Update to 2.7.6

Changelog:
Knot DNS 2.7.6 (2019-01-23)
===========================

Improvements:
-------------
 - Zone status also shows when the zone load is scheduled
 - Server workers status also shows background workers utilization
 - Default control timeout for knotc was increased to 10 seconds
 - Pkg-config files contain auxiliary variable with library filename

Bugfixes:
---------
 - Configuration commit or server reload can drop some pending zone events
 - Nonempty zone journal is created even though it's disabled #635
 - Zone is completely re-signed during empty dynamic update processing
 - Server can crash when storing a big zone difference to the journal
 - Failed to link on FreeBSD 12 with Clang

Knot DNS 2.7.5 (2019-01-07)
===========================

Features:
---------
 - Keymgr supports NSEC3 salt handling

Improvements:
-------------
 - Zone history in journal is dropped apon AXFR-like zone update
 - Libdnssec is no longer linked against libm #628
 - Libdnssec is explicitly linked against libpthread if PKCS #11 enabled #629
 - Better support for libknot packaging in Python
 - Manually generated KSK is 'ready' by default
 - Kdig supports '+timeout' as an alias for '+time'
 - Kdig supports '+nocomments' option
 - Kdig no longer prints empty lines between retries
 - Kdig returns failure if operations not successfully resolved #632
 - Fixed repeating of the 'KSK submission, waiting for confirmation' log
 - Various improvements in documentation, Dockerfile, and tests

Bugfixes:
---------
 - Knotc fails to unset huge configuration section
 - Kjournalprint sometimes fails to display zone journal content
 - Improper timing of ZSK removal during ZSK rollover
 - Missing UTC time zone indication in the 'iso' keymgr list output
 - A race condition in the online signing module

Knot DNS 2.7.4 (2018-11-13)
===========================

Features:
---------
 - Added SNI configuration for TLS in kdig (Thanks to Alexander Schultz)

Improvements:
-------------
 - Added warning log when DNSSEC events not successfully scheduled
 - New semantic check on timer values in keymgr
 - DS query no longer asks other addresses if got a negative answer
 - Reintroduced 'rollover' configuration option for CDS/CDNSKEY publication
 - Extended logging for zone loading
 - Various documentation improvements

Bugfixes:
---------
 - Failed to import module configuration #613
 - Improper Cflags value in libknot.pc if built with embedded LMDB #615
 - IXFR doesn't fall back to AXFR if malformed reply
 - DNSSEC events not correctly scheduled for empty zone updates
 - During algorithm rollover old keys get removed before DS TTL expires #617
 - Maximum zone's RRSIG TTL not considered during algorithm rollover #620

Knot DNS 2.7.3 (2018-10-11)
===========================

Features:
---------
 - New queryacl module for query access control
 - Configurable answer rrset rotation #612
 - Configurable NSEC bitmap in online signing

Improvements:
-------------
 - Better error logging for KASP DB operations #601
 - Some documentation improvements

Bugfixes:
---------
 - Keymgr "list" output doesn't show key size for ECDSA algorithms #602
 - Failed to link statically with embedded LMDB
 - Configuration commit causes zone reload for all zones
 - The statistics module overlooks TSIG record in a request
 - Improper processing of an AXFR-style-IXFR response consisting of one-record messages
 - Race condition in online signing during key rollover #600
 - Server can crash if geoip module is enabled in the geo mode

Knot DNS 2.7.2 (2018-08-29)
===========================

Improvements:
-------------
 - Keymgr list command displays also key size
 - Kjournalprint displays total occupied size in the debug mode
 - Server doesn't stop if failed to load a shared module from the module directory
 - Libraries libcap-ng, pthread, and dl are linked selectively if needed

Bugfixes:
---------
 - Sometimes incorrect result from dnssec_nsec_bitmap_contains (libdnssec)
 - Server can crash when loading zone file difference and zone-in-journal is set
 - Incorrect treatment of specific queries in the module RRL
 - Failed to link module Cookies as a shared library

