kpriv/pkgsrc
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
pkgsrc/net/knot/PLIST

98 lines
2.4 KiB
Text
Raw Normal View History

Knot DNS 2.5.7 (2018-01-02) =========================== Bugfixes: --------- - Unintentional zone re-sign during reload if empty NSEC3 salt - Inconsistent zone names in journald structured logs - Malformed outgoing transfer for big zone with TSIG - Unexpected reply for DS query with an owner below a delegation point - Old dependencies in the pkg-config file [...] Only new Features & Security fixes of the previous updates are shown below For a complete of all Improvements & Bugfixes, see: https://gitlab.labs.nic.cz/knot/knot-dns/blob/2.5/NEWS Knot DNS 2.5.3 (2017-07-14) =========================== Features: --------- - CSK rollover support for Single-Type Signing Scheme [...] Knot DNS 2.5.2 (2017-06-23) =========================== Security: --------- - CVE-2017-11104: Improper TSIG validity period check can allow TSIG forgery (Thanks to Synacktiv!) Knot DNS 2.5.0 (2017-06-05) =========================== Features: --------- - KASP database switched from JSON files to LMDB database - KSK rollover support using CDNSKEY and CDS in the automatic DNSSEC signing - Dynamic module loading support with proper module API - Journal can store full zone contents (not only differences) - Zone freeze/thaw support - Updated knotc zone-status output with optional column filters - New '[no]crypto' option in kdig - New keymgr implementation reflecting KASP database changes - New pykeymgr for JSON-based KASP database migration - Removed obsolete knot1to2 utility
2018-03-08 15:30:37 +01:00
@comment $NetBSD: PLIST,v 1.14 2018/03/08 14:30:37 pettai Exp $
v1.3.1 - Aug 26, 2013 --------------------- Bugfixes: * Response with NSID contained extra bytes after reload * List of remotes is scanned for longest prefix match * Multipacket TSIG signatures for transfers * Wrongly parsed TSIG key secret without quotes * Removed autoconf checks for extended instruction sets v1.3.0 - Aug 5, 2013 -------------------- Features: * Defaults for CH TXT id.server,version.server (see doc) Bugfixes: * Progressive interval for bootstrap retry * Transfers randomly cancelled * Disabling RRL on reload * Secondary groups not initialized when dropping privileges * Responding to DS queries for names at or below delegation points v1.3.0-rc5 - Jul 29, 2013 ------------------------- Features: * Much faster bootstrap of many zones Bugfixes: * Removed deprecated 'knotc -w' option * Slave ignores out-of-zone records in zone * Support for obsolete types in zone transfers * Slave zone file names fixes * Long transfers being randomly dropped v1.3.0-rc4 - Jul 15, 2013 ------------------------- Features: * --with-configdir option for default config path * Reintroducted 'pidfile' config option Bugfixes: * AXFR/IXFR subsystem performance improvements * Rescheduling of AXFR in some cases * RRSIGs not in the same section for DS records * Log messages leaking to syslog * 'knotc restart' option removed due to several limitations v1.3.0-rc3 - Jun 28, 2013 ------------------------- Features: * Utility to estimate memory consumption (see 'knotc memstats') * PID file is not created when running on foreground * UNIX sockets support for knotc * Configurable 'rundir' and 'storage' Bugfixes: * IXFR with an arbitrary number of diffs * Processing of knotc TSIG keyfile * Atomic PID file writing, removed deprecated 'knotc start' * Performance regression when RRSIGs came before covered RRs in AXFR v1.3.0-rc2 - Jun 14, 2013 ------------------------- Bugfixes: * Label compression related bug * Proper resolution of some CNAME chains * Unstable response rate in rare cases * Several log messages v1.3.0-rc1 - Jun 4, 2013 --------------------------- Features: * Faster zone parser * Full support for EUI and ILNP resource records * Lower memory footprint for large zones * No compilation of zones * Improved scheduling of zone transfers * Logging of serials and timing information for zone transfers * Config: 'groups' keyword allowing to create groups of remotes * Config: 'include' keyword allowing other file includes * Client utilities: kdig, khost, knsupdate * Server identification using TXT/CH queries (RFC 4892) * Improved build scripts * Improved dname compression and performance Bugfixes: * Fixed creating of PID file when dropping privileges
2013-09-13 20:14:11 +02:00
bin/kdig
bin/khost
Knot DNS 2.3.3 (2016-12-08) =========================== Bugfixes: --------- - Double free when failed to apply zone journal - Zone bootstrap retry interval not preserved upon zone reload - DNSSEC related records not flushed if not signed - False semantic checks warning about incorrect type in NSEC bitmap - Memory leak in kzonecheck Improvements: ------------- - All zone names are fully-qualified in log Features: --------- - New kjournalprint utility Knot DNS 2.3.2 (2016-11-04) =========================== Bugfixes: --------- - Incorrect %s expansion for the root zone - Failed to refresh not existing slave zone after restart - Immediate zone refresh upon restart if refresh already scheduled - Early zone transfer after restart if transfer already scheduled - Not ignoring empty non-terminal parents during delegation lookup - CD bit preservation in responses - Compilation error on GNU/kFreeBSD - Server crash after double zone-commit if journal error Improvements: ------------- - Speed-up of knotc if control operation and known socket - Zone purge operation purges also zone timers Features: --------- - Simple modules don't require empty configuration section - New zone journal path configuration option - New timeout configuration option for module dnsproxy
2016-12-09 23:28:17 +01:00
bin/kjournalprint
v1.4.2 - Jan 27, 2014 --------------------- Bugfixes: * AXFR/IXFR compatibility issues with tinydns/axfrdns * Journal file is created only when needed * Zone-related log messages are logged into correct category * DNSSEC: Refresh signatures earlier (3 days before their expiration with the default signature lifetime) * Fixed RCU synchronization causing deadlock on 'knotc signzone' * RRSIG not fitting in the additional records doesn't cause truncation v1.4.1 - Jan 13, 2014 --------------------- Bugfixes: * Empty APL record support * 'zonestatus' when using immediate zone syncing * Immediate zone syncing after reload * Race condition writing time values to zone file v1.4.0 - Jan 6, 2014 --------------------- Features: * Zone SERIAL policies (INCREMENT, UNIXTIME) Bugfixes: * AXFR crash with specific packet * QNAME case-sensitive since 1.4.0-rc0 * DNSSEC records over DDNS * Semantic check fail in AXFR is only soft-error * Journal race condition * Notifies are sent immediately v1.4.0-rc2 - Dec 13, 2013 ------------------------- Features: * IDN support in Knot utilities * DNSSEC: support for GOST algorithm Bugfixes: * Crash in particular additionals processing * Race condition in event cancelation * Journal corruption after failed transactions * DNSSEC: fixed detection of ECDSA support Other improvements: * ./configure prints build configuration summary * Pretty zone file output (DNSSEC-related data separately) * Lower memory consumption * config: option 'dnssec-keydir' can be set per zone * config: option 'storage' can be set per zone v1.4.0-rc1 - Nov 20, 2013 ------------------------- Features: * Better logging of automatic DNSSEC events * Support for DNSSEC key pre-publication Bugfixes: * Refactored zone loading * Improved journal locking and fixed some race conditions * Various fixes in client utilities * Fixed memory errors in automatic DNSSEC signing * 'dnssec-keydir' doesn't auto-enable signing * Fixed rescheduling of zone resigns v1.4.0-beta - Oct 28, 2013 -------------------------- Features: * Experimental automatic DNSSEC signing * Reduced memory usage
2014-01-31 23:05:43 +01:00
bin/knsec3hash
v1.3.1 - Aug 26, 2013 --------------------- Bugfixes: * Response with NSID contained extra bytes after reload * List of remotes is scanned for longest prefix match * Multipacket TSIG signatures for transfers * Wrongly parsed TSIG key secret without quotes * Removed autoconf checks for extended instruction sets v1.3.0 - Aug 5, 2013 -------------------- Features: * Defaults for CH TXT id.server,version.server (see doc) Bugfixes: * Progressive interval for bootstrap retry * Transfers randomly cancelled * Disabling RRL on reload * Secondary groups not initialized when dropping privileges * Responding to DS queries for names at or below delegation points v1.3.0-rc5 - Jul 29, 2013 ------------------------- Features: * Much faster bootstrap of many zones Bugfixes: * Removed deprecated 'knotc -w' option * Slave ignores out-of-zone records in zone * Support for obsolete types in zone transfers * Slave zone file names fixes * Long transfers being randomly dropped v1.3.0-rc4 - Jul 15, 2013 ------------------------- Features: * --with-configdir option for default config path * Reintroducted 'pidfile' config option Bugfixes: * AXFR/IXFR subsystem performance improvements * Rescheduling of AXFR in some cases * RRSIGs not in the same section for DS records * Log messages leaking to syslog * 'knotc restart' option removed due to several limitations v1.3.0-rc3 - Jun 28, 2013 ------------------------- Features: * Utility to estimate memory consumption (see 'knotc memstats') * PID file is not created when running on foreground * UNIX sockets support for knotc * Configurable 'rundir' and 'storage' Bugfixes: * IXFR with an arbitrary number of diffs * Processing of knotc TSIG keyfile * Atomic PID file writing, removed deprecated 'knotc start' * Performance regression when RRSIGs came before covered RRs in AXFR v1.3.0-rc2 - Jun 14, 2013 ------------------------- Bugfixes: * Label compression related bug * Proper resolution of some CNAME chains * Unstable response rate in rare cases * Several log messages v1.3.0-rc1 - Jun 4, 2013 --------------------------- Features: * Faster zone parser * Full support for EUI and ILNP resource records * Lower memory footprint for large zones * No compilation of zones * Improved scheduling of zone transfers * Logging of serials and timing information for zone transfers * Config: 'groups' keyword allowing to create groups of remotes * Config: 'include' keyword allowing other file includes * Client utilities: kdig, khost, knsupdate * Server identification using TXT/CH queries (RFC 4892) * Improved build scripts * Improved dname compression and performance Bugfixes: * Fixed creating of PID file when dropping privileges
2013-09-13 20:14:11 +02:00
bin/knsupdate
Knot DNS 2.3.1 (2016-10-07) =========================== Bugfixes: --------- - Missing glue records in some responses - Knsupdate prompt printing on non-terminal - Mismatch between configuration policy item names and documentation - Segfault on OS X (Sierra) Improvements: ------------- - Significant speed-up of conf-commit and conf-diff operations (in most cases) - New EDNS Client Subnet libknot API - Better semantic-checks error messages Features: --------- - Print TLS certificate hierarchy in kdig verbose mode - New +subnet alias for +client - New mod-whoami and mod-noudp modules - New zone-purge control command - New log-queries and log-responses options for mod-dnstap
2016-10-29 11:42:48 +02:00
bin/kzonecheck
