pkgsrc-Changes archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
CVS commit: pkgsrc/net/knot
Module Name: pkgsrc
Committed By: ryoon
Date: Tue Jan 29 15:07:25 UTC 2019
Modified Files:
pkgsrc/net/knot: Makefile PLIST distinfo
Log Message:
Update to 2.7.6
Changelog:
Knot DNS 2.7.6 (2019-01-23)
===========================
Improvements:
-------------
- Zone status also shows when the zone load is scheduled
- Server workers status also shows background workers utilization
- Default control timeout for knotc was increased to 10 seconds
- Pkg-config files contain auxiliary variable with library filename
Bugfixes:
---------
- Configuration commit or server reload can drop some pending zone events
- Nonempty zone journal is created even though it's disabled #635
- Zone is completely re-signed during empty dynamic update processing
- Server can crash when storing a big zone difference to the journal
- Failed to link on FreeBSD 12 with Clang
Knot DNS 2.7.5 (2019-01-07)
===========================
Features:
---------
- Keymgr supports NSEC3 salt handling
Improvements:
-------------
- Zone history in journal is dropped apon AXFR-like zone update
- Libdnssec is no longer linked against libm #628
- Libdnssec is explicitly linked against libpthread if PKCS #11 enabled #629
- Better support for libknot packaging in Python
- Manually generated KSK is 'ready' by default
- Kdig supports '+timeout' as an alias for '+time'
- Kdig supports '+nocomments' option
- Kdig no longer prints empty lines between retries
- Kdig returns failure if operations not successfully resolved #632
- Fixed repeating of the 'KSK submission, waiting for confirmation' log
- Various improvements in documentation, Dockerfile, and tests
Bugfixes:
---------
- Knotc fails to unset huge configuration section
- Kjournalprint sometimes fails to display zone journal content
- Improper timing of ZSK removal during ZSK rollover
- Missing UTC time zone indication in the 'iso' keymgr list output
- A race condition in the online signing module
Knot DNS 2.7.4 (2018-11-13)
===========================
Features:
---------
- Added SNI configuration for TLS in kdig (Thanks to Alexander Schultz)
Improvements:
-------------
- Added warning log when DNSSEC events not successfully scheduled
- New semantic check on timer values in keymgr
- DS query no longer asks other addresses if got a negative answer
- Reintroduced 'rollover' configuration option for CDS/CDNSKEY publication
- Extended logging for zone loading
- Various documentation improvements
Bugfixes:
---------
- Failed to import module configuration #613
- Improper Cflags value in libknot.pc if built with embedded LMDB #615
- IXFR doesn't fall back to AXFR if malformed reply
- DNSSEC events not correctly scheduled for empty zone updates
- During algorithm rollover old keys get removed before DS TTL expires #617
- Maximum zone's RRSIG TTL not considered during algorithm rollover #620
Knot DNS 2.7.3 (2018-10-11)
===========================
Features:
---------
- New queryacl module for query access control
- Configurable answer rrset rotation #612
- Configurable NSEC bitmap in online signing
Improvements:
-------------
- Better error logging for KASP DB operations #601
- Some documentation improvements
Bugfixes:
---------
- Keymgr "list" output doesn't show key size for ECDSA algorithms #602
- Failed to link statically with embedded LMDB
- Configuration commit causes zone reload for all zones
- The statistics module overlooks TSIG record in a request
- Improper processing of an AXFR-style-IXFR response consisting of one-record messages
- Race condition in online signing during key rollover #600