Knot DNS 2.7.1 (2018-08-14)
===========================

Improvements:
-------------
 - Added zone wire size information to zone loading log message
 - Added debug log message for each unsuccessful remote address operation
 - Various improvements for packaging

Bugfixes:
---------
 - Incompatible handling of RRSIG TTL value when creating a DNS message
 - Incorrect RRSIG TTL value in zone differences and knotc zone operation outputs
 - Default configure prefix is ignored

Knot DNS 2.7.0 (2018-08-03)
===========================

Features:
---------
 - New DNS Cookies module and related '+cookie' kdig option
 - New module for response tailoring according to client's subnet or geographic location
 - General EDNS Client Subnet support in the server
 - OSS-Fuzz integration (Thanks to Jonathan Foote)
 - New '+ednsopt' kdig option (Thanks to Jan Včelák)
 - Online Signing support for automatic key rollover
 - Non-normal file (e.g. pipe) loading support in zscanner #542
 - Automatic SOA serial incrementation if non-empty zone difference
 - New zone file load option for ignoring zone file's SOA serial
 - New build-time option for alternative malloc specification
 - Structured logging for DNSSEC key submission event
 - Empty QNAME support in kdig

Improvements:
-------------
 - Various library and server optimizations
 - Reduced memory consumption of outgoing IXFR processing
 - Linux capabilities use overhaul #546 (Thanks to Robert Edmonds)
 - Online Signing properly signs delegations and CNAME records
 - CDS/CDNSKEY rrset is signed with KSK instead of ZSK
 - DNSSEC-related records are ignored when loading zone difference with signing enabled
 - Minimum allowed RSA key length was increased to 1024
 - Removed explicit dependency on Nettle

Bugfixes:
---------
 - Possible uninitialized address buffer use in zscanner
 - Possible index overflow during multiline record parsing in zscanner
 - kdig +tls sometimes consumes 100 % CPU #561
 - Single-Type Signing doesn't work with single ZSK key #566
 - Zone not flushed after re-signing during zone load #594
 - Server crashes when committing empty zone transaction
 - Incoming IXFR with on-slave signing sometimes leads to memory corruption #595

Compatibility:
--------------
 - Removed obsolete RRL configuration
 - Removed obsolete module names 'mod-online-sign' and 'mod-synth-record'
 - Removed obsolete 'ixfr-from-differences' configuration option
 - Removed old journal migration
 - Removed module rosedb

Knot DNS 2.6.9 (2018-08-14)
===========================

Improvements:
-------------
 - Added zone wire size to zone loading log message
 - Added debug log message for each unsuccessful remote address operation

Bugfixes:
---------
 - Zone not flushed after re-signing during zone load #594
 - Server crashes when committing empty zone transaction
 - Incoming IXFR with on-slave signing sometimes leads to memory corruption #595

Knot DNS 2.6.8 (2018-07-10)
===========================

Features:
---------
 - New 'import-pkcs11' command in keymgr

Improvements:
-------------
 - Unixtime serial policy mimics Bind – increment if lower #593

Bugfixes:
---------
 - Creeping memory consuption upon server reload #584
 - Kdig incorrectly detects QNAME if 'notify' is a prefix
 - Server crashes when zone sign fails #587
 - CSK->KZSK rollover retires CSK early #588
 - Server crashes when zone expires during outgoing multi-message transfer
 - Kjournalprint doesn't convert zone name argument to lower-case
 - Cannot switch to a previously used ksk-shared dnssec policy #589

Knot DNS 2.6.7 (2018-05-17)
===========================

Features:
---------
 - Added 'dateserial' (YYYYMMDDnn) serial policy configuration (Thanks to Wolfgang Jung)

Improvements:
-------------
 - Trailing data indication from the packet parser (libknot)
 - Better configuration check for a problematical option combination

Bugfixes:
---------
 - Incomplete configuration option item name check
 - Possible buffer overflow in 'knot_dname_to_str' (libknot)
 - Module dnsproxy doesn't preserve letter case of QNAME
 - Module dnsproxy duplicates OPT and TSIG in the non-fallback mode

