The NetBSD Project

CVS log for pkgsrc/net/knot/Makefile

[BACK] Up to [] / pkgsrc / net / knot

Request diff between arbitrary revisions

Default branch: MAIN

Revision 1.73 / (download) - annotate - [select for diffs], Wed Apr 19 08:11:07 2023 UTC (7 weeks, 1 day ago) by adam
Branch: MAIN
Changes since 1.72: +2 -1 lines
Diff to previous 1.72 (colored)

revbump after textproc/icu update

Revision 1.72 / (download) - annotate - [select for diffs], Fri Mar 3 15:32:41 2023 UTC (3 months ago) by ryoon
Branch: MAIN
CVS Tags: pkgsrc-2023Q1-base, pkgsrc-2023Q1
Changes since 1.71: +2 -2 lines
Diff to previous 1.71 (colored)

knot: Update to 3.2.5

Version 3.2.5

Thursday, February 2, 2023


      + knotd: new configuration option for enforcing IXFR fallback (see


      + knotd: changed UNIX socket file mode to 0222 for answering and 0220 for
      + mod-probe: new support for communication over a UNIX socket
      + kdig: new support for communication over a UNIX socket
      + libs: upgraded embedded libngtcp2 to 0.13.0
      + doc: various improvements


      + knotd: failed to get catalog member configuration if catalog template
        is in a template
      + knotd: failed to respond over a UNIX socket with EDNS
      + knotd: unexpected zone update upon restart or zone reload if ZONEMD
        generation is enabled
      + knotd: redundant zone flush of unchanged zone if zone file load is
      + knotd/kxdpgun: failed to receive messages over XDP with drivers tap or
      + knotc: zone check doesn't report missing zone file #829
      + kxdpgun: program crashes when remote closes QUIC connection instead of
      + mod-geoip: configuration check leaks memory in the geodb mode
      + utils: unwanted color reset sequences in non-color output

Revision 1.71 / (download) - annotate - [select for diffs], Sun Jan 8 20:40:20 2023 UTC (4 months, 4 weeks ago) by ryoon
Branch: MAIN
Changes since 1.70: +2 -3 lines
Diff to previous 1.70 (colored)

knot: Update to 3.2.4

Version 3.2.4
      + knotd: significant speed-up of catalog zone update processing
      + knotd: new runtime check if RRSIG lifetime is lower than RRSIG refresh
      + knotd: reworked zone re-bootstrap scheduling to be less progressive
      + mod-synthrecord: module can work with CIDR-style reverse zones #826
      + python: new libknot wrappers for some dname transformation functions
      + doc: a few fixes and improvements

      + knotd: incomplete zone is received when IXFR falls back to AXFR due to
        connection timeout if primary puts initial SOA only to the first
      + knotd: first zone re-bootstrap is planned after 24 hours
      + knotd: EDNS EXPIRE option is present in outgoing transfer of a catalog
      + knotd: catalog zone can expire upon EDNS EXPIRE processing
      + knotd: DNSSEC signing doesn't fail if no offline KSK records available

Version 3.2.3
      + knotd: new per-zone DS push configuration option (see 'zone.ds-push')
      + libs: upgraded embedded libngtcp2 to 0.11.0

      + knsupdate: program crashes when sending an update
      + knotd: server drops more responses over UDP under higher load
      + knotd: missing EDNS padding in responses over QUIC
      + knotd: some memory issues when handling unusual QUIC traffic
      + kxdpgun: broken IPv4 source subnet processing
      + kdig: incorrect handling of unsent data over QUIC

Version 3.2.2
      + knotd,kxdpgun: support for VLAN (802.1Q) traffic in the XDP mode
      + knotd: added configurable delay upon D-Bus initialization (see
      + kdig: support for JSON (RFC 8427) output format (see '+json')
      + kdig: support for PROXYv2 (see '+proxy') (Gift for Peter van Dijk)

      + mod-geoip: module respects the server configuration of answer rotation
      + libs: upgraded embedded libngtcp2 to 0.10.0
      + tests: improved robustness of some unit tests
      + doc: added description of zone bootstrap re-planning

      + knotd: catalog confusion when a member is added and immediately deleted
      + knotd: defective handling of short messages with PROXYv2 header #816
      + knotd: inconsistent processing of malformed messages with PROXYv2
        header #817
      + kxdpgun: incorrect XDP mode is logged
      + packaging: outdated dependency check in RPM packages

Version 3.2.1
      + libknot: added compatibility with libbpf 1.0 and libxdp
      + libknot: removed some trailing white space characters from textual RR
      + libs: upgraded embedded libngtcp2 to 0.8.1

      + knotd: some non-DNS packets not passed to OS if XDP mode enabled
      + knotd: inappropriate log about QUIC port change if QUIC not enabled
      + knotd/kxdpgun: various memory leaks related to QUIC and TCP
      + kxdpgun: can crash at high rates in emulated XDP mode
      + tests: broken XDP-TCP test on 32-bit platforms
      + kdig: failed to build with enabled QUIC on OpenBSD
      + systemd: failed to start server due to TemporaryFileSystem setting
      + packaging: missing knot-dnssecutils package on CentOS 7

Version 3.2.0
      + knotd: finalized TCP over XDP implementation
      + knotd: initial implementation of DNS over QUIC in the XDP mode (see
      + knotd: new incremental DNSKEY management for multi-signer deployment
        (see 'policy.dnskey-management')
      + knotd: support for remote grouping in configuration (see 'groups'
      + knotd: implemented EDNS Expire option (RFC 7314)
      + knotd: NSEC3 salt is changed with every ZSK rollover if lifetime is set
        to -1
      + knotd: support for PROXY v2 protocol over UDP (Thanks to Robert
        Edmonds) #762
      + knotd: support for key labels with PKCS #11 keystore (see
      + knotd: SVCB/HTTPS treatment according to draft-ietf-dnsop-svcb-https
      + keymgr: new JSON output format (see '-j' parameter) for listing keys or
        zones (Thanks to JP Mens)
      + kxdpgun: support for DNS over QUIC with some testing modes (see '-U'
      + kdig: new DNS over QUIC support (see '+quic')

      + knotd: reduced memory consumption when processing IXFR, DNSSEC,
        catalog, or DDNS
      + knotd: RRSIG refresh values don't have to match in the mode Offline KSK
      + knotd: better decision whether AXFR fallback is needed upon a refresh
      + knotd: NSEC3 resalt event was merged with the DNSSEC event
      + knotd: server logs when the connection to remote was taken from the
      + knotd: server logs zone expiration time when the zone is loaded
      + knotd: DS check verifies removal of old DS during algorithm rollover
      + knotd: DNSSEC-related records can be updated via DDNS
      + knotd: new 'xdp.udp' configuration option for disabling UDP over XDP
      + knotd: outgoing NOTIFY is replanned if failed
      + knotd: configuration checks if zone MIN interval values are lower or
        equal to MAX ones
      + knotd: DNSSEC-related zone semantic checks use DNSSEC validation
      + knotd: new configuration value 'query' for setting ACL action
      + knotd: new check on near end of imported Offline KSK records
      + knotd/knotc: implemented zone catalog purge, including orphaned member
      + knotc: interactive mode supports catalog zone completion, value
        completion, and more
      + knotc: new default brief and colorized output from zone status
      + knotc: unified empty values in zone status output
      + keymgr: DNSKEY TTL is taken from KSR in the Offline KSK mode
      + kjournalprint: path to journal DB is automatically taken from the
        configuration, which can be specified using '-c', '-C' (or '-D')
      + kcatalogprint: path to catalog DB is automatically taken from the
        configuration, which can be specified using '-c', '-C' (or '-D')
      + kzonesign: added automatic configuration file detection and '-C'
        parameter for configuration DB specificaion
      + kzonesign: all CPU threads are used for DNSSEC validation
      + libknot: dname pointer cannot point to another dname pointer when
        encoding RRsets #765
      + libknot: QNAME case is preserved in knot_pkt_t 'wire' field (Thanks to
        Robert Edmonds) #780
      + libknot: reduced memory consumption of the XDP mode
      + libknot: XDP filter supports up to 256 NIC queues
      + kxdpgun: new options for specifying source and remote MAC addresses
      + utils: extended logging of LMDB-related errors
      + utils: improved error outputs
      + kdig: query has AD bit set by default
      + doc: various improvements

      + knotd: zone changeset is stored to journal even if disabled
      + knotd: journal not applied to zone file if zone file changed during
      + knotd: possible out-of-order processing or postponed zone events to far
      + knotd: incorrect TTL is used if updated RRSet is empty over control
      + knotd/libs: serial arithmetics not used for RRSIG expiration processing
      + knsupdate: incorrect RRTYPE in the question section

      + knotd: default value for 'zone.journal-max-depth' was lowered to 20
      + knotd: default value for 'policy.nsec3-iterations' was lowered to 0
      + knotd: default value for 'policy.rrsig-refresh' is propagation delay +
        zone maximum TTL
      + knotd: server fails to load configuration if 'policy.rrsig-refresh' is
        too low
      + knotd: configuration option 'server.listen-xdp' has no effect
      + knotd: new configuration check on deprecated DNSSEC algorithm
      + knotc: new '-e' parameter for full zone status output
      + keymgr: new '-e' parameter for full key list output
      + keymgr: brief key listing mode is enabled by default
      + keymgr: renamed parameter '-d' to '-D'
      + knsupdate: default TTL is set to 3600
      + knsupdate: default zone is empty
      + kjournalprint: renamed parameter '-c' to '-H'
      + python/libknot: removed compatibility with Python 2

      + systemd: removed knot.tmpfile
      + systemd: added some hardening options
      + distro: Debian 9 and Ubuntu 16.04 no longer supported
      + distro: packages for CentOS 7 are built in a separate COPR repository
      + kzonecheck/kzonesign/knsec3hash: moved to new package knot-dnssecutils

Version 3.1.9
      + knotd: new configuration checks on unsupported catalog settings
      + knotd: semantic check issues have notice log level in the soft mode
      + keymgr: command generate-ksr automatically sets 'from' parameter to
        last offline KSK records' timestamp if it's not specified
      + keymgr: command show-offline starts from the first offline KSK record
        set if 'from' parameter isn't specified
      + kcatalogprint: new parameters for filtering catalog or member zone
      + mod-probe: default rate limit was increased to 100000
      + libknot: default control timeout was increased to 30 seconds
      + python/libknot: various exceptions are raised from class KnotCtl
      + doc: some improvements

      + knotd: incomplete outgoing IXFR is responded if journal history is
      + knotd: manually triggered zone flush is suppressed if disabled zone
      + knotd: failed to configure XDP listen interface without port
      + knotd: de-cataloged member zone's file isn't deleted #805
      + knotd: member zone leaks memory when reloading catalog during dynamic
        configuration change
      + knotd: server can crash when reloading modules with DNSSEC signing
        (Thanks to iqinlongfei)
      + knotd: server crashes during shutdown if PKCS #11 keystore is used
      + keymgr: command del-all-old isn't applied to all keys in the removed
      + kxdpgun: user specified network interface isn't used
      + libs: fixed compilation on illumos derivatives (Thanks to Nick Ewins)

Revision 1.70 / (download) - annotate - [select for diffs], Wed Oct 26 10:31:48 2022 UTC (7 months, 1 week ago) by wiz
Branch: MAIN
CVS Tags: pkgsrc-2022Q4-base, pkgsrc-2022Q4
Changes since 1.69: +2 -2 lines
Diff to previous 1.69 (colored)

*: bump PKGREVISION for libunistring shlib major bump

Revision 1.69 / (download) - annotate - [select for diffs], Thu Jun 30 11:18:42 2022 UTC (11 months, 1 week ago) by nia
Branch: MAIN
CVS Tags: pkgsrc-2022Q3-base, pkgsrc-2022Q3
Changes since 1.68: +2 -1 lines
Diff to previous 1.68 (colored)

*: Revbump packages that use Python at runtime without a PKGNAME prefix

Revision 1.68 / (download) - annotate - [select for diffs], Thu Jun 16 16:31:04 2022 UTC (11 months, 3 weeks ago) by ryoon
Branch: MAIN
CVS Tags: pkgsrc-2022Q2-base, pkgsrc-2022Q2
Changes since 1.67: +2 -2 lines
Diff to previous 1.67 (colored)

knot: Update to 3.1.8

Version 3.1.8

Thursday, April 28, 2022


      + knotd: optional automatic ACL for XFR and NOTIFY (see
      + knotd: new soft zone semantic check mode for allowing defective zone
      + knotc: added zone transfer freeze state to the zone status output


      + knotd: added configuration check for serial policy of generated


      + knotd/libknot: the server can crash when validating a malformed TSIG
      + knotd: outgoing zone transfer freeze not preserved during server reload
      + knotd: catalog UPDATE not processed if previous UPDATE processing not
        finished #790
      + knotd: zone refresh not started if planned during server reload
      + knotd: generated catalogs can be queried over UDP
      + knotd/utils: failed to open LMDB database if too many stale slots
        occupy the lock table

Version 3.1.7

Wednesday, March 30, 2022


      + knotd: new configuration items for restricting minimum and maximum zone
        expire and retry intervals (see 'zone.expire-min-interval',
        'zone.expire-max-interval', 'zone.retry-min-interval',
        'zone.retry-max-interval') #785
      + knotc: added catalog information to zone status


