@ -1,112 +1,76 @@
%global _hardened_build 1
%{!?_pkgdocdir: %global _pkgdocdir %{_docdir} /%{name} }
%{!?_pkgdocdir: %global _pkgdocdir %{_docdir} /%{name} -%{version} }
%define GPG_CHECK 1
%define VERSION 2.7.4
%define repodir %{_builddir}/%{name}-%{version}
Summary : High-performance authoritative DNS server
Name : knot
Version : %{VERSION}
Release : 1%{?dist}
License : GPLv3
Group : System Environment/Daemons
URL : https://www.knot-dns.cz
Source0 : https://public.nic.cz/files/knot-dns/%{name} -%{version} .tar.xz
%if 0%{GPG_CHECK}
Source1 : https://public.nic.cz/files/knot-dns/%{name} -%{version} .tar.xz.asc
# PGP keys used to sign upstream releases
# Export with --armor using command from https://fedoraproject.org/wiki/PackagingDrafts:GPGSignatures
# Don't forget to update %%prep section when adding/removing keys
Source100 : gpgkey-742FA4E95829B6C5EAC6B85710BB7AF6FEBBD6AB.gpg.asc
BuildRequires : gnupg2
%endif
Summary : High-performance authoritative DNS server
Name : knot
Version : 2.4.5
Release : 1%{?dist}
License : GPLv3
Group : System Environment/Daemons
URL : http://www.knot-dns.cz
Source0 : http://public.nic.cz/files/knot-dns/%{name} -%{version} .tar.xz
Source1 : http://public.nic.cz/files/knot-dns/%{name} -%{version} .tar.xz.asc
Source2 : %{name} .service
Source3 : %{name} .conf
Source4 : %{name} .tmpfiles
# Required dependencies
BuildRequires : gcc
BuildRequires : pkgconfig(liburcu)
BuildRequires : pkgconfig(gnutls) >= 3.3
BuildRequires : pkgconfig(libedit)
BuildRequires : pkgconfig(liburcu) pkgconfig(gnutls) >= 3.0 pkgconfig(nettle) pkgconfig(jansson) lmdb-devel pkgconfig(libedit)
# Optional dependencies
BuildRequires : pkgconfig(libcap-ng)
BuildRequires : pkgconfig(libfstrm)
BuildRequires : pkgconfig(libidn2)
BuildRequires : pkgconfig(libmaxminddb)
BuildRequires : pkgconfig(libprotobuf-c)
BuildRequires : pkgconfig(libsystemd)
BuildRequires : pkgconfig(systemd)
BuildRequires : pkgconfig(libcap-ng) pkgconfig(libidn) pkgconfig(libsystemd) pkgconfig(libfstrm) pkgconfig(libprotobuf-c)
# Distro-dependent dependencies
%if 0%{?suse_version}
BuildRequires : python3-Sphinx
BuildRequires : lmdb-devel
BuildRequires : protobuf-c
Requires(pre) : pwdutils
%endif
%if 0%{?rhel}
BuildRequires : python-sphinx
BuildRequires : lmdb-devel
%endif
%if 0%{?fedora}
BuildRequires : python3-sphinx
BuildRequires : pkgconfig(lmdb)
%endif
BuildRequires : systemd
Requires(post) : systemd %{_sbindir} /runuser
Requires(preun) : systemd
Requires(postun) : systemd
Requires(post) : systemd %{_sbindir} /runuser
Requires(preun) : systemd
Requires(postun) : systemd
# Knot DNS 2.7+ isn't compatible with earlier knot-resolver
Conflicts : knot-resolver < 3.0.0
Requires : %{name} -libs%{?_isa} = %{version} -%{release}
Requires : %{name} -libs%{?_isa} = %{version} -%{release}
%description
Knot DNS is a high-performance authoritative DNS server implementation.
%package libs
Summary : Libraries used by the Knot DNS server and client applications
Summary : Libraries used by the Knot DNS server and client applications
%description libs
The package contains shared libraries used by the Knot DNS server and
utilities.
