From bert.hubert at powerdns.com Thu Jan 22 13:37:27 2015 From: bert.hubert at powerdns.com (bert hubert) Date: Thu, 22 Jan 2015 13:37:27 +0100 Subject: [Pdns-dev] PowerDNS Recursor 3.7.0-RC1 available Message-ID: <20150122123727.GA24577@xs.powerdns.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi everybody, We're very pleased to announce the availability of the first release candidate of PowerDNS Recursor 3.7.0. Of note is the massive community contribution, mostly over Christmas. Especially Ruben Kerkhof, Pieter Lexis, Kees Monshouwer and Aki Tuomi delivered a lot of love. Thanks! As is often the case, this RC has actually seen production use already, and should be safe to use. Specifically, it offers significant performance improvements when using IPv6 for outgoing queries, which is only on if query-local-address6 is set to something. Secondly, we spent a lot of time with very large PowerDNS deployments to preemptively improve our resilience against difficult or malicious traffic. To further enhance our resilience, the Lua module has been enhanced with new (bulk & automated) filtering abilities. This version of the Recursor can also publish live performance graphs & and a realtime overview of (attack) traffic per domain name. A demo of this can be seen on https://xs.powerdns.com/tmp/powerdns-recursor-live.gif . This is an early development, but to try this out, consult https://github.com/ahupowerdns/recuweb Tar.gz and packages are available on: * https://downloads.powerdns.com/testing/ * https://www.monshouwer.eu/download/3rd_party/pdns-recursor/rc1/ (RHEL/CentOS, with the usual huge thanks to Kees Monshouwer). The changelog with clickable links can also be found on https://doc.powerdns.com/md/changelog/#powerdns-recursor-370 This version contains a mix of speedups and improvements, the combined effect of which is vastly improved resilience against traffic spikes and malicious query overloads. Minor changes: * Removal of dead code here and there 04dc6d618 * Per-qtype response counters are now 64 bit 297bb6acf on 64 bit systems * Add IPv6 addresses for b and c.root-servers.net hints efc259542 * Add IP address to logging about terminated queries 37aa9904d * Improve qtype name logging fab3ed345 (Aki Tuomi) * Redefine 'BAD_NETS' for dont-query based on newer IANA guidance 12cd44ee0 (lochiiconnectivity) * Add documentation links to systemd unit eb154adfd (Ruben Kerkhof) Improvements: * Upgrade embedded PolarSSL to 1.3.9: d330a2ea1 * yahttp upgrade c29097577 c65a57e88 (Aki Tuomi) * Replace . in hostnames by - for Carbon so as not to confuse Metronome 46541751e * Manpages got a lot of love and are now built from Markdown (Pieter Lexis) * Move to PolarSSL base64 488360551 (Kees Monshouwer) * The quiet=no query logging is now more informative 461df9d20 * We can finally bind to 0.0.0.0 and :: and guarantee answers from the correct source b71b60ee7 * We use per-packet timestamps to drop ancient traffic in case of overload b71b60ee7 * Builtin webserver can be queried with the API key in the URL again c89f8cd02 * Ringbuffers are now available via API c89f8cd02 * Lua 5.3 compatibility 59c6fc3e3 (Kees Monshouwer) New features: * Lua preoutquery filter 3457a2a0e * Lua IP-based filter (ipfilter) before parsing packets 4ea949413 * iputils class for Lua, to quickly process IP addresses and netmasks in their native format * Various new ringbuffers: top-servfail-remotes, top-largeanswer-remotes, top-servfail-queries Speedups: * Remove unneeded malloc traffic 93d4a8909 8682c32bc a903b39cf * Our nameserver-loop detection carried around a lot of baggage for complex domain names, plus did not differentiate IPv4 and IPv6 well enough 891fbf888 * Prioritize new queries over nameserver responses, improving latency under query bursts bf3b0cec3 * Remove escaping in case there was nothing to escape 83b746fd1 * Our logging infrastructure had a lot of locking d1449e4d0 * Reduce logging level of certain common messages, which locked up synchronously logging systems 854d44e31 * Add limit on total wall-clock time spent on a query 9de3e0340 * Packet cache is now case-insensitive, which increases hitrate 90974597a Security relevant: * Check for PIE, RELRO and stack protector during configure 8d0354b18 (Aki Tuomi) * Max query-per-query limit (max-qperq) is now configurable 173d790ea Bugs fixed: * IPv6 outgoing queries had a disproportionate effect on our query load. Fixed in 76f190f2a and beyond. * rec_control gave incorrect output on a timeout 12997e9d8 * When using the webserver AND having an error in the Lua script, recursor could crash during startup 62f0ae629 * Hugely long version strings would trip up security polling 18b733382 (Kees Monshouwer) Various other documentation changes by Christian Hoffstaedtler and Ruben Kerkhof. Lots of improvements all over the place by Kees Monshouwer. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) iEYEARECAAYFAlTA7wcACgkQHF7pkNLnFXXi1gCfUxHYNmziQhODHRFOvF+pMWcd GL8An1HuJkwtat++lnuZ+CqJ8vhUqhYw =4Nq9 -----END PGP SIGNATURE-----