Knot DNS 2.6.6 (2018-04-11)
===========================

Features:
---------
 - New EDNS option counters in the statistics module
 - New '+orphan' filter for the 'zone-purge' operation

Improvements:
-------------
 - Reduced memory consuption of disabled statistics metrics
 - Some spelling fixes (Thanks to Daniel Kahn Gillmor)
 - Server no longer fails to start if MODULE_DIR doesn't exist
 - Configuration include doesn't fail if empty wildcard match
 - Added a configuration check for a problematical option combination

Bugfixes:
---------
 - NSEC3 chain not re-created when SOA minimum TTL changed
 - Failed to start server if no template is configured
 - Possibly incorrect SOA serial upon changed zone reload with DNSSEC signing
 - Inaccurate outgoing zone transfer size in the log message
 - Invalid dname compression if empty question section
 - Missing EDNS in EMALF responses

Knot DNS 2.6.5 (2018-02-12)
===========================

Features:
---------
 - New 'zone-notify' command in knotc
 - Kdig uses '@server' as a hostname for TLS authenticaion if '+tls-ca' is set

Improvements:
-------------
 - Better heap memory trimming for zone operations
 - Added proper polling for TLS operations in kdig
 - Configuration export uses stdout as a default output
 - Simplified detection of atomic operations
 - Added '--disable-modules' configure option
 - Small documentation updates

Bugfixes:
---------
 - Zone retransfer doesn't work well if more masters configured
 - Kdig can leak or double free memory in corner cases
 - Inconsistent error outputs from dynamic configuration operations
 - Failed to generate documentation on OpenBSD

Knot DNS 2.6.4 (2018-01-02)
===========================

Features:
---------
 - Module synthrecord allows multiple 'network' specification
 - New CSK handling support in keymgr

Improvements:
-------------
 - Allowed configuration for infinite zsk lifetime
 - Increased performance and security of the module synthrecord
 - Signing changeset is stored into journal even if 'zonefile-load' is whole

Bugfixes:
---------
 - Unintentional zone re-sign during reload if empty NSEC3 salt
 - Inconsistent zone names in journald structured logs
 - Malformed outgoing transfer for big zone with TSIG
 - Some minor DNSSEC-related issues

Knot DNS 2.6.3 (2017-11-24)
===========================

Bugfixes:
---------
 - Wrong detection of signing scheme rollover

Knot DNS 2.6.2 (2017-11-23)
===========================

Features:
---------
 - CSK algorithm rollover and (KSK, ZSK) <-> CSK rollover support

Improvements:
-------------
 - Allowed explicit configuration for infinite ksk lifetime
 - Proper error messages instead of unclear error codes in server log
 - Better support for old compilers

Bugfixes:
---------
 - Unexpected reply for DS query with an owner below a delegation point
 - Old dependencies in the pkg-config file

Knot DNS 2.6.1 (2017-11-02)
===========================

Features:
---------
 - NSEC3 Opt-Out support in the DNSSEC signing
 - New CDS/CDNSKEY publish configuration option

Improvements:
-------------
 - Simplified DNSSEC log message with DNSKEY details
 - +tls-hostname in kdig implies +tls-ca if neither +tls-ca nor +tls-pin is given
 - New documentation sections for DNSSEC key rollovers and shared keys
 - Keymgr no longer prints useless algorithm number for generated key
 - Kdig prints unknown RCODE in a numeric format
 - Better support for LLVM libFuzzer

Bugfixes:
---------
 - Faulty DNAME semantic check if present in the zone apex and NSEC3 is used
 - Immediate zone flush not scheduled during the zone load event
 - Server crashes upon dynamic zone addition if a query module is loaded
 - Kdig fails to connect over TLS due to SNI is set to server IP address
 - Possible out-of-bounds memory access at the end of the input
 - TCP Fast Open enabled by default in kdig breaks TLS connection

