Changelog:
Version 3.2.5
Thursday, February 2, 2023
Features:
+ knotd: new configuration option for enforcing IXFR fallback (see
'zone.provide-ixfr')
Improvements:
+ knotd: changed UNIX socket file mode to 0222 for answering and 0220 for
control
+ mod-probe: new support for communication over a UNIX socket
+ kdig: new support for communication over a UNIX socket
+ libs: upgraded embedded libngtcp2 to 0.13.0
+ doc: various improvements
Bugfixes:
+ knotd: failed to get catalog member configuration if catalog template
is in a template
+ knotd: failed to respond over a UNIX socket with EDNS
+ knotd: unexpected zone update upon restart or zone reload if ZONEMD
generation is enabled
+ knotd: redundant zone flush of unchanged zone if zone file load is
'difference-no-serial'
+ knotd/kxdpgun: failed to receive messages over XDP with drivers tap or
ena
+ knotc: zone check doesn't report missing zone file #829
+ kxdpgun: program crashes when remote closes QUIC connection instead of
resumption
+ mod-geoip: configuration check leaks memory in the geodb mode
+ utils: unwanted color reset sequences in non-color output
Changelog:
Version 3.2.4
Improvements:
+ knotd: significant speed-up of catalog zone update processing
+ knotd: new runtime check if RRSIG lifetime is lower than RRSIG refresh
+ knotd: reworked zone re-bootstrap scheduling to be less progressive
+ mod-synthrecord: module can work with CIDR-style reverse zones #826
+ python: new libknot wrappers for some dname transformation functions
+ doc: a few fixes and improvements
Bugfixes:
+ knotd: incomplete zone is received when IXFR falls back to AXFR due to
connection timeout if primary puts initial SOA only to the first
message
+ knotd: first zone re-bootstrap is planned after 24 hours
+ knotd: EDNS EXPIRE option is present in outgoing transfer of a catalog
zone
+ knotd: catalog zone can expire upon EDNS EXPIRE processing
+ knotd: DNSSEC signing doesn't fail if no offline KSK records available
Version 3.2.3
Improvements:
+ knotd: new per-zone DS push configuration option (see 'zone.ds-push')
+ libs: upgraded embedded libngtcp2 to 0.11.0
Bugfixes:
+ knsupdate: program crashes when sending an update
+ knotd: server drops more responses over UDP under higher load
+ knotd: missing EDNS padding in responses over QUIC
+ knotd: some memory issues when handling unusual QUIC traffic
+ kxdpgun: broken IPv4 source subnet processing
+ kdig: incorrect handling of unsent data over QUIC
Version 3.2.2
Features:
+ knotd,kxdpgun: support for VLAN (802.1Q) traffic in the XDP mode
+ knotd: added configurable delay upon D-Bus initialization (see
'server.dbus-init-delay')
+ kdig: support for JSON (RFC 8427) output format (see '+json')
+ kdig: support for PROXYv2 (see '+proxy') (Gift for Peter van Dijk)
Improvements:
+ mod-geoip: module respects the server configuration of answer rotation
+ libs: upgraded embedded libngtcp2 to 0.10.0
+ tests: improved robustness of some unit tests
+ doc: added description of zone bootstrap re-planning
Bugfixes:
+ knotd: catalog confusion when a member is added and immediately deleted
#818
+ knotd: defective handling of short messages with PROXYv2 header #816
+ knotd: inconsistent processing of malformed messages with PROXYv2
header #817
+ kxdpgun: incorrect XDP mode is logged
+ packaging: outdated dependency check in RPM packages
Version 3.2.1
Improvements:
+ libknot: added compatibility with libbpf 1.0 and libxdp
+ libknot: removed some trailing white space characters from textual RR
format
+ libs: upgraded embedded libngtcp2 to 0.8.1
Bugfixes:
+ knotd: some non-DNS packets not passed to OS if XDP mode enabled
+ knotd: inappropriate log about QUIC port change if QUIC not enabled
+ knotd/kxdpgun: various memory leaks related to QUIC and TCP
+ kxdpgun: can crash at high rates in emulated XDP mode
+ tests: broken XDP-TCP test on 32-bit platforms
+ kdig: failed to build with enabled QUIC on OpenBSD
+ systemd: failed to start server due to TemporaryFileSystem setting
+ packaging: missing knot-dnssecutils package on CentOS 7
Version 3.2.0
Features:
+ knotd: finalized TCP over XDP implementation
+ knotd: initial implementation of DNS over QUIC in the XDP mode (see
'xdp.quic')
+ knotd: new incremental DNSKEY management for multi-signer deployment
(see 'policy.dnskey-management')
+ knotd: support for remote grouping in configuration (see 'groups'
section)
+ knotd: implemented EDNS Expire option (RFC 7314)
+ knotd: NSEC3 salt is changed with every ZSK rollover if lifetime is set
to -1
+ knotd: support for PROXY v2 protocol over UDP (Thanks to Robert
Edmonds) #762
+ knotd: support for key labels with PKCS #11 keystore (see
'keystore.key-label')
+ knotd: SVCB/HTTPS treatment according to draft-ietf-dnsop-svcb-https
+ keymgr: new JSON output format (see '-j' parameter) for listing keys or
zones (Thanks to JP Mens)
+ kxdpgun: support for DNS over QUIC with some testing modes (see '-U'
parameter)
+ kdig: new DNS over QUIC support (see '+quic')
Improvements:
+ knotd: reduced memory consumption when processing IXFR, DNSSEC,
catalog, or DDNS
+ knotd: RRSIG refresh values don't have to match in the mode Offline KSK
+ knotd: better decision whether AXFR fallback is needed upon a refresh
error
+ knotd: NSEC3 resalt event was merged with the DNSSEC event
+ knotd: server logs when the connection to remote was taken from the
pool
+ knotd: server logs zone expiration time when the zone is loaded
+ knotd: DS check verifies removal of old DS during algorithm rollover
+ knotd: DNSSEC-related records can be updated via DDNS
+ knotd: new 'xdp.udp' configuration option for disabling UDP over XDP
+ knotd: outgoing NOTIFY is replanned if failed
+ knotd: configuration checks if zone MIN interval values are lower or
equal to MAX ones
+ knotd: DNSSEC-related zone semantic checks use DNSSEC validation
+ knotd: new configuration value 'query' for setting ACL action
+ knotd: new check on near end of imported Offline KSK records
+ knotd/knotc: implemented zone catalog purge, including orphaned member
zones
+ knotc: interactive mode supports catalog zone completion, value
completion, and more
+ knotc: new default brief and colorized output from zone status
+ knotc: unified empty values in zone status output
+ keymgr: DNSKEY TTL is taken from KSR in the Offline KSK mode
+ kjournalprint: path to journal DB is automatically taken from the
configuration, which can be specified using '-c', '-C' (or '-D')
+ kcatalogprint: path to catalog DB is automatically taken from the
configuration, which can be specified using '-c', '-C' (or '-D')
+ kzonesign: added automatic configuration file detection and '-C'
parameter for configuration DB specificaion
+ kzonesign: all CPU threads are used for DNSSEC validation
+ libknot: dname pointer cannot point to another dname pointer when
encoding RRsets #765
+ libknot: QNAME case is preserved in knot_pkt_t 'wire' field (Thanks to
Robert Edmonds) #780
+ libknot: reduced memory consumption of the XDP mode
+ libknot: XDP filter supports up to 256 NIC queues
+ kxdpgun: new options for specifying source and remote MAC addresses
+ utils: extended logging of LMDB-related errors
+ utils: improved error outputs
+ kdig: query has AD bit set by default
+ doc: various improvements
Bugfixes:
+ knotd: zone changeset is stored to journal even if disabled
+ knotd: journal not applied to zone file if zone file changed during
reload
+ knotd: possible out-of-order processing or postponed zone events to far
future
+ knotd: incorrect TTL is used if updated RRSet is empty over control
interface
+ knotd/libs: serial arithmetics not used for RRSIG expiration processing
+ knsupdate: incorrect RRTYPE in the question section
Compatibility:
+ knotd: default value for 'zone.journal-max-depth' was lowered to 20
+ knotd: default value for 'policy.nsec3-iterations' was lowered to 0
+ knotd: default value for 'policy.rrsig-refresh' is propagation delay +
zone maximum TTL
+ knotd: server fails to load configuration if 'policy.rrsig-refresh' is
too low
+ knotd: configuration option 'server.listen-xdp' has no effect
+ knotd: new configuration check on deprecated DNSSEC algorithm
+ knotc: new '-e' parameter for full zone status output
+ keymgr: new '-e' parameter for full key list output
+ keymgr: brief key listing mode is enabled by default
+ keymgr: renamed parameter '-d' to '-D'
+ knsupdate: default TTL is set to 3600
+ knsupdate: default zone is empty
+ kjournalprint: renamed parameter '-c' to '-H'
+ python/libknot: removed compatibility with Python 2
Packaging:
+ systemd: removed knot.tmpfile
+ systemd: added some hardening options
+ distro: Debian 9 and Ubuntu 16.04 no longer supported
+ distro: packages for CentOS 7 are built in a separate COPR repository
+ kzonecheck/kzonesign/knsec3hash: moved to new package knot-dnssecutils
Version 3.1.9
Improvements:
+ knotd: new configuration checks on unsupported catalog settings
+ knotd: semantic check issues have notice log level in the soft mode
+ keymgr: command generate-ksr automatically sets 'from' parameter to