Knot DNS 2.0.1 (2015-09-02) =========================== Bugfixes: --------- - Do not reload expired zones on 'knotc reload' and server startup - Fix rare race-condition in event scheduling causing delayed event execution - Fix skipping of non-authoritative nodes in NSEC proofs - Fix TC flag setting in RRL slipped answers - Disable domain name compression for root label - Log via journald only when running under systemd - Fix CNAME following when quering for NSEC RR type - Fix refreshing of DNSSEC signatures for zone keys - Fix binding an unavailable IPv6 address on Linux (IP_FREEBIND) - Fix infinite loop in knotc zonestatus and memstats - Fix memory leak in configuration on server shutdown - Fix broken dnsproxy module - Fix DNSSEC KASP timestamps parsing in strict POSIX environment - fix multi value parsing on big-endian - Adapt to Nettle 3 API break causing base64 decoding failures on big-endian Features: --------- - Add 'keymgr zone key ds' to show key's DS record - Add 'keymgr tsig generate' to generate TSIG keys - Add query module scoping to process either all queries or zone queries only - Add support for file name globbing in config file includes - Add 'request-edns-option' config option to add custom EDNS0 option into server initiated queries Improvements: ------------- - Send minimal responses (remove NS from Authority section for NOERROR) - Update persistent timers only on shutdown for better performance - Allow change of RR TTL over DDNS - Documentation fixes, updates, and improvements in formatting - Install yparser and zscanner header files - Improve lookup of libsystemd build dependencies - Fix compilation warnings in endian conversion functions on OpenBSD Knot DNS 2.0.0 (2015-06-26) =========================== Bugfixes: --------- - Fix lost NOTIFY message if received during zone transfer - Disable fast zone parser when compiled in Clang (workaround for Clang bug) - kdig: Record correct dnstap SocketProtocol when retrying over TCP - kdig: Hide TSIG section with +noall - Do not set AA flag for AXFR/IXFR queries Features: --------- - DNSSEC: separate library, switch to GnuTLS, new utilities - DNSSEC: basic KASP support (generate initial keys, ZSK rollover) - Configuration: New text format in YAML, binary store in LMDB - Zone parser: Split long TXT/SPF strings into multiple strings - kdig: Add generic dump style option (+generic) - Try all master servers in multi-master environment - Improved remotes and ACLs (multiple addresses, multiple keys) - Basic support for zone file patterns (%s to substitute zone name) - Disable zone file synchronization by setting 'zonefile_sync' to '-1' - knsupdate: Add input prompt in interactive mode and 'quit' command - knsupdate: Allow TSIG algorithm specification in interactive prompt Improvements: ------------- - Zone dump: Do not write class for SOA record (unified with other RR types) - Zone dump: Do not write master server address into the zone file - Documentation: Manual pages are included in HTML and PDF
2015-10-26 20:23:08 +01:00
include/dnssec/binary.h
include/dnssec/crypto.h
include/dnssec/dnssec.h
include/dnssec/error.h
include/dnssec/key.h
include/dnssec/keyid.h
include/dnssec/keystore.h
include/dnssec/keytag.h
include/dnssec/list.h
include/dnssec/nsec.h
include/dnssec/random.h
include/dnssec/sign.h
include/dnssec/tsig.h
Knot DNS 2.1.1 (2016-02-10) =========================== Bugfixes: --------- - DNSSEC: Allow import of duplicate private key into the KASP - DNSSEC: Avoid duplicate NSEC for Wildcard No Data answer - Fix server crash when an incomming transfer is in progress and reload is issued - Fix socket polling when configured with many interfaces and threads - Fix compilation against Nettle 3.2 Improvements: ------------- - Select correct source address for UDP messages recieved on ANY address - Extend documentation of knotc commands Knot DNS 2.1.0 (2016-01-14) =========================== Features: --------- - Per-thread UDP socket binding using SO_REUSEPORT on Linux - Support for dynamic configuration database - DNSSEC: Support for cryptographic tokens via PKCS #11 interface - DNSSEC: Experimental support for online signing Improvements: ------------- - Support for zone file name patterns - Configurable location of zone timer database - Non-blocking network operations and better timeout handling - Caching of Critical configuration values for better performance - Logging of ACL failures - RRL: Add rate-limit-slip zero support to drop all responses - RRL: Document behavior for different rate-limit-slip options - kdig: Warning instead of error on TSIG validation failure - Cleanup of support libraries interfaces (libknot, libzscanner, libdnssec) - Remove possibly insecure server control over a network socket - Remove implementation limit for the number of network interfaces Bugfixes: --------- - synth-record module: Fix application of default configuration options - TSIG: Allow compressed TSIG name when forwarding DDNS updates - Schedule zone bootstrap after slave zone fails to load from disk
2016-02-28 18:02:38 +01:00
include/dnssec/version.h
Knot DNS 2.5.7 (2018-01-02) =========================== Bugfixes: --------- - Unintentional zone re-sign during reload if empty NSEC3 salt - Inconsistent zone names in journald structured logs - Malformed outgoing transfer for big zone with TSIG - Unexpected reply for DS query with an owner below a delegation point - Old dependencies in the pkg-config file [...] Only new Features & Security fixes of the previous updates are shown below For a complete of all Improvements & Bugfixes, see: https://gitlab.labs.nic.cz/knot/knot-dns/blob/2.5/NEWS Knot DNS 2.5.3 (2017-07-14) =========================== Features: --------- - CSK rollover support for Single-Type Signing Scheme [...] Knot DNS 2.5.2 (2017-06-23) =========================== Security: --------- - CVE-2017-11104: Improper TSIG validity period check can allow TSIG forgery (Thanks to Synacktiv!) Knot DNS 2.5.0 (2017-06-05) =========================== Features: --------- - KASP database switched from JSON files to LMDB database - KSK rollover support using CDNSKEY and CDS in the automatic DNSSEC signing - Dynamic module loading support with proper module API - Journal can store full zone contents (not only differences) - Zone freeze/thaw support - Updated knotc zone-status output with optional column filters - New '[no]crypto' option in kdig - New keymgr implementation reflecting KASP database changes - New pykeymgr for JSON-based KASP database migration - Removed obsolete knot1to2 utility
2018-03-08 15:30:37 +01:00
include/knot/module.h
Knot DNS 2.1.1 (2016-02-10) =========================== Bugfixes: --------- - DNSSEC: Allow import of duplicate private key into the KASP - DNSSEC: Avoid duplicate NSEC for Wildcard No Data answer - Fix server crash when an incomming transfer is in progress and reload is issued - Fix socket polling when configured with many interfaces and threads - Fix compilation against Nettle 3.2 Improvements: ------------- - Select correct source address for UDP messages recieved on ANY address - Extend documentation of knotc commands Knot DNS 2.1.0 (2016-01-14) =========================== Features: --------- - Per-thread UDP socket binding using SO_REUSEPORT on Linux - Support for dynamic configuration database - DNSSEC: Support for cryptographic tokens via PKCS #11 interface - DNSSEC: Experimental support for online signing Improvements: ------------- - Support for zone file name patterns - Configurable location of zone timer database - Non-blocking network operations and better timeout handling - Caching of Critical configuration values for better performance - Logging of ACL failures - RRL: Add rate-limit-slip zero support to drop all responses - RRL: Document behavior for different rate-limit-slip options - kdig: Warning instead of error on TSIG validation failure - Cleanup of support libraries interfaces (libknot, libzscanner, libdnssec) - Remove possibly insecure server control over a network socket - Remove implementation limit for the number of network interfaces Bugfixes: --------- - synth-record module: Fix application of default configuration options - TSIG: Allow compressed TSIG name when forwarding DDNS updates - Schedule zone bootstrap after slave zone fails to load from disk
2016-02-28 18:02:38 +01:00
include/libknot/attribute.h
Knot DNS 2.0.1 (2015-09-02) =========================== Bugfixes: --------- - Do not reload expired zones on 'knotc reload' and server startup - Fix rare race-condition in event scheduling causing delayed event execution - Fix skipping of non-authoritative nodes in NSEC proofs - Fix TC flag setting in RRL slipped answers - Disable domain name compression for root label - Log via journald only when running under systemd - Fix CNAME following when quering for NSEC RR type - Fix refreshing of DNSSEC signatures for zone keys - Fix binding an unavailable IPv6 address on Linux (IP_FREEBIND) - Fix infinite loop in knotc zonestatus and memstats - Fix memory leak in configuration on server shutdown - Fix broken dnsproxy module - Fix DNSSEC KASP timestamps parsing in strict POSIX environment - fix multi value parsing on big-endian - Adapt to Nettle 3 API break causing base64 decoding failures on big-endian Features: --------- - Add 'keymgr zone key ds' to show key's DS record - Add 'keymgr tsig generate' to generate TSIG keys - Add query module scoping to process either all queries or zone queries only - Add support for file name globbing in config file includes - Add 'request-edns-option' config option to add custom EDNS0 option into server initiated queries Improvements: ------------- - Send minimal responses (remove NS from Authority section for NOERROR) - Update persistent timers only on shutdown for better performance - Allow change of RR TTL over DDNS - Documentation fixes, updates, and improvements in formatting - Install yparser and zscanner header files - Improve lookup of libsystemd build dependencies - Fix compilation warnings in endian conversion functions on OpenBSD Knot DNS 2.0.0 (2015-06-26) =========================== Bugfixes: --------- - Fix lost NOTIFY message if received during zone transfer - Disable fast zone parser when compiled in Clang (workaround for Clang bug) - kdig: Record correct dnstap SocketProtocol when retrying over TCP - kdig: Hide TSIG section with +noall - Do not set AA flag for AXFR/IXFR queries Features: --------- - DNSSEC: separate library, switch to GnuTLS, new utilities - DNSSEC: basic KASP support (generate initial keys, ZSK rollover) - Configuration: New text format in YAML, binary store in LMDB - Zone parser: Split long TXT/SPF strings into multiple strings - kdig: Add generic dump style option (+generic) - Try all master servers in multi-master environment - Improved remotes and ACLs (multiple addresses, multiple keys) - Basic support for zone file patterns (%s to substitute zone name) - Disable zone file synchronization by setting 'zonefile_sync' to '-1' - knsupdate: Add input prompt in interactive mode and 'quit' command - knsupdate: Allow TSIG algorithm specification in interactive prompt Improvements: ------------- - Zone dump: Do not write class for SOA record (unified with other RR types) - Zone dump: Do not write master server address into the zone file - Documentation: Manual pages are included in HTML and PDF
2015-10-26 20:23:08 +01:00
include/libknot/binary.h
Knot DNS 2.1.1 (2016-02-10) =========================== Bugfixes: --------- - DNSSEC: Allow import of duplicate private key into the KASP - DNSSEC: Avoid duplicate NSEC for Wildcard No Data answer - Fix server crash when an incomming transfer is in progress and reload is issued - Fix socket polling when configured with many interfaces and threads - Fix compilation against Nettle 3.2 Improvements: ------------- - Select correct source address for UDP messages recieved on ANY address - Extend documentation of knotc commands Knot DNS 2.1.0 (2016-01-14) =========================== Features: --------- - Per-thread UDP socket binding using SO_REUSEPORT on Linux - Support for dynamic configuration database - DNSSEC: Support for cryptographic tokens via PKCS #11 interface - DNSSEC: Experimental support for online signing Improvements: ------------- - Support for zone file name patterns - Configurable location of zone timer database - Non-blocking network operations and better timeout handling - Caching of Critical configuration values for better performance - Logging of ACL failures - RRL: Add rate-limit-slip zero support to drop all responses - RRL: Document behavior for different rate-limit-slip options - kdig: Warning instead of error on TSIG validation failure - Cleanup of support libraries interfaces (libknot, libzscanner, libdnssec) - Remove possibly insecure server control over a network socket - Remove implementation limit for the number of network interfaces Bugfixes: --------- - synth-record module: Fix application of default configuration options - TSIG: Allow compressed TSIG name when forwarding DDNS updates - Schedule zone bootstrap after slave zone fails to load from disk
