4.4.0-alpha1 changelog, secpoll, notes

diff --git a/.github/actions/spell-check/expect.txt b/.github/actions/spell-check/expect.txt
index 67f36f2c9b81c2bd0e6d8d06d0077ad7a54831ec..06bb794a6213db690b544787857f40a0a1f0f559 100644 (file)
--- a/.github/actions/spell-check/expect.txt
+++ b/.github/actions/spell-check/expect.txt
@@ -364,6 +364,7 @@ cppcheck
 createdb
 createslavedomain
 Cremers
+criteo
 CRn
 cron
 Cruft
@@ -639,6 +640,7 @@ execfile
 Exort
 externalrefs
 extrahead
+Exx
 Ezb
 Ezbu
 ezdns
@@ -776,6 +778,7 @@ gmysqlbackend
 gnutls
 godbc
 godbcbackend
+Godwottery
 goodmatch
 google
 googleapis
@@ -816,6 +819,7 @@ hardcoded
 hardcoding
 hardlink
 Harker
+Hausberger
 headbgcolor
 headerlink
 headfont
@@ -954,6 +958,7 @@ Jeroen
 jessie
 jj
 Joaqu
+jonathaneen
 Jong
 Jorn
 journalctl
@@ -1190,6 +1195,7 @@ minbody
 mindex
 MINFO
 minipatch
+Mischan
 misconfigured
 mjt
 mkuchar
@@ -1879,6 +1885,7 @@ stutiredboy
 stylesheet
 subdomain
 subkey
+submitters
 subnetmask
 sudo
 suffixmatchtree
@@ -1888,9 +1895,11 @@ supernotification
 supersecretpassword
 superslave
 superslaving
+supervacuus
 supervisord
 Surfnet
 SUSE
+SVCB
 swapcontext
 swe
 swoga
@@ -1968,6 +1977,7 @@ toint
 tokenuser
 tolower
 Tolstov
+Toosarani
 Toshifumi
 tostring
 Travaille

