CVS commit: pkgsrc/net/knot

["Marcin Gondek" <drixter%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   drixter
Date:           Fri Oct  9 17:50:26 UTC 2026

Modified Files:
        pkgsrc/net/knot: Makefile buildlink3.mk distinfo
Removed Files:
        pkgsrc/net/knot/patches: patch-src_contrib_time.c
            patch-src_contrib_ucw_mempool.c patch-tests_contrib_test_atomic.c
            patch-tests_knot_test__semantic__check.in
            patch-tests_libknot_test_cookies.c

Log Message:
knot: Update to 3.6.1

Features:
mod-ecs: new module for setting the ECS scope prefix length (Thanks to Branko Mijuskovic)

Improvements:
knotd: additional SOA consistency checks when processing incoming XFR
knotd: DDNS over 0-RTT QUIC/TLS is forbidden
knotd: new warning if difference(-no-serial) is enabled on a secondary zone
knotc: control blocking timeout is per full command, not per each zone
kdig: backward compatibility for +noidn as an alias for +noidnout
libknot: extra checks for malformed IPv4 and TCP packets in XDP filter (Thanks to Joshua Rogers)
src,tests: various compatibility fixes for SmartOS #980
doc: various improvements

Bugfixes:
knotd: missing synchronization between catalog reload and worker suspension
knotd: race condition between pausing/resuming events, zonedb update, and reload/conf-commit
knotd: non-consumed DoT 0-RTT early data can cause memory exhaustion (Thanks to Yuxiao Wu)
knotd: server can crash if NSEC3-enabled zone has empty NSEC3 chain (Thanks to Yuxiao Wu)
knotd: server sends 3 session tickets over DoQ
knotd: missing checks for malformed sentinel-related replies from Redis (Thanks to Joshua Rogers)
knotd: defective error handling during zone update (Thanks to Joshua Rogers)
knotd: defective TSIG MAC truncation processing (Thanks to Joshua Rogers)
knotd: zone update commit reads parent zone contents without RCU protection (Thanks to Joshua Rogers)
knotd: parent-check TTL can overflow KSK retirement delay (Thanks to Joshua Rogers)
knotd: missing DDNS queue synchronization during reload (Thanks to Joshua Rogers)
keymgr: validate-skr returns success for cryptographically invalid SKR signatures (Thanks to Joshua Rogers)
kdig: missing check for malformed EDNS/REPORTCHANNEL data (Thanks to Joshua Rogers)
libknot: defective output buffer handling in TCP over XDP
libknot: auto-generated TLS key file follows symlinks (Thanks to Joshua Rogers)
libknot: missing checks for malformed data in rrset-dump (Thanks to Joshua Rogers)
libzsanner: possible out-of-bounds write when parsing DELEG/DELEGPARAM dname (Thanks to Joshua Rogers)
redis: possible use-after-free when rrset index update fails (Thanks to Joshua Rogers)
redis: incorrect arity check for KNOT_BIN.UPD.LOAD (Thanks to Joshua Rogers)
redis: KNOT.ZONE.INFO crashes on nonexistent zone (Thanks to Joshua Rogers)
redis: update commit uses freed zset element buffer while applying updates (Thanks to Joshua Rogers)
python: receive_block() doesn't return data from the 'status' command


To generate a diff of this commit:
cvs rdiff -u -r1.104 -r1.105 pkgsrc/net/knot/Makefile
cvs rdiff -u -r1.4 -r1.5 pkgsrc/net/knot/buildlink3.mk
cvs rdiff -u -r1.60 -r1.61 pkgsrc/net/knot/distinfo
cvs rdiff -u -r1.1 -r0 pkgsrc/net/knot/patches/patch-src_contrib_time.c \
    pkgsrc/net/knot/patches/patch-src_contrib_ucw_mempool.c \
    pkgsrc/net/knot/patches/patch-tests_contrib_test_atomic.c \
    pkgsrc/net/knot/patches/patch-tests_knot_test__semantic__check.in \
    pkgsrc/net/knot/patches/patch-tests_libknot_test_cookies.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/net/knot/Makefile
diff -u pkgsrc/net/knot/Makefile:1.104 pkgsrc/net/knot/Makefile:1.105
--- pkgsrc/net/knot/Makefile:1.104      Wed Sep  9 14:25:20 2026
+++ pkgsrc/net/knot/Makefile    Fri Oct  9 17:50:25 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.104 2026/09/09 14:25:20 drixter Exp $
+# $NetBSD: Makefile,v 1.105 2026/10/09 17:50:25 drixter Exp $
 