      + knotd: better warning message if SOA serial comparison failed when
        loading from zone file
      + knotc: zone status shows all zone events when frozen
      + keymgr: better error message is returned when importing SKR with
        insufficient permissions
      + kdig: transfer status is also printed if failed


      + knotd: incomplete implementation of the Offline KSK mode in the IXFR
        and DDNS processing
      + knotd: catalog zone accepts duplicate members via UPDATE #786
      + knotd: server crashes if catalog database contains orphaned member
      + knotd: old journal is scraped when restoring just the zone file
      + knotd: some planned zone events can be lost during server reload
      + knotd: frozen zone gets thawed during server reload
      + knsupdate: missing section names in the show output
      + knsupdate: inappropriate log message if called from a script

Version 3.1.6

Tuesday, February 8, 2022


      + knotd: optional D-Bus notifications for significant server and zone
        events (see 'server.dbus-event')
      + knotd: new submission configuration option for delayed KSK
        post-activation (see 'submission.parent-delay')
      + knotc: new commands for outgoing XFR freeze (see 'zone-xfr-freeze' and
      + kzonesign: added multithreaded DNSSEC validation mode (see '--verify')


      + kdig: trailing data in reply packet is accepted with a warning
      + kdig: XFR responses are checked if SOA owners match
      + knotd: failed remote operations are logged as info instead of debug
      + knsec3hash: added alternative and more natural parameter semantics
      + knsupdate: interactive mode is newly based on library Editline
      + Dockerfile: added UID argument to facilitate the use of unprivileged
        container #783
      + doc: various fixes and improvements


      + libknot: inaccurate KNOT_DNAME_TXT_MAXLEN constant value #781
      + knotd: propagation delay not considered before DS push
      + knotd: excessive refresh retry delay when a few early attemps fail
      + knotd: duplicate KSK submission log message during a KSK rollover
      + kdig: dname letter case not preserved in XFR and Dnstap outputs
      + mod-cookies: missing server cookie in responses over TCP

Version 3.1.5

Monday, December 20, 2021


      + knotd: optional outgoing TCP connection pool for faster communication
        with remotes (see 'server.remote-pool-limit' and
      + knotd: optional unreachable remote tracking to avoid zone events
        clogging (see 'server.remote-retry-delay')
      + knotd: new ZONEMD generation mode for the record removal from the zone
        apex #760 (see 'zone.zonemd-generate: remove')
      + mod-dnsproxy: new source address match option (see
      + scripts/probe_dump: simple mod-probe client


      + knotd: DS push sets DS TTL equal to DNSKEY TTL
      + knotd: extended zone purge error logging
      + knotd: zone file parsing error message was extended by the file name
      + knotd: improved debug log message when TCP timeout is reached
      + knotd: new configuration check for using the default number of NSEC3
      + knotd: new configuration check for insufficient RRSIG refresh time
      + mod-geoip: configuration check newly verifies the module configuration
        file #778
      + kdig: option +notimeout or +timeout=0 is interpreted as infinity
      + kdig: option +noretry is interpreted as zero retries
      + python/probe: more detailed default output format
      + doc: many spelling fixes (Thanks to Josh Soref)
      + doc: various fixes and improvements


      + knotd: imperfect TCP connection closing in the XDP mode
      + knotd: TCP reset packets are wrongly checked for ackno in the XDP mode
      + knotd: only first zone name is logged for multi-zone control operations
      + knotd: minor memory leak when full zone update fails to write to
      + knotc: configuration check doesn't check a configuration database
      + mod-dnstap: incorrect QNAME case restore in some corner cases (Thanks
        to Robert Edmonds) #777

Revision 1.67 / (download) - annotate - [select for diffs], Fri Dec 17 15:15:58 2021 UTC (17 months, 3 weeks ago) by ryoon
Branch: MAIN
CVS Tags: pkgsrc-2022Q1-base, pkgsrc-2022Q1, pkgsrc-2021Q4-base, pkgsrc-2021Q4
Changes since 1.66: +2 -3 lines
Diff to previous 1.66 (colored)

knot: Update to 3.1.4

Version 3.1.4


      + mod-dnstap: added 'responses-with-queries' configuration option (Thanks
        to Robert Edmonds)


      + knotd: DNSSEC keys are logged in sorted order by timestamp
      + mod-cookies: added statistics counter for dropped queries due to the
        slip limit
      + mod-dnstap: restored the original query QNAME case #773 (Thanks to
        Robert Edmonds)
      + configure: improved compatibility of some scripts on macOS and BSDs
      + doc: updates on DNSSEC signing


      + knotd: server can crash when receiving queries with NSID EDNS flag #774
        (Thanks to Romain Labolle)
      + knotd: server crashes on reload when no interfaces configured #770
      + knotd: ZONEMD without DNSSEC not handled correctly
      + knotd: generated catalog zone not updated on config reload #772
      + knotd: zone catalog not verified before its interpretation
      + knotd: ds-push fails to update the parent zone if a CNAME exists for a
        non-terminal node

Version 3.1.3

Monday, October 18, 2021


      + knotd: added simple error logging to orphaned zone purge
      + knotd: allow manual public-only keys for unused algorithm
      + kdig: send ALPN when using DoT or XoT #769
      + doc: various fixes and improvements #767


      + knotd: catalog backup doesn't preserve version of the catalog
      + knotd: NOTIFY is scheduled even when DNSSEC signing is up-to-date
      + knotd: server can crash when zone difference is inconsistent upon cold
      + knotd: zone not bootstrapped when zone file load failed due to an error
      + knotd: broken AXFR with knot as slave and dnsmasq as master (Thanks to
        Daniel Gr?ber)
      + knotd: journal not able to free up space when zone-in-journal present
        and zonefile written
      + mod-stats: missing protocol counters for TCP over XDP
      + kzonesign: input zone name not lower-cased

Version 3.1.2


      + knotd: new policy configuration for postponing complete deletion of
        previous keys
      + keymgr: new optional pretty mode (-b) of listing keys
      + kdig: added support for TCP keepopen #503


      + knotd: configuration item values can contain UTF-8 characters
      + knotd: added configuration check for database storage writability
      + knotd: better error reporting if zone is empty
      + knotd: smaller journal database chunks in order to mitigate LMDB
      + knotd/kxdpgun: CAP_SYS_RESOURCE capability no longer needed for XDP on
        Linux >= 5.11


      + knotd: incomplete NSEC3 proof in response to opt-outed empty
      + knotd: wrong SOA serial handling when enabling signing on already
        existing secondary zone
      + knotd: defective ZONEMD verification error reporting when loading zone
      + knotd: server can crash when reloading catalog zone #761
      + knotd: DNSSEC validation doesn't work when only NSEC3 chain changes
        knotd: DNSSEC validation doesn't check if empty non-terminal over
            delegation isn't opt-outed too

      + knotd: ZONEMD generation doesn't cause flushing zone to disk #758
      + knotd: incorrect evaluation of ACL deny rule in combination with TSIG
      + knotd: failed DS-check is replaned even if no key is ready
      + kdig: abort when query times out #763
      + libzscanner: missing output overflow check in the SVCB parsing


      + keymgr: parameter -d is marked deprecated in favor of new parameter -D
      + kjournalprint: parameter -n is marked deprecated in favor of new
        parameter -x

Version 3.1.1


      + keymgr: import-bind sets publish and active timers to now if missing
        timers #747
      + mod-rrl: added QNAME, which triggered an action, to log messages #757
      + systemd: added environment variable for setting maximum configuration
        DB size


      + knotd: adding RRSIGs to a signed zone can lead to redundant RRSIGs for
        some NSEC(3)s
      + knotd: code not compiled correctly for ARM on Fedora >= 33
      + knotd: server can crash when opening catalog DB on startup
      + knotd: incorrect catalog update counts in logs
      + knotd: journal discontinuity and zone-in-journal result in incorrectly
        calculated journal occupation
      + kdig: +noall does not filter out AUTHORITY comment #749
      + tests: journal unit test not passing if memory page size is different
        from 4096


      + libzscanner: reverted "omitted TTL value is correctly set to the last
        explicitly stated value (RFC 1035)" #751

Revision 1.66 / (download) - annotate - [select for diffs], Wed Dec 8 16:06:00 2021 UTC (17 months, 4 weeks ago) by adam
Branch: MAIN
Changes since 1.65: +2 -2 lines
Diff to previous 1.65 (colored)

revbump for icu and libffi

Revision 1.65 / (download) - annotate - [select for diffs], Wed Sep 29 19:01:08 2021 UTC (20 months, 1 week ago) by adam
Branch: MAIN
Changes since 1.64: +2 -1 lines
Diff to previous 1.64 (colored)

revbump for boost-libs

Revision 1.64 / (download) - annotate - [select for diffs], Sat Aug 7 16:36:18 2021 UTC (22 months ago) by ryoon
Branch: MAIN
CVS Tags: pkgsrc-2021Q3-base, pkgsrc-2021Q3
Changes since 1.63: +2 -3 lines
Diff to previous 1.63 (colored)

knot: Update to 3.1.0

Version 3.1.0

Monday, August 2, 2021


      + knotd: automatic zone catalog generation based on actual configuration
      + knotd: zone catalog supports configuration groups
      + knotd: support for ZONEMD validation and generation
      + knotd: basic support for TCP over XDP processing
      + knotd: configuration option for enabling IP route check in the XDP mode
      + knotd: support for epoll (Linux) and kqueue (*BSD, macOS) socket
      + knotd: extended EDNS error (EDE) is added to the response if
      + knotd: DNSSEC operation with extra ready public-only KSK is newly
      + knotd: new zone backup/restore filters for more variable component
      + knotd: adaptive systemd service start timeout and new zone loading
        status #733
      + knotd: configuration option for enabling TCP Fast Open on outbound
      + knotd: when the server starts, zone NOTIFY is send only if not sent
      + knotc: zone reload with the force flag triggers reload of the zone and
        its modules
      + libs: support for parsing and dumping SVCB and HTTPS resource records
      + kdig: support for TCP Fast Open along with DoT/DoH #549
      + kxdpgun: basic support for DNS over TCP processing
      + kxdpgun: current traffic statistics can be printed using a USR1 signal
      + python: new libknot/probe API wrapper


      + knotd: PID file is created even in the foreground mode
      + knotd: more robust and enhanced zone data backup and restore operations
      + knotd: maximum length of an XFR message is limited to 16 KiB for better
      + knotd: maximum CNAME/DNAME chain depth per reply was decreased from 20
        to 5
      + knotd: improved performance of processing domain names with many short
      + knotd: adaptive limit on the number of LMDB readers to avoid problems
        with many workers
      + knotd: TTL of generated NSEC(3) records is set to min(SOA TTL, SOA
      + knotd: TTL of generated NSEC3PARAM is equal to TTL of NSEC3 records
      + knotd: maximum TCP segment size is restricted to 1220 octets on Linux #
      + knotc: various improvements in error reporting
      + knotc: default control timeout is infinity in the blocking mode
      + dnssec: dnskey generator tries to return a key with a unique keytag
      + kxdpgun: RLIMIT_MEMLOCK is increased only if not high enough
      + kxdpgun: RTNETLINK is used for getting network information instead of
        the ip command


      + knotd: DNAME not applied more than once to resolve the query #714
      + knotd: root zone not correctly purged from the journal
      + kzonecheck: incorrect check for opt-outed empty non-terminal nodes
      + libzscanner: wrong error line number
      + libzscanner: broken multiline rdata processing if an error occurs
      + mod-geoip: NXDOMAIN is responded instead of NODATA #745
      + make: build fails with undefined references if building using slibtool


      + knotd: systemd service reload uses 'kill -HUP' instead of 'knotc
      + kxdpgun: new library dependency libmnl
      + mod-dnstap: new package separate from the knot package
      + mod-geoip: new package separate from the knot package


      + configure: option '--enable-xdp=yes' means use an external libbpf if
            or use the embedded one

      + libzsanner: omitted TTL value is correctly set to the last explicitly
        stated value (RFC 1035)
      + knotc: zone restore from an old backup (3.0.x) requires forced
      + knotd: configuration option 'server.listen-xdp' is replaced with
      + knotd: zone file loading with automatic SOA serial incrementation newly
            requires having full zone in the journal

      + knotd: obsolete configuration options 'zone.disable-any',
            are silently ignored

      + knotd: obsolete configuration options 'zone.max-zone-size',
            'zone.max-journal-usage', 'zone.max-refresh-interval',
            'zone.min-refresh-interval' 'server.max-ipv4-udp-payload',
            'server.max-ipv6-udp-payload', 'server.max-udp-payload',
            'server.tcp-reply-timeout', 'server.max-tcp-clients' are ignored

      + knotd: obsolete default template options 'template.journal-db',
            'template.kasp-db', 'template.timer-db',
            'template.max-journal-db-size', 'template.journal-db-mode',
            'template.max-timer-db-size', 'template.max-kasp-db-size' are

Version 3.0.8

Friday, July 16, 2021


      + knotc: new command for loading DNSSEC keys without dropping all RRSIGs
        when re-signing
      + knotd: new policy configuration option for disabling some DNSSEC safety
        features #741
      + mod-geoip: new dnssec and policy configuration options


      + knotd: early KSK removal during a KSK rollover if automatic KSK
            submission check
            is enabled and DNSKEY TTL is lower than the corresponding DS TTL

      + knotd: failed to generate a new DNSKEY if previously generated shared
        key not available
      + knotd: periodical error logging when a PKCS #11 keystore failed to
        initialize #742
      + knotd: zone commit doesn't check for missing SOA record