Knot DNS 2.6.0 (2017-09-29)
===========================

Features:
---------
 - On-slave (inline) signing support
 - Automatic DNSSEC key algorithm rollover
 - Ed25519 algorithm support in DNSSEC (requires GnuTLS 3.6.0)
 - New 'journal-content' and 'zonefile-load' configuration options
 - keymgr tries to run as user/group set in the configuration
 - Public-only DNSSEC key import into KASP DB via keymgr
 - NSEC3 resalt and parent DS query events are persistent in timer DB
 - New processing state for a response suppression within a query module
 - Enabled server side TCP Fast Open if supported
 - TCP Fast Open support in kdig

Improvements:
-------------
 - Better record owner compression if related to the previous rdata dname
 - NSEC(3) chain is no longer recomputed whole on every update
 - Remove inconsistent and unnecessary quoting in log files
 - Avoiding of overlapping key rollovers at a time
 - More DNSSSEC-related semantic checks
 - Extended timestamp format in keymgr

Bugfixes:
---------
 - Incorrect journal free space computation causing inefficient space handling
 - Interface-automatic broken on Linux in the presence of asymmetric routing

This commit is contained in:

ryoon

2019-01-29 15:07:24 +00:00

parent 1097d873d0

commit a24848966e

3 changed files with 30 additions and 37 deletions

									
										5

net/knot/Makefile
									
										View file
										
					@ -1,7 +1,6 @@

					# $NetBSD: Makefile,v 1.40 2018/07/04 13:40:28 jperkin Exp $

					# $NetBSD: Makefile,v 1.41 2019/01/29 15:07:24 ryoon Exp $

					DISTNAME=	knot-2.5.7

					DISTNAME=	knot-2.7.6

					PKGREVISION=	1

					CATEGORIES=	net

					CATEGORIES=	net

					MASTER_SITES=	https://secure.nic.cz/files/knot-dns/

					MASTER_SITES=	https://secure.nic.cz/files/knot-dns/

					EXTRACT_SUFX=	.tar.xz

					EXTRACT_SUFX=	.tar.xz

52

net/knot/PLIST

View file

-@comment $NetBSD: PLIST,v 1.14 2018/03/08 14:30:37 pettai Exp $
+@comment $NetBSD: PLIST,v 1.15 2019/01/29 15:07:24 ryoon Exp $
 bin/kdig
 bin/khost
-bin/kjournalprint
 bin/knsec3hash
 bin/knsupdate
 bin/kzonecheck
-include/dnssec/binary.h
-include/dnssec/crypto.h
-include/dnssec/dnssec.h
-include/dnssec/error.h
-include/dnssec/key.h
-include/dnssec/keyid.h
-include/dnssec/keystore.h
-include/dnssec/keytag.h
-include/dnssec/list.h
-include/dnssec/nsec.h
-include/dnssec/random.h
-include/dnssec/sign.h
-include/dnssec/tsig.h
-include/dnssec/version.h
 include/knot/module.h
+include/libdnssec/binary.h
+include/libdnssec/crypto.h
+include/libdnssec/dnssec.h
+include/libdnssec/error.h
+include/libdnssec/key.h
+include/libdnssec/keyid.h
+include/libdnssec/keystore.h
+include/libdnssec/keytag.h
+include/libdnssec/list.h
+include/libdnssec/nsec.h
+include/libdnssec/random.h
+include/libdnssec/sign.h
+include/libdnssec/tsig.h
+include/libdnssec/version.h
 include/libknot/attribute.h
-include/libknot/binary.h
 include/libknot/codes.h
 include/libknot/consts.h
 include/libknot/control/control.h