last offline KSK records' timestamp if it's not specified
+ keymgr: command show-offline starts from the first offline KSK record
set if 'from' parameter isn't specified
+ kcatalogprint: new parameters for filtering catalog or member zone
+ mod-probe: default rate limit was increased to 100000
+ libknot: default control timeout was increased to 30 seconds
+ python/libknot: various exceptions are raised from class KnotCtl
+ doc: some improvements
Bugfixes:
+ knotd: incomplete outgoing IXFR is responded if journal history is
inconsistent
+ knotd: manually triggered zone flush is suppressed if disabled zone
synchronization
+ knotd: failed to configure XDP listen interface without port
specification
+ knotd: de-cataloged member zone's file isn't deleted #805
+ knotd: member zone leaks memory when reloading catalog during dynamic
configuration change
+ knotd: server can crash when reloading modules with DNSSEC signing
(Thanks to iqinlongfei)
+ knotd: server crashes during shutdown if PKCS #11 keystore is used
+ keymgr: command del-all-old isn't applied to all keys in the removed
state
+ kxdpgun: user specified network interface isn't used
+ libs: fixed compilation on illumos derivatives (Thanks to Nick Ewins)
Changelog:
Version 3.1.8
Thursday, April 28, 2022
Features:
+ knotd: optional automatic ACL for XFR and NOTIFY (see
'remote.automatic-acl')
+ knotd: new soft zone semantic check mode for allowing defective zone
loading
+ knotc: added zone transfer freeze state to the zone status output
Improvements:
+ knotd: added configuration check for serial policy of generated
catalogs
Bugfixes:
+ knotd/libknot: the server can crash when validating a malformed TSIG
record
+ knotd: outgoing zone transfer freeze not preserved during server reload
+ knotd: catalog UPDATE not processed if previous UPDATE processing not
finished #790
+ knotd: zone refresh not started if planned during server reload
+ knotd: generated catalogs can be queried over UDP
+ knotd/utils: failed to open LMDB database if too many stale slots
occupy the lock table
Version 3.1.7
Wednesday, March 30, 2022
Features:
+ knotd: new configuration items for restricting minimum and maximum zone
expire and retry intervals (see 'zone.expire-min-interval',
'zone.expire-max-interval', 'zone.retry-min-interval',
'zone.retry-max-interval') #785
+ knotc: added catalog information to zone status
Improvements:
+ knotd: better warning message if SOA serial comparison failed when
loading from zone file
+ knotc: zone status shows all zone events when frozen
+ keymgr: better error message is returned when importing SKR with
insufficient permissions
+ kdig: transfer status is also printed if failed
Bugfixes:
+ knotd: incomplete implementation of the Offline KSK mode in the IXFR
and DDNS processing
+ knotd: catalog zone accepts duplicate members via UPDATE #786
+ knotd: server crashes if catalog database contains orphaned member
zones
+ knotd: old journal is scraped when restoring just the zone file
+ knotd: some planned zone events can be lost during server reload
+ knotd: frozen zone gets thawed during server reload
+ knsupdate: missing section names in the show output
+ knsupdate: inappropriate log message if called from a script
Version 3.1.6
Tuesday, February 8, 2022
Features:
+ knotd: optional D-Bus notifications for significant server and zone
events (see 'server.dbus-event')
+ knotd: new submission configuration option for delayed KSK
post-activation (see 'submission.parent-delay')
+ knotc: new commands for outgoing XFR freeze (see 'zone-xfr-freeze' and
'zone-xfr-thaw')
+ kzonesign: added multithreaded DNSSEC validation mode (see '--verify')
Improvements:
+ kdig: trailing data in reply packet is accepted with a warning
+ kdig: XFR responses are checked if SOA owners match
+ knotd: failed remote operations are logged as info instead of debug
+ knsec3hash: added alternative and more natural parameter semantics
+ knsupdate: interactive mode is newly based on library Editline
+ Dockerfile: added UID argument to facilitate the use of unprivileged
container #783
+ doc: various fixes and improvements
Bugfixes:
+ libknot: inaccurate KNOT_DNAME_TXT_MAXLEN constant value #781
+ knotd: propagation delay not considered before DS push
+ knotd: excessive refresh retry delay when a few early attemps fail
+ knotd: duplicate KSK submission log message during a KSK rollover
+ kdig: dname letter case not preserved in XFR and Dnstap outputs
+ mod-cookies: missing server cookie in responses over TCP
Version 3.1.5
Monday, December 20, 2021
Features:
+ knotd: optional outgoing TCP connection pool for faster communication
with remotes (see 'server.remote-pool-limit' and
'server.remote-pool-timeout')
+ knotd: optional unreachable remote tracking to avoid zone events
clogging (see 'server.remote-retry-delay')
+ knotd: new ZONEMD generation mode for the record removal from the zone
apex #760 (see 'zone.zonemd-generate: remove')
+ mod-dnsproxy: new source address match option (see
'mod-dnsproxy.address')
+ scripts/probe_dump: simple mod-probe client
Improvements:
+ knotd: DS push sets DS TTL equal to DNSKEY TTL
+ knotd: extended zone purge error logging
+ knotd: zone file parsing error message was extended by the file name
+ knotd: improved debug log message when TCP timeout is reached
+ knotd: new configuration check for using the default number of NSEC3
iterations
+ knotd: new configuration check for insufficient RRSIG refresh time
+ mod-geoip: configuration check newly verifies the module configuration
file #778
+ kdig: option +notimeout or +timeout=0 is interpreted as infinity
+ kdig: option +noretry is interpreted as zero retries
+ python/probe: more detailed default output format
+ doc: many spelling fixes (Thanks to Josh Soref)
+ doc: various fixes and improvements
Bugfixes:
+ knotd: imperfect TCP connection closing in the XDP mode
+ knotd: TCP reset packets are wrongly checked for ackno in the XDP mode
+ knotd: only first zone name is logged for multi-zone control operations
#776
+ knotd: minor memory leak when full zone update fails to write to
journal
+ knotc: configuration check doesn't check a configuration database
+ mod-dnstap: incorrect QNAME case restore in some corner cases (Thanks
to Robert Edmonds) #777
Changelog:
Version 3.1.4
Features:
+ mod-dnstap: added 'responses-with-queries' configuration option (Thanks
to Robert Edmonds)
Improvements:
+ knotd: DNSSEC keys are logged in sorted order by timestamp
+ mod-cookies: added statistics counter for dropped queries due to the
slip limit
+ mod-dnstap: restored the original query QNAME case #773 (Thanks to
Robert Edmonds)
+ configure: improved compatibility of some scripts on macOS and BSDs
+ doc: updates on DNSSEC signing
Bugfixes:
+ knotd: server can crash when receiving queries with NSID EDNS flag #774
(Thanks to Romain Labolle)
+ knotd: server crashes on reload when no interfaces configured #770
+ knotd: ZONEMD without DNSSEC not handled correctly
+ knotd: generated catalog zone not updated on config reload #772
+ knotd: zone catalog not verified before its interpretation
+ knotd: ds-push fails to update the parent zone if a CNAME exists for a
non-terminal node
Version 3.1.3
Monday, October 18, 2021
Improvements:
+ knotd: added simple error logging to orphaned zone purge
+ knotd: allow manual public-only keys for unused algorithm
+ kdig: send ALPN when using DoT or XoT #769
+ doc: various fixes and improvements #767
Bugfixes:
+ knotd: catalog backup doesn't preserve version of the catalog
implementation
+ knotd: NOTIFY is scheduled even when DNSSEC signing is up-to-date
+ knotd: server can crash when zone difference is inconsistent upon cold
start
+ knotd: zone not bootstrapped when zone file load failed due to an error
+ knotd: broken AXFR with knot as slave and dnsmasq as master (Thanks to
Daniel Gr?ber)
+ knotd: journal not able to free up space when zone-in-journal present
and zonefile written
+ mod-stats: missing protocol counters for TCP over XDP
+ kzonesign: input zone name not lower-cased
Version 3.1.2
Features:
+ knotd: new policy configuration for postponing complete deletion of
previous keys
+ keymgr: new optional pretty mode (-b) of listing keys
+ kdig: added support for TCP keepopen #503
Improvements:
+ knotd: configuration item values can contain UTF-8 characters
+ knotd: added configuration check for database storage writability
+ knotd: better error reporting if zone is empty
+ knotd: smaller journal database chunks in order to mitigate LMDB
fragmentation
+ knotd/kxdpgun: CAP_SYS_RESOURCE capability no longer needed for XDP on
Linux >= 5.11
Bugfixes:
+ knotd: incomplete NSEC3 proof in response to opt-outed empty
non-terminal
+ knotd: wrong SOA serial handling when enabling signing on already
existing secondary zone
+ knotd: defective ZONEMD verification error reporting when loading zone
#759
+ knotd: server can crash when reloading catalog zone #761
+ knotd: DNSSEC validation doesn't work when only NSEC3 chain changes
+
