kpriv/pkgsrc
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
pkgsrc/net/knot/Makefile

68 lines
1.8 KiB
Makefile
Raw Normal View History

knot: Update to 3.0.3 Changelog: Version 3.0.3 Features: + Kjournalprint can display changesets starting from specific SOA serial Improvements: + New configuration check on ambiguous 'storage' specification #706 + New configuration check on problematic 'zonefile-load' with 'journal-contents' combination + Server logs positive ACL check in debug severity level (Thanks to Andreas Schrägle) + More verbose logging of failed zone backup + Extended documentation for catalog zones Bugfixes: + On-slave signing produces broken NSEC(3) chain if glue node becomes (un-)orphaned #705 + Server responds CNAME query with NXDOMAIN for CNAME synthesized from DNAME + Kdig crashes if source address and dnstap logging are specified together #702 + Knotc fails to display error returned from zone freeze or zone thaw + Dynamically reconfigured zone isn't loaded upon configuration commit + Keymgr is unable to import BIND-style private key if it contains empty lines + Zone backup fails to backup keys if any of them is public-only + Failed to build with XDP support on Debian testing Version 3.0.2 Features: + kdig prints Extended DNS Error (Gift for Marek Vavruša) + kxdpgun allows source IP address/subnet specification Improvements: + Server doesn't start if any of listen addresses fails to bind + knotc no longer stores empty and adjacent identical commands to interactive history + Depth of interactive history of knotc was increased to 1000 commands + keymgr prints error messages to stderr instead of stdout + keymgr checks for proper offline-ksk configuration before processing KSR or SKR + keymgr imports Revoked timer from BIND keys + Additional XDP support detection in server + Lots of spelling and grammar fixes in documentation (Thanks to Paul Dee) + Some documentation improvements Bugfixes: + If more masters configured, zone retransfer triggers AXFR from all masters + Server can fail to bind address during restart due to missing SO_REUSEADDR + KSK imported from BIND doesn't roll over automatically + libdnssec respects local GnuTLS policy — affects DNSSEC operations and Knot Resolver + kdig can stuck in infinite loop when solving BADCOOKIE responses + Zone names received over control interface are not lower-cased + Zone attributes not secured with multi-threaded changes + kzonecheck ignores forced dnssec checks if zone not signed + kzonecheck fails on case-sensitivity of owner names in NSEC records # 699 + kdig fails to establish TLS connection #700 + Server responds NOTIMPL to queries with QDCOUNT 0 and known OPCODE
2021-01-06 13:18:48 +01:00
# $NetBSD: Makefile,v 1.60 2021/01/06 12:18:48 ryoon Exp $
Knot DNS is a high-performance authoritative-only DNS server which supports all key features of the domain name system including zone transfers, dynamic updates and DNSSEC.
2012-10-03 00:40:07 +02:00
knot: Update to 3.0.3 Changelog: Version 3.0.3 Features: + Kjournalprint can display changesets starting from specific SOA serial Improvements: + New configuration check on ambiguous 'storage' specification #706 + New configuration check on problematic 'zonefile-load' with 'journal-contents' combination + Server logs positive ACL check in debug severity level (Thanks to Andreas Schrägle) + More verbose logging of failed zone backup + Extended documentation for catalog zones Bugfixes: + On-slave signing produces broken NSEC(3) chain if glue node becomes (un-)orphaned #705 + Server responds CNAME query with NXDOMAIN for CNAME synthesized from DNAME + Kdig crashes if source address and dnstap logging are specified together #702 + Knotc fails to display error returned from zone freeze or zone thaw + Dynamically reconfigured zone isn't loaded upon configuration commit + Keymgr is unable to import BIND-style private key if it contains empty lines + Zone backup fails to backup keys if any of them is public-only + Failed to build with XDP support on Debian testing Version 3.0.2 Features: + kdig prints Extended DNS Error (Gift for Marek Vavruša) + kxdpgun allows source IP address/subnet specification Improvements: + Server doesn't start if any of listen addresses fails to bind + knotc no longer stores empty and adjacent identical commands to interactive history + Depth of interactive history of knotc was increased to 1000 commands + keymgr prints error messages to stderr instead of stdout + keymgr checks for proper offline-ksk configuration before processing KSR or SKR + keymgr imports Revoked timer from BIND keys + Additional XDP support detection in server + Lots of spelling and grammar fixes in documentation (Thanks to Paul Dee) + Some documentation improvements Bugfixes: + If more masters configured, zone retransfer triggers AXFR from all masters + Server can fail to bind address during restart due to missing SO_REUSEADDR + KSK imported from BIND doesn't roll over automatically + libdnssec respects local GnuTLS policy — affects DNSSEC operations and Knot Resolver + kdig can stuck in infinite loop when solving BADCOOKIE responses + Zone names received over control interface are not lower-cased + Zone attributes not secured with multi-threaded changes + kzonecheck ignores forced dnssec checks if zone not signed + kzonecheck fails on case-sensitivity of owner names in NSEC records # 699 + kdig fails to establish TLS connection #700 + Server responds NOTIMPL to queries with QDCOUNT 0 and known OPCODE
2021-01-06 13:18:48 +01:00
DISTNAME= knot-3.0.3
Knot DNS is a high-performance authoritative-only DNS server which supports all key features of the domain name system including zone transfers, dynamic updates and DNSSEC.
2012-10-03 00:40:07 +02:00
CATEGORIES= net
Fix MASTER_SITES. Addresses PR 48673.