%package devel
Summary : Development header files for the Knot DNS libraries
Requires : %{name} -libs%{?_isa} = %{version} -%{release}
Summary : Development header files for the Knot DNS libraries
Requires : %{name} -libs%{?_isa} = %{version} -%{release}
%description devel
The package contains development header files for the Knot DNS libraries
included in knot-libs package.
%package utils
Summary : DNS client utilities shipped with the Knot DNS server
Requires : %{name} -libs%{?_isa} = %{version} -%{release}
Summary : DNS client utilities shipped with the Knot DNS server
Requires : %{name} -libs%{?_isa} = %{version} -%{release}
%description utils
The package contains DNS client utilities shipped with the Knot DNS server.
%package doc
Summary : Documentation for the Knot DNS server
License : GPLv3 and BSD and MIT
BuildArch : noarch
Provides : bundled(jquery) = 3.1.0
Summary : Documentation for the Knot DNS server
License : GPLv3 and BSD and MIT
BuildArch : noarch
%if 0%{?rhel}
BuildRequires : python-sphinx
%else
BuildRequires : python3-sphinx
%endif
Provides : bundled(jquery)
%description doc
The package contains documentation for the Knot DNS server.
On-line version is available on https://www.knot-dns.cz/documentation/
%prep
%if 0%{GPG_CHECK}
export GNUPGHOME=./gpg-keyring
mkdir ${GNUPGHOME}
gpg2 --import %{SOURCE100}
gpg2 --verify %{SOURCE1} %{SOURCE0}
%endif
%setup -q
# make sure embedded LMDB library is not used
rm -vr src/contrib/lmdb
%build
# disable debug code (causes unused warnings)
CFLAGS=" %{optflags} - D N D E B U G - W n o - u n u s e d "
@ -114,19 +78,10 @@ CFLAGS="%{optflags} -DNDEBUG -Wno-unused"
%ifarch armv7hl i686
# 32-bit architectures sometimes do not have sufficient amount of
# contiguous address space to handle default values
%define configure_db_sizes --with-conf-mapsize=64
%define configure_db_sizes --with-conf-mapsize=64 --with-timer-mapsize=16
%endif
%configure \
--sysconfdir=/etc \
--localstatedir=/var/lib \
--libexecdir=/usr/lib/knot \
--with-rundir=/run/knot \
--with-storage=/var/lib/knot \
%{?configure_db_sizes} \
--disable-static \
--enable-dnstap=yes \
--with-module-dnstap=yes
%configure %{configure_db_sizes}
make %{?_smp_mflags}
make html
@ -134,89 +89,86 @@ make html
make install DESTDIR=%{buildroot}
# install documentation
install -d -m 0755 %{buildroot} %{_pkgdocdir} /samples
install -p -m 0644 -t %{buildroot} %{_pkgdocdir} /samples samples/*.zone*
install -p -m 0644 NEWS README %{buildroot} %{_pkgdocdir}
mkdir -p %{buildroot} %{_pkgdocdir}
cp -av doc/_build/html %{buildroot} %{_pkgdocdir}
[ -r %{buildroot} %{_pkgdocdir} /html/index.html ] || exit 1
rm -f %{buildroot} %{_pkgdocdir} /html/.buildinfo
# install configuration file
rm %{buildroot} %{_sysconfdir} /%{name} /*
install -p -m 0644 -D %{repodir} /samples/%{name} .sample.conf %{buildroot} %{_sysconfdir} /%{name} /%{name} .conf
# install shell completion scripts
install -p -m 0644 -D samples/keymgr-completion.sh %{buildroot} %{_datadir} /bash-completion/completions/keymgr
install -p -m 0644 -D samples/keymgr-completion.zsh %{buildroot} %{_datadir} /zsh/site-functions/_keymgr
# install systemd files
install -p -m 0644 -D %{repodir} /distro/common/%{name} .service %{buildroot} %{_unitdir} /%{name} .service
install -p -m 0644 -D %{repodir} /distro/common/%{name} .tmpfiles %{buildroot} %{_tmpfilesdir} /%{name} .conf
# install customized configuration file
rm %{buildroot} %{_sysconfdir} /%{name} /*
install -p -m 0644 -D %{SOURCE3} %{buildroot} %{_sysconfdir} /%{name} /%{name} .conf