Version 3.0.7

Wednesday, June 16, 2021


      + knotd: new configuration policy option for CDS digest algorithm setting
      + keymgr: new command for primary SOA serial manipulation in on-secondary
        signing mode


      + knotd: improved algorithm rollover to shorten the last step of old
        RRSIG publication


      + knotd: zone is flushed upon server start, despite DNSSEC signing is
      + knotd: wildcard nonexistence is proved on empty-non-terminal query
      + knotd: redundant wildcard proof for non-authoritative data in a reply
      + knotd: missing wildcard proofs in a wildcard-cname loop reply
      + knotd: incorrectly synthesized CNAME owner from a wildcard record #715
      + knotd: zone-in-journal changeset ignores journal-max-usage limit #736
      + knotd: incorrect processing of zone-in-journal changeset with SOA
        serial 0
      + knotd: broken initialization of processing workers if SO_REUSEPORT(_LB)
        not available
      + kjournalprint: reported journal usage is incorrect #736
      + keymgr: cannot parse algorithm name ed448 #739
      + keymgr: default key size not set properly
      + kdig: failed to process huge DoH responses
      + libknot/probe: some corner-case bugs

Version 3.0.6

Wednesday, May 12, 2021


      + mod-probe: new module for simple traffic logging (Python API not yet


      + keymgr: new mode for listing zones with at least one key stored
      + keymgr: the pregenerate command accepts optional timestamp-from
      + kzonecheck: accept '-' as substitution for standard input #727
      + knotd: print an error when unable to change owner of a logging file
      + knotd: new warning log if no interface is configured
      + knotd: new signing policy check for NSEC3 iterations higher than 20
      + knotd: don't allow backup to/restore from the DB storage directory
      + Various code (mostly zone backup/restore), tests, and documentation


      + knotd: secondary fails to load zone file if HTTPS or SVCB record is
        present #725
      + knotd: (KSK roll-over) new KSK is not signing DNSKEY long enough before
        DS submission
      + knotd: (KSK roll-over) old KSK uselessly published after roll-over
      + knotd: malformed address in TCP-related logs when listening on a UNIX
      + knotd: server responds FORMERR instead of BADTIME if TSIG signed time
        is zero #730
      + modules: incorrect local and remote addresses in the XDP mode
      + modules: failed to read configuration from a section without
      + mod-synthrecord: queries on synthesized empty-non-terminals not
        answered with NODATA
      + keymgr: confusing error if del-all-old command fails

Revision 1.63 / (download) - annotate - [select for diffs], Fri May 14 13:08:10 2021 UTC (2 years ago) by nia
Branch: MAIN
CVS Tags: pkgsrc-2021Q2-base, pkgsrc-2021Q2
Changes since 1.62: +4 -3 lines
Diff to previous 1.62 (colored)

knot: needs editline

Revision 1.62 / (download) - annotate - [select for diffs], Wed Apr 21 13:25:10 2021 UTC (2 years, 1 month ago) by adam
Branch: MAIN
Changes since 1.61: +2 -1 lines
Diff to previous 1.61 (colored)

revbump for boost-libs

Revision 1.61 / (download) - annotate - [select for diffs], Sat Feb 27 18:55:31 2021 UTC (2 years, 3 months ago) by ryoon
Branch: MAIN
CVS Tags: pkgsrc-2021Q1-base, pkgsrc-2021Q1
Changes since 1.60: +2 -2 lines
Diff to previous 1.60 (colored)

knot: Update to 3.0.4


        Sockets to CPUs binding is no longer enabled by default but can be enabled via new configuration option 'server.socket-affinity'
        Some documentation improvements


        DNS queries without EDNS to the root zone apex are dropped in the XDP mode
        Deterministic ECDSA signing leaks memory
        Zone not stored to journal if zonefile-load isn't ZONEFILE_LOAD_WHOLE
        Server crashes if the catalog zone isn't configured for registered member zones
        Server crashes when loading conflicting catalog member zones
        CNAME and DNAME records below delegation are not ignored #713
        Not all udp/tcp workers are used if the number of NIC queues is lower than the number of udp/tcp workers
        Failed to load statistics and geoip modules if built as shared

Revision 1.60 / (download) - annotate - [select for diffs], Wed Jan 6 12:18:48 2021 UTC (2 years, 5 months ago) by ryoon
Branch: MAIN
Changes since 1.59: +2 -3 lines
Diff to previous 1.59 (colored)

knot: Update to 3.0.3

Version 3.0.3


      + Kjournalprint can display changesets starting from specific SOA serial


      + New configuration check on ambiguous 'storage' specification #706
      + New configuration check on problematic 'zonefile-load' with
        'journal-contents' combination
      + Server logs positive ACL check in debug severity level (Thanks to
        Andreas Schrägle)
      + More verbose logging of failed zone backup
      + Extended documentation for catalog zones


      + On-slave signing produces broken NSEC(3) chain if glue node becomes
        (un-)orphaned #705
      + Server responds CNAME query with NXDOMAIN for CNAME synthesized from
      + Kdig crashes if source address and dnstap logging are specified
        together #702
      + Knotc fails to display error returned from zone freeze or zone thaw
      + Dynamically reconfigured zone isn't loaded upon configuration commit
      + Keymgr is unable to import BIND-style private key if it contains empty
      + Zone backup fails to backup keys if any of them is public-only
      + Failed to build with XDP support on Debian testing

Version 3.0.2


      + kdig prints Extended DNS Error (Gift for Marek Vavruša)
      + kxdpgun allows source IP address/subnet specification


      + Server doesn't start if any of listen addresses fails to bind
      + knotc no longer stores empty and adjacent identical commands to
        interactive history
      + Depth of interactive history of knotc was increased to 1000 commands
      + keymgr prints error messages to stderr instead of stdout
      + keymgr checks for proper offline-ksk configuration before processing
        KSR or SKR
      + keymgr imports Revoked timer from BIND keys
      + Additional XDP support detection in server
      + Lots of spelling and grammar fixes in documentation (Thanks to Paul
      + Some documentation improvements


      + If more masters configured, zone retransfer triggers AXFR from all
      + Server can fail to bind address during restart due to missing
      + KSK imported from BIND doesn't roll over automatically
      + libdnssec respects local GnuTLS policy affects DNSSEC operations and
        Knot Resolver
      + kdig can stuck in infinite loop when solving BADCOOKIE responses
      + Zone names received over control interface are not lower-cased
      + Zone attributes not secured with multi-threaded changes
      + kzonecheck ignores forced dnssec checks if zone not signed
      + kzonecheck fails on case-sensitivity of owner names in NSEC records #
      + kdig fails to establish TLS connection #700
      + Server responds NOTIMPL to queries with QDCOUNT 0 and known OPCODE

Revision 1.59 / (download) - annotate - [select for diffs], Fri Dec 4 20:45:34 2020 UTC (2 years, 6 months ago) by nia
Branch: MAIN
CVS Tags: pkgsrc-2020Q4-base, pkgsrc-2020Q4
Changes since 1.58: +2 -1 lines
Diff to previous 1.58 (colored)

Revbump packages with a runtime Python dep but no version prefix.

For the Python 3.8 default switch.

Revision 1.58 / (download) - annotate - [select for diffs], Sun Oct 25 11:13:43 2020 UTC (2 years, 7 months ago) by ryoon
Branch: MAIN
Changes since 1.57: +2 -2 lines
Diff to previous 1.57 (colored)

knot: Update to 3.0.1


        New command in keymgr for validation of RRSIGs in SKR
        Keymgr validates RRSIGs in SKR during import
        New option in kzonecheck to skip DNSSEC-related checks


        Module noudp has new configuration option for UDP truncation rate
        Better detection of reproducible signing availability
        Kxdpgun allows setting of network interface
        Default control timeout in knotc was increased to 60 seconds
        DNSSEC validation searches for invalid redundant RRSIGs
        Configuration source detection no longer considers empty confdb directory as active configuration
        Zone backup preserves original zone file if zone file synchronization is disabled


        NSEC3 re-salt can cause server crash due to possible zone inconsistencies
        Zone reload logs 'invalid parameter' if zone file not changed
        Outgoing multi-message transfer can contain invalid compression pointers under specific conditions
        Improper handling of file descriptors in libdnssec
        Server crashes if no policy is configured with DNSSEC validation
        Server crashes if DNSSEC validation is enabled for unsigned zone
        Failed to build with libnghttp2 (Thanks to Robert Edmonds)
        Various bugs in zone data backup/restore

Revision 1.57 / (download) - annotate - [select for diffs], Thu Oct 1 03:37:02 2020 UTC (2 years, 8 months ago) by ryoon
Branch: MAIN
Changes since 1.56: +3 -2 lines
Diff to previous 1.56 (colored)

knot: Update to 3.0.0

Version 3.0.0

Wednesday, September 9, 2020


      + High-performance networking mode using XDP sockets (requires Linux
      + Support for Catalog zones including kcatalogprint utility
      + New DNSSEC validation mode
      + New kzonesign utility --- an interface for manual DNSSEC signing
      + New kxdpgun utility --- high-performance DNS over UDP traffic generator
        for Linux
      + DoH support in kdig using GnuTLS and libnghttp2
      + New KSK revoked state (RFC 5011) in manual DNSSEC key management mode
      + Deterministic signing with ECDSA algorithms (requires GnuTLS 3.6.10+)
      + Module synthrecord supports reverse pointer shortening
      + Safe persistent zone data backup and restore


      + Processing depth of CNAME and DNAME chains is limited to 20
      + Non-FQDN is allowed as 'update-owner-name' configuration option value
      + Kdig prints detailed algorithm idendifier for PRIVATEDNS and PRIVATEOID
        in multiline mode #334
      + Queries with QTYPE ANY or RRSIG are always responded with at most one
        random RRSet
      + The statistics module has negligible performance overhead on modern
      + If multithreaded zone signing is enabled, some additional zone
        maintenance steps are newly parallelized
      + ACL can be configured by reference to a remote
      + Better CPU cache locality for higher query processing performance
      + Logging to non-syslog streams contains timestamps with the timezone
      + Keeping initial DNSKEY TTL and zone maximum TTL in KASP database to
        ensure proper rollover timing in case of TTL changes during the
      + Responding FORMERR to queries with more OPT records


      + Module onlinesign responds NXDOMAIN insted of NOERROR (NODATA) if
        DNSSEC not requested
      + Outgoing multi-message transfer can contain invalid compression
        pointers under specific conditions

Version 2.9.6

Monday, August 31, 2020


      + New kdig option '+[no]opttext' to print unknown EDNS options as text if
        possible (Thanks to Robert Edmonds)


      + Better error message if no key is ready for submission
      + Improved logging when master is not usable
      + Improved control logging of zone-flush errors if output directory is
      + More precise system error messages when a zone transfer fails
      + Some documentation improvements (especially Offline KSK)


      + In the case of many zones, control operations over all zones take lots
        of memory
      + Misleading error message on keymgr import-bind #683
      + DS push is triggered upon every zone change even though CDS wasn't
      + Kzonecheck performance penalty with passive keys #688
       CSK->KSK+ZSK scheme rollover can end too early

Revision 1.56 / (download) - annotate - [select for diffs], Wed May 27 14:32:02 2020 UTC (3 years ago) by ryoon
Branch: MAIN
CVS Tags: pkgsrc-2020Q3-base, pkgsrc-2020Q3, pkgsrc-2020Q2-base, pkgsrc-2020Q2
Changes since 1.55: +2 -3 lines
Diff to previous 1.55 (colored)

knot: Update to 2.9.5

Monday, May 25, 2020
        Old ZSK can be withdrawn too early during a ZSK rollover if maximum zone TTL is computed automatically
        Server responds SERVFAIL to ANY queries on empty non-terminal nodes

        Also module onlinesign returns minimized responses to ANY queries
        Linking against libcap-ng can be disabled via a configure option

Revision 1.55 / (download) - annotate - [select for diffs], Fri May 22 23:29:31 2020 UTC (3 years ago) by maya
Branch: MAIN
Changes since 1.54: +1 -4 lines
Diff to previous 1.54 (colored)

knot: Disable hack to disable optimization.

It isn't actually stuck, with enough patience it does complete.

