%global _hardened_build 1 %{!?_pkgdocdir: %global _pkgdocdir %{_docdir}/%{name}-%{version}} Summary: High-performance authoritative DNS server Name: knot Version: 2.4.1 Release: 2%{?dist} License: GPLv3 Group: System Environment/Daemons URL: http://www.knot-dns.cz Source0: http://public.nic.cz/files/knot-dns/%{name}-%{version}.tar.xz Source1: http://public.nic.cz/files/knot-dns/%{name}-%{version}.tar.xz.asc Source2: %{name}.init Source3: %{name}.conf Patch0: sphinx_theme_default.patch # Required dependencies BuildRequires: gnutls30-devel >= 3.3 BuildRequires: pkgconfig(liburcu) pkgconfig(jansson) lmdb-devel pkgconfig(libedit) # Optional dependencies BuildRequires: pkgconfig(libcap-ng) pkgconfig(libidn) # fstrm is not available in EPEL6 so Dnstap support cannot be built Requires(post): /bin/su Requires: %{name}-libs%{?_isa} = %{version}-%{release} Obsoletes: %{name} < 2.0.0 %description Knot DNS is a high-performance authoritative DNS server implementation. %package libs Summary: Libraries used by the Knot DNS server and client applications Obsoletes: %{name} < 2.0.0 Conflicts: %{name} < 2.0.0 %description libs The package contains shared libraries used by the Knot DNS server and utilities. %package devel Summary: Development header files for the Knot DNS libraries Requires: %{name}-libs%{?_isa} = %{version}-%{release} Obsoletes: %{name} < 2.0.0 %description devel The package contains development header files for the Knot DNS libraries included in knot-libs package. %package utils Summary: DNS client utilities shipped with the Knot DNS server Requires: %{name}-libs%{?_isa} = %{version}-%{release} Obsoletes: %{name} < 2.0.0 %description utils The package contains DNS client utilities shipped with the Knot DNS server. %package doc Summary: Documentation for the Knot DNS server License: GPLv3 and BSD and MIT Obsoletes: %{name} < 2.0.0 BuildArch: noarch %if 0%{?rhel} BuildRequires: python-sphinx %else BuildRequires: python3-sphinx %endif Provides: bundled(jquery) %description doc The package contains documentation for the Knot DNS server. %prep %setup -q %patch0 -p1 # make sure embedded LMDB library is not used rm -vr src/contrib/lmdb %build # disable debug code (causes unused warnings) CFLAGS="%{optflags} -DNDEBUG -Wno-unused" %ifarch armv7hl i686 # 32-bit architectures sometimes do not have sufficient amount of # contiguous address space to handle default values %define configure_db_sizes --with-conf-mapsize=64 --with-timer-mapsize=16 %endif export PKG_CONFIG_PATH=%{_libdir}/gnutls30/pkgconfig %configure %{configure_db_sizes} make %{?_smp_mflags} make html %install make install DESTDIR=%{buildroot} # install documentation mkdir -p %{buildroot}%{_pkgdocdir} cp -av doc/_build/html %{buildroot}%{_pkgdocdir} [ -r %{buildroot}%{_pkgdocdir}/html/index.html ] || exit 1 rm -f %{buildroot}%{_pkgdocdir}/html/.buildinfo # install shell completion scripts install -p -m 0644 -D samples/keymgr-completion.sh %{buildroot}%{_datadir}/bash-completion/completions/keymgr install -p -m 0644 -D samples/keymgr-completion.zsh %{buildroot}%{_datadir}/zsh/site-functions/_keymgr # install customized configuration file rm %{buildroot}%{_sysconfdir}/%{name}/* install -p -m 0644 -D %{SOURCE3} %{buildroot}%{_sysconfdir}/%{name}/%{name}.conf # install service file and create rundir install -p -m 0755 -D %{SOURCE2} %{buildroot}%{_initddir}/%{name} install -d -m 0755 %{buildroot}%{_localstatedir}/run/%{name} # create