# install service file and create rundir
install -p -m 0644 -D %{SOURCE2} %{buildroot} %{_unitdir} /%{name} .service
install -p -m 0644 -D %{SOURCE4} %{buildroot} %{_tmpfilesdir} /%{name} .conf
install -d -m 0755 %{buildroot} %{_localstatedir} /run/%{name}
# create storage dir and key dir
install -d %{buildroot} %{_sharedstatedir}
install -d -m 0775 -D %{buildroot} %{_sharedstatedir} /%{name}
install -d -m 0770 -D %{buildroot} %{_sharedstatedir} /%{name} /keys
mkdir -p %{buildroot} %{_sharedstatedir}
install -d -m 0775 %{buildroot} %{_sharedstatedir} /%{name}
install -d -m 0770 %{buildroot} %{_sharedstatedir} /%{name} /keys
# remove libarchive files
find %{buildroot} -type f -name " * . l a " -delete -print
# install config samples into docdir
install -d -m 0755 %{buildroot} %{_pkgdocdir} /samples
for sample_file in knot.sample.conf example.com.zone; do
install -p -m 0644 samples/${sample_file} %{buildroot} %{_pkgdocdir} /samples
done
# remove static libraries and libarchive files
rm %{buildroot} %{_libdir} /*.a
rm %{buildroot} %{_libdir} /*.la
%check
make check
%pre
getent group knot >/dev/null || groupadd -r knot
getent passwd knot >/dev/null || \
useradd -r -g knot -d %{_sysconfdir} /knot -s /sbin/nologin \
-c " K n o t D N S s e r v e r " knot
%if 0%{?suse_version}
%service_add_pre knot.service
%endif
getent passwd knot >/dev/null || useradd -r -g knot -d %{_sysconfdir} /knot -s /sbin/nologin -c " K n o t D N S s e r v e r " knot
exit 0
%post
systemd-tmpfiles --create %{_tmpfilesdir} /knot.conf &>/dev/null || :
%if 0%{?suse_version}
%service_add_post knot.service
%else
%systemd_post knot.service
%endif
# initialize/upgrade KASP database
%{_sbindir} /runuser -u knot -- %{_sbindir} /keymgr --dir %{_sharedstatedir} /%{name} /keys --legacy init
%preun
%if 0%{?suse_version}
%service_del_preun knot.service
%else
%systemd_preun knot.service
%endif
%postun
%if 0%{?suse_version}
%service_del_postun knot.service
%else
%systemd_postun_with_restart knot.service
%endif
%post libs -p /sbin/ldconfig
%postun libs -p /sbin/ldconfig
%files
%license COPYING
%{_pkgdocdir} /NEWS
%{_pkgdocdir} /README
%{_pkgdocdir} /samples
%dir %attr (750,root,knot) %{_sysconfdir} /%{name}
%config (noreplace) %attr (640,root,knot) %{_sysconfdir} /%{name} /%{name} .conf
%dir %attr (775,root,knot) %{_sharedstatedir} /%{name}
%dir %attr (770,root,knot) %{_sharedstatedir} /%{name} /keys
%{_unitdir} /knot.service
%dir %attr (-,knot,knot) %{_localstatedir} /run/%{name}
%{_unitdir} /%{name} .service
%{_tmpfilesdir} /%{name} .conf
%{_libexecdir} /knot1to2
%{_bindir} /kjournalprint
%{_bindir} /kzonecheck
%{_sbindir} /kjournalprint
%{_sbindir} /keymgr
%{_sbindir} /knotc
%{_sbindir} /knotd
%{_mandir} /man1/knot1to2.*
%{_mandir} /man1/kjournalprint.*
%{_mandir} /man1/kzonecheck.*
%{_mandir} /man5/knot.conf.*
%{_mandir} /man8/kjournalprint.*
%{_mandir} /man8/keymgr.*
%{_mandir} /man8/knotc.*
%{_mandir} /man8/knotd.*
%{_datadir} /bash-completion/completions/keymgr
%{_datadir} /zsh/site-functions/_keymgr
%files utils
%{_bindir} /kdig
@ -229,22 +181,18 @@ systemd-tmpfiles --create %{_tmpfilesdir}/knot.conf &>/dev/null || :
%{_mandir} /man1/knsupdate.*
%files libs
%license COPYING
%doc NEWS
%doc README
%doc COPYING AUTHORS NEWS THANKS
%{_libdir} /libdnssec.so.*
%{_libdir} /libknot.so.*
%{_libdir} /libzscanner.so.*
%files devel
%{_includedir} /libdnssec
%{_includedir} /knot
%{_includedir} /dnssec
%{_includedir} /libknot
%{_includedir} /lib zscanner
%{_includedir} /zscanner
%{_libdir} /libdnssec.so
%{_libdir} /libknot.so