Revision 1.54 / (download) - annotate - [select for diffs], Fri May 22 10:56:28 2020 UTC (3 years ago) by adam
Branch: MAIN
Changes since 1.53: +2 -1 lines
Diff to previous 1.53 (colored)

revbump after updating security/nettle

Revision 1.53 / (download) - annotate - [select for diffs], Thu May 21 11:39:10 2020 UTC (3 years ago) by ryoon
Branch: MAIN
Changes since 1.52: +2 -2 lines
Diff to previous 1.52 (colored)

Update to 2.9.4

Version 2.9.4
Tuesday, May 5, 2020


        ANY query over UDP is always answered with one RRSet + possible RRSIG instead of truncated reply
        Server tries to resolve CNAME record generated by geoip module (Thanks to Conrad Hoffmann)
        Earlier OCSP validity check in kdig certificate verification (Thanks to Alexander Schultz)
        Module onlinesign allows KSK + ZSK mode
        Server control listen backlog limit was increased to 5
        Zone signing event is always re-scheduled even after a signing error
        Extended error checks and tiny enhancements in kjournalprint
        kdig logs a more detailed error message when failed to acquire a remote address
        Some documentation improvements

        Server can crash when zone update fails due to exceeded zone size limit
        keymgr 'share' command doesn't work
        Shared KSK doesn't work with an initial key
        Self-created RRSIGs are still cryptographically verified in some unnecessary cases
        Changed NSEC3PARAM not correctly detected during zone update
        NSEC(3) chain not fixed if affected by zone udpate
        knotc orphan purge doesn't work on journal
        Online signing configured along with DNSSEC signing can cause MDB_BAD_RSLOT error during server reload
        Zone journal access can stuck if mismanaged zone serial
        Concurrently added and removed same records in a DDNS message are not properly handled
        Zone check logs error instead of warning after a first error occured

Revision 1.52 / (download) - annotate - [select for diffs], Fri May 8 16:25:04 2020 UTC (3 years, 1 month ago) by rillig
Branch: MAIN
Changes since 1.51: +1 -3 lines
Diff to previous 1.51 (colored)

net/knot: remove nonexistent file from REPLACE_PYTHON

Revision 1.51 / (download) - annotate - [select for diffs], Mon Mar 30 12:42:22 2020 UTC (3 years, 2 months ago) by ryoon
Branch: MAIN
Changes since 1.50: +2 -3 lines
Diff to previous 1.50 (colored)

knot: Update to 2.9.3

Version 2.9.3

Tuesday, March 3, 2020

        New configuration option 'remote.block-notify-after-transfer' to suppress sending NOTIFY messages
        Enabled testing support for Ed448 DNSSEC algorithm (requires GnuTLS 3.6.12+ and not-yet-released Nettle 3.6+)
        New keymgr parameter 'local-serial' for getting/setting signed zone SOA serial in the KASP database
        keymgr can import Ed25519 and Ed448 keys in the BIND format (Thanks to Conrad Hoffmann)


        kdig returns error if the query name is invalid
        Increased 'server.tcp-io-timeout' default value to 500 ms
        Decreased 'database.journal-db-max-size' default value to 512 MiB on 32-bit systems
        Server no longer falls back to AXFR if master is outdated during zone refresh
        Some documentation improvements (including new EPUB format and compatibility with Ultra Electronics CIS Keyper Plus HSM)
        Some packaging improvements (including new python3-libknot deb package)


        Outgoing IXFR can be malformed if the message size has specific size
        Server can crash if the zone contains solo NSEC3 record
        Improved compatibility with older journal format
        Incorrect SOA TTL in negative answers SOA minimum not considered
        Cannot unset uppercase nodes via control interface #668
        Module RRL doesn't set AA flag and NOERROR rcode in slipped responses
        Server returns FORMERR instead of NOTIMP if empty QUESTION and unknown OPCODE

Revision 1.50 / (download) - annotate - [select for diffs], Sun Mar 8 16:50:54 2020 UTC (3 years, 3 months ago) by wiz
Branch: MAIN
CVS Tags: pkgsrc-2020Q1-base, pkgsrc-2020Q1
Changes since 1.49: +2 -1 lines
Diff to previous 1.49 (colored)

*: recursive bump for libffi

Revision 1.49 / (download) - annotate - [select for diffs], Wed Feb 19 13:17:24 2020 UTC (3 years, 3 months ago) by ryoon
Branch: MAIN
Changes since 1.48: +5 -2 lines
Diff to previous 1.48 (colored)

knot: Update to 2.9.2

Knot DNS 2.9.2 (2019-12-12)

 - Tiny ds-check log message rewording
 - Some unnecessary code cleanup

 - ds-push doesn't replace the DS RRset on the parent #661
 - Server gets stuck in a never-ending logging loop when changing SOA TTL
 - Server can crash when the journal database size limit is reached
 - Server can create a bogus changeset with equal serials from and to
 - Unreasonable re-signing of the NSEC3PARAM record when reloading the zone
   and 'zonefile-load: difference-no-serial' is configured
 - SOA RRSIG not updated if the only changed record is SOA
 - Failed to remove NSEC3 records through the control interface #666
 - Failed to stop the server if a zone transaction is active

Knot DNS 2.9.1 (2019-11-11)

 - New option for OCSP stapling '+[no]tls-ocsp-stapling[=H]' in kdig (Thanks to Alexander Schultz)

 - Kdig always randomizes source TCP port on recent Linux #575
 - Server no longer warns about disabled zone file synchronization during shutdown
 - Zone loading stops if failed to load zone from the journal
 - Speed-up of insertion to big RRSets
 - Various code and documentation improvements

 - Failed to apply journal changes after upgrade #659
 - Failed to finish zone loading if journal changeset serials from and to are equal
 - Incorrect handling of 0 value for 'tcp-io-timeout' and 'tcp-remote-io-timeout' configuration
 - Server can crash if zone transaction is open during zone update
 - NSEC3 chain not fully updated if NSEC3 salt changes during zone update
 - Server can crash when flushing zone to a specified directory
 - Server can respond incorrect NSEC3 records after NSEC3 salt change
 - Delegation glue records not updated after specific zone change

Knot DNS 2.9.0 (2019-10-10)

 - Full support for different master/slave serial arithmetics when on-slave signing
 - Module geoip newly supports wildcard records #650
 - New DNSSEC policy configuration option 'rrsig-pre-refresh' for reducing
   frequency of the zone signing event
 - New server configuration option 'tcp-reuseport' for setting SO_REUSEPORT(_LB)
   mode on TCP sockets
 - New server configuration option 'tcp-io-timeout' [ms] for restricting inbound
   IO operations over TCP #474

 - Significant speed-up of zone contents modifications
 - Avoided double zone signing during CSK rollovers
 - Self-created RRSIGs are not cryptographically verified if not necessary
 - Zone journal can store two changesets if zone file difference computing
   and DNSSEC signing are enabled. The first one containing the difference of
   zone history needed by slave servers, the second one containing the difference
   between zone file and zone needed for server restart
 - Universal and more robust memory clearing
 - More precise socket timeout handling
 - New notice log message for configuration changes requiring server restart
 - Module RRL logs both trigger source address and affected subnet
 - Various code (especially zone and TCP processing) and documentation improvements

 - RRSIGs are wrongly checked for inconsistent RRSet TTLs during zone update
 - DS check/push warnings after disabled DNSSEC signing
 - NSEC3 records not accessible through control interface
 - Module geoip doesn't accept underscore character in dname specification #655

 - Removed runtime reconfiguration of network workers and interfaces since
   it was imperfect and also couldn't work after dropped process privileges
 - Removed inaccurate and misleading knotc command 'zone-memstats' because
   memory consumption varies during zone modifications or transfers
 - Removed useless 'zone.request-edns-option' configuration option
 - Reimplemented DNS Cookies to be interoperable (based on draft-ietf-dnsop-server-cookies
   and work by Witold Krcicki)
 - Default limit on TCP clients is auto-configured to one half of the file
   descriptor limit for the server process
 - Number of open files limit is set to 1048576 in upstream packages
 - Default number of TCP workers is equal to the number of online CPUs or at least 10
 - Default EDNS buffer size is 1232 for both IPv4 and IPv6
 - Removed 'tcp-handshake-timeout' server configuration option
 - Some configuration options were renamed and possibly moved. Old names will
   be supported at least until next major release:
    - 'server.tcp-reply-timeout' [s] to 'server.tcp-remote-io-timeout' [ms]
    - 'server.max-tcp-clients'       to 'server.tcp-max-clients'
    - 'server.max-udp-payload'       to 'server.udp-max-payload'
    - 'server.max-ipv4-udp-payload'  to 'server.udp-max-payload-ipv4'
    - 'server.max-ipv6-udp-payload'  to 'server.udp-max-payload-ipv6'
    - 'template.journal-db'          to 'database.journal-db'
    - 'template.journal-db-mode'     to 'database.journal-db-mode'
    - 'template.max-journal-db-size' to 'database.journal-db-max-size'
    - 'template.kasp-db'             to 'database.kasp-db'
    - 'template.max-kasp-db-size'    to 'database.kasp-db-max-size'
    - 'template.timer-db'            to 'database.timer-db'
    - 'template.max-timer-db-size'   to 'database.timer-db-max-size'
    - 'zone.max-journal-usage'       to 'zone.journal-max-usage'
    - 'zone.max-journal-depth'       to 'zone.journal-max-depth'
    - 'zone.max-zone-size'           to ''
    - 'zone.max-refresh-interval'    to 'zone.refresh-max-interval'
    - 'zone.min-refresh-interval'    to 'zone.refresh-min-interval'

Knot DNS 2.8.4 (2019-09-24)

 - Automatic uploading of DS records to parent zone using DDNS,
   see 'policy.ds-push' configuration option

 - Incoming IXFR no longer falls back to AXFR if connection error #642
 - More accurate semantic checks for missing glue records
 - Various code and documentation improvements

 - Failed to read/export configuration if 'acl.update-type' is set #651
 - Failed to generate initial zero-length salt
 - Missing error log for invalid rrtype input to dynamic configuration #652
 - Missing error log when AXFR processing fails to store zone data
 - Redundant notice log about unavailable persistent configuration DB
 - Zone not flushed after retransfer if SOA serial not changed
 - Zone contents not properly fixed during zone transfers
 - No changeset created for updated rrset's TTL if changed by RR addition

Revision 1.48 / (download) - annotate - [select for diffs], Sun Nov 3 11:45:38 2019 UTC (3 years, 7 months ago) by rillig
Branch: MAIN
CVS Tags: pkgsrc-2019Q4-base, pkgsrc-2019Q4
Changes since 1.47: +2 -2 lines
Diff to previous 1.47 (colored)

net: align variable assignments

pkglint -Wall -F --only aligned --only indent -r

No manual corrections.

Revision 1.47 / (download) - annotate - [select for diffs], Wed Aug 21 14:19:00 2019 UTC (3 years, 9 months ago) by ryoon
Branch: MAIN
CVS Tags: pkgsrc-2019Q3-base, pkgsrc-2019Q3
Changes since 1.46: +2 -3 lines
Diff to previous 1.46 (colored)

Update to 2.8.3



        Added cert/key file configuration for TLS in kdig (Thanks to Alexander Schultz)


        More verbose log message for offline-KSK signing
        Module RRL logs affected source address subnet instead of only one source address
        Extended DNSSEC policy configuration checks
        Various improvements in the documentation


        Excessive server load when maximum TCP clients limit is reached
        Incorrect reply after zone update with a node changed from non-authoritative to delegation
        Wrong error line number in a config file if it contains leading tab character
        Config file error message contains unrelated parsing context
        NSEC3 salt not updated when reconfigured to zero length
        Kjournalprint sometimes prints a random value for per-zone occupation
        Missing debug log for failed zone refresh triggered by zone notification
        DS check not scheduled when reconfigured
        Broken unit test on NetBSD 8.x

Revision 1.46 / (download) - annotate - [select for diffs], Sat Jul 20 22:46:39 2019 UTC (3 years, 10 months ago) by wiz
Branch: MAIN
Changes since 1.45: +2 -1 lines
Diff to previous 1.45 (colored)

*: recursive bump for nettle 3.5.1

Revision 1.45 / (download) - annotate - [select for diffs], Thu Jun 13 23:47:05 2019 UTC (3 years, 11 months ago) by ryoon
Branch: MAIN
CVS Tags: pkgsrc-2019Q2-base, pkgsrc-2019Q2
Changes since 1.44: +2 -3 lines
Diff to previous 1.44 (colored)

Update to 2.8.2

Knot DNS 2.8.2 (2019-06-05)

 - New blocking mode for zone event triggers in knotc
 - New weighted records mode in the module geoip (Thanks to Conrad Hoffmann)
 - Module noudp allows UDP allow rate configuration

 - NSEC3 salt lifetime can be set to infinity
 - New 'running' zone event status in the knotc output
 - Knotc in the forced mode returns failure also if zone check emits any warning
 - Ignoring PMTU information for IPv4/UDP via IP_PMTUDISC_OMIT (Thanks to Daisuke Higashi)
 - Various improvements in the documentation

 - Broken setting of CPU affinity for UDP workers
 - Unexpected results with the geoip subnet mode
 - Sometimes insufficient zone adjusting
 - Incoherent DNSKEY RRSIG lifetimes in SKR
 - Confusing output from keymgr if an error occurs during KSR generation
 - Non-functional changeset history depth limitation in kjournalprint
 - Wrong processing of multiple $INCLUDE directives #646

Revision 1.44 / (download) - annotate - [select for diffs], Thu May 23 19:23:10 2019 UTC (4 years ago) by rillig
Branch: MAIN
Changes since 1.43: +2 -2 lines
Diff to previous 1.43 (colored)

all: replace SUBST_SED with the simpler SUBST_VARS

pkglint -Wall -r --only "substitution command" -F

With manual review and indentation fixes since pkglint doesn't get that
part correct in every case.

Revision 1.43 / (download) - annotate - [select for diffs], Thu Apr 25 07:33:11 2019 UTC (4 years, 1 month ago) by maya
Branch: MAIN
Changes since 1.42: +2 -1 lines
Diff to previous 1.42 (colored)

PKGREVISION bump for anything using python without a PYPKGPREFIX.

This is a semi-manual PKGREVISION bump.