knotd: DNSSEC validation doesn't check if empty non-terminal over
non-opt-outed
delegation isn't opt-outed too
+ knotd: ZONEMD generation doesn't cause flushing zone to disk #758
+ knotd: incorrect evaluation of ACL deny rule in combination with TSIG
+ knotd: failed DS-check is replaned even if no key is ready
+ kdig: abort when query times out #763
+ libzscanner: missing output overflow check in the SVCB parsing
Compatibility:
+ keymgr: parameter -d is marked deprecated in favor of new parameter -D
+ kjournalprint: parameter -n is marked deprecated in favor of new
parameter -x
Version 3.1.1
Improvements:
+ keymgr: import-bind sets publish and active timers to now if missing
timers #747
+ mod-rrl: added QNAME, which triggered an action, to log messages #757
+ systemd: added environment variable for setting maximum configuration
DB size
Bugfixes:
+ knotd: adding RRSIGs to a signed zone can lead to redundant RRSIGs for
some NSEC(3)s
+ knotd: code not compiled correctly for ARM on Fedora >= 33
+ knotd: server can crash when opening catalog DB on startup
+ knotd: incorrect catalog update counts in logs
+ knotd: journal discontinuity and zone-in-journal result in incorrectly
calculated journal occupation
+ kdig: +noall does not filter out AUTHORITY comment #749
+ tests: journal unit test not passing if memory page size is different
from 4096
Reverts:
+ libzscanner: reverted "omitted TTL value is correctly set to the last
explicitly stated value (RFC 1035)" #751
All checksums have been double-checked against existing RMD160 and
SHA512 hashes
Not committed (merge conflicts...):
net/radsecproxy/distinfo
The following distfiles could not be fetched (fetched conditionally?):
./net/citrix_ica/distinfo citrix_ica-10.6.115659/en.linuxx86.tar.gz
./net/djbdns/distinfo dnscache-1.05-multiple-ip.patch
./net/djbdns/distinfo djbdns-1.05-test28.diff.xz
./net/djbdns/distinfo djbdns-1.05-ignoreip2.patch
./net/djbdns/distinfo djbdns-1.05-multiip.diff
./net/djbdns/distinfo djbdns-cachestats.patch
Changelog:
Version 3.1.0
Monday, August 2, 2021
Features:
+ knotd: automatic zone catalog generation based on actual configuration
+ knotd: zone catalog supports configuration groups
+ knotd: support for ZONEMD validation and generation
+ knotd: basic support for TCP over XDP processing
+ knotd: configuration option for enabling IP route check in the XDP mode
+ knotd: support for epoll (Linux) and kqueue (*BSD, macOS) socket
polling
+ knotd: extended EDNS error (EDE) is added to the response if
appropriate
+ knotd: DNSSEC operation with extra ready public-only KSK is newly
allowed
+ knotd: new zone backup/restore filters for more variable component
specification
+ knotd: adaptive systemd service start timeout and new zone loading
status #733
+ knotd: configuration option for enabling TCP Fast Open on outbound
communication
+ knotd: when the server starts, zone NOTIFY is send only if not sent
already
+ knotc: zone reload with the force flag triggers reload of the zone and
its modules
+ libs: support for parsing and dumping SVCB and HTTPS resource records
+ kdig: support for TCP Fast Open along with DoT/DoH #549
+ kxdpgun: basic support for DNS over TCP processing
+ kxdpgun: current traffic statistics can be printed using a USR1 signal
+ python: new libknot/probe API wrapper
Improvements:
+ knotd: PID file is created even in the foreground mode
+ knotd: more robust and enhanced zone data backup and restore operations
+ knotd: maximum length of an XFR message is limited to 16 KiB for better
compression
+ knotd: maximum CNAME/DNAME chain depth per reply was decreased from 20
to 5
+ knotd: improved performance of processing domain names with many short
labels
+ knotd: adaptive limit on the number of LMDB readers to avoid problems
with many workers
+ knotd: TTL of generated NSEC(3) records is set to min(SOA TTL, SOA
minimum)
+ knotd: TTL of generated NSEC3PARAM is equal to TTL of NSEC3 records
+ knotd: maximum TCP segment size is restricted to 1220 octets on Linux #
468
+ knotc: various improvements in error reporting
+ knotc: default control timeout is infinity in the blocking mode
+ dnssec: dnskey generator tries to return a key with a unique keytag
+ kxdpgun: RLIMIT_MEMLOCK is increased only if not high enough
+ kxdpgun: RTNETLINK is used for getting network information instead of
the ip command
Bugfixes:
+ knotd: DNAME not applied more than once to resolve the query #714
+ knotd: root zone not correctly purged from the journal
+ kzonecheck: incorrect check for opt-outed empty non-terminal nodes
+ libzscanner: wrong error line number
+ libzscanner: broken multiline rdata processing if an error occurs
+ mod-geoip: NXDOMAIN is responded instead of NODATA #745
+ make: build fails with undefined references if building using slibtool
#722
Packaging:
+ knotd: systemd service reload uses 'kill -HUP' instead of 'knotc
reload'
+ kxdpgun: new library dependency libmnl
+ mod-dnstap: new package separate from the knot package
+ mod-geoip: new package separate from the knot package
Compatibility:
+ configure: option '--enable-xdp=yes' means use an external libbpf if
available
or use the embedded one
+ libzsanner: omitted TTL value is correctly set to the last explicitly
stated value (RFC 1035)
+ knotc: zone restore from an old backup (3.0.x) requires forced
operation
+ knotd: configuration option 'server.listen-xdp' is replaced with
'xdp.listen'
+ knotd: zone file loading with automatic SOA serial incrementation newly
requires having full zone in the journal
+ knotd: obsolete configuration options 'zone.disable-any',
'server.tcp-handshake-timeout'
are silently ignored
+ knotd: obsolete configuration options 'zone.max-zone-size',
'zone.max-journal-depth',
'zone.max-journal-usage', 'zone.max-refresh-interval',
'zone.min-refresh-interval' 'server.max-ipv4-udp-payload',
'server.max-ipv6-udp-payload', 'server.max-udp-payload',
'server.tcp-reply-timeout', 'server.max-tcp-clients' are ignored
+ knotd: obsolete default template options 'template.journal-db',
'template.kasp-db', 'template.timer-db',
'template.max-journal-db-size', 'template.journal-db-mode',
'template.max-timer-db-size', 'template.max-kasp-db-size' are
ignored
Version 3.0.8
Friday, July 16, 2021
Features:
+ knotc: new command for loading DNSSEC keys without dropping all RRSIGs
when re-signing
+ knotd: new policy configuration option for disabling some DNSSEC safety
features #741
+ mod-geoip: new dnssec and policy configuration options
Bugfixes:
+ knotd: early KSK removal during a KSK rollover if automatic KSK
submission check
is enabled and DNSKEY TTL is lower than the corresponding DS TTL
+ knotd: failed to generate a new DNSKEY if previously generated shared
key not available
+ knotd: periodical error logging when a PKCS #11 keystore failed to
initialize #742
+ knotd: zone commit doesn't check for missing SOA record
Version 3.0.7
Wednesday, June 16, 2021
Features:
+ knotd: new configuration policy option for CDS digest algorithm setting
#738
+ keymgr: new command for primary SOA serial manipulation in on-secondary
signing mode
Improvements:
+ knotd: improved algorithm rollover to shorten the last step of old
RRSIG publication
Bugfixes:
+ knotd: zone is flushed upon server start, despite DNSSEC signing is
up-to-date
+ knotd: wildcard nonexistence is proved on empty-non-terminal query
+ knotd: redundant wildcard proof for non-authoritative data in a reply
+ knotd: missing wildcard proofs in a wildcard-cname loop reply
+ knotd: incorrectly synthesized CNAME owner from a wildcard record #715
+ knotd: zone-in-journal changeset ignores journal-max-usage limit #736
+ knotd: incorrect processing of zone-in-journal changeset with SOA
serial 0
+ knotd: broken initialization of processing workers if SO_REUSEPORT(_LB)
not available
+ kjournalprint: reported journal usage is incorrect #736
+ keymgr: cannot parse algorithm name ed448 #739
+ keymgr: default key size not set properly
+ kdig: failed to process huge DoH responses
+ libknot/probe: some corner-case bugs
Version 3.0.6
Wednesday, May 12, 2021
Features:
+ mod-probe: new module for simple traffic logging (Python API not yet
included)
Improvements:
+ keymgr: new mode for listing zones with at least one key stored
+ keymgr: the pregenerate command accepts optional timestamp-from
parameter
+ kzonecheck: accept '-' as substitution for standard input #727
+ knotd: print an error when unable to change owner of a logging file
+ knotd: new warning log if no interface is configured
+ knotd: new signing policy check for NSEC3 iterations higher than 20
+ knotd: don't allow backup to/restore from the DB storage directory
+ Various code (mostly zone backup/restore), tests, and documentation
improvements
Bugfixes:
+ knotd: secondary fails to load zone file if HTTPS or SVCB record is
present #725
+ knotd: (KSK roll-over) new KSK is not signing DNSKEY long enough before
DS submission
+ knotd: (KSK roll-over) old KSK uselessly published after roll-over
finished
+ knotd: malformed address in TCP-related logs when listening on a UNIX
