summaryrefslogtreecommitdiff
path: root/net/knot
AgeCommit message (Collapse)AuthorFilesLines
2022-10-26*: bump PKGREVISION for libunistring shlib major bumpwiz1-2/+2
2022-06-30*: Revbump packages that use Python at runtime without a PKGNAME prefixnia1-1/+2
2022-06-16knot: Update to 3.1.8ryoon2-6/+6
Changelog: Version 3.1.8 Thursday, April 28, 2022 Features: + knotd: optional automatic ACL for XFR and NOTIFY (see 'remote.automatic-acl') + knotd: new soft zone semantic check mode for allowing defective zone loading + knotc: added zone transfer freeze state to the zone status output Improvements: + knotd: added configuration check for serial policy of generated catalogs Bugfixes: + knotd/libknot: the server can crash when validating a malformed TSIG record + knotd: outgoing zone transfer freeze not preserved during server reload + knotd: catalog UPDATE not processed if previous UPDATE processing not finished #790 + knotd: zone refresh not started if planned during server reload + knotd: generated catalogs can be queried over UDP + knotd/utils: failed to open LMDB database if too many stale slots occupy the lock table Version 3.1.7 Wednesday, March 30, 2022 Features: + knotd: new configuration items for restricting minimum and maximum zone expire and retry intervals (see 'zone.expire-min-interval', 'zone.expire-max-interval', 'zone.retry-min-interval', 'zone.retry-max-interval') #785 + knotc: added catalog information to zone status Improvements: + knotd: better warning message if SOA serial comparison failed when loading from zone file + knotc: zone status shows all zone events when frozen + keymgr: better error message is returned when importing SKR with insufficient permissions + kdig: transfer status is also printed if failed Bugfixes: + knotd: incomplete implementation of the Offline KSK mode in the IXFR and DDNS processing + knotd: catalog zone accepts duplicate members via UPDATE #786 + knotd: server crashes if catalog database contains orphaned member zones + knotd: old journal is scraped when restoring just the zone file + knotd: some planned zone events can be lost during server reload + knotd: frozen zone gets thawed during server reload + knsupdate: missing section names in the show output + knsupdate: inappropriate log message if called from a script Version 3.1.6 Tuesday, February 8, 2022 Features: + knotd: optional D-Bus notifications for significant server and zone events (see 'server.dbus-event') + knotd: new submission configuration option for delayed KSK post-activation (see 'submission.parent-delay') + knotc: new commands for outgoing XFR freeze (see 'zone-xfr-freeze' and 'zone-xfr-thaw') + kzonesign: added multithreaded DNSSEC validation mode (see '--verify') Improvements: + kdig: trailing data in reply packet is accepted with a warning + kdig: XFR responses are checked if SOA owners match + knotd: failed remote operations are logged as info instead of debug + knsec3hash: added alternative and more natural parameter semantics + knsupdate: interactive mode is newly based on library Editline + Dockerfile: added UID argument to facilitate the use of unprivileged container #783 + doc: various fixes and improvements Bugfixes: + libknot: inaccurate KNOT_DNAME_TXT_MAXLEN constant value #781 + knotd: propagation delay not considered before DS push + knotd: excessive refresh retry delay when a few early attemps fail + knotd: duplicate KSK submission log message during a KSK rollover + kdig: dname letter case not preserved in XFR and Dnstap outputs + mod-cookies: missing server cookie in responses over TCP Version 3.1.5 Monday, December 20, 2021 Features: + knotd: optional outgoing TCP connection pool for faster communication with remotes (see 'server.remote-pool-limit' and 'server.remote-pool-timeout') + knotd: optional unreachable remote tracking to avoid zone events clogging (see 'server.remote-retry-delay') + knotd: new ZONEMD generation mode for the record removal from the zone apex #760 (see 'zone.zonemd-generate: remove') + mod-dnsproxy: new source address match option (see 'mod-dnsproxy.address') + scripts/probe_dump: simple mod-probe client Improvements: + knotd: DS push sets DS TTL equal to DNSKEY TTL + knotd: extended zone purge error logging + knotd: zone file parsing error message was extended by the file name + knotd: improved debug log message when TCP timeout is reached + knotd: new configuration check for using the default number of NSEC3 iterations + knotd: new configuration check for insufficient RRSIG refresh time + mod-geoip: configuration check newly verifies the module configuration file #778 + kdig: option +notimeout or +timeout=0 is interpreted as infinity + kdig: option +noretry is interpreted as zero retries + python/probe: more detailed default output format + doc: many spelling fixes (Thanks to Josh Soref) + doc: various fixes and improvements Bugfixes: + knotd: imperfect TCP connection closing in the XDP mode + knotd: TCP reset packets are wrongly checked for ackno in the XDP mode + knotd: only first zone name is logged for multi-zone control operations #776 + knotd: minor memory leak when full zone update fails to write to journal + knotc: configuration check doesn't check a configuration database + mod-dnstap: incorrect QNAME case restore in some corner cases (Thanks to Robert Edmonds) #777
2021-12-17knot: Update to 3.1.4ryoon2-7/+6
Changelog: Version 3.1.4 Features: + mod-dnstap: added 'responses-with-queries' configuration option (Thanks to Robert Edmonds) Improvements: + knotd: DNSSEC keys are logged in sorted order by timestamp + mod-cookies: added statistics counter for dropped queries due to the slip limit + mod-dnstap: restored the original query QNAME case #773 (Thanks to Robert Edmonds) + configure: improved compatibility of some scripts on macOS and BSDs + doc: updates on DNSSEC signing Bugfixes: + knotd: server can crash when receiving queries with NSID EDNS flag #774 (Thanks to Romain Labolle) + knotd: server crashes on reload when no interfaces configured #770 + knotd: ZONEMD without DNSSEC not handled correctly + knotd: generated catalog zone not updated on config reload #772 + knotd: zone catalog not verified before its interpretation + knotd: ds-push fails to update the parent zone if a CNAME exists for a non-terminal node Version 3.1.3 Monday, October 18, 2021 Improvements: + knotd: added simple error logging to orphaned zone purge + knotd: allow manual public-only keys for unused algorithm + kdig: send ALPN when using DoT or XoT #769 + doc: various fixes and improvements #767 Bugfixes: + knotd: catalog backup doesn't preserve version of the catalog implementation + knotd: NOTIFY is scheduled even when DNSSEC signing is up-to-date + knotd: server can crash when zone difference is inconsistent upon cold start + knotd: zone not bootstrapped when zone file load failed due to an error + knotd: broken AXFR with knot as slave and dnsmasq as master (Thanks to Daniel Gr?ber) + knotd: journal not able to free up space when zone-in-journal present and zonefile written + mod-stats: missing protocol counters for TCP over XDP + kzonesign: input zone name not lower-cased Version 3.1.2 Features: + knotd: new policy configuration for postponing complete deletion of previous keys + keymgr: new optional pretty mode (-b) of listing keys + kdig: added support for TCP keepopen #503 Improvements: + knotd: configuration item values can contain UTF-8 characters + knotd: added configuration check for database storage writability + knotd: better error reporting if zone is empty + knotd: smaller journal database chunks in order to mitigate LMDB fragmentation + knotd/kxdpgun: CAP_SYS_RESOURCE capability no longer needed for XDP on Linux >= 5.11 Bugfixes: + knotd: incomplete NSEC3 proof in response to opt-outed empty non-terminal + knotd: wrong SOA serial handling when enabling signing on already existing secondary zone + knotd: defective ZONEMD verification error reporting when loading zone #759 + knotd: server can crash when reloading catalog zone #761 + knotd: DNSSEC validation doesn't work when only NSEC3 chain changes + knotd: DNSSEC validation doesn't check if empty non-terminal over non-opt-outed delegation isn't opt-outed too + knotd: ZONEMD generation doesn't cause flushing zone to disk #758 + knotd: incorrect evaluation of ACL deny rule in combination with TSIG + knotd: failed DS-check is replaned even if no key is ready + kdig: abort when query times out #763 + libzscanner: missing output overflow check in the SVCB parsing Compatibility: + keymgr: parameter -d is marked deprecated in favor of new parameter -D + kjournalprint: parameter -n is marked deprecated in favor of new parameter -x Version 3.1.1 Improvements: + keymgr: import-bind sets publish and active timers to now if missing timers #747 + mod-rrl: added QNAME, which triggered an action, to log messages #757 + systemd: added environment variable for setting maximum configuration DB size Bugfixes: + knotd: adding RRSIGs to a signed zone can lead to redundant RRSIGs for some NSEC(3)s + knotd: code not compiled correctly for ARM on Fedora >= 33 + knotd: server can crash when opening catalog DB on startup + knotd: incorrect catalog update counts in logs + knotd: journal discontinuity and zone-in-journal result in incorrectly calculated journal occupation + kdig: +noall does not filter out AUTHORITY comment #749 + tests: journal unit test not passing if memory page size is different from 4096 Reverts: + libzscanner: reverted "omitted TTL value is correctly set to the last explicitly stated value (RFC 1035)" #751