%{_libdir} /libzscanner.so
%{_libdir} /pkgconfig/knotd.pc
%{_libdir} /pkgconfig/libdnssec.pc
%{_libdir} /pkgconfig/libknot.pc
%{_libdir} /pkgconfig/libzscanner.pc
@ -254,487 +202,6 @@ systemd-tmpfiles --create %{_tmpfilesdir}/knot.conf &>/dev/null || :
%{_pkgdocdir} /html
%changelog
* Tue Nov 13 2018 Tomas Krizek <tomas.krizek@nic.cz> - 2.7.4-1
Knot DNS 2.7.4 (2018-11-13)
===========================
Features:
---------
- Added SNI configuration for TLS in kdig (Thanks to Alexander Schultz)
Improvements:
-------------
- Added warning log when DNSSEC events not successfully scheduled
- New semantic check on timer values in keymgr
- DS query no longer asks other addresses if got a negative answer
- Reintroduced 'rollover' configuration option for CDS/CDNSKEY publication
- Extended logging for zone loading
- Various documentation improvements
Bugfixes:
---------
- Failed to import module configuration #613
- Improper Cflags value in libknot.pc if built with embedded LMDB #615
- IXFR doesn't fall back to AXFR if malformed reply
- DNSSEC events not correctly scheduled for empty zone updates
- During algorithm rollover old keys get removed before DS TTL expires #617
- Maximum zone's RRSIG TTL not considered during algorithm rollover #620
* Fri Oct 12 2018 Tomas Krizek <tomas.krizek@nic.cz> - 2.7.3-1
Knot DNS 2.7.3 (2018-10-11)
===========================
Features:
---------
- New queryacl module for query access control
- Configurable answer rrset rotation #612
- Configurable NSEC bitmap in online signing
Improvements:
-------------
- Better error logging for KASP DB operations #601
- Some documentation improvements
Bugfixes:
---------
- Keymgr " l i s t " output doesn't show key size for ECDSA algorithms #602
- Failed to link statically with embedded LMDB
- Configuration commit causes zone reload for all zones
- The statistics module overlooks TSIG record in a request
- Improper processing of an AXFR-style-IXFR response consisting of one-record messages
- Race condition in online signing during key rollover #600
- Server can crash if geoip module is enabled in the geo mode
* Wed Aug 29 2018 Tomas Krizek <tomas.krizek@nic.cz> - 2.7.2-1
Knot DNS 2.7.2 (2018-08-29)
===========================
Improvements:
-------------
- Keymgr list command displays also key size
- Kjournalprint displays total occupied size in the debug mode
- Server doesn't stop if failed to load a shared module from the module directory
- Libraries libcap-ng, pthread, and dl are linked selectively if needed
Bugfixes:
---------
- Sometimes incorrect result from dnssec_nsec_bitmap_contains (libdnssec)
- Server can crash when loading zone file difference and zone-in-journal is set
- Incorrect treatment of specific queries in the module RRL
- Failed to link module Cookies as a shared library
* Wed Aug 15 2018 Tomas Krizek <tomas.krizek@nic.cz> - 2.7.1-1
Knot DNS 2.7.1 (2018-08-14)
===========================
Improvements:
-------------
- Added zone wire size information to zone loading log message
- Added debug log message for each unsuccessful remote address operation
- Various improvements for packaging
Bugfixes:
---------
- Incompatible handling of RRSIG TTL value when creating a DNS message
- Incorrect RRSIG TTL value in zone differences and knotc zone operation outputs
- Default configure prefix is ignored
Knot DNS 2.7.0 (2018-08-03)
===========================
Features:
---------
- New DNS Cookies module and related '+cookie' kdig option
- New module for response tailoring according to client's subnet or geographic location