socket
+ knotd: server responds FORMERR instead of BADTIME if TSIG signed time
is zero #730
+ modules: incorrect local and remote addresses in the XDP mode
+ modules: failed to read configuration from a section without
identifiers
+ mod-synthrecord: queries on synthesized empty-non-terminals not
answered with NODATA
+ keymgr: confusing error if del-all-old command fails
Changelog:
Improvements:
Sockets to CPUs binding is no longer enabled by default but can be enabled via new configuration option 'server.socket-affinity'
Some documentation improvements
Bugfixes:
DNS queries without EDNS to the root zone apex are dropped in the XDP mode
Deterministic ECDSA signing leaks memory
Zone not stored to journal if zonefile-load isn't ZONEFILE_LOAD_WHOLE
Server crashes if the catalog zone isn't configured for registered member zones
Server crashes when loading conflicting catalog member zones
CNAME and DNAME records below delegation are not ignored #713
Not all udp/tcp workers are used if the number of NIC queues is lower than the number of udp/tcp workers
Failed to load statistics and geoip modules if built as shared
Changelog:
Version 3.0.3
Features:
+ Kjournalprint can display changesets starting from specific SOA serial
Improvements:
+ New configuration check on ambiguous 'storage' specification #706
+ New configuration check on problematic 'zonefile-load' with
'journal-contents' combination
+ Server logs positive ACL check in debug severity level (Thanks to
Andreas Schrägle)
+ More verbose logging of failed zone backup
+ Extended documentation for catalog zones
Bugfixes:
+ On-slave signing produces broken NSEC(3) chain if glue node becomes
(un-)orphaned #705
+ Server responds CNAME query with NXDOMAIN for CNAME synthesized from
DNAME
+ Kdig crashes if source address and dnstap logging are specified
together #702
+ Knotc fails to display error returned from zone freeze or zone thaw
+ Dynamically reconfigured zone isn't loaded upon configuration commit
+ Keymgr is unable to import BIND-style private key if it contains empty
lines
+ Zone backup fails to backup keys if any of them is public-only
+ Failed to build with XDP support on Debian testing
Version 3.0.2
Features:
+ kdig prints Extended DNS Error (Gift for Marek Vavruša)
+ kxdpgun allows source IP address/subnet specification
Improvements:
+ Server doesn't start if any of listen addresses fails to bind
+ knotc no longer stores empty and adjacent identical commands to
interactive history
+ Depth of interactive history of knotc was increased to 1000 commands
+ keymgr prints error messages to stderr instead of stdout
+ keymgr checks for proper offline-ksk configuration before processing
KSR or SKR
+ keymgr imports Revoked timer from BIND keys
+ Additional XDP support detection in server
+ Lots of spelling and grammar fixes in documentation (Thanks to Paul
Dee)
+ Some documentation improvements
Bugfixes:
+ If more masters configured, zone retransfer triggers AXFR from all
masters
+ Server can fail to bind address during restart due to missing
SO_REUSEADDR
+ KSK imported from BIND doesn't roll over automatically
+ libdnssec respects local GnuTLS policy — affects DNSSEC operations and
Knot Resolver
+ kdig can stuck in infinite loop when solving BADCOOKIE responses
+ Zone names received over control interface are not lower-cased
+ Zone attributes not secured with multi-threaded changes
+ kzonecheck ignores forced dnssec checks if zone not signed
+ kzonecheck fails on case-sensitivity of owner names in NSEC records #
699
+ kdig fails to establish TLS connection #700
+ Server responds NOTIMPL to queries with QDCOUNT 0 and known OPCODE
Changelog:
3.0.1
Features:
New command in keymgr for validation of RRSIGs in SKR
Keymgr validates RRSIGs in SKR during import
New option in kzonecheck to skip DNSSEC-related checks
Improvements:
Module noudp has new configuration option for UDP truncation rate
Better detection of reproducible signing availability
Kxdpgun allows setting of network interface
Default control timeout in knotc was increased to 60 seconds
DNSSEC validation searches for invalid redundant RRSIGs
Configuration source detection no longer considers empty confdb directory as active configuration
Zone backup preserves original zone file if zone file synchronization is disabled
Bugfixes:
NSEC3 re-salt can cause server crash due to possible zone inconsistencies
Zone reload logs 'invalid parameter' if zone file not changed
Outgoing multi-message transfer can contain invalid compression pointers under specific conditions
Improper handling of file descriptors in libdnssec
Server crashes if no policy is configured with DNSSEC validation
Server crashes if DNSSEC validation is enabled for unsigned zone
Failed to build with libnghttp2 (Thanks to Robert Edmonds)
Various bugs in zone data backup/restore
Changelog:
Version 3.0.0
Wednesday, September 9, 2020
Features:
+ High-performance networking mode using XDP sockets (requires Linux
4.18+)
+ Support for Catalog zones including kcatalogprint utility
+ New DNSSEC validation mode
+ New kzonesign utility --- an interface for manual DNSSEC signing
+ New kxdpgun utility --- high-performance DNS over UDP traffic generator
for Linux
+ DoH support in kdig using GnuTLS and libnghttp2
+ New KSK revoked state (RFC 5011) in manual DNSSEC key management mode
+ Deterministic signing with ECDSA algorithms (requires GnuTLS 3.6.10+)
+ Module synthrecord supports reverse pointer shortening
+ Safe persistent zone data backup and restore
Improvements:
+ Processing depth of CNAME and DNAME chains is limited to 20
+ Non-FQDN is allowed as 'update-owner-name' configuration option value
+ Kdig prints detailed algorithm idendifier for PRIVATEDNS and PRIVATEOID
in multiline mode #334
+ Queries with QTYPE ANY or RRSIG are always responded with at most one
random RRSet
+ The statistics module has negligible performance overhead on modern
CPUs
+ If multithreaded zone signing is enabled, some additional zone
maintenance steps are newly parallelized
+ ACL can be configured by reference to a remote
+ Better CPU cache locality for higher query processing performance
+ Logging to non-syslog streams contains timestamps with the timezone
+ Keeping initial DNSKEY TTL and zone maximum TTL in KASP database to
ensure proper rollover timing in case of TTL changes during the
rollover
+ Responding FORMERR to queries with more OPT records
Bugfixes:
+ Module onlinesign responds NXDOMAIN insted of NOERROR (NODATA) if
DNSSEC not requested
+ Outgoing multi-message transfer can contain invalid compression
pointers under specific conditions
Version 2.9.6
Monday, August 31, 2020
Features:
+ New kdig option '+[no]opttext' to print unknown EDNS options as text if
possible (Thanks to Robert Edmonds)
Improvements:
+ Better error message if no key is ready for submission
+ Improved logging when master is not usable
+ Improved control logging of zone-flush errors if output directory is
specified
+ More precise system error messages when a zone transfer fails
+ Some documentation improvements (especially Offline KSK)
Bugfixes:
+ In the case of many zones, control operations over all zones take lots
of memory
+ Misleading error message on keymgr import-bind #683
+ DS push is triggered upon every zone change even though CDS wasn't
changed
+ Kzonecheck performance penalty with passive keys #688
CSK->KSK+ZSK scheme rollover can end too early
Changelog:
Monday, May 25, 2020
Bugfixes:
Old ZSK can be withdrawn too early during a ZSK rollover if maximum zone TTL is computed automatically
Server responds SERVFAIL to ANY queries on empty non-terminal nodes
Improvements:
Also module onlinesign returns minimized responses to ANY queries
Linking against libcap-ng can be disabled via a configure option
Changelog:
Version 2.9.4
Tuesday, May 5, 2020
Improvements:
ANY query over UDP is always answered with one RRSet + possible RRSIG instead of truncated reply
Server tries to resolve CNAME record generated by geoip module (Thanks to Conrad Hoffmann)
Earlier OCSP validity check in kdig certificate verification (Thanks to Alexander Schultz)
Module onlinesign allows KSK + ZSK mode
Server control listen backlog limit was increased to 5
Zone signing event is always re-scheduled even after a signing error
Extended error checks and tiny enhancements in kjournalprint
kdig logs a more detailed error message when failed to acquire a remote address
Some documentation improvements
Bugfixes:
Server can crash when zone update fails due to exceeded zone size limit
keymgr 'share' command doesn't work
Shared KSK doesn't work with an initial key
Self-created RRSIGs are still cryptographically verified in some unnecessary cases
Changed NSEC3PARAM not correctly detected during zone update
NSEC(3) chain not fixed if affected by zone udpate
knotc orphan purge doesn't work on journal
Online signing configured along with DNSSEC signing can cause MDB_BAD_RSLOT error during server reload
Zone journal access can stuck if mismanaged zone serial
