[Pdns-users] PowerDNS Authoritative Server 3.3 released!

[Peter van Dijk]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi everybody,

PowerDNS Authoritative Server 3.3 is now available!

3.3 is the best version of the PowerDNS Authoratitive Server currently
available, and we recommend upgrading to it. Please read 
http://doc.powerdns.com/from3.2to3.3.html before you do, however!

Please see http://doc.powerdns.com/changelog.html#changelog-auth-3-3 for full
release notes and all download links.

You can get PowerDNS 3.3 from:

http://downloads.powerdns.com/releases/pdns-3.3.tar.gz
http://downloads.powerdns.com/releases/deb/pdns-static_3.3-1_i386.deb
http://downloads.powerdns.com/releases/deb/pdns-static_3.3-1_amd64.deb
http://downloads.powerdns.com/releases/rpm/pdns-static-3.3-1.i386.rpm
http://downloads.powerdns.com/releases/rpm/pdns-static-3.3-1.x86_64.rpm

These files also come with GPG signatures (append .sig).

Additionaly, Kees Monshouwer has kindly provided native builds for RHEL/CentOS
5 and 6 at http://www.monshouwer.eu/download/3rd_party/pdns-server/

This a stability, bugfix and conformity update to 3.2. It improves
interoperability with various validators, either through bugfixes or by
catering to their needs beyond the specifications.

Changes between RC2 and final:

  * pdnssec rectify-zone now refuses to operate on presigned zones, as
    rectification already happens during incoming transfer. Patch by Kees
    Monshouwer in commit 9bd211e.

  * We now handle zones with a mix of NSEC3 opt-out and non-opt-out ranges
    correctly during inbound and outbound AXFR. Many thanks to Kees Monshouwer.
    Code in commit 5aa7003 and commit d3e7b17.

  * More remotebackend fixes (commit 32d4f44, commit 44c2ee8, commit 1fcc7b7,
    commit 0b1a3b2, commit 9a319b1), thanks Aki Tuomi.

  * Some compiler warnings were squashed (commit ed554db), thanks Morten
    Stevens.

  * Fix broken memory access in LOC parser (commit 4eec51b, commit bea513c),
    thanks Aki Tuomi.

  * DNSSEC: DS queries at the apex of a zone for which we are not hosting the
    parent, would wrongly get an 'unauth NOERROR'. Fixed by Kees Monshouwer in
    commit 34479a6.

Changes between RC1 and RC2:

  * Added dnstcpbench tool, by popular demand.

  * We always shipped a static tools RPM; we now have a similar Debian package.
    All packages have been cleaned up a bit, and the binary collections are now
    consistent between RPM and Deb. New: pass --enable-tools to configure to
    have the tools included in 'make all' and 'make install'.

  * commit 4d2e3f5: add selinux policy files

  * We would sometimes send a single NULL byte, or nothing at all, instead of
    an OPT record. Fixed in commit bf7f822, commit 063076b, commit 90d361d.

  * commit 2ee9ba2: expand any-to-tcp to direct RRSIG queries

  * commit 5fff084, commit e38ef51: drop no-op flag strict-rfc-axfrs, thanks
    Jelte Jansen.

  * commit f3d8902, commit 7c0b859, commit 5eea730: Implement MINFO qtype for
    better interaction when slaving zones from NSD (that contain MINFO). Thanks
    to Jelte Jansen.

  * commit 8655a42, commit bf79c6a, commit 38c941b: SRV record can have a '.'
    as final field, from which we would dutifully strip the trailing ., leaving
    void, confusing everything. We now remove the trailing . in the right
    place, and not if we are trying to server '.'. Again thanks to Jelte & SIDN
    for catching this.

  * commit 70d5a66: improve error message in ill formed unknown record type,
    thanks Jelte Jansen for reporting.

  * commit 3640473: Built in webserver can now listen on IPv6, fixes ticket 843
    . Also silences some useless messages about timeouts.

  * commit 7db735c, commit d72166c: CHANGES BEHAVIOUR: before we launch, check
    if we can connect to the controlsocket we are about to obliterate. If it
    works, abort. Fixes ticket 841 and changes standing behaviour. There might
    be circumstances where PowerDNS now refuses to start, where it previously
    would. However, starting and making our previous instance mute wasn't good.

