .. change::
 438     :tags: Internals, Bug Fixes
 439     :pullreq: 5917
 440
 441     Use ``_exit()`` when we really really want to exit, for example
 442     after a fatal error. This stops us dying while we die. A call to
 443     ``exit()`` will trigger destructors, which may paradoxically stop
 444     the process from exiting, taking down only one thread, but harming
 445     the rest of the process.
 446
 447   .. change::
 448     :tags: Lua, DNSSEC, Improvements
 449     :pullreq: 5895
 450     :tickets: 5888
 451
 452     Add the DNSSEC validation state to the ``DNSQuestion`` Lua object
 453     (although the ability to update the validation state from these
 454     hooks is postponed to after 4.1.0).
 455
 456   .. change::
 457     :tags: Bug Fixes
 458     :pullreq: 5930
 459
 460     In the recursor secpoll code, we assumed the TXT record would be the
 461     first record first record we received. Sometimes it was the RRSIG,
 462     leading to a silent error, and no secpoll check. Fixed the
 463     assumption, added an error.
 464
 465   .. change::
 466     :tags: Internals, Bug Fixes
 467     :pullreq: 5938
 468
 469     Don't crash when asked to run with zero threads.
 470
 471   .. change::
 472     :tags: Internals, Bug Fixes
 473     :pullreq: 5939
 474     :tickets: 5934
 475
 476     Only accept types not matching the query if we asked for ANY. Even
 477     from forward-recurse servers.
 478
 479   .. change::
 480     :tags: Internals, Bug Fixes
 481     :pullreq: 5937
 482     :tickets: 2758
 483
 484     Allow the use of a 'self-resolving' NS if cached A / AAAA
 485     exists. Before this, we could skip a perfectly valid NS for which we
 486     had retrieved the A and / or AAAA entries, for example via a glue.
 487
 488   .. change::
 489     :tags: Bug Fixes
 490     :pullreq: 5961
 491
 492     Add the config-name argument to the definition of configname. There
 493     was a bug where the config-name parameter was not used to change the
 494     path of the config file. This meant that some commands via
 495     rec_control (e.g. reload-acls) would fail when run against a
 496     recursor which had config-name defined. The correct behaviour was
 497     present in some, but not all, definitions of configname. (@jake2184)
 498
 499 .. changelog::
 500   :version: 4.1.0-rc2
 501   :released: 30th of October 2017
 502
 503   The second Release Candidate contains several correctness fixes for DNSSEC,
 504   mostly in the area of verifying negative responses.
 505
 506   .. change::
 507     :tags: API, Improvements
 508     :pullreq: 5805
 509
 510     Improve logging for the built-in :doc:`webserver <../../http-api/index>`
 511     and the :ref:`Carbon <metricscarbon>` sender.
 512
 513   .. change::
 514     :tags: DNSSEC, Bug Fixes
 515     :pullreq: 5808
 516
 517     Check that the NSEC covers an empty non-terminal when looking for NODATA.
 518
 519   .. change::
 520     :tags: Improvements, Internals
 521     :pullreq: 5824
 522     :tickets: 5663
 523
 524     New b.root ipv4 address (Kees Monshouwer).
 525
 526   .. change::
 527     :tags: Bug Fixes, Internals
 528     :pullreq: 5740
 529
 530     Lowercase all outgoing qnames when :ref:`setting-lowercase-outgoing` is set.
 531
 532   .. change::
 533     :tags: DNSSEC, Improvements
 534     :pullreq: 5834
 535
 536     Don't directly store NSEC3 records in the positive cache.
 537
 538   .. change::
 539     :tags: Improvements
 540     :pullreq: 5774
 541
 542     Add :ref:`experimental metrics <stat-x-our-latency>` that track the time spent inside PowerDNS per query.
 543     These metrics ignore time spent waiting for the network.
 544
 545   .. change::
 546     :tags: DNSSEC, Bug Fixes
 547     :pullreq: 5835
 548     :tickets: 5827
 549
 550     Disable validation for infrastructure queries (e.g. when recursing for a name).
 551     Also validate entries from the Negative cache if they were not validated before.
 552
 553   .. change::
 554     :tags: Improvements
 555     :pullreq: 5842
 556
 557     Add :ref:`setting-log-timestamp` setting. This option can be used to disable
 558     printing timestamps to stdout, this is useful when using ``systemd-journald``
 559     or another supervisor that timestamps output by itself.