diff --git a/docs/changelog/4.4.rst b/docs/changelog/4.4.rst
new file mode 100644 (file)
index 0000000..5609eb3
--- /dev/null
+++ b/docs/changelog/4.4.rst
@@ -0,0 +1,300 @@
+Changelogs for 4.4.x
+====================
+
+.. changelog::
+  :version: 4.4.0-alpha1
+  :released: 30th of September 2020
+
+  This is version 4.4.0-alpha1 of the Authoritative Server.
+  This release drops GSS/TSIG support, please see :doc:`PowerDNS Security Advisory 2020-06 <../security-advisories/powerdns-advisory-2020-06>`.
+
+  Version 4.4.0 brings a bunch of exciting changes:
+
+  * the LMDB backend now supports long record content, making it production ready for everybody
+  * the SVCB and HTTPS record types are supported, with limited additional processing
+  * transaction handling in the 2136 handler and the HTTP API was again improved a lot, avoiding various spurious issues users may have noticed if they do a lot of changes
+  * we finally emit Prometheus metrics!
+
+  We want to specifically thank Robin Geuze, Kees Monshouwer, Mischan Toosarani-Hausberger, and Chris Hofstaedtler for their contributions to this release.
+  We are also grateful to all other reporters of bugs, issues, feature requests, and submitters of smaller fixes and features.
+
+  Please make sure to read the :doc:`upgrade notes <../upgrading>` before upgrading.
+
+  .. change::
+    :tags: Improvements
+    :pullreq: 9369, 8638, 9337
+
+    New RRtypes: SVCB, HTTPS, APL.
+    Fixed RRtypes: IPSECKEY.
+
+  .. change::
+    :tags: Improvements
+    :pullreq: 9389
+
+    LMDB: new schema that supports long records (Robin Geuze)
+
+  .. change::
+    :tags: Bug Fixes
+    :pullreq: 9518, 9427, 9409, 9407
+
+    Improved transaction handling, especially around the metadata cache (Kees Monshouwer)
+
+  .. change::
+    :tags: Improvements
+    :pullreq: 9524
+
+    bindbackend: 'rediscover' changes to master and also-notifies (Matti Hiljanen)
+
+  .. change::
+    :tags: Bug Fixes
+    :pullreq: 9496
+
+    ignore cryptokeys in presigned zones (Kees Monshouwer)
+
+  .. change::
+    :tags: Improvements
+    :pullreq: 9039
+
+    quote/escape PG connection parameters
+
+  .. change::
+    :tags: Improvements
+    :pullreq: 8942
+
+    lua: add backtraces to errors
+
+  .. change::
+    :tags: Bug Fixes
+    :pullreq: 9478
+
+    remove a '// HACK FIXME400' and fix the bugs it was hiding (Kees Monshouwer)
+
+  .. change::
+    :tags: Removed Features
+    :pullreq: 9385
+
+    Remove GSS/TSIG support
+
+  .. change::
+    :tags: Improvements
+    :pullreq: 8993
+
+    Skip EDNS Cookies in the packet cache
+
+  .. change::
+    :tags: Improvements
+    :pullreq: 8969
+
+    Use more of systemd's sandboxing options when available
+
+  .. change::
+    :tags: Improvements
+    :pullreq: 9387
+
+    auth slave: log successful NOTIFY (Chris Hofstaedtler)
+
+  .. change::
+    :tags: Bug Fixes
+    :pullreq: 9439
+
+    Fix the sample 'geoip.conf' for Debian-based packages
+
+  .. change::
+    :tags: Improvements
+    :pullreq: 9419, 9430
+
+    sdig: Increment the DNS message IDs when pipelining, report ID mismatches
+
+  .. change::
+    :tags: Bug Fixes
+    :pullreq: 9408
+
+    Fix building with LLVM11 (RvdE)
+
+  .. change::
+    :tags: Improvements
+    :pullreq: 9157
+
+    Add support for FreeBSD's SO_REUSEPORT_LB
+
+  .. change::
+    :tags: Improvements
+    :pullreq: 9101
+
+    LUA records: two improvements to createForward
+
+  .. change::
+    :tags: New Features
+    :pullreq: 8824
+
+    Allow forced secondary zone retrieval
+
+  .. change::
+    :tags: Bug Fixes
+    :pullreq: 8928
+
+    Ensure qtype is set before calling setContent() in axfrfilter()
+
+  .. change::
+    :tags: New Features
+    :pullreq: 7963
+
+    Add a new command to add a super-master to SQL backends (Godwottery)
+
+  .. change::
+    :tags: Improvements
+    :pullreq: 8564, 8565
+
+    geoipbackend: top looking after first weighted match, propagate weighted rounding gap fix (criteo-forks)
+
+  .. change::
+    :tags: Improvements
+    :pullreq: 8623
+
+    Make a combination of delete and replace for rrset possible (jonathaneen)
+
+  .. change::
+    :tags: Bug Fixes
+    :pullreq: 9340
+
+    Auth API: Allow removal of NSEC3PARAM metadata
+
+  .. change::
+    :tags: Improvements
+    :pullreq: 9218
+
+    log more pdns_control actions (Chris Hofstaedtler)
+
+  .. change::
+    :tags: Improvements
+    :pullreq: 9318
+
+    gsqlbackend: allow backend-specific queries (Chris Hofstaedtler)
+
+  .. change::
+    :tags: Improvements
+    :pullreq: 9265
+
+    add used master address to slave check logs (Chris Hofstaedtler)
+
+  .. change::
+    :tags: Improvements
+    :pullreq: 9280
+
+    immediately fill account, kind, masters on zone create (Chris Hofstaedtler)
+
+  .. change::
+    :tags: Improvements
+    :pullreq: 9169
+
+    fetch all metadata at once (Kees Monshouwer)
+
+  .. change::
+    :tags: Improvements
+    :pullreq: 9252
+
+    Add version 'statistic' to prometheus
+
+  .. change::
+    :tags: Bug Fixes
+    :pullreq: 9253
+    :issues: 4973
+
+    pdnsutil: make sure we let all destructors run.
+
+  .. change::
+    :tags: Improvements
+    :pullreq: 9215
+
+    PKCS11 improvements
+
+  .. change::
+    :tags: Improvements
+    :pullreq: 9189
+
+    gpgsqlbackend: add parameters to query logging (Chris Hofstaedtler)
+
+  .. change::
+    :tags: Improvements
+    :pullreq: 9187
+
+    Set SyslogIdentifier for multiple instances (Chris Hofstaedtler)
+
+  .. change::
+    :tags: New Features
+    :pullreq: 9183
+
+    API: Allow rectifying Slave zones (Chris Hofstaedtler)
+
+  .. change::
+    :tags: New Features
+    :pullreq: 9182
+
+    Implemented prometheus metrics-endpoint for auth (supervacuus)
+
+  .. change::
+    :tags: Improvements
+    :pullreq: 9163
+
+    Optimize IXFR-to-AXFR fallback path (Chris Hofstaedtler)
+
+  .. change::
+    :tags: Bug Fixes
+    :pullreq: 8943
+
+    Remote Backend: Throw DBException in functions that allow it
+
+  .. change::
+    :tags: Bug Fixes
+    :pullreq: 9073
+
+    Ensure runtime dirs for virtual services differ
+
+  .. change::
+    :tags: Bug Fixes
+    :pullreq: 9080
+
+    better (actual) fix for mem leak in SSQLite3::execute()
+
+  .. change::
+    :tags: Bug Fixes
+    :pullreq: 9069
+
+    Avoid "pthread_rwlock_destroy on rwlock with waiters!" on OpenBSD
+
+  .. change::
+    :tags: Bug Fixes
+    :pullreq: 9060
+
+    BIND-DOMAIN-EXTENDED-STATUS: don't look for a domain called BIND-DOMAIN-EXTENDED-STATUS
+
+  .. change::
+    :tags: Improvements
+    :pullreq: 9024
+
+    auth smysql: mimic error message format from mysql tooling
+
+  .. change::
+    :tags: Improvements
+    :pullreq: 8975
+
+    improve sql schema updates (Kees Monshouwer)
+
+  .. change::
+    :tags: Improvements
+    :pullreq: 8939, 8925
+
+    NSEC fixes for unpublished DNSKEY (RobinGeuze)
+
+  .. change::
+    :tags: Improvements
+    :pullreq: 8929
+
+    make sure we look at 10% of all cached items during cleanup (Kees Monshouwer)
+
+  .. change::
+    :tags: Improvements
+    :pullreq: 8714
+
+    Reduce the number of temporary memory allocations
+