2014-03-21 13:23:52 +01:00
MASTER_SITES= https://secure.nic.cz/files/knot-dns/
Knot DNS 2.0.1 (2015-09-02) =========================== Bugfixes: --------- - Do not reload expired zones on 'knotc reload' and server startup - Fix rare race-condition in event scheduling causing delayed event execution - Fix skipping of non-authoritative nodes in NSEC proofs - Fix TC flag setting in RRL slipped answers - Disable domain name compression for root label - Log via journald only when running under systemd - Fix CNAME following when quering for NSEC RR type - Fix refreshing of DNSSEC signatures for zone keys - Fix binding an unavailable IPv6 address on Linux (IP_FREEBIND) - Fix infinite loop in knotc zonestatus and memstats - Fix memory leak in configuration on server shutdown - Fix broken dnsproxy module - Fix DNSSEC KASP timestamps parsing in strict POSIX environment - fix multi value parsing on big-endian - Adapt to Nettle 3 API break causing base64 decoding failures on big-endian Features: --------- - Add 'keymgr zone key ds' to show key's DS record - Add 'keymgr tsig generate' to generate TSIG keys - Add query module scoping to process either all queries or zone queries only - Add support for file name globbing in config file includes - Add 'request-edns-option' config option to add custom EDNS0 option into server initiated queries Improvements: ------------- - Send minimal responses (remove NS from Authority section for NOERROR) - Update persistent timers only on shutdown for better performance - Allow change of RR TTL over DDNS - Documentation fixes, updates, and improvements in formatting - Install yparser and zscanner header files - Improve lookup of libsystemd build dependencies - Fix compilation warnings in endian conversion functions on OpenBSD Knot DNS 2.0.0 (2015-06-26) =========================== Bugfixes: --------- - Fix lost NOTIFY message if received during zone transfer - Disable fast zone parser when compiled in Clang (workaround for Clang bug) - kdig: Record correct dnstap SocketProtocol when retrying over TCP - kdig: Hide TSIG section with +noall - Do not set AA flag for AXFR/IXFR queries Features: --------- - DNSSEC: separate library, switch to GnuTLS, new utilities - DNSSEC: basic KASP support (generate initial keys, ZSK rollover) - Configuration: New text format in YAML, binary store in LMDB - Zone parser: Split long TXT/SPF strings into multiple strings - kdig: Add generic dump style option (+generic) - Try all master servers in multi-master environment - Improved remotes and ACLs (multiple addresses, multiple keys) - Basic support for zone file patterns (%s to substitute zone name) - Disable zone file synchronization by setting 'zonefile_sync' to '-1' - knsupdate: Add input prompt in interactive mode and 'quit' command - knsupdate: Allow TSIG algorithm specification in interactive prompt Improvements: ------------- - Zone dump: Do not write class for SOA record (unified with other RR types) - Zone dump: Do not write master server address into the zone file - Documentation: Manual pages are included in HTML and PDF
2015-10-26 20:23:08 +01:00
EXTRACT_SUFX= .tar.xz
Knot DNS is a high-performance authoritative-only DNS server which supports all key features of the domain name system including zone transfers, dynamic updates and DNSSEC.
2012-10-03 00:40:07 +02:00
MAINTAINER= pettai@NetBSD.org
Follow some http redirects.
2017-08-16 22:21:03 +02:00
HOMEPAGE= https://www.knot-dns.cz/
Knot DNS is a high-performance authoritative-only DNS server which supports all key features of the domain name system including zone transfers, dynamic updates and DNSSEC.
2012-10-03 00:40:07 +02:00
COMMENT= Knot (auth) DNS server
LICENSE= gnu-gpl-v3
v1.1.1 - Oct 31, 2012 --------------------- Bugfixes: * Fixed assertion failing when asking directly for a wildcard name. v1.1.1-rc1 - Oct 23, 2012 ------------------------- Bugfixes: * Crash after IXFR in certain cases when adding RRSIG in an IXFR. * Fixed behaviour when incoming IXFR removes a zone cut. Previously occluded names now become properly visible. Previously lead to a crash when the server was asked for the previously occluded name. * Fixed handling of zero-length strings in text zone dump. Caused the compilation to fail. * Fixed TSIG algorithm name comparison - the names should be in canonical form. * Fixed handling unknown RR types with type less than 251. Features: * Improved compression of packets. Out-of-zone dnames present in RDATA were not compressed. * Slave zones are now automatically refreshed after startup. * Proper response to IXFR/UDP query (returns SOA in Authority section).
2012-11-06 00:08:06 +01:00
BUILD_DEFS+= VARBASE
Knot DNS is a high-performance authoritative-only DNS server which supports all key features of the domain name system including zone transfers, dynamic updates and DNSSEC.
2012-10-03 00:40:07 +02:00
v1.1.1 - Oct 31, 2012 --------------------- Bugfixes: * Fixed assertion failing when asking directly for a wildcard name. v1.1.1-rc1 - Oct 23, 2012 ------------------------- Bugfixes: * Crash after IXFR in certain cases when adding RRSIG in an IXFR. * Fixed behaviour when incoming IXFR removes a zone cut. Previously occluded names now become properly visible. Previously lead to a crash when the server was asked for the previously occluded name. * Fixed handling of zero-length strings in text zone dump. Caused the compilation to fail. * Fixed TSIG algorithm name comparison - the names should be in canonical form. * Fixed handling unknown RR types with type less than 251. Features: * Improved compression of packets. Out-of-zone dnames present in RDATA were not compressed. * Slave zones are now automatically refreshed after startup. * Proper response to IXFR/UDP query (returns SOA in Authority section).
2012-11-06 00:08:06 +01:00
GNU_CONFIGURE= yes
Knot DNS is a high-performance authoritative-only DNS server which supports all key features of the domain name system including zone transfers, dynamic updates and DNSSEC.
2012-10-03 00:40:07 +02:00
CONFIGURE_ARGS+= --prefix=${PREFIX:Q}
Use PKG_SYSCONF* variables correctly in net/knot. Set PKG_SYSCONFSUBDIR to "knot" to have all of the config files located in the "knot" subdirectory of ${PKG_SYSCONFBASE}. Pass ${PKG_SYSCONFBASE} to the configure script since the package's build infrastructure automatically appends "/knot" to the value passed in through --sysconfdir. Remove ${PKG_SYSCONFDIR} from INSTALLATION_DIRS since it is automatically created by the package install script. Bump the PKGREVISION due to changes in the package install scripts.
