2025.1 Series Release Notes

20.0.2-1

Security Issues

  • Fixed a TXT and SPF recordset validation gap that allowed a value containing an unescaped literal newline character to be accepted and persisted, and NAPTR and CERT validation gaps that allowed a trailing newline in the NAPTR flags, service, or regexp fields, or in a numeric CERT cert_type or cert_algo field, through due to regular expressions anchored with a trailing $, which (without re.MULTILINE) matches immediately before a trailing newline rather than strictly at the end of the string. A CERT certificate field could separately carry a literal newline through unrejected, since base64 decoding ignores embedded newlines. In all cases the persisted value later failed to parse when designate-mdns rendered an AXFR response for the zone, which aborted the entire zone transfer to the backend nameserver. Because any project with recordset-create permission on a zone (including a project a PRIMARY zone has been shared with) could create such a value, this allowed one project’s malformed recordset to block publication of every other recordset in the same zone, including recordsets belonging to other projects.

    TXT and SPF record values, and CERT certificate values, are now rejected at validation time if they contain a literal newline character, and NAPTR’s flags, service, and regexp fields and CERT’s cert_type and cert_algo fields are now anchored with \Z so a trailing newline is correctly rejected. As defense in depth, designate-mdns now logs and skips any individual recordset that still fails to parse, both while rendering an AXFR response and while answering a direct record query, instead of aborting the whole zone transfer or leaving the query unanswered — including recordsets in system-generated catalog zones.

    See bug 2162105 for more information.

20.0.2

Bug Fixes

  • Fixed mDNS _handle_record_query to use TSIG-based pool scoping when looking up SOA and other record queries. Previously, when the same zone name existed in multiple pools (e.g. split-horizon DNS), the handler would find multiple matching recordsets and return REFUSED. The handler now resolves the zone first using the TSIG key’s pool_id, then looks up the recordset within that zone.

Other Notes

  • [bug 2008693] Added validation to require TSIG keys for zones in non-default pools. When backend nameservers request zone transfers from MDNS without TSIG authentication, MDNS defaults to searching only in the default pool, causing zones in other pools to fail with “ZoneNotFound” errors. The new validation prevents this by rejecting zone creation and pool moves to non-default pools when no TSIG key with scope=POOL exists for that pool. Documentation has been added explaining how to properly configure TSIG keys for multi-pool deployments.

20.0.1

Bug Fixes

  • Zone export now validates the api_export_size quota synchronously before accepting the async export job. Previously, users would receive a 202 Accepted response, then discover the quota violation only after polling the export status, which showed an ERROR state. With this fix, users receive an immediate 413 Request Entity Too Large error when attempting to export a zone that exceeds the quota limit.

    This provides better user experience by giving immediate feedback and prevents wasted resources on doomed async jobs. The implementation uses the same quota validation pattern already employed by zone and recordset creation operations.

    See bug 1960495 for more information.

  • Fixed collection links for floating IP API endpoint returning a next key pointing to itself when the exact amount of floating IPs in a project was the same as config default_limit_v2 that would cause some clients to enter an endless loop.

    See bug #2106112.

  • Fixed a bug that didn’t allow zones to be moved from non-default pools to default pools.

Other Notes

  • Added a “designate-api-wsgi” script for backward compatibility now that pbr’s wsgi_scripts no longer functions with the latest setuptools.

20.0.0

New Features

  • The new [service:mdns] tcp_keepidle option has been added. This option allows customizing TCP keepidle set for socket used by designate-mdns.

Upgrade Notes

  • The following deprecated options in the network_api:neutron section have been removed.

    • admin_username

    • admin_password

    • admin_tenant_name

    • auth_url

    • auth_strategy

  • Support for Python 3.8 has been removed. Now the minimum python version supported is 3.9 .

Bug Fixes

  • Fixed the ignored [DEFAULT] backlog option.

  • Refresh secondary zone task was broken. It failed all the time. If MDNS didn’t get NOTIFY from master server, the secondary zone didn’t get updates. Now it’s fixed.

Other Notes

  • Add multiple pools guidance docs to Admin, User, and CLI docs.