docs/changelog/4.0.rst

   1 Changelogs for 4.0.x
   2 ====================
   3
   4 PowerDNS Authoritative Server 4.0.9
   5 -----------------------------------
   6
   7 Released 1st of August 2019
   8
   9 This release contains the updated PostgreSQL schema for PowerDNS Security Advisory :doc:`2019-06 <../security-advisories/powerdns-advisory-2019-06>` (CVE-2019-10203).
  10
  11 Upgrading is not enough - you need to manually apply the schema change: ``ALTER TABLE domains ALTER notified_serial TYPE bigint USING CASE WHEN notified_serial >= 0 THEN notified_serial::bigint END;``
  12
  13 PowerDNS Authoritative Server 4.0.8
  14 -----------------------------------
  15
  16 Released 21st of June 2019
  17
  18 This release fixes PowerDNS Security Advisories
  19 :doc:`2019-04 <../security-advisories/powerdns-advisory-2019-04>` and
  20 :doc:`2019-05 <../security-advisories/powerdns-advisory-2019-05>`.
  21
  22 PowerDNS Authoritative Server 4.0.7
  23 -----------------------------------
  24
  25 Released 18th of March 2019
  26
  27 This release fixes PowerDNS Security Advisory
  28 :doc:`2019-03 <../security-advisories/powerdns-advisory-2019-03>`: Insufficient validation in the HTTP remote backend (CVE-2019-3871)
  29
  30 Bug fixes
  31 ~~~~~~~~~
  32
  33 - `#7582 <https://github.com/PowerDNS/pdns/pull/7582>`__: Insufficient validation in the HTTP remote backend (CVE-2019-3871)
  34
  35
  36 PowerDNS Authoritative Server 4.0.6
  37 -----------------------------------
  38
  39 Released 6th of November 2018
  40
  41 This release fixes PowerDNS Security Advisory
  42 :doc:`2018-03 <../security-advisories/powerdns-advisory-2018-03>`: Crafted zone record can cause a denial of service (CVE-2018-10851)
  43
  44 Bug fixes
  45 ~~~~~~~~~
  46
  47 - `#7150 <https://github.com/PowerDNS/pdns/pull/7150>`__: Crafted zone record can cause a denial of service (CVE-2018-10851)
  48 - `#7135 <https://github.com/PowerDNS/pdns/pull/7135>`__: Fix el6 builds
  49
  50 Improvements
  51 ~~~~~~~~~~~~
  52
  53 - `#6315 <https://github.com/PowerDNS/pdns/pull/6315>`__: Prevent cname + other data with dnsupdate
  54 - `#7119 <https://github.com/PowerDNS/pdns/pull/7119>`__: Switch to devtoolset 7 for el6
  55
  56 PowerDNS Authoritative Server 4.0.5
  57 -----------------------------------
  58
  59 Released 27th of November 2017
  60
  61 This release fixes PowerDNS Security Advisory
  62 :doc:`2017-04 <../security-advisories/powerdns-advisory-2017-04>`: Missing check on API operations (CVE-2017-15091).
  63
  64 Bug fixes
  65 ~~~~~~~~~
  66
  67 - `#4650 <https://github.com/PowerDNS/pdns/pull/4650>`__: Bindbackend: do not corrupt data supplied by other backends in getAllDomains (Christian Hofstaedtler)
  68 - `#4751 <https://github.com/PowerDNS/pdns/pull/4751>`__: API: prevent sending nameservers list and zone-level NS in rrsets (Christian Hofstaedtler)
  69 - `#4929 <https://github.com/PowerDNS/pdns/pull/4929>`__: gpgsql: make statement names actually unique (Christian Hofstaedtler)
  70 - `#4997 <https://github.com/PowerDNS/pdns/pull/4997>`__: Fix remotebackend params (Aki Tuomi)
  71 - `#5051 <https://github.com/PowerDNS/pdns/pull/5051>`__: Fix godbc query logging
  72 - `#5125 <https://github.com/PowerDNS/pdns/pull/5125>`__: For create-slave-zone, actually add all slaves, and not only first n times
  73 - `#5161 <https://github.com/PowerDNS/pdns/pull/5161>`__: Fix a regression in axfr-rectify + test (Arthur Gautier)
  74 - `#5408 <https://github.com/PowerDNS/pdns/pull/5408>`__: When making a netmask from a comboaddress, we neglected to zero the port
  75 - `#5599 <https://github.com/PowerDNS/pdns/pull/5599>`__: Fix libatomic detection on ppc64
  76 - `#5641 <https://github.com/PowerDNS/pdns/pull/5641>`__: Catch DNSName exception in the Zoneparser
  77 - `#5722 <https://github.com/PowerDNS/pdns/pull/5722>`__: Publish inactive KSK/CSK as CDNSKEY/CDS
  78 - `#5730 <https://github.com/PowerDNS/pdns/pull/5730>`__: Handle AFSDB record separately due to record structure. Fixes #4703 (Johan Jatko)
  79 - `#5678 <https://github.com/PowerDNS/pdns/pull/5678>`__: Treat requestor's payload size lower than 512 as equal to 512
  80 - `#5766 <https://github.com/PowerDNS/pdns/pull/5766>`__: Correctly purge entries from the caches after a transfer
  81 - `#5777 <https://github.com/PowerDNS/pdns/pull/5777>`__: Handle a signing pipe worker dying with work still pending
  82 - `#5815 <https://github.com/PowerDNS/pdns/pull/5815>`__: Ignore SOA-EDIT for PRESIGNED zones. Fixes #5814
  83 - `#5933 <https://github.com/PowerDNS/pdns/pull/5933>`__: Check return value for all getTSIGKey calls. Fixes #5931
  84 - `#5996 <https://github.com/PowerDNS/pdns/pull/5996>`__: Deny cache flush, zone retrieve and notify if the API is RO (Security Advisory