2017-08-07 10:44:14 +02:00
CONFIGURE_ARGS+= --sysconfdir=${PKG_SYSCONFBASE}
v1.1.1 - Oct 31, 2012 --------------------- Bugfixes: * Fixed assertion failing when asking directly for a wildcard name. v1.1.1-rc1 - Oct 23, 2012 ------------------------- Bugfixes: * Crash after IXFR in certain cases when adding RRSIG in an IXFR. * Fixed behaviour when incoming IXFR removes a zone cut. Previously occluded names now become properly visible. Previously lead to a crash when the server was asked for the previously occluded name. * Fixed handling of zero-length strings in text zone dump. Caused the compilation to fail. * Fixed TSIG algorithm name comparison - the names should be in canonical form. * Fixed handling unknown RR types with type less than 251. Features: * Improved compression of packets. Out-of-zone dnames present in RDATA were not compressed. * Slave zones are now automatically refreshed after startup. * Proper response to IXFR/UDP query (returns SOA in Authority section).
2012-11-06 00:08:06 +01:00
CONFIGURE_ARGS+= --localstatedir=${VARBASE}/knot
fix rc script
2015-06-30 15:17:10 +02:00
CONFIGURE_ARGS+= --with-rundir=${VARBASE}/run/knot
CONFIGURE_ARGS+= --with-storage=${VARBASE}/knot/lib
Knot DNS 2.0.1 (2015-09-02) =========================== Bugfixes: --------- - Do not reload expired zones on 'knotc reload' and server startup - Fix rare race-condition in event scheduling causing delayed event execution - Fix skipping of non-authoritative nodes in NSEC proofs - Fix TC flag setting in RRL slipped answers - Disable domain name compression for root label - Log via journald only when running under systemd - Fix CNAME following when quering for NSEC RR type - Fix refreshing of DNSSEC signatures for zone keys - Fix binding an unavailable IPv6 address on Linux (IP_FREEBIND) - Fix infinite loop in knotc zonestatus and memstats - Fix memory leak in configuration on server shutdown - Fix broken dnsproxy module - Fix DNSSEC KASP timestamps parsing in strict POSIX environment - fix multi value parsing on big-endian - Adapt to Nettle 3 API break causing base64 decoding failures on big-endian Features: --------- - Add 'keymgr zone key ds' to show key's DS record - Add 'keymgr tsig generate' to generate TSIG keys - Add query module scoping to process either all queries or zone queries only - Add support for file name globbing in config file includes - Add 'request-edns-option' config option to add custom EDNS0 option into server initiated queries Improvements: ------------- - Send minimal responses (remove NS from Authority section for NOERROR) - Update persistent timers only on shutdown for better performance - Allow change of RR TTL over DDNS - Documentation fixes, updates, and improvements in formatting - Install yparser and zscanner header files - Improve lookup of libsystemd build dependencies - Fix compilation warnings in endian conversion functions on OpenBSD Knot DNS 2.0.0 (2015-06-26) =========================== Bugfixes: --------- - Fix lost NOTIFY message if received during zone transfer - Disable fast zone parser when compiled in Clang (workaround for Clang bug) - kdig: Record correct dnstap SocketProtocol when retrying over TCP - kdig: Hide TSIG section with +noall - Do not set AA flag for AXFR/IXFR queries Features: --------- - DNSSEC: separate library, switch to GnuTLS, new utilities - DNSSEC: basic KASP support (generate initial keys, ZSK rollover) - Configuration: New text format in YAML, binary store in LMDB - Zone parser: Split long TXT/SPF strings into multiple strings - kdig: Add generic dump style option (+generic) - Try all master servers in multi-master environment - Improved remotes and ACLs (multiple addresses, multiple keys) - Basic support for zone file patterns (%s to substitute zone name) - Disable zone file synchronization by setting 'zonefile_sync' to '-1' - knsupdate: Add input prompt in interactive mode and 'quit' command - knsupdate: Allow TSIG algorithm specification in interactive prompt Improvements: ------------- - Zone dump: Do not write class for SOA record (unified with other RR types) - Zone dump: Do not write master server address into the zone file - Documentation: Manual pages are included in HTML and PDF
2015-10-26 20:23:08 +01:00
CONFIGURE_ARGS+= --with-urcu=${BUILDLINK_PREFIX.userspace-rcu}
CONFIGURE_ARGS+= --with-libidn=${BUILDLINK_PREFIX.libidn}
Knot DNS is a high-performance authoritative-only DNS server which supports all key features of the domain name system including zone transfers, dynamic updates and DNSSEC.
2012-10-03 00:40:07 +02:00
Use OPSYSVARS.