- General EDNS Client Subnet support in the server
- OSS-Fuzz integration (Thanks to Jonathan Foote)
- New '+ednsopt' kdig option (Thanks to Jan Včelák)
- Online Signing support for automatic key rollover
- Non-normal file (e.g. pipe) loading support in zscanner #542
- Automatic SOA serial incrementation if non-empty zone difference
- New zone file load option for ignoring zone file's SOA serial
- New build-time option for alternative malloc specification
- Structured logging for DNSSEC key submission event
- Empty QNAME support in kdig
Improvements:
-------------
- Various library and server optimizations
- Reduced memory consumption of outgoing IXFR processing
- Linux capabilities use overhaul #546 (Thanks to Robert Edmonds)
- Online Signing properly signs delegations and CNAME records
- CDS/CDNSKEY rrset is signed with KSK instead of ZSK
- DNSSEC-related records are ignored when loading zone difference with signing enabled
- Minimum allowed RSA key length was increased to 1024
- Removed explicit dependency on Nettle
Bugfixes:
---------
- Possible uninitialized address buffer use in zscanner
- Possible index overflow during multiline record parsing in zscanner
- kdig +tls sometimes consumes 100 % CPU #561
- Single-Type Signing doesn't work with single ZSK key #566
- Zone not flushed after re-signing during zone load #594
- Server crashes when committing empty zone transaction
- Incoming IXFR with on-slave signing sometimes leads to memory corruption #595
Compatibility:
--------------
- Removed obsolete RRL configuration
- Removed obsolete module names 'mod-online-sign' and 'mod-synth-record'
- Removed obsolete 'ixfr-from-differences' configuration option
- Removed old journal migration
- Removed module rosedb
* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.6.8-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
* Wed Jul 11 2018 Tomas Krizek <tomas.krizek@nic.cz> - 2.6.8-1
Knot DNS 2.6.8 (2018-07-10)
===========================
Features:
---------
- New 'import-pkcs11' command in keymgr
Improvements:
-------------
- Unixtime serial policy mimics Bind – increment if lower #593
Bugfixes:
---------
- Creeping memory consuption upon server reload #584
- Kdig incorrectly detects QNAME if 'notify' is a prefix
- Server crashes when zone sign fails #587
- CSK->KZSK rollover retires CSK early #588
- Server crashes when zone expires during outgoing multi-message transfer
- Kjournalprint doesn't convert zone name argument to lower-case
- Cannot switch to a previously used ksk-shared dnssec policy #589
* Thu May 17 2018 Tomas Krizek <tomas.krizek@nic.cz> - 2.6.7-1
Knot DNS 2.6.7 (2018-05-17)
===========================
Features:
---------
- Added 'dateserial' (YYYYMMDDnn) serial policy configuration (Thanks to Wolfgang Jung)
Improvements:
-------------
- Trailing data indication from the packet parser (libknot)
- Better configuration check for a problematical option combination
Bugfixes:
---------
- Incomplete configuration option item name check
- Possible buffer overflow in 'knot_dname_to_str' (libknot)
- Module dnsproxy doesn't preserve letter case of QNAME
- Module dnsproxy duplicates OPT and TSIG in the non-fallback mode
* Wed Apr 11 2018 Tomas Krizek <tomas.krizek@nic.cz> - 2.6.6-1
Knot DNS 2.6.6 (2018-04-11)
===========================
Features:
---------
- New EDNS option counters in the statistics module
- New '+orphan' filter for the 'zone-purge' operation
Improvements:
-------------
- Reduced memory consuption of disabled statistics metrics