  85    :doc:`2017-04 <../security-advisories/powerdns-advisory-2017-04>`)
  86
  87 Improvements
  88 ~~~~~~~~~~~~
  89
  90 - `#4922 <https://github.com/PowerDNS/pdns/pull/4922>`__: Fix ldap-strict autoptr feature, including a test
  91 - `#5043 <https://github.com/PowerDNS/pdns/pull/5043>`__: mydnsbackend: Add getAllDomains (Aki Tuomi)
  92 - `#5112 <https://github.com/PowerDNS/pdns/pull/5112>`__: Stubresolver: Use only ``recursor`` setting if given
  93 - `#5147 <https://github.com/PowerDNS/pdns/pull/5147>`__: LuaWrapper: Allow embedded NULs in strings received from Lua
  94 - `#5277 <https://github.com/PowerDNS/pdns/pull/5277>`__: sdig: Clarify that the ``ednssubnet`` option takes "subnet/mask"
  95 - `#5309 <https://github.com/PowerDNS/pdns/pull/5309>`__: Tests: Ensure all required tools are available (Arthur Gautier)
  96 - `#5320 <https://github.com/PowerDNS/pdns/pull/5320>`__: PowerDNS sdig does not truncate trailing bits of EDNS Client Subnet mask
  97 - `#5349 <https://github.com/PowerDNS/pdns/pull/5349>`__: LuaJIT 2.1: Lua fallback functionality no longer uses Lua namespace
  98 - `#5498 <https://github.com/PowerDNS/pdns/pull/5498>`__: Add support for Botan 2.x
  99 - `#5509 <https://github.com/PowerDNS/pdns/pull/5509>`__: Ship ldapbackend schema files in tarball (Christian Hofstaedtler)
 100 - `#5518 <https://github.com/PowerDNS/pdns/pull/5518>`__: Collection of schema changes (Kees Monshouwer)
 101 - `#5523 <https://github.com/PowerDNS/pdns/pull/5523>`__: Fix typo in two log messages (Ruben Kerkhof)
 102 - `#5598 <https://github.com/PowerDNS/pdns/pull/5598>`__: Add help text on autodetecting systemd support
 103 - `#5723 <https://github.com/PowerDNS/pdns/pull/5723>`__: Use a unique pointer for bind backend's ``d_of``
 104 - `#5826 <https://github.com/PowerDNS/pdns/pull/5826>`__: Fix some of the issues found by @jpmens
 105
 106 PowerDNS Authoritative Server 4.0.4
 107 -----------------------------------
 108
 109 Released 23rd of June 2017
 110
 111 This release features a fix for the ed25519 signer. This signer hashed
 112 the message before signing, resulting in unverifiable signatures. Also
 113 on the Elliptic Curve front, support was added for ED448 (DNSSEC
 114 algorithm 16) by using libdecaf.
 115
 116 Bug fixes
 117 ~~~~~~~~~
 118
 119 -  `#5423 <https://github.com/PowerDNS/pdns/pull/5423>`__: Do not hash
 120    the message in the ed25519 signer (Kees Monshouwer)
 121 -  `#5445 <https://github.com/PowerDNS/pdns/pull/5445>`__: Make URI
 122    integers 16 bits, fixes
 123    `#5443 <https://github.com/PowerDNS/pdns/issues/5443>`__
 124 -  `#5346 <https://github.com/PowerDNS/pdns/pull/5346>`__: configure.ac:
 125    Corrects syntax error in test statement on existance of
 126    libcrypto\_ecdsa (shinsterneck)
 127 -  `#5440 <https://github.com/PowerDNS/pdns/pull/5440>`__: configure.ac:
 128    Fix quoting issue fixes
 129    `#5401 <https://github.com/PowerDNS/pdns/issues/5401>`__
 130 -  `#4824 <https://github.com/PowerDNS/pdns/pull/4824>`__: configure.ac:
 131    Check in the detected OpenSSL/libcrypto for ECDSA
 132 -  `#5016 <https://github.com/PowerDNS/pdns/pull/5016>`__: configure.ac:
 133    Check if we can link against libatomic if needed
 134 -  `#5341 <https://github.com/PowerDNS/pdns/pull/5341>`__: Fix typo in
 135    ldapbackend.cc from issue
 136    `#5091 <https://github.com/PowerDNS/pdns/issues/5091>`__
 137    (shantikulkarni)
 138 -  `#5289 <https://github.com/PowerDNS/pdns/pull/5289>`__: Sort NSEC
 139    record case insensitive (Kees Monshouwer)
 140 -  `#5378 <https://github.com/PowerDNS/pdns/pull/5378>`__: Make sure
 141    NSEC ordernames are always lower case
 142 -  `#4781 <https://github.com/PowerDNS/pdns/pull/4781>`__: API:
 143    correctly take TTL from first record even if we are at the last
 144    comment (Christian Hofstaedtler)
 145 -  `#4901 <https://github.com/PowerDNS/pdns/pull/4901>`__: Fix
 146    AtomicCounter unit tests on 32-bit
 147 -  `#4911 <https://github.com/PowerDNS/pdns/pull/4911>`__: Fix negative
 148    port detection for IPv6 addresses on 32-bit
 149 -  `#4508 <https://github.com/PowerDNS/pdns/pull/4508>`__: Remove
 150    support for 'right' timezones, as this code turned out to be broken
 151 -  `#4961 <https://github.com/PowerDNS/pdns/pull/4961>`__: Lowercase the
 152    TSIG algorithm name in hash computation
 153 -  `#5048 <https://github.com/PowerDNS/pdns/pull/5048>`__: Handle
 154    exceptions raised by ``closesocket()``
 155 -  `#5297 <https://github.com/PowerDNS/pdns/pull/5297>`__: Don't leak on
 156    signing errors during outgoing AXFR; signpipe stumbles over
 157    interrupted rrsets; fix memory leak in gmysql backend
 158 -  `#5450 <https://github.com/PowerDNS/pdns/pull/5450>`__: TinyCDB
 159    backend: Don't leak a CDB object in case of bogus data
