22e07e3f37
Accepting request 1177076 from server:dns
Ana Guerrero2024-05-28 15:28:33 +00:00
7886287fd9
Accepting request 1176818 from home:AndreasStieger:branches:server:dns
Adam Majer2024-05-27 09:09:53 +00:00
6425823a92
Accepting request 1170013 from server:dns
Ana Guerrero2024-04-25 18:48:36 +00:00
94361cad7d
- update to 5.0.4: * fixes a case when a crafted responses can lead to a denial of service in Recursor if recursive forwarding is configured (bsc#1223262, CVE-2024-25583) - changes in 5.0.3 * Log if a DNSSEC related limit was hit if log_bogus is set * Reduce RPZ memory usage by not keeping the initially loaded RPZs in memory * Fix the zoneToCache regression introduced by 5.0.2 security update
Adam Majer2024-04-24 11:34:43 +00:00
f9c7779d55
Accepting request 1146434 from server:dns
Ana Guerrero2024-02-13 21:42:17 +00:00
90f0f6064c
Accepting request 1146193 from home:adamm:branches:server:dns
Adam Majer2024-02-12 14:04:44 +00:00
769d7d2b5e
Accepting request 1108433 from server:dns
Ana Guerrero2023-09-01 12:21:59 +00:00
62ffb89c44
- update to 4.9.1 * The setting of policy tags for packet cache hist has been fixed. Previously, packet cache hits would not contain policy tags set in the Lua gettags(-ffi) intercept functions. * The retrieval of RPZ zones could fail in situations where a read of the chunk length from the IXFR TCP stream would produce an incomplete result. - enable DSN-over-TLS (DoT) via OpenSSL For complete list of changes, see https://doc.powerdns.com/recursor/changelog/4.9.html#change-4.9.1 For upgrades since 4.8.x and earlier, see https://doc.powerdns.com/recursor/upgrade.htmlAdam Majer2023-08-25 10:44:15 +00:00
ccf3326df5
- update to 4.8.4 * Deterred spoofing attempts can lead to authoritative servers being marked unavailable (bsc#1209897, CVE-2023-26437)
Adam Majer2023-04-04 09:06:40 +00:00
e16c52d075
- update to 4.8.3 * Fix serve-stale logic to not cause intermittent high CPU load by: + correcting the removal of a negative cache entry, + correcting the serve-stale main loop regarding exception handling, + correctly handle negcache entries with serve-state status. - changes in version 4.8.2 * Make cache cleaning of record an negative cache more fair * Do not report “not decreasing socket buf size” as an error * Do not use “message” as key, it has a special meaning to systemd-journal * Add the ‘parse packet from auth’ error message to structured logging * Refresh of negcache stale entry might use wrong qtype * Do not chain ECS enabled queries * Properly encode json string containing binary data
Adam Majer2023-03-07 10:44:23 +00:00
9c40b6e286
- update to 4.8.1 * Avoid unbounded recursion when retrieving DS records from some misconfigured domains. (bsc#1207342, CVE-2023-22617)
Adam Majer2023-01-20 12:45:37 +00:00
4b61020231
- update to 4.7.2 * incomplete exception handling related to protobuf message generation. (CVE-2022-37428)
Adam Majer2022-08-23 21:57:16 +00:00
7bd5d7193e
Accepting request 998876 from home:stroeder:network
Adam Majer2022-08-23 21:55:14 +00:00
7becf97f66
- boost_context.patch: Boost.Context detection fix on SLE12
Adam Majer2022-03-29 09:13:36 +00:00
1c660c301d
Accepting request 965584 from home:adamm:branches:OBS_Maintained:pdns-recursor
Adam Majer2022-03-29 09:12:31 +00:00
e0c775e492
- fix building against sle-12 backports with gcc-9 - remove obsolete BR on protobuf - add bundled information to the spec file
Adam Majer2022-03-28 11:37:28 +00:00
c2d6a441d0
- update to 4.6.1 fixes incomplete validation of incoming IXFR transfer in the Recursor. It applies to setups retrieving one or more RPZ zones from a remote server if the network path to the server is not trusted. (bsc#1197525, CVE-2022-27227)
Adam Majer2022-03-25 13:24:30 +00:00
647174ea16