Concurrently added and removed same records in a DDNS message are not properly handled
Zone check logs error instead of warning after a first error occured
Changelog:
Version 2.9.3
Tuesday, March 3, 2020
Features:
New configuration option 'remote.block-notify-after-transfer' to suppress sending NOTIFY messages
Enabled testing support for Ed448 DNSSEC algorithm (requires GnuTLS 3.6.12+ and not-yet-released Nettle 3.6+)
New keymgr parameter 'local-serial' for getting/setting signed zone SOA serial in the KASP database
keymgr can import Ed25519 and Ed448 keys in the BIND format (Thanks to Conrad Hoffmann)
Improvements:
kdig returns error if the query name is invalid
Increased 'server.tcp-io-timeout' default value to 500 ms
Decreased 'database.journal-db-max-size' default value to 512 MiB on 32-bit systems
Server no longer falls back to AXFR if master is outdated during zone refresh
Some documentation improvements (including new EPUB format and compatibility with Ultra Electronics CIS Keyper Plus HSM)
Some packaging improvements (including new python3-libknot deb package)
Bugfixes:
Outgoing IXFR can be malformed if the message size has specific size
Server can crash if the zone contains solo NSEC3 record
Improved compatibility with older journal format
Incorrect SOA TTL in negative answers — SOA minimum not considered
Cannot unset uppercase nodes via control interface #668
Module RRL doesn't set AA flag and NOERROR rcode in slipped responses
Server returns FORMERR instead of NOTIMP if empty QUESTION and unknown OPCODE
Changelog:
Knot DNS 2.9.2 (2019-12-12)
===========================
Improvements:
-------------
- Tiny ds-check log message rewording
- Some unnecessary code cleanup
Bugfixes:
---------
- ds-push doesn't replace the DS RRset on the parent #661
- Server gets stuck in a never-ending logging loop when changing SOA TTL
- Server can crash when the journal database size limit is reached
- Server can create a bogus changeset with equal serials from and to
- Unreasonable re-signing of the NSEC3PARAM record when reloading the zone
and 'zonefile-load: difference-no-serial' is configured
- SOA RRSIG not updated if the only changed record is SOA
- Failed to remove NSEC3 records through the control interface #666
- Failed to stop the server if a zone transaction is active
Knot DNS 2.9.1 (2019-11-11)
===========================
Features:
---------
- New option for OCSP stapling '+[no]tls-ocsp-stapling[=H]' in kdig (Thanks to Alexander Schultz)
Improvements:
-------------
- Kdig always randomizes source TCP port on recent Linux #575
- Server no longer warns about disabled zone file synchronization during shutdown
- Zone loading stops if failed to load zone from the journal
- Speed-up of insertion to big RRSets
- Various code and documentation improvements
Bugfixes:
---------
- Failed to apply journal changes after upgrade #659
- Failed to finish zone loading if journal changeset serials from and to are equal
- Incorrect handling of 0 value for 'tcp-io-timeout' and 'tcp-remote-io-timeout' configuration
- Server can crash if zone transaction is open during zone update
- NSEC3 chain not fully updated if NSEC3 salt changes during zone update
- Server can crash when flushing zone to a specified directory
- Server can respond incorrect NSEC3 records after NSEC3 salt change
- Delegation glue records not updated after specific zone change
Knot DNS 2.9.0 (2019-10-10)
===========================
Features:
---------
- Full support for different master/slave serial arithmetics when on-slave signing
- Module geoip newly supports wildcard records #650
- New DNSSEC policy configuration option 'rrsig-pre-refresh' for reducing
frequency of the zone signing event
- New server configuration option 'tcp-reuseport' for setting SO_REUSEPORT(_LB)
mode on TCP sockets
- New server configuration option 'tcp-io-timeout' [ms] for restricting inbound
IO operations over TCP #474
Improvements:
-------------
- Significant speed-up of zone contents modifications
- Avoided double zone signing during CSK rollovers
- Self-created RRSIGs are not cryptographically verified if not necessary
- Zone journal can store two changesets if zone file difference computing
and DNSSEC signing are enabled. The first one containing the difference of
zone history needed by slave servers, the second one containing the difference
between zone file and zone needed for server restart
- Universal and more robust memory clearing
- More precise socket timeout handling
- New notice log message for configuration changes requiring server restart
- Module RRL logs both trigger source address and affected subnet
- Various code (especially zone and TCP processing) and documentation improvements
Bugfixes:
---------
- RRSIGs are wrongly checked for inconsistent RRSet TTLs during zone update
- DS check/push warnings after disabled DNSSEC signing
- NSEC3 records not accessible through control interface
- Module geoip doesn't accept underscore character in dname specification #655
Compatibility:
--------------
- Removed runtime reconfiguration of network workers and interfaces since
it was imperfect and also couldn't work after dropped process privileges
- Removed inaccurate and misleading knotc command 'zone-memstats' because
memory consumption varies during zone modifications or transfers
- Removed useless 'zone.request-edns-option' configuration option
- Reimplemented DNS Cookies to be interoperable (based on draft-ietf-dnsop-server-cookies
and work by Witold Kręcicki)
- Default limit on TCP clients is auto-configured to one half of the file
descriptor limit for the server process
- Number of open files limit is set to 1048576 in upstream packages
- Default number of TCP workers is equal to the number of online CPUs or at least 10
- Default EDNS buffer size is 1232 for both IPv4 and IPv6
- Removed 'tcp-handshake-timeout' server configuration option
- Some configuration options were renamed and possibly moved. Old names will
be supported at least until next major release:
- 'server.tcp-reply-timeout' [s] to 'server.tcp-remote-io-timeout' [ms]
- 'server.max-tcp-clients' to 'server.tcp-max-clients'
- 'server.max-udp-payload' to 'server.udp-max-payload'
- 'server.max-ipv4-udp-payload' to 'server.udp-max-payload-ipv4'
- 'server.max-ipv6-udp-payload' to 'server.udp-max-payload-ipv6'
- 'template.journal-db' to 'database.journal-db'
- 'template.journal-db-mode' to 'database.journal-db-mode'
- 'template.max-journal-db-size' to 'database.journal-db-max-size'
- 'template.kasp-db' to 'database.kasp-db'
- 'template.max-kasp-db-size' to 'database.kasp-db-max-size'
- 'template.timer-db' to 'database.timer-db'
- 'template.max-timer-db-size' to 'database.timer-db-max-size'
- 'zone.max-journal-usage' to 'zone.journal-max-usage'
- 'zone.max-journal-depth' to 'zone.journal-max-depth'
- 'zone.max-zone-size' to 'zone.zone-max-size'
- 'zone.max-refresh-interval' to 'zone.refresh-max-interval'
- 'zone.min-refresh-interval' to 'zone.refresh-min-interval'
Knot DNS 2.8.4 (2019-09-24)
===========================
Features:
---------
- Automatic uploading of DS records to parent zone using DDNS,
see 'policy.ds-push' configuration option
Improvements:
-------------
- Incoming IXFR no longer falls back to AXFR if connection error #642
- More accurate semantic checks for missing glue records
- Various code and documentation improvements
Bugfixes:
---------
- Failed to read/export configuration if 'acl.update-type' is set #651
- Failed to generate initial zero-length salt
- Missing error log for invalid rrtype input to dynamic configuration #652
- Missing error log when AXFR processing fails to store zone data
- Redundant notice log about unavailable persistent configuration DB
- Zone not flushed after retransfer if SOA serial not changed
- Zone contents not properly fixed during zone transfers
- No changeset created for updated rrset's TTL if changed by RR addition
Changelog:
Features:
Added cert/key file configuration for TLS in kdig (Thanks to Alexander Schultz)
Improvements:
More verbose log message for offline-KSK signing
Module RRL logs affected source address subnet instead of only one source address
Extended DNSSEC policy configuration checks
Various improvements in the documentation
Bugfixes:
Excessive server load when maximum TCP clients limit is reached
Incorrect reply after zone update with a node changed from non-authoritative to delegation
Wrong error line number in a config file if it contains leading tab character
Config file error message contains unrelated parsing context
NSEC3 salt not updated when reconfigured to zero length
Kjournalprint sometimes prints a random value for per-zone occupation
Missing debug log for failed zone refresh triggered by zone notification
DS check not scheduled when reconfigured
Broken unit test on NetBSD 8.x
Changelog:
Knot DNS 2.8.2 (2019-06-05)
===========================
Features:
---------
- New blocking mode for zone event triggers in knotc
- New weighted records mode in the module geoip (Thanks to Conrad Hoffmann)
