Update to 2.7.6
Changelog: Knot DNS 2.7.6 (2019-01-23) =========================== Improvements: ------------- - Zone status also shows when the zone load is scheduled - Server workers status also shows background workers utilization - Default control timeout for knotc was increased to 10 seconds - Pkg-config files contain auxiliary variable with library filename Bugfixes: --------- - Configuration commit or server reload can drop some pending zone events - Nonempty zone journal is created even though it's disabled #635 - Zone is completely re-signed during empty dynamic update processing - Server can crash when storing a big zone difference to the journal - Failed to link on FreeBSD 12 with Clang Knot DNS 2.7.5 (2019-01-07) =========================== Features: --------- - Keymgr supports NSEC3 salt handling Improvements: ------------- - Zone history in journal is dropped apon AXFR-like zone update - Libdnssec is no longer linked against libm #628 - Libdnssec is explicitly linked against libpthread if PKCS #11 enabled #629 - Better support for libknot packaging in Python - Manually generated KSK is 'ready' by default - Kdig supports '+timeout' as an alias for '+time' - Kdig supports '+nocomments' option - Kdig no longer prints empty lines between retries - Kdig returns failure if operations not successfully resolved #632 - Fixed repeating of the 'KSK submission, waiting for confirmation' log - Various improvements in documentation, Dockerfile, and tests Bugfixes: --------- - Knotc fails to unset huge configuration section - Kjournalprint sometimes fails to display zone journal content - Improper timing of ZSK removal during ZSK rollover - Missing UTC time zone indication in the 'iso' keymgr list output - A race condition in the online signing module Knot DNS 2.7.4 (2018-11-13) =========================== Features: --------- - Added SNI configuration for TLS in kdig (Thanks to Alexander Schultz) Improvements: ------------- - Added warning log when DNSSEC events not successfully scheduled - New semantic check on timer values in keymgr - DS query no longer asks other addresses if got a negative answer - Reintroduced 'rollover' configuration option for CDS/CDNSKEY publication - Extended logging for zone loading - Various documentation improvements Bugfixes: --------- - Failed to import module configuration #613 - Improper Cflags value in libknot.pc if built with embedded LMDB #615 - IXFR doesn't fall back to AXFR if malformed reply - DNSSEC events not correctly scheduled for empty zone updates - During algorithm rollover old keys get removed before DS TTL expires #617 - Maximum zone's RRSIG TTL not considered during algorithm rollover #620 Knot DNS 2.7.3 (2018-10-11) =========================== Features: --------- - New queryacl module for query access control - Configurable answer rrset rotation #612 - Configurable NSEC bitmap in online signing Improvements: ------------- - Better error logging for KASP DB operations #601 - Some documentation improvements Bugfixes: --------- - Keymgr "list" output doesn't show key size for ECDSA algorithms #602 - Failed to link statically with embedded LMDB - Configuration commit causes zone reload for all zones - The statistics module overlooks TSIG record in a request - Improper processing of an AXFR-style-IXFR response consisting of one-record messages - Race condition in online signing during key rollover #600 - Server can crash if geoip module is enabled in the geo mode Knot DNS 2.7.2 (2018-08-29) =========================== Improvements: ------------- - Keymgr list command displays also key size - Kjournalprint displays total occupied size in the debug mode - Server