Revision 1.42 / (download) - annotate - [select for diffs], Mon Apr 15 16:23:03 2019 UTC (4 years, 1 month ago) by ryoon
Branch: MAIN
Changes since 1.41: +2 -2 lines
Diff to previous 1.41 (colored)

Update to 2.8.1

Knot DNS 2.8.1 (2019-04-09)

 - Possible zone transaction is aborted by zone events to avoid inconsistency
 - Added log message if no persistent config DB is available during 'conf-begin'
 - New environment setting 'KNOT_VERSION_FORMAT=release' for extended version suppression
 - Various improvements in the documentation

 - Broken NSEC3-wildcard-nonexistence proof after NSEC3 re-salt
 - Glue records under delegation are sometimes signed
 - RRL doesn't work correctly on big-endian architectures
 - NSEC3 not re-salted during AXFR refresh
 - Failed to sign new zone contents if added dynamically #641
 - NSEC3 opt-out signing doesn't work in some cases
 - Broken NSEC3 chain after adding new sub-delegations
 - Redundant SOA RRSIG on slave if RRSIG TTL changed on master
 - Sometimes confusing log error message for NOTIFY event
 - Improper include for LMDB #638

Knot DNS 2.8.0 (2019-03-05)

 - New offline-KSK mode of operation
 - Configurable multithreaded DNSSEC signing for large zones
 - Extended ACL configuration for dynamic updates
 - New knotc trigger 'zone-key-rollover' for immediate DNSKEY rollover
 - Added support for OPENPGPKEY, CSYNC, SMIMEA, and ZONEMD RR types
 - New 'double-ds' option for CDS/CDNSKEY publication

 - Significant speed-up of zone updates
 - Knotc supports force option in the interactive mode
 - Copy-on-write support for QP-trie (Thanks to Tony Finch)
 - Unified and more efficient LMDB layer for journal, timer, and KASP databases
 - DS check event is re-planned according to KASP even when purged timers
 - Module DNS Cookies supports explicit Server Secret configuration
 - Zone mtime is verified against full-precision timestamp (Thanks to Daniel Kahn Gillmor)
 - Extended logging (loaded SOA serials, refresh duration, tiny cleanup)
 - Relaxed fixed-length condition for DNSSEC key ID
 - Extended semantic checks for DNAME and NS RR types
 - Added support for FreeBSD's SO_REUSEPORT_LB
 - Improved performance of geoip module
 - Various improvements in the documentation

 - Changed configuration default for 'cds-cdnskey-publish' to 'rollover'
 - Journal DB format changes are not downgrade-compatible
 - Keymgr no longer prints DS for algorithm SHA-1

Revision 1.41 / (download) - annotate - [select for diffs], Tue Jan 29 15:07:24 2019 UTC (4 years, 4 months ago) by ryoon
Branch: MAIN
CVS Tags: pkgsrc-2019Q1-base, pkgsrc-2019Q1
Changes since 1.40: +2 -3 lines
Diff to previous 1.40 (colored)

Update to 2.7.6

Knot DNS 2.7.6 (2019-01-23)

 - Zone status also shows when the zone load is scheduled
 - Server workers status also shows background workers utilization
 - Default control timeout for knotc was increased to 10 seconds
 - Pkg-config files contain auxiliary variable with library filename

 - Configuration commit or server reload can drop some pending zone events
 - Nonempty zone journal is created even though it's disabled #635
 - Zone is completely re-signed during empty dynamic update processing
 - Server can crash when storing a big zone difference to the journal
 - Failed to link on FreeBSD 12 with Clang

Knot DNS 2.7.5 (2019-01-07)

 - Keymgr supports NSEC3 salt handling

 - Zone history in journal is dropped apon AXFR-like zone update
 - Libdnssec is no longer linked against libm #628
 - Libdnssec is explicitly linked against libpthread if PKCS #11 enabled #629
 - Better support for libknot packaging in Python
 - Manually generated KSK is 'ready' by default
 - Kdig supports '+timeout' as an alias for '+time'
 - Kdig supports '+nocomments' option
 - Kdig no longer prints empty lines between retries
 - Kdig returns failure if operations not successfully resolved #632
 - Fixed repeating of the 'KSK submission, waiting for confirmation' log
 - Various improvements in documentation, Dockerfile, and tests

 - Knotc fails to unset huge configuration section
 - Kjournalprint sometimes fails to display zone journal content
 - Improper timing of ZSK removal during ZSK rollover
 - Missing UTC time zone indication in the 'iso' keymgr list output
 - A race condition in the online signing module

Knot DNS 2.7.4 (2018-11-13)

 - Added SNI configuration for TLS in kdig (Thanks to Alexander Schultz)

 - Added warning log when DNSSEC events not successfully scheduled
 - New semantic check on timer values in keymgr
 - DS query no longer asks other addresses if got a negative answer
 - Reintroduced 'rollover' configuration option for CDS/CDNSKEY publication
 - Extended logging for zone loading
 - Various documentation improvements

 - Failed to import module configuration #613
 - Improper Cflags value in libknot.pc if built with embedded LMDB #615
 - IXFR doesn't fall back to AXFR if malformed reply
 - DNSSEC events not correctly scheduled for empty zone updates
 - During algorithm rollover old keys get removed before DS TTL expires #617
 - Maximum zone's RRSIG TTL not considered during algorithm rollover #620

Knot DNS 2.7.3 (2018-10-11)

 - New queryacl module for query access control
 - Configurable answer rrset rotation #612
 - Configurable NSEC bitmap in online signing

 - Better error logging for KASP DB operations #601
 - Some documentation improvements

 - Keymgr "list" output doesn't show key size for ECDSA algorithms #602
 - Failed to link statically with embedded LMDB
 - Configuration commit causes zone reload for all zones
 - The statistics module overlooks TSIG record in a request
 - Improper processing of an AXFR-style-IXFR response consisting of one-record messages
 - Race condition in online signing during key rollover #600
 - Server can crash if geoip module is enabled in the geo mode

Knot DNS 2.7.2 (2018-08-29)

 - Keymgr list command displays also key size
 - Kjournalprint displays total occupied size in the debug mode
 - Server doesn't stop if failed to load a shared module from the module directory
 - Libraries libcap-ng, pthread, and dl are linked selectively if needed

 - Sometimes incorrect result from dnssec_nsec_bitmap_contains (libdnssec)
 - Server can crash when loading zone file difference and zone-in-journal is set
 - Incorrect treatment of specific queries in the module RRL
 - Failed to link module Cookies as a shared library

Knot DNS 2.7.1 (2018-08-14)

 - Added zone wire size information to zone loading log message
 - Added debug log message for each unsuccessful remote address operation
 - Various improvements for packaging

 - Incompatible handling of RRSIG TTL value when creating a DNS message
 - Incorrect RRSIG TTL value in zone differences and knotc zone operation outputs
 - Default configure prefix is ignored

Knot DNS 2.7.0 (2018-08-03)

 - New DNS Cookies module and related '+cookie' kdig option
 - New module for response tailoring according to client's subnet or geographic location
 - General EDNS Client Subnet support in the server
 - OSS-Fuzz integration (Thanks to Jonathan Foote)
 - New '+ednsopt' kdig option (Thanks to Jan Velák)
 - Online Signing support for automatic key rollover
 - Non-normal file (e.g. pipe) loading support in zscanner #542
 - Automatic SOA serial incrementation if non-empty zone difference
 - New zone file load option for ignoring zone file's SOA serial
 - New build-time option for alternative malloc specification
 - Structured logging for DNSSEC key submission event
 - Empty QNAME support in kdig

 - Various library and server optimizations
 - Reduced memory consumption of outgoing IXFR processing
 - Linux capabilities use overhaul #546 (Thanks to Robert Edmonds)
 - Online Signing properly signs delegations and CNAME records
 - CDS/CDNSKEY rrset is signed with KSK instead of ZSK
 - DNSSEC-related records are ignored when loading zone difference with signing enabled
 - Minimum allowed RSA key length was increased to 1024
 - Removed explicit dependency on Nettle

 - Possible uninitialized address buffer use in zscanner
 - Possible index overflow during multiline record parsing in zscanner
 - kdig +tls sometimes consumes 100 % CPU #561
 - Single-Type Signing doesn't work with single ZSK key #566
 - Zone not flushed after re-signing during zone load #594
 - Server crashes when committing empty zone transaction
 - Incoming IXFR with on-slave signing sometimes leads to memory corruption #595

 - Removed obsolete RRL configuration
 - Removed obsolete module names 'mod-online-sign' and 'mod-synth-record'
 - Removed obsolete 'ixfr-from-differences' configuration option
 - Removed old journal migration
 - Removed module rosedb

Knot DNS 2.6.9 (2018-08-14)

 - Added zone wire size to zone loading log message
 - Added debug log message for each unsuccessful remote address operation

 - Zone not flushed after re-signing during zone load #594
 - Server crashes when committing empty zone transaction
 - Incoming IXFR with on-slave signing sometimes leads to memory corruption #595

Knot DNS 2.6.8 (2018-07-10)

 - New 'import-pkcs11' command in keymgr

 - Unixtime serial policy mimics Bind increment if lower #593

 - Creeping memory consuption upon server reload #584
 - Kdig incorrectly detects QNAME if 'notify' is a prefix
 - Server crashes when zone sign fails #587
 - CSK->KZSK rollover retires CSK early #588
 - Server crashes when zone expires during outgoing multi-message transfer
 - Kjournalprint doesn't convert zone name argument to lower-case
 - Cannot switch to a previously used ksk-shared dnssec policy #589

Knot DNS 2.6.7 (2018-05-17)

 - Added 'dateserial' (YYYYMMDDnn) serial policy configuration (Thanks to Wolfgang Jung)

 - Trailing data indication from the packet parser (libknot)
 - Better configuration check for a problematical option combination

 - Incomplete configuration option item name check
 - Possible buffer overflow in 'knot_dname_to_str' (libknot)
 - Module dnsproxy doesn't preserve letter case of QNAME
 - Module dnsproxy duplicates OPT and TSIG in the non-fallback mode

Knot DNS 2.6.6 (2018-04-11)

 - New EDNS option counters in the statistics module
 - New '+orphan' filter for the 'zone-purge' operation

 - Reduced memory consuption of disabled statistics metrics
 - Some spelling fixes (Thanks to Daniel Kahn Gillmor)
 - Server no longer fails to start if MODULE_DIR doesn't exist
 - Configuration include doesn't fail if empty wildcard match
 - Added a configuration check for a problematical option combination

 - NSEC3 chain not re-created when SOA minimum TTL changed
 - Failed to start server if no template is configured
 - Possibly incorrect SOA serial upon changed zone reload with DNSSEC signing
 - Inaccurate outgoing zone transfer size in the log message
 - Invalid dname compression if empty question section
 - Missing EDNS in EMALF responses

Knot DNS 2.6.5 (2018-02-12)

 - New 'zone-notify' command in knotc
 - Kdig uses '@server' as a hostname for TLS authenticaion if '+tls-ca' is set

 - Better heap memory trimming for zone operations
 - Added proper polling for TLS operations in kdig
 - Configuration export uses stdout as a default output
 - Simplified detection of atomic operations
 - Added '--disable-modules' configure option
 - Small documentation updates

 - Zone retransfer doesn't work well if more masters configured
 - Kdig can leak or double free memory in corner cases
 - Inconsistent error outputs from dynamic configuration operations
 - Failed to generate documentation on OpenBSD

Knot DNS 2.6.4 (2018-01-02)

 - Module synthrecord allows multiple 'network' specification
 - New CSK handling support in keymgr

 - Allowed configuration for infinite zsk lifetime
 - Increased performance and security of the module synthrecord
 - Signing changeset is stored into journal even if 'zonefile-load' is whole

 - Unintentional zone re-sign during reload if empty NSEC3 salt
 - Inconsistent zone names in journald structured logs
 - Malformed outgoing transfer for big zone with TSIG
 - Some minor DNSSEC-related issues

Knot DNS 2.6.3 (2017-11-24)

 - Wrong detection of signing scheme rollover

Knot DNS 2.6.2 (2017-11-23)

 - CSK algorithm rollover and (KSK, ZSK) <-> CSK rollover support

 - Allowed explicit configuration for infinite ksk lifetime
 - Proper error messages instead of unclear error codes in server log
 - Better support for old compilers

 - Unexpected reply for DS query with an owner below a delegation point
 - Old dependencies in the pkg-config file

Knot DNS 2.6.1 (2017-11-02)

 - NSEC3 Opt-Out support in the DNSSEC signing
 - New CDS/CDNSKEY publish configuration option

 - Simplified DNSSEC log message with DNSKEY details
 - +tls-hostname in kdig implies +tls-ca if neither +tls-ca nor +tls-pin is given
 - New documentation sections for DNSSEC key rollovers and shared keys
 - Keymgr no longer prints useless algorithm number for generated key
 - Kdig prints unknown RCODE in a numeric format
 - Better support for LLVM libFuzzer

 - Faulty DNAME semantic check if present in the zone apex and NSEC3 is used
 - Immediate zone flush not scheduled during the zone load event
 - Server crashes upon dynamic zone addition if a query module is loaded
 - Kdig fails to connect over TLS due to SNI is set to server IP address
 - Possible out-of-bounds memory access at the end of the input
 - TCP Fast Open enabled by default in kdig breaks TLS connection

Knot DNS 2.6.0 (2017-09-29)

 - On-slave (inline) signing support
 - Automatic DNSSEC key algorithm rollover
 - Ed25519 algorithm support in DNSSEC (requires GnuTLS 3.6.0)
 - New 'journal-content' and 'zonefile-load' configuration options
 - keymgr tries to run as user/group set in the configuration
 - Public-only DNSSEC key import into KASP DB via keymgr
 - NSEC3 resalt and parent DS query events are persistent in timer DB
 - New processing state for a response suppression within a query module
 - Enabled server side TCP Fast Open if supported
 - TCP Fast Open support in kdig

 - Better record owner compression if related to the previous rdata dname
 - NSEC(3) chain is no longer recomputed whole on every update
 - Remove inconsistent and unnecessary quoting in log files
 - Avoiding of overlapping key rollovers at a time
 - More DNSSSEC-related semantic checks
 - Extended timestamp format in keymgr

 - Incorrect journal free space computation causing inefficient space handling
 - Interface-automatic broken on Linux in the presence of asymmetric routing

Revision 1.40 / (download) - annotate - [select for diffs], Wed Jul 4 13:40:28 2018 UTC (4 years, 11 months ago) by jperkin
Branch: MAIN
CVS Tags: pkgsrc-2018Q4-base, pkgsrc-2018Q4, pkgsrc-2018Q3-base, pkgsrc-2018Q3
Changes since 1.39: +2 -2 lines
Diff to previous 1.39 (colored)

*: Move SUBST_STAGE from post-patch to pre-configure

Performing substitutions during post-patch breaks tools such as mkpatches,
making it very difficult to regenerate correct patches after making changes,
and often leading to substituted string replacements being committed.