2016-02-28 18:02:38 +01:00
include/libknot/codes.h
Knot DNS 2.0.1 (2015-09-02) =========================== Bugfixes: --------- - Do not reload expired zones on 'knotc reload' and server startup - Fix rare race-condition in event scheduling causing delayed event execution - Fix skipping of non-authoritative nodes in NSEC proofs - Fix TC flag setting in RRL slipped answers - Disable domain name compression for root label - Log via journald only when running under systemd - Fix CNAME following when quering for NSEC RR type - Fix refreshing of DNSSEC signatures for zone keys - Fix binding an unavailable IPv6 address on Linux (IP_FREEBIND) - Fix infinite loop in knotc zonestatus and memstats - Fix memory leak in configuration on server shutdown - Fix broken dnsproxy module - Fix DNSSEC KASP timestamps parsing in strict POSIX environment - fix multi value parsing on big-endian - Adapt to Nettle 3 API break causing base64 decoding failures on big-endian Features: --------- - Add 'keymgr zone key ds' to show key's DS record - Add 'keymgr tsig generate' to generate TSIG keys - Add query module scoping to process either all queries or zone queries only - Add support for file name globbing in config file includes - Add 'request-edns-option' config option to add custom EDNS0 option into server initiated queries Improvements: ------------- - Send minimal responses (remove NS from Authority section for NOERROR) - Update persistent timers only on shutdown for better performance - Allow change of RR TTL over DDNS - Documentation fixes, updates, and improvements in formatting - Install yparser and zscanner header files - Improve lookup of libsystemd build dependencies - Fix compilation warnings in endian conversion functions on OpenBSD Knot DNS 2.0.0 (2015-06-26) =========================== Bugfixes: --------- - Fix lost NOTIFY message if received during zone transfer - Disable fast zone parser when compiled in Clang (workaround for Clang bug) - kdig: Record correct dnstap SocketProtocol when retrying over TCP - kdig: Hide TSIG section with +noall - Do not set AA flag for AXFR/IXFR queries Features: --------- - DNSSEC: separate library, switch to GnuTLS, new utilities - DNSSEC: basic KASP support (generate initial keys, ZSK rollover) - Configuration: New text format in YAML, binary store in LMDB - Zone parser: Split long TXT/SPF strings into multiple strings - kdig: Add generic dump style option (+generic) - Try all master servers in multi-master environment - Improved remotes and ACLs (multiple addresses, multiple keys) - Basic support for zone file patterns (%s to substitute zone name) - Disable zone file synchronization by setting 'zonefile_sync' to '-1' - knsupdate: Add input prompt in interactive mode and 'quit' command - knsupdate: Allow TSIG algorithm specification in interactive prompt Improvements: ------------- - Zone dump: Do not write class for SOA record (unified with other RR types) - Zone dump: Do not write master server address into the zone file - Documentation: Manual pages are included in HTML and PDF
2015-10-26 20:23:08 +01:00
include/libknot/consts.h
Knot DNS 2.2.1 (2016-05-24) =========================== Bugfixes: --------- - Fix separate logging of server and zone events - Fix concurrent zone file flushing with many zones - Fix possible server crash with empty hostname on OpenWRT - Fix control timeout parsing in knotc - Fix "Environment maxreaders limit reached" error in knotc - Don't apply journal changes on modified zone file - Remove broken LTO option from configure script - Enable multiple zone names completion in interactive knotc - Set the TC flag in a response if a glue doesn't fit the response - Disallow server reload when there is an active configuration transaction Improvements: ------------- - Distinguish unavailable zones from zones with zero serial in log messages - Log warning and error messages to standard error output in all utilities - Document tested PKCS #11 devices - Extended Python configuration interface Knot DNS 2.2.0 (2016-04-26) =========================== Bugfixes: --------- - Fix build dependencies on FreeBSD - Fix query/response message type setting in dnstap module - Fix remote address retrieval from dnstap capture in kdig - Fix global modules execution for queries hitting existing zones - Fix execution of semantic checks after an IXFR transfer - Fix PKCS#11 support detection at build time - Fix kdig failure when the first AXFR message contains just the SOA record - Exclude non-authoritative types from NSEC/NSEC3 bitmap at a delegation - Mark PKCS#11 generated keys as sensitive (required by Luna SA) - Fix error when removing the only zone from the server - Don't abort knotc transaction when some check fails Features: --------- - URI and CAA resource record types support - RRL client address based white list - knotc interactive mode Improvements: ------------- - Consistent IXFR error messages - Various fixes for better compatibility with PKCS#11 devices - Various keymgr user interface improvements - Better zone event scheduler performance with many zones - New server control interface - kdig uses local resolver if resolv.conf is empty
2016-06-16 19:12:27 +02:00
include/libknot/control/control.h
Knot DNS 2.3.0 (2016-08-09) =========================== Bugfixes: --------- - No wildcard expansion below empty non-terminal for NSEC signed zone - Avoid multiple loads of the same PKCS #11 module - Fix kdig IXFR response processing if the transfer content is empty - Don't ignore non-existing records to be removed in IXFR Improvements: ------------- - Refactored semantic checks and improved error messages - Set TC flag in delegation only if mandatory glue doesn't fit the response - Separate EDNS(0) payload size configuration for IPv4 and IPv6 Features: --------- - DNSSEC policy can be defined in server configuration - Automatic NSEC3 resalt according to DNSSEC policy - Zone content editing using control interface - Zone size limit restriction for DDNS, AXFR, and IXFR (CVE-2016-6171) - DNS-over-TLS support in kdig (RFC 7858) - EDNS(0) padding and alignment support in kdig (RFC 7830)
2016-08-25 16:11:49 +02:00
include/libknot/cookies/alg-fnv64.h
include/libknot/cookies/client.h
include/libknot/cookies/server.h
Knot DNS 2.1.1 (2016-02-10) =========================== Bugfixes: --------- - DNSSEC: Allow import of duplicate private key into the KASP - DNSSEC: Avoid duplicate NSEC for Wildcard No Data answer - Fix server crash when an incomming transfer is in progress and reload is issued - Fix socket polling when configured with many interfaces and threads - Fix compilation against Nettle 3.2 Improvements: ------------- - Select correct source address for UDP messages recieved on ANY address - Extend documentation of knotc commands Knot DNS 2.1.0 (2016-01-14) =========================== Features: --------- - Per-thread UDP socket binding using SO_REUSEPORT on Linux - Support for dynamic configuration database - DNSSEC: Support for cryptographic tokens via PKCS #11 interface - DNSSEC: Experimental support for online signing Improvements: ------------- - Support for zone file name patterns - Configurable location of zone timer database - Non-blocking network operations and better timeout handling - Caching of Critical configuration values for better performance - Logging of ACL failures - RRL: Add rate-limit-slip zero support to drop all responses - RRL: Document behavior for different rate-limit-slip options - kdig: Warning instead of error on TSIG validation failure - Cleanup of support libraries interfaces (libknot, libzscanner, libdnssec) - Remove possibly insecure server control over a network socket - Remove implementation limit for the number of network interfaces Bugfixes: --------- - synth-record module: Fix application of default configuration options - TSIG: Allow compressed TSIG name when forwarding DDNS updates - Schedule zone bootstrap after slave zone fails to load from disk
2016-02-28 18:02:38 +01:00
include/libknot/db/db.h
include/libknot/db/db_lmdb.h
include/libknot/db/db_trie.h
Knot DNS 2.0.1 (2015-09-02) =========================== Bugfixes: --------- - Do not reload expired zones on 'knotc reload' and server startup - Fix rare race-condition in event scheduling causing delayed event execution - Fix skipping of non-authoritative nodes in NSEC proofs - Fix TC flag setting in RRL slipped answers - Disable domain name compression for root label - Log via journald only when running under systemd - Fix CNAME following when quering for NSEC RR type - Fix refreshing of DNSSEC signatures for zone keys - Fix binding an unavailable IPv6 address on Linux (IP_FREEBIND) - Fix infinite loop in knotc zonestatus and memstats - Fix memory leak in configuration on server shutdown - Fix broken dnsproxy module - Fix DNSSEC KASP timestamps parsing in strict POSIX environment - fix multi value parsing on big-endian - Adapt to Nettle 3 API break causing base64 decoding failures on big-endian Features: --------- - Add 'keymgr zone key ds' to show key's DS record - Add 'keymgr tsig generate' to generate TSIG keys - Add query module scoping to process either all queries or zone queries only - Add support for file name globbing in config file includes - Add 'request-edns-option' config option to add custom EDNS0 option into server initiated queries Improvements: ------------- - Send minimal responses (remove NS from Authority section for NOERROR) - Update persistent timers only on shutdown for better performance - Allow change of RR TTL over DDNS - Documentation fixes, updates, and improvements in formatting - Install yparser and zscanner header files - Improve lookup of libsystemd build dependencies - Fix compilation warnings in endian conversion functions on OpenBSD Knot DNS 2.0.0 (2015-06-26) =========================== Bugfixes: --------- - Fix lost NOTIFY message if received during zone transfer - Disable fast zone parser when compiled in Clang (workaround for Clang bug) - kdig: Record correct dnstap SocketProtocol when retrying over TCP - kdig: Hide TSIG section with +noall - Do not set AA flag for AXFR/IXFR queries Features: --------- - DNSSEC: separate library, switch to GnuTLS, new utilities - DNSSEC: basic KASP support (generate initial keys, ZSK rollover) - Configuration: New text format in YAML, binary store in LMDB - Zone parser: Split long TXT/SPF strings into multiple strings - kdig: Add generic dump style option (+generic) - Try all master servers in multi-master environment - Improved remotes and ACLs (multiple addresses, multiple keys) - Basic support for zone file patterns (%s to substitute zone name) - Disable zone file synchronization by setting 'zonefile_sync' to '-1' - knsupdate: Add input prompt in interactive mode and 'quit' command - knsupdate: Allow TSIG algorithm specification in interactive prompt Improvements: ------------- - Zone dump: Do not write class for SOA record (unified with other RR types) - Zone dump: Do not write master server address into the zone file - Documentation: Manual pages are included in HTML and PDF
2015-10-26 20:23:08 +01:00
include/libknot/descriptor.h
include/libknot/dname.h
include/libknot/errcode.h