doesn't stop if failed to load a shared module from the module directory - Libraries libcap-ng, pthread, and dl are linked selectively if needed Bugfixes: --------- - Sometimes incorrect result from dnssec_nsec_bitmap_contains (libdnssec) - Server can crash when loading zone file difference and zone-in-journal is set - Incorrect treatment of specific queries in the module RRL - Failed to link module Cookies as a shared library Knot DNS 2.7.1 (2018-08-14) =========================== Improvements: ------------- - Added zone wire size information to zone loading log message - Added debug log message for each unsuccessful remote address operation - Various improvements for packaging Bugfixes: --------- - Incompatible handling of RRSIG TTL value when creating a DNS message - Incorrect RRSIG TTL value in zone differences and knotc zone operation outputs - Default configure prefix is ignored Knot DNS 2.7.0 (2018-08-03) =========================== Features: --------- - New DNS Cookies module and related '+cookie' kdig option - New module for response tailoring according to client's subnet or geographic location - General EDNS Client Subnet support in the server - OSS-Fuzz integration (Thanks to Jonathan Foote) - New '+ednsopt' kdig option (Thanks to Jan Včelák) - Online Signing support for automatic key rollover - Non-normal file (e.g. pipe) loading support in zscanner #542 - Automatic SOA serial incrementation if non-empty zone difference - New zone file load option for ignoring zone file's SOA serial - New build-time option for alternative malloc specification - Structured logging for DNSSEC key submission event - Empty QNAME support in kdig Improvements: ------------- - Various library and server optimizations - Reduced memory consumption of outgoing IXFR processing - Linux capabilities use overhaul #546 (Thanks to Robert Edmonds) - Online Signing properly signs delegations and CNAME records - CDS/CDNSKEY rrset is signed with KSK instead of ZSK - DNSSEC-related records are ignored when loading zone difference with signing enabled - Minimum allowed RSA key length was increased to 1024 - Removed explicit dependency on Nettle Bugfixes: --------- - Possible uninitialized address buffer use in zscanner - Possible index overflow during multiline record parsing in zscanner - kdig +tls sometimes consumes 100 % CPU #561 - Single-Type Signing doesn't work with single ZSK key #566 - Zone not flushed after re-signing during zone load #594 - Server crashes when committing empty zone transaction - Incoming IXFR with on-slave signing sometimes leads to memory corruption #595 Compatibility: -------------- - Removed obsolete RRL configuration - Removed obsolete module names 'mod-online-sign' and 'mod-synth-record' - Removed obsolete 'ixfr-from-differences' configuration option - Removed old journal migration - Removed module rosedb Knot DNS 2.6.9 (2018-08-14) =========================== Improvements: ------------- - Added zone wire size to zone loading log message - Added debug log message for each unsuccessful remote address operation Bugfixes: --------- - Zone not flushed after re-signing during zone load #594 - Server crashes when committing empty zone transaction - Incoming IXFR with on-slave signing sometimes leads to memory corruption #595 Knot DNS 2.6.8 (2018-07-10) =========================== Features: --------- - New 'import-pkcs11' command in keymgr Improvements: ------------- - Unixtime serial policy mimics Bind – increment if lower #593 Bugfixes: --------- - Creeping memory consuption upon server reload #584 - Kdig incorrectly detects QNAME if 'notify' is a prefix - Server crashes when zone sign fails #587 - CSK->KZSK