 560
 561   .. change::
 562     :tags: Bug Fixes
 563     :pullreq: 5762
 564     :tickets: 5439
 565
 566     Create :ref:`setting-socket-dir` from the init-script.
 567
 568   .. change::
 569     :tags: DNSSEC, Bug Fixes
 570     :pullreq: 5868
 571     :tickets: 5861
 572
 573     Fix DNSSEC validation for denial of wildcards in negative answers and
 574     denial of existence proofs in wildcard-expanded positive responses.
 575
 576   .. change::
 577     :tags: DNSSEC, Bug Fixes
 578     :pullreq: 5873
 579
 580     Fix DNSSEC validation when using ``-flto``.
 581
 582   .. change::
 583     :tags: Bug Fixes, Internals
 584     :pullreq: 5803
 585
 586     Fix crashes with uncaught exceptions in MThreads.
 587
 588 .. changelog::
 589   :version: 4.1.0-rc1
 590   :released: 9th of October 2017
 591
 592   The RC1 release features many fixes to the DNSSEC validation code, reported by different users. Other improvements include: logging, RPZ and the Remote Logger.
 593
 594   While not specifically mentioned in the ChangeLog, also thanks to Winfried Angele for bringing a documentation issue to our attention!
 595
 596   .. change::
 597     :tags: Bug Fixes
 598     :pullreq: 5530
 599
 600     Add a missing header for PRId64 in the negative cache, required on EL5/EL6.
 601
 602   .. change::
 603     :tags: Internals, Improvements
 604     :pullreq: 5543
 605
 606     Wrap the webserver's and Resolver::tryGetSOASerial objects into smart pointers (also thanks to Christian Hofstaedtler for reviewing!)
 607
 608   .. change::
 609     :tags: Internals, Improvements
 610     :pullreq: 5545
 611
 612     Add more unit tests for the NetmaskTree and ECS cache index.
 613
 614   .. change::
 615     :tags: Bug Fixes
 616     :pullreq: 5549
 617
 618     Prevent an infinite loop if we need auth and the best match is not.
 619
 620   .. change::
 621     :tags: Bug Fixes
 622     :pullreq: 5570
 623
 624     Be more careful about the validation of negative answers.
 625
 626   .. change::
 627     :tags: Bug Fixes, DNSSEC
 628     :pullreq: 5569
 629
 630     Don't fetch the DNSKEY of a zone to validate the DS of the same zone.
 631
 632   .. change::
 633     :tags: Bug Fixes
 634     :pullreq: 5599
 635     :tickets: 5456
 636
 637     Fix libatomic detection on ppc64. (Sander Hoentjen)
 638
 639   .. change::
 640     :tags: Improvements
 641     :pullreq: 5588
 642
 643     Switch the default webserver's ACL to ``127.0.0.1, ::1``.
 644
 645   .. change::
 646     :tags: Improvements
 647     :pullreq: 5598
 648     :tickets: 5524
 649
 650     Add help text on autodetecting systemd support. (Ruben Kerkhof thanks for reporting!)
 651
 652   .. change::
 653     :tags: Bug Fixes
 654     :pullreq: 5615
 655     :tickets: 5357
 656
 657     Fix sortlist in the presence of CNAME. (Benoit Perroud thanks for
 658     reporting this issue!)
