rpms/knot
3
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
b9245ebb09
knot/knot.spec
Jan Vcelak b9245ebb09 new release (1.6.8) 
Resolves: #1353573 #1353575
2016-08-09 19:51:10 +02:00

277 lines
9.9 KiB
RPMSpec
Raw Blame History

%global _hardened_build 1
%{!?_pkgdocdir: %global _pkgdocdir %{_docdir}/%{name}-%{version}}
# TODO:
# - split into subpackages
# - documentation building
Summary: An authoritative DNS daemon
Name: knot
Version: 1.6.8
Release: 1%{?dist}
License: GPLv3
Group: System Environment/Daemons
URL: http://www.knot-dns.cz
Source0: http://public.nic.cz/files/knot-dns/%{name}-%{version}.tar.xz
Source1: %{name}.conf
Source2: %{name}.init
BuildRequires: flex bison openssl-devel userspace-rcu-devel libcap-ng-devel libidn-devel lmdb-devel
BuildRequires: texinfo
Requires(post): info
Requires(preun): info
Requires(post): chkconfig
Requires(preun): chkconfig
Requires(preun): initscripts
%description
Knot DNS is a high-performance authoritative DNS server implementation.
%prep
%setup -q
%build
# disable debug code (causes unused warnings)
CFLAGS="%{optflags} -DNDEBUG -Wno-unused"
%configure
make %{?_smp_mflags}
%install
make install DESTDIR=%{buildroot}
# install customized configuration file
rm %{buildroot}%{_sysconfdir}/%{name}/*
install -p -m 0644 -D %{SOURCE1} %{buildroot}%{_sysconfdir}/%{name}/%{name}.conf
# install service file and create rundir
install -p -m 0755 -D %{SOURCE2} %{buildroot}%{_initddir}/%{name}
install -d -m 0755 %{buildroot}%{_localstatedir}/run/%{name}
# create storage dir and key dir
mkdir -p %{buildroot}%{_sharedstatedir}
install -d -m 0775 %{buildroot}%{_sharedstatedir}/%{name}
install -d -m 0750 %{buildroot}%{_sharedstatedir}/%{name}/keys
# install config samples into docdir
install -d -m 0755 %{buildroot}%{_pkgdocdir}/samples
for sample_file in knot.sample.conf example.com.zone; do
install -p -m 0644 samples/${sample_file} %{buildroot}%{_pkgdocdir}/samples
done
# remove libarchive files
rm %{buildroot}%{_libdir}/*.la
# remove .so files, the headers are not available
rm %{buildroot}%{_libdir}/*.so
%check
make check
%pre
getent group knot >/dev/null || groupadd -r knot
getent passwd knot >/dev/null || \
useradd -r -g knot -d %{_sysconfdir}/knot -s /sbin/nologin \
-c "Knot DNS server" knot
exit 0
%post
/sbin/ldconfig
/sbin/chkconfig --add %{name}
%preun
if [ $1 -eq 0 ] ; then
/sbin/service %{name} stop >/dev/null 2>&1
/sbin/chkconfig --del %{name}
fi
%postun
/sbin/ldconfig
if [ "$1" -ge "1" ] ; then
/sbin/service %{name} condrestart >/dev/null 2>&1 || :
fi
%files
%doc COPYING AUTHORS NEWS README THANKS
%{_initddir}/%{name}
%dir %attr(750,root,knot) %{_sysconfdir}/%{name}
%config(noreplace) %attr(640,root,knot) %{_sysconfdir}/%{name}/%{name}.conf
%dir %attr(775,root,knot) %{_sharedstatedir}/%{name}
%dir %attr(750,root,knot) %{_sharedstatedir}/%{name}/keys
%dir %attr(-,knot,knot) %{_localstatedir}/run/%{name}
%{_bindir}/*
%{_sbindir}/*
%{_libdir}/libknot.so.*
%{_libdir}/libzscanner.so.*
%{_mandir}/man1/*
%{_mandir}/man5/*
%{_mandir}/man8/*
%changelog
* Tue Aug 09 2016 Jan Vcelak <jvcelak@fedoraproject.org> - 1.6.8-1
- new upstream release:
+ feature: Zone size limit restriction for DDNS, AXFR, and IXFR (CVE-2016-6171)
* Wed Feb 10 2016 Jan Vcelak <jvcelak@fedoraproject.org> 1.6.7-1
- new upstream release:
+ improvement: Log change of the zone serial number after IXFR transfer