Knot DNS 2.1.1 (2016-02-10) =========================== Bugfixes: --------- - DNSSEC: Allow import of duplicate private key into the KASP - DNSSEC: Avoid duplicate NSEC for Wildcard No Data answer - Fix server crash when an incomming transfer is in progress and reload is issued - Fix socket polling when configured with many interfaces and threads - Fix compilation against Nettle 3.2 Improvements: ------------- - Select correct source address for UDP messages recieved on ANY address - Extend documentation of knotc commands Knot DNS 2.1.0 (2016-01-14) =========================== Features: --------- - Per-thread UDP socket binding using SO_REUSEPORT on Linux - Support for dynamic configuration database - DNSSEC: Support for cryptographic tokens via PKCS #11 interface - DNSSEC: Experimental support for online signing Improvements: ------------- - Support for zone file name patterns - Configurable location of zone timer database - Non-blocking network operations and better timeout handling - Caching of Critical configuration values for better performance - Logging of ACL failures - RRL: Add rate-limit-slip zero support to drop all responses - RRL: Document behavior for different rate-limit-slip options - kdig: Warning instead of error on TSIG validation failure - Cleanup of support libraries interfaces (libknot, libzscanner, libdnssec) - Remove possibly insecure server control over a network socket - Remove implementation limit for the number of network interfaces Bugfixes: --------- - synth-record module: Fix application of default configuration options - TSIG: Allow compressed TSIG name when forwarding DDNS updates - Schedule zone bootstrap after slave zone fails to load from disk
2016-02-28 18:02:38 +01:00
include/libknot/error.h
Knot DNS 2.0.1 (2015-09-02) =========================== Bugfixes: --------- - Do not reload expired zones on 'knotc reload' and server startup - Fix rare race-condition in event scheduling causing delayed event execution - Fix skipping of non-authoritative nodes in NSEC proofs - Fix TC flag setting in RRL slipped answers - Disable domain name compression for root label - Log via journald only when running under systemd - Fix CNAME following when quering for NSEC RR type - Fix refreshing of DNSSEC signatures for zone keys - Fix binding an unavailable IPv6 address on Linux (IP_FREEBIND) - Fix infinite loop in knotc zonestatus and memstats - Fix memory leak in configuration on server shutdown - Fix broken dnsproxy module - Fix DNSSEC KASP timestamps parsing in strict POSIX environment - fix multi value parsing on big-endian - Adapt to Nettle 3 API break causing base64 decoding failures on big-endian Features: --------- - Add 'keymgr zone key ds' to show key's DS record - Add 'keymgr tsig generate' to generate TSIG keys - Add query module scoping to process either all queries or zone queries only - Add support for file name globbing in config file includes - Add 'request-edns-option' config option to add custom EDNS0 option into server initiated queries Improvements: ------------- - Send minimal responses (remove NS from Authority section for NOERROR) - Update persistent timers only on shutdown for better performance - Allow change of RR TTL over DDNS - Documentation fixes, updates, and improvements in formatting - Install yparser and zscanner header files - Improve lookup of libsystemd build dependencies - Fix compilation warnings in endian conversion functions on OpenBSD Knot DNS 2.0.0 (2015-06-26) =========================== Bugfixes: --------- - Fix lost NOTIFY message if received during zone transfer - Disable fast zone parser when compiled in Clang (workaround for Clang bug) - kdig: Record correct dnstap SocketProtocol when retrying over TCP - kdig: Hide TSIG section with +noall - Do not set AA flag for AXFR/IXFR queries Features: --------- - DNSSEC: separate library, switch to GnuTLS, new utilities - DNSSEC: basic KASP support (generate initial keys, ZSK rollover) - Configuration: New text format in YAML, binary store in LMDB - Zone parser: Split long TXT/SPF strings into multiple strings - kdig: Add generic dump style option (+generic) - Try all master servers in multi-master environment - Improved remotes and ACLs (multiple addresses, multiple keys) - Basic support for zone file patterns (%s to substitute zone name) - Disable zone file synchronization by setting 'zonefile_sync' to '-1' - knsupdate: Add input prompt in interactive mode and 'quit' command - knsupdate: Allow TSIG algorithm specification in interactive prompt Improvements: ------------- - Zone dump: Do not write class for SOA record (unified with other RR types) - Zone dump: Do not write master server address into the zone file - Documentation: Manual pages are included in HTML and PDF
2015-10-26 20:23:08 +01:00
include/libknot/libknot.h
Knot DNS 2.1.1 (2016-02-10) =========================== Bugfixes: --------- - DNSSEC: Allow import of duplicate private key into the KASP - DNSSEC: Avoid duplicate NSEC for Wildcard No Data answer - Fix server crash when an incomming transfer is in progress and reload is issued - Fix socket polling when configured with many interfaces and threads - Fix compilation against Nettle 3.2 Improvements: ------------- - Select correct source address for UDP messages recieved on ANY address - Extend documentation of knotc commands Knot DNS 2.1.0 (2016-01-14) =========================== Features: --------- - Per-thread UDP socket binding using SO_REUSEPORT on Linux - Support for dynamic configuration database - DNSSEC: Support for cryptographic tokens via PKCS #11 interface - DNSSEC: Experimental support for online signing Improvements: ------------- - Support for zone file name patterns - Configurable location of zone timer database - Non-blocking network operations and better timeout handling - Caching of Critical configuration values for better performance - Logging of ACL failures - RRL: Add rate-limit-slip zero support to drop all responses - RRL: Document behavior for different rate-limit-slip options - kdig: Warning instead of error on TSIG validation failure - Cleanup of support libraries interfaces (libknot, libzscanner, libdnssec) - Remove possibly insecure server control over a network socket - Remove implementation limit for the number of network interfaces Bugfixes: --------- - synth-record module: Fix application of default configuration options - TSIG: Allow compressed TSIG name when forwarding DDNS updates - Schedule zone bootstrap after slave zone fails to load from disk
2016-02-28 18:02:38 +01:00
include/libknot/lookup.h
include/libknot/mm_ctx.h
Knot DNS 2.0.1 (2015-09-02) =========================== Bugfixes: --------- - Do not reload expired zones on 'knotc reload' and server startup - Fix rare race-condition in event scheduling causing delayed event execution - Fix skipping of non-authoritative nodes in NSEC proofs - Fix TC flag setting in RRL slipped answers - Disable domain name compression for root label - Log via journald only when running under systemd - Fix CNAME following when quering for NSEC RR type - Fix refreshing of DNSSEC signatures for zone keys - Fix binding an unavailable IPv6 address on Linux (IP_FREEBIND) - Fix infinite loop in knotc zonestatus and memstats - Fix memory leak in configuration on server shutdown - Fix broken dnsproxy module - Fix DNSSEC KASP timestamps parsing in strict POSIX environment - fix multi value parsing on big-endian - Adapt to Nettle 3 API break causing base64 decoding failures on big-endian Features: --------- - Add 'keymgr zone key ds' to show key's DS record - Add 'keymgr tsig generate' to generate TSIG keys - Add query module scoping to process either all queries or zone queries only - Add support for file name globbing in config file includes - Add 'request-edns-option' config option to add custom EDNS0 option into server initiated queries Improvements: ------------- - Send minimal responses (remove NS from Authority section for NOERROR) - Update persistent timers only on shutdown for better performance - Allow change of RR TTL over DDNS - Documentation fixes, updates, and improvements in formatting - Install yparser and zscanner header files - Improve lookup of libsystemd build dependencies - Fix compilation warnings in endian conversion functions on OpenBSD Knot DNS 2.0.0 (2015-06-26) =========================== Bugfixes: --------- - Fix lost NOTIFY message if received during zone transfer - Disable fast zone parser when compiled in Clang (workaround for Clang bug) - kdig: Record correct dnstap SocketProtocol when retrying over TCP - kdig: Hide TSIG section with +noall - Do not set AA flag for AXFR/IXFR queries Features: --------- - DNSSEC: separate library, switch to GnuTLS, new utilities - DNSSEC: basic KASP support (generate initial keys, ZSK rollover) - Configuration: New text format in YAML, binary store in LMDB - Zone parser: Split long TXT/SPF strings into multiple strings - kdig: Add generic dump style option (+generic) - Try all master servers in multi-master environment - Improved remotes and ACLs (multiple addresses, multiple keys) - Basic support for zone file patterns (%s to substitute zone name) - Disable zone file synchronization by setting 'zonefile_sync' to '-1' - knsupdate: Add input prompt in interactive mode and 'quit' command - knsupdate: Allow TSIG algorithm specification in interactive prompt Improvements: ------------- - Zone dump: Do not write class for SOA record (unified with other RR types) - Zone dump: Do not write master server address into the zone file - Documentation: Manual pages are included in HTML and PDF
2015-10-26 20:23:08 +01:00
include/libknot/packet/compr.h
include/libknot/packet/pkt.h
include/libknot/packet/rrset-wire.h
include/libknot/packet/wire.h
include/libknot/rdata.h
include/libknot/rdataset.h
include/libknot/rrset-dump.h
include/libknot/rrset.h
include/libknot/rrtype/aaaa.h
include/libknot/rrtype/dnskey.h
Knot DNS 2.1.1 (2016-02-10) =========================== Bugfixes: --------- - DNSSEC: Allow import of duplicate private key into the KASP - DNSSEC: Avoid duplicate NSEC for Wildcard No Data answer - Fix server crash when an incomming transfer is in progress and reload is issued - Fix socket polling when configured with many interfaces and threads - Fix compilation against Nettle 3.2 Improvements: ------------- - Select correct source address for UDP messages recieved on ANY address - Extend documentation of knotc commands Knot DNS 2.1.0 (2016-01-14) =========================== Features: --------- - Per-thread UDP socket binding using SO_REUSEPORT on Linux - Support for dynamic configuration database - DNSSEC: Support for cryptographic tokens via PKCS #11 interface - DNSSEC: Experimental support for online signing Improvements: ------------- - Support for zone file name patterns - Configurable location of zone timer database - Non-blocking network operations and better timeout handling - Caching of Critical configuration values for better performance - Logging of ACL failures - RRL: Add rate-limit-slip zero support to drop all responses - RRL: Document behavior for different rate-limit-slip options - kdig: Warning instead of error on TSIG validation failure - Cleanup of support libraries interfaces (libknot, libzscanner, libdnssec) - Remove possibly insecure server control over a network socket - Remove implementation limit for the number of network interfaces Bugfixes: --------- - synth-record module: Fix application of default configuration options - TSIG: Allow compressed TSIG name when forwarding DDNS updates - Schedule zone bootstrap after slave zone fails to load from disk
2016-02-28 18:02:38 +01:00
include/libknot/rrtype/ds.h