- Some spelling fixes (Thanks to Daniel Kahn Gillmor)
- Server no longer fails to start if MODULE_DIR doesn't exist
- Configuration include doesn't fail if empty wildcard match
- Added a configuration check for a problematical option combination
Bugfixes:
---------
- NSEC3 chain not re-created when SOA minimum TTL changed
- Failed to start server if no template is configured
- Possibly incorrect SOA serial upon changed zone reload with DNSSEC signing
- Inaccurate outgoing zone transfer size in the log message
- Invalid dname compression if empty question section
- Missing EDNS in EMALF responses
* Mon Mar 26 2018 Iryna Shcherbina <ishcherb@redhat.com> - 2.6.5-2
- Update Python 2 dependency declarations to new packaging standards
(See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3)
* Mon Feb 12 2018 Tomas Krizek <tomas.krizek@nic.cz> - 2.6.5-1
- New upstream release 2.6.5
Knot DNS 2.6.5 (2018-02-12)
===========================
Features:
---------
- New 'zone-notify' command in knotc
- Kdig uses '@server' as a hostname for TLS authenticaion if '+tls-ca' is set
Improvements:
-------------
- Better heap memory trimming for zone operations
- Added proper polling for TLS operations in kdig
- Configuration export uses stdout as a default output
- Simplified detection of atomic operations
- Added '--disable-modules' configure option
- Small documentation updates
Bugfixes:
---------
- Zone retransfer doesn't work well if more masters configured
- Kdig can leak or double free memory in corner cases
- Inconsistent error outputs from dynamic configuration operations
- Failed to generate documentation on OpenBSD
* Fri Feb 09 2018 Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 2.6.4-3
- Escape macros in %%changelog
* Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.6.4-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
* Mon Jan 22 2018 Tomas Krizek <tomas.krizek@nic.cz> - 2.6.4-1
- Added PGP signature verification
- Added integration test
- New upstream release 2.6.4
Knot DNS 2.6.4 (2018-01-02)
===========================
Features:
---------
- Module synthrecord allows multiple 'network' specification
- New CSK handling support in keymgr
Improvements:
-------------
- Allowed configuration for infinite zsk lifetime
- Increased performance and security of the module synthrecord
- Signing changeset is stored into journal even if 'zonefile-load' is whole
Bugfixes:
---------
- Unintentional zone re-sign during reload if empty NSEC3 salt
- Inconsistent zone names in journald structured logs
- Malformed outgoing transfer for big zone with TSIG
- Some minor DNSSEC-related issues
Knot DNS 2.6.3 (2017-11-24)
===========================
Bugfixes:
---------
- Wrong detection of signing scheme rollover
Knot DNS 2.6.2 (2017-11-23)
===========================
Features:
---------
- CSK algorithm rollover and (KSK, ZSK) <-> CSK rollover support
Improvements:
-------------
- Allowed explicit configuration for infinite ksk lifetime
- Proper error messages instead of unclear error codes in server log
- Better support for old compilers
Bugfixes:
---------
- Unexpected reply for DS query with an owner below a delegation point
- Old dependencies in the pkg-config file
* Mon Nov 06 2017 Petr Špaček <petr.spacek@nic.cz> - 2.6.1-1
- New upstream release 2.6.1
Knot DNS 2.6.1 (2017-11-02)
===========================
Features:
---------
- NSEC3 Opt-Out support in the DNSSEC signing
- New CDS/CDNSKEY publish configuration option
Improvements:
-------------
- Simplified DNSSEC log message with DNSKEY details