 160
 161 Improvements
 162 ~~~~~~~~~~~~
 163
 164 -  `#5071 <https://github.com/PowerDNS/pdns/pull/5071>`__: ODBC backend:
 165    Allow query logging
 166 -  `#5441 <https://github.com/PowerDNS/pdns/pull/5441>`__: Add ED25519
 167    (algo 15) and ED448 (algo 16) support with libdecaf signer (Kees
 168    Monshouwer)
 169 -  `#5325 <https://github.com/PowerDNS/pdns/pull/5325>`__: YaHTTP: Sync
 170    with upstream changes
 171 -  `#5298 <https://github.com/PowerDNS/pdns/pull/5298>`__: Send a
 172    notification to all slave servers after every dnsupdate (Kees
 173    Monshouwer)
 174 -  `#5317 <https://github.com/PowerDNS/pdns/pull/5317>`__: Add option to
 175    set a global ``lua-axfr-script`` value (Kees Monshouwer)
 176 -  `#5130 <https://github.com/PowerDNS/pdns/pull/5130>`__: dnsreplay:
 177    Add ``--source-ip`` and ``--source-port`` options
 178 -  `#5085 <https://github.com/PowerDNS/pdns/pull/5085>`__: calidns: Use
 179    the correct socket family (IPv4 / IPv6)
 180 -  `#5170 <https://github.com/PowerDNS/pdns/pull/5170>`__: Add an option
 181    to allow AXFR of zones with a different (higher/lower) serial (Kees
 182    Monshouwer)
 183 -  `#4622 <https://github.com/PowerDNS/pdns/pull/4622>`__: API: Make
 184    trailing dot handling consistent with pdnsutil (Tuxis Internet
 185    Engineering)
 186 -  `#4762 <https://github.com/PowerDNS/pdns/pull/4762>`__:
 187    SuffixMatchNode: Fix insertion issue for an existing node
 188 -  `#4861 <https://github.com/PowerDNS/pdns/pull/4861>`__: Do not
 189    resolve the NS-records for NOTIFY targets if the "only-notify"
 190    whitelist is empty, as a target will never match an empty whitelist.
 191 -  `#5378 <https://github.com/PowerDNS/pdns/pull/5378>`__: Improve the
 192    AXFR DNSSEC freshness check; Ignore NSEC3PARAM metadata in an
 193    unsigned zone
 194 -  `#5297 <https://github.com/PowerDNS/pdns/pull/5297>`__: Create
 195    additional ``reuseport`` sockets before dropping privileges; remove
 196    transaction in pgpsql backend
 197
 198 PowerDNS Authoritative Server 4.0.3
 199 -----------------------------------
 200
 201 Released January 17th 2017
 202
 203 This release fixes an issue when using multiple backends, where one of
 204 the backends is the BIND backend. This regression was introduced in
 205 4.0.2.
 206
 207 Bug fix
 208 ~~~~~~~
 209
 210 -  `#4905 <https://github.com/PowerDNS/pdns/pull/4905>`__: Revert "auth:
 211    In ``Bind2Backend::lookup()``, use the ``zoneId`` when we have it"
 212
 213 PowerDNS Authoritative Server 4.0.2
 214 -----------------------------------
 215
 216 Released January 13th 2017
 217
 218 This release fixes PowerDNS Security Advisories
 219 :doc:`2016-02 <../security-advisories/powerdns-advisory-2016-02>`,
 220 :doc:`2016-03 <../security-advisories/powerdns-advisory-2016-03>`,
 221 :doc:`2016-04 <../security-advisories/powerdns-advisory-2016-04>` and
 222 :doc:`2016-05 <../security-advisories/powerdns-advisory-2016-05>` and includes a fix
 223 for a memory leak in the Postgresql backend.
 224
 225 Bug fixes
 226 ~~~~~~~~~
 227
 228 -  `commit f61af48 <https://github.com/PowerDNS/pdns/commit/f61af48>`__:
 229    Don't parse spurious RRs in queries when we don't need them (Security
 230    Advisory :doc:`2016-02 <../security-advisories/powerdns-advisory-2016-02>`)
 231 -  `commit 592006d <https://github.com/PowerDNS/pdns/commit/592006d>`__:
 232    Don't exit if the webserver can't accept a connection (Security
 233    Advisory :doc:`2016-03 <../security-advisories/powerdns-advisory-2016-03>`)
 234 -  `commit e85acc6 <https://github.com/PowerDNS/pdns/commit/e85acc6>`__:
 235    Check TSIG signature on IXFR (Security Advisory
 236    :doc:`2016-04 <../security-advisories/powerdns-advisory-2016-04>`)
 237 -  `commit 3b1e4a2 <https://github.com/PowerDNS/pdns/commit/3b1e4a2>`__:
 238    Correctly check unknown record content size (Security Advisory
 239    :doc:`2016-05 <../security-advisories/powerdns-advisory-2016-05>`)
 240 -  `commit 9ecbf02 <https://github.com/PowerDNS/pdns/commit/9ecbf02>`__:
 241    ODBC backend: actually prepare statements
 242 -  `commit a4d607b <https://github.com/PowerDNS/pdns/commit/a4d607b>`__:
 243    Fix incorrect length check in ``DNSName`` when extracting qtype or
 244    qclass
 245 -  `commit c816fe3 <https://github.com/PowerDNS/pdns/commit/c816fe3>`__:
 246    Fix a possible memory leak in the webserver
 247 -  `#4287 <https://github.com/PowerDNS/pdns/pull/4287>`__: Better
 248    handling of invalid serial
 249 -  `#4306 <https://github.com/PowerDNS/pdns/pull/4306>`__: Limit size of
 250    mysql cell to 128 kilobytes
 251 -  `#4314 <https://github.com/PowerDNS/pdns/pull/4314>`__: Overload fix:
 252    make overload-queue-length work as intended again, add test for it.