Knot DNS 2.0.1 (2015-09-02) =========================== Bugfixes: --------- - Do not reload expired zones on 'knotc reload' and server startup - Fix rare race-condition in event scheduling causing delayed event execution - Fix skipping of non-authoritative nodes in NSEC proofs - Fix TC flag setting in RRL slipped answers - Disable domain name compression for root label - Log via journald only when running under systemd - Fix CNAME following when quering for NSEC RR type - Fix refreshing of DNSSEC signatures for zone keys - Fix binding an unavailable IPv6 address on Linux (IP_FREEBIND) - Fix infinite loop in knotc zonestatus and memstats - Fix memory leak in configuration on server shutdown - Fix broken dnsproxy module - Fix DNSSEC KASP timestamps parsing in strict POSIX environment - fix multi value parsing on big-endian - Adapt to Nettle 3 API break causing base64 decoding failures on big-endian Features: --------- - Add 'keymgr zone key ds' to show key's DS record - Add 'keymgr tsig generate' to generate TSIG keys - Add query module scoping to process either all queries or zone queries only - Add support for file name globbing in config file includes - Add 'request-edns-option' config option to add custom EDNS0 option into server initiated queries Improvements: ------------- - Send minimal responses (remove NS from Authority section for NOERROR) - Update persistent timers only on shutdown for better performance - Allow change of RR TTL over DDNS - Documentation fixes, updates, and improvements in formatting - Install yparser and zscanner header files - Improve lookup of libsystemd build dependencies - Fix compilation warnings in endian conversion functions on OpenBSD Knot DNS 2.0.0 (2015-06-26) =========================== Bugfixes: --------- - Fix lost NOTIFY message if received during zone transfer - Disable fast zone parser when compiled in Clang (workaround for Clang bug) - kdig: Record correct dnstap SocketProtocol when retrying over TCP - kdig: Hide TSIG section with +noall - Do not set AA flag for AXFR/IXFR queries Features: --------- - DNSSEC: separate library, switch to GnuTLS, new utilities - DNSSEC: basic KASP support (generate initial keys, ZSK rollover) - Configuration: New text format in YAML, binary store in LMDB - Zone parser: Split long TXT/SPF strings into multiple strings - kdig: Add generic dump style option (+generic) - Try all master servers in multi-master environment - Improved remotes and ACLs (multiple addresses, multiple keys) - Basic support for zone file patterns (%s to substitute zone name) - Disable zone file synchronization by setting 'zonefile_sync' to '-1' - knsupdate: Add input prompt in interactive mode and 'quit' command - knsupdate: Allow TSIG algorithm specification in interactive prompt Improvements: ------------- - Zone dump: Do not write class for SOA record (unified with other RR types) - Zone dump: Do not write master server address into the zone file - Documentation: Manual pages are included in HTML and PDF
2015-10-26 20:23:08 +01:00
include/libknot/rrtype/naptr.h
include/libknot/rrtype/nsec.h
include/libknot/rrtype/nsec3.h
include/libknot/rrtype/nsec3param.h
Knot DNS 2.3.0 (2016-08-09) =========================== Bugfixes: --------- - No wildcard expansion below empty non-terminal for NSEC signed zone - Avoid multiple loads of the same PKCS #11 module - Fix kdig IXFR response processing if the transfer content is empty - Don't ignore non-existing records to be removed in IXFR Improvements: ------------- - Refactored semantic checks and improved error messages - Set TC flag in delegation only if mandatory glue doesn't fit the response - Separate EDNS(0) payload size configuration for IPv4 and IPv6 Features: --------- - DNSSEC policy can be defined in server configuration - Automatic NSEC3 resalt according to DNSSEC policy - Zone content editing using control interface - Zone size limit restriction for DDNS, AXFR, and IXFR (CVE-2016-6171) - DNS-over-TLS support in kdig (RFC 7858) - EDNS(0) padding and alignment support in kdig (RFC 7830)
2016-08-25 16:11:49 +02:00
include/libknot/rrtype/opt-cookie.h
Knot DNS 2.0.1 (2015-09-02) =========================== Bugfixes: --------- - Do not reload expired zones on 'knotc reload' and server startup - Fix rare race-condition in event scheduling causing delayed event execution - Fix skipping of non-authoritative nodes in NSEC proofs - Fix TC flag setting in RRL slipped answers - Disable domain name compression for root label - Log via journald only when running under systemd - Fix CNAME following when quering for NSEC RR type - Fix refreshing of DNSSEC signatures for zone keys - Fix binding an unavailable IPv6 address on Linux (IP_FREEBIND) - Fix infinite loop in knotc zonestatus and memstats - Fix memory leak in configuration on server shutdown - Fix broken dnsproxy module - Fix DNSSEC KASP timestamps parsing in strict POSIX environment - fix multi value parsing on big-endian - Adapt to Nettle 3 API break causing base64 decoding failures on big-endian Features: --------- - Add 'keymgr zone key ds' to show key's DS record - Add 'keymgr tsig generate' to generate TSIG keys - Add query module scoping to process either all queries or zone queries only - Add support for file name globbing in config file includes - Add 'request-edns-option' config option to add custom EDNS0 option into server initiated queries Improvements: ------------- - Send minimal responses (remove NS from Authority section for NOERROR) - Update persistent timers only on shutdown for better performance - Allow change of RR TTL over DDNS - Documentation fixes, updates, and improvements in formatting - Install yparser and zscanner header files - Improve lookup of libsystemd build dependencies - Fix compilation warnings in endian conversion functions on OpenBSD Knot DNS 2.0.0 (2015-06-26) =========================== Bugfixes: --------- - Fix lost NOTIFY message if received during zone transfer - Disable fast zone parser when compiled in Clang (workaround for Clang bug) - kdig: Record correct dnstap SocketProtocol when retrying over TCP - kdig: Hide TSIG section with +noall - Do not set AA flag for AXFR/IXFR queries Features: --------- - DNSSEC: separate library, switch to GnuTLS, new utilities - DNSSEC: basic KASP support (generate initial keys, ZSK rollover) - Configuration: New text format in YAML, binary store in LMDB - Zone parser: Split long TXT/SPF strings into multiple strings - kdig: Add generic dump style option (+generic) - Try all master servers in multi-master environment - Improved remotes and ACLs (multiple addresses, multiple keys) - Basic support for zone file patterns (%s to substitute zone name) - Disable zone file synchronization by setting 'zonefile_sync' to '-1' - knsupdate: Add input prompt in interactive mode and 'quit' command - knsupdate: Allow TSIG algorithm specification in interactive prompt Improvements: ------------- - Zone dump: Do not write class for SOA record (unified with other RR types) - Zone dump: Do not write master server address into the zone file - Documentation: Manual pages are included in HTML and PDF
2015-10-26 20:23:08 +01:00
include/libknot/rrtype/opt.h
include/libknot/rrtype/rdname.h
include/libknot/rrtype/rrsig.h
include/libknot/rrtype/soa.h
include/libknot/rrtype/tsig.h
include/libknot/rrtype/txt.h
include/libknot/tsig-op.h
include/libknot/tsig.h
Knot DNS 2.1.1 (2016-02-10) =========================== Bugfixes: --------- - DNSSEC: Allow import of duplicate private key into the KASP - DNSSEC: Avoid duplicate NSEC for Wildcard No Data answer - Fix server crash when an incomming transfer is in progress and reload is issued - Fix socket polling when configured with many interfaces and threads - Fix compilation against Nettle 3.2 Improvements: ------------- - Select correct source address for UDP messages recieved on ANY address - Extend documentation of knotc commands Knot DNS 2.1.0 (2016-01-14) =========================== Features: --------- - Per-thread UDP socket binding using SO_REUSEPORT on Linux - Support for dynamic configuration database - DNSSEC: Support for cryptographic tokens via PKCS #11 interface - DNSSEC: Experimental support for online signing Improvements: ------------- - Support for zone file name patterns - Configurable location of zone timer database - Non-blocking network operations and better timeout handling - Caching of Critical configuration values for better performance - Logging of ACL failures - RRL: Add rate-limit-slip zero support to drop all responses - RRL: Document behavior for different rate-limit-slip options - kdig: Warning instead of error on TSIG validation failure - Cleanup of support libraries interfaces (libknot, libzscanner, libdnssec) - Remove possibly insecure server control over a network socket - Remove implementation limit for the number of network interfaces Bugfixes: --------- - synth-record module: Fix application of default configuration options - TSIG: Allow compressed TSIG name when forwarding DDNS updates - Schedule zone bootstrap after slave zone fails to load from disk
2016-02-28 18:02:38 +01:00
include/libknot/version.h
Knot DNS 2.5.7 (2018-01-02) =========================== Bugfixes: --------- - Unintentional zone re-sign during reload if empty NSEC3 salt - Inconsistent zone names in journald structured logs - Malformed outgoing transfer for big zone with TSIG - Unexpected reply for DS query with an owner below a delegation point - Old dependencies in the pkg-config file [...] Only new Features & Security fixes of the previous updates are shown below For a complete of all Improvements & Bugfixes, see: https://gitlab.labs.nic.cz/knot/knot-dns/blob/2.5/NEWS Knot DNS 2.5.3 (2017-07-14) =========================== Features: --------- - CSK rollover support for Single-Type Signing Scheme [...] Knot DNS 2.5.2 (2017-06-23) =========================== Security: --------- - CVE-2017-11104: Improper TSIG validity period check can allow TSIG forgery (Thanks to Synacktiv!) Knot DNS 2.5.0 (2017-06-05) =========================== Features: --------- - KASP database switched from JSON files to LMDB database - KSK rollover support using CDNSKEY and CDS in the automatic DNSSEC signing - Dynamic module loading support with proper module API - Journal can store full zone contents (not only differences) - Zone freeze/thaw support - Updated knotc zone-status output with optional column filters - New '[no]crypto' option in kdig - New keymgr implementation reflecting KASP database changes - New pykeymgr for JSON-based KASP database migration - Removed obsolete knot1to2 utility
2018-03-08 15:30:37 +01:00
include/libknot/yparser/yparser.h
include/libknot/yparser/ypformat.h
include/libknot/yparser/ypschema.h
include/libknot/yparser/yptrafo.h
Knot DNS 2.0.1 (2015-09-02) =========================== Bugfixes: --------- - Do not reload expired zones on 'knotc reload' and server startup - Fix rare race-condition in event scheduling causing delayed event execution - Fix skipping of non-authoritative nodes in NSEC proofs - Fix TC flag setting in RRL slipped answers - Disable domain name compression for root label - Log via journald only when running under systemd - Fix CNAME following when quering for NSEC RR type - Fix refreshing of DNSSEC signatures for zone keys - Fix binding an unavailable IPv6 address on Linux (IP_FREEBIND) - Fix infinite loop in knotc zonestatus and memstats - Fix memory leak in configuration on server shutdown - Fix broken dnsproxy module - Fix DNSSEC KASP timestamps parsing in strict POSIX environment - fix multi value parsing on big-endian - Adapt to Nettle 3 API break causing base64 decoding failures on big-endian Features: --------- - Add 'keymgr zone key ds' to show key's DS record - Add 'keymgr tsig generate' to generate TSIG keys - Add query module scoping to process either all queries or zone queries only - Add support for file name globbing in config file includes - Add 'request-edns-option' config option to add custom EDNS0 option into server initiated queries Improvements: ------------- - Send minimal responses (remove NS from Authority section for NOERROR) - Update persistent timers only on shutdown for better performance - Allow change of RR TTL over DDNS - Documentation fixes, updates, and improvements in formatting - Install yparser and zscanner header files - Improve lookup of libsystemd build dependencies - Fix compilation warnings in endian conversion functions on OpenBSD Knot DNS 2.0.0 (2015-06-26) =========================== Bugfixes: --------- - Fix lost NOTIFY message if received during zone transfer - Disable fast zone parser when compiled in Clang (workaround for Clang bug) - kdig: Record correct dnstap SocketProtocol when retrying over TCP - kdig: Hide TSIG section with +noall - Do not set AA flag for AXFR/IXFR queries Features: --------- - DNSSEC: separate library, switch to GnuTLS, new utilities - DNSSEC: basic KASP support (generate initial keys, ZSK rollover) - Configuration: New text format in YAML, binary store in LMDB - Zone parser: Split long TXT/SPF strings into multiple strings - kdig: Add generic dump style option (+generic) - Try all master servers in multi-master environment - Improved remotes and ACLs (multiple addresses, multiple keys) - Basic support for zone file patterns (%s to substitute zone name) - Disable zone file synchronization by setting 'zonefile_sync' to '-1' - knsupdate: Add input prompt in interactive mode and 'quit' command - knsupdate: Allow TSIG algorithm specification in interactive prompt Improvements: ------------- - Zone dump: Do not write class for SOA record (unified with other RR types) - Zone dump: Do not write master server address into the zone file - Documentation: Manual pages are included in HTML and PDF