2021-12-08revbump for icu and libffiadam1-2/+2
2021-10-26net: Replace RMD160 checksums with BLAKE2s checksumsnia1-2/+2
All checksums have been double-checked against existing RMD160 and SHA512 hashes Not committed (merge conflicts...): net/radsecproxy/distinfo The following distfiles could not be fetched (fetched conditionally?): ./net/citrix_ica/distinfo citrix_ica-10.6.115659/en.linuxx86.tar.gz ./net/djbdns/distinfo dnscache-1.05-multiple-ip.patch ./net/djbdns/distinfo djbdns-1.05-test28.diff.xz ./net/djbdns/distinfo djbdns-1.05-ignoreip2.patch ./net/djbdns/distinfo djbdns-1.05-multiip.diff ./net/djbdns/distinfo djbdns-cachestats.patch
2021-10-07net: Remove SHA1 hashes for distfilesnia1-2/+1
2021-09-29revbump for boost-libsadam1-1/+2
2021-08-07knot: Update to 3.1.0ryoon4-33/+14
Changelog: Version 3.1.0 Monday, August 2, 2021 Features: + knotd: automatic zone catalog generation based on actual configuration + knotd: zone catalog supports configuration groups + knotd: support for ZONEMD validation and generation + knotd: basic support for TCP over XDP processing + knotd: configuration option for enabling IP route check in the XDP mode + knotd: support for epoll (Linux) and kqueue (*BSD, macOS) socket polling + knotd: extended EDNS error (EDE) is added to the response if appropriate + knotd: DNSSEC operation with extra ready public-only KSK is newly allowed + knotd: new zone backup/restore filters for more variable component specification + knotd: adaptive systemd service start timeout and new zone loading status #733 + knotd: configuration option for enabling TCP Fast Open on outbound communication + knotd: when the server starts, zone NOTIFY is send only if not sent already + knotc: zone reload with the force flag triggers reload of the zone and its modules + libs: support for parsing and dumping SVCB and HTTPS resource records + kdig: support for TCP Fast Open along with DoT/DoH #549 + kxdpgun: basic support for DNS over TCP processing + kxdpgun: current traffic statistics can be printed using a USR1 signal + python: new libknot/probe API wrapper Improvements: + knotd: PID file is created even in the foreground mode + knotd: more robust and enhanced zone data backup and restore operations + knotd: maximum length of an XFR message is limited to 16 KiB for better compression + knotd: maximum CNAME/DNAME chain depth per reply was decreased from 20 to 5 + knotd: improved performance of processing domain names with many short labels + knotd: adaptive limit on the number of LMDB readers to avoid problems with many workers + knotd: TTL of generated NSEC(3) records is set to min(SOA TTL, SOA minimum) + knotd: TTL of generated NSEC3PARAM is equal to TTL of NSEC3 records + knotd: maximum TCP segment size is restricted to 1220 octets on Linux # 468 + knotc: various improvements in error reporting + knotc: default control timeout is infinity in the blocking mode + dnssec: dnskey generator tries to return a key with a unique keytag + kxdpgun: RLIMIT_MEMLOCK is increased only if not high enough + kxdpgun: RTNETLINK is used for getting network information instead of the ip command Bugfixes: + knotd: DNAME not applied more than once to resolve the query #714 + knotd: root zone not correctly purged from the journal + kzonecheck: incorrect check for opt-outed empty non-terminal nodes + libzscanner: wrong error line number + libzscanner: broken multiline rdata processing if an error occurs + mod-geoip: NXDOMAIN is responded instead of NODATA #745 + make: build fails with undefined references if building using slibtool #722 Packaging: + knotd: systemd service reload uses 'kill -HUP' instead of 'knotc reload' + kxdpgun: new library dependency libmnl + mod-dnstap: new package separate from the knot package + mod-geoip: new package separate from the knot package Compatibility: + configure: option '--enable-xdp=yes' means use an external libbpf if available or use the embedded one + libzsanner: omitted TTL value is correctly set to the last explicitly stated value (RFC 1035) + knotc: zone restore from an old backup (3.0.x) requires forced operation + knotd: configuration option 'server.listen-xdp' is replaced with 'xdp.listen' + knotd: zone file loading with automatic SOA serial incrementation newly requires having full zone in the journal + knotd: obsolete configuration options 'zone.disable-any', 'server.tcp-handshake-timeout' are silently ignored + knotd: obsolete configuration options 'zone.max-zone-size', 'zone.max-journal-depth', 'zone.max-journal-usage', 'zone.max-refresh-interval', 'zone.min-refresh-interval' 'server.max-ipv4-udp-payload', 'server.max-ipv6-udp-payload', 'server.max-udp-payload', 'server.tcp-reply-timeout', 'server.max-tcp-clients' are ignored + knotd: obsolete default template options 'template.journal-db', 'template.kasp-db', 'template.timer-db', 'template.max-journal-db-size', 'template.journal-db-mode', 'template.max-timer-db-size', 'template.max-kasp-db-size' are ignored Version 3.0.8 Friday, July 16, 2021 Features: + knotc: new command for loading DNSSEC keys without dropping all RRSIGs when re-signing + knotd: new policy configuration option for disabling some DNSSEC safety features #741 + mod-geoip: new dnssec and policy configuration options Bugfixes: + knotd: early KSK removal during a KSK rollover if automatic KSK submission check is enabled and DNSKEY TTL is lower than the corresponding DS TTL + knotd: failed to generate a new DNSKEY if previously generated shared key not available + knotd: periodical error logging when a PKCS #11 keystore failed to initialize #742 + knotd: zone commit doesn't check for missing SOA record Version 3.0.7 Wednesday, June 16, 2021 Features: + knotd: new configuration policy option for CDS digest algorithm setting #738 + keymgr: new command for primary SOA serial manipulation in on-secondary signing mode Improvements: + knotd: improved algorithm rollover to shorten the last step of old RRSIG publication Bugfixes: + knotd: zone is flushed upon server start, despite DNSSEC signing is up-to-date + knotd: wildcard nonexistence is proved on empty-non-terminal query + knotd: redundant wildcard proof for non-authoritative data in a reply + knotd: missing wildcard proofs in a wildcard-cname loop reply + knotd: incorrectly synthesized CNAME owner from a wildcard record #715 + knotd: zone-in-journal changeset ignores journal-max-usage limit #736 + knotd: incorrect processing of zone-in-journal changeset with SOA serial 0 + knotd: broken initialization of processing workers if SO_REUSEPORT(_LB) not available + kjournalprint: reported journal usage is incorrect #736 + keymgr: cannot parse algorithm name ed448 #739 + keymgr: default key size not set properly + kdig: failed to process huge DoH responses + libknot/probe: some corner-case bugs Version 3.0.6 Wednesday, May 12, 2021 Features: + mod-probe: new module for simple traffic logging (Python API not yet included) Improvements: + keymgr: new mode for listing zones with at least one key stored + keymgr: the pregenerate command accepts optional timestamp-from parameter + kzonecheck: accept '-' as substitution for standard input #727 + knotd: print an error when unable to change owner of a logging file + knotd: new warning log if no interface is configured + knotd: new signing policy check for NSEC3 iterations higher than 20 + knotd: don't allow backup to/restore from the DB storage directory + Various code (mostly zone backup/restore), tests, and documentation improvements Bugfixes: + knotd: secondary fails to load zone file if HTTPS or SVCB record is present #725 + knotd: (KSK roll-over) new KSK is not signing DNSKEY long enough before DS submission + knotd: (KSK roll-over) old KSK uselessly published after roll-over finished + knotd: malformed address in TCP-related logs when listening on a UNIX socket + knotd: server responds FORMERR instead of BADTIME if TSIG signed time is zero #730 + modules: incorrect local and remote addresses in the XDP mode + modules: failed to read configuration from a section without identifiers + mod-synthrecord: queries on synthesized empty-non-terminals not answered with NODATA + keymgr: confusing error if del-all-old command fails