Revision 1.39 / (download) - annotate - [select for diffs], Tue Apr 17 22:29:45 2018 UTC (5 years, 1 month ago) by wiz
Branch: MAIN
CVS Tags: pkgsrc-2018Q2-base, pkgsrc-2018Q2
Changes since 1.38: +2 -1 lines
Diff to previous 1.38 (colored)

Add p11-kit to gnutls/ and bump dependencies.

Revision 1.38 / (download) - annotate - [select for diffs], Thu Mar 8 14:30:37 2018 UTC (5 years, 3 months ago) by pettai
Branch: MAIN
CVS Tags: pkgsrc-2018Q1-base, pkgsrc-2018Q1
Changes since 1.37: +8 -2 lines
Diff to previous 1.37 (colored)

Knot DNS 2.5.7 (2018-01-02)

 - Unintentional zone re-sign during reload if empty NSEC3 salt
 - Inconsistent zone names in journald structured logs
 - Malformed outgoing transfer for big zone with TSIG
 - Unexpected reply for DS query with an owner below a delegation point
 - Old dependencies in the pkg-config file


Only new Features & Security fixes of the previous updates are shown below

For a complete of all Improvements & Bugfixes, see:

Knot DNS 2.5.3 (2017-07-14)

 - CSK rollover support for Single-Type Signing Scheme


Knot DNS 2.5.2 (2017-06-23)

 - CVE-2017-11104: Improper TSIG validity period check can allow TSIG forgery (Thanks to Synacktiv!)

Knot DNS 2.5.0 (2017-06-05)

 - KASP database switched from JSON files to LMDB database
 - KSK rollover support using CDNSKEY and CDS in the automatic DNSSEC signing
 - Dynamic module loading support with proper module API
 - Journal can store full zone contents (not only differences)
 - Zone freeze/thaw support
 - Updated knotc zone-status output with optional column filters
 - New '[no]crypto' option in kdig
 - New keymgr implementation reflecting KASP database changes
 - New pykeymgr for JSON-based KASP database migration
 - Removed obsolete knot1to2 utility

Revision 1.37 / (download) - annotate - [select for diffs], Wed Mar 7 16:42:10 2018 UTC (5 years, 3 months ago) by pettai
Branch: MAIN
Changes since 1.36: +8 -3 lines
Diff to previous 1.36 (colored)

Knot DNS 2.4.5 (2017-06-23)

 - Improper TSIG validity period check can allow TSIG forgery (Thanks to Synacktiv!)

 - Corner case journal fixes (huge changesets, OpenWRT operation)

Knot DNS 2.4.4 (2017-06-05)

 - Improved error handling in kjournalprint

 - Zone flush not replanned upon unsuccessful flush
 - Journal inconsistency after deleting deleted zone
 - Zone events not rescheduled upon server reload (Thanks to Mark Warren)
 - Unreliable LMDB mapsize detection in kjournalprint
 - Some minor issues found by AddressSanitizer

Knot DNS 2.4.3 (2017-04-11)

 - New 'journal-db-mode' optimization configuration option
 - The default TSIG algorithm for utilities input is HMAC-SHA256
 - Implemented sensible default EDNS(0) padding policy (Thanks to D. K. Gillmor)
 - Added some more semantic checks on the knotc configuration operations

 - Missing 'zone' keyword in the YAML output
 - Missing trailing dot in the keymgr DS owner output
 - Journal logs 'invalid parameter' in several cases
 - Some minor journal-related problems

Knot DNS 2.4.2 (2017-03-23)

 - Zscanner can store record comments placed on the same line
 - Knotc status extension with version, configure, and workers parameters

 - Significant incoming XFR speed-up in the case of many zones

 - Double OPT RR insertion when a global module returns KNOT_STATE_FAIL
 - User-driven zscanner parsing logic inconsistency
 - Lower serial at master doesn't trigger any errors
 - Queries with too long DNAME substitution do not return YXDOMAIN response
 - Incorrect elapsed time in the DDNS log
 - Failed to process forwarded DDNS request with TSIG

Knot DNS 2.4.1 (2017-02-10)

 - Speed-up of rdata addition into a huge rrset
 - Introduce check of minumum timeout for next refresh
 - Dnsproxy module can forward all queries without local resolving

 - Transfer of a huge rrset goes into an infinite loop
 - Huge response over TCP contains useless TC bit instead of SERVFAIL
 - Failed to build utilities with disabled daemon
 - Memory leaks during keys removal
 - Rough TSIG packet reservation causes early truncation
 - Minor out-of-bounds string termination write in rrset dump
 - Server crash during stop if failed to open timers DB
 - Failed to compile on OS X older than Sierra
 - Poor minimum UDP-max-size configuration check
 - Failed to receive one-record-per-message IXFR-style AXFR
 - Kdig timeouts when receiving RCODE != NOERROR on subsequent transfer message

Knot DNS 2.4.0 (2017-01-18)
 - Kdig timeouts when receiving RCODE != NOERROR on subsequent transfer message

Knot DNS 2.4.0 (2017-01-18)

 - False positive semantic-check warning about invalid bitmap in NSEC
 - Unnecessary SOA queries upon notify with up to date serial
 - Timers for expired zones are reset on reload
 - Zone doesn't expire when the server is down
 - Failed to handle keys with duplicate keytags
 - Per zone module and global module insconsistency
 - Obsolete online signing module configuration
 - Malformed output from kjournalprint
 - Redundant SO_REUSEPORT activation on the TCP socket
 - Failed to use higher number of background workers

 - Lower memory consumption with qp-trie
 - Zone events and zone timers improvements
 - Print all zone names in the FQDN format
 - Simplified query module interface
 - Shared TCP connection between SOA query and transfer
 - Response Rate Limiting as a module with statistics support
 - Key filters in keymgr

 - New unified LMDB-based zone journal
 - Server statistics support
 - New statistics module for traffic measuring
 - Automatic deletion of retired DNSSEC keys
 - New control logging category

Revision 1.36 / (download) - annotate - [select for diffs], Wed Aug 16 20:21:13 2017 UTC (5 years, 9 months ago) by wiz
Branch: MAIN
CVS Tags: pkgsrc-2017Q4-base, pkgsrc-2017Q4, pkgsrc-2017Q3-base, pkgsrc-2017Q3
Changes since 1.35: +2 -2 lines
Diff to previous 1.35 (colored)

Follow some http redirects.

Revision 1.35 / (download) - annotate - [select for diffs], Mon Aug 7 08:44:14 2017 UTC (5 years, 10 months ago) by jlam
Branch: MAIN
Changes since 1.34: +7 -6 lines
Diff to previous 1.34 (colored)

Use PKG_SYSCONF* variables correctly in net/knot.

Set PKG_SYSCONFSUBDIR to "knot" to have all of the config files
located in the "knot" subdirectory of ${PKG_SYSCONFBASE}.

Pass ${PKG_SYSCONFBASE} to the configure script since the package's
build infrastructure automatically appends "/knot" to the value
passed in through --sysconfdir.

automatically created by the package install script.

Bump the PKGREVISION due to changes in the package install scripts.

Revision 1.34 / (download) - annotate - [select for diffs], Fri Dec 9 22:28:17 2016 UTC (6 years, 5 months ago) by pettai
Branch: MAIN
CVS Tags: pkgsrc-2017Q2-base, pkgsrc-2017Q2, pkgsrc-2017Q1-base, pkgsrc-2017Q1, pkgsrc-2016Q4-base, pkgsrc-2016Q4
Changes since 1.33: +2 -2 lines
Diff to previous 1.33 (colored)

Knot DNS 2.3.3 (2016-12-08)

 - Double free when failed to apply zone journal
 - Zone bootstrap retry interval not preserved upon zone reload
 - DNSSEC related records not flushed if not signed
 - False semantic checks warning about incorrect type in NSEC bitmap
 - Memory leak in kzonecheck

 - All zone names are fully-qualified in log

 - New kjournalprint utility

Knot DNS 2.3.2 (2016-11-04)

 - Incorrect %s expansion for the root zone
 - Failed to refresh not existing slave zone after restart
 - Immediate zone refresh upon restart if refresh already scheduled
 - Early zone transfer after restart if transfer already scheduled
 - Not ignoring empty non-terminal parents during delegation lookup
 - CD bit preservation in responses
 - Compilation error on GNU/kFreeBSD
 - Server crash after double zone-commit if journal error

 - Speed-up of knotc if control operation and known socket
 - Zone purge operation purges also zone timers

 - Simple modules don't require empty configuration section
 - New zone journal path configuration option
 - New timeout configuration option for module dnsproxy

Revision 1.33 / (download) - annotate - [select for diffs], Sat Oct 29 09:42:48 2016 UTC (6 years, 7 months ago) by pettai
Branch: MAIN
Changes since 1.32: +2 -3 lines
Diff to previous 1.32 (colored)

Knot DNS 2.3.1 (2016-10-07)

 - Missing glue records in some responses
 - Knsupdate prompt printing on non-terminal
 - Mismatch between configuration policy item names and documentation
 - Segfault on OS X (Sierra)

 - Significant speed-up of conf-commit and conf-diff operations (in most cases)
 - New EDNS Client Subnet libknot API
 - Better semantic-checks error messages

 - Print TLS certificate hierarchy in kdig verbose mode
 - New +subnet alias for +client
 - New mod-whoami and mod-noudp modules
 - New zone-purge control command
 - New log-queries and log-responses options for mod-dnstap

Revision / (download) - annotate - [select for diffs], Fri Oct 28 12:54:22 2016 UTC (6 years, 7 months ago) by pettai
Branch: pkgsrc-2016Q3
Changes since +2 -1 lines
Diff to previous (colored) to branchpoint 1.32 (colored) next main 1.33 (colored)

reverting commit (to wrong branch)

Revision / (download) - annotate - [select for diffs], Fri Oct 28 11:10:54 2016 UTC (6 years, 7 months ago) by pettai
Branch: pkgsrc-2016Q3
Changes since 1.32: +2 -3 lines
Diff to previous 1.32 (colored)

Knot DNS 2.3.1 (2016-10-07)

 - Missing glue records in some responses
 - Knsupdate prompt printing on non-terminal
 - Mismatch between configuration policy item names and documentation
 - Segfault on OS X (Sierra)

 - Significant speed-up of conf-commit and conf-diff operations (in most cases)
 - New EDNS Client Subnet libknot API
 - Better semantic-checks error messages

 - Print TLS certificate hierarchy in kdig verbose mode
 - New +subnet alias for +client
 - New mod-whoami and mod-noudp modules
 - New zone-purge control command
 - New log-queries and log-responses options for mod-dnstap

Revision 1.32 / (download) - annotate - [select for diffs], Mon Sep 19 13:04:25 2016 UTC (6 years, 8 months ago) by wiz
Branch: MAIN
CVS Tags: pkgsrc-2016Q3-base
Branch point for: pkgsrc-2016Q3
Changes since 1.31: +2 -1 lines
Diff to previous 1.31 (colored)

Recursive PKGREVISION bump for gnutls shlib major bump.