 253 -  `#4317 <https://github.com/PowerDNS/pdns/pull/4317>`__: Improve
 254    root-zone performance
 255 -  `#4319 <https://github.com/PowerDNS/pdns/pull/4319>`__: pipe:
 256    SERVFAIL when needed
 257 -  `#4360 <https://github.com/PowerDNS/pdns/pull/4360>`__: Make sure
 258    mariadb (mysql on centos/rhel) is started before pdns (42wim)
 259 -  `#4387 <https://github.com/PowerDNS/pdns/pull/4387>`__: ComboAddress:
 260    don't allow invalid ports
 261 -  `#4459 <https://github.com/PowerDNS/pdns/pull/4459>`__: Plug memory
 262    leak in postgresql backend (Christian Hofstaedtler)
 263 -  `#4544 <https://github.com/PowerDNS/pdns/pull/4544>`__: Fix a
 264    stack-based off-by-one write in the HTTP remote backend
 265 -  `#4755 <https://github.com/PowerDNS/pdns/pull/4755>`__: calidns:
 266    Don't crash if we don't have enough 'unknown' queries remaining
 267
 268 Additions and Enhancements
 269 ~~~~~~~~~~~~~~~~~~~~~~~~~~
 270
 271 -  `commit 1238e06 <https://github.com/PowerDNS/pdns/commit/1238e06>`__:
 272    disable negative getSOA caching if the negcache\_ttl is 0 (Kees
 273    Monshouwer)
 274 -  `commit 3a0bded <https://github.com/PowerDNS/pdns/commit/3a0bded>`__,
 275    `commit 8c879d4 <https://github.com/PowerDNS/pdns/commit/8c879d4>`__,
 276    `commit 8c03126 <https://github.com/PowerDNS/pdns/commit/8c03126>`__,
 277    `commit 5656e12 <https://github.com/PowerDNS/pdns/commit/5656e12>`__
 278    and `commit
 279    c1d283d <https://github.com/PowerDNS/pdns/commit/c1d283d>`__: Improve
 280    PacketCache cleaning (Kees Monshouwer)
 281 -  `#4261 <https://github.com/PowerDNS/pdns/pull/4261>`__: Strip
 282    trailing dot in PTR content (Kees Monshouwer)
 283 -  `#4269 <https://github.com/PowerDNS/pdns/pull/4269>`__: contrib:
 284    simple bash completion for pdnsutil (j0ju)
 285 -  `#4272 <https://github.com/PowerDNS/pdns/pull/4272>`__: Bind backend:
 286    update status message on reload, keep the existing zone on failure
 287 -  `#4274 <https://github.com/PowerDNS/pdns/pull/4274>`__: report DHCID
 288    type (Kees Monshouwer)
 289 -  `#4310 <https://github.com/PowerDNS/pdns/pull/4310>`__: Fix build
 290    with LibreSSL, for which OPENSSL\_VERSION\_NUMBER is irrelevant
 291 -  `#4323 <https://github.com/PowerDNS/pdns/pull/4323>`__: Speedup
 292    DNSName creation
 293 -  `#4335 <https://github.com/PowerDNS/pdns/pull/4335>`__: fix TSIG for
 294    single thread distributor (Kees Monshouwer)
 295 -  `#4346 <https://github.com/PowerDNS/pdns/pull/4346>`__: change
 296    default for any-to-tcp to yes (Kees Monshouwer)
 297 -  `#4356 <https://github.com/PowerDNS/pdns/pull/4356>`__: Don't look up
 298    the packet cache for TSIG-enabled queries
 299 -  `#4403 <https://github.com/PowerDNS/pdns/pull/4403>`__: (auth) Fix
 300    build with OpenSSL 1.1.0 final (Christian Hofstaedtler)
 301 -  `#4442 <https://github.com/PowerDNS/pdns/pull/4442>`__: geoipbackend:
 302    Fix minor naming issue (Aki Tuomi)
 303 -  `#4454 <https://github.com/PowerDNS/pdns/pull/4454>`__: pdnsutil:
 304    create-slave-zone accept multiple masters (Hannu Ylitalo)
 305 -  `#4541 <https://github.com/PowerDNS/pdns/pull/4541>`__: Backport of
 306    #4542: API: search should not return ENTs (Christian Hofstaedtler)
 307 -  `#4754 <https://github.com/PowerDNS/pdns/pull/4754>`__: In
 308    ``Bind2Backend::lookup()``, use the ``zoneId`` when we have it
 309
 310 PowerDNS Authoritative Server 4.0.1
 311 -----------------------------------
 312
 313 Released July 29th 2016
 314
 315 This release fixes two small issues and adds a setting to limit AXFR and
 316 IXFR sizes, in response to
 317 `CVE-2016-6172 <http://www.openwall.com/lists/oss-security/2016/07/06/4>`__.