2016-02-25 17:20:49 +01:00
CONFIGURE_ARGS.NetBSD+= --enable-recvmmsg=no
Disable recvmmsg() on NetBSD as a workaround. (NetBSD's implementation of recvmmsg() is not 100% with the Linux version)
2015-10-27 19:56:40 +01:00
Knot DNS 2.4.5 (2017-06-23) =========================== Security: --------- - Improper TSIG validity period check can allow TSIG forgery (Thanks to Synacktiv!) Bugfixes: --------- - Corner case journal fixes (huge changesets, OpenWRT operation) Knot DNS 2.4.4 (2017-06-05) =========================== Improvements: ------------- - Improved error handling in kjournalprint Bugfixes: --------- - Zone flush not replanned upon unsuccessful flush - Journal inconsistency after deleting deleted zone - Zone events not rescheduled upon server reload (Thanks to Mark Warren) - Unreliable LMDB mapsize detection in kjournalprint - Some minor issues found by AddressSanitizer Knot DNS 2.4.3 (2017-04-11) =========================== Improvements: ------------- - New 'journal-db-mode' optimization configuration option - The default TSIG algorithm for utilities input is HMAC-SHA256 - Implemented sensible default EDNS(0) padding policy (Thanks to D. K. Gillmor) - Added some more semantic checks on the knotc configuration operations Bugfixes: --------- - Missing 'zone' keyword in the YAML output - Missing trailing dot in the keymgr DS owner output - Journal logs 'invalid parameter' in several cases - Some minor journal-related problems Knot DNS 2.4.2 (2017-03-23) =========================== Features: --------- - Zscanner can store record comments placed on the same line - Knotc status extension with version, configure, and workers parameters Improvements: ------------- - Significant incoming XFR speed-up in the case of many zones Bugfixes: --------- - Double OPT RR insertion when a global module returns KNOT_STATE_FAIL - User-driven zscanner parsing logic inconsistency - Lower serial at master doesn't trigger any errors - Queries with too long DNAME substitution do not return YXDOMAIN response - Incorrect elapsed time in the DDNS log - Failed to process forwarded DDNS request with TSIG Knot DNS 2.4.1 (2017-02-10) =========================== Improvements: ------------- - Speed-up of rdata addition into a huge rrset - Introduce check of minumum timeout for next refresh - Dnsproxy module can forward all queries without local resolving Bugfixes: -------- - Transfer of a huge rrset goes into an infinite loop - Huge response over TCP contains useless TC bit instead of SERVFAIL - Failed to build utilities with disabled daemon - Memory leaks during keys removal - Rough TSIG packet reservation causes early truncation - Minor out-of-bounds string termination write in rrset dump - Server crash during stop if failed to open timers DB - Failed to compile on OS X older than Sierra - Poor minimum UDP-max-size configuration check - Failed to receive one-record-per-message IXFR-style AXFR - Kdig timeouts when receiving RCODE != NOERROR on subsequent transfer message Knot DNS 2.4.0 (2017-01-18) =========================== - Kdig timeouts when receiving RCODE != NOERROR on subsequent transfer message Knot DNS 2.4.0 (2017-01-18) =========================== Bugfixes: -------- - False positive semantic-check warning about invalid bitmap in NSEC - Unnecessary SOA queries upon notify with up to date serial - Timers for expired zones are reset on reload - Zone doesn't expire when the server is down - Failed to handle keys with duplicate keytags - Per zone module and global module insconsistency - Obsolete online signing module configuration - Malformed output from kjournalprint - Redundant SO_REUSEPORT activation on the TCP socket - Failed to use higher number of background workers Improvements: ------------- - Lower memory consumption with qp-trie - Zone events and zone timers improvements - Print all zone names in the FQDN format - Simplified query module interface - Shared TCP connection between SOA query and transfer - Response Rate Limiting as a module with statistics support - Key filters in keymgr Features: --------- - New unified LMDB-based zone journal - Server statistics support - New statistics module for traffic measuring - Automatic deletion of retired DNSSEC keys - New control logging category
2018-03-07 17:42:10 +01:00
.include "../../mk/bsd.prefs.mk"
.if ${MACHINE_ARCH} == "i386"
net: align variable assignments pkglint -Wall -F --only aligned --only indent -r No manual corrections.
2019-11-03 12:45:28 +01:00
CFLAGS += -march=i586
Knot DNS 2.4.5 (2017-06-23) =========================== Security: --------- - Improper TSIG validity period check can allow TSIG forgery (Thanks to Synacktiv!) Bugfixes: --------- - Corner case journal fixes (huge changesets, OpenWRT operation) Knot DNS 2.4.4 (2017-06-05) =========================== Improvements: ------------- - Improved error handling in kjournalprint Bugfixes: --------- - Zone flush not replanned upon unsuccessful flush - Journal inconsistency after deleting deleted zone - Zone events not rescheduled upon server reload (Thanks to Mark Warren) - Unreliable LMDB mapsize detection in kjournalprint - Some minor issues found by AddressSanitizer Knot DNS 2.4.3 (2017-04-11) =========================== Improvements: ------------- - New 'journal-db-mode' optimization configuration option - The default TSIG algorithm for utilities input is HMAC-SHA256 - Implemented sensible default EDNS(0) padding policy (Thanks to D. K. Gillmor) - Added some more semantic checks on the knotc configuration operations Bugfixes: --------- - Missing 'zone' keyword in the YAML output - Missing trailing dot in the keymgr DS owner output - Journal logs 'invalid parameter' in several cases - Some minor journal-related problems Knot DNS 2.4.2 (2017-03-23) =========================== Features: --------- - Zscanner can store record comments placed on the same line - Knotc status extension with version, configure, and workers parameters Improvements: ------------- - Significant incoming XFR speed-up in the case of many zones Bugfixes: --------- - Double OPT RR insertion when a global module returns KNOT_STATE_FAIL - User-driven zscanner parsing logic inconsistency - Lower serial at master doesn't trigger any errors - Queries with too long DNAME substitution do not return YXDOMAIN response - Incorrect elapsed time in the DDNS log - Failed to process forwarded DDNS request with TSIG Knot DNS 2.4.1 (2017-02-10) =========================== Improvements: ------------- - Speed-up of rdata addition into a huge rrset - Introduce check of minumum timeout for next refresh - Dnsproxy module can forward all queries without local resolving Bugfixes: -------- - Transfer of a huge rrset goes into an infinite loop - Huge response over TCP contains useless TC bit instead of SERVFAIL - Failed to build utilities with disabled daemon - Memory leaks during keys removal - Rough TSIG packet reservation causes early truncation - Minor out-of-bounds string termination write in rrset dump - Server crash during stop if failed to open timers DB - Failed to compile on OS X older than Sierra - Poor minimum UDP-max-size configuration check - Failed to receive one-record-per-message IXFR-style AXFR - Kdig timeouts when receiving RCODE != NOERROR on subsequent transfer message Knot DNS 2.4.0 (2017-01-18) =========================== - Kdig timeouts when receiving RCODE != NOERROR on subsequent transfer message Knot DNS 2.4.0 (2017-01-18) =========================== Bugfixes: -------- - False positive semantic-check warning about invalid bitmap in NSEC - Unnecessary SOA queries upon notify with up to date serial - Timers for expired zones are reset on reload - Zone doesn't expire when the server is down - Failed to handle keys with duplicate keytags - Per zone module and global module insconsistency - Obsolete online signing module configuration - Malformed output from kjournalprint - Redundant SO_REUSEPORT activation on the TCP socket - Failed to use higher number of background workers Improvements: ------------- - Lower memory consumption with qp-trie - Zone events and zone timers improvements - Print all zone names in the FQDN format - Simplified query module interface - Shared TCP connection between SOA query and transfer - Response Rate Limiting as a module with statistics support - Key filters in keymgr Features: --------- - New unified LMDB-based zone journal - Server statistics support - New statistics module for traffic measuring - Automatic deletion of retired DNSSEC keys - New control logging category
2018-03-07 17:42:10 +01:00
.endif
Knot DNS is a high-performance authoritative-only DNS server which supports all key features of the domain name system including zone transfers, dynamic updates and DNSSEC.