-include/libknot/cookies/alg-fnv64.h
+include/libknot/cookies.h
-include/libknot/cookies/client.h
-include/libknot/cookies/server.h
 include/libknot/db/db.h
 include/libknot/db/db_lmdb.h
 include/libknot/db/db_trie.h
 include/libknot/descriptor.h
 include/libknot/dname.h
+include/libknot/endian.h
 include/libknot/errcode.h
 include/libknot/error.h
 include/libknot/libknot.h
 include/libknot/rdataset.h
 include/libknot/rrset-dump.h
 include/libknot/rrset.h
-include/libknot/rrtype/aaaa.h
 include/libknot/rrtype/dnskey.h
 include/libknot/rrtype/ds.h
 include/libknot/rrtype/naptr.h
 include/libknot/rrtype/nsec.h
 include/libknot/rrtype/nsec3.h
 include/libknot/rrtype/nsec3param.h
-include/libknot/rrtype/opt-cookie.h
 include/libknot/rrtype/opt.h
 include/libknot/rrtype/rdname.h
 include/libknot/rrtype/rrsig.h
 include/libknot/rrtype/soa.h
 include/libknot/rrtype/tsig.h
-include/libknot/rrtype/txt.h
 include/libknot/tsig-op.h
 include/libknot/tsig.h
 include/libknot/version.h
+include/libknot/wire.h
 include/libknot/yparser/yparser.h
 include/libknot/yparser/ypformat.h
 include/libknot/yparser/ypschema.h
 include/libknot/yparser/yptrafo.h
-include/zscanner/error.h
+include/libzscanner/error.h
-include/zscanner/scanner.h
+include/libzscanner/scanner.h
-include/zscanner/version.h
+include/libzscanner/version.h
 lib/libdnssec.la
 lib/libknot.la
 lib/libzscanner.la
 lib/pkgconfig/libzscanner.pc
 man/man1/kdig.1
 man/man1/khost.1
-man/man1/kjournalprint.1
 man/man1/knsec3hash.1
 man/man1/knsupdate.1
 man/man1/kzonecheck.1
 man/man5/knot.conf.5
 man/man8/keymgr.8
+man/man8/kjournalprint.8
 man/man8/knotc.8
 man/man8/knotd.8
-man/man8/pykeymgr.8
 sbin/keymgr
+sbin/kjournalprint
 sbin/knotc
 sbin/knotd
-sbin/pykeymgr
 share/examples/knot/example.com.zone
 share/examples/knot/knot.sample.conf
 @pkgdir etc/knot

10

net/knot/distinfo

View file

-$NetBSD: distinfo,v 1.24 2018/03/08 14:30:37 pettai Exp $
+$NetBSD: distinfo,v 1.25 2019/01/29 15:07:24 ryoon Exp $
-SHA1 (knot-2.5.7.tar.xz) = 26bcd2784a8d1c062a4a103d9f2cb651804e7d68
+SHA1 (knot-2.7.6.tar.xz) = d2f313267c2b68b822c5b715927eae9d5268738e
-RMD160 (knot-2.5.7.tar.xz) = 96ac63cf365ed10fc979a351c79c12e345d4c2f0
+RMD160 (knot-2.7.6.tar.xz) = fca8c746a783789a1a5c0d1f0fbe2df8f652a250
-SHA512 (knot-2.5.7.tar.xz) = 96e375f556309bb89cea982dda169cef70c23d03c48282110e47a44849c1102cd37d98aa7650781b399f5d932b724b8a935f0b9e55e4920465ae7b74a0d1d55a
+SHA512 (knot-2.7.6.tar.xz) = 6b6a727d57337da01e2d44abec7fde4504d112604769b118fe6254b0317f149ed4e9fab321a04517eccedb08e409818d1817fc1136c27d1fd351538e6816022a
-Size (knot-2.5.7.tar.xz) = 1084656 bytes
+Size (knot-2.7.6.tar.xz) = 1151068 bytes
 SHA1 (patch-samples_Makefile.in) = 499b8742dbd948e489b01d512bc7a8d8e4fe2e7b

Update to 2.7.6

5 net/knot/Makefile Unescape Escape View file

52 net/knot/PLIST Unescape Escape View file

10 net/knot/distinfo Unescape Escape View file

5

net/knot/Makefile

View file

52

net/knot/PLIST

View file

10

net/knot/distinfo

View file