[Pdns-announce] PowerDNS Recursor 4.0.2 released

[Pieter Lexis]

Hello everyone,

Today, the PowerDNS Recursor version 4.0.2 is released.

This version fixes several bugs, among which was a regression in 4.x where CNAME records for DNSSEC signed domains were not sorted before the final answers, leading to some clients (notably some versions of Chrome) not being able to extract the required answer from the packet.
This happened exclusively for DNSSEC signed domains, but the problem happens even for clients not requesting DNSSEC validation.

This release also features several additions to the RPZ-stack.
Most notably the addition of NSDNAME and NSIP triggers and Lua-based access to the policy-decision in the existing hooks, plus a new prerpz hook that is called before preresolve to allow disabling of RPZ lookups.

Source tarball is here[1](sig[2]) and packages are available from our repositories[3].

The full changelog is as follows, changelog with links is online[4]:

Bug fixes

 - #4264: Set dq.rcode before calling postresolve
 - #4294: Honor PIE flags.
 - #4310: Fix build with LibreSSL, for which OPENSSL_VERSION_NUMBER is irrelevant
 - #4340: Don't shuffle CNAME records. (thanks to Gert van Dijk for the extensive bug report!)
 - #4354: Fix delegation-only

Additions and enhancements

 - #4288: Respect the timeout when connecting to a protobuf server
 - #4300: allow newDN to take a DNSName in; document missing methods
 - #4301: expose SMN toString to lua
 - #4318: Anonymize the protobuf ECS value as well (thanks to Kai Storbeck of XS4All for finding this)
 - #4324: Allow Lua access to the result of the Policy Engine decision, skip RPZ, finish RPZ implementation
 - #4349: Remove unused DNSPacket::d_qlen
 - #4351: RPZ: Use query-local-address(6) by default (thanks to Oli Schacher of switch.ch for the bug report)
 - #4357: Move the root DNSSEC data to a header file

Best regards,

Pieter, on behalf of the PowerDNS team

1 - https://downloads.powerdns.com/releases/pdns-recursor-4.0.2.tar.bz2
2 - https://downloads.powerdns.com/releases/pdns-recursor-4.0.2.tar.bz2.sig
3 - https://repo.powerdns.com
4 - https://doc.powerdns.com/md/changelog/#powerdns-recursor-402

-- 
Pieter Lexis
PowerDNS.COM BV -- https://www.powerdns.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 801 bytes
Desc: OpenPGP digital signature
URL: <http://mailman.powerdns.com/pipermail/pdns-announce/attachments/20160826/229702de/attachment.sig>