2021-05-14knot: needs editlinenia1-3/+4
2021-04-21revbump for boost-libsadam1-1/+2
2021-02-27knot: Update to 3.0.4ryoon2-7/+7
Changelog: Improvements: Sockets to CPUs binding is no longer enabled by default but can be enabled via new configuration option 'server.socket-affinity' Some documentation improvements Bugfixes: DNS queries without EDNS to the root zone apex are dropped in the XDP mode Deterministic ECDSA signing leaks memory Zone not stored to journal if zonefile-load isn't ZONEFILE_LOAD_WHOLE Server crashes if the catalog zone isn't configured for registered member zones Server crashes when loading conflicting catalog member zones CNAME and DNAME records below delegation are not ignored #713 Not all udp/tcp workers are used if the number of NIC queues is lower than the number of udp/tcp workers Failed to load statistics and geoip modules if built as shared
2021-01-06knot: Update to 3.0.3ryoon2-8/+7
Changelog: Version 3.0.3 Features: + Kjournalprint can display changesets starting from specific SOA serial Improvements: + New configuration check on ambiguous 'storage' specification #706 + New configuration check on problematic 'zonefile-load' with 'journal-contents' combination + Server logs positive ACL check in debug severity level (Thanks to Andreas Schrägle) + More verbose logging of failed zone backup + Extended documentation for catalog zones Bugfixes: + On-slave signing produces broken NSEC(3) chain if glue node becomes (un-)orphaned #705 + Server responds CNAME query with NXDOMAIN for CNAME synthesized from DNAME + Kdig crashes if source address and dnstap logging are specified together #702 + Knotc fails to display error returned from zone freeze or zone thaw + Dynamically reconfigured zone isn't loaded upon configuration commit + Keymgr is unable to import BIND-style private key if it contains empty lines + Zone backup fails to backup keys if any of them is public-only + Failed to build with XDP support on Debian testing Version 3.0.2 Features: + kdig prints Extended DNS Error (Gift for Marek Vavruša) + kxdpgun allows source IP address/subnet specification Improvements: + Server doesn't start if any of listen addresses fails to bind + knotc no longer stores empty and adjacent identical commands to interactive history + Depth of interactive history of knotc was increased to 1000 commands + keymgr prints error messages to stderr instead of stdout + keymgr checks for proper offline-ksk configuration before processing KSR or SKR + keymgr imports Revoked timer from BIND keys + Additional XDP support detection in server + Lots of spelling and grammar fixes in documentation (Thanks to Paul Dee) + Some documentation improvements Bugfixes: + If more masters configured, zone retransfer triggers AXFR from all masters + Server can fail to bind address during restart due to missing SO_REUSEADDR + KSK imported from BIND doesn't roll over automatically + libdnssec respects local GnuTLS policy — affects DNSSEC operations and Knot Resolver + kdig can stuck in infinite loop when solving BADCOOKIE responses + Zone names received over control interface are not lower-cased + Zone attributes not secured with multi-threaded changes + kzonecheck ignores forced dnssec checks if zone not signed + kzonecheck fails on case-sensitivity of owner names in NSEC records # 699 + kdig fails to establish TLS connection #700 + Server responds NOTIMPL to queries with QDCOUNT 0 and known OPCODE
2020-12-04Revbump packages with a runtime Python dep but no version prefix.nia1-1/+2
For the Python 3.8 default switch.
2020-10-25knot: Update to 3.0.1ryoon2-7/+7
Changelog: 3.0.1 Features: New command in keymgr for validation of RRSIGs in SKR Keymgr validates RRSIGs in SKR during import New option in kzonecheck to skip DNSSEC-related checks Improvements: Module noudp has new configuration option for UDP truncation rate Better detection of reproducible signing availability Kxdpgun allows setting of network interface Default control timeout in knotc was increased to 60 seconds DNSSEC validation searches for invalid redundant RRSIGs Configuration source detection no longer considers empty confdb directory as active configuration Zone backup preserves original zone file if zone file synchronization is disabled Bugfixes: NSEC3 re-salt can cause server crash due to possible zone inconsistencies Zone reload logs 'invalid parameter' if zone file not changed Outgoing multi-message transfer can contain invalid compression pointers under specific conditions Improper handling of file descriptors in libdnssec Server crashes if no policy is configured with DNSSEC validation Server crashes if DNSSEC validation is enabled for unsigned zone Failed to build with libnghttp2 (Thanks to Robert Edmonds) Various bugs in zone data backup/restore
2020-10-01knot: Update to 3.0.0ryoon4-8/+36
Changelog: Version 3.0.0 Wednesday, September 9, 2020 Features: + High-performance networking mode using XDP sockets (requires Linux 4.18+) + Support for Catalog zones including kcatalogprint utility + New DNSSEC validation mode + New kzonesign utility --- an interface for manual DNSSEC signing + New kxdpgun utility --- high-performance DNS over UDP traffic generator for Linux + DoH support in kdig using GnuTLS and libnghttp2 + New KSK revoked state (RFC 5011) in manual DNSSEC key management mode + Deterministic signing with ECDSA algorithms (requires GnuTLS 3.6.10+) + Module synthrecord supports reverse pointer shortening + Safe persistent zone data backup and restore Improvements: + Processing depth of CNAME and DNAME chains is limited to 20 + Non-FQDN is allowed as 'update-owner-name' configuration option value + Kdig prints detailed algorithm idendifier for PRIVATEDNS and PRIVATEOID in multiline mode #334 + Queries with QTYPE ANY or RRSIG are always responded with at most one random RRSet + The statistics module has negligible performance overhead on modern CPUs + If multithreaded zone signing is enabled, some additional zone maintenance steps are newly parallelized + ACL can be configured by reference to a remote + Better CPU cache locality for higher query processing performance + Logging to non-syslog streams contains timestamps with the timezone + Keeping initial DNSKEY TTL and zone maximum TTL in KASP database to ensure proper rollover timing in case of TTL changes during the rollover + Responding FORMERR to queries with more OPT records Bugfixes: + Module onlinesign responds NXDOMAIN insted of NOERROR (NODATA) if DNSSEC not requested + Outgoing multi-message transfer can contain invalid compression pointers under specific conditions Version 2.9.6 Monday, August 31, 2020 Features: + New kdig option '+[no]opttext' to print unknown EDNS options as text if possible (Thanks to Robert Edmonds) Improvements: + Better error message if no key is ready for submission + Improved logging when master is not usable + Improved control logging of zone-flush errors if output directory is specified + More precise system error messages when a zone transfer fails + Some documentation improvements (especially Offline KSK) Bugfixes: + In the case of many zones, control operations over all zones take lots of memory + Misleading error message on keymgr import-bind #683 + DS push is triggered upon every zone change even though CDS wasn't changed + Kzonecheck performance penalty with passive keys #688 CSK->KSK+ZSK scheme rollover can end too early
2020-05-27knot: Update to 2.9.5ryoon2-8/+7
Changelog: Monday, May 25, 2020 Bugfixes: Old ZSK can be withdrawn too early during a ZSK rollover if maximum zone TTL is computed automatically Server responds SERVFAIL to ANY queries on empty non-terminal nodes Improvements: Also module onlinesign returns minimized responses to ANY queries Linking against libcap-ng can be disabled via a configure option
2020-05-22knot: Disable hack to disable optimization.maya1-4/+1
It isn't actually stuck, with enough patience it does complete.