storage dir and key dir mkdir -p %{buildroot}%{_sharedstatedir} install -d -m 0775 %{buildroot}%{_sharedstatedir}/%{name} install -d -m 0770 %{buildroot}%{_sharedstatedir}/%{name}/keys # install config samples into docdir install -d -m 0755 %{buildroot}%{_pkgdocdir}/samples for sample_file in knot.sample.conf example.com.zone; do install -p -m 0644 samples/${sample_file} %{buildroot}%{_pkgdocdir}/samples done # remove static libraries and libarchive files rm %{buildroot}%{_libdir}/*.a rm %{buildroot}%{_libdir}/*.la %check make check %pre getent group knot >/dev/null || groupadd -r knot getent passwd knot >/dev/null || useradd -r -g knot -d %{_sysconfdir}/knot -s /sbin/nologin -c "Knot DNS server" knot if [ $1 -gt 1 ] ; then # upgrade, try to detect versions 1.x if rpm -q --qf=%%{version} knot | grep -q "^1\." ; then touch %{_localstatedir}/lib/knot/knot.1x.upgrade fi fi exit 0 %post /sbin/ldconfig /sbin/chkconfig --add %{name} # initialize/upgrade KASP database /bin/su --login -s /bin/sh knot -c "%{_sbindir}/keymgr --dir %{_sharedstatedir}/%{name}/keys --legacy init" if [ -e %{_localstatedir}/lib/knot/knot.1x.upgrade ] ; then # upgrading from Knot 1.x, convert config file cp /etc/knot/knot.conf /etc/knot/knot.conf.1x.rpmsave rm %{_localstatedir}/lib/knot/knot.1x.upgrade %{_libexecdir}/knot1to2 -i /etc/knot/knot.conf.1x.rpmsave -o /etc/knot/knot.conf fi %preun if [ $1 -eq 0 ] ; then /sbin/service %{name} stop >/dev/null 2>&1 /sbin/chkconfig --del %{name} fi %postun /sbin/ldconfig if [ "$1" -ge "1" ] ; then /sbin/service %{name} condrestart >/dev/null 2>&1 || : fi %files %{_initddir}/%{name} %{_pkgdocdir}/samples %dir %attr(750,root,knot) %{_sysconfdir}/%{name} %config(noreplace) %attr(640,root,knot) %{_sysconfdir}/%{name}/%{name}.conf %dir %attr(775,root,knot) %{_sharedstatedir}/%{name} %dir %attr(770,root,knot) %{_sharedstatedir}/%{name}/keys %dir %attr(-,knot,knot) %{_localstatedir}/run/%{name} %{_libexecdir}/knot1to2 %{_bindir}/kjournalprint %{_bindir}/kzonecheck %{_sbindir}/keymgr %{_sbindir}/knotc %{_sbindir}/knotd %{_mandir}/man1/knot1to2.* %{_mandir}/man1/kjournalprint.* %{_mandir}/man1/kzonecheck.* %{_mandir}/man5/knot.conf.* %{_mandir}/man8/keymgr.* %{_mandir}/man8/knotc.* %{_mandir}/man8/knotd.* %{_datadir}/bash-completion/completions/keymgr %{_datadir}/zsh/site-functions/_keymgr %files utils %{_bindir}/kdig %{_bindir}/khost %{_bindir}/knsec3hash %{_bindir}/knsupdate %{_mandir}/man1/kdig.* %{_mandir}/man1/khost.* %{_mandir}/man1/knsec3hash.* %{_mandir}/man1/knsupdate.* %files libs %doc COPYING AUTHORS NEWS THANKS %{_libdir}/libdnssec.so.* %{_libdir}/libknot.so.* %{_libdir}/libzscanner.so.* %files devel %{_includedir}/dnssec %{_includedir}/libknot %{_includedir}/zscanner %{_libdir}/libdnssec.so %{_libdir}/libknot.so %{_libdir}/libzscanner.so %{_libdir}/pkgconfig/libdnssec.pc %{_libdir}/pkgconfig/libknot.pc %{_libdir}/pkgconfig/libzscanner.pc %files doc %dir %{_pkgdocdir} %{_pkgdocdir}/html %changelog * Wed Mar 15 2017 Petr Spacek - 2.4.1-2 - fix build on 32 bit architectures * Mon Feb 27 2017 Petr Spacek - 2.4.1-1 - new upstream release 2.4.1 replaces old 1.6.x series which is not supported - configuration should be upgraded automatically using knot1to2 tool - make sure you reviewed the new configuration in /etc/knot directory! * Tue Aug 09 2016 Jan Vcelak - 1.6.8-1 - new upstream release: + feature: Zone size limit restriction for DDNS, AXFR, and IXFR (CVE-2016-6171) * Wed Feb 10 2016 Jan Vcelak 1.6.7-1 - new upstream release: + improvement: Log change of the zone serial number after IXFR transfer + improvement: Document operational impact of various RRL settings + improvement: Add support for rate-limit-slip zero + improvement: Add 'timer-db' configuration option * Wed Nov 25 2015 Jan Vcelak 1.6.6-1 - new upstream release: + security fix: out-of-bound read in packet parser for malformed NAPTR record + fix: systemd startup notifications * Wed Sep 02 2015 Jan Vcelak 1.6.5-1 - new upstream release: + fix: don't load expired zones on reload and startup + fix: remove race condition in scheduling causing delaying of events + fix: NSEC proof construction in zones with many delegations + fix: TC flag setting in RRL slipped answers + fix: disable domain name compression for root label + fix: check if executed under systemd before using journald log sink + feature: write persistent timers on server shutdown for better performance + feature: support time unit specification for 'max-conn-idle', 'max-conn-handshake', 'max-conn-reply', and 'notify-timeout' config options + feature: add 'request-edns-config' config option * Thu Jun 18 2015 Jan Vcelak 1.6.4-1 - new upstream release: + fix: lost NOTIFY message if received during zone transfer + fix: kdig, record correct dnstap SocketProtocol when retrying over TCP + fix: kdig, hide TSIG section with +noall + fix: do not set AA flag for AXFR/IXFR queries + feature: zone scanner, split long TXT/SPF strings into multiple strings + feature: kdig, add +generic dump style option + feature: try all servers on failure in multi-master environment + improvement: zone dump, do not print class for SOA record for consistency * Wed Apr 08 2015 Jan Vcelak 1.6.3-1 - new upstream release: + fix: performance drop for NSEC-signed zones + fix: proper handling of TCP short-writes + fix: possible out-of-bound reads in zone parser and packet parser + feature: CDS and CDNSKEY support in zone parser + improvement: add defaults for TCP config options into documentation + improvement: detailed error message if zone reload fails * Thu Feb 19 2015 Jan Vcelak 1.6.2-1 - new upstream release: + new config option 'max-tcp-clients' + fix possible resource leak when terminating inactive TCP clients * Tue Jan 20 2015 Jan Vcelak 1.6.1-3 - service file changes: + remove dependency on network.target + remove bounding capabilities (breaks reload) * Sat Dec 13 2014 Jan Vcelak 1.6.1-2 - new upstream release: + DNSSEC: support for Single-Type Signing Scheme + fix: journal file growing over configured limit - service file changes: + run as 'knot' user and group + set security bounding capabilities + change Type to 'notify' * Thu Oct 30 2014 Jan Vcelak 1.6.0-2 - default config: run server as unprivileged user - service file: remove useless startup dependencies - service file: add bounding capabilities * Thu Oct 23 2014 Jan Vcelak 1.6.0-1 - new upstream release: + support for persistent zone timers (expire, refresh, and flush) + DNSSEC: RFC-compliant processing of letter case in RDATA domain names + EDNS: return minimal response for queries with unsupported version + EDNS: fix interpretation of Extended RCODE + transfers: fix forced zone retransfer + timers: properly expire zone when transfer is being refused by master * Mon Sep 15 2014 Jan Vcelak 1.5.3-1 - new upstream release: + fix crash on specific incoming IXFR message + fix rare synchronization error during server reload + fix crash in reverse record synthesis module on DNSSEC signed zones + fix message ID and opcode for AXFR-style IXFR responses + fix sending of large responses to remote control commands * Mon Sep 08 2014 Jan Vcelak 1.5.2-1 - new upstream release: + CVE-2014-0486: remote crash using crafted DNS message + transfers: do not refuse AXFR answers to IXFR queries + fix storing of hash character '#' in zone file * Tue Aug 19 2014 Jan Vcelak 1.5.1-1 - new upstream release: + logging: unified logging messages + logging: support for systemd journal + DDNS: processing updates in bulk + DDNS: fix signing of responses with TSIG + DDNS: fix prerequisites checking in apex node + DNSSEC: fix domain names conversion to canonical format before signing + DNSSEC: semantic checks for signing keys + EDNS: fix inclusion of OPT record into some packets + knsupdate: fix use of zone origin for deletions * Sun Aug 17 2014 Fedora Release Engineering - 1.5.0-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild * Thu Jul 10 2014 Jan Vcelak 1.5.0-1 - update to 1.5.0 + reimplemented DDNS forwarding + transfer sizes logged in bytes + logging of outgoing/incoming NOTIFY messages + zone flush planning after bootstrap + DDNS signing changes freeing + knotc key handling - update to 1.5.0-rc2 + edns-client-subnet support in kdig + optional asynchronous startup (config 'asynchronous-start') + preempt task queue for faster reload + lazy zone file write after zone transfer (config 'zonefile-sync') + close zone transfer after SERVFAIL response + incremental to full zone transfer fallback, wrong log message + zone events corner cases, reload replanning - update to 1.5.0-rc1 + Pluggable query processing modules + Synthetic IPv4/IPv6 reverse/forward records (optional module) + Dnstap support in both utilities & server (optional module) + NOTIFY message support and new TSIG section in kdig + Multi-master support + Query processing and core functionality overhaul + Performance and reduced memory footprint + Faster zone events scheduling + RFC compliant queries/responses in some corner cases + Log messages + New documentation (Sphinx) - enabled dynamic linking - removed info pages * Wed Jun 18 2014 Jan Vcelak 1.4.7-1 - update to 1.4.7 + Fixed DDNS corner cases + Fixed zone EXPIRE timer + Fixed semantic checks false positives + Fixed sending malformed IXFR with automatic DNSSEC + Fixed NAPTR record serialization * Thu May 22 2014 Jan Vcelak 1.4.6-2 - update to 1.4.6 + DNSSEC: fix possible signing loop when doing key rollover + RRL: fixed sending of malformed UDP empty responses * Mon Apr 14 2014 Jan Vcelak 1.4.5-1 - update to 1.4.5 + fix weakness in TSIG digest checking * Thu Mar 27 2014 Jan Vcelak 1.4.4-1 - update to 1.4.4 + server is logging remote control commands + 'knotc reload' doesn't refresh unchanged zones + 'knotc -f refresh' forces zone retransfer + missing notifications after DDNS/automatic resign + zone is rebootstrapped if the zone file is unreadable + progressive bootstrap retry backoff + zone file parser allows asterisk as part of the label + journal maximum entry size fixes + sign DNSKEYs in non-apex nodes as regular RR sets + various spelling and typo fixes * Tue Feb 18 2014 Jan Vcelak 1.4.3-1 - update to 1.4.3 + DNSSEC: fixes in authenticated denial proofs + zone parser: case insensitive comparison of $ORIGIN + journal: fix corruption if zone