  * commit 9130f9e: correctly refuse out-of-zone data in bindbackend, closes
    ticket 845

  * commit 3363ef7: initialise server-id after all parsing is done, instead of
    half way through. Fixes situations where server-id was emptied explicitly.
    Reported by Wouter de Jong

  * commit cd4f253: bump boost requirement, thanks Wouter de Jong

  * commit 58cad74: Update pdns auth init script so it works on wheezy

  * commit 8714c9c: clang fixes by Aki Tuomi, thanks!

  * commit 146601d: stretch supermasters.ip for IPv6, thanks Dennis Krul

  * commit 1a5c5f9: various remotebackend improvements by Aki Tuomi

  * commit 6ab1a11: make sure systemd starts PowerDNS after relevant databases
    have been started, thanks Morten Stevens.

  * commit 606018f, commit ee5e175, commit c76f6f4: check scopeMask of answer
    packet, not of query packet!

  * commit 2b18bcf: Added warning if trailing dot is used, thanks Aki Tuomi.

  * commit 16cf913: make superfluous 'bind' NSEC3 record optional

New features and important changes since 3.2 (these changes are in RC1 and up):

  * commit 04576ee, commit b0e15c8: Implement pdnssec increase-serial, thanks
    Ruben d'Arco.

  * commit cee857b: PowerDNS now sets additional groups while dropping
    privileges.

  * commit 7796a3b: Merge support for include-dir directive, thanks Aki Tuomi!

  * commit d725755: make pdns-static Conflict with pdns-server, closes ticket
    640

  * commit c0d5504: pdnssec now emits 'INSERT INTO domain ..' queries when
    running without named.conf, thanks Ruben d'Arco.

  * commit a1d6b0c: Older versions of the BIND 9 validating recursor need a
    superfluous NSEC3 record on positive wildcard responses. We now send this
    extra NSEC3. Closes ticket 814.

  * commit 07bf35d: catch a lot more errors in pdnssec and report them. Fixes
    ticket 588.

  * commit 032e390: make pdnssec exit with 1 on some error conditions, closes
    ticket 677

  * commit 4af49b8, commit 4cec6ac: add ability to create an 'active' or
    inactive key using add-zone-key and import-zone-key, plus silenced some
    debugging. Fixes ticket 707.

  * commit fae4167: Compiling against Lua 5.2 (--with-lua=lua5.2) now disables
    some code used for regression testing, instead of breaking during compile.
    This means that Lua 5.2 can be used in production.

  * commit abc8f3f, 357f6a7: Implement the new any-to-tcp option that, when
    set, always replies with a truncated response (TC=1) to ANY queries,
    forcing them to use TCP.

  * commit 496073b: Since 3.0, pdnssec secure-zone has always generated 3 keys:
    one KSK and two ZSK, with one ZSK active. For most, if not almost all,
    users, this inactive ZSK is never used. We now no longer generate this
    useless ZSK. The resulting smaller DNSKEY RRset improves interoperability
    with certain validators. Closes ticket 824.

  * commit df55450: Non-DNSSEC ANY queries no longer get sent DNSSEC records.
    This improves interoperability with some old resolvers. Patch by Kees
    Monshouwer.

  * commit 04b4bf6: Merge support for not using opt-out with NSEC3. Many thanks
    to Kees Monshouwer.

  * commit 8db49a6: We now try not to NOTIFY ourselves. In convoluted cases
    involving REUSE_PORT and binding to 0.0.0.0 and ::, it might be possible
    that we guess wrong, in which case you can set prevent-self-notification to
    off.

Important bug fixes:

  * commit 63e365d: don't mess up encoding when copying qname from question to
    answer in packetcache. Based on reports&debugging by Jimmy Bergman
    (sigint), Daniel Norman (Loopia) and the fine people at ISC. This avoids
    most issues related to BIND 9 erroneously blacklisting PowerDNS for lack of
    EDNS support.