- Module noudp allows UDP allow rate configuration
Improvements:
-------------
- NSEC3 salt lifetime can be set to infinity
- New 'running' zone event status in the knotc output
- Knotc in the forced mode returns failure also if zone check emits any warning
- Ignoring PMTU information for IPv4/UDP via IP_PMTUDISC_OMIT (Thanks to Daisuke Higashi)
- Various improvements in the documentation
Bugfixes:
---------
- Broken setting of CPU affinity for UDP workers
- Unexpected results with the geoip subnet mode
- Sometimes insufficient zone adjusting
- Incoherent DNSKEY RRSIG lifetimes in SKR
- Confusing output from keymgr if an error occurs during KSR generation
- Non-functional changeset history depth limitation in kjournalprint
- Wrong processing of multiple $INCLUDE directives #646
Changelog:
Knot DNS 2.8.1 (2019-04-09)
===========================
Improvements:
-------------
- Possible zone transaction is aborted by zone events to avoid inconsistency
- Added log message if no persistent config DB is available during 'conf-begin'
- New environment setting 'KNOT_VERSION_FORMAT=release' for extended version suppression
- Various improvements in the documentation
Bugfixes:
---------
- Broken NSEC3-wildcard-nonexistence proof after NSEC3 re-salt
- Glue records under delegation are sometimes signed
- RRL doesn't work correctly on big-endian architectures
- NSEC3 not re-salted during AXFR refresh
- Failed to sign new zone contents if added dynamically #641
- NSEC3 opt-out signing doesn't work in some cases
- Broken NSEC3 chain after adding new sub-delegations
- Redundant SOA RRSIG on slave if RRSIG TTL changed on master
- Sometimes confusing log error message for NOTIFY event
- Improper include for LMDB #638
Knot DNS 2.8.0 (2019-03-05)
===========================
Features:
---------
- New offline-KSK mode of operation
- Configurable multithreaded DNSSEC signing for large zones
- Extended ACL configuration for dynamic updates
- New knotc trigger 'zone-key-rollover' for immediate DNSKEY rollover
- Added support for OPENPGPKEY, CSYNC, SMIMEA, and ZONEMD RR types
- New 'double-ds' option for CDS/CDNSKEY publication
Improvements:
-------------
- Significant speed-up of zone updates
- Knotc supports force option in the interactive mode
- Copy-on-write support for QP-trie (Thanks to Tony Finch)
- Unified and more efficient LMDB layer for journal, timer, and KASP databases
- DS check event is re-planned according to KASP even when purged timers
- Module DNS Cookies supports explicit Server Secret configuration
- Zone mtime is verified against full-precision timestamp (Thanks to Daniel Kahn Gillmor)
- Extended logging (loaded SOA serials, refresh duration, tiny cleanup)
- Relaxed fixed-length condition for DNSSEC key ID
- Extended semantic checks for DNAME and NS RR types
- Added support for FreeBSD's SO_REUSEPORT_LB
- Improved performance of geoip module
- Various improvements in the documentation
Compatibility:
--------------
- Changed configuration default for 'cds-cdnskey-publish' to 'rollover'
- Journal DB format changes are not downgrade-compatible
- Keymgr no longer prints DS for algorithm SHA-1
Changelog:
Knot DNS 2.7.6 (2019-01-23)
===========================
Improvements:
-------------
- Zone status also shows when the zone load is scheduled
- Server workers status also shows background workers utilization
- Default control timeout for knotc was increased to 10 seconds
- Pkg-config files contain auxiliary variable with library filename
Bugfixes:
---------
- Configuration commit or server reload can drop some pending zone events
- Nonempty zone journal is created even though it's disabled #635
- Zone is completely re-signed during empty dynamic update processing
- Server can crash when storing a big zone difference to the journal
- Failed to link on FreeBSD 12 with Clang
Knot DNS 2.7.5 (2019-01-07)
===========================
Features:
---------
- Keymgr supports NSEC3 salt handling
Improvements:
-------------
- Zone history in journal is dropped apon AXFR-like zone update
- Libdnssec is no longer linked against libm #628
- Libdnssec is explicitly linked against libpthread if PKCS #11 enabled #629
- Better support for libknot packaging in Python
- Manually generated KSK is 'ready' by default
- Kdig supports '+timeout' as an alias for '+time'
- Kdig supports '+nocomments' option
- Kdig no longer prints empty lines between retries
- Kdig returns failure if operations not successfully resolved#632
- Fixed repeating of the 'KSK submission, waiting for confirmation' log
- Various improvements in documentation, Dockerfile, and tests
Bugfixes:
---------
- Knotc fails to unset huge configuration section
- Kjournalprint sometimes fails to display zone journal content
- Improper timing of ZSK removal during ZSK rollover
- Missing UTC time zone indication in the 'iso' keymgr list output
- A race condition in the online signing module
Knot DNS 2.7.4 (2018-11-13)
===========================
Features:
---------
- Added SNI configuration for TLS in kdig (Thanks to Alexander Schultz)
Improvements:
-------------
- Added warning log when DNSSEC events not successfully scheduled
- New semantic check on timer values in keymgr
- DS query no longer asks other addresses if got a negative answer
- Reintroduced 'rollover' configuration option for CDS/CDNSKEY publication
- Extended logging for zone loading
- Various documentation improvements
Bugfixes:
---------
- Failed to import module configuration #613
- Improper Cflags value in libknot.pc if built with embedded LMDB #615
- IXFR doesn't fall back to AXFR if malformed reply
- DNSSEC events not correctly scheduled for empty zone updates
- During algorithm rollover old keys get removed before DS TTL expires #617
- Maximum zone's RRSIG TTL not considered during algorithm rollover #620
Knot DNS 2.7.3 (2018-10-11)
===========================
Features:
---------
- New queryacl module for query access control
- Configurable answer rrset rotation #612
- Configurable NSEC bitmap in online signing
Improvements:
-------------
- Better error logging for KASP DB operations #601
- Some documentation improvements
Bugfixes:
---------
- Keymgr "list" output doesn't show key size for ECDSA algorithms #602
- Failed to link statically with embedded LMDB
- Configuration commit causes zone reload for all zones
- The statistics module overlooks TSIG record in a request
- Improper processing of an AXFR-style-IXFR response consisting of one-record messages
- Race condition in online signing during key rollover #600
- Server can crash if geoip module is enabled in the geo mode
Knot DNS 2.7.2 (2018-08-29)
===========================
Improvements:
-------------
- Keymgr list command displays also key size
- Kjournalprint displays total occupied size in the debug mode
- Server doesn't stop if failed to load a shared module from the module directory
- Libraries libcap-ng, pthread, and dl are linked selectively if needed
Bugfixes:
---------
- Sometimes incorrect result from dnssec_nsec_bitmap_contains (libdnssec)
- Server can crash when loading zone file difference and zone-in-journal is set
- Incorrect treatment of specific queries in the module RRL
- Failed to link module Cookies as a shared library
Knot DNS 2.7.1 (2018-08-14)
===========================
Improvements:
-------------
- Added zone wire size information to zone loading log message
- Added debug log message for each unsuccessful remote address operation
- Various improvements for packaging
Bugfixes:
---------
- Incompatible handling of RRSIG TTL value when creating a DNS message
- Incorrect RRSIG TTL value in zone differences and knotc zone operation outputs
- Default configure prefix is ignored
Knot DNS 2.7.0 (2018-08-03)
===========================
Features:
---------
- New DNS Cookies module and related '+cookie' kdig option
- New module for response tailoring according to client's subnet or geographic location
- General EDNS Client Subnet support in the server
- OSS-Fuzz integration (Thanks to Jonathan Foote)
- New '+ednsopt' kdig option (Thanks to Jan Včelák)
- Online Signing support for automatic key rollover
- Non-normal file (e.g. pipe) loading support in zscanner #542
- Automatic SOA serial incrementation if non-empty zone difference
- New zone file load option for ignoring zone file's SOA serial
- New build-time option for alternative malloc specification
- Structured logging for DNSSEC key submission event
- Empty QNAME support in kdig
Improvements:
-------------
- Various library and server optimizations
- Reduced memory consumption of outgoing IXFR processing
- Linux capabilities use overhaul #546 (Thanks to Robert Edmonds)
- Online Signing properly signs delegations and CNAME records
- CDS/CDNSKEY rrset is signed with KSK instead of ZSK
- DNSSEC-related records are ignored when loading zone difference with signing enabled
- Minimum allowed RSA key length was increased to 1024
- Removed explicit dependency on Nettle
Bugfixes:
---------
- Possible uninitialized address buffer use in zscanner