loading fails + config: add support for includes of directories * Wed Feb 12 2014 Jan Vcelak 1.4.2-3 - rebuild with new userspace-rcu * Mon Jan 27 2014 Jan Vcelak 1.4.2-2 - enable IDN support in domain names * Mon Jan 27 2014 Jan Vcelak 1.4.2-1 - update to 1.4.2 * Mon Jan 13 2014 Jan Vcelak 1.4.1-1 - update to 1.4.1 * Mon Jan 06 2014 Jan Vcelak 1.4.0-1 - update to 1.4.0 * Fri Dec 13 2013 Jan Vcelak 1.4.0-0.2.rc2 - update to 1.4.0-rc2 * Tue Nov 26 2013 Jan Vcelak 1.4.0-0.1.rc1 - update to 1.4.0-rc1 * Tue Oct 08 2013 Jan Vcelak 1.3.2-2 - fix failing wire reading/writing tests on big endian (#1015976) * Tue Oct 01 2013 Jan Vcelak 1.3.2-1 - update to 1.3.2 + possibility to set max UDP payload in EDNS0 + fixed bug limiting payload size in some TCP responses + fixed closing of file descriptors for included files in config * Sun Sep 01 2013 Jan Vcelak 1.3.1-1 - update to 1.3.1 * Mon Jul 29 2013 Jan Vcelak 1.3.0-0.4.rc5 - update to 1.3.0-rc5 * Mon Jul 15 2013 Paul Wouters - 1.3.0-0.3.rc4 - Added Alias=knotd.service alias to service file - Added ExecStartPre=/usr/sbin/knotc checkconf to service file * Mon Jul 15 2013 Jan Vcelak 1.3.0-0.2.rc4 - update to 1.3.0-rc4 * Wed Jul 03 2013 Jan Vcelak 1.3.0-0.1.rc3 - update to 1.3.0-rc3 - update configuration - disable assertions in the code (define NDEBUG) - enable unit tests as a part of RPM build process - enable fast zone parser - fix wrong dates in changelog * Fri Apr 05 2013 Paul Wouters - 1.2.0-1 - Updated to 1.2.0-1 - Enabled hardening/relro/pie protection * Thu Feb 14 2013 Fedora Release Engineering - 1.1.3-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild * Thu Dec 20 2012 Paul Wouters - 1.1.3-2 - Use new systemd macros * Thu Dec 20 2012 Paul Wouters - 1.1.3-1 - Initial build for Fedora * Thu Nov 22 2012 Ondřej Surý - 1.1.2-1 - Update to 1.1.2 * Wed Nov 7 2012 Stanislav Petr - 1.1.1-1 - Fixed build problem - Update to 1.1.1 - Add man5 directory - Add knot.info.gz to infodir * Mon Aug 27 2012 Stanislav Petr - 1.1.0-1 - Update to 1.1.0-rc2 - Fix default knot.conf - Add build dependency to texinfo * Tue May 15 2012 Stanislav Petr - 1.0.6-2 - Try to fix compilation problem on some systems - force add -lgcc_eh to gcc flags * Sun May 13 2012 Stanislav Petr - 1.0.6-1 - Update to versio 1.0.6 - Change attrs to 750 on /etc/knot - only for root (knot configuration can contain DNS keys for zone updates) - Clean content in /etc/knot * Tue May 1 2012 Stanislav Petr - 1.0.5-1 - Update to version 1.0.5 * Wed Apr 18 2012 Stanislav Petr - 1.0.3-1 - Fixed knot directory ownership. - Update to version 1.0.3 - Merget changes from Paul Wouters - Removed unnecessary commands pro %%post script - Add knot user - More configuration samples in /usr/share/doc/knot * Thu Mar 1 2012 Stanislav Petr - 1.0.0-4 - Update to upstream version 1.0.0 - Fix %%{_sharedstatedir} usage in .spec. - Fix file and directories ownership - Fix service upgrade in postun in rpm. - Do not install unittests. * Wed Jan 25 2012 Stanislav Petr - 0.9.1-3 - Update to upstream version 0.9.1 * Mon Dec 12 2011 Stanislav Petr - 0.8.1-3 - Add docs (COPYING AUTHORS RELNOTES KNOWN_ISSUES) - Update rpm building options. Use %%{_sharedstatedir} instead of %%{_var}/lib, dafault value for %%{buildroot} path - Remove ldconfig from post and postun in rpm. - Update licence to GPLv3+ * Wed Dec 07 2011 Stanislav Petr - 0.8.1-2 - RPM build fix * Mon Dec 05 2011 Stanislav Petr - 0.8.1-1 - Create