2012-10-03 00:40:07 +02:00
USE_LIBTOOL= yes
Knot DNS 2.0.1 (2015-09-02) =========================== Bugfixes: --------- - Do not reload expired zones on 'knotc reload' and server startup - Fix rare race-condition in event scheduling causing delayed event execution - Fix skipping of non-authoritative nodes in NSEC proofs - Fix TC flag setting in RRL slipped answers - Disable domain name compression for root label - Log via journald only when running under systemd - Fix CNAME following when quering for NSEC RR type - Fix refreshing of DNSSEC signatures for zone keys - Fix binding an unavailable IPv6 address on Linux (IP_FREEBIND) - Fix infinite loop in knotc zonestatus and memstats - Fix memory leak in configuration on server shutdown - Fix broken dnsproxy module - Fix DNSSEC KASP timestamps parsing in strict POSIX environment - fix multi value parsing on big-endian - Adapt to Nettle 3 API break causing base64 decoding failures on big-endian Features: --------- - Add 'keymgr zone key ds' to show key's DS record - Add 'keymgr tsig generate' to generate TSIG keys - Add query module scoping to process either all queries or zone queries only - Add support for file name globbing in config file includes - Add 'request-edns-option' config option to add custom EDNS0 option into server initiated queries Improvements: ------------- - Send minimal responses (remove NS from Authority section for NOERROR) - Update persistent timers only on shutdown for better performance - Allow change of RR TTL over DDNS - Documentation fixes, updates, and improvements in formatting - Install yparser and zscanner header files - Improve lookup of libsystemd build dependencies - Fix compilation warnings in endian conversion functions on OpenBSD Knot DNS 2.0.0 (2015-06-26) =========================== Bugfixes: --------- - Fix lost NOTIFY message if received during zone transfer - Disable fast zone parser when compiled in Clang (workaround for Clang bug) - kdig: Record correct dnstap SocketProtocol when retrying over TCP - kdig: Hide TSIG section with +noall - Do not set AA flag for AXFR/IXFR queries Features: --------- - DNSSEC: separate library, switch to GnuTLS, new utilities - DNSSEC: basic KASP support (generate initial keys, ZSK rollover) - Configuration: New text format in YAML, binary store in LMDB - Zone parser: Split long TXT/SPF strings into multiple strings - kdig: Add generic dump style option (+generic) - Try all master servers in multi-master environment - Improved remotes and ACLs (multiple addresses, multiple keys) - Basic support for zone file patterns (%s to substitute zone name) - Disable zone file synchronization by setting 'zonefile_sync' to '-1' - knsupdate: Add input prompt in interactive mode and 'quit' command - knsupdate: Allow TSIG algorithm specification in interactive prompt Improvements: ------------- - Zone dump: Do not write class for SOA record (unified with other RR types) - Zone dump: Do not write master server address into the zone file - Documentation: Manual pages are included in HTML and PDF
2015-10-26 20:23:08 +01:00
USE_TOOLS+= bison flex gmake pkg-config
Knot DNS 2.5.7 (2018-01-02) =========================== Bugfixes: --------- - Unintentional zone re-sign during reload if empty NSEC3 salt - Inconsistent zone names in journald structured logs - Malformed outgoing transfer for big zone with TSIG - Unexpected reply for DS query with an owner below a delegation point - Old dependencies in the pkg-config file [...] Only new Features & Security fixes of the previous updates are shown below For a complete of all Improvements & Bugfixes, see: https://gitlab.labs.nic.cz/knot/knot-dns/blob/2.5/NEWS Knot DNS 2.5.3 (2017-07-14) =========================== Features: --------- - CSK rollover support for Single-Type Signing Scheme [...] Knot DNS 2.5.2 (2017-06-23) =========================== Security: --------- - CVE-2017-11104: Improper TSIG validity period check can allow TSIG forgery (Thanks to Synacktiv!) Knot DNS 2.5.0 (2017-06-05) =========================== Features: --------- - KASP database switched from JSON files to LMDB database - KSK rollover support using CDNSKEY and CDS in the automatic DNSSEC signing - Dynamic module loading support with proper module API - Journal can store full zone contents (not only differences) - Zone freeze/thaw support - Updated knotc zone-status output with optional column filters - New '[no]crypto' option in kdig - New keymgr implementation reflecting KASP database changes - New pykeymgr for JSON-based KASP database migration - Removed obsolete knot1to2 utility
2018-03-08 15:30:37 +01:00
.include "../../lang/python/extension.mk"
.include "../../lang/python/application.mk"
Knot DNS 2.0.1 (2015-09-02) =========================== Bugfixes: --------- - Do not reload expired zones on 'knotc reload' and server startup - Fix rare race-condition in event scheduling causing delayed event execution - Fix skipping of non-authoritative nodes in NSEC proofs - Fix TC flag setting in RRL slipped answers - Disable domain name compression for root label - Log via journald only when running under systemd - Fix CNAME following when quering for NSEC RR type - Fix refreshing of DNSSEC signatures for zone keys - Fix binding an unavailable IPv6 address on Linux (IP_FREEBIND) - Fix infinite loop in knotc zonestatus and memstats - Fix memory leak in configuration on server shutdown - Fix broken dnsproxy module - Fix DNSSEC KASP timestamps parsing in strict POSIX environment - fix multi value parsing on big-endian - Adapt to Nettle 3 API break causing base64 decoding failures on big-endian Features: --------- - Add 'keymgr zone key ds' to show key's DS record - Add 'keymgr tsig generate' to generate TSIG keys - Add query module scoping to process either all queries or zone queries only - Add support for file name globbing in config file includes - Add 'request-edns-option' config option to add custom EDNS0 option into server initiated queries Improvements: ------------- - Send minimal responses (remove NS from Authority section for NOERROR) - Update persistent timers only on shutdown for better performance - Allow change of RR TTL over DDNS - Documentation fixes, updates, and improvements in formatting - Install yparser and zscanner header files - Improve lookup of libsystemd build dependencies - Fix compilation warnings in endian conversion functions on OpenBSD Knot DNS 2.0.0 (2015-06-26) =========================== Bugfixes: --------- - Fix lost NOTIFY message if received during zone transfer - Disable fast zone parser when compiled in Clang (workaround for Clang bug) - kdig: Record correct dnstap SocketProtocol when retrying over TCP - kdig: Hide TSIG section with +noall - Do not set AA flag for AXFR/IXFR queries Features: --------- - DNSSEC: separate library, switch to GnuTLS, new utilities - DNSSEC: basic KASP support (generate initial keys, ZSK rollover) - Configuration: New text format in YAML, binary store in LMDB - Zone parser: Split long TXT/SPF strings into multiple strings - kdig: Add generic dump style option (+generic) - Try all master servers in multi-master environment - Improved remotes and ACLs (multiple addresses, multiple keys) - Basic support for zone file patterns (%s to substitute zone name) - Disable zone file synchronization by setting 'zonefile_sync' to '-1' - knsupdate: Add input prompt in interactive mode and 'quit' command - knsupdate: Allow TSIG algorithm specification in interactive prompt Improvements: ------------- - Zone dump: Do not write class for SOA record (unified with other RR types) - Zone dump: Do not write master server address into the zone file - Documentation: Manual pages are included in HTML and PDF
2015-10-26 20:23:08 +01:00
PKGCONFIG_OVERRIDE= src/dnssec/libdnssec.pc.in
Knot DNS 2.5.7 (2018-01-02) =========================== Bugfixes: --------- - Unintentional zone re-sign during reload if empty NSEC3 salt - Inconsistent zone names in journald structured logs - Malformed outgoing transfer for big zone with TSIG - Unexpected reply for DS query with an owner below a delegation point - Old dependencies in the pkg-config file [...] Only new Features & Security fixes of the previous updates are shown below For a complete of all Improvements & Bugfixes, see: https://gitlab.labs.nic.cz/knot/knot-dns/blob/2.5/NEWS Knot DNS 2.5.3 (2017-07-14) =========================== Features: --------- - CSK rollover support for Single-Type Signing Scheme [...] Knot DNS 2.5.2 (2017-06-23) =========================== Security: --------- - CVE-2017-11104: Improper TSIG validity period check can allow TSIG forgery (Thanks to Synacktiv!) Knot DNS 2.5.0 (2017-06-05) =========================== Features: --------- - KASP database switched from JSON files to LMDB database - KSK rollover support using CDNSKEY and CDS in the automatic DNSSEC signing - Dynamic module loading support with proper module API - Journal can store full zone contents (not only differences) - Zone freeze/thaw support - Updated knotc zone-status output with optional column filters - New '[no]crypto' option in kdig - New keymgr implementation reflecting KASP database changes - New pykeymgr for JSON-based KASP database migration - Removed obsolete knot1to2 utility
2018-03-08 15:30:37 +01:00
PKGCONFIG_OVERRIDE+= src/knotd.pc.in
Knot DNS 2.0.1 (2015-09-02) =========================== Bugfixes: --------- - Do not reload expired zones on 'knotc reload' and server startup - Fix rare race-condition in event scheduling causing delayed event execution - Fix skipping of non-authoritative nodes in NSEC proofs - Fix TC flag setting in RRL slipped answers - Disable domain name compression for root label - Log via journald only when running under systemd - Fix CNAME following when quering for NSEC RR type - Fix refreshing of DNSSEC signatures for zone keys - Fix binding an unavailable IPv6 address on Linux (IP_FREEBIND) - Fix infinite loop in knotc zonestatus and memstats - Fix memory leak in configuration on server shutdown - Fix broken dnsproxy module - Fix DNSSEC KASP timestamps parsing in strict POSIX environment - fix multi value parsing on big-endian - Adapt to Nettle 3 API break causing base64 decoding failures on big-endian Features: --------- - Add 'keymgr zone key ds' to show key's DS record - Add 'keymgr tsig generate' to generate TSIG keys - Add query module scoping to process either all queries or zone queries only - Add support for file name globbing in config file includes - Add 'request-edns-option' config option to add custom EDNS0 option into server initiated queries Improvements: ------------- - Send minimal responses (remove NS from Authority section for NOERROR) - Update persistent timers only on shutdown for better performance - Allow change of RR TTL over DDNS - Documentation fixes, updates, and improvements in formatting - Install yparser and zscanner header files - Improve lookup of libsystemd build dependencies - Fix compilation warnings in endian conversion functions on OpenBSD Knot DNS 2.0.0 (2015-06-26) =========================== Bugfixes: --------- - Fix lost NOTIFY message if received during zone transfer - Disable fast zone parser when compiled in Clang (workaround for Clang bug) - kdig: Record correct dnstap SocketProtocol when retrying over TCP - kdig: Hide TSIG section with +noall - Do not set AA flag for AXFR/IXFR queries Features: --------- - DNSSEC: separate library, switch to GnuTLS, new utilities - DNSSEC: basic KASP support (generate initial keys, ZSK rollover) - Configuration: New text format in YAML, binary store in LMDB - Zone parser: Split long TXT/SPF strings into multiple strings - kdig: Add generic dump style option (+generic) - Try all master servers in multi-master environment - Improved remotes and ACLs (multiple addresses, multiple keys) - Basic support for zone file patterns (%s to substitute zone name) - Disable zone file synchronization by setting 'zonefile_sync' to '-1' - knsupdate: Add input prompt in interactive mode and 'quit' command - knsupdate: Allow TSIG algorithm specification in interactive prompt Improvements: ------------- - Zone dump: Do not write class for SOA record (unified with other RR types) - Zone dump: Do not write master server address into the zone file - Documentation: Manual pages are included in HTML and PDF
2015-10-26 20:23:08 +01:00
PKGCONFIG_OVERRIDE+= src/libknot.pc.in
PKGCONFIG_OVERRIDE+= src/zscanner/libzscanner.pc.in
v1.1.1 - Oct 31, 2012 --------------------- Bugfixes: * Fixed assertion failing when asking directly for a wildcard name. v1.1.1-rc1 - Oct 23, 2012 ------------------------- Bugfixes: * Crash after IXFR in certain cases when adding RRSIG in an IXFR. * Fixed behaviour when incoming IXFR removes a zone cut. Previously occluded names now become properly visible. Previously lead to a crash when the server was asked for the previously occluded name. * Fixed handling of zero-length strings in text zone dump. Caused the compilation to fail. * Fixed TSIG algorithm name comparison - the names should be in canonical form. * Fixed handling unknown RR types with type less than 251. Features: * Improved compression of packets. Out-of-zone dnames present in RDATA were not compressed. * Slave zones are now automatically refreshed after startup. * Proper response to IXFR/UDP query (returns SOA in Authority section).