Revision 1.31 / (download) - annotate - [select for diffs], Thu Aug 25 14:11:49 2016 UTC (6 years, 9 months ago) by pettai
Branch: MAIN
Changes since 1.30: +2 -2 lines
Diff to previous 1.30 (colored)

Knot DNS 2.3.0 (2016-08-09)

 - No wildcard expansion below empty non-terminal for NSEC signed zone
 - Avoid multiple loads of the same PKCS #11 module
 - Fix kdig IXFR response processing if the transfer content is empty
 - Don't ignore non-existing records to be removed in IXFR

 - Refactored semantic checks and improved error messages
 - Set TC flag in delegation only if mandatory glue doesn't fit the response
 - Separate EDNS(0) payload size configuration for IPv4 and IPv6

 - DNSSEC policy can be defined in server configuration
 - Automatic NSEC3 resalt according to DNSSEC policy
 - Zone content editing using control interface
 - Zone size limit restriction for DDNS, AXFR, and IXFR (CVE-2016-6171)
 - DNS-over-TLS support in kdig (RFC 7858)
 - EDNS(0) padding and alignment support in kdig (RFC 7830)

Revision 1.30 / (download) - annotate - [select for diffs], Thu Jun 16 17:12:27 2016 UTC (6 years, 11 months ago) by pettai
Branch: MAIN
CVS Tags: pkgsrc-2016Q2-base, pkgsrc-2016Q2
Changes since 1.29: +2 -2 lines
Diff to previous 1.29 (colored)

Knot DNS 2.2.1 (2016-05-24)

 - Fix separate logging of server and zone events
 - Fix concurrent zone file flushing with many zones
 - Fix possible server crash with empty hostname on OpenWRT
 - Fix control timeout parsing in knotc
 - Fix "Environment maxreaders limit reached" error in knotc
 - Don't apply journal changes on modified zone file
 - Remove broken LTO option from configure script
 - Enable multiple zone names completion in interactive knotc
 - Set the TC flag in a response if a glue doesn't fit the response
 - Disallow server reload when there is an active configuration transaction

 - Distinguish unavailable zones from zones with zero serial in log messages
 - Log warning and error messages to standard error output in all utilities
 - Document tested PKCS #11 devices
 - Extended Python configuration interface

Knot DNS 2.2.0 (2016-04-26)

 - Fix build dependencies on FreeBSD
 - Fix query/response message type setting in dnstap module
 - Fix remote address retrieval from dnstap capture in kdig
 - Fix global modules execution for queries hitting existing zones
 - Fix execution of semantic checks after an IXFR transfer
 - Fix PKCS#11 support detection at build time
 - Fix kdig failure when the first AXFR message contains just the SOA record
 - Exclude non-authoritative types from NSEC/NSEC3 bitmap at a delegation
 - Mark PKCS#11 generated keys as sensitive (required by Luna SA)
 - Fix error when removing the only zone from the server
 - Don't abort knotc transaction when some check fails

 - URI and CAA resource record types support
 - RRL client address based white list
 - knotc interactive mode

 - Consistent IXFR error messages
 - Various fixes for better compatibility with PKCS#11 devices
 - Various keymgr user interface improvements
 - Better zone event scheduler performance with many zones
 - New server control interface
 - kdig uses local resolver if resolv.conf is empty

Revision 1.29 / (download) - annotate - [select for diffs], Sun Feb 28 17:02:38 2016 UTC (7 years, 3 months ago) by pettai
Branch: MAIN
CVS Tags: pkgsrc-2016Q1-base, pkgsrc-2016Q1
Changes since 1.28: +2 -2 lines
Diff to previous 1.28 (colored)

Knot DNS 2.1.1 (2016-02-10)

 - DNSSEC: Allow import of duplicate private key into the KASP
 - DNSSEC: Avoid duplicate NSEC for Wildcard No Data answer
 - Fix server crash when an incomming transfer is in progress and reload is issued
 - Fix socket polling when configured with many interfaces and threads
 - Fix compilation against Nettle 3.2

 - Select correct source address for UDP messages recieved on ANY address
 - Extend documentation of knotc commands

Knot DNS 2.1.0 (2016-01-14)

 - Per-thread UDP socket binding using SO_REUSEPORT on Linux
 - Support for dynamic configuration database
 - DNSSEC: Support for cryptographic tokens via PKCS #11 interface
 - DNSSEC: Experimental support for online signing

 - Support for zone file name patterns
 - Configurable location of zone timer database
 - Non-blocking network operations and better timeout handling
 - Caching of Critical configuration values for better performance
 - Logging of ACL failures
 - RRL: Add rate-limit-slip zero support to drop all responses
 - RRL: Document behavior for different rate-limit-slip options
 - kdig: Warning instead of error on TSIG validation failure
 - Cleanup of support libraries interfaces (libknot, libzscanner, libdnssec)
 - Remove possibly insecure server control over a network socket
 - Remove implementation limit for the number of network interfaces

 - synth-record module: Fix application of default configuration options
 - TSIG: Allow compressed TSIG name when forwarding DDNS updates
 - Schedule zone bootstrap after slave zone fails to load from disk

Revision 1.28 / (download) - annotate - [select for diffs], Thu Feb 25 16:20:51 2016 UTC (7 years, 3 months ago) by jperkin
Branch: MAIN
Changes since 1.27: +2 -6 lines
Diff to previous 1.27 (colored)


Revision 1.27 / (download) - annotate - [select for diffs], Sun Dec 13 00:01:29 2015 UTC (7 years, 5 months ago) by pettai
Branch: MAIN
CVS Tags: pkgsrc-2015Q4-base, pkgsrc-2015Q4
Changes since 1.26: +2 -2 lines
Diff to previous 1.26 (colored)

Knot DNS 2.0.2

 - Out-of-bound read in packet parser for malformed NAPTR records (LibFuzzer)

Revision 1.26 / (download) - annotate - [select for diffs], Tue Oct 27 18:56:40 2015 UTC (7 years, 7 months ago) by pettai
Branch: MAIN
Changes since 1.25: +7 -1 lines
Diff to previous 1.25 (colored)

Disable recvmmsg() on NetBSD as a workaround.
(NetBSD's implementation of recvmmsg() is not 100% with the Linux version)

Revision 1.25 / (download) - annotate - [select for diffs], Mon Oct 26 19:23:08 2015 UTC (7 years, 7 months ago) by pettai
Branch: MAIN
Changes since 1.24: +14 -4 lines
Diff to previous 1.24 (colored)

Knot DNS 2.0.1 (2015-09-02)

 - Do not reload expired zones on 'knotc reload' and server startup
 - Fix rare race-condition in event scheduling causing delayed event execution
 - Fix skipping of non-authoritative nodes in NSEC proofs
 - Fix TC flag setting in RRL slipped answers
 - Disable domain name compression for root label
 - Log via journald only when running under systemd
 - Fix CNAME following when quering for NSEC RR type
 - Fix refreshing of DNSSEC signatures for zone keys
 - Fix binding an unavailable IPv6 address on Linux (IP_FREEBIND)
 - Fix infinite loop in knotc zonestatus and memstats
 - Fix memory leak in configuration on server shutdown
 - Fix broken dnsproxy module
 - Fix DNSSEC KASP timestamps parsing in strict POSIX environment
 - fix multi value parsing on big-endian
 - Adapt to Nettle 3 API break causing base64 decoding failures on big-endian

 - Add 'keymgr zone key ds' to show key's DS record
 - Add 'keymgr tsig generate' to generate TSIG keys
 - Add query module scoping to process either all queries or zone queries only
 - Add support for file name globbing in config file includes
 - Add 'request-edns-option' config option to add custom EDNS0 option into
   server initiated queries

 - Send minimal responses (remove NS from Authority section for NOERROR)
 - Update persistent timers only on shutdown for better performance
 - Allow change of RR TTL over DDNS
 - Documentation fixes, updates, and improvements in formatting
 - Install yparser and zscanner header files
 - Improve lookup of libsystemd build dependencies
 - Fix compilation warnings in endian conversion functions on OpenBSD

Knot DNS 2.0.0 (2015-06-26)

 - Fix lost NOTIFY message if received during zone transfer
 - Disable fast zone parser when compiled in Clang (workaround for Clang bug)
 - kdig: Record correct dnstap SocketProtocol when retrying over TCP
 - kdig: Hide TSIG section with +noall
 - Do not set AA flag for AXFR/IXFR queries

 - DNSSEC: separate library, switch to GnuTLS, new utilities
 - DNSSEC: basic KASP support (generate initial keys, ZSK rollover)
 - Configuration: New text format in YAML, binary store in LMDB
 - Zone parser: Split long TXT/SPF strings into multiple strings
 - kdig: Add generic dump style option (+generic)
 - Try all master servers in multi-master environment
 - Improved remotes and ACLs (multiple addresses, multiple keys)
 - Basic support for zone file patterns (%s to substitute zone name)
 - Disable zone file synchronization by setting 'zonefile_sync' to '-1'
 - knsupdate: Add input prompt in interactive mode and 'quit' command
 - knsupdate: Allow TSIG algorithm specification in interactive prompt

 - Zone dump: Do not write class for SOA record (unified with other RR types)
 - Zone dump: Do not write master server address into the zone file
 - Documentation: Manual pages are included in HTML and PDF

Revision 1.24 / (download) - annotate - [select for diffs], Tue Jun 30 13:17:10 2015 UTC (7 years, 11 months ago) by pettai
Branch: MAIN
CVS Tags: pkgsrc-2015Q3-base, pkgsrc-2015Q3
Changes since 1.23: +3 -4 lines
Diff to previous 1.23 (colored)

fix rc script

Revision 1.23 / (download) - annotate - [select for diffs], Sun Jan 18 16:00:02 2015 UTC (8 years, 4 months ago) by wiedi
Branch: MAIN
CVS Tags: pkgsrc-2015Q2-base, pkgsrc-2015Q2, pkgsrc-2015Q1-base, pkgsrc-2015Q1
Changes since 1.22: +2 -1 lines
Diff to previous 1.22 (colored)

bulk build wants zlib

Revision 1.22 / (download) - annotate - [select for diffs], Mon Nov 10 21:20:32 2014 UTC (8 years, 6 months ago) by pettai
Branch: MAIN
CVS Tags: pkgsrc-2014Q4-base, pkgsrc-2014Q4
Changes since 1.21: +2 -2 lines
Diff to previous 1.21 (colored)

Knot DNS 1.5.3 (2014-09-15)

 - Some specific incoming IXFRs were causing server to crash
 - Rare sychronization error during reload caused read-after-free
 - Response synthetization module did not work properly with
   DNSSEC-enabled zones
 - When Knot sent AXFR when IXFR was requested, message ID and
   opcode were wrong
 - Knot failed to send large messages to remote control
   (present since 1.5.1)

Knot DNS 1.5.2 (2014-09-08)

 - Some RR parsing corner cases were not handled properly
 - AXFR-style IXFR was refused and had to be retransfered
 - Hash character (#) was not properly escaped when storing text zone file

Knot DNS 1.5.1 (2014-08-19)

 - Basic support for logging using systemd journal
 - DDNS: Ability to process updates in bulk

 - Unified logging messages structure
 - DNSSEC: More strict controls for signing keys

 - DNSSEC: DNAMEs in RDATA were not lowercased before signing
 - EDNS: OPT RR were not put into responsing for some errors
 - TSIG: DDNS responses were not signed with TSIG
 - DDNS: Prerequisite checks failed for some inputs
 - knsupdate: Zone origin was not used for deletions

Knot DNS 1.5.0 (2014-07-08)

 - DDNS forwarding reimplemented

 - Transfer sizes logged in bytes if needed
 - Logging outgoing NOTIFY messages
 - Logging unauthorized incoming NOTIFYs

 - Zone flush planning after bootstrap
 - Incorrect incoming AXFR message sizes
 - DDNS signing changes were freed too soon, posibility of stale data
 - knotc remote control key handling

Knot DNS 1.5.0-rc2 (2014-06-18)

 - edns-client-subnet support in kdig
 - Optional asynchronous startup (config "asynchronous-start")

 - Preempt task queue for faster reload
 - Lazy zone file write after zone transfer (governed by

 - Close zone transfer after SERVFAIL response
 - Incremental to full zone transfer fallback, wrong log message
 - Zone events corner cases, reload replanning

Knot DNS 1.5.0-rc1 (2014-06-03)

 - Pluggable query processing modules
 - Synthetic IPv4/IPv6 reverse/forward records (optional module)
 - dnstap support in both utilities & server (optional module)
 - NOTIFY message support and new TSIG section in kdig
 - Zone transfer master failover

 - Query processing and core functionality overhaul
 - Performance and reduced memory footprint
 - Faster zone events scheduling
 - RFC compliant queries/responses in some corner cases
 - Log messages
 - New documentation (Sphinx)

Revision 1.21 / (download) - annotate - [select for diffs], Sat Sep 27 21:27:11 2014 UTC (8 years, 8 months ago) by pettai
Branch: MAIN
CVS Tags: pkgsrc-2014Q3-base, pkgsrc-2014Q3
Changes since 1.20: +2 -3 lines
Diff to previous 1.20 (colored)

v1.4.7 - Jun 18, 2014
        * Fixed DDNS corner cases
        * Fixed zone EXPIRE timer
        * Fixed semantic checks false positives
        * Fixed sending malformed IXFR with automatic DNSSEC
        * Fixed NAPTR record serialization

Revision 1.20 / (download) - annotate - [select for diffs], Sun Jun 29 06:53:41 2014 UTC (8 years, 11 months ago) by dholland
Branch: MAIN
CVS Tags: pkgsrc-2014Q2-base, pkgsrc-2014Q2
Changes since 1.19: +3 -1 lines
Diff to previous 1.19 (colored)

add missing openssl buildlink, appeared in linux build

Revision 1.19 / (download) - annotate - [select for diffs], Mon Jun 2 11:57:17 2014 UTC (9 years ago) by pettai
Branch: MAIN
Changes since 1.18: +2 -2 lines
Diff to previous 1.18 (colored)

v1.4.6 - May 22, 2014
        * Fix possible signing loop when doing key rollover
        * Fixed sending of malformed UDP empty responses

Revision 1.18 / (download) - annotate - [select for diffs], Mon May 12 14:52:54 2014 UTC (9 years ago) by pettai
Branch: MAIN
Changes since 1.17: +2 -2 lines
Diff to previous 1.17 (colored)

v1.4.5 - Apr 14, 2014
        * Fix possible weakness in TSIG signature checking

Revision 1.17 / (download) - annotate - [select for diffs], Wed Apr 2 21:08:22 2014 UTC (9 years, 2 months ago) by pettai
Branch: MAIN
Changes since 1.16: +2 -2 lines
Diff to previous 1.16 (colored)

v1.4.4 - Mar 24, 2014
        * Server is logging remote control commands
        * 'knotc reload' doesn't refresh unchanged zones
        * 'knotc -f refresh' forces zone retransfer
        * Missing notifications after DDNS/automatic resign
        * Zone is rebootstrapped if the zone file is unreadable
        * Progressive bootstrap retry backoff
        * Zone file parser allows asterisk as part of the label
        * Journal maximum entry size fixes
        * Sign DNSKEYs in non-apex nodes as regular RR sets
        * Various spelling and typo fixes

Revision 1.16 / (download) - annotate - [select for diffs], Fri Mar 21 12:23:52 2014 UTC (9 years, 2 months ago) by wiz
Branch: MAIN
CVS Tags: pkgsrc-2014Q1-base, pkgsrc-2014Q1
Changes since 1.15: +2 -2 lines
Diff to previous 1.15 (colored)

Fix MASTER_SITES. Addresses PR 48673.