- Possible index overflow during multiline record parsing in zscanner
- kdig +tls sometimes consumes 100 % CPU #561
- Single-Type Signing doesn't work with single ZSK key #566
- Zone not flushed after re-signing during zone load #594
- Server crashes when committing empty zone transaction
- Incoming IXFR with on-slave signing sometimes leads to memory corruption #595
Compatibility:
--------------
- Removed obsolete RRL configuration
- Removed obsolete module names 'mod-online-sign' and 'mod-synth-record'
- Removed obsolete 'ixfr-from-differences' configuration option
- Removed old journal migration
- Removed module rosedb
Knot DNS 2.6.9 (2018-08-14)
===========================
Improvements:
-------------
- Added zone wire size to zone loading log message
- Added debug log message for each unsuccessful remote address operation
Bugfixes:
---------
- Zone not flushed after re-signing during zone load #594
- Server crashes when committing empty zone transaction
- Incoming IXFR with on-slave signing sometimes leads to memory corruption #595
Knot DNS 2.6.8 (2018-07-10)
===========================
Features:
---------
- New 'import-pkcs11' command in keymgr
Improvements:
-------------
- Unixtime serial policy mimics Bind – increment if lower #593
Bugfixes:
---------
- Creeping memory consuption upon server reload #584
- Kdig incorrectly detects QNAME if 'notify' is a prefix
- Server crashes when zone sign fails #587
- CSK->KZSK rollover retires CSK early #588
- Server crashes when zone expires during outgoing multi-message transfer
- Kjournalprint doesn't convert zone name argument to lower-case
- Cannot switch to a previously used ksk-shared dnssec policy #589
Knot DNS 2.6.7 (2018-05-17)
===========================
Features:
---------
- Added 'dateserial' (YYYYMMDDnn) serial policy configuration (Thanks to Wolfgang Jung)
Improvements:
-------------
- Trailing data indication from the packet parser (libknot)
- Better configuration check for a problematical option combination
Bugfixes:
---------
- Incomplete configuration option item name check
- Possible buffer overflow in 'knot_dname_to_str' (libknot)
- Module dnsproxy doesn't preserve letter case of QNAME
- Module dnsproxy duplicates OPT and TSIG in the non-fallback mode
Knot DNS 2.6.6 (2018-04-11)
===========================
Features:
---------
- New EDNS option counters in the statistics module
- New '+orphan' filter for the 'zone-purge' operation
Improvements:
-------------
- Reduced memory consuption of disabled statistics metrics
- Some spelling fixes (Thanks to Daniel Kahn Gillmor)
- Server no longer fails to start if MODULE_DIR doesn't exist
- Configuration include doesn't fail if empty wildcard match
- Added a configuration check for a problematical option combination
Bugfixes:
---------
- NSEC3 chain not re-created when SOA minimum TTL changed
- Failed to start server if no template is configured
- Possibly incorrect SOA serial upon changed zone reload with DNSSEC signing
- Inaccurate outgoing zone transfer size in the log message
- Invalid dname compression if empty question section
- Missing EDNS in EMALF responses
Knot DNS 2.6.5 (2018-02-12)
===========================
Features:
---------
- New 'zone-notify' command in knotc
- Kdig uses '@server' as a hostname for TLS authenticaion if '+tls-ca' is set
Improvements:
-------------
- Better heap memory trimming for zone operations
- Added proper polling for TLS operations in kdig
- Configuration export uses stdout as a default output
- Simplified detection of atomic operations
- Added '--disable-modules' configure option
- Small documentation updates
Bugfixes:
---------
- Zone retransfer doesn't work well if more masters configured
- Kdig can leak or double free memory in corner cases
- Inconsistent error outputs from dynamic configuration operations
- Failed to generate documentation on OpenBSD
Knot DNS 2.6.4 (2018-01-02)
===========================
Features:
---------
- Module synthrecord allows multiple 'network' specification
- New CSK handling support in keymgr
Improvements:
-------------
- Allowed configuration for infinite zsk lifetime
- Increased performance and security of the module synthrecord
- Signing changeset is stored into journal even if 'zonefile-load' is whole
Bugfixes:
---------
- Unintentional zone re-sign during reload if empty NSEC3 salt
- Inconsistent zone names in journald structured logs
- Malformed outgoing transfer for big zone with TSIG
- Some minor DNSSEC-related issues
Knot DNS 2.6.3 (2017-11-24)
===========================
Bugfixes:
---------
- Wrong detection of signing scheme rollover
Knot DNS 2.6.2 (2017-11-23)
===========================
Features:
---------
- CSK algorithm rollover and (KSK, ZSK) <-> CSK rollover support
Improvements:
-------------
- Allowed explicit configuration for infinite ksk lifetime
- Proper error messages instead of unclear error codes in server log
- Better support for old compilers
Bugfixes:
---------
- Unexpected reply for DS query with an owner below a delegation point
- Old dependencies in the pkg-config file
Knot DNS 2.6.1 (2017-11-02)
===========================
Features:
---------
- NSEC3 Opt-Out support in the DNSSEC signing
- New CDS/CDNSKEY publish configuration option
Improvements:
-------------
- Simplified DNSSEC log message with DNSKEY details
- +tls-hostname in kdig implies +tls-ca if neither +tls-ca nor +tls-pin is given
- New documentation sections for DNSSEC key rollovers and shared keys
- Keymgr no longer prints useless algorithm number for generated key
- Kdig prints unknown RCODE in a numeric format
- Better support for LLVM libFuzzer
Bugfixes:
---------
- Faulty DNAME semantic check if present in the zone apex and NSEC3 is used
- Immediate zone flush not scheduled during the zone load event
- Server crashes upon dynamic zone addition if a query module is loaded
- Kdig fails to connect over TLS due to SNI is set to server IP address
- Possible out-of-bounds memory access at the end of the input
- TCP Fast Open enabled by default in kdig breaks TLS connection
Knot DNS 2.6.0 (2017-09-29)
===========================
Features:
---------
- On-slave (inline) signing support
- Automatic DNSSEC key algorithm rollover
- Ed25519 algorithm support in DNSSEC (requires GnuTLS 3.6.0)
- New 'journal-content' and 'zonefile-load' configuration options
- keymgr tries to run as user/group set in the configuration
- Public-only DNSSEC key import into KASP DB via keymgr
- NSEC3 resalt and parent DS query events are persistent in timer DB
- New processing state for a response suppression within a query module
- Enabled server side TCP Fast Open if supported
- TCP Fast Open support in kdig
Improvements:
-------------
- Better record owner compression if related to the previous rdata dname
- NSEC(3) chain is no longer recomputed whole on every update
- Remove inconsistent and unnecessary quoting in log files
- Avoiding of overlapping key rollovers at a time
- More DNSSSEC-related semantic checks
- Extended timestamp format in keymgr
Bugfixes:
---------
- Incorrect journal free space computation causing inefficient space handling
- Interface-automatic broken on Linux in the presence of asymmetric routing
Performing substitutions during post-patch breaks tools such as mkpatches,
making it very difficult to regenerate correct patches after making changes,
and often leading to substituted string replacements being committed.
===========================
Bugfixes:
---------
- Unintentional zone re-sign during reload if empty NSEC3 salt
- Inconsistent zone names in journald structured logs
- Malformed outgoing transfer for big zone with TSIG
- Unexpected reply for DS query with an owner below a delegation point
- Old dependencies in the pkg-config file
[...]
Only new Features & Security fixes of the previous updates are shown below
For a complete of all Improvements & Bugfixes, see:
https://gitlab.labs.nic.cz/knot/knot-dns/blob/2.5/NEWS
Knot DNS 2.5.3 (2017-07-14)
===========================
Features:
---------
- CSK rollover support for Single-Type Signing Scheme
[...]
Knot DNS 2.5.2 (2017-06-23)
===========================
Security:
---------
- CVE-2017-11104: Improper TSIG validity period check can allow TSIG forgery (Thanks to Synacktiv!)
Knot DNS 2.5.0 (2017-06-05)
===========================
Features:
---------
- KASP database switched from JSON files to LMDB database
- KSK rollover support using CDNSKEY and CDS in the automatic DNSSEC signing
- Dynamic module loading support with proper module API
- Journal can store full zone contents (not only differences)
- Zone freeze/thaw support
- Updated knotc zone-status output with optional column filters
- New '[no]crypto' option in kdig
- New keymgr implementation reflecting KASP database changes
- New pykeymgr for JSON-based KASP database migration
- Removed obsolete knot1to2 utility
===========================
Security:
---------
- Improper TSIG validity period check can allow TSIG forgery (Thanks to Synacktiv!)