- Server can crash if geoip module is enabled in the geo mode
Knot DNS 2.7.2 (2018-08-29)
===========================
Improvements:
-------------
- Keymgr list command displays also key size
- Kjournalprint displays total occupied size in the debug mode
- Server doesn't stop if failed to load a shared module from the module directory
- Libraries libcap-ng, pthread, and dl are linked selectively if needed
Bugfixes:
---------
- Sometimes incorrect result from dnssec_nsec_bitmap_contains (libdnssec)
- Server can crash when loading zone file difference and zone-in-journal is set
- Incorrect treatment of specific queries in the module RRL
- Failed to link module Cookies as a shared library
Knot DNS 2.7.1 (2018-08-14)
===========================
Improvements:
-------------
- Added zone wire size information to zone loading log message
- Added debug log message for each unsuccessful remote address operation
- Various improvements for packaging
Bugfixes:
---------
- Incompatible handling of RRSIG TTL value when creating a DNS message
- Incorrect RRSIG TTL value in zone differences and knotc zone operation outputs
- Default configure prefix is ignored
Knot DNS 2.7.0 (2018-08-03)
===========================
Features:
---------
- New DNS Cookies module and related '+cookie' kdig option
- New module for response tailoring according to client's subnet or geographic location
- General EDNS Client Subnet support in the server
- OSS-Fuzz integration (Thanks to Jonathan Foote)
- New '+ednsopt' kdig option (Thanks to Jan Včelák)
- Online Signing support for automatic key rollover
- Non-normal file (e.g. pipe) loading support in zscanner #542
- Automatic SOA serial incrementation if non-empty zone difference
- New zone file load option for ignoring zone file's SOA serial
- New build-time option for alternative malloc specification
- Structured logging for DNSSEC key submission event
- Empty QNAME support in kdig
Improvements:
-------------
- Various library and server optimizations
- Reduced memory consumption of outgoing IXFR processing
- Linux capabilities use overhaul #546 (Thanks to Robert Edmonds)
- Online Signing properly signs delegations and CNAME records
- CDS/CDNSKEY rrset is signed with KSK instead of ZSK
- DNSSEC-related records are ignored when loading zone difference with signing enabled
- Minimum allowed RSA key length was increased to 1024
- Removed explicit dependency on Nettle
Bugfixes:
---------
- Possible uninitialized address buffer use in zscanner
- Possible index overflow during multiline record parsing in zscanner
- kdig +tls sometimes consumes 100 % CPU #561
- Single-Type Signing doesn't work with single ZSK key #566
- Zone not flushed after re-signing during zone load #594
- Server crashes when committing empty zone transaction
- Incoming IXFR with on-slave signing sometimes leads to memory corruption #595
Compatibility:
--------------
- Removed obsolete RRL configuration
- Removed obsolete module names 'mod-online-sign' and 'mod-synth-record'
- Removed obsolete 'ixfr-from-differences' configuration option
- Removed old journal migration
- Removed module rosedb
Knot DNS 2.6.9 (2018-08-14)
===========================
Improvements:
-------------
- Added zone wire size to zone loading log message
- Added debug log message for each unsuccessful remote address operation
Bugfixes:
---------
- Zone not flushed after re-signing during zone load #594
- Server crashes when committing empty zone transaction
- Incoming IXFR with on-slave signing sometimes leads to memory corruption #595
Knot DNS 2.6.8 (2018-07-10)
===========================
Features:
---------
- New 'import-pkcs11' command in keymgr
Improvements:
-------------