2012-11-06 00:08:06 +01:00
RCD_SCRIPTS= knot
Knot DNS is a high-performance authoritative-only DNS server which supports all key features of the domain name system including zone transfers, dynamic updates and DNSSEC.
2012-10-03 00:40:07 +02:00
EGDIR= ${PREFIX}/share/examples/knot
Use PKG_SYSCONF* variables correctly in net/knot. Set PKG_SYSCONFSUBDIR to "knot" to have all of the config files located in the "knot" subdirectory of ${PKG_SYSCONFBASE}. Pass ${PKG_SYSCONFBASE} to the configure script since the package's build infrastructure automatically appends "/knot" to the value passed in through --sysconfdir. Remove ${PKG_SYSCONFDIR} from INSTALLATION_DIRS since it is automatically created by the package install script. Bump the PKGREVISION due to changes in the package install scripts.
2017-08-07 10:44:14 +02:00
PKG_SYSCONFSUBDIR= knot
Knot DNS is a high-performance authoritative-only DNS server which supports all key features of the domain name system including zone transfers, dynamic updates and DNSSEC.
2012-10-03 00:40:07 +02:00
SUBST_CLASSES+= paths
SUBST_FILES.paths= ${WRKSRC}/samples/Makefile.in
*: Move SUBST_STAGE from post-patch to pre-configure Performing substitutions during post-patch breaks tools such as mkpatches, making it very difficult to regenerate correct patches after making changes, and often leading to substituted string replacements being committed.
2018-07-04 15:40:07 +02:00
SUBST_STAGE.paths= pre-configure
all: replace SUBST_SED with the simpler SUBST_VARS pkglint -Wall -r --only "substitution command" -F With manual review and indentation fixes since pkglint doesn't get that part correct in every case.
2019-05-23 21:22:54 +02:00
SUBST_VARS.paths= EGDIR
Knot DNS is a high-performance authoritative-only DNS server which supports all key features of the domain name system including zone transfers, dynamic updates and DNSSEC.
2012-10-03 00:40:07 +02:00
CONF_FILES= ${EGDIR}/knot.sample.conf \
Use PKG_SYSCONF* variables correctly in net/knot. Set PKG_SYSCONFSUBDIR to "knot" to have all of the config files located in the "knot" subdirectory of ${PKG_SYSCONFBASE}. Pass ${PKG_SYSCONFBASE} to the configure script since the package's build infrastructure automatically appends "/knot" to the value passed in through --sysconfdir. Remove ${PKG_SYSCONFDIR} from INSTALLATION_DIRS since it is automatically created by the package install script. Bump the PKGREVISION due to changes in the package install scripts.
2017-08-07 10:44:14 +02:00
${PKG_SYSCONFDIR}/knot.conf
Knot DNS is a high-performance authoritative-only DNS server which supports all key features of the domain name system including zone transfers, dynamic updates and DNSSEC.
2012-10-03 00:40:07 +02:00
CONF_FILES+= ${EGDIR}/example.com.zone \
Use PKG_SYSCONF* variables correctly in net/knot. Set PKG_SYSCONFSUBDIR to "knot" to have all of the config files located in the "knot" subdirectory of ${PKG_SYSCONFBASE}. Pass ${PKG_SYSCONFBASE} to the configure script since the package's build infrastructure automatically appends "/knot" to the value passed in through --sysconfdir. Remove ${PKG_SYSCONFDIR} from INSTALLATION_DIRS since it is automatically created by the package install script. Bump the PKGREVISION due to changes in the package install scripts.
2017-08-07 10:44:14 +02:00
${PKG_SYSCONFDIR}/example.com.zone
Knot DNS is a high-performance authoritative-only DNS server which supports all key features of the domain name system including zone transfers, dynamic updates and DNSSEC.
2012-10-03 00:40:07 +02:00
Use PKG_SYSCONF* variables correctly in net/knot. Set PKG_SYSCONFSUBDIR to "knot" to have all of the config files located in the "knot" subdirectory of ${PKG_SYSCONFBASE}. Pass ${PKG_SYSCONFBASE} to the configure script since the package's build infrastructure automatically appends "/knot" to the value passed in through --sysconfdir. Remove ${PKG_SYSCONFDIR} from INSTALLATION_DIRS since it is automatically created by the package install script. Bump the PKGREVISION due to changes in the package install scripts.
2017-08-07 10:44:14 +02:00
INSTALLATION_DIRS= ${EGDIR}
Knot DNS is a high-performance authoritative-only DNS server which supports all key features of the domain name system including zone transfers, dynamic updates and DNSSEC.