 318
 319 Bug fixes
 320 ~~~~~~~~~
 321
 322 -  `#4126 <https://github.com/PowerDNS/pdns/pull/4126>`__ Wait for the
 323    connection to the carbon server to be established
 324 -  `#4206 <https://github.com/PowerDNS/pdns/pull/4206>`__ Don't try to
 325    deallocate empty PG statements
 326 -  `#4245 <https://github.com/PowerDNS/pdns/pull/4245>`__ Send the
 327    correct response when queried for an NSEC directly (Kees Monshouwer)
 328 -  `#4252 <https://github.com/PowerDNS/pdns/pull/4252>`__ Don't include
 329    bind files if length <= 2 or > sizeof(filename)
 330 -  `#4255 <https://github.com/PowerDNS/pdns/pull/4255>`__ Catch
 331    runtime\_error when parsing a broken MNAME
 332
 333 Improvements
 334 ~~~~~~~~~~~~
 335
 336 -  `#4044 <https://github.com/PowerDNS/pdns/pull/4044>`__ Make DNSPacket
 337    return a ComboAddress for local and remote (Aki Tuomi)
 338 -  `#4056 <https://github.com/PowerDNS/pdns/pull/4056>`__ OpenSSL 1.1.0
 339    support (Christian Hofstaedtler)
 340 -  `#4169 <https://github.com/PowerDNS/pdns/pull/4169>`__ Fix typos in a
 341    logmessage and exception (Christian Hofstaedtler)
 342 -  `#4183 <https://github.com/PowerDNS/pdns/pull/4183>`__ pdnsutil:
 343    Remove checking of ctime and always diff the changes (Hannu Ylitalo)
 344 -  `#4192 <https://github.com/PowerDNS/pdns/pull/4192>`__ dnsreplay:
 345    Only add Client Subnet stamp when asked
 346 -  `#4250 <https://github.com/PowerDNS/pdns/pull/4250>`__ Use
 347    toLogString() for ringAccount (Kees Monshouwer)
 348
 349 Additions
 350 ~~~~~~~~~
 351
 352 -  `#4133 <https://github.com/PowerDNS/pdns/pull/4133>`__ Add limits to
 353    the size of received {A,I}XFR (CVE-2016-6172)
 354 -  `#4142 <https://github.com/PowerDNS/pdns/pull/4142>`__ Add used
 355    filedescriptor statistic (Kees Monshouwer)
 356
 357 PowerDNS Authoritative Server 4.0.0
 358 -----------------------------------
 359
 360 Released July 11th 2016
 361
 362 PowerDNS Authoritative Server 4.0.0 is part of `the great 4.x "Spring
 363 Cleaning" <https://blog.powerdns.com/2015/11/28/powerdns-spring-cleaning/>`__
 364 of PowerDNS which lasted through the end of 2015.
 365
 366 As part of the general cleanup and improvements, we did the following:
 367
 368 -  Moved to C++ 2011, a cleaner more powerful version of C++ that has
 369    allowed us to `improve the quality of
 370    implementation <http://bert-hubert.blogspot.nl/2015/01/on-c2011-quality-of-implementation.html>`__
 371    in many places.
 372 -  Implemented dedicated infrastructure for dealing with DNS names that
 373    is fully "DNS Native" and needs less escaping and unescaping.
 374 -  All backends derived from the Generic SQL backend use :doc:`prepared
 375    statements <../backends/generic-sql>`.
 376 -  Both the server and ``pdns_control`` do the right thing when
 377    ``chroot``'ed.
 378
 379 In addition to this cleanup, 4.0.0 brings the following new features:
 380
 381 -  A revived ODBC backend
 382    (:doc:`godbc <../backends/generic-odbc>`).
 383 -  A revived LDAP backend (:doc:`ldap <../backends/ldap>`).
 384 -  Support for
 385    :doc:`CDS/CDNSKEY <../guides/kskrollcdnskey>`
 386    and :rfc:`7344` key-rollovers.
 387 -  Support for the :doc:`ALIAS <../guides/alias>` record.
 388 -  The webserver and API are no longer marked experimental.
 389
 390    -  The API-path has moved to ``/api/v1``
 391
 392 -  DNSUpdate is no longer experimental.
 393 -  Default ECDSA (algorithms 13 and 14) support without external
 394    dependencies.
 395 -  Experimental support for ed25519 DNSSEC signatures (when compiled
 396    with libsodium support).
 397 -  IXFR consumption support.
 398 -  Many new ``pdnsutil`` commands
 399
 400    -  ``help`` command now produces the help
 401    -  Warns if the configuration file cannot be read
 402    -  Does not check disabled records with ``check-zone`` unless verbose
 403       mode is enabled
 404    -  ``create-zone`` command creates a new zone
 405    -  ``add-record`` command to add records
 406    -  ``delete-rrset`` and ``replace-rrset`` commands to delete and add
 407       rrsets
 408    -  ``edit-zone`` command that spawns ``$EDITOR`` with the zone
 409       contents in zonefile format regardless of the backend used
 410       (`blogpost <https://blog.powerdns.com/2016/02/02/powerdns-authoritative-the-new-old-way-to-manage-domains/>`__
 411
 412 The following backend have been dropped in 4.0.0:
 413
 414 -  LMDB.
 415 -  Geo (use the improved :doc:`GeoIP <../backends/geoip>`
 416    instead).