2020-05-22revbump after updating security/nettleadam1-1/+2
2020-05-21Update to 2.9.4ryoon2-7/+7
Changelog: Version 2.9.4 Tuesday, May 5, 2020 Improvements: ANY query over UDP is always answered with one RRSet + possible RRSIG instead of truncated reply Server tries to resolve CNAME record generated by geoip module (Thanks to Conrad Hoffmann) Earlier OCSP validity check in kdig certificate verification (Thanks to Alexander Schultz) Module onlinesign allows KSK + ZSK mode Server control listen backlog limit was increased to 5 Zone signing event is always re-scheduled even after a signing error Extended error checks and tiny enhancements in kjournalprint kdig logs a more detailed error message when failed to acquire a remote address Some documentation improvements Bugfixes: Server can crash when zone update fails due to exceeded zone size limit keymgr 'share' command doesn't work Shared KSK doesn't work with an initial key Self-created RRSIGs are still cryptographically verified in some unnecessary cases Changed NSEC3PARAM not correctly detected during zone update NSEC(3) chain not fixed if affected by zone udpate knotc orphan purge doesn't work on journal Online signing configured along with DNSSEC signing can cause MDB_BAD_RSLOT error during server reload Zone journal access can stuck if mismanaged zone serial Concurrently added and removed same records in a DDNS message are not properly handled Zone check logs error instead of warning after a first error occured
2020-05-08net/knot: remove nonexistent file from REPLACE_PYTHONrillig1-3/+1
2020-03-30knot: Update to 2.9.3ryoon2-8/+7
Changelog: Version 2.9.3 Tuesday, March 3, 2020 Features: New configuration option 'remote.block-notify-after-transfer' to suppress sending NOTIFY messages Enabled testing support for Ed448 DNSSEC algorithm (requires GnuTLS 3.6.12+ and not-yet-released Nettle 3.6+) New keymgr parameter 'local-serial' for getting/setting signed zone SOA serial in the KASP database keymgr can import Ed25519 and Ed448 keys in the BIND format (Thanks to Conrad Hoffmann) Improvements: kdig returns error if the query name is invalid Increased 'server.tcp-io-timeout' default value to 500 ms Decreased 'database.journal-db-max-size' default value to 512 MiB on 32-bit systems Server no longer falls back to AXFR if master is outdated during zone refresh Some documentation improvements (including new EPUB format and compatibility with Ultra Electronics CIS Keyper Plus HSM) Some packaging improvements (including new python3-libknot deb package) Bugfixes: Outgoing IXFR can be malformed if the message size has specific size Server can crash if the zone contains solo NSEC3 record Improved compatibility with older journal format Incorrect SOA TTL in negative answers — SOA minimum not considered Cannot unset uppercase nodes via control interface #668 Module RRL doesn't set AA flag and NOERROR rcode in slipped responses Server returns FORMERR instead of NOTIMP if empty QUESTION and unknown OPCODE
2020-03-08*: recursive bump for libffiwiz1-1/+2
2020-02-19knot: Update to 2.9.2ryoon2-7/+10
Changelog: Knot DNS 2.9.2 (2019-12-12) =========================== Improvements: ------------- - Tiny ds-check log message rewording - Some unnecessary code cleanup Bugfixes: --------- - ds-push doesn't replace the DS RRset on the parent #661 - Server gets stuck in a never-ending logging loop when changing SOA TTL - Server can crash when the journal database size limit is reached - Server can create a bogus changeset with equal serials from and to - Unreasonable re-signing of the NSEC3PARAM record when reloading the zone and 'zonefile-load: difference-no-serial' is configured - SOA RRSIG not updated if the only changed record is SOA - Failed to remove NSEC3 records through the control interface #666 - Failed to stop the server if a zone transaction is active Knot DNS 2.9.1 (2019-11-11) =========================== Features: --------- - New option for OCSP stapling '+[no]tls-ocsp-stapling[=H]' in kdig (Thanks to Alexander Schultz) Improvements: ------------- - Kdig always randomizes source TCP port on recent Linux #575 - Server no longer warns about disabled zone file synchronization during shutdown - Zone loading stops if failed to load zone from the journal - Speed-up of insertion to big RRSets - Various code and documentation improvements Bugfixes: --------- - Failed to apply journal changes after upgrade #659 - Failed to finish zone loading if journal changeset serials from and to are equal - Incorrect handling of 0 value for 'tcp-io-timeout' and 'tcp-remote-io-timeout' configuration - Server can crash if zone transaction is open during zone update - NSEC3 chain not fully updated if NSEC3 salt changes during zone update - Server can crash when flushing zone to a specified directory - Server can respond incorrect NSEC3 records after NSEC3 salt change - Delegation glue records not updated after specific zone change Knot DNS 2.9.0 (2019-10-10) =========================== Features: --------- - Full support for different master/slave serial arithmetics when on-slave signing - Module geoip newly supports wildcard records #650 - New DNSSEC policy configuration option 'rrsig-pre-refresh' for reducing frequency of the zone signing event - New server configuration option 'tcp-reuseport' for setting SO_REUSEPORT(_LB) mode on TCP sockets - New server configuration option 'tcp-io-timeout' [ms] for restricting inbound IO operations over TCP #474 Improvements: ------------- - Significant speed-up of zone contents modifications - Avoided double zone signing during CSK rollovers - Self-created RRSIGs are not cryptographically verified if not necessary - Zone journal can store two changesets if zone file difference computing and DNSSEC signing are enabled. The first one containing the difference of zone history needed by slave servers, the second one containing the difference between zone file and zone needed for server restart - Universal and more robust memory clearing - More precise socket timeout handling - New notice log message for configuration changes requiring server restart - Module RRL logs both trigger source address and affected subnet - Various code (especially zone and TCP processing) and documentation improvements Bugfixes: --------- - RRSIGs are wrongly checked for inconsistent RRSet TTLs during zone update - DS check/push warnings after disabled DNSSEC signing - NSEC3 records not accessible through control interface - Module geoip doesn't accept underscore character in dname specification #655 Compatibility: -------------- - Removed runtime reconfiguration of network workers and interfaces since it was imperfect and also couldn't work after dropped process privileges - Removed inaccurate and misleading knotc command 'zone-memstats' because memory consumption varies during zone modifications or transfers - Removed useless 'zone.request-edns-option' configuration option - Reimplemented DNS Cookies to be interoperable (based on draft-ietf-dnsop-server-cookies and work by Witold Kręcicki) - Default limit on TCP clients is auto-configured to one half of the file descriptor limit for the server process - Number of open files limit is set to 1048576 in upstream packages - Default number of TCP workers is equal to the number of online CPUs or at least 10 - Default EDNS buffer size is 1232 for both IPv4 and IPv6 - Removed 'tcp-handshake-timeout' server configuration option - Some configuration options were renamed and possibly moved. Old names will be supported at least until next major release: - 'server.tcp-reply-timeout' [s] to 'server.tcp-remote-io-timeout' [ms] - 'server.max-tcp-clients' to 'server.tcp-max-clients' - 'server.max-udp-payload' to 'server.udp-max-payload' - 'server.max-ipv4-udp-payload' to 'server.udp-max-payload-ipv4' - 'server.max-ipv6-udp-payload' to 'server.udp-max-payload-ipv6' - 'template.journal-db' to 'database.journal-db' - 'template.journal-db-mode' to 'database.journal-db-mode' - 'template.max-journal-db-size' to 'database.journal-db-max-size' - 'template.kasp-db' to 'database.kasp-db' - 'template.max-kasp-db-size' to 'database.kasp-db-max-size' - 'template.timer-db' to 'database.timer-db' - 'template.max-timer-db-size' to 'database.timer-db-max-size' - 'zone.max-journal-usage' to 'zone.journal-max-usage' - 'zone.max-journal-depth' to 'zone.journal-max-depth' - 'zone.max-zone-size' to 'zone.zone-max-size' - 'zone.max-refresh-interval' to 'zone.refresh-max-interval' - 'zone.min-refresh-interval' to 'zone.refresh-min-interval' Knot DNS 2.8.4 (2019-09-24) =========================== Features: --------- - Automatic uploading of DS records to parent zone using DDNS, see 'policy.ds-push' configuration option Improvements: ------------- - Incoming IXFR no longer falls back to AXFR if connection error #642 - More accurate semantic checks for missing glue records - Various code and documentation improvements Bugfixes: --------- - Failed to read/export configuration if 'acl.update-type' is set #651 - Failed to generate initial zero-length salt - Missing error log for invalid rrtype input to dynamic configuration #652 - Missing error log when AXFR processing fails to store zone data - Redundant notice log about unavailable persistent configuration DB - Zone not flushed after retransfer if SOA serial not changed - Zone contents not properly fixed during zone transfers - No changeset created for updated rrset's TTL if changed by RR addition
2019-11-03net: align variable assignmentsrillig1-2/+2
pkglint -Wall -F --only aligned --only indent -r No manual corrections.