2012-10-03 00:40:07 +02:00
OWN_DIRS+= ${VARBASE}/knot
knot: Update to 3.0.0 Changelog: Version 3.0.0 Wednesday, September 9, 2020 Features: + High-performance networking mode using XDP sockets (requires Linux 4.18+) + Support for Catalog zones including kcatalogprint utility + New DNSSEC validation mode + New kzonesign utility --- an interface for manual DNSSEC signing + New kxdpgun utility --- high-performance DNS over UDP traffic generator for Linux + DoH support in kdig using GnuTLS and libnghttp2 + New KSK revoked state (RFC 5011) in manual DNSSEC key management mode + Deterministic signing with ECDSA algorithms (requires GnuTLS 3.6.10+) + Module synthrecord supports reverse pointer shortening + Safe persistent zone data backup and restore Improvements: + Processing depth of CNAME and DNAME chains is limited to 20 + Non-FQDN is allowed as 'update-owner-name' configuration option value + Kdig prints detailed algorithm idendifier for PRIVATEDNS and PRIVATEOID in multiline mode #334 + Queries with QTYPE ANY or RRSIG are always responded with at most one random RRSet + The statistics module has negligible performance overhead on modern CPUs + If multithreaded zone signing is enabled, some additional zone maintenance steps are newly parallelized + ACL can be configured by reference to a remote + Better CPU cache locality for higher query processing performance + Logging to non-syslog streams contains timestamps with the timezone + Keeping initial DNSKEY TTL and zone maximum TTL in KASP database to ensure proper rollover timing in case of TTL changes during the rollover + Responding FORMERR to queries with more OPT records Bugfixes: + Module onlinesign responds NXDOMAIN insted of NOERROR (NODATA) if DNSSEC not requested + Outgoing multi-message transfer can contain invalid compression pointers under specific conditions Version 2.9.6 Monday, August 31, 2020 Features: + New kdig option '+[no]opttext' to print unknown EDNS options as text if possible (Thanks to Robert Edmonds) Improvements: + Better error message if no key is ready for submission + Improved logging when master is not usable + Improved control logging of zone-flush errors if output directory is specified + More precise system error messages when a zone transfer fails + Some documentation improvements (especially Offline KSK) Bugfixes: + In the case of many zones, control operations over all zones take lots of memory + Misleading error message on keymgr import-bind #683 + DS push is triggered upon every zone change even though CDS wasn't changed + Kzonecheck performance penalty with passive keys #688 CSK->KSK+ZSK scheme rollover can end too early
2020-10-01 05:37:02 +02:00
.include "../../databases/lmdb/buildlink3.mk"
Knot DNS is a high-performance authoritative-only DNS server which supports all key features of the domain name system including zone transfers, dynamic updates and DNSSEC.
2012-10-03 00:40:07 +02:00
.include "../../devel/userspace-rcu/buildlink3.mk"
Knot DNS 2.0.1 (2015-09-02) =========================== Bugfixes: --------- - Do not reload expired zones on 'knotc reload' and server startup - Fix rare race-condition in event scheduling causing delayed event execution - Fix skipping of non-authoritative nodes in NSEC proofs - Fix TC flag setting in RRL slipped answers - Disable domain name compression for root label - Log via journald only when running under systemd - Fix CNAME following when quering for NSEC RR type - Fix refreshing of DNSSEC signatures for zone keys - Fix binding an unavailable IPv6 address on Linux (IP_FREEBIND) - Fix infinite loop in knotc zonestatus and memstats - Fix memory leak in configuration on server shutdown - Fix broken dnsproxy module - Fix DNSSEC KASP timestamps parsing in strict POSIX environment - fix multi value parsing on big-endian - Adapt to Nettle 3 API break causing base64 decoding failures on big-endian Features: --------- - Add 'keymgr zone key ds' to show key's DS record - Add 'keymgr tsig generate' to generate TSIG keys - Add query module scoping to process either all queries or zone queries only - Add support for file name globbing in config file includes - Add 'request-edns-option' config option to add custom EDNS0 option into server initiated queries Improvements: ------------- - Send minimal responses (remove NS from Authority section for NOERROR) - Update persistent timers only on shutdown for better performance - Allow change of RR TTL over DDNS - Documentation fixes, updates, and improvements in formatting - Install yparser and zscanner header files - Improve lookup of libsystemd build dependencies - Fix compilation warnings in endian conversion functions on OpenBSD Knot DNS 2.0.0 (2015-06-26) =========================== Bugfixes: --------- - Fix lost NOTIFY message if received during zone transfer - Disable fast zone parser when compiled in Clang (workaround for Clang bug) - kdig: Record correct dnstap SocketProtocol when retrying over TCP - kdig: Hide TSIG section with +noall - Do not set AA flag for AXFR/IXFR queries Features: --------- - DNSSEC: separate library, switch to GnuTLS, new utilities - DNSSEC: basic KASP support (generate initial keys, ZSK rollover) - Configuration: New text format in YAML, binary store in LMDB - Zone parser: Split long TXT/SPF strings into multiple strings - kdig: Add generic dump style option (+generic) - Try all master servers in multi-master environment - Improved remotes and ACLs (multiple addresses, multiple keys) - Basic support for zone file patterns (%s to substitute zone name) - Disable zone file synchronization by setting 'zonefile_sync' to '-1' - knsupdate: Add input prompt in interactive mode and 'quit' command - knsupdate: Allow TSIG algorithm specification in interactive prompt Improvements: ------------- - Zone dump: Do not write class for SOA record (unified with other RR types) - Zone dump: Do not write master server address into the zone file - Documentation: Manual pages are included in HTML and PDF
2015-10-26 20:23:08 +01:00
.include "../../security/gnutls/buildlink3.mk"
.include "../../textproc/jansson/buildlink3.mk"
.include "../../devel/libidn/buildlink3.mk"
bulk build wants zlib
2015-01-18 17:00:02 +01:00
.include "../../devel/zlib/buildlink3.mk"
Knot DNS is a high-performance authoritative-only DNS server which supports all key features of the domain name system including zone transfers, dynamic updates and DNSSEC.
2012-10-03 00:40:07 +02:00
.include "../../mk/bsd.pkg.mk"
Reference in a new issue Copy permalink