rollover retires CSK early #588 - Server crashes when zone expires during outgoing multi-message transfer - Kjournalprint doesn't convert zone name argument to lower-case - Cannot switch to a previously used ksk-shared dnssec policy #589 Knot DNS 2.6.7 (2018-05-17) =========================== Features: --------- - Added 'dateserial' (YYYYMMDDnn) serial policy configuration (Thanks to Wolfgang Jung) Improvements: ------------- - Trailing data indication from the packet parser (libknot) - Better configuration check for a problematical option combination Bugfixes: --------- - Incomplete configuration option item name check - Possible buffer overflow in 'knot_dname_to_str' (libknot) - Module dnsproxy doesn't preserve letter case of QNAME - Module dnsproxy duplicates OPT and TSIG in the non-fallback mode Knot DNS 2.6.6 (2018-04-11) =========================== Features: --------- - New EDNS option counters in the statistics module - New '+orphan' filter for the 'zone-purge' operation Improvements: ------------- - Reduced memory consuption of disabled statistics metrics - Some spelling fixes (Thanks to Daniel Kahn Gillmor) - Server no longer fails to start if MODULE_DIR doesn't exist - Configuration include doesn't fail if empty wildcard match - Added a configuration check for a problematical option combination Bugfixes: --------- - NSEC3 chain not re-created when SOA minimum TTL changed - Failed to start server if no template is configured - Possibly incorrect SOA serial upon changed zone reload with DNSSEC signing - Inaccurate outgoing zone transfer size in the log message - Invalid dname compression if empty question section - Missing EDNS in EMALF responses Knot DNS 2.6.5 (2018-02-12) =========================== Features: --------- - New 'zone-notify' command in knotc - Kdig uses '@server' as a hostname for TLS authenticaion if '+tls-ca' is set Improvements: ------------- - Better heap memory trimming for zone operations - Added proper polling for TLS operations in kdig - Configuration export uses stdout as a default output - Simplified detection of atomic operations - Added '--disable-modules' configure option - Small documentation updates Bugfixes: --------- - Zone retransfer doesn't work well if more masters configured - Kdig can leak or double free memory in corner cases - Inconsistent error outputs from dynamic configuration operations - Failed to generate documentation on OpenBSD Knot DNS 2.6.4 (2018-01-02) =========================== Features: --------- - Module synthrecord allows multiple 'network' specification - New CSK handling support in keymgr Improvements: ------------- - Allowed configuration for infinite zsk lifetime - Increased performance and security of the module synthrecord - Signing changeset is stored into journal even if 'zonefile-load' is whole Bugfixes: --------- - Unintentional zone re-sign during reload if empty NSEC3 salt - Inconsistent zone names in journald structured logs - Malformed outgoing transfer for big zone with TSIG - Some minor DNSSEC-related issues Knot DNS 2.6.3 (2017-11-24) =========================== Bugfixes: --------- - Wrong detection of signing scheme rollover Knot DNS 2.6.2 (2017-11-23) =========================== Features: --------- - CSK algorithm rollover and (KSK, ZSK) <-> CSK rollover support Improvements: ------------- - Allowed explicit configuration for infinite ksk lifetime - Proper error messages instead of unclear error codes in server log - Better support for old compilers Bugfixes: --------- - Unexpected reply for DS query with an owner below a delegation point - Old dependencies in the pkg-config file Knot DNS 2.6.1 (2017-11-02) =========================== Features: --------- - NSEC3 Opt-Out support in the DNSSEC signing - New CDS/CDNSKEY publish configuration option Improvements: ------------- - Simplified DNSSEC log message with DNSKEY details - +tls-hostname in kdig implies +tls-ca if neither +tls-ca nor +tls-pin is given - New documentation sections for DNSSEC key rollovers and shared keys - Keymgr no longer prints useless algorithm number for generated key - Kdig prints unknown RCODE in a numeric format - Better support for LLVM libFuzzer Bugfixes: --------- - Faulty DNAME semantic check if present in the zone apex and NSEC3 is used - Immediate zone flush not scheduled during the zone load event - Server crashes upon dynamic zone addition if a query module is loaded - Kdig fails to connect over TLS due to SNI is set to server IP address - Possible out-of-bounds memory access at the end of the input - TCP Fast Open enabled by default in kdig breaks TLS connection Knot DNS 2.6.0 (2017-09-29) =========================== Features: --------- - On-slave (inline) signing support - Automatic DNSSEC key algorithm rollover - Ed25519 algorithm support in DNSSEC (requires GnuTLS 3.6.0) - New 'journal-content' and 'zonefile-load' configuration options - keymgr tries to run as user/group set in the configuration - Public-only DNSSEC key import into KASP DB via keymgr - NSEC3 resalt and parent DS query events are persistent in timer DB - New processing state for a response suppression within a query module - Enabled server side TCP Fast Open if supported - TCP Fast Open support in kdig Improvements: ------------- - Better record owner compression if related to the previous rdata dname - NSEC(3) chain is no longer recomputed whole on every update - Remove inconsistent and unnecessary quoting in log files - Avoiding of overlapping key rollovers at a time - More DNSSSEC-related semantic checks - Extended timestamp format in keymgr Bugfixes: --------- - Incorrect journal free space computation causing inefficient space handling - Interface-automatic broken on Linux in the presence of asymmetric routing
This commit is contained in:
ryoon
parent
1097d873d0
commit
a24848966e
3 changed files with 30 additions and 37 deletions
|
|
@ -1,7 +1,6 @@
|
|||
# $NetBSD: Makefile,v 1.40 2018/07/04 13:40:28 jperkin Exp $
|
||||
# $NetBSD: Makefile,v 1.41 2019/01/29 15:07:24 ryoon Exp $
|
||||
|
||||
DISTNAME= knot-2.5.7
|
||||
PKGREVISION= 1
|
||||
DISTNAME= knot-2.7.6
|
||||
CATEGORIES= net
|
||||
MASTER_SITES= https://secure.nic.cz/files/knot-dns/
|
||||
EXTRACT_SUFX= .tar.xz
|
||||
|
|
|
|||
|
|
@ -1,38 +1,35 @@
|
|||
@comment $NetBSD: PLIST,v 1.14 2018/03/08 14:30:37 pettai Exp $
|
||||
@comment $NetBSD: PLIST,v 1.15 2019/01/29 15:07:24 ryoon Exp $
|
||||
bin/kdig
|
||||
bin/khost
|
||||
bin/kjournalprint
|
||||
bin/knsec3hash
|
||||
bin/knsupdate
|
||||
bin/kzonecheck
|
||||
include/dnssec/binary.h
|
||||
include/dnssec/crypto.h
|
||||
include/dnssec/dnssec.h
|
||||
include/dnssec/error.h
|
||||
include/dnssec/key.h
|
||||
include/dnssec/keyid.h
|
||||
include/dnssec/keystore.h
|
||||
include/dnssec/keytag.h
|
||||
include/dnssec/list.h
|
||||
include/dnssec/nsec.h
|
||||
include/dnssec/random.h
|
||||
include/dnssec/sign.h
|
||||
include/dnssec/tsig.h
|
||||
include/dnssec/version.h
|
||||
include/knot/module.h
|
||||
include/libdnssec/binary.h
|
||||
include/libdnssec/crypto.h
|
||||
include/libdnssec/dnssec.h
|
||||
include/libdnssec/error.h
|
||||
include/libdnssec/key.h
|
||||
include/libdnssec/keyid.h
|
||||
include/libdnssec/keystore.h
|
||||
include/libdnssec/keytag.h
|
||||
include/libdnssec/list.h
|
||||
include/libdnssec/nsec.h
|
||||
include/libdnssec/random.h