  * commit 3526186: fix backslash handling in TXT parser, includes test. Thanks
    Jan-Piet Mens.

  * commit 830281f, aef7330: Accept chars >127 ('high ASCII') in TXT records,
    closing ticket 541 and 723.

  * commit feef1ec: fix missing NSEC3 for secure delegation, thanks Kees
    Monshouwer, closes ticket 682

  * commit b61e407: around Thursday midnight, during signature rollovers, we
    would update the SOA serial too early. Fixed by reverting commit d90efbf,
    adding 7 days margin to inception. Fix by Kees Monshouwer.

  * commit ff64750: make sure mixed-case queries get a correct apex NSEC3 type
    bitmap

  * commit 4b153d8: always lowercase next name in NSEC to avoid interop
    troubles with validators, thanks Marco Davids&Matthijs Mekking.

Other changes:

  * commit 49977c6: fix bug in boost.m4 where it insists on setting -L, causing
    useless RPATH in our binaries. Closes ticket 728

  * commit 62ac758: use PolarSSL for MD5 hashing instead of shipping our own
    copy of md5 hashing code, thanks Aki Tuomi.

  * commit 775acd9: give a better error on trying to add nsec3 parameters to a
    weird zone like "1 0 1 ab" (which indicates that you forgot to specify a
    zone name on the command line). Fixes ticket 800.

  * commit 315dd2e: Simplify socket listening code, and make sure we always set
    the nonblocking flag correctly. Patch by Mark Zealey, closes ticket 664.

  * commit b35da1b: if_ether.h is in netinet/ not net/ on OpenBSD, thanks
    Florian Obser.

  * commit 71301b6: Replicate gsql backend feature of having separate -auth
    queries for DNSSEC into oraclebackend. Also lets you disable dnssec if you
    are not ready for it. Closes ticket 527, patch by Aki Tuomi.

  * commit 2125dac: drop unused ignore-rd-bit flag

  * commit 8c1a6d6: NSECx optimizations, thanks Kees Monshouwer.

  * commit 664716a: drop unused variables in lua backend ( ticket 653)

  * commit d8ec70f: fix db2 backend includes ( ticket 653)

  * commit 6477102: add goracle schema, thanks Aki Tuomi.

  * commit 9118638: make goraclebackend "at least work", closes ticket 729,
    thanks Aki Tuomi.

  * commit e0ad7bb: add DS digest type 4 to show-zone output; add algorithm
    names. Based on a patch by Aki Tuomi, closes ticket 744

  * commit 61a7fac: enable AM_SILENT_RULES, closing ticket 647

  * commit 837f4b4: do a better job at escaping TXT, fixes ticket 795

  * commit 6ca3fa7: add SOA-EDIT INCEPTION-INCREMENT mode, thanks stbuehler

  * commit 6159c49: Add connection info to sql-connect message

  * commit 9f62e34, commit 0fc965f, commit 2035112: Added EUI48 and EUI64
    record types

  * commit f9cf6d9: cut the number of database queries in half for AXFR-in,
    thanks Kees Monshouwer.

  * commit c87f987: add default for SOA contact e-mail

  * commit bb4a573: move random backend to modules, thanks Kees Monshouwer.

  * commit 1071abd: restyle builtin webserver page, thanks Christian
    Hofstaedtler.

  * commit cd5e158: correct bogus use of poll(2) related constants, improving
    non-Linux portability. Thanks Wouter de Jong.

  * commit 27ff60a: make sure our NSEC(3)s for names with spaces in them are
    correct. Reported by Jimmy Bergman. Includes test.

  * commit 116e28a: reduce log level of successful gpgsql/gsqlite3 connection
    to Info

  * commit b23b90a: Metadata update is now in the same transaction as the AXFR.
    This improves slaving speed tremendously, especially for SQLite users.
    Patch by Kees Monshouwer.

  * commit 4620e8a: Added zone2json, thanks Aki Tuomi.

  * commit f0fa8b6: Fix remotebackend setdomainmetadata return value handling.
    Fix by Aki Tuomi, closes ticket 740.

  * commit 80e82d6: log control listener abort even more explicitly.