2019-08-21Update to 2.8.3ryoon2-8/+7
Changelog: Features: Added cert/key file configuration for TLS in kdig (Thanks to Alexander Schultz) Improvements: More verbose log message for offline-KSK signing Module RRL logs affected source address subnet instead of only one source address Extended DNSSEC policy configuration checks Various improvements in the documentation Bugfixes: Excessive server load when maximum TCP clients limit is reached Incorrect reply after zone update with a node changed from non-authoritative to delegation Wrong error line number in a config file if it contains leading tab character Config file error message contains unrelated parsing context NSEC3 salt not updated when reconfigured to zero length Kjournalprint sometimes prints a random value for per-zone occupation Missing debug log for failed zone refresh triggered by zone notification DS check not scheduled when reconfigured Broken unit test on NetBSD 8.x
2019-07-20*: recursive bump for nettle 3.5.1wiz1-1/+2
2019-06-13Update to 2.8.2ryoon2-8/+7
Changelog: Knot DNS 2.8.2 (2019-06-05) =========================== Features: --------- - New blocking mode for zone event triggers in knotc - New weighted records mode in the module geoip (Thanks to Conrad Hoffmann) - Module noudp allows UDP allow rate configuration Improvements: ------------- - NSEC3 salt lifetime can be set to infinity - New 'running' zone event status in the knotc output - Knotc in the forced mode returns failure also if zone check emits any warning - Ignoring PMTU information for IPv4/UDP via IP_PMTUDISC_OMIT (Thanks to Daisuke Higashi) - Various improvements in the documentation Bugfixes: --------- - Broken setting of CPU affinity for UDP workers - Unexpected results with the geoip subnet mode - Sometimes insufficient zone adjusting - Incoherent DNSKEY RRSIG lifetimes in SKR - Confusing output from keymgr if an error occurs during KSR generation - Non-functional changeset history depth limitation in kjournalprint - Wrong processing of multiple $INCLUDE directives #646
2019-05-23all: replace SUBST_SED with the simpler SUBST_VARSrillig1-2/+2
pkglint -Wall -r --only "substitution command" -F With manual review and indentation fixes since pkglint doesn't get that part correct in every case.
2019-04-25PKGREVISION bump for anything using python without a PYPKGPREFIX.maya1-1/+2
This is a semi-manual PKGREVISION bump.
2019-04-15Update to 2.8.1ryoon3-9/+9
Changelog: Knot DNS 2.8.1 (2019-04-09) =========================== Improvements: ------------- - Possible zone transaction is aborted by zone events to avoid inconsistency - Added log message if no persistent config DB is available during 'conf-begin' - New environment setting 'KNOT_VERSION_FORMAT=release' for extended version suppression - Various improvements in the documentation Bugfixes: --------- - Broken NSEC3-wildcard-nonexistence proof after NSEC3 re-salt - Glue records under delegation are sometimes signed - RRL doesn't work correctly on big-endian architectures - NSEC3 not re-salted during AXFR refresh - Failed to sign new zone contents if added dynamically #641 - NSEC3 opt-out signing doesn't work in some cases - Broken NSEC3 chain after adding new sub-delegations - Redundant SOA RRSIG on slave if RRSIG TTL changed on master - Sometimes confusing log error message for NOTIFY event - Improper include for LMDB #638 Knot DNS 2.8.0 (2019-03-05) =========================== Features: --------- - New offline-KSK mode of operation - Configurable multithreaded DNSSEC signing for large zones - Extended ACL configuration for dynamic updates - New knotc trigger 'zone-key-rollover' for immediate DNSKEY rollover - Added support for OPENPGPKEY, CSYNC, SMIMEA, and ZONEMD RR types - New 'double-ds' option for CDS/CDNSKEY publication Improvements: ------------- - Significant speed-up of zone updates - Knotc supports force option in the interactive mode - Copy-on-write support for QP-trie (Thanks to Tony Finch) - Unified and more efficient LMDB layer for journal, timer, and KASP databases - DS check event is re-planned according to KASP even when purged timers - Module DNS Cookies supports explicit Server Secret configuration - Zone mtime is verified against full-precision timestamp (Thanks to Daniel Kahn Gillmor) - Extended logging (loaded SOA serials, refresh duration, tiny cleanup) - Relaxed fixed-length condition for DNSSEC key ID - Extended semantic checks for DNAME and NS RR types - Added support for FreeBSD's SO_REUSEPORT_LB - Improved performance of geoip module - Various improvements in the documentation Compatibility: -------------- - Changed configuration default for 'cds-cdnskey-publish' to 'rollover' - Journal DB format changes are not downgrade-compatible - Keymgr no longer prints DS for algorithm SHA-1
2019-01-29Update to 2.7.6ryoon3-37/+30
Changelog: Knot DNS 2.7.6 (2019-01-23) =========================== Improvements: ------------- - Zone status also shows when the zone load is scheduled - Server workers status also shows background workers utilization - Default control timeout for knotc was increased to 10 seconds - Pkg-config files contain auxiliary variable with library filename Bugfixes: --------- - Configuration commit or server reload can drop some pending zone events - Nonempty zone journal is created even though it's disabled #635 - Zone is completely re-signed during empty dynamic update processing - Server can crash when storing a big zone difference to the journal - Failed to link on FreeBSD 12 with Clang Knot DNS 2.7.5 (2019-01-07) =========================== Features: --------- - Keymgr supports NSEC3 salt handling Improvements: ------------- - Zone history in journal is dropped apon AXFR-like zone update - Libdnssec is no longer linked against libm #628 - Libdnssec is explicitly linked against libpthread if PKCS #11 enabled #629 - Better support for libknot packaging in Python - Manually generated KSK is 'ready' by default - Kdig supports '+timeout' as an alias for '+time' - Kdig supports '+nocomments' option - Kdig no longer prints empty lines between retries - Kdig returns failure if operations not successfully resolved #632 - Fixed repeating of the 'KSK submission, waiting for confirmation' log - Various improvements in documentation, Dockerfile, and tests Bugfixes: --------- - Knotc fails to unset huge configuration section - Kjournalprint sometimes fails to display zone journal content - Improper timing of ZSK removal during ZSK rollover - Missing UTC time zone indication in the 'iso' keymgr list output - A race condition in the online signing module Knot DNS 2.7.4 (2018-11-13) =========================== Features: --------- - Added SNI configuration for TLS in kdig (Thanks to Alexander Schultz) Improvements: ------------- - Added warning log when DNSSEC events not successfully scheduled - New semantic check on timer values in keymgr - DS query no longer asks other addresses if got a negative answer - Reintroduced 'rollover' configuration option for CDS/CDNSKEY publication - Extended logging for zone loading - Various documentation improvements Bugfixes: --------- - Failed to import module configuration #613 - Improper Cflags value in libknot.pc if built with embedded LMDB #615 - IXFR doesn't fall back to AXFR if malformed reply - DNSSEC events not correctly scheduled for empty zone updates - During algorithm rollover old keys get removed before DS TTL expires #617 - Maximum zone's RRSIG TTL not considered during algorithm rollover #620 Knot DNS 2.7.3 (2018-10-11) =========================== Features: --------- - New queryacl module for query access control - Configurable answer rrset rotation #612 - Configurable NSEC bitmap in online signing Improvements: ------------- - Better error logging for KASP DB operations #601 - Some documentation improvements Bugfixes: --------- - Keymgr "list" output doesn't show key size for ECDSA algorithms #602 - Failed to link statically with embedded LMDB - Configuration commit causes zone reload for all zones - The statistics module overlooks TSIG record in a request - Improper processing of an AXFR-style-IXFR response consisting of one-record messages - Race condition in online signing during key rollover #600 - Server can crash if geoip module is enabled in the geo mode Knot DNS 2.7.2 (2018-08-29) =========================== Improvements: ------------- - Keymgr list command displays also key size - Kjournalprint displays total occupied size in the debug mode - Server doesn't stop if failed to load a shared module from the module directory - Libraries libcap-ng, pthread, and dl are linked selectively if needed Bugfixes: --------- - Sometimes incorrect result from dnssec_nsec_bitmap_contains (libdnssec) - Server can crash when loading zone file difference and zone-in-journal is set - Incorrect treatment of specific queries in the module RRL - Failed to link module Cookies as a shared library Knot DNS 2.7.1 (2018-08-14) =========================== Improvements: ------------- - Added zone wire size information to zone loading log message - Added debug log message for each unsuccessful remote