 659
 660   .. change::
 661     :tags: Bug Fixes, DNSSEC
 662     :pullreq: 5614
 663
 664     Improve DNSSEC debug logging,
 665
 666   .. change::
 667     :tags: Improvements
 668     :pullreq: 5622
 669
 670     Add ``log-rpz-changes`` to log RPZ additions and removals.
 671
 672   .. change::
 673     :tags: Improvements
 674     :pullreq: 5621
 675
 676     Log the policy type (QName, Client IP, NS IP...) over protobuf.
 677
 678   .. change::
 679     :tags: Bug Fixes
 680     :pullreq: 5515
 681
 682     Fix cache handling of ECS queries with a source length of 0.
 683
 684   .. change::
 685     :tags: Improvements
 686     :pullreq: 5637
 687
 688     Remove unused SortList compare operator for ComboAddress.
 689
 690   .. change::
 691     :tags: Improvements
 692     :pullreq: 5620
 693
 694     Add support for dumping the in-memory RPZ zones to a file.
 695
 696   .. change::
 697     :tags: Bug Fixes
 698     :pullreq: 5328
 699     :tickets: 5327
 700
 701     Handle SNMP alarms so we can reconnect to the master.
 702
 703   .. change::
 704     :tags: Improvements
 705     :pullreq: 5646
 706
 707     Support for identifying devices by id such as mac address.
 708
 709   .. change::
 710     :tags: Bug Fixes
 711     :pullreq: 5662
 712
 713     Fix Recursor 4.1.0 alpha 1 compilation on FreeBSD. (@RvdE)
 714
 715   .. change::
 716     :tags: Bug Fixes, DNSSEC
 717     :pullreq: 5672
 718     :tickets: 5649
 719
 720     Add NSEC records on nx-trust cache hits.
 721
 722   .. change::
 723     :tags: Bug Fixes, DNSSEC
 724     :pullreq: 5671
 725     :tickets: 5650
 726
 727     Handle NSEC wrap-around.
 728
 729   .. change::
 730     :tags: Bug Fixes, DNSSEC
 731     :pullreq: 5670
 732     :tickets: 5648, 5651
 733
 734     Fix erroneous check for section 4.1 of rfc6840.
 735
 736   .. change::
 737     :tags: Bug Fixes, DNSSEC
 738     :pullreq: 5715
 739     :tickets: 5705
 740
 741     Handle direct NSEC queries.
 742
 743   .. change::
 744     :tags: Bug Fixes
 745     :pullreq: 5739
 746
 747     Remove pdns.PASS and pdns.TRUNCATE.
 748
 749   .. change::
 750     :tags: Bug Fixes
 751     :pullreq: 5734
 752
 753     Fix a crash when getting a public GOST key if the private one is not set.
 754
 755   .. change::
 756     :tags: Improvements
 757     :pullreq: 5699
 758
 759     Implement dynamic cache sizeing.
 760
 761   .. change::
 762     :tags: Bug Fixes, DNSSEC
 763     :pullreq: 5716
 764     :tickets: 5681
 765
 766     Detect zone cuts by asking for DS instead of NS.
 767
 768   .. change::
 769     :tags: Bug Fixes, DNSSEC
 770     :pullreq: 5738
 771     :tickets: 5735
 772
 773     Do not allow direct queries for RRSIG or NSEC3.
 774
 775   .. change::
 776     :tags: Improvements
 777     :pullreq: 5755
 778
 779     Improve dnsbulktest experience in Travis for more robustness.
 780
 781   .. change::
 782     :tags: Improvements, DNSSEC
 783     :pullreq: 5756
 784
 785     Improve ``--quiet=false`` output to include DNSSEC and more timing details.
 786
 787   .. change::
 788     :tags: Improvements
 789     :pullreq: 5772
 790
 791     Set ``TC=1`` if we had to omit part of the AUTHORITY section.
 792
 793   .. change::
 794     :tags: Bug Fixes, DNSSEC
 795     :pullreq: 5771
 796
 797     The target zone being insecure doesn't mean that the denial of the DS is too, if the parent zone is Secure..
 798
 799   .. change::
 800     :tags: Improvements, DNSSEC
 801     :pullreq: 5733
 802
 803     Add DNSSEC test vectors for RSA, ECDSA, ed25519 and GOST.
 804
 805   .. change::
 806     :tags: Bug Fixes
 807     :pullreq: 5773
 808
 809     Don't negcache entries for longer than their RRSIG validity.
 810
 811   .. change::
 812     :tags: Improvements
 813     :pullreq: 5764
 814
 815     autoconf: set ``--with-libsodium`` to ``auto``.