- Unixtime serial policy mimics Bind – increment if lower #593
Bugfixes:
---------
- Creeping memory consuption upon server reload #584
- Kdig incorrectly detects QNAME if 'notify' is a prefix
- Server crashes when zone sign fails #587
- CSK->KZSK rollover retires CSK early #588
- Server crashes when zone expires during outgoing multi-message transfer
- Kjournalprint doesn't convert zone name argument to lower-case
- Cannot switch to a previously used ksk-shared dnssec policy #589
Knot DNS 2.6.7 (2018-05-17)
===========================
Features:
---------
- Added 'dateserial' (YYYYMMDDnn) serial policy configuration (Thanks to Wolfgang Jung)
Improvements:
-------------
- Trailing data indication from the packet parser (libknot)
- Better configuration check for a problematical option combination
Bugfixes:
---------
- Incomplete configuration option item name check
- Possible buffer overflow in 'knot_dname_to_str' (libknot)
- Module dnsproxy doesn't preserve letter case of QNAME
- Module dnsproxy duplicates OPT and TSIG in the non-fallback mode
Knot DNS 2.6.6 (2018-04-11)
===========================
Features:
---------
- New EDNS option counters in the statistics module
- New '+orphan' filter for the 'zone-purge' operation
Improvements:
-------------
- Reduced memory consuption of disabled statistics metrics
- Some spelling fixes (Thanks to Daniel Kahn Gillmor)
- Server no longer fails to start if MODULE_DIR doesn't exist
- Configuration include doesn't fail if empty wildcard match
- Added a configuration check for a problematical option combination
Bugfixes:
---------
- NSEC3 chain not re-created when SOA minimum TTL changed
- Failed to start server if no template is configured
- Possibly incorrect SOA serial upon changed zone reload with DNSSEC signing
- Inaccurate outgoing zone transfer size in the log message
- Invalid dname compression if empty question section
- Missing EDNS in EMALF responses
Knot DNS 2.6.5 (2018-02-12)
===========================
Features:
---------
- New 'zone-notify' command in knotc
- Kdig uses '@server' as a hostname for TLS authenticaion if '+tls-ca' is set
Improvements:
-------------
- Better heap memory trimming for zone operations
- Added proper polling for TLS operations in kdig
- Configuration export uses stdout as a default output
- Simplified detection of atomic operations
- Added '--disable-modules' configure option
- Small documentation updates
Bugfixes:
---------
- Zone retransfer doesn't work well if more masters configured
- Kdig can leak or double free memory in corner cases
- Inconsistent error outputs from dynamic configuration operations
- Failed to generate documentation on OpenBSD
Knot DNS 2.6.4 (2018-01-02)
===========================
Features:
---------
- Module synthrecord allows multiple 'network' specification
- New CSK handling support in keymgr
Improvements:
-------------
- Allowed configuration for infinite zsk lifetime
- Increased performance and security of the module synthrecord
- Signing changeset is stored into journal even if 'zonefile-load' is whole
Bugfixes:
---------
- Unintentional zone re-sign during reload if empty NSEC3 salt
- Inconsistent zone names in journald structured logs
- Malformed outgoing transfer for big zone with TSIG
- Some minor DNSSEC-related issues
Knot DNS 2.6.3 (2017-11-24)
===========================
Bugfixes:
---------
- Wrong detection of signing scheme rollover
Knot DNS 2.6.2 (2017-11-23)
===========================
Features:
---------
- CSK algorithm rollover and (KSK, ZSK) <-> CSK rollover support
Improvements:
-------------
- Allowed explicit configuration for infinite ksk lifetime
- Proper error messages instead of unclear error codes in server log