-DISTNAME=      knot-3.6.0
+DISTNAME=      knot-3.6.1
 CATEGORIES=    net
 MASTER_SITES=  https://knot-dns.nic.cz/release/
 EXTRACT_SUFX=  .tar.xz

Index: pkgsrc/net/knot/buildlink3.mk
diff -u pkgsrc/net/knot/buildlink3.mk:1.4 pkgsrc/net/knot/buildlink3.mk:1.5
--- pkgsrc/net/knot/buildlink3.mk:1.4   Wed Sep  9 14:25:20 2026
+++ pkgsrc/net/knot/buildlink3.mk       Fri Oct  9 17:50:25 2026
@@ -1,11 +1,11 @@
-# $NetBSD: buildlink3.mk,v 1.4 2026/09/09 14:25:20 drixter Exp $
+# $NetBSD: buildlink3.mk,v 1.5 2026/10/09 17:50:25 drixter Exp $
 
 BUILDLINK_TREE+=       knot
 
 .if !defined(KNOT_BUILDLINK3_MK)
 KNOT_BUILDLINK3_MK:=
 
-BUILDLINK_API_DEPENDS.knot+=   knot>=3.6.0
+BUILDLINK_API_DEPENDS.knot+=   knot>=3.6.1
 BUILDLINK_PKGSRCDIR.knot?=     ../../net/knot
 
 .endif

Index: pkgsrc/net/knot/distinfo
diff -u pkgsrc/net/knot/distinfo:1.60 pkgsrc/net/knot/distinfo:1.61
--- pkgsrc/net/knot/distinfo:1.60       Fri Sep 11 12:53:13 2026
+++ pkgsrc/net/knot/distinfo    Fri Oct  9 17:50:25 2026
@@ -1,11 +1,6 @@
-$NetBSD: distinfo,v 1.60 2026/09/11 12:53:13 drixter Exp $
+$NetBSD: distinfo,v 1.61 2026/10/09 17:50:25 drixter Exp $
 
-BLAKE2s (knot-3.6.0.tar.xz) = 79dabdb7837e77fde56795cb6d959de1b9dc292c26786ed511a768001a3356c0
-SHA512 (knot-3.6.0.tar.xz) = 83369a94ce7f35f41b08d599844e4c9586c29ba8efcf841e90560734b81df72054ddd62df609b84149944a36672bb71219c66e6e0c8ee7e41d5c421fc256e64a
-Size (knot-3.6.0.tar.xz) = 1852000 bytes
+BLAKE2s (knot-3.6.1.tar.xz) = 92b8ac0fb85cbef63e554b3fea6fa0984d967440e74d1a0f5a3ba97e98b889b4
+SHA512 (knot-3.6.1.tar.xz) = 3009a4cf8119624b526847d5a07700fb6c3b6f34f054ca2d62d75e40eb754df9e80bc5971a25da3ede665d0786669f11d980336a1927508f67e6968635d11669
+Size (knot-3.6.1.tar.xz) = 1890808 bytes
 SHA1 (patch-samples_Makefile.in) = 499b8742dbd948e489b01d512bc7a8d8e4fe2e7b
-SHA1 (patch-src_contrib_time.c) = 67bd79053522b5142d622721377e791134901729
-SHA1 (patch-src_contrib_ucw_mempool.c) = 68e9d60757edc9fb58f323884ecc62ea0f024f36
-SHA1 (patch-tests_contrib_test_atomic.c) = 019cd4eab859b61afd8b839eea64f246bce8adaf
-SHA1 (patch-tests_knot_test__semantic__check.in) = bb55e07176e194bc34ed2eb957040e5d0531ed12
-SHA1 (patch-tests_libknot_test_cookies.c) = 07fca48cbd3948ba607b4ccdd852ac5ee2d1e20e