| Index | index by Group | index by Distribution | index by Vendor | index by creation date | index by Name | Mirrors | Help | Search |
| Name: knot-dnssecutils | Distribution: Fedora Project |
| Version: 3.2.13 | Vendor: Fedora Project |
| Release: 1.el7 | Build date: Tue Jun 25 18:31:39 2024 |
| Group: Unspecified | Build host: buildvm-ppc64le-07.iad2.fedoraproject.org |
| Size: 1811381 | Source RPM: knot-3.2.13-1.el7.src.rpm |
| Packager: Fedora Project | |
| Url: https://www.knot-dns.cz | |
| Summary: DNSSEC tools shipped with the Knot DNS server | |
The package contains DNSSEC tools shipped with the Knot DNS server.
GPL-3.0-or-later
* Tue Jun 25 2024 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.2.13-1
- Update to 3.2.13
* Wed Jan 24 2024 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.2.12-1
- Update to 3.2.12
* Mon Oct 30 2023 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.2.11-1
- Update to 3.2.11
* Tue Sep 12 2023 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.2.10-1
- Update to 3.2.10
* Thu Jul 27 2023 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.2.9-1
- Update to 3.2.9
* Mon Jun 26 2023 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.2.8-1
- Update to 3.2.8
* Tue Jun 06 2023 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.2.7-1
- Update to 3.2.7
* Thu Apr 06 2023 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.2.6-1
- Update to 3.2.6
* Thu Feb 02 2023 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.2.5-1
- Update to 3.2.5
* Mon Dec 12 2022 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.2.4-1
- Update to 3.2.4
- Use devtoolset-12-gcc on EPEL 7
* Mon Nov 21 2022 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.2.3-1
- Update to 3.2.3
* Tue Nov 01 2022 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.2.2-1
- Update to 3.2.2
* Fri Sep 09 2022 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.2.1-1
- Update to 3.2.1
- Remove patches included upstream
- Update Conflicts and move to knot-libs
* Mon Aug 22 2022 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.2.0-1
- Update to 3.2.0
- Patch: fix tests on 32-bit platforms
- Patch: revert problematic hardening of service file
- Patch: revert config improvement to support EL 7
- New knot-dnssecutils subpackage
- Debian compat (knot-utils vs knot-dnsutils)
- Remove bundled(jquery) version as it differes between distros
* Thu Apr 28 2022 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.1.8-1
- Update to 3.1.8
* Wed Mar 30 2022 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.1.7-1
- Update to 3.1.7
* Thu Feb 10 2022 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.1.6-1
- Update to 3.1.6
- Use _sharedstatedir for home
* Wed Jan 05 2022 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.1.5-1
- Update to 3.1.5
* Thu Nov 04 2021 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.1.4-1
- Update to 3.1