2015-10-26 20:23:08 +01:00
include/zscanner/error.h
include/zscanner/scanner.h
Knot DNS 2.1.1 (2016-02-10) =========================== Bugfixes: --------- - DNSSEC: Allow import of duplicate private key into the KASP - DNSSEC: Avoid duplicate NSEC for Wildcard No Data answer - Fix server crash when an incomming transfer is in progress and reload is issued - Fix socket polling when configured with many interfaces and threads - Fix compilation against Nettle 3.2 Improvements: ------------- - Select correct source address for UDP messages recieved on ANY address - Extend documentation of knotc commands Knot DNS 2.1.0 (2016-01-14) =========================== Features: --------- - Per-thread UDP socket binding using SO_REUSEPORT on Linux - Support for dynamic configuration database - DNSSEC: Support for cryptographic tokens via PKCS #11 interface - DNSSEC: Experimental support for online signing Improvements: ------------- - Support for zone file name patterns - Configurable location of zone timer database - Non-blocking network operations and better timeout handling - Caching of Critical configuration values for better performance - Logging of ACL failures - RRL: Add rate-limit-slip zero support to drop all responses - RRL: Document behavior for different rate-limit-slip options - kdig: Warning instead of error on TSIG validation failure - Cleanup of support libraries interfaces (libknot, libzscanner, libdnssec) - Remove possibly insecure server control over a network socket - Remove implementation limit for the number of network interfaces Bugfixes: --------- - synth-record module: Fix application of default configuration options - TSIG: Allow compressed TSIG name when forwarding DDNS updates - Schedule zone bootstrap after slave zone fails to load from disk
2016-02-28 18:02:38 +01:00
include/zscanner/version.h
Knot DNS 2.0.1 (2015-09-02) =========================== Bugfixes: --------- - Do not reload expired zones on 'knotc reload' and server startup - Fix rare race-condition in event scheduling causing delayed event execution - Fix skipping of non-authoritative nodes in NSEC proofs - Fix TC flag setting in RRL slipped answers - Disable domain name compression for root label - Log via journald only when running under systemd - Fix CNAME following when quering for NSEC RR type - Fix refreshing of DNSSEC signatures for zone keys - Fix binding an unavailable IPv6 address on Linux (IP_FREEBIND) - Fix infinite loop in knotc zonestatus and memstats - Fix memory leak in configuration on server shutdown - Fix broken dnsproxy module - Fix DNSSEC KASP timestamps parsing in strict POSIX environment - fix multi value parsing on big-endian - Adapt to Nettle 3 API break causing base64 decoding failures on big-endian Features: --------- - Add 'keymgr zone key ds' to show key's DS record - Add 'keymgr tsig generate' to generate TSIG keys - Add query module scoping to process either all queries or zone queries only - Add support for file name globbing in config file includes - Add 'request-edns-option' config option to add custom EDNS0 option into server initiated queries Improvements: ------------- - Send minimal responses (remove NS from Authority section for NOERROR) - Update persistent timers only on shutdown for better performance - Allow change of RR TTL over DDNS - Documentation fixes, updates, and improvements in formatting - Install yparser and zscanner header files - Improve lookup of libsystemd build dependencies - Fix compilation warnings in endian conversion functions on OpenBSD Knot DNS 2.0.0 (2015-06-26) =========================== Bugfixes: --------- - Fix lost NOTIFY message if received during zone transfer - Disable fast zone parser when compiled in Clang (workaround for Clang bug) - kdig: Record correct dnstap SocketProtocol when retrying over TCP - kdig: Hide TSIG section with +noall - Do not set AA flag for AXFR/IXFR queries Features: --------- - DNSSEC: separate library, switch to GnuTLS, new utilities - DNSSEC: basic KASP support (generate initial keys, ZSK rollover) - Configuration: New text format in YAML, binary store in LMDB - Zone parser: Split long TXT/SPF strings into multiple strings - kdig: Add generic dump style option (+generic) - Try all master servers in multi-master environment - Improved remotes and ACLs (multiple addresses, multiple keys) - Basic support for zone file patterns (%s to substitute zone name) - Disable zone file synchronization by setting 'zonefile_sync' to '-1' - knsupdate: Add input prompt in interactive mode and 'quit' command - knsupdate: Allow TSIG algorithm specification in interactive prompt Improvements: ------------- - Zone dump: Do not write class for SOA record (unified with other RR types) - Zone dump: Do not write master server address into the zone file - Documentation: Manual pages are included in HTML and PDF
2015-10-26 20:23:08 +01:00
lib/libdnssec.la
Knot DNS 1.5.3 (2014-09-15) ========================== Bugfixes: --------- - Some specific incoming IXFRs were causing server to crash - Rare sychronization error during reload caused read-after-free - Response synthetization module did not work properly with DNSSEC-enabled zones - When Knot sent AXFR when IXFR was requested, message ID and opcode were wrong - Knot failed to send large messages to remote control (present since 1.5.1) Knot DNS 1.5.2 (2014-09-08) ========================== Bugfixes: --------- - Some RR parsing corner cases were not handled properly - AXFR-style IXFR was refused and had to be retransfered - Hash character (#) was not properly escaped when storing text zone file Knot DNS 1.5.1 (2014-08-19) =========================== Features: --------- - Basic support for logging using systemd journal - DDNS: Ability to process updates in bulk Improvements: ------------- - Unified logging messages structure - DNSSEC: More strict controls for signing keys Bugfixes: --------- - DNSSEC: DNAMEs in RDATA were not lowercased before signing - EDNS: OPT RR were not put into responsing for some errors - TSIG: DDNS responses were not signed with TSIG - DDNS: Prerequisite checks failed for some inputs - knsupdate: Zone origin was not used for deletions Knot DNS 1.5.0 (2014-07-08) =========================== Features: --------- - DDNS forwarding reimplemented Improvements: ------------- - Transfer sizes logged in bytes if needed - Logging outgoing NOTIFY messages - Logging unauthorized incoming NOTIFYs Bugfixes: --------- - Zone flush planning after bootstrap - Incorrect incoming AXFR message sizes - DDNS signing changes were freed too soon, posibility of stale data - knotc remote control key handling Knot DNS 1.5.0-rc2 (2014-06-18) =============================== Features: --------- - edns-client-subnet support in kdig - Optional asynchronous startup (config "asynchronous-start") Improvements: ------------- - Preempt task queue for faster reload - Lazy zone file write after zone transfer (governed by "zonefile-sync") Bugfixes: --------- - Close zone transfer after SERVFAIL response - Incremental to full zone transfer fallback, wrong log message - Zone events corner cases, reload replanning Knot DNS 1.5.0-rc1 (2014-06-03) =============================== Features: --------- - Pluggable query processing modules - Synthetic IPv4/IPv6 reverse/forward records (optional module) - dnstap support in both utilities & server (optional module) - NOTIFY message support and new TSIG section in kdig - Zone transfer master failover Improvements: ------------- - Query processing and core functionality overhaul - Performance and reduced memory footprint - Faster zone events scheduling - RFC compliant queries/responses in some corner cases - Log messages - New documentation (Sphinx)
2014-11-10 22:20:32 +01:00
lib/libknot.la
lib/libzscanner.la
Knot DNS 2.5.7 (2018-01-02) =========================== Bugfixes: --------- - Unintentional zone re-sign during reload if empty NSEC3 salt - Inconsistent zone names in journald structured logs - Malformed outgoing transfer for big zone with TSIG - Unexpected reply for DS query with an owner below a delegation point - Old dependencies in the pkg-config file [...] Only new Features & Security fixes of the previous updates are shown below For a complete of all Improvements & Bugfixes, see: https://gitlab.labs.nic.cz/knot/knot-dns/blob/2.5/NEWS Knot DNS 2.5.3 (2017-07-14) =========================== Features: --------- - CSK rollover support for Single-Type Signing Scheme [...] Knot DNS 2.5.2 (2017-06-23) =========================== Security: --------- - CVE-2017-11104: Improper TSIG validity period check can allow TSIG forgery (Thanks to Synacktiv!) Knot DNS 2.5.0 (2017-06-05) =========================== Features: --------- - KASP database switched from JSON files to LMDB database - KSK rollover support using CDNSKEY and CDS in the automatic DNSSEC signing - Dynamic module loading support with proper module API - Journal can store full zone contents (not only differences) - Zone freeze/thaw support - Updated knotc zone-status output with optional column filters - New '[no]crypto' option in kdig - New keymgr implementation reflecting KASP database changes - New pykeymgr for JSON-based KASP database migration - Removed obsolete knot1to2 utility
2018-03-08 15:30:37 +01:00
lib/pkgconfig/knotd.pc
Knot DNS 2.0.1 (2015-09-02) =========================== Bugfixes: --------- - Do not reload expired zones on 'knotc reload' and server startup - Fix rare race-condition in event scheduling causing delayed event execution - Fix skipping of non-authoritative nodes in NSEC proofs - Fix TC flag setting in RRL slipped answers - Disable domain name compression for root label - Log via journald only when running under systemd - Fix CNAME following when quering for NSEC RR type - Fix refreshing of DNSSEC signatures for zone keys - Fix binding an unavailable IPv6 address on Linux (IP_FREEBIND) - Fix infinite loop in knotc zonestatus and memstats - Fix memory leak in configuration on server shutdown - Fix broken dnsproxy module - Fix DNSSEC KASP timestamps parsing in strict POSIX environment - fix multi value parsing on big-endian - Adapt to Nettle 3 API break causing base64 decoding failures on big-endian Features: --------- - Add 'keymgr zone key ds' to show key's DS record - Add 'keymgr tsig generate' to generate TSIG keys - Add query module scoping to process either all queries or zone queries only - Add support for file name globbing in config file includes - Add 'request-edns-option' config option to add custom EDNS0 option into server initiated queries Improvements: ------------- - Send minimal responses (remove NS from Authority section for NOERROR) - Update persistent timers only on shutdown for better performance - Allow change of RR TTL over DDNS - Documentation fixes, updates, and improvements in formatting - Install yparser and zscanner header files - Improve lookup of libsystemd build dependencies - Fix compilation warnings in endian conversion functions on OpenBSD Knot DNS 2.0.0 (2015-06-26) =========================== Bugfixes: --------- - Fix lost NOTIFY message if received during zone transfer - Disable fast zone parser when compiled in Clang (workaround for Clang bug) - kdig: Record correct dnstap SocketProtocol when retrying over TCP - kdig: Hide TSIG section with +noall - Do not set AA flag for AXFR/IXFR queries Features: --------- - DNSSEC: separate library, switch to GnuTLS, new utilities - DNSSEC: basic KASP support (generate initial keys, ZSK rollover) - Configuration: New text format in YAML, binary store in LMDB - Zone parser: Split long TXT/SPF strings into multiple strings - kdig: Add generic dump style option (+generic) - Try all master servers in multi-master environment - Improved remotes and ACLs (multiple addresses, multiple keys) - Basic support for zone file patterns (%s to substitute zone name) - Disable zone file synchronization by setting 'zonefile_sync' to '-1' - knsupdate: Add input prompt in interactive mode and 'quit' command - knsupdate: Allow TSIG algorithm specification in interactive prompt Improvements: ------------- - Zone dump: Do not write class for SOA record (unified with other RR types) - Zone dump: Do not write master server address into the zone file - Documentation: Manual pages are included in HTML and PDF
