[Pdns-dev] PowerDNS Recursor 3.7.0-RC1 available

[bert hubert]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi everybody,

We're very pleased to announce the availability of the first release
candidate of PowerDNS Recursor 3.7.0. 

Of note is the massive community contribution, mostly over Christmas. 
Especially Ruben Kerkhof, Pieter Lexis, Kees Monshouwer and Aki Tuomi
delivered a lot of love.  Thanks!

As is often the case, this RC has actually seen production use already, and
should be safe to use.

Specifically, it offers significant performance improvements when using IPv6
for outgoing queries, which is only on if query-local-address6 is set to
something.  Secondly, we spent a lot of time with very large PowerDNS
deployments to preemptively improve our resilience against difficult or
malicious traffic. To further enhance our resilience, the Lua module has
been enhanced with new (bulk & automated) filtering abilities.

This version of the Recursor can also publish live performance graphs & and
a realtime overview of (attack) traffic per domain name.  A demo of this can
be seen on https://xs.powerdns.com/tmp/powerdns-recursor-live.gif .  This is
an early development, but to try this out, consult
https://github.com/ahupowerdns/recuweb

Tar.gz and packages are available on:

 * https://downloads.powerdns.com/testing/ 
 * https://www.monshouwer.eu/download/3rd_party/pdns-recursor/rc1/
   (RHEL/CentOS, with the usual huge thanks to Kees Monshouwer).

The changelog with clickable links can also be found on 
https://doc.powerdns.com/md/changelog/#powerdns-recursor-370

This version contains a mix of speedups and improvements, the combined
effect of which is vastly improved resilience against traffic spikes and
malicious query overloads.

Minor changes:

 * Removal of dead code here and there 04dc6d618
 * Per-qtype response counters are now 64 bit 297bb6acf on 64 bit systems
 * Add IPv6 addresses for b and c.root-servers.net hints efc259542
 * Add IP address to logging about terminated queries 37aa9904d
 * Improve qtype name logging fab3ed345 (Aki Tuomi)
 * Redefine 'BAD_NETS' for dont-query based on newer IANA guidance 12cd44ee0 (lochiiconnectivity)
 * Add documentation links to systemd unit eb154adfd (Ruben Kerkhof)

Improvements:

 * Upgrade embedded PolarSSL to 1.3.9: d330a2ea1
 * yahttp upgrade c29097577 c65a57e88 (Aki Tuomi)
 * Replace . in hostnames by - for Carbon so as not to confuse Metronome 46541751e
 * Manpages got a lot of love and are now built from Markdown (Pieter Lexis)
 * Move to PolarSSL base64 488360551 (Kees Monshouwer)
 * The quiet=no query logging is now more informative 461df9d20
 * We can finally bind to 0.0.0.0 and :: and guarantee answers from the correct source b71b60ee7
 * We use per-packet timestamps to drop ancient traffic in case of overload b71b60ee7
 * Builtin webserver can be queried with the API key in the URL again c89f8cd02
 * Ringbuffers are now available via API c89f8cd02
 * Lua 5.3 compatibility 59c6fc3e3 (Kees Monshouwer)

New features:

 * Lua preoutquery filter 3457a2a0e
 * Lua IP-based filter (ipfilter) before parsing packets 4ea949413
 * iputils class for Lua, to quickly process IP addresses and netmasks in their
   native format
 * Various new ringbuffers: top-servfail-remotes, top-largeanswer-remotes, top-servfail-queries

Speedups:

 * Remove unneeded malloc traffic 93d4a8909 8682c32bc a903b39cf
 * Our nameserver-loop detection carried around a lot of baggage for complex
   domain names, plus did not differentiate IPv4 and IPv6 well enough 891fbf888
 * Prioritize new queries over nameserver responses, improving latency under
   query bursts bf3b0cec3
 * Remove escaping in case there was nothing to escape 83b746fd1
 * Our logging infrastructure had a lot of locking d1449e4d0
 * Reduce logging level of certain common messages, which locked up
   synchronously logging systems 854d44e31
 * Add limit on total wall-clock time spent on a query 9de3e0340
 * Packet cache is now case-insensitive, which increases hitrate 90974597a

Security relevant:

* Check for PIE, RELRO and stack protector during configure 8d0354b18 (Aki
  Tuomi)
* Max query-per-query limit (max-qperq) is now configurable 173d790ea

Bugs fixed:

 * IPv6 outgoing queries had a disproportionate effect on our query load. Fixed
   in 76f190f2a and beyond.
 * rec_control gave incorrect output on a timeout 12997e9d8
 * When using the webserver AND having an error in the Lua script, recursor
   could crash during startup 62f0ae629
 * Hugely long version strings would trip up security polling 18b733382 (Kees
   Monshouwer)

Various other documentation changes by Christian Hoffstaedtler and Ruben
Kerkhof. Lots of improvements all over the place by Kees Monshouwer.


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iEYEARECAAYFAlTA7wcACgkQHF7pkNLnFXXi1gCfUxHYNmziQhODHRFOvF+pMWcd
GL8An1HuJkwtat++lnuZ+CqJ8vhUqhYw
=4Nq9
-----END PGP SIGNATURE-----