+ improvement: Document operational impact of various RRL settings
+ improvement: Add support for rate-limit-slip zero
+ improvement: Add 'timer-db' configuration option
* Wed Nov 25 2015 Jan Vcelak <jvcelak@fedoraproject.org> 1.6.6-1
- new upstream release:
+ security fix: out-of-bound read in packet parser for malformed NAPTR record
+ fix: systemd startup notifications
* Wed Sep 02 2015 Jan Vcelak <jvcelak@fedoraproject.org> 1.6.5-1
- new upstream release:
+ fix: don't load expired zones on reload and startup
+ fix: remove race condition in scheduling causing delaying of events
+ fix: NSEC proof construction in zones with many delegations
+ fix: TC flag setting in RRL slipped answers
+ fix: disable domain name compression for root label
+ fix: check if executed under systemd before using journald log sink
+ feature: write persistent timers on server shutdown for better performance
+ feature: support time unit specification for 'max-conn-idle',
'max-conn-handshake', 'max-conn-reply', and 'notify-timeout' config options
+ feature: add 'request-edns-config' config option
* Thu Jun 18 2015 Jan Vcelak <jvcelak@fedoraproject.org> 1.6.4-1
- new upstream release:
+ fix: lost NOTIFY message if received during zone transfer
+ fix: kdig, record correct dnstap SocketProtocol when retrying over TCP
+ fix: kdig, hide TSIG section with +noall
+ fix: do not set AA flag for AXFR/IXFR queries
+ feature: zone scanner, split long TXT/SPF strings into multiple strings
+ feature: kdig, add +generic dump style option
+ feature: try all servers on failure in multi-master environment
+ improvement: zone dump, do not print class for SOA record for consistency
* Wed Apr 08 2015 Jan Vcelak <jvcelak@fedoraproject.org> 1.6.3-1
- new upstream release:
+ fix: performance drop for NSEC-signed zones
+ fix: proper handling of TCP short-writes
+ fix: possible out-of-bound reads in zone parser and packet parser
+ feature: CDS and CDNSKEY support in zone parser
+ improvement: add defaults for TCP config options into documentation
+ improvement: detailed error message if zone reload fails
* Thu Feb 19 2015 Jan Vcelak <jvcelak@fedoraproject.org> 1.6.2-1
- new upstream release:
+ new config option 'max-tcp-clients'
+ fix possible resource leak when terminating inactive TCP clients
+ support for Single-Type Signing DNSSEC Scheme
+ fix journal file growing over configured limit
* Thu Oct 30 2014 Jan Vcelak <jvcelak@fedoraproject.org> 1.6.0-2
- default config: run server as unprivileged user
* Thu Oct 23 2014 Jan Vcelak <jvcelak@fedoraproject.org> 1.6.0-1
- new upstream release:
+ support for persistent zone timers (expire, refresh, and flush)
+ DNSSEC: RFC-compliant processing of letter case in RDATA domain names
+ EDNS: return minimal response for queries with unsupported version
+ EDNS: fix interpretation of Extended RCODE
+ transfers: fix forced zone retransfer
+ timers: properly expire zone when transfer is being refused by master
* Mon Sep 15 2014 Jan Vcelak <jvcelak@fedoraproject.org> 1.5.3-1
- new upstream release:
+ fix crash on specific incoming IXFR message
+ fix rare synchronization error during server reload
+ fix crash in reverse record synthesis module on DNSSEC signed zones
+ fix message ID and opcode for AXFR-style IXFR responses
+ fix sending of large responses to remote control commands
* Mon Sep 08 2014 Jan Vcelak <jvcelak@fedoraproject.org> 1.5.2-1
- new upstream release:
+ CVE-2014-0486: remote crash using crafted DNS message
+ transfers: do not refuse AXFR answers to IXFR queries
+ fix storing of hash character '#' in zone file
* Tue Aug 19 2014 Jan Vcelak <jvcelak@fedoraproject.org> 1.5.1-1
- new upstream release:
+ logging: unified logging messages
+ logging: support for systemd journal
+ DDNS: processing updates in bulk
+ DDNS: fix signing of responses with TSIG
+ DDNS: fix prerequisites checking in apex node
+ DNSSEC: fix domain names conversion to canonical format before signing
+ DNSSEC: semantic checks for signing keys
+ EDNS: fix inclusion of OPT record into some packets
+ knsupdate: fix use of zone origin for deletions
* Thu Jul 10 2014 Jan Vcelak <jvcelak@fedoraproject.org> 1.5.0-1
- update to 1.5.0
+ reimplemented DDNS forwarding
+ transfer sizes logged in bytes
+ logging of outgoing/incoming NOTIFY messages
+ zone flush planning after bootstrap
+ DDNS signing changes freeing
+ knotc key handling
- update to 1.5.0-rc2
+ edns-client-subnet support in kdig
+ optional asynchronous startup (config 'asynchronous-start')
+ preempt task queue for faster reload
+ lazy zone file write after zone transfer (config 'zonefile-sync')
+ close zone transfer after SERVFAIL response
+ incremental to full zone transfer fallback, wrong log message
+ zone events corner cases, reload replanning
- update to 1.5.0-rc1
+ Pluggable query processing modules
+ Synthetic IPv4/IPv6 reverse/forward records (optional module)
+ Dnstap support in both utilities & server (optional module)
+ NOTIFY message support and new TSIG section in kdig
+ Multi-master support
+ Query processing and core functionality overhaul
+ Performance and reduced memory footprint
+ Faster zone events scheduling
+ RFC compliant queries/responses in some corner cases
+ Log messages
+ New documentation (Sphinx)
- enabled dynamic linking
- removed info pages
* Wed Jun 18 2014 Jan Vcelak <jvcelak@fedoraproject.org> 1.4.7-1
- update to 1.4.7
+ Fixed DDNS corner cases
+ Fixed zone EXPIRE timer
+ Fixed semantic checks false positives
+ Fixed sending malformed IXFR with automatic DNSSEC
+ Fixed NAPTR record serialization
* Thu May 22 2014 Jan Vcelak <jvcelak@fedoraproject.org> 1.4.6-2
- update to 1.4.6
+ DNSSEC: fix possible signing loop when doing key rollover
+ RRL: fixed sending of malformed UDP empty responses
* Mon Apr 14 2014 Jan Vcelak <jvcelak@fedoraproject.org> 1.4.5-1
- update to 1.4.5
+ fix weakness in TSIG digest checking
* Thu Mar 27 2014 Jan Vcelak <jvcelak@fedoraproject.org> 1.4.4-1
- update to 1.4.4
+ server is logging remote control commands
+ 'knotc reload' doesn't refresh unchanged zones
+ 'knotc -f refresh' forces zone retransfer
+ missing notifications after DDNS/automatic resign
+ zone is rebootstrapped if the zone file is unreadable
+ progressive bootstrap retry backoff
+ zone file parser allows asterisk as part of the label
+ journal maximum entry size fixes
+ sign DNSKEYs in non-apex nodes as regular RR sets
+ various spelling and typo fixes
* Tue Feb 18 2014 Jan Vcelak <jvcelak@fedoraproject.org> 1.4.3-1
- update to 1.4.3
+ DNSSEC: fixes in authenticated denial proofs
+ zone parser: case insensitive comparison of $ORIGIN
+ journal: fix corruption if zone loading fails
+ config: add support for includes of directories
* Tue Feb 04 2014 Jan Vcelak <jvcelak@fedoraproject.org> 1.4.2-1
- initial package for RHEL
Reference in New Issue View Git Blame Copy Permalink