address operation - Various improvements for packaging Bugfixes: --------- - Incompatible handling of RRSIG TTL value when creating a DNS message - Incorrect RRSIG TTL value in zone differences and knotc zone operation outputs - Default configure prefix is ignored Knot DNS 2.7.0 (2018-08-03) =========================== Features: --------- - New DNS Cookies module and related '+cookie' kdig option - New module for response tailoring according to client's subnet or geographic location - General EDNS Client Subnet support in the server - OSS-Fuzz integration (Thanks to Jonathan Foote) - New '+ednsopt' kdig option (Thanks to Jan Včelák) - Online Signing support for automatic key rollover - Non-normal file (e.g. pipe) loading support in zscanner #542 - Automatic SOA serial incrementation if non-empty zone difference - New zone file load option for ignoring zone file's SOA serial - New build-time option for alternative malloc specification - Structured logging for DNSSEC key submission event - Empty QNAME support in kdig Improvements: ------------- - Various library and server optimizations - Reduced memory consumption of outgoing IXFR processing - Linux capabilities use overhaul #546 (Thanks to Robert Edmonds) - Online Signing properly signs delegations and CNAME records - CDS/CDNSKEY rrset is signed with KSK instead of ZSK - DNSSEC-related records are ignored when loading zone difference with signing enabled - Minimum allowed RSA key length was increased to 1024 - Removed explicit dependency on Nettle Bugfixes: --------- - Possible uninitialized address buffer use in zscanner - Possible index overflow during multiline record parsing in zscanner - kdig +tls sometimes consumes 100 % CPU #561 - Single-Type Signing doesn't work with single ZSK key #566 - Zone not flushed after re-signing during zone load #594 - Server crashes when committing empty zone transaction - Incoming IXFR with on-slave signing sometimes leads to memory corruption #595 Compatibility: -------------- - Removed obsolete RRL configuration - Removed obsolete module names 'mod-online-sign' and 'mod-synth-record' - Removed obsolete 'ixfr-from-differences' configuration option - Removed old journal migration - Removed module rosedb Knot DNS 2.6.9 (2018-08-14) =========================== Improvements: ------------- - Added zone wire size to zone loading log message - Added debug log message for each unsuccessful remote address operation Bugfixes: --------- - Zone not flushed after re-signing during zone load #594 - Server crashes when committing empty zone transaction - Incoming IXFR with on-slave signing sometimes leads to memory corruption #595 Knot DNS 2.6.8 (2018-07-10) =========================== Features: --------- - New 'import-pkcs11' command in keymgr Improvements: ------------- - Unixtime serial policy mimics Bind – increment if lower #593 Bugfixes: --------- - Creeping memory consuption upon server reload #584 - Kdig incorrectly detects QNAME if 'notify' is a prefix - Server crashes when zone sign fails #587 - CSK->KZSK rollover retires CSK early #588 - Server crashes when zone expires during outgoing multi-message transfer - Kjournalprint doesn't convert zone name argument to lower-case - Cannot switch to a previously used ksk-shared dnssec policy #589 Knot DNS 2.6.7 (2018-05-17) =========================== Features: --------- - Added 'dateserial' (YYYYMMDDnn) serial policy configuration (Thanks to Wolfgang Jung) Improvements: ------------- - Trailing data indication from the packet parser (libknot) - Better configuration check for a problematical option combination Bugfixes: --------- - Incomplete configuration option item name check - Possible buffer overflow in 'knot_dname_to_str' (libknot) - Module dnsproxy doesn't preserve letter case of QNAME - Module dnsproxy duplicates OPT and TSIG in the non-fallback mode Knot DNS 2.6.6 (2018-04-11) =========================== Features: --------- - New EDNS option counters in the statistics module - New '+orphan' filter for the 'zone-purge' operation Improvements: ------------- - Reduced memory consuption of disabled statistics metrics - Some spelling fixes (Thanks to Daniel Kahn Gillmor) - Server no longer fails to start if MODULE_DIR doesn't exist - Configuration include doesn't fail if empty wildcard match - Added a configuration check for a problematical option combination Bugfixes: --------- - NSEC3 chain not re-created when SOA minimum TTL changed - Failed to start server if no template is configured - Possibly incorrect SOA serial upon changed zone reload with DNSSEC signing - Inaccurate outgoing zone transfer size in the log message - Invalid dname compression if empty question section - Missing EDNS in EMALF responses Knot DNS 2.6.5 (2018-02-12) =========================== Features: --------- - New 'zone-notify' command in knotc - Kdig uses '@server' as a hostname for TLS authenticaion if '+tls-ca' is set Improvements: ------------- - Better heap memory trimming for zone operations - Added proper polling for TLS operations in kdig - Configuration export uses stdout as a default output - Simplified detection of atomic operations - Added '--disable-modules' configure option - Small documentation updates Bugfixes: --------- - Zone retransfer doesn't work well if more masters configured - Kdig can leak or double free memory in corner cases - Inconsistent error outputs from dynamic configuration operations - Failed to generate documentation on OpenBSD Knot DNS 2.6.4 (2018-01-02) =========================== Features: --------- - Module synthrecord allows multiple 'network' specification - New CSK handling support in keymgr Improvements: ------------- - Allowed configuration for infinite zsk lifetime - Increased performance and security of the module synthrecord - Signing changeset is stored into journal even if 'zonefile-load' is whole Bugfixes: --------- - Unintentional zone re-sign during reload if empty NSEC3 salt - Inconsistent zone names in journald structured logs - Malformed outgoing transfer for big zone with TSIG - Some minor DNSSEC-related issues Knot DNS 2.6.3 (2017-11-24) =========================== Bugfixes: --------- - Wrong detection of signing scheme rollover Knot DNS 2.6.2 (2017-11-23) =========================== Features: --------- - CSK algorithm rollover and (KSK, ZSK) <-> CSK rollover support Improvements: ------------- - Allowed explicit configuration for infinite ksk lifetime - Proper error messages instead of unclear error codes in server log - Better support for old compilers Bugfixes: --------- - Unexpected reply for DS query with an owner below a delegation point - Old dependencies in the pkg-config file Knot DNS 2.6.1 (2017-11-02) =========================== Features: --------- - NSEC3 Opt-Out support in the DNSSEC signing - New CDS/CDNSKEY publish configuration option Improvements: ------------- - Simplified DNSSEC log message with DNSKEY details - +tls-hostname in kdig implies +tls-ca if neither +tls-ca nor +tls-pin is given - New documentation sections for DNSSEC key rollovers and shared keys - Keymgr no longer prints useless algorithm number for generated key - Kdig prints unknown RCODE in a numeric format - Better support for LLVM libFuzzer Bugfixes: --------- - Faulty DNAME semantic check if present in the zone apex and NSEC3 is used - Immediate zone flush not scheduled during the zone load event - Server crashes upon dynamic zone addition if a query module is loaded - Kdig fails to connect over TLS due to SNI is set to server IP address - Possible out-of-bounds memory access at the end of the input - TCP Fast Open enabled by default in kdig breaks TLS connection Knot DNS 2.6.0 (2017-09-29) =========================== Features: --------- - On-slave (inline) signing support - Automatic DNSSEC key algorithm rollover - Ed25519 algorithm support in DNSSEC (requires GnuTLS 3.6.0) - New 'journal-content' and 'zonefile-load' configuration options - keymgr tries to run as user/group set in the configuration - Public-only DNSSEC key import into KASP DB via keymgr - NSEC3 resalt and parent DS query events are persistent in timer DB - New processing state for a response suppression within a query module - Enabled server side TCP Fast Open if supported - TCP Fast Open support in kdig Improvements: ------------- - Better record owner compression if related to the previous rdata dname - NSEC(3) chain is no longer recomputed whole on every update - Remove inconsistent and unnecessary quoting in log files - Avoiding of overlapping key rollovers at a time - More DNSSSEC-related semantic checks - Extended timestamp format in keymgr Bugfixes: --------- - Incorrect journal free space computation causing inefficient space handling - Interface-automatic broken on Linux in the presence of asymmetric routing
2018-07-04*: Move SUBST_STAGE from post-patch to pre-configurejperkin1-2/+2
Performing substitutions during post-patch breaks tools such as mkpatches, making it very difficult to regenerate correct patches after making changes, and often leading to substituted string replacements being committed.