- +tls-hostname in kdig implies +tls-ca if neither +tls-ca nor +tls-pin is given
- New documentation sections for DNSSEC key rollovers and shared keys
- Keymgr no longer prints useless algorithm number for generated key
- Kdig prints unknown RCODE in a numeric format
- Better support for LLVM libFuzzer
Bugfixes:
---------
- Faulty DNAME semantic check if present in the zone apex and NSEC3 is used
- Immediate zone flush not scheduled during the zone load event
- Server crashes upon dynamic zone addition if a query module is loaded
- Kdig fails to connect over TLS due to SNI is set to server IP address
- Possible out-of-bounds memory access at the end of the input
- TCP Fast Open enabled by default in kdig breaks TLS connection
Knot DNS 2.6.0 (2017-09-29)
===========================
Features:
---------
- On-slave (inline) signing support
- Automatic DNSSEC key algorithm rollover
- Ed25519 algorithm support in DNSSEC (requires GnuTLS 3.6.0)
- New 'journal-content' and 'zonefile-load' configuration options
- keymgr tries to run as user/group set in the configuration
- Public-only DNSSEC key import into KASP DB via keymgr
- NSEC3 resalt and parent DS query events are persistent in timer DB
- New processing state for a response suppression within a query module
- Enabled server side TCP Fast Open if supported
- TCP Fast Open support in kdig
Improvements:
-------------
- Better record owner compression if related to the previous rdata dname
- NSEC(3) chain is no longer recomputed whole on every update
- Remove inconsistent and unnecessary quoting in log files
- Avoiding of overlapping key rollovers at a time
- More DNSSSEC-related semantic checks
- Extended timestamp format in keymgr
Bugfixes:
---------
- Incorrect journal free space computation causing inefficient space handling
- Interface-automatic broken on Linux in the presence of asymmetric routing
Knot DNS 2.5.5 (2017-09-29)
===========================
Improvements:
-------------
- Constant time memory comparison in the TSIG processing
- Proper use of the ctype functions
- Generated RRSIG records have inception time 90 minutes in the past
Bugfixes:
---------
- Incorrect online signature for NSEC in the case of a CNAME record
- Incorrect timestamps in dnstap records
- EDNS Subnet Client validation rejects valid payloads
- Module configuration semantic checks are not executed
- Kzonecheck segfaults with unusual inputs
Knot DNS 2.5.4 (2017-08-31)
===========================
Improvements:
-------------
- New minimum and maximum refresh interval config options (Thanks to Manabu Sonoda)
- New warning when unforced flush with disabled zone file synchronization
- New 'dnskey' keymgr command
- Linking with libatomic on architectures that require it (Thanks to Pierre-Olivier Mercier)
- Removed 'OK' from listing keymgr command outputs
- Extended journal and keymgr documentation and logging
Bugfixes:
---------
- Incorrect handling of specific corner-cases with zone-in-journal
- The 'share' keymgr command doesn't work
- Server crashes if configured with query-size and reply-size statistics options
- Malformed big integer configuration values on some 32-bit platforms
- Keymgr uses local time when parsing date inputs
- Memory leak in kdig upon IXFR query
* Mon Jul 31 2017 Petr Spacek <petr.spacek@nic.cz> - 2.5.3-1
- new upstream release
WARNING: Automatic upgrade from versions 1.y.z is no longer possible.
To migrate, upgrade your packages gradually or use contacts listed on
https://www.knot-dns.cz/support/ (if you are in trouble).