 816
 817   .. change::
 818     :tags: Bug Fixes
 819     :pullreq: 5792
 820
 821     Gracefully handle Socket::accept() returning a null pointer on EAGAIN.
 822
 823 .. changelog::
 824   :version: 4.1.0-alpha1
 825   :released: 18th of July 2017
 826
 827   This is the first release of the PowerDNS Recursor in the 4.1 release train.
 828   This release contains several performance and correctness improvements in the EDNS Client subnet area, as well as better DNSSEC processing.
 829
 830   .. change::
 831     :tags: New Features
 832     :pullreq: 5138
 833     :tickets: 5128
 834
 835     Add server-side TCP Fast Open support.
 836     This adds a new option :ref:`setting-tcp-fast-open`.
 837
 838   .. change::
 839     :tags: New Features
 840     :pullreq: 4569
 841
 842     Pass ``tcp`` to :func:`gettag` to allow a script to take different actions whether a query came in over TCP or UDP.
 843
 844   .. change::
 845     :tags: New Features
 846     :pullreq: 4569
 847
 848     Allow setting the requestor ID field in the :attr:`DNSQuestion <DNSQuestion.requestorId>` from all hooks.
 849
 850   .. change::
 851     :tags: Improvements, DNSSEC
 852     :pullreq: 5223, 5463, 5486, 5528
 853     :tickets: 4254, 4362, 4490, 4994
 854
 855     Implement "on-the-fly" DNSSEC processing. This places the DNSSEC processing alongside the regular recursion, reducing possible cornercases, adding unit tests and making the code better maintainable.
 856
 857   .. change::
 858     :tags: New Features
 859     :pullreq: 5063
 860     :tickets: 2818
 861
 862     Implement CNAME wildcards in recursor authoritative component.
 863
 864   .. change::
 865     :tags: Bug Fixes
 866     :pullreq: 5078
 867     :tickets: 4939, 5075
 868
 869     Show a useful error when an invalid :ref:`setting-lua-config-file` is configured.
 870
 871   .. change::
 872     :tags: Bug Fixes
 873     :pullreq: 4860
 874
 875     Fix :class:`DNSQuestion` members alterations from Lua not being taken into account.
 876
 877   .. change::
 878     :tags: Bug Fixes, Protobuf
 879     :pullreq: 4984
 880     :tickets: 4969
 881
 882     Fix ``remote``/``local`` inversion in :func:`preoutquery`.
 883
 884   .. change::
 885     :tags: New Features, Scripting
 886     :pullreq: 4982
 887     :tickets: 4981
 888
 889     Allow returning the :attr:`DNSQuestion.data` table from :func:`gettag`.
 890
 891   .. change::
 892     :tags: New Features, SNMP
 893     :pullreq: 4990, 5404
 894
 895     Add :ref:`SNMP <snmp>` support.
 896
 897   .. change::
 898     :tags: Improvements
 899     :pullreq: 5106
 900
 901     Split SyncRes::doResolveAt, add const and static whenever possible. Possibly improving performance while making the code easier to maintain.
 902
 903   .. change::
 904     :tags: Improvements
 905     :pullreq: 5102
 906
 907     Packet cache speedup and cleanup.
 908
 909   .. change::
 910     :tags: Improvements
 911     :pullreq: 5146
 912
 913     Make Lua mandatory for recursor builds.
 914
 915   .. change::
 916     :tags: Improvements, Performance
 917     :pullreq: 5103, 5487
 918
 919     Use one listening socket per thread when reuseport is enabled.
 920
 921   .. change::
 922     :tags: Improvements, RPZ
 923     :pullreq: 5057
 924
 925     Use the RPZ zone's TTL and add a new `maxTTL` setting.
 926
 927   .. change::