2015-10-26 20:23:08 +01:00
lib/pkgconfig/libdnssec.pc
lib/pkgconfig/libknot.pc
lib/pkgconfig/libzscanner.pc
v1.3.1 - Aug 26, 2013 --------------------- Bugfixes: * Response with NSID contained extra bytes after reload * List of remotes is scanned for longest prefix match * Multipacket TSIG signatures for transfers * Wrongly parsed TSIG key secret without quotes * Removed autoconf checks for extended instruction sets v1.3.0 - Aug 5, 2013 -------------------- Features: * Defaults for CH TXT id.server,version.server (see doc) Bugfixes: * Progressive interval for bootstrap retry * Transfers randomly cancelled * Disabling RRL on reload * Secondary groups not initialized when dropping privileges * Responding to DS queries for names at or below delegation points v1.3.0-rc5 - Jul 29, 2013 ------------------------- Features: * Much faster bootstrap of many zones Bugfixes: * Removed deprecated 'knotc -w' option * Slave ignores out-of-zone records in zone * Support for obsolete types in zone transfers * Slave zone file names fixes * Long transfers being randomly dropped v1.3.0-rc4 - Jul 15, 2013 ------------------------- Features: * --with-configdir option for default config path * Reintroducted 'pidfile' config option Bugfixes: * AXFR/IXFR subsystem performance improvements * Rescheduling of AXFR in some cases * RRSIGs not in the same section for DS records * Log messages leaking to syslog * 'knotc restart' option removed due to several limitations v1.3.0-rc3 - Jun 28, 2013 ------------------------- Features: * Utility to estimate memory consumption (see 'knotc memstats') * PID file is not created when running on foreground * UNIX sockets support for knotc * Configurable 'rundir' and 'storage' Bugfixes: * IXFR with an arbitrary number of diffs * Processing of knotc TSIG keyfile * Atomic PID file writing, removed deprecated 'knotc start' * Performance regression when RRSIGs came before covered RRs in AXFR v1.3.0-rc2 - Jun 14, 2013 ------------------------- Bugfixes: * Label compression related bug * Proper resolution of some CNAME chains * Unstable response rate in rare cases * Several log messages v1.3.0-rc1 - Jun 4, 2013 --------------------------- Features: * Faster zone parser * Full support for EUI and ILNP resource records * Lower memory footprint for large zones * No compilation of zones * Improved scheduling of zone transfers * Logging of serials and timing information for zone transfers * Config: 'groups' keyword allowing to create groups of remotes * Config: 'include' keyword allowing other file includes * Client utilities: kdig, khost, knsupdate * Server identification using TXT/CH queries (RFC 4892) * Improved build scripts * Improved dname compression and performance Bugfixes: * Fixed creating of PID file when dropping privileges
2013-09-13 20:14:11 +02:00
man/man1/kdig.1
man/man1/khost.1
Knot DNS 2.3.3 (2016-12-08) =========================== Bugfixes: --------- - Double free when failed to apply zone journal - Zone bootstrap retry interval not preserved upon zone reload - DNSSEC related records not flushed if not signed - False semantic checks warning about incorrect type in NSEC bitmap - Memory leak in kzonecheck Improvements: ------------- - All zone names are fully-qualified in log Features: --------- - New kjournalprint utility Knot DNS 2.3.2 (2016-11-04) =========================== Bugfixes: --------- - Incorrect %s expansion for the root zone - Failed to refresh not existing slave zone after restart - Immediate zone refresh upon restart if refresh already scheduled - Early zone transfer after restart if transfer already scheduled - Not ignoring empty non-terminal parents during delegation lookup - CD bit preservation in responses - Compilation error on GNU/kFreeBSD - Server crash after double zone-commit if journal error Improvements: ------------- - Speed-up of knotc if control operation and known socket - Zone purge operation purges also zone timers Features: --------- - Simple modules don't require empty configuration section - New zone journal path configuration option - New timeout configuration option for module dnsproxy
2016-12-09 23:28:17 +01:00
man/man1/kjournalprint.1
v1.4.2 - Jan 27, 2014 --------------------- Bugfixes: * AXFR/IXFR compatibility issues with tinydns/axfrdns * Journal file is created only when needed * Zone-related log messages are logged into correct category * DNSSEC: Refresh signatures earlier (3 days before their expiration with the default signature lifetime) * Fixed RCU synchronization causing deadlock on 'knotc signzone' * RRSIG not fitting in the additional records doesn't cause truncation v1.4.1 - Jan 13, 2014 --------------------- Bugfixes: * Empty APL record support * 'zonestatus' when using immediate zone syncing * Immediate zone syncing after reload * Race condition writing time values to zone file v1.4.0 - Jan 6, 2014 --------------------- Features: * Zone SERIAL policies (INCREMENT, UNIXTIME) Bugfixes: * AXFR crash with specific packet * QNAME case-sensitive since 1.4.0-rc0 * DNSSEC records over DDNS * Semantic check fail in AXFR is only soft-error * Journal race condition * Notifies are sent immediately v1.4.0-rc2 - Dec 13, 2013 ------------------------- Features: * IDN support in Knot utilities * DNSSEC: support for GOST algorithm Bugfixes: * Crash in particular additionals processing * Race condition in event cancelation * Journal corruption after failed transactions * DNSSEC: fixed detection of ECDSA support Other improvements: * ./configure prints build configuration summary * Pretty zone file output (DNSSEC-related data separately) * Lower memory consumption * config: option 'dnssec-keydir' can be set per zone * config: option 'storage' can be set per zone v1.4.0-rc1 - Nov 20, 2013 ------------------------- Features: * Better logging of automatic DNSSEC events * Support for DNSSEC key pre-publication Bugfixes: * Refactored zone loading * Improved journal locking and fixed some race conditions * Various fixes in client utilities * Fixed memory errors in automatic DNSSEC signing * 'dnssec-keydir' doesn't auto-enable signing * Fixed rescheduling of zone resigns v1.4.0-beta - Oct 28, 2013 -------------------------- Features: * Experimental automatic DNSSEC signing * Reduced memory usage
2014-01-31 23:05:43 +01:00
man/man1/knsec3hash.1
v1.3.1 - Aug 26, 2013 --------------------- Bugfixes: * Response with NSID contained extra bytes after reload * List of remotes is scanned for longest prefix match * Multipacket TSIG signatures for transfers * Wrongly parsed TSIG key secret without quotes * Removed autoconf checks for extended instruction sets v1.3.0 - Aug 5, 2013 -------------------- Features: * Defaults for CH TXT id.server,version.server (see doc) Bugfixes: * Progressive interval for bootstrap retry * Transfers randomly cancelled * Disabling RRL on reload * Secondary groups not initialized when dropping privileges * Responding to DS queries for names at or below delegation points v1.3.0-rc5 - Jul 29, 2013 ------------------------- Features: * Much faster bootstrap of many zones Bugfixes: * Removed deprecated 'knotc -w' option * Slave ignores out-of-zone records in zone * Support for obsolete types in zone transfers * Slave zone file names fixes * Long transfers being randomly dropped v1.3.0-rc4 - Jul 15, 2013 ------------------------- Features: * --with-configdir option for default config path * Reintroducted 'pidfile' config option Bugfixes: * AXFR/IXFR subsystem performance improvements * Rescheduling of AXFR in some cases * RRSIGs not in the same section for DS records * Log messages leaking to syslog * 'knotc restart' option removed due to several limitations v1.3.0-rc3 - Jun 28, 2013 ------------------------- Features: * Utility to estimate memory consumption (see 'knotc memstats') * PID file is not created when running on foreground * UNIX sockets support for knotc * Configurable 'rundir' and 'storage' Bugfixes: * IXFR with an arbitrary number of diffs * Processing of knotc TSIG keyfile * Atomic PID file writing, removed deprecated 'knotc start' * Performance regression when RRSIGs came before covered RRs in AXFR v1.3.0-rc2 - Jun 14, 2013 ------------------------- Bugfixes: * Label compression related bug * Proper resolution of some CNAME chains * Unstable response rate in rare cases * Several log messages v1.3.0-rc1 - Jun 4, 2013 --------------------------- Features: * Faster zone parser * Full support for EUI and ILNP resource records * Lower memory footprint for large zones * No compilation of zones * Improved scheduling of zone transfers * Logging of serials and timing information for zone transfers * Config: 'groups' keyword allowing to create groups of remotes * Config: 'include' keyword allowing other file includes * Client utilities: kdig, khost, knsupdate * Server identification using TXT/CH queries (RFC 4892) * Improved build scripts * Improved dname compression and performance Bugfixes: * Fixed creating of PID file when dropping privileges
2013-09-13 20:14:11 +02:00
man/man1/knsupdate.1
Knot DNS 2.3.0 (2016-08-09) =========================== Bugfixes: --------- - No wildcard expansion below empty non-terminal for NSEC signed zone - Avoid multiple loads of the same PKCS #11 module - Fix kdig IXFR response processing if the transfer content is empty - Don't ignore non-existing records to be removed in IXFR Improvements: ------------- - Refactored semantic checks and improved error messages - Set TC flag in delegation only if mandatory glue doesn't fit the response - Separate EDNS(0) payload size configuration for IPv4 and IPv6 Features: --------- - DNSSEC policy can be defined in server configuration - Automatic NSEC3 resalt according to DNSSEC policy - Zone content editing using control interface - Zone size limit restriction for DDNS, AXFR, and IXFR (CVE-2016-6171) - DNS-over-TLS support in kdig (RFC 7858) - EDNS(0) padding and alignment support in kdig (RFC 7830)
2016-08-25 16:11:49 +02:00
man/man1/kzonecheck.1
v1.1.1 - Oct 31, 2012 --------------------- Bugfixes: * Fixed assertion failing when asking directly for a wildcard name. v1.1.1-rc1 - Oct 23, 2012 ------------------------- Bugfixes: * Crash after IXFR in certain cases when adding RRSIG in an IXFR. * Fixed behaviour when incoming IXFR removes a zone cut. Previously occluded names now become properly visible. Previously lead to a crash when the server was asked for the previously occluded name. * Fixed handling of zero-length strings in text zone dump. Caused the compilation to fail. * Fixed TSIG algorithm name comparison - the names should be in canonical form. * Fixed handling unknown RR types with type less than 251. Features: * Improved compression of packets. Out-of-zone dnames present in RDATA were not compressed. * Slave zones are now automatically refreshed after startup. * Proper response to IXFR/UDP query (returns SOA in Authority section).