  * commit 7c0cb15, a718d74: support automake 1.12

  * commit 3fe22eb, 6707cb1: update autoconf/automake preamble to
    non-deprecated variant, thanks Morten Stevens

  * commit 6c4e531: disarm dead code that causes gcc crashes on ARM, thanks
    Morten Stevens.

  * commit 36855b5: if we failed to make a new UDP socket, we'd report a
    confusing error about it.

  * commit 1b8e5e6: autoconf support for oracle, thanks Aki Tuomi. Closes
    ticket 726.

  * commit 8ac0c06: allow setting of some oracle env vars. Patch by Aki Tuomi,
    closes ticket 725.

  * commit 45e845b: add example.rb sample script for remotebackend, thanks Aki
    Tuomi.

  * commit 950bddd: add pdnssec generate-zone-key command, thanks Aki. Closes
    ticket 711.

  * commit 2c03cde: Replace select with waitForData in remotebackend. Patch by
    Aki Tuomi, closes ticket 715.

  * commit 450292c: accept ANY responses during recursive forwarding, thanks
    Jan-Piet Mens.

  * commit d9dd76b: actually clean up unix domain sockets too after use.

  * commit 36758d2: merge ticket 476 by Aki Tuomi, providing default-ksk/
    zsk-algorithms/size configuration parameters for pdnssec.

  * commit 2f2b014: apply variant of code in ticket 714 so we can lauch pipe
    backend scripts with parameters, plus add experimental code that if
    pipe-command is a unix domain socket, we use that.

  * commit 9566683: merge patch from ticket 712 addressing memory leak in
    remotebackend, thanks Aki.

  * commit fb6ed6f: explicitly set domain id during bindbackend superslave
    domain create, thanks Kees Monshouwer&Aki Tuomi.

  * commit 69bae20: use private temp dir when running under systemd, thanks
    Morten Stevens&Ruben Kerkhof.

  * commit b26a48a: fix rapidjson usage in remotebackend, patch by Aki Tuomi.
    Closes ticket 697.

  * commit da8e6ae: also answer questions with : in them.

  * commit ef1c4bf: also spot trailing dots on CNAME content, thanks Jan-Piet
    Mens and Ruben d'Arco.

  * commit fb31631: only setCloseOnExec on valid sockets
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org

iQIcBAEBAgAGBQJR1nd2AAoJENz1E/p+7RnzbQoP/RZKOFyP1SSGBmpdDKfD+PFh
dNL/VvWRHXil63tFoPrvnGhfJhEAVVL5EZ+zc/fjoOMDHCkrN6nk5ReHyPACfQT/
TDnXgRjk2DoO+txCnNy2M85pulWN3xAjtyyAboQzVJwojGNYoAIdUYoKHewSM2Nl
479QUcxkxdzzdCapR81gBLqbOPNq/7ypyA/VTDb7GeBUAolCvpo1VoBEtyiqSQ2j
8EytrQTjU3vCGcFW5BM7cjVBONDCBk64rzyESiYhGnJEYsiRdVeNL6FhmrVu4VEn
+eDb2lpMK1SjXzEDj+YEpn8nb7MCxJLPX2UDY0281tVcLjQgWarKWWoYT5KV2or5
3M44Lxm+w8Ypwjd7X/21EZdTBwmQFoOyKP0QcMCrak+z+6iT3OX9jJG9PICAeGN/
yxPpa8zAepTHNJgHoACCJPcfrqJmq3p+MZEVBoq8RwYtrGWvcNB79Z7WD17HS3Dx
hpkpsYt6qY4zhr3mtd0qVtZ/dgvp5xPosZVGGcuP7ffot4QrkWxV1rAHS1EGk5cE
dvGh17T9fzdiomEyZ65a2QayBd/h+z87OJtJgOWT81iTLDxJJ+B2v7SgDeUgM13o
/+XpAYBdX5o+dX+J/uRULsnlIKY4Gv3HKXPUztVlaNB4dstHFHKxEAdKneZGgQB5
IAqui86rJp/RKtTwwSNh
=woQk
-----END PGP SIGNATURE-----