 417
 418 Important changes:
 419
 420 -  ``pdnssec`` has been renamed to ``pdnsutil``
 421 -  PowerDNS Authoritative Server now listens by default on all IPv6
 422    addresses.
 423 -  The default for ``pdnsutil secure-zone`` has been changed from 1 2048
 424    bit RSA KSK and 1 1024 bit RSA ZSK to a single 256 bit ECDSA
 425    (algorithm 13, ECDSAP256SHA256) key.
 426 -  Several superfluous queries have been dropped from the SQL backend,
 427    if you use a non-standard SQL schema, please review the new defaults
 428
 429    -  ``insert-ent-query``, ``insert-empty-non-terminal-query``,
 430       ``insert-ent-order-query`` have been replaced by one query named
 431       ``insert-empty-non-terminal-order-query``
 432    -  ``insert-record-order-query`` has been dropped,
 433       ``insert-record-query`` now sets the ordername (or NULL)
 434    -  ``insert-slave-query`` has been dropped, ``insert-zone-query`` now
 435       sets the type of zone
 436
 437 -  Crypto++ and mbedTLS support is dropped, these are replaced by
 438    OpenSSL
 439 -  The INCEPTION and INCEPTION-WEEK SOA-EDIT metadata values are
 440    marked as deprecated and will be removed in 4.1
 441
 442 The final release has the following bug fixes compared to rc2:
 443
 444 -  `#4071 <https://github.com/PowerDNS/pdns/pull/4071>`__ Abort on
 445    backend failures at startup and retry while running (Kees Monshouwer)
 446 -  `#4099 <https://github.com/PowerDNS/pdns/pull/4099>`__ Don't leak TCP
 447    connection descriptor if ``pthread_create()`` failed
 448 -  `#4137 <https://github.com/PowerDNS/pdns/pull/4137>`__ gsqlite3:
 449    Check whether foreign keys should be turned on (Aki Tuomi)
 450
 451 And the following improvements:
 452
 453 -  `#3051 <https://github.com/PowerDNS/pdns/pull/3051>`__ Better error
 454    message for unfound new slave domains
 455 -  `#4123 <https://github.com/PowerDNS/pdns/pull/4123>`__ check-zone:
 456    warn on mismatch between algo and NSEC mode
 457
 458 PowerDNS Authoritative Server 4.0.0-rc2
 459 ---------------------------------------
 460
 461 Released June 29th 2016
 462
 463 .. note::
 464   rc1 was tagged in git but never officially released. Kees
 465   Monshouwer discovered an issue in the gmysql backend that would
 466   terminate the daemon on a connection error, this fixed in rc2.
 467
 468 This Release Candidate adds IXFR consumption and fixes some issues with
 469 prepared statements:
 470
 471 -  `#3937 <https://github.com/PowerDNS/pdns/pull/3937>`__ GSQL: use lazy
 472    prepared statements (Aki Tuomi)
 473 -  `#3949 <https://github.com/PowerDNS/pdns/pull/3949>`__ Implement
 474    IXFR-based slaving for Authoritative, fix duplicate AXFRs
 475 -  `#4066 <https://github.com/PowerDNS/pdns/pull/4066>`__ Don't die on a
 476    mysql timeout (Kees Monshouwer)
 477
 478 Other improvements:
 479
 480 -  `#4061 <https://github.com/PowerDNS/pdns/pull/4061>`__ Various fixes,
 481    a MySQL-query fix that improves performance and one that allows
 482    shorter best matches in getAuth()
 483 -  `#3962 <https://github.com/PowerDNS/pdns/pull/3962>`__ Fix OpenBSD
 484    support
 485 -  `#3972 <https://github.com/PowerDNS/pdns/pull/3972>`__ API: change
 486    PATCH/PUT on zones to return 204 No Content instead of full zone
 487    (Christian Hofstaedtler)
 488 -  `#3917 <https://github.com/PowerDNS/pdns/pull/3917>`__ Remotebackend:
 489    Add getAllDomains call (Aki Tuomi)
 490
 491 Bug fixes and changes:
 492
 493 -  `#3998 <https://github.com/PowerDNS/pdns/pull/3998>`__ remove
 494    gsql::isOurDomain for now (Kees Monshouwer)
 495 -  `#3989 <https://github.com/PowerDNS/pdns/pull/3989>`__ Fix usage of
 496    std::distance() in DNSName::isPartOf()
 497 -  `#4001 <https://github.com/PowerDNS/pdns/pull/4001>`__ re enable
 498    validDNSName() check (Kees Monshouwer)
 499 -  `#3930 <https://github.com/PowerDNS/pdns/pull/3930>`__ Have
 500    pdns\_control bind-add-zone check for zonefile
 501 -  `#3400 <https://github.com/PowerDNS/pdns/pull/3400>`__ Fix building
 502    on OpenIndiana
 503 -  `#3961 <https://github.com/PowerDNS/pdns/pull/3961>`__ Allow building
 504    on CentOS 6 i386
 505 -  `#3940 <https://github.com/PowerDNS/pdns/pull/3940>`__ auth: Don't
 506    build dnsbulktest and dnstcpbench if boost is too old, fixes building
 507    on CentOS 6
 508 -  `#3931 <https://github.com/PowerDNS/pdns/pull/3931>`__ Rename
 509    ``notify`` to ``pdns_notify`` (Christian Hofstaedtler)