Knot DNS 2.5.3 (2017-07-14)
===========================
Features:
---------
- CSK rollover support for Single-Type Signing Scheme
Improvements:
-------------
- Allowed binding to non-local adresses for TCP (Thanks to Julian Brost!)
- New documentation section for manual DNSSEC key algorithm rollover
- Initial KSK also generated in the submission state
- The 'ds' keymgr command with no parameter uses all KSK keys
- New debug mode in kjournalprint
- Updated keymgr documentation
Bugfixes:
---------
- Sometimes missing RRSIG by KSK in submission state.
- Minor DNSSEC-related issues
Knot DNS 2.5.2 (2017-06-23)
===========================
Security:
---------
- CVE-2017-11104: Improper TSIG validity period check can allow TSIG forgery (Thanks to Synacktiv!)
Improvements:
-------------
- Extended debug logging for TSIG errors
- Better error message for unknown module section in the configuration
- Module documentation compilation no longer depends on module configuration
- Extended policy section configuration semantic checks
- Improved python version compatibility in pykeymgr
- Extended migration section in the documentation
- Improved DNSSEC event timing on 32-bit systems
- New KSK rollover start log info message
- NULL qtype support in kdig
Bugfixes:
---------
- Failed to process included configuration
- dnskey_ttl policy option in the configuration has no effect on DNSKEY TTL
- Corner case journal fixes (huge changesets, OpenWRT operation)
- Confusing event timestamps in knotc zone-status output
- NSEC/NSEC3 bitmap not updated for CDS/CDNSKEY
- CDS/CDNSKEY RRSIG not updated
Knot DNS 2.5.1 (2017-06-07)
===========================
Bugfixes:
---------
- pykeymgr no longer crash on empty json files in the KASP DB directory
- pykeymgr no longer imports keys in the " r e m o v e d " state
- Imported keys in the " r e m o v e d " state no longer makes knotd to crash
- Including an empty configuration directory no longer makes knotd to crash
- pykeymgr is distributed and installed to the distribution tarball
Knot DNS 2.5.0 (2017-06-05)
===========================
Features:
---------
- KASP database switched from JSON files to LMDB database
- KSK rollover support using CDNSKEY and CDS in the automatic DNSSEC signing
- Dynamic module loading support with proper module API
- Journal can store full zone contents (not only differences)
- Zone freeze/thaw support
- Updated knotc zone-status output with optional column filters
- New '[no]crypto' option in kdig
- New keymgr implementation reflecting KASP database changes
- New pykeymgr for JSON-based KASP database migration
- Removed obsolete knot1to2 utility
Improvements:
-------------
- Added libidn2 support to kdig (with libidn fallback)
- Maximum timer database switched from configure to the server configuration
* Wed Jul 26 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.5-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
* Mon Jul 10 2017 Petr Spacek <petr.spacek@nic.cz> - 2.4.5-1
New upstream release: 2.4.5
@ -863,7 +330,7 @@ Bugfixes:
+ fix: knsupdate prompt printing on non-terminal
+ fix: configuration policy item names in documentation
+ fix: segfault on OS X Sierra
+ fix: incorrect %% s expansion for the root zone
+ fix: incorrect %s expansion for the root zone
+ fix: refresh not existing slave zone after restart
+ fix: immediate zone refresh upon restart if refresh already scheduled
+ fix: early zone transfer after restart if transfer already scheduled
@ -1035,7 +502,7 @@ Bugfixes:
+ feature: kdig, add generic dump style option (+generic)
+ feature: try all master servers on failure in multi-master environment
+ feature: improved remotes and ACLs (multiple addresses, multiple keys)
+ feature: basic support for zone file patterns (%% s to substitute zone name)
+ feature: basic support for zone file patterns (%s to substitute zone name)
+ improvement: do not write class for SOA record (unified with other RR types)
+ improvement: do not write master server address into the zone file
+ documentation: manual pages also in HTML and PDF format