Revision 1.15 / (download) - annotate - [select for diffs], Sun Mar 9 19:00:13 2014 UTC (9 years, 3 months ago) by pettai
Branch: MAIN
Changes since 1.14: +2 -2 lines
Diff to previous 1.14 (colored)

v1.4.3 - Feb 13, 2014
        * Failure when expanding wildcard leading to apex and having DNSKEY records
        * Failure for query to wildcard without wildcard expansion
        * Bad cleanup when loading a faulty entry from a journal
        * Zone file $ORIGIN and configuration comparison is case-insensitive
        * Config "include" statement supports directory and includes all files within

Revision 1.14 / (download) - annotate - [select for diffs], Mon Feb 3 15:32:14 2014 UTC (9 years, 4 months ago) by pettai
Branch: MAIN
Changes since 1.13: +5 -2 lines
Diff to previous 1.13 (colored)

Add comment on how to fetch the distfile, if "make fetch" fails

Revision 1.13 / (download) - annotate - [select for diffs], Sun Feb 2 13:51:50 2014 UTC (9 years, 4 months ago) by wiz
Branch: MAIN
Changes since 1.12: +1 -3 lines
Diff to previous 1.12 (colored)


Revision 1.12 / (download) - annotate - [select for diffs], Fri Jan 31 22:05:43 2014 UTC (9 years, 4 months ago) by pettai
Branch: MAIN
Changes since 1.11: +4 -2 lines
Diff to previous 1.11 (colored)

v1.4.2 - Jan 27, 2014
        * AXFR/IXFR compatibility issues with tinydns/axfrdns
        * Journal file is created only when needed
        * Zone-related log messages are logged into correct category
        * DNSSEC: Refresh signatures earlier (3 days before their expiration
          with the default signature lifetime)
        * Fixed RCU synchronization causing deadlock on 'knotc signzone'
        * RRSIG not fitting in the additional records doesn't cause truncation

v1.4.1 - Jan 13, 2014
        * Empty APL record support
        * 'zonestatus' when using immediate zone syncing
        * Immediate zone syncing after reload
        * Race condition writing time values to zone file

v1.4.0 - Jan 6, 2014
        * Zone SERIAL policies (INCREMENT, UNIXTIME)
        * AXFR crash with specific packet
        * QNAME case-sensitive since 1.4.0-rc0
        * DNSSEC records over DDNS
        * Semantic check fail in AXFR is only soft-error
        * Journal race condition
        * Notifies are sent immediately

v1.4.0-rc2 - Dec 13, 2013
        * IDN support in Knot utilities
        * DNSSEC: support for GOST algorithm

        * Crash in particular additionals processing
        * Race condition in event cancelation
        * Journal corruption after failed transactions
        * DNSSEC: fixed detection of ECDSA support

Other improvements:
        * ./configure prints build configuration summary
        * Pretty zone file output (DNSSEC-related data separately)
        * Lower memory consumption
        * config: option 'dnssec-keydir' can be set per zone
        * config: option 'storage' can be set per zone

v1.4.0-rc1 - Nov 20, 2013

        * Better logging of automatic DNSSEC events
        * Support for DNSSEC key pre-publication
        * Refactored zone loading
        * Improved journal locking and fixed some race conditions
        * Various fixes in client utilities
        * Fixed memory errors in automatic DNSSEC signing
        * 'dnssec-keydir' doesn't auto-enable signing
        * Fixed rescheduling of zone resigns

v1.4.0-beta - Oct 28, 2013
        * Experimental automatic DNSSEC signing
        * Reduced memory usage

Revision 1.11 / (download) - annotate - [select for diffs], Mon Jan 27 18:41:14 2014 UTC (9 years, 4 months ago) by wiz
Branch: MAIN
Changes since 1.10: +1 -3 lines
Diff to previous 1.10 (colored)

Do not set FETCH_USING, should not be set in a package Makefile.

Revision 1.10 / (download) - annotate - [select for diffs], Sat Nov 9 22:17:45 2013 UTC (9 years, 6 months ago) by pettai
Branch: MAIN
CVS Tags: pkgsrc-2013Q4-base, pkgsrc-2013Q4
Changes since 1.9: +2 -2 lines
Diff to previous 1.9 (colored)

v1.3.3 - Oct 28, 2013
        * Improved zone loading error messages
        * Correct control socket permissions
        * Improved log syntax documentation
        * Fixed wrong assertions in DDNS prerequisites checking
        * Fixed processing of some malformed DNS packets
        * Fixed notify messages being ignored in some cases

v1.3.2 - Sep 30, 2013
        * Configuration option for EDNS0 max UDP payload.
        * Max UDP payload from EDNS0 affected TCP responses.
        * Fixed build on SLE 10.
        * knotc reload did not close files included from config.

Revision 1.9 / (download) - annotate - [select for diffs], Fri Sep 13 18:14:11 2013 UTC (9 years, 8 months ago) by pettai
Branch: MAIN
CVS Tags: pkgsrc-2013Q3-base, pkgsrc-2013Q3
Changes since 1.8: +3 -3 lines
Diff to previous 1.8 (colored)

v1.3.1 - Aug 26, 2013
        * Response with NSID contained extra bytes after reload
        * List of remotes is scanned for longest prefix match
        * Multipacket TSIG signatures for transfers
        * Wrongly parsed TSIG key secret without quotes
        * Removed autoconf checks for extended instruction sets

v1.3.0 - Aug 5, 2013
        * Defaults for CH TXT id.server,version.server (see doc)
        * Progressive interval for bootstrap retry
        * Transfers randomly cancelled
        * Disabling RRL on reload
        * Secondary groups not initialized when dropping privileges
        * Responding to DS queries for names at or below delegation points

v1.3.0-rc5 - Jul 29, 2013
        * Much faster bootstrap of many zones
        * Removed deprecated 'knotc -w' option
        * Slave ignores out-of-zone records in zone
        * Support for obsolete types in zone transfers
        * Slave zone file names fixes
        * Long transfers being randomly dropped

v1.3.0-rc4 - Jul 15, 2013
        * --with-configdir option for default config path
        * Reintroducted 'pidfile' config option
        * AXFR/IXFR subsystem performance improvements
        * Rescheduling of AXFR in some cases
        * RRSIGs not in the same section for DS records
        * Log messages leaking to syslog
        * 'knotc restart' option removed due to several limitations

v1.3.0-rc3 - Jun 28, 2013

        * Utility to estimate memory consumption (see 'knotc memstats')
        * PID file is not created when running on foreground
        * UNIX sockets support for knotc
        * Configurable 'rundir' and 'storage'

        * IXFR with an arbitrary number of diffs
        * Processing of knotc TSIG keyfile
        * Atomic PID file writing, removed deprecated 'knotc start'
        * Performance regression when RRSIGs came before covered RRs in AXFR

v1.3.0-rc2 - Jun 14, 2013

        * Label compression related bug
        * Proper resolution of some CNAME chains
        * Unstable response rate in rare cases
        * Several log messages

v1.3.0-rc1 - Jun 4, 2013

        * Faster zone parser
        * Full support for EUI and ILNP resource records
        * Lower memory footprint for large zones
        * No compilation of zones
        * Improved scheduling of zone transfers
        * Logging of serials and timing information for zone transfers
        * Config: 'groups' keyword allowing to create groups of remotes
        * Config: 'include' keyword allowing other file includes
        * Client utilities: kdig, khost, knsupdate
        * Server identification using TXT/CH queries (RFC 4892)
        * Improved build scripts
        * Improved dname compression and performance
        * Fixed creating of PID file when dropping privileges

Revision 1.8 / (download) - annotate - [select for diffs], Tue May 14 08:16:05 2013 UTC (10 years ago) by pettai
Branch: MAIN
CVS Tags: pkgsrc-2013Q2-base, pkgsrc-2013Q2
Changes since 1.7: +2 -2 lines
Diff to previous 1.7 (colored)

v1.2.0 - Mar 29, 2013

        * Memory leaks


        * knotc 'zonestatus' command

        * Check for broken recvmmsg() implementation
        * Changing logfile ownership before dropping privileges
        * knotc respects 'control' section from configuration
        * RRL: resolved bucket collisions
        * RRL: updated bucket mapping to conform RRL technical memo


        * Response rate limiting (see documentation)

        * Fixed OpenBSD build
        * Responses to ANY should contain RRSIGs


        * Fixed processing of some non-standard dnames.
        * Correct checking of label length bounds in some cases.
        * More compliant rcodes in case of DDNS/TSIG failures.
        * Correct processing of malformed DDNS prereq section.


        * Dynamic updates, including forwarding (limited on signed zones)
        * Updated remote control utility
        * Configurable TCP timeouts
        * LOC RR support

Revision 1.7 / (download) - annotate - [select for diffs], Sun Dec 23 23:38:08 2012 UTC (10 years, 5 months ago) by pettai
Branch: MAIN
CVS Tags: pkgsrc-2013Q1-base, pkgsrc-2013Q1, pkgsrc-2012Q4-base, pkgsrc-2012Q4
Changes since 1.6: +2 -2 lines
Diff to previous 1.6 (colored)

v1.1.3 - Dec 19, 2012

        * Updated manpage.

v1.1.3-rc1 - Dec 6, 2012

        * Fixed answering DS queries (RRSIGs not together with DS, AA bit
        * Fixed setting ARCOUNT in some error responses with EDNS enabled.
        * Fixed crash when compiling zone zone with NSEC3PARAM but no NSEC3
          and semantic checks enabled.

Revision 1.6 / (download) - annotate - [select for diffs], Thu Dec 20 07:50:19 2012 UTC (10 years, 5 months ago) by pettai
Branch: MAIN
Changes since 1.5: +2 -2 lines
Diff to previous 1.5 (colored)

Added flex

Revision 1.5 / (download) - annotate - [select for diffs], Tue Dec 18 17:03:56 2012 UTC (10 years, 5 months ago) by pettai
Branch: MAIN
Changes since 1.4: +2 -2 lines
Diff to previous 1.4 (colored)

USE_TOOLS+= bison
(instead of using incompatible (f)lex found on some platforms)

Revision 1.4 / (download) - annotate - [select for diffs], Fri Nov 23 23:24:52 2012 UTC (10 years, 6 months ago) by pettai
Branch: MAIN
Changes since 1.3: +2 -2 lines
Diff to previous 1.3 (colored)

v1.1.2 - Nov 21, 2012

        * Fixed debug message.

v1.1.2-rc1 - Nov 14, 2012

        * Fixed crash on reload when config contained duplicate zones.
        * Fixed scheduling of transfers.

Revision 1.3 / (download) - annotate - [select for diffs], Mon Nov 5 23:08:06 2012 UTC (10 years, 7 months ago) by pettai
Branch: MAIN
Changes since 1.2: +8 -6 lines
Diff to previous 1.2 (colored)

v1.1.1 - Oct 31, 2012

        * Fixed assertion failing when asking directly for a wildcard name.

v1.1.1-rc1 - Oct 23, 2012

        * Crash after IXFR in certain cases when adding RRSIG in an IXFR.
        * Fixed behaviour when incoming IXFR removes a zone cut. Previously
          occluded names now become properly visible. Previously lead to a
          crash when the server was asked for the previously occluded name.
        * Fixed handling of zero-length strings in text zone dump. Caused the
          compilation to fail.
        * Fixed TSIG algorithm name comparison - the names should be in
          canonical form.
        * Fixed handling unknown RR types with type less than 251.

        * Improved compression of packets. Out-of-zone dnames present in RDATA
          were not compressed.
        * Slave zones are now automatically refreshed after startup.
        * Proper response to IXFR/UDP query (returns SOA in Authority section).

Revision 1.2 / (download) - annotate - [select for diffs], Tue Oct 23 17:18:31 2012 UTC (10 years, 7 months ago) by asau
Branch: MAIN
Changes since 1.1: +1 -3 lines
Diff to previous 1.1 (colored)

Drop superfluous PKG_DESTDIR_SUPPORT, "user-destdir" is default these days.

Revision 1.1 / (download) - annotate - [select for diffs], Tue Oct 2 22:40:07 2012 UTC (10 years, 8 months ago) by pettai
Branch: MAIN

Knot DNS is a high-performance authoritative-only DNS server
which supports all key features of the domain name system including
zone transfers, dynamic updates and DNSSEC.

This form allows you to request diff's between any two revisions of a file. You may select a symbolic revision name using the selection box or you may type in a numeric name using the type-in text box.

CVSweb <>