pi-hole/FTL v6.9

on GitHub

Security

This release fixes the following security advisories (credit to the reporters named):

High

• GHSA-pj9m-9623-2g75 (CVSS 7.2): a quote in files.gravity or files.database ended the SQL string in the Teleporter ATTACH statements, and together with Core's gravity.sh led to command execution by an admin. The path is now bound to a prepared statement. Reported by @Pedromdsn. Requires Core v6.6.

Low

• GHSA-x6xh-vxcm-g8rm (CVSS 3.8): app sessions without webserver.api.app_sudo and CLI sessions could list every API session and end any of them. Reported by @gudangkantong.
• GHSA-87wp-wm3p-8cxm (CVSS 3.7): IPv4 entries in webserver.acl never matched IPv4 clients on a dual-stack webserver.port such as +80. Reported by @010011110.
• GHSA-cg4p-5r3r-m54p (CVSS 3.1): a password change through pihole-FTL --config (and so pihole setpassword) could be undone by an API config write at the same time, keeping the old password and its sessions valid. Reported by @010011110.
• GHSA-fj2f-pgf2-j888 (CVSS 2.2): queries recorded at misc.privacylevel 3 could reach the long-term database once the level was lowered. Reported by @010011110.
• GHSA-9mh9-95wj-4w4q (CVSS 2.2): crash when the metrics were read while a hosts file reload freed the dnsmasq cache. Needs a valid session. Reported by @010011110.
• GHSA-9hh4-j8jf-6c96 (CVSS 2.2): use-after-free when a v5 Teleporter import ran while the API read the config. Needs a valid session. Reported by @010011110.

What's Changed

This release backports the fixes that landed on development since v6.8 and updates the embedded dnsmasq (v2.93+42), SQLite (v3.54.1) and the bundled TRE regex engine (current upstream master), again without the v7 work. The TRE update changes how some stored regex filters match, so this is a minor release rather than v6.8.1.

The dnsmasq update carries one change that is not upstream yet, the blockdata_alloc() fix from #3305, which is pending on dnsmasq-discuss.

Improvements

• Regex matching is faster (#3315).
• gravity.db is only opened again when it changed on disk. This was most of FTL's CPU time while idle (#3323).
• Partial domain searches also find ABP-style list entries.
• With DNSSEC, dnsmasq keeps extra TCP slots for its own validation queries, so validation still works when clients use up the TCP connection limit.
• Control characters in logged configuration values are escaped (#3325).
• Bash completion for pihole-FTL --config -t and -q (#3339).
• .diskused works in pihole-FTL sqlite3.
• Quad9's unfiltered upstream is labelled as validating DNSSEC.

Notable fixes

• DNSSEC, via dnsmasq: a heap out-of-bounds read in zone_status(), SERVFAIL for deeper wildcard answers (#3161) and lost pipelined TCP answers (#3167).
• Via dnsmasq: a heap out-of-bounds write in blockdata_read(), a DNS name buffer overflow and an off-by-one in the DHCPv6 FQDN option.
• Via dnsmasq: a TFTP caching error, an empty CNAME alias from a space before a comma, and a failed realloc in poll_listen().
• Two config changes through the API at the same time could lose one of them (#3184).
• A PATCH of webserver.api.excludeDomains or excludeClients could free the array under a running Query Log or top list request (#3244).
• A TCP worker forked during a config write kept pihole.toml.lock held for up to 300 s, and every config write waited for it.
• The webserver could spin at 100% CPU and stop accepting connections when two listening sockets became ready at once (#2959, #3301).
• Via CivetWeb: a HEAD request to a Lua page or the error page got the body, a Teleporter upload with a space in its file name was refused, and an unsatisfiable Range got a 206 instead of a 416 (#3340).
• A crashed thread could leave FTL hanging instead of exiting, and webserver threads used the non-reentrant getpwuid()/getgrgid() (#3029).
• /api/info/system reported the host's load inside containers (#3267).
• FTLCONF_ variables were ignored when FTL started without pihole.toml.
• A second pihole-FTL rewrote the config before noticing that FTL was already running.
• Without a password, a link to the dashboard from another site was answered with 403.
• Queries of DNS type 0 stored by FTL v5 were skipped on import.
• misc.hide_dnsmasq_warn and misc.hide_connection_error did not hide the warnings from FTL.log (#3003).
• A malformed password hash in pihole.toml leaked memory on every login attempt, and an app-password login counted twice against the rate limit (#3334).
• pihole -g started through the API inherited FTL's sockets and stopped when the client stopped reading (#3335).
• A client whose slot was reused during its name lookup got the old client's name (#3328).
• An RTC whose time could not be read was never set (#3332).
• pihole-FTL --config -t required a writable config (#3338), and two misleading log lines on a first start without pihole.toml (#3324).
• The reply to a duplicate query was logged as unknown, a shared-memory resize race, pihole-FTL wait-for missing lines, and undefined behaviour in the addinfo cache.

Behaviour changes to be aware of

• Regex filters: an omitted lower bound ({,n}, {,}) now means {0,n} and {0,}. More than three nested approximate-matching groups are rejected, and so is a back-reference inside an unbounded repetition.
• webserver.acl: IPv4 entries now match IPv4 clients on every port, including dual-stack ones. IPv6 entries other than ::ffff:a.b.c.d only match IPv6 clients, so [::]/0 no longer admits IPv4 clients anywhere.
• App sessions without webserver.api.app_sudo and CLI sessions get a 403 from GET /api/auth/sessions and DELETE /api/auth/session/{id}. A session can still end itself with DELETE /api/auth.
• A password set with pihole setpassword or pihole-FTL --config while FTL is running is no longer overwritten by the next config change made through the web interface.
• dns.cnameRecords entries whose names are not valid domains, or whose TTL does not fit into an int, are rejected (#3256).
• A request with more than 64 headers is refused instead of losing the rest of them (#3340).
• /api/info/system answers with an error instead of zeros when the load averages cannot be read.
• DELETE /api/dhcp/leases/{ip} answers 503 instead of 400 when the resolver did not get to it in time (#3333).
• With misc.readOnly, a missing pihole.toml is still written.

Full Changelog: v6.8...v6.9