- Better support for old compilers
Bugfixes:
---------
- Unexpected reply for DS query with an owner below a delegation point
- Old dependencies in the pkg-config file
Knot DNS 2.6.1 (2017-11-02)
===========================
Features:
---------
- NSEC3 Opt-Out support in the DNSSEC signing
- New CDS/CDNSKEY publish configuration option
Improvements:
-------------
- Simplified DNSSEC log message with DNSKEY details
- +tls-hostname in kdig implies +tls-ca if neither +tls-ca nor +tls-pin is given
- New documentation sections for DNSSEC key rollovers and shared keys
- Keymgr no longer prints useless algorithm number for generated key
- Kdig prints unknown RCODE in a numeric format
- Better support for LLVM libFuzzer
Bugfixes:
---------
- Faulty DNAME semantic check if present in the zone apex and NSEC3 is used
- Immediate zone flush not scheduled during the zone load event
- Server crashes upon dynamic zone addition if a query module is loaded
- Kdig fails to connect over TLS due to SNI is set to server IP address
- Possible out-of-bounds memory access at the end of the input
- TCP Fast Open enabled by default in kdig breaks TLS connection
Knot DNS 2.6.0 (2017-09-29)
===========================
Features:
---------
- On-slave (inline) signing support
- Automatic DNSSEC key algorithm rollover
- Ed25519 algorithm support in DNSSEC (requires GnuTLS 3.6.0)
- New 'journal-content' and 'zonefile-load' configuration options
- keymgr tries to run as user/group set in the configuration
- Public-only DNSSEC key import into KASP DB via keymgr
- NSEC3 resalt and parent DS query events are persistent in timer DB
- New processing state for a response suppression within a query module
- Enabled server side TCP Fast Open if supported
- TCP Fast Open support in kdig
Improvements:
-------------
- Better record owner compression if related to the previous rdata dname
- NSEC(3) chain is no longer recomputed whole on every update
- Remove inconsistent and unnecessary quoting in log files
- Avoiding of overlapping key rollovers at a time
- More DNSSSEC-related semantic checks
- Extended timestamp format in keymgr
Bugfixes:
---------
- Incorrect journal free space computation causing inefficient space handling
- Interface-automatic broken on Linux in the presence of asymmetric routing
To generate a diff of this commit:
cvs rdiff -u -r1.40 -r1.41 pkgsrc/net/knot/Makefile
cvs rdiff -u -r1.14 -r1.15 pkgsrc/net/knot/PLIST
cvs rdiff -u -r1.24 -r1.25 pkgsrc/net/knot/distinfo
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: pkgsrc/net/knot/Makefile
diff -u pkgsrc/net/knot/Makefile:1.40 pkgsrc/net/knot/Makefile:1.41
--- pkgsrc/net/knot/Makefile:1.40 Wed Jul 4 13:40:28 2018
+++ pkgsrc/net/knot/Makefile Tue Jan 29 15:07:24 2019
@@ -1,7 +1,6 @@
-# $NetBSD: Makefile,v 1.40 2018/07/04 13:40:28 jperkin Exp $
+# $NetBSD: Makefile,v 1.41 2019/01/29 15:07:24 ryoon Exp $
-DISTNAME= knot-2.5.7
-PKGREVISION= 1
+DISTNAME= knot-2.7.6
CATEGORIES= net
MASTER_SITES= https://secure.nic.cz/files/knot-dns/
EXTRACT_SUFX= .tar.xz
Index: pkgsrc/net/knot/PLIST
diff -u pkgsrc/net/knot/PLIST:1.14 pkgsrc/net/knot/PLIST:1.15
--- pkgsrc/net/knot/PLIST:1.14 Thu Mar 8 14:30:37 2018
+++ pkgsrc/net/knot/PLIST Tue Jan 29 15:07:24 2019
@@ -1,38 +1,35 @@
-@comment $NetBSD: PLIST,v 1.14 2018/03/08 14:30:37 pettai Exp $
+@comment $NetBSD: PLIST,v 1.15 2019/01/29 15:07:24 ryoon Exp $
bin/kdig
bin/khost
-bin/kjournalprint
bin/knsec3hash
bin/knsupdate
bin/kzonecheck
-include/dnssec/binary.h
-include/dnssec/crypto.h
-include/dnssec/dnssec.h
-include/dnssec/error.h
-include/dnssec/key.h
-include/dnssec/keyid.h
-include/dnssec/keystore.h
-include/dnssec/keytag.h
-include/dnssec/list.h