2012-11-06 00:08:06 +01:00
man/man5/knot.conf.5
Knot DNS 2.0.1 (2015-09-02) =========================== Bugfixes: --------- - Do not reload expired zones on 'knotc reload' and server startup - Fix rare race-condition in event scheduling causing delayed event execution - Fix skipping of non-authoritative nodes in NSEC proofs - Fix TC flag setting in RRL slipped answers - Disable domain name compression for root label - Log via journald only when running under systemd - Fix CNAME following when quering for NSEC RR type - Fix refreshing of DNSSEC signatures for zone keys - Fix binding an unavailable IPv6 address on Linux (IP_FREEBIND) - Fix infinite loop in knotc zonestatus and memstats - Fix memory leak in configuration on server shutdown - Fix broken dnsproxy module - Fix DNSSEC KASP timestamps parsing in strict POSIX environment - fix multi value parsing on big-endian - Adapt to Nettle 3 API break causing base64 decoding failures on big-endian Features: --------- - Add 'keymgr zone key ds' to show key's DS record - Add 'keymgr tsig generate' to generate TSIG keys - Add query module scoping to process either all queries or zone queries only - Add support for file name globbing in config file includes - Add 'request-edns-option' config option to add custom EDNS0 option into server initiated queries Improvements: ------------- - Send minimal responses (remove NS from Authority section for NOERROR) - Update persistent timers only on shutdown for better performance - Allow change of RR TTL over DDNS - Documentation fixes, updates, and improvements in formatting - Install yparser and zscanner header files - Improve lookup of libsystemd build dependencies - Fix compilation warnings in endian conversion functions on OpenBSD Knot DNS 2.0.0 (2015-06-26) =========================== Bugfixes: --------- - Fix lost NOTIFY message if received during zone transfer - Disable fast zone parser when compiled in Clang (workaround for Clang bug) - kdig: Record correct dnstap SocketProtocol when retrying over TCP - kdig: Hide TSIG section with +noall - Do not set AA flag for AXFR/IXFR queries Features: --------- - DNSSEC: separate library, switch to GnuTLS, new utilities - DNSSEC: basic KASP support (generate initial keys, ZSK rollover) - Configuration: New text format in YAML, binary store in LMDB - Zone parser: Split long TXT/SPF strings into multiple strings - kdig: Add generic dump style option (+generic) - Try all master servers in multi-master environment - Improved remotes and ACLs (multiple addresses, multiple keys) - Basic support for zone file patterns (%s to substitute zone name) - Disable zone file synchronization by setting 'zonefile_sync' to '-1' - knsupdate: Add input prompt in interactive mode and 'quit' command - knsupdate: Allow TSIG algorithm specification in interactive prompt Improvements: ------------- - Zone dump: Do not write class for SOA record (unified with other RR types) - Zone dump: Do not write master server address into the zone file - Documentation: Manual pages are included in HTML and PDF
2015-10-26 20:23:08 +01:00
man/man8/keymgr.8
Knot DNS is a high-performance authoritative-only DNS server which supports all key features of the domain name system including zone transfers, dynamic updates and DNSSEC.
2012-10-03 00:40:07 +02:00
man/man8/knotc.8
man/man8/knotd.8
Knot DNS 2.5.7 (2018-01-02) =========================== Bugfixes: --------- - Unintentional zone re-sign during reload if empty NSEC3 salt - Inconsistent zone names in journald structured logs - Malformed outgoing transfer for big zone with TSIG - Unexpected reply for DS query with an owner below a delegation point - Old dependencies in the pkg-config file [...] Only new Features & Security fixes of the previous updates are shown below For a complete of all Improvements & Bugfixes, see: https://gitlab.labs.nic.cz/knot/knot-dns/blob/2.5/NEWS Knot DNS 2.5.3 (2017-07-14) =========================== Features: --------- - CSK rollover support for Single-Type Signing Scheme [...] Knot DNS 2.5.2 (2017-06-23) =========================== Security: --------- - CVE-2017-11104: Improper TSIG validity period check can allow TSIG forgery (Thanks to Synacktiv!) Knot DNS 2.5.0 (2017-06-05) =========================== Features: --------- - KASP database switched from JSON files to LMDB database - KSK rollover support using CDNSKEY and CDS in the automatic DNSSEC signing - Dynamic module loading support with proper module API - Journal can store full zone contents (not only differences) - Zone freeze/thaw support - Updated knotc zone-status output with optional column filters - New '[no]crypto' option in kdig - New keymgr implementation reflecting KASP database changes - New pykeymgr for JSON-based KASP database migration - Removed obsolete knot1to2 utility
2018-03-08 15:30:37 +01:00
man/man8/pykeymgr.8
Knot DNS 2.0.1 (2015-09-02) =========================== Bugfixes: --------- - Do not reload expired zones on 'knotc reload' and server startup - Fix rare race-condition in event scheduling causing delayed event execution - Fix skipping of non-authoritative nodes in NSEC proofs - Fix TC flag setting in RRL slipped answers - Disable domain name compression for root label - Log via journald only when running under systemd - Fix CNAME following when quering for NSEC RR type - Fix refreshing of DNSSEC signatures for zone keys - Fix binding an unavailable IPv6 address on Linux (IP_FREEBIND) - Fix infinite loop in knotc zonestatus and memstats - Fix memory leak in configuration on server shutdown - Fix broken dnsproxy module - Fix DNSSEC KASP timestamps parsing in strict POSIX environment - fix multi value parsing on big-endian - Adapt to Nettle 3 API break causing base64 decoding failures on big-endian Features: --------- - Add 'keymgr zone key ds' to show key's DS record - Add 'keymgr tsig generate' to generate TSIG keys - Add query module scoping to process either all queries or zone queries only - Add support for file name globbing in config file includes - Add 'request-edns-option' config option to add custom EDNS0 option into server initiated queries Improvements: ------------- - Send minimal responses (remove NS from Authority section for NOERROR) - Update persistent timers only on shutdown for better performance - Allow change of RR TTL over DDNS - Documentation fixes, updates, and improvements in formatting - Install yparser and zscanner header files - Improve lookup of libsystemd build dependencies - Fix compilation warnings in endian conversion functions on OpenBSD Knot DNS 2.0.0 (2015-06-26) =========================== Bugfixes: --------- - Fix lost NOTIFY message if received during zone transfer - Disable fast zone parser when compiled in Clang (workaround for Clang bug) - kdig: Record correct dnstap SocketProtocol when retrying over TCP - kdig: Hide TSIG section with +noall - Do not set AA flag for AXFR/IXFR queries Features: --------- - DNSSEC: separate library, switch to GnuTLS, new utilities - DNSSEC: basic KASP support (generate initial keys, ZSK rollover) - Configuration: New text format in YAML, binary store in LMDB - Zone parser: Split long TXT/SPF strings into multiple strings - kdig: Add generic dump style option (+generic) - Try all master servers in multi-master environment - Improved remotes and ACLs (multiple addresses, multiple keys) - Basic support for zone file patterns (%s to substitute zone name) - Disable zone file synchronization by setting 'zonefile_sync' to '-1' - knsupdate: Add input prompt in interactive mode and 'quit' command - knsupdate: Allow TSIG algorithm specification in interactive prompt Improvements: ------------- - Zone dump: Do not write class for SOA record (unified with other RR types) - Zone dump: Do not write master server address into the zone file - Documentation: Manual pages are included in HTML and PDF
2015-10-26 20:23:08 +01:00
sbin/keymgr
Knot DNS is a high-performance authoritative-only DNS server which supports all key features of the domain name system including zone transfers, dynamic updates and DNSSEC.
2012-10-03 00:40:07 +02:00
sbin/knotc
sbin/knotd
Knot DNS 2.5.7 (2018-01-02) =========================== Bugfixes: --------- - Unintentional zone re-sign during reload if empty NSEC3 salt - Inconsistent zone names in journald structured logs - Malformed outgoing transfer for big zone with TSIG - Unexpected reply for DS query with an owner below a delegation point - Old dependencies in the pkg-config file [...] Only new Features & Security fixes of the previous updates are shown below For a complete of all Improvements & Bugfixes, see: https://gitlab.labs.nic.cz/knot/knot-dns/blob/2.5/NEWS Knot DNS 2.5.3 (2017-07-14) =========================== Features: --------- - CSK rollover support for Single-Type Signing Scheme [...] Knot DNS 2.5.2 (2017-06-23) =========================== Security: --------- - CVE-2017-11104: Improper TSIG validity period check can allow TSIG forgery (Thanks to Synacktiv!) Knot DNS 2.5.0 (2017-06-05) =========================== Features: --------- - KASP database switched from JSON files to LMDB database - KSK rollover support using CDNSKEY and CDS in the automatic DNSSEC signing - Dynamic module loading support with proper module API - Journal can store full zone contents (not only differences) - Zone freeze/thaw support - Updated knotc zone-status output with optional column filters - New '[no]crypto' option in kdig - New keymgr implementation reflecting KASP database changes - New pykeymgr for JSON-based KASP database migration - Removed obsolete knot1to2 utility
2018-03-08 15:30:37 +01:00
sbin/pykeymgr
Knot DNS is a high-performance authoritative-only DNS server which supports all key features of the domain name system including zone transfers, dynamic updates and DNSSEC.
2012-10-03 00:40:07 +02:00
share/examples/knot/example.com.zone
share/examples/knot/knot.sample.conf
Knot DNS 2.2.1 (2016-05-24) =========================== Bugfixes: --------- - Fix separate logging of server and zone events - Fix concurrent zone file flushing with many zones - Fix possible server crash with empty hostname on OpenWRT - Fix control timeout parsing in knotc - Fix "Environment maxreaders limit reached" error in knotc - Don't apply journal changes on modified zone file - Remove broken LTO option from configure script - Enable multiple zone names completion in interactive knotc - Set the TC flag in a response if a glue doesn't fit the response - Disallow server reload when there is an active configuration transaction Improvements: ------------- - Distinguish unavailable zones from zones with zero serial in log messages - Log warning and error messages to standard error output in all utilities - Document tested PKCS #11 devices - Extended Python configuration interface Knot DNS 2.2.0 (2016-04-26) =========================== Bugfixes: --------- - Fix build dependencies on FreeBSD - Fix query/response message type setting in dnstap module - Fix remote address retrieval from dnstap capture in kdig - Fix global modules execution for queries hitting existing zones - Fix execution of semantic checks after an IXFR transfer - Fix PKCS#11 support detection at build time - Fix kdig failure when the first AXFR message contains just the SOA record - Exclude non-authoritative types from NSEC/NSEC3 bitmap at a delegation - Mark PKCS#11 generated keys as sensitive (required by Luna SA) - Fix error when removing the only zone from the server - Don't abort knotc transaction when some check fails Features: --------- - URI and CAA resource record types support - RRL client address based white list - knotc interactive mode Improvements: ------------- - Consistent IXFR error messages - Various fixes for better compatibility with PKCS#11 devices - Various keymgr user interface improvements - Better zone event scheduler performance with many zones - New server control interface - kdig uses local resolver if resolv.conf is empty
2016-06-16 19:12:27 +02:00
@pkgdir etc/knot
Reference in a new issue Copy permalink