 928     :tags: Improvements, Lua
 929     :pullreq: 5141
 930
 931     Stop (de)serializing :attr:`DNSQuestion.data`.
 932
 933   .. change::
 934     :tags: New Features, Lua
 935     :pullreq: 5198
 936     :tickets: 5195
 937
 938     Allow access to EDNS options from the :func:`gettag` hook.
 939
 940   .. change::
 941     :tags: Improvements
 942     :pullreq: 5226
 943
 944     Refactor the negative cache into a class.
 945
 946   .. change::
 947     :tags: Bug Fixes
 948     :pullreq: 5209
 949
 950     Ensure locks can not be copied.
 951
 952   .. change::
 953     :tags: Improvements, RPZ
 954     :pullreq: 5275, 5307
 955     :tickets: 5231, 5236
 956
 957     RPZ updates are done zone by zone, zones are now shared pointers.
 958
 959   .. change::
 960     :tags: Bug Fixes
 961     :pullreq: 5252
 962     :tickets: 5246
 963
 964     Only apply :ref:`setting-root-nx-trust` if the received SOA is ".".
 965
 966   .. change::
 967     :tags: New Features
 968     :pullreq: 4569
 969
 970     Pass ``tcp`` to :func:`gettag`, allow setting the requestor ID from hooks.
 971
 972   .. change::
 973     :tags: Bug Fixes
 974     :pullreq: 5312
 975
 976     Don't throw an exception when logging to protobuf without a question set.
 977
 978   .. change::
 979     :tags: New Features, Lua
 980     :pullreq: 5293
 981
 982     Allow retrieving stats from Lua via the :func:`getStat` call.
 983
 984   .. change::
 985     :tags: New Features, RPZ
 986     :pullreq: 5265
 987     :tickets: 5237
 988
 989     Add support for RPZ wildcarded target names.
 990
 991   .. change::
 992     :tags: Bug Fixes
 993     :pullreq: 5320
 994
 995     Correctly truncate EDNS Client Subnetmasks.
 996
 997   .. change::
 998     :tags: Improvements
 999     :pullreq: 5319
1000
1001     Only check the netmask for subnet specific cache entries.
1002
1003   .. change::
1004     :tags: Improvements
1005     :pullreq: 5236
1006
1007     Refactor and split ``SyncRes::doResolveAt()``, making it easier to understand.
1008     Get rid of ``SyncRes::d_nocache``, makes sure we can't get into a root refresh loop.
1009     Limit the use of global variables in SyncRes, to make it easier to understand the interaction between components
1010
1011   .. change::
1012     :tags: Improvements, EDNS Client Subnet
1013     :pullreq: 5461, 5472
1014
1015     Add an ECS index to the cache
1016
1017   .. change::
1018     :tags: New Features, EDNS Client Subnet
1019     :pullreq: 5409
1020
1021     Add ECS metrics.
1022
1023   .. change::
1024     :tags: Improvements, EDNS Client Subnet, DNSSEC
1025     :pullreq: 5484
1026
1027     Use ECS when updating the validation state if needed.
1028
1029   .. change::
1030     :tags: Bug Fixes, API
1031     :pullreq: 5466
1032     :tickets: 5398
1033
1034     Clean up auth/recursor code mismatches in the API (Christian Hofstaedtler).
1035
1036   .. change::
1037     :tags: Bug Fixes
1038     :pullreq: 5474
1039     :tickets: 5474
1040
1041     Only increase ``no-packet-error`` on the first read.
1042
1043   .. change::
1044     :tags: Improvements
1045     :pullreq: 5511
1046
1047     When dumping the cache, also dump RRSIGs.
1048
1049   .. change::
1050     :tags: Bug Fixes, DNSSEC
1051     :pullreq: 5525
1052
1053     Fix validation at the exact RRSIG inception or expiration time.
1054
1055   .. change::
1056     :tags: Improvements
1057     :pullreq: 5485
1058
1059     Don't always override :ref:`setting-loglevel` to 6.
1060
1061   .. change::
1062     :tags: Improvements
1063     :pullreq: 5406, 5530
1064
1065     Make more specific Netmasks < to less specific ones.
1066
1067   .. change::
1068     :tags: New Features
1069     :pullreq: 5482
1070
1071     Add a :ref:`setting-cpu-map` directive to set CPU affinity per thread.