- update to 4.4.3: Improvements Use a short-lived NSEC3 hashes cache for denial validation. References: #9856, pull request 10221 Bug Fixes More fail-safe handling of Newly Discovered Domain files. Handle policy (if needed) after postresolve. Return current rcode instead of 0 if there are no CNAME records to follow. Lookup DS entries before CNAME entries. Handle failure to start the web server more gracefully. Test that we correctly cap the answer’s TTL in expanded wildcard cases. Fix the gathering of denial proof for wildcard-expanded answers. Make sure we take the right minimum for the packet cache TTL data in the SERVFAIL case. For details see, https://doc.powerdns.com/recursor/changelog/4.4.html#change-4.4.3Adam Majer2021-03-31 09:38:56 +00:00
12a42cdc81
- update to 4.4.2: Improvements * UUID: Use the non-cryptographic variant of the boost::uuid. * Keep a cached, valid entry over a fresher Bogus one. * Ensure socket-dir matches runtime directory on old systemd * Move to several distinct Bogus states, for easier debugging. * Do not chase CNAME during qname minimization step 4. Bug Fixes * Untangle the validation/resolving qnames and qtypes. * APL records: fix endianness problem. For details see, https://doc.powerdns.com/recursor/changelog/4.4.html#change-4.4.2Adam Majer2020-12-14 12:49:14 +00:00
08fab363d7
- update to 4.4.1 * Allow specifying a name in getMetric() that is used for Prometheus * Avoids a CNAME loop detection issue with DNS64 * No longer sends overly long NOD lookups. * If a.b.c CNAME x.a.b.c is encountered, switch off QName Minimization. * Fix the processing of answers generated from gettag.
Adam Majer2020-11-25 15:07:02 +00:00
e870722ff6
- fix default config - turn off chroot by default as it is not supported on systemd enabled systems - set query-local-address to ::,0.0.0.0 to make ipv6 only nameservers work out of the box
Marcus Rueckert2020-10-26 19:04:46 +00:00
5db34830a0
- update to 4.3.5: * fixes cache pollution related to DNSSEC validation. (CVE-2020-25829, bsc#1177383) * now raise an exception on invalid content in unknown records * fixes the parsing of dont-throttle-netmasks in the presence of dont-throttle-names - 9070.patch: upstreamed and removed
Adam Majer2020-10-13 11:36:10 +00:00
e29d8afa33
- update to 4.3.2 * Fixes a access restriction bypass vulnerability where ACL applied to the internal web server via webserver-allow-from is not properly enforced, allowing a remote attacker to send HTTP queries to the internal web server, bypassing the restriction. (CVE-2020-14196, bsc#1173302) * improves CNAME loop detection * Fix the handling of DS queries for the root * Fix RPZ removals when an update has several deltas
Adam Majer2020-07-01 18:44:03 +00:00
28affeaed5
- update to 4.3.1 * fixes an issue where records in the answer section of a NXDOMAIN response lacking an SOA were not properly validated (CVE-2020-12244, bsc#1171553) * fixes an issue where invalid hostname on the server can result in disclosure of invalid memory (CVE-2020-10030, bsc#1171553) * fixes an issue in the DNS protocol has been found that allows malicious parties to use recursive DNS services to attack third party authoritative name servers (CVE-2020-10995, bsc#1171553)
Adam Majer2020-05-19 09:49:25 +00:00
b6b4cec296
- update to 4.3.0: * A relaxed form of QName Minimization as described in rfc7816bis-01. This feature is enabled by default * Dnstap support for outgoing queries to authoritative servers and the corresponding replies. * The recursor now processes a number of requests incoming over a TCP connection simultaneously and will return results (potentially) out-of-order. * Newly Observed Domain (NOD) functionality * For details see https://blog.powerdns.com/2020/03/03/powerdns-recursor-4-3-0-released/Adam Majer2020-03-03 09:51:47 +00:00
9b38d59daf
- update to 4.2.1: * Add deviceName field to protobuf messages * Purge map of failed auths periodically by keeping last changed timestamp. * Prime NS records of root-servers.net parent (.net) * Issue with “zz” abbreviation for IPv6 RPZ triggers * Basic validation of $GENERATE parameters * Fix inverse handler registration logic for SNMP
Adam Majer2019-12-09 09:52:47 +00:00
Arjen de Korte
Adam Majer
Marcus Rueckert
Ana Guerrero
Dominique Leuenberger
Richard Brown
Richard Brown
Marguerite Su