 510
 511 PowerDNS Authoritative Server 4.0.0-beta1
 512 -----------------------------------------
 513
 514 Released May 27th 2016
 515
 516 This release features several small fixes and deprecations.
 517
 518 Improvements and Additions
 519 ~~~~~~~~~~~~~~~~~~~~~~~~~~
 520
 521 -  `#3851 <https://github.com/PowerDNS/pdns/pull/3851>`__ Disable
 522    algorithm 13 and 14 if OpenSSL does not support ecdsa or the required
 523    curves (Kees Monshouwer)
 524 -  `#3857 <https://github.com/PowerDNS/pdns/pull/3857>`__ Add simple
 525    stubquery tool for testing the stubresolver
 526 -  `#3859 <https://github.com/PowerDNS/pdns/pull/3859>`__ build scripts:
 527    Stop patching config-dir in pdns.conf (Christian Hofstaedtler)
 528 -  `#3872 <https://github.com/PowerDNS/pdns/pull/3872>`__ Add support
 529    for multiple carbon servers
 530 -  `#3901 <https://github.com/PowerDNS/pdns/pull/3901>`__ Add support
 531    for virtual hosting with systemd
 532
 533 Bug fixes
 534 ~~~~~~~~~
 535
 536 -  `#3856 <https://github.com/PowerDNS/pdns/pull/3856>`__ Deal with
 537    unset name in nproxy replies
 538
 539 PowerDNS Authoritative Server 4.0.0-alpha3
 540 ------------------------------------------
 541
 542 Released May 11th 2016
 543
 544 Notable changes since 4.0.0-alpha2
 545
 546 -  `#3415 <https://github.com/PowerDNS/pdns/pull/3415>`__ pdnsutil: add
 547    clear-zone command
 548 -  `#3586 <https://github.com/PowerDNS/pdns/pull/3586>`__ Remove
 549    send-root-referral option
 550 -  `#3578 <https://github.com/PowerDNS/pdns/pull/3578>`__ Add
 551    disable-syslog option
 552 -  `#3733 <https://github.com/PowerDNS/pdns/pull/3733>`__ ALIAS
 553    improvements: DNSSEC and optional on-AXFR expansion of records
 554 -  `#3764 <https://github.com/PowerDNS/pdns/pull/3764>`__ Notify support
 555    for systemd
 556 -  `#3807 <https://github.com/PowerDNS/pdns/pull/3807>`__ Add TTL
 557    settings for DNSSECKeeper's caches
 558
 559 Bug fixes
 560 ~~~~~~~~~
 561
 562 -  `#3553 <https://github.com/PowerDNS/pdns/pull/3553>`__ pdnsutil:
 563    properly show key sizes for presigned zones in show-zone
 564 -  `#3507 <https://github.com/PowerDNS/pdns/pull/3507>`__ webserver:
 565    mask out the api-key setting (Christian Hofstaedtler)
 566 -  `#3580 <https://github.com/PowerDNS/pdns/pull/3580>`__ bindbackend:
 567    set domain in list() (Kees Monshouwer)
 568 -  `#3595 <https://github.com/PowerDNS/pdns/pull/3595>`__ pdnsutil: add
 569    NS record without trailing dot with create-zone
 570 -  `#3653 <https://github.com/PowerDNS/pdns/pull/3653>`__ Allow tabs as
 571    whitespace in zonefiles
 572 -  `#3666 <https://github.com/PowerDNS/pdns/pull/3666>`__ Restore
 573    recycle backend behaviour (Kees Monshouwer)
 574 -  `#3612 <https://github.com/PowerDNS/pdns/pull/3612>`__ Prevent
 575    segfault in PostgreSQL backend
 576 -  `#3779 <https://github.com/PowerDNS/pdns/pull/3779>`__,
 577    `#3768 <https://github.com/PowerDNS/pdns/pull/3768>`__,
 578    `#3766 <https://github.com/PowerDNS/pdns/pull/3766>`__,
 579    `#3783 <https://github.com/PowerDNS/pdns/pull/3783>`__ and
 580    `#3789 <https://github.com/PowerDNS/pdns/pull/3789>`__ DNSName and
 581    other hardening improvements
 582 -  `#3784 <https://github.com/PowerDNS/pdns/pull/3784>`__ fix SOA
 583    caching with multiple backends (Kees Monshouwer)
 584 -  `#3827 <https://github.com/PowerDNS/pdns/pull/3827>`__ Force
 585    NSEC3PARAM algorithm to 1, fixes validation issues when set to not 1
 586
 587 Improvements
 588 ~~~~~~~~~~~~
 589
 590 -  `#3637 <https://github.com/PowerDNS/pdns/pull/3637>`__,
 591    `#3678 <https://github.com/PowerDNS/pdns/pull/3678>`__,
 592    `#3740 <https://github.com/PowerDNS/pdns/pull/3740>`__ Correct
 593    root-zone slaving and serving (Kees Monshouwer and others)
 594 -  `#3495 <https://github.com/PowerDNS/pdns/pull/3495>`__ API: Add
 595    discovery endpoint (Christian Hofstaedtler)
 596 -  `#3389 <https://github.com/PowerDNS/pdns/pull/3389>`__ pdnsutil:
 597    support chroot
 598 -  `#3596 <https://github.com/PowerDNS/pdns/pull/3596>`__ Remove
 599    botan-based ecdsa and rsa signers (Kees Monshouwer)
 600 -  `#3478 <https://github.com/PowerDNS/pdns/pull/3478>`__,
 601    `#3603 <https://github.com/PowerDNS/pdns/pull/3603>`__,
 602    `#3628 <https://github.com/PowerDNS/pdns/pull/3628>`__ Various build
 603    system improvements (Ruben Kerkhof)
 604 -  `#3621 <https://github.com/PowerDNS/pdns/pull/3621>`__ Always