Bugfixes:
---------
- Corner case journal fixes (huge changesets, OpenWRT operation)
Knot DNS 2.4.4 (2017-06-05)
===========================
Improvements:
-------------
- Improved error handling in kjournalprint
Bugfixes:
---------
- Zone flush not replanned upon unsuccessful flush
- Journal inconsistency after deleting deleted zone
- Zone events not rescheduled upon server reload (Thanks to Mark Warren)
- Unreliable LMDB mapsize detection in kjournalprint
- Some minor issues found by AddressSanitizer
Knot DNS 2.4.3 (2017-04-11)
===========================
Improvements:
-------------
- New 'journal-db-mode' optimization configuration option
- The default TSIG algorithm for utilities input is HMAC-SHA256
- Implemented sensible default EDNS(0) padding policy (Thanks to D. K. Gillmor)
- Added some more semantic checks on the knotc configuration operations
Bugfixes:
---------
- Missing 'zone' keyword in the YAML output
- Missing trailing dot in the keymgr DS owner output
- Journal logs 'invalid parameter' in several cases
- Some minor journal-related problems
Knot DNS 2.4.2 (2017-03-23)
===========================
Features:
---------
- Zscanner can store record comments placed on the same line
- Knotc status extension with version, configure, and workers parameters
Improvements:
-------------
- Significant incoming XFR speed-up in the case of many zones
Bugfixes:
---------
- Double OPT RR insertion when a global module returns KNOT_STATE_FAIL
- User-driven zscanner parsing logic inconsistency
- Lower serial at master doesn't trigger any errors
- Queries with too long DNAME substitution do not return YXDOMAIN response
- Incorrect elapsed time in the DDNS log
- Failed to process forwarded DDNS request with TSIG
Knot DNS 2.4.1 (2017-02-10)
===========================
Improvements:
-------------
- Speed-up of rdata addition into a huge rrset
- Introduce check of minumum timeout for next refresh
- Dnsproxy module can forward all queries without local resolving
Bugfixes:
--------
- Transfer of a huge rrset goes into an infinite loop
- Huge response over TCP contains useless TC bit instead of SERVFAIL
- Failed to build utilities with disabled daemon
- Memory leaks during keys removal
- Rough TSIG packet reservation causes early truncation
- Minor out-of-bounds string termination write in rrset dump
- Server crash during stop if failed to open timers DB
- Failed to compile on OS X older than Sierra
- Poor minimum UDP-max-size configuration check
- Failed to receive one-record-per-message IXFR-style AXFR
- Kdig timeouts when receiving RCODE != NOERROR on subsequent transfer message
Knot DNS 2.4.0 (2017-01-18)
===========================
- Kdig timeouts when receiving RCODE != NOERROR on subsequent transfer message
Knot DNS 2.4.0 (2017-01-18)
===========================
Bugfixes:
--------
- False positive semantic-check warning about invalid bitmap in NSEC
- Unnecessary SOA queries upon notify with up to date serial
- Timers for expired zones are reset on reload
- Zone doesn't expire when the server is down
- Failed to handle keys with duplicate keytags
- Per zone module and global module insconsistency
- Obsolete online signing module configuration
- Malformed output from kjournalprint
- Redundant SO_REUSEPORT activation on the TCP socket
- Failed to use higher number of background workers
Improvements:
-------------
- Lower memory consumption with qp-trie
- Zone events and zone timers improvements
- Print all zone names in the FQDN format
- Simplified query module interface
- Shared TCP connection between SOA query and transfer
- Response Rate Limiting as a module with statistics support
- Key filters in keymgr
Features:
---------
- New unified LMDB-based zone journal
- Server statistics support
- New statistics module for traffic measuring
- Automatic deletion of retired DNSSEC keys
- New control logging category
Set PKG_SYSCONFSUBDIR to "knot" to have all of the config files
located in the "knot" subdirectory of ${PKG_SYSCONFBASE}.
Pass ${PKG_SYSCONFBASE} to the configure script since the package's
build infrastructure automatically appends "/knot" to the value
passed in through --sysconfdir.
Remove ${PKG_SYSCONFDIR} from INSTALLATION_DIRS since it is
automatically created by the package install script.
Bump the PKGREVISION due to changes in the package install scripts.
===========================
Bugfixes:
---------
- Double free when failed to apply zone journal
- Zone bootstrap retry interval not preserved upon zone reload
- DNSSEC related records not flushed if not signed
- False semantic checks warning about incorrect type in NSEC bitmap
- Memory leak in kzonecheck
Improvements:
-------------
- All zone names are fully-qualified in log
Features:
---------
- New kjournalprint utility
Knot DNS 2.3.2 (2016-11-04)
===========================
Bugfixes:
---------
- Incorrect %s expansion for the root zone
- Failed to refresh not existing slave zone after restart
- Immediate zone refresh upon restart if refresh already scheduled
- Early zone transfer after restart if transfer already scheduled
- Not ignoring empty non-terminal parents during delegation lookup
- CD bit preservation in responses
- Compilation error on GNU/kFreeBSD
- Server crash after double zone-commit if journal error
Improvements:
-------------
- Speed-up of knotc if control operation and known socket
- Zone purge operation purges also zone timers
Features:
---------
- Simple modules don't require empty configuration section
- New zone journal path configuration option
- New timeout configuration option for module dnsproxy
===========================
Bugfixes:
---------
- Missing glue records in some responses
- Knsupdate prompt printing on non-terminal
- Mismatch between configuration policy item names and documentation
- Segfault on OS X (Sierra)
Improvements:
-------------
- Significant speed-up of conf-commit and conf-diff operations (in most cases)
- New EDNS Client Subnet libknot API
- Better semantic-checks error messages
Features:
---------
- Print TLS certificate hierarchy in kdig verbose mode
- New +subnet alias for +client
- New mod-whoami and mod-noudp modules
- New zone-purge control command
- New log-queries and log-responses options for mod-dnstap
===========================
Bugfixes:
---------
- No wildcard expansion below empty non-terminal for NSEC signed zone
- Avoid multiple loads of the same PKCS #11 module
- Fix kdig IXFR response processing if the transfer content is empty
- Don't ignore non-existing records to be removed in IXFR
Improvements:
-------------
- Refactored semantic checks and improved error messages
- Set TC flag in delegation only if mandatory glue doesn't fit the response
- Separate EDNS(0) payload size configuration for IPv4 and IPv6
Features:
---------
- DNSSEC policy can be defined in server configuration
- Automatic NSEC3 resalt according to DNSSEC policy
- Zone content editing using control interface
- Zone size limit restriction for DDNS, AXFR, and IXFR (CVE-2016-6171)
- DNS-over-TLS support in kdig (RFC 7858)
- EDNS(0) padding and alignment support in kdig (RFC 7830)
===========================
Bugfixes:
---------
- Fix separate logging of server and zone events
- Fix concurrent zone file flushing with many zones
- Fix possible server crash with empty hostname on OpenWRT
- Fix control timeout parsing in knotc
- Fix "Environment maxreaders limit reached" error in knotc
- Don't apply journal changes on modified zone file
- Remove broken LTO option from configure script
- Enable multiple zone names completion in interactive knotc
- Set the TC flag in a response if a glue doesn't fit the response
- Disallow server reload when there is an active configuration transaction
Improvements:
-------------
- Distinguish unavailable zones from zones with zero serial in log messages
- Log warning and error messages to standard error output in all utilities
- Document tested PKCS #11 devices
- Extended Python configuration interface
Knot DNS 2.2.0 (2016-04-26)
===========================
Bugfixes:
---------
- Fix build dependencies on FreeBSD
- Fix query/response message type setting in dnstap module
- Fix remote address retrieval from dnstap capture in kdig
- Fix global modules execution for queries hitting existing zones
- Fix execution of semantic checks after an IXFR transfer
- Fix PKCS#11 support detection at build time
- Fix kdig failure when the first AXFR message contains just the SOA record
- Exclude non-authoritative types from NSEC/NSEC3 bitmap at a delegation
- Mark PKCS#11 generated keys as sensitive (required by Luna SA)
- Fix error when removing the only zone from the server
- Don't abort knotc transaction when some check fails
Features:
---------
- URI and CAA resource record types support
- RRL client address based white list
- knotc interactive mode
Improvements:
-------------
- Consistent IXFR error messages
- Various fixes for better compatibility with PKCS#11 devices
- Various keymgr user interface improvements
- Better zone event scheduler performance with many zones
- New server control interface
- kdig uses local resolver if resolv.conf is empty
===========================
Bugfixes:
---------
- DNSSEC: Allow import of duplicate private key into the KASP
- DNSSEC: Avoid duplicate NSEC for Wildcard No Data answer
- Fix server crash when an incomming transfer is in progress and reload is issued
- Fix socket polling when configured with many interfaces and threads
- Fix compilation against Nettle 3.2
Improvements:
-------------
- Select correct source address for UDP messages recieved on ANY address
- Extend documentation of knotc commands
Knot DNS 2.1.0 (2016-01-14)
===========================
Features:
---------
- Per-thread UDP socket binding using SO_REUSEPORT on Linux
- Support for dynamic configuration database
- DNSSEC: Support for cryptographic tokens via PKCS #11 interface
- DNSSEC: Experimental support for online signing
Improvements:
-------------
- Support for zone file name patterns
- Configurable location of zone timer database
- Non-blocking network operations and better timeout handling
- Caching of Critical configuration values for better performance
- Logging of ACL failures
- RRL: Add rate-limit-slip zero support to drop all responses
- RRL: Document behavior for different rate-limit-slip options
- kdig: Warning instead of error on TSIG validation failure
- Cleanup of support libraries interfaces (libknot, libzscanner, libdnssec)
- Remove possibly insecure server control over a network socket
- Remove implementation limit for the number of network interfaces
Bugfixes:
---------
- synth-record module: Fix application of default configuration options
- TSIG: Allow compressed TSIG name when forwarding DDNS updates
- Schedule zone bootstrap after slave zone fails to load from disk