|
||||
include/libdnssec/sign.h
|
||||
include/libdnssec/tsig.h
|
||||
include/libdnssec/version.h
|
||||
include/libknot/attribute.h
|
||||
include/libknot/binary.h
|
||||
include/libknot/codes.h
|
||||
include/libknot/consts.h
|
||||
include/libknot/control/control.h
|
||||
include/libknot/cookies/alg-fnv64.h
|
||||
include/libknot/cookies/client.h
|
||||
include/libknot/cookies/server.h
|
||||
include/libknot/cookies.h
|
||||
include/libknot/db/db.h
|
||||
include/libknot/db/db_lmdb.h
|
||||
include/libknot/db/db_trie.h
|
||||
include/libknot/descriptor.h
|
||||
include/libknot/dname.h
|
||||
include/libknot/endian.h
|
||||
include/libknot/errcode.h
|
||||
include/libknot/error.h
|
||||
include/libknot/libknot.h
|
||||
|
|
@ -46,30 +43,28 @@ include/libknot/rdata.h
|
|||
include/libknot/rdataset.h
|
||||
include/libknot/rrset-dump.h
|
||||
include/libknot/rrset.h
|
||||
include/libknot/rrtype/aaaa.h
|
||||
include/libknot/rrtype/dnskey.h
|
||||
include/libknot/rrtype/ds.h
|
||||
include/libknot/rrtype/naptr.h
|
||||
include/libknot/rrtype/nsec.h
|
||||
include/libknot/rrtype/nsec3.h
|
||||
include/libknot/rrtype/nsec3param.h
|
||||
include/libknot/rrtype/opt-cookie.h
|
||||
include/libknot/rrtype/opt.h
|
||||
include/libknot/rrtype/rdname.h
|
||||
include/libknot/rrtype/rrsig.h
|
||||
include/libknot/rrtype/soa.h
|
||||
include/libknot/rrtype/tsig.h
|
||||
include/libknot/rrtype/txt.h
|
||||
include/libknot/tsig-op.h
|
||||
include/libknot/tsig.h
|
||||
include/libknot/version.h
|
||||
include/libknot/wire.h
|
||||
include/libknot/yparser/yparser.h
|
||||
include/libknot/yparser/ypformat.h
|
||||
include/libknot/yparser/ypschema.h
|
||||
include/libknot/yparser/yptrafo.h
|
||||
include/zscanner/error.h
|
||||
include/zscanner/scanner.h
|
||||
include/zscanner/version.h
|
||||
include/libzscanner/error.h
|
||||
include/libzscanner/scanner.h
|
||||
include/libzscanner/version.h
|
||||
lib/libdnssec.la
|
||||
lib/libknot.la
|
||||
lib/libzscanner.la
|
||||
|
|
@ -79,19 +74,18 @@ lib/pkgconfig/libknot.pc
|
|||
lib/pkgconfig/libzscanner.pc
|
||||
man/man1/kdig.1
|
||||
man/man1/khost.1
|
||||
man/man1/kjournalprint.1
|
||||
man/man1/knsec3hash.1
|
||||
man/man1/knsupdate.1
|
||||
man/man1/kzonecheck.1
|
||||
man/man5/knot.conf.5
|
||||
man/man8/keymgr.8
|
||||
man/man8/kjournalprint.8
|
||||
man/man8/knotc.8
|
||||
man/man8/knotd.8
|
||||
man/man8/pykeymgr.8
|
||||
sbin/keymgr
|
||||
sbin/kjournalprint
|
||||
sbin/knotc
|
||||
sbin/knotd
|
||||
sbin/pykeymgr
|
||||
share/examples/knot/example.com.zone
|
||||
share/examples/knot/knot.sample.conf
|
||||
@pkgdir etc/knot
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
$NetBSD: distinfo,v 1.24 2018/03/08 14:30:37 pettai Exp $
|
||||
$NetBSD: distinfo,v 1.25 2019/01/29 15:07:24 ryoon Exp $
|
||||
|
||||
SHA1 (knot-2.5.7.tar.xz) = 26bcd2784a8d1c062a4a103d9f2cb651804e7d68
|
||||
RMD160 (knot-2.5.7.tar.xz) = 96ac63cf365ed10fc979a351c79c12e345d4c2f0
|
||||
SHA512 (knot-2.5.7.tar.xz) = 96e375f556309bb89cea982dda169cef70c23d03c48282110e47a44849c1102cd37d98aa7650781b399f5d932b724b8a935f0b9e55e4920465ae7b74a0d1d55a
|
||||
Size (knot-2.5.7.tar.xz) = 1084656 bytes
|
||||
SHA1 (knot-2.7.6.tar.xz) = d2f313267c2b68b822c5b715927eae9d5268738e
|
||||
RMD160 (knot-2.7.6.tar.xz) = fca8c746a783789a1a5c0d1f0fbe2df8f652a250
|
||||
SHA512 (knot-2.7.6.tar.xz) = 6b6a727d57337da01e2d44abec7fde4504d112604769b118fe6254b0317f149ed4e9fab321a04517eccedb08e409818d1817fc1136c27d1fd351538e6816022a
|
||||
Size (knot-2.7.6.tar.xz) = 1151068 bytes
|
||||
SHA1 (patch-samples_Makefile.in) = 499b8742dbd948e489b01d512bc7a8d8e4fe2e7b
|
||||
|
|
|
|||
Loading…
Reference in a new issue