diff --git a/docs/changelog/index.rst b/docs/changelog/index.rst
index 9357f1a997bc522e375d0a0c6703a889ca28c8d9..91280d4cf7b0e3426544f3670688471225f281de 100644 (file)
--- a/docs/changelog/index.rst
+++ b/docs/changelog/index.rst
@@ -6,6 +6,7 @@ The changelogs for the PowerDNS Authoritative Server are split between release t
 .. toctree::
     :maxdepth: 2
 
+    4.4
     4.3
     4.2
     4.1

diff --git a/docs/secpoll.zone b/docs/secpoll.zone
index 9ac5bce83c0420957b59e7d2aa57f928efc78d7f..e6845e9850cea5b00ec74eca3a21672c42bfac67 100644 (file)
--- a/docs/secpoll.zone
+++ b/docs/secpoll.zone
@@ -1,4 +1,4 @@
-@       86400   IN  SOA pdns-public-ns1.powerdns.com. pieter\.lexis.powerdns.com. 2020100101 10800 3600 604800 10800
+@       86400   IN  SOA pdns-public-ns1.powerdns.com. pieter\.lexis.powerdns.com. 2020100102 10800 3600 604800 10800
 @       3600    IN  NS  pdns-public-ns1.powerdns.com.
 @       3600    IN  NS  pdns-public-ns2.powerdns.com.
 
@@ -70,6 +70,7 @@ auth-4.3.0-rc1.security-status                          60 IN TXT "2 Unsupported
 auth-4.3.0-rc2.security-status                          60 IN TXT "2 Unsupported pre-release (no known vulnerabilities)"
 auth-4.3.0.security-status                              60 IN TXT "3 Upgrade now, see https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2020-05.html"
 auth-4.3.1.security-status                              60 IN TXT "1 OK"
+auth-4.4.0-alpha1.security-status                       60 IN TXT "1 OK"
 
 ; Auth Debian
 auth-3.4.1-2.debian.security-status                     60 IN TXT "3 Upgrade now, see https://doc.powerdns.com/3/security/powerdns-advisory-2015-01/ and https://doc.powerdns.com/3/security/powerdns-advisory-2015-02/ and https://doc.powerdns.com/3/security/powerdns-advisory-2016-02/ and https://doc.powerdns.com/3/security/powerdns-advisory-2016-03/ and https://doc.powerdns.com/3/security/powerdns-advisory-2016-04/ and https://doc.powerdns.com/3/security/powerdns-advisory-2016-05/"

diff --git a/docs/upgrading.rst b/docs/upgrading.rst
index b3660ee6bf955f4b8c0e1c97863ca22ea2c80466..47392ad05603dcb11c27a5b8861b397b555920b1 100644 (file)
--- a/docs/upgrading.rst
+++ b/docs/upgrading.rst
@@ -11,11 +11,11 @@ upgrade notes if your version is older than 3.4.2.
 4.3.x to 4.4.0
 --------------
 
-``IPSECKEY`` change on secondaries
+Record type changes on secondaries
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
-The in-database format of the ``IPSECKEY`` has changed from 'generic' format to its specialized format.
-It is recommended to re-transfer, using ``pdns_control retrieve ZONE``, all zones that have ``IPSECKEY`` or ``TYPE45`` records.
+The in-database format of the ``IPSECKEY``, ``SVCB``, ``HTTPS`` and ``APL`` records has changed from 'generic' format to its specialized format.
+It is recommended to re-transfer, using ``pdns_control retrieve ZONE``, all zones that have records of those types, or ``TYPExx``, for numbers 42, 45, 64, 65.
 
 PostgreSQL configuration escaping
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
@@ -23,6 +23,15 @@ PostgreSQL configuration escaping
 We now correctly quote/escape Postgres connection parameters.
 If you used single quotes (or some other form of escaping) around your Postgres password because it contained spaces, you now need to put your unmodified, unescaped, unquoted password in your configuration.
 
+New LMDB schema
+^^^^^^^^^^^^^^^
+
+An LMDB schema upgrade is mandatory.
+Please carefully read :ref:`setting-lmdb-schema-version` before upgrading to 4.4.x.
+
+FIXME: 4.3.1 docs failed to mention #9233 (gsqlite3: add missing indexes)
+
+
 4.3.0 to 4.3.1
 --------------