pi-hole/FTL v6.8

Pi-hole FTL v6.8

on GitHub

Security

This release fixes the following security advisories (credit to the reporters named):

High

• GHSA-2h7g-g549-hf74 (CVSS 7.7): document root could be relocated via a Teleporter import or symlink. Reported by @abdoghazy2015 and @Jgarcg40.

Medium

• GHSA-667h-gpmh-7gxc (CVSS 6.5): contents of local files echoed when parsing a file:// adlist. Reported by @Rakan78. Requires Core v6.5.
• GHSA-v53r-4564-3449 (CVSS 6.5, duplicate GHSA-846w-3j3v-2hx8): read-only app sessions could read password hashes and the TOTP secret. Reported by @Pedromdsn and @010011110.
• GHSA-8fc6-q9x4-892v (CVSS 5.9): out-of-bounds write in the API TXT buffer. Reported by @dagadjno.
• GHSA-xj4x-gf2g-r6m7 (CVSS 4.2): EDNS(0) data leaking between clients' queries. Reported by @010011110.

Low

• GHSA-322h-f873-hp54: cross-site requests and DNS rebinding against a passwordless install. Reported by @ChrisLundquist.
• GHSA-mqr7-j2p5-5495 (CVSS 2.7): crash on a malformed POSTed regex array. Reported by @010011110.
• GHSA-v8mj-cqgw-63rj (CVSS 2.2): race when deleting a DHCP lease. Reported by @010011110.
• GHSA-9828-2f2q-2c8v (CVSS 2.2): crash when searching domains during a list reload. Reported by @010011110.

What's Changed

This is a minor release rather than v6.7.2: there are enough visible behaviour changes that a patch version would undersell it. It backports the bug fixes that landed on development since v6.7.1 and updates the embedded dnsmasq (v2.93+30) and SQLite (v3.53.3).

Improvements

• The live log is now stored as a ring buffer instead of moving the whole buffer for every new line, which costs far less CPU per cached answer.
• Internationalised domain names on lists are converted to punycode with libidn2 and block, instead of being rejected as invalid.
• Long-term statistics are grouped before joining the name tables (faster), and two unused in-memory indexes are gone, saving about 22 MB per million queries.

Notable fixes

• Flushing the logs deleted the whole long-term history, not only the last 24 hours, and moved the graph a day into the future.
• Crashes with 257+ alias-clients, with a no-longer-forced FTLCONF_ array, and with database.DBinterval = 0.
• Group and list changes not reaching a client until the next reload, stale forced replies, and missing EDE on the first block.
• A file path containing + (or any other printable ASCII) was reset to its default on start-up.
• An open redirect in the .lp compatibility redirect, and / ignoring webserver.serve_all.
• Pi-hole's own certificate for a custom webserver.domain was never renewed, and a domain longer than 64 characters ended up as an oversized CN.
• The empty-DS DNSSEC loop, via dnsmasq, plus its double-free and information disclosure fixes.
• An API session could enable misc.readOnly through a Teleporter archive, and pihole.toml.lock failed on NFS.
• Any LAN client could make FTL add a new PTR record for every spelling of its own address until a restart.
• The CLI password file and pihole-tmp.db were briefly or permanently readable by everyone.
• On ARM and RISC-V the MAC address of a new device was never looked up at query time, so its MAC-based groups only applied later.
• Raising misc.privacylevel at runtime did not cover domains and clients already seen, and an ntp.sync.interval above about 24.8 days made the NTP client sync back to back.
• DNS stalls on list reloads and rate limiting, GC double processing, lost queries at shutdown, and wrong long-term statistics.
• Old queries were never deleted from pihole-FTL.db on a host that restarts FTL at least once a day.
• dhcp-discover printed the DNSSL labels of Router Advertisements unescaped.
• Clients without a MAC address (e.g. a WireGuard peer) stayed in the default group until the next list reload, because the groups of a new client were resolved before its interface was known.
• The load check counted only the CPUs a container was limited to, while /proc/loadavg shows the host's load, so the long-term load warning fired spuriously and /api/info/system inflated the load percentage in LXC/Docker with fewer cores. FTL now counts all present host CPUs.
• FTLCONF_files_log_ftl was not used for log lines on early startup.

Behaviour changes to be aware of

• Invalid values found in pihole.toml are rejected and reset to the default: database.DBinterval of 0, a webserver.tls.cert below the webroot, a non-base32 webserver.api.totp_secret, relative paths for files FTL writes, and a files.tmp_db that names another file Pi-hole keeps (e.g. pihole-FTL.db). A webserver.api.maxHistory above 86400 is reduced to 86400. A list (e.g. dns.hosts) now loses only its invalid entries instead of being reset as a whole.
• With webserver.serve_all = false, / under a host other than webserver.domain now returns a 404, so a custom index.html in the webroot no longer shows up at http://<ip>/. Behind a proxy that does not strip webserver.paths.prefix, the prefixed path returns a 404 as well.
• A renewed self-signed certificate comes with a new CA, so an imported tls_ca.crt has to be imported again.
• FTL no longer hands a symbolic link (e.g. pihole-FTL.db or FTL.log linked to another disk) to the pihole user, and warns about it on every start. Such a target has to be owned by pihole already.
• When FTL runs as root it only changes ownership or permissions of regular files directly in /etc/pihole and /var/log/pihole, and refuses a symbolic link as log file (including files.log.dnsmasq). Started as pihole, a linked log file keeps working.
• A blocking timer on an unchanged status now switches to the opposite mode when it expires.
• The host's own interfaces show up in the network table, and shutdown may wait up to 30 seconds for a busy database thread.
• dnsmasq adds the option4: syntax and DHCPv6 vendor classes.
• Changing ntp.sync.interval restarts FTL, ntp.sync.count = 0 is rejected, and POST /api/action/gravity answers 409 while a run is in progress.
• Queries older than database.maxDBdays are deleted in the first night after a start, 10000 at a time. A database that kept growing will lose its whole backlog in the first night after the update.
• A v5 Teleporter import replaces the upstreams, reverse servers and excluded domains/clients instead of adding to them.

Full Changelog: v6.7.1...v6.8