2018-04-17Add p11-kit to gnutls/bl3.mk and bump dependencies.wiz1-1/+2
2018-03-08Knot DNS 2.5.7 (2018-01-02)pettai4-21/+29
=========================== Bugfixes: --------- - Unintentional zone re-sign during reload if empty NSEC3 salt - Inconsistent zone names in journald structured logs - Malformed outgoing transfer for big zone with TSIG - Unexpected reply for DS query with an owner below a delegation point - Old dependencies in the pkg-config file [...] Only new Features & Security fixes of the previous updates are shown below For a complete of all Improvements & Bugfixes, see: https://gitlab.labs.nic.cz/knot/knot-dns/blob/2.5/NEWS Knot DNS 2.5.3 (2017-07-14) =========================== Features: --------- - CSK rollover support for Single-Type Signing Scheme [...] Knot DNS 2.5.2 (2017-06-23) =========================== Security: --------- - CVE-2017-11104: Improper TSIG validity period check can allow TSIG forgery (Thanks to Synacktiv!) Knot DNS 2.5.0 (2017-06-05) =========================== Features: --------- - KASP database switched from JSON files to LMDB database - KSK rollover support using CDNSKEY and CDS in the automatic DNSSEC signing - Dynamic module loading support with proper module API - Journal can store full zone contents (not only differences) - Zone freeze/thaw support - Updated knotc zone-status output with optional column filters - New '[no]crypto' option in kdig - New keymgr implementation reflecting KASP database changes - New pykeymgr for JSON-based KASP database migration - Removed obsolete knot1to2 utility
2018-03-07Knot DNS 2.4.5 (2017-06-23)pettai3-9/+16
=========================== Security: --------- - Improper TSIG validity period check can allow TSIG forgery (Thanks to Synacktiv!) Bugfixes: --------- - Corner case journal fixes (huge changesets, OpenWRT operation) Knot DNS 2.4.4 (2017-06-05) =========================== Improvements: ------------- - Improved error handling in kjournalprint Bugfixes: --------- - Zone flush not replanned upon unsuccessful flush - Journal inconsistency after deleting deleted zone - Zone events not rescheduled upon server reload (Thanks to Mark Warren) - Unreliable LMDB mapsize detection in kjournalprint - Some minor issues found by AddressSanitizer Knot DNS 2.4.3 (2017-04-11) =========================== Improvements: ------------- - New 'journal-db-mode' optimization configuration option - The default TSIG algorithm for utilities input is HMAC-SHA256 - Implemented sensible default EDNS(0) padding policy (Thanks to D. K. Gillmor) - Added some more semantic checks on the knotc configuration operations Bugfixes: --------- - Missing 'zone' keyword in the YAML output - Missing trailing dot in the keymgr DS owner output - Journal logs 'invalid parameter' in several cases - Some minor journal-related problems Knot DNS 2.4.2 (2017-03-23) =========================== Features: --------- - Zscanner can store record comments placed on the same line - Knotc status extension with version, configure, and workers parameters Improvements: ------------- - Significant incoming XFR speed-up in the case of many zones Bugfixes: --------- - Double OPT RR insertion when a global module returns KNOT_STATE_FAIL - User-driven zscanner parsing logic inconsistency - Lower serial at master doesn't trigger any errors - Queries with too long DNAME substitution do not return YXDOMAIN response - Incorrect elapsed time in the DDNS log - Failed to process forwarded DDNS request with TSIG Knot DNS 2.4.1 (2017-02-10) =========================== Improvements: ------------- - Speed-up of rdata addition into a huge rrset - Introduce check of minumum timeout for next refresh - Dnsproxy module can forward all queries without local resolving Bugfixes: -------- - Transfer of a huge rrset goes into an infinite loop - Huge response over TCP contains useless TC bit instead of SERVFAIL - Failed to build utilities with disabled daemon - Memory leaks during keys removal - Rough TSIG packet reservation causes early truncation - Minor out-of-bounds string termination write in rrset dump - Server crash during stop if failed to open timers DB - Failed to compile on OS X older than Sierra - Poor minimum UDP-max-size configuration check - Failed to receive one-record-per-message IXFR-style AXFR - Kdig timeouts when receiving RCODE != NOERROR on subsequent transfer message Knot DNS 2.4.0 (2017-01-18) =========================== - Kdig timeouts when receiving RCODE != NOERROR on subsequent transfer message Knot DNS 2.4.0 (2017-01-18) =========================== Bugfixes: -------- - False positive semantic-check warning about invalid bitmap in NSEC - Unnecessary SOA queries upon notify with up to date serial - Timers for expired zones are reset on reload - Zone doesn't expire when the server is down - Failed to handle keys with duplicate keytags - Per zone module and global module insconsistency - Obsolete online signing module configuration - Malformed output from kjournalprint - Redundant SO_REUSEPORT activation on the TCP socket - Failed to use higher number of background workers Improvements: ------------- - Lower memory consumption with qp-trie - Zone events and zone timers improvements - Print all zone names in the FQDN format - Simplified query module interface - Shared TCP connection between SOA query and transfer - Response Rate Limiting as a module with statistics support - Key filters in keymgr Features: --------- - New unified LMDB-based zone journal - Server statistics support - New statistics module for traffic measuring - Automatic deletion of retired DNSSEC keys - New control logging category
2017-08-16Follow some http redirects.wiz1-2/+2
2017-08-07Use PKG_SYSCONF* variables correctly in net/knot.jlam1-6/+7
Set PKG_SYSCONFSUBDIR to "knot" to have all of the config files located in the "knot" subdirectory of ${PKG_SYSCONFBASE}. Pass ${PKG_SYSCONFBASE} to the configure script since the package's build infrastructure automatically appends "/knot" to the value passed in through --sysconfdir. Remove ${PKG_SYSCONFDIR} from INSTALLATION_DIRS since it is automatically created by the package install script. Bump the PKGREVISION due to changes in the package install scripts.