 605    lowercase when inserting into the database
 606 -  `#3651 <https://github.com/PowerDNS/pdns/pull/3651>`__ Rename
 607    PUBLISH\_\* to PUBLISH-\* domainmetadata
 608 -  `#3656 <https://github.com/PowerDNS/pdns/pull/3656>`__ API: clean up
 609    cryptokeys resource (Christian Hofstaedtler)
 610 -  `#3632 <https://github.com/PowerDNS/pdns/pull/3632>`__ pdnsutil: Fix
 611    exit statuses to constants and return 0 when success (saltsa)
 612 -  `#3655 <https://github.com/PowerDNS/pdns/pull/3655>`__ API: Fix
 613    set-ptr to honor SOA-EDIT-API (Christian Hofstaedtler)
 614 -  `#3720 <https://github.com/PowerDNS/pdns/pull/3720>`__ Many fixes for
 615    dnswasher (Robert Edmonds)
 616 -  `#3707 <https://github.com/PowerDNS/pdns/pull/3707>`__,
 617    `#3788 <https://github.com/PowerDNS/pdns/pull/3788>`__ Make MySQL
 618    timeout configurable (Kees Monshouwer and Brynjar Eide)
 619 -  `#3806 <https://github.com/PowerDNS/pdns/pull/3806>`__ Move key
 620    validity check out of ``fromISCMap()``, improves DNSSEC performance
 621 -  `#3820 <https://github.com/PowerDNS/pdns/pull/3820>`__ pdnsutil
 622    load-zone: ignore double SOA
 623
 624 PowerDNS Authoritative Server 4.0.0-alpha2
 625 ------------------------------------------
 626
 627 Released February 25th 2016
 628
 629 Notable changes since 4.0.0-alpha1
 630
 631 -  `#3037 <https://github.com/PowerDNS/pdns/pull/3037>`__ Remove
 632    superfluous gsql queries and stop relying on schema defaults
 633 -  `#3176 <https://github.com/PowerDNS/pdns/pull/3176>`__,
 634    `#3139 <https://github.com/PowerDNS/pdns/pull/3139>`__ OpenSSL
 635    support (Christian Hofstaedtler and Kees Monshouwer)
 636 -  `#3128 <https://github.com/PowerDNS/pdns/pull/3128>`__ ECDSA support
 637    to DNSSEC infra via OpenSSL (Kees Monshouwer)
 638 -  `#3281 <https://github.com/PowerDNS/pdns/pull/3281>`__,
 639    `#3283 <https://github.com/PowerDNS/pdns/pull/3283>`__,
 640    `#3363 <https://github.com/PowerDNS/pdns/pull/3363>`__ Remove
 641    Crypto++ and mbedTLS support
 642 -  `#3298 <https://github.com/PowerDNS/pdns/pull/3298>`__ Implement
 643    pdnsutil create-zone zone nsname, add-record, delete-rrset,
 644    replace-rrset
 645 -  `#3407 <https://github.com/PowerDNS/pdns/pull/3407>`__ API: Permit
 646    wildcard manipulation (Aki Tuomi)
 647 -  `#3230 <https://github.com/PowerDNS/pdns/pull/3230>`__ API: drop
 648    JSONP, add web security headers (Christian Hofstaedtler)
 649 -  `#3428 <https://github.com/PowerDNS/pdns/pull/3428>`__ API: Fix
 650    zone/records design mistake (Christian Hofstaedtler)
 651
 652    -  **Note**: this is a breaking change from alpha1, please review the
 653       `API documentation <../httpapi>`
 654
 655 Bug fixes
 656 ~~~~~~~~~
 657
 658 -  `#3124 <https://github.com/PowerDNS/pdns/pull/3124>`__ Fix several
 659    bugs with introduced with the change to a single signing key (e.g.
 660    the SEP bit is set on these single keys)
 661 -  `#3151 <https://github.com/PowerDNS/pdns/pull/3151>`__ Catch DNSName
 662    build errors in dynhandler (Christian Hofstaedtler)
 663 -  `#3264 <https://github.com/PowerDNS/pdns/pull/3264>`__ GeoIP backend:
 664    Use correct id numbers for domains (Aki Tuomi)
 665 -  `#3271 <https://github.com/PowerDNS/pdns/pull/3271>`__ ZoneParser:
 666    Throw PDNSException on too many SOA data elements
 667 -  `#3302 <https://github.com/PowerDNS/pdns/pull/3302>`__ Fix
 668    bindbackend's feedRecord to handle being slave for the root
 669 -  `#3399 <https://github.com/PowerDNS/pdns/pull/3399>`__ Report OpenSSL
 670    RSA keysize in bits (Kees Monshouwer)
 671
 672 Improvements
 673 ~~~~~~~~~~~~
 674
 675 -  `#3119 <https://github.com/PowerDNS/pdns/pull/3119>`__ Show DNSSEC
 676    keys for slaved zone (Aki Tuomi)
 677 -  `#3255 <https://github.com/PowerDNS/pdns/pull/3255>`__ Don't log
 678    authentication errors before sending HTTP basic auth challenge (Jan
 679    Broer)
 680 -  `#3338 <https://github.com/PowerDNS/pdns/pull/3338>`__ Add weight
 681    feature to GeoIP backend (Aki Tuomi)
 682 -  `#3364 <https://github.com/PowerDNS/pdns/pull/3364>`__ Shrink
 683    PacketID by 10% by eliminating padding. (Andrew Nelless)
 684 -  `#3443 <https://github.com/PowerDNS/pdns/pull/3443>`__ Many speedup
 685    and correctness fixes
 686
 687 PowerDNS Authoritative Server 4.0.0-alpha1
 688 ------------------------------------------
 689
 690 Released December 24th 2015