-include/dnssec/nsec.h
-include/dnssec/random.h
-include/dnssec/sign.h
-include/dnssec/tsig.h
-include/dnssec/version.h
include/knot/module.h
+include/libdnssec/binary.h
+include/libdnssec/crypto.h
+include/libdnssec/dnssec.h
+include/libdnssec/error.h
+include/libdnssec/key.h
+include/libdnssec/keyid.h
+include/libdnssec/keystore.h
+include/libdnssec/keytag.h
+include/libdnssec/list.h
+include/libdnssec/nsec.h
+include/libdnssec/random.h
+include/libdnssec/sign.h
+include/libdnssec/tsig.h
+include/libdnssec/version.h
include/libknot/attribute.h
-include/libknot/binary.h
include/libknot/codes.h
include/libknot/consts.h
include/libknot/control/control.h
-include/libknot/cookies/alg-fnv64.h
-include/libknot/cookies/client.h
-include/libknot/cookies/server.h
+include/libknot/cookies.h
include/libknot/db/db.h
include/libknot/db/db_lmdb.h
include/libknot/db/db_trie.h
include/libknot/descriptor.h
include/libknot/dname.h
+include/libknot/endian.h
include/libknot/errcode.h
include/libknot/error.h
include/libknot/libknot.h
@@ -46,30 +43,28 @@ include/libknot/rdata.h
include/libknot/rdataset.h
include/libknot/rrset-dump.h
include/libknot/rrset.h
-include/libknot/rrtype/aaaa.h
include/libknot/rrtype/dnskey.h
include/libknot/rrtype/ds.h
include/libknot/rrtype/naptr.h
include/libknot/rrtype/nsec.h
include/libknot/rrtype/nsec3.h
include/libknot/rrtype/nsec3param.h
-include/libknot/rrtype/opt-cookie.h
include/libknot/rrtype/opt.h
include/libknot/rrtype/rdname.h
include/libknot/rrtype/rrsig.h
include/libknot/rrtype/soa.h
include/libknot/rrtype/tsig.h
-include/libknot/rrtype/txt.h
include/libknot/tsig-op.h
include/libknot/tsig.h
include/libknot/version.h
+include/libknot/wire.h
include/libknot/yparser/yparser.h
include/libknot/yparser/ypformat.h
include/libknot/yparser/ypschema.h
include/libknot/yparser/yptrafo.h
-include/zscanner/error.h
-include/zscanner/scanner.h
-include/zscanner/version.h
+include/libzscanner/error.h
+include/libzscanner/scanner.h
+include/libzscanner/version.h
lib/libdnssec.la
lib/libknot.la
lib/libzscanner.la
@@ -79,19 +74,18 @@ lib/pkgconfig/libknot.pc
lib/pkgconfig/libzscanner.pc
man/man1/kdig.1
man/man1/khost.1
-man/man1/kjournalprint.1
man/man1/knsec3hash.1
man/man1/knsupdate.1
man/man1/kzonecheck.1
man/man5/knot.conf.5
man/man8/keymgr.8
+man/man8/kjournalprint.8
man/man8/knotc.8
man/man8/knotd.8
-man/man8/pykeymgr.8
sbin/keymgr
+sbin/kjournalprint
sbin/knotc
sbin/knotd
-sbin/pykeymgr
share/examples/knot/example.com.zone
share/examples/knot/knot.sample.conf
@pkgdir etc/knot
Index: pkgsrc/net/knot/distinfo
diff -u pkgsrc/net/knot/distinfo:1.24 pkgsrc/net/knot/distinfo:1.25
--- pkgsrc/net/knot/distinfo:1.24 Thu Mar 8 14:30:37 2018
+++ pkgsrc/net/knot/distinfo Tue Jan 29 15:07:24 2019
@@ -1,7 +1,7 @@
-$NetBSD: distinfo,v 1.24 2018/03/08 14:30:37 pettai Exp $
+$NetBSD: distinfo,v 1.25 2019/01/29 15:07:24 ryoon Exp $
-SHA1 (knot-2.5.7.tar.xz) = 26bcd2784a8d1c062a4a103d9f2cb651804e7d68
-RMD160 (knot-2.5.7.tar.xz) = 96ac63cf365ed10fc979a351c79c12e345d4c2f0
-SHA512 (knot-2.5.7.tar.xz) = 96e375f556309bb89cea982dda169cef70c23d03c48282110e47a44849c1102cd37d98aa7650781b399f5d932b724b8a935f0b9e55e4920465ae7b74a0d1d55a
-Size (knot-2.5.7.tar.xz) = 1084656 bytes
+SHA1 (knot-2.7.6.tar.xz) = d2f313267c2b68b822c5b715927eae9d5268738e
+RMD160 (knot-2.7.6.tar.xz) = fca8c746a783789a1a5c0d1f0fbe2df8f652a250
+SHA512 (knot-2.7.6.tar.xz) = 6b6a727d57337da01e2d44abec7fde4504d112604769b118fe6254b0317f149ed4e9fab321a04517eccedb08e409818d1817fc1136c27d1fd351538e6816022a
+Size (knot-2.7.6.tar.xz) = 1151068 bytes
SHA1 (patch-samples_Makefile.in) = 499b8742dbd948e489b01d512bc7a8d8e4fe2e7b
Home |
Main Index |
Thread Index |
Old Index