2016-12-09Knot DNS 2.3.3 (2016-12-08)pettai3-8/+10
=========================== Bugfixes: --------- - Double free when failed to apply zone journal - Zone bootstrap retry interval not preserved upon zone reload - DNSSEC related records not flushed if not signed - False semantic checks warning about incorrect type in NSEC bitmap - Memory leak in kzonecheck Improvements: ------------- - All zone names are fully-qualified in log Features: --------- - New kjournalprint utility Knot DNS 2.3.2 (2016-11-04) =========================== Bugfixes: --------- - Incorrect %s expansion for the root zone - Failed to refresh not existing slave zone after restart - Immediate zone refresh upon restart if refresh already scheduled - Early zone transfer after restart if transfer already scheduled - Not ignoring empty non-terminal parents during delegation lookup - CD bit preservation in responses - Compilation error on GNU/kFreeBSD - Server crash after double zone-commit if journal error Improvements: ------------- - Speed-up of knotc if control operation and known socket - Zone purge operation purges also zone timers Features: --------- - Simple modules don't require empty configuration section - New zone journal path configuration option - New timeout configuration option for module dnsproxy
2016-10-29fix pkglint warningpettai2-3/+5
2016-10-29Knot DNS 2.3.1 (2016-10-07)pettai3-10/+9
=========================== Bugfixes: --------- - Missing glue records in some responses - Knsupdate prompt printing on non-terminal - Mismatch between configuration policy item names and documentation - Segfault on OS X (Sierra) Improvements: ------------- - Significant speed-up of conf-commit and conf-diff operations (in most cases) - New EDNS Client Subnet libknot API - Better semantic-checks error messages Features: --------- - Print TLS certificate hierarchy in kdig verbose mode - New +subnet alias for +client - New mod-whoami and mod-noudp modules - New zone-purge control command - New log-queries and log-responses options for mod-dnstap
2016-09-19Recursive PKGREVISION bump for gnutls shlib major bump.wiz1-1/+2
2016-08-25Knot DNS 2.3.0 (2016-08-09)pettai3-11/+14
=========================== Bugfixes: --------- - No wildcard expansion below empty non-terminal for NSEC signed zone - Avoid multiple loads of the same PKCS #11 module - Fix kdig IXFR response processing if the transfer content is empty - Don't ignore non-existing records to be removed in IXFR Improvements: ------------- - Refactored semantic checks and improved error messages - Set TC flag in delegation only if mandatory glue doesn't fit the response - Separate EDNS(0) payload size configuration for IPv4 and IPv6 Features: --------- - DNSSEC policy can be defined in server configuration - Automatic NSEC3 resalt according to DNSSEC policy - Zone content editing using control interface - Zone size limit restriction for DDNS, AXFR, and IXFR (CVE-2016-6171) - DNS-over-TLS support in kdig (RFC 7858) - EDNS(0) padding and alignment support in kdig (RFC 7830)
2016-06-16Knot DNS 2.2.1 (2016-05-24)pettai3-9/+10
=========================== Bugfixes: --------- - Fix separate logging of server and zone events - Fix concurrent zone file flushing with many zones - Fix possible server crash with empty hostname on OpenWRT - Fix control timeout parsing in knotc - Fix "Environment maxreaders limit reached" error in knotc - Don't apply journal changes on modified zone file - Remove broken LTO option from configure script - Enable multiple zone names completion in interactive knotc - Set the TC flag in a response if a glue doesn't fit the response - Disallow server reload when there is an active configuration transaction Improvements: ------------- - Distinguish unavailable zones from zones with zero serial in log messages - Log warning and error messages to standard error output in all utilities - Document tested PKCS #11 devices - Extended Python configuration interface Knot DNS 2.2.0 (2016-04-26) =========================== Bugfixes: --------- - Fix build dependencies on FreeBSD - Fix query/response message type setting in dnstap module - Fix remote address retrieval from dnstap capture in kdig - Fix global modules execution for queries hitting existing zones - Fix execution of semantic checks after an IXFR transfer - Fix PKCS#11 support detection at build time - Fix kdig failure when the first AXFR message contains just the SOA record - Exclude non-authoritative types from NSEC/NSEC3 bitmap at a delegation - Mark PKCS#11 generated keys as sensitive (required by Luna SA) - Fix error when removing the only zone from the server - Don't abort knotc transaction when some check fails Features: --------- - URI and CAA resource record types support - RRL client address based white list - knotc interactive mode Improvements: ------------- - Consistent IXFR error messages - Various fixes for better compatibility with PKCS#11 devices - Various keymgr user interface improvements - Better zone event scheduler performance with many zones - New server control interface - kdig uses local resolver if resolv.conf is empty
2016-02-28Knot DNS 2.1.1 (2016-02-10)pettai3-40/+21
=========================== Bugfixes: --------- - DNSSEC: Allow import of duplicate private key into the KASP - DNSSEC: Avoid duplicate NSEC for Wildcard No Data answer - Fix server crash when an incomming transfer is in progress and reload is issued - Fix socket polling when configured with many interfaces and threads - Fix compilation against Nettle 3.2 Improvements: ------------- - Select correct source address for UDP messages recieved on ANY address - Extend documentation of knotc commands Knot DNS 2.1.0 (2016-01-14) =========================== Features: --------- - Per-thread UDP socket binding using SO_REUSEPORT on Linux - Support for dynamic configuration database - DNSSEC: Support for cryptographic tokens via PKCS #11 interface - DNSSEC: Experimental support for online signing Improvements: ------------- - Support for zone file name patterns - Configurable location of zone timer database - Non-blocking network operations and better timeout handling - Caching of Critical configuration values for better performance - Logging of ACL failures - RRL: Add rate-limit-slip zero support to drop all responses - RRL: Document behavior for different rate-limit-slip options - kdig: Warning instead of error on TSIG validation failure - Cleanup of support libraries interfaces (libknot, libzscanner, libdnssec) - Remove possibly insecure server control over a network socket - Remove implementation limit for the number of network interfaces Bugfixes: --------- - synth-record module: Fix application of default configuration options - TSIG: Allow compressed TSIG name when forwarding DDNS updates - Schedule zone bootstrap after slave zone fails to load from disk
2016-02-25Use OPSYSVARS.jperkin1-6/+2
2015-12-13Knot DNS 2.0.2pettai2-7/+7
============== Bugfixes: --------- - Out-of-bound read in packet parser for malformed NAPTR records (LibFuzzer)
2015-10-27Disable recvmmsg() on NetBSD as a workaround.pettai1-1/+7
(NetBSD's implementation of recvmmsg() is not 100% with the Linux version)
2015-10-26Knot DNS 2.0.1 (2015-09-02)pettai6-48/+125
=========================== Bugfixes: --------- - Do not reload expired zones on 'knotc reload' and server startup - Fix rare race-condition in event scheduling causing delayed event execution - Fix skipping of non-authoritative nodes in NSEC proofs - Fix TC flag setting in RRL slipped answers - Disable domain name compression for root label - Log via journald only when running under systemd - Fix CNAME following when quering for NSEC RR type - Fix refreshing of DNSSEC signatures for zone keys - Fix binding an unavailable IPv6 address on Linux (IP_FREEBIND) - Fix infinite loop in knotc zonestatus and memstats - Fix memory leak in configuration on server shutdown - Fix broken dnsproxy module - Fix DNSSEC KASP timestamps parsing in strict POSIX environment - fix multi value parsing on big-endian - Adapt to Nettle 3 API break causing base64 decoding failures on big-endian Features: --------- - Add 'keymgr zone key ds' to show key's DS record - Add 'keymgr tsig generate' to generate TSIG keys - Add query module scoping to process either all queries or zone queries only - Add support for file name globbing in config file includes - Add 'request-edns-option' config option to add custom EDNS0 option into server initiated queries Improvements: ------------- - Send minimal responses (remove NS from Authority section for NOERROR) - Update persistent timers only on shutdown for better performance - Allow change of RR TTL over DDNS - Documentation fixes, updates, and improvements in formatting - Install yparser and zscanner header files - Improve lookup of libsystemd build dependencies - Fix compilation warnings in endian conversion functions on OpenBSD Knot DNS 2.0.0 (2015-06-26) =========================== Bugfixes: --------- - Fix lost NOTIFY message if received during zone transfer - Disable fast zone parser when compiled in Clang (workaround for Clang bug) - kdig: Record correct dnstap SocketProtocol when retrying over TCP - kdig: Hide TSIG section with +noall - Do not set AA flag for AXFR/IXFR queries Features: --------- - DNSSEC: separate library, switch to GnuTLS, new utilities - DNSSEC: basic KASP support (generate initial keys, ZSK rollover) - Configuration: New text format in YAML, binary store in LMDB - Zone parser: Split long TXT/SPF strings into multiple strings - kdig: Add generic dump style option (+generic) - Try all master servers in multi-master environment - Improved remotes and ACLs (multiple addresses, multiple keys) - Basic support for zone file patterns (%s to substitute zone name) - Disable zone file synchronization by setting 'zonefile_sync' to '-1' - knsupdate: Add input prompt in interactive mode and 'quit' command - knsupdate: Allow TSIG algorithm specification in interactive prompt Improvements: ------------- - Zone dump: Do not write class for SOA record (unified with other RR types) - Zone dump: Do not write master server address into the zone file - Documentation: Manual pages are included in HTML and PDF
2015-06-30fix rc scriptpettai2-8/+8
generated by cgit v1.2.3 (git 2.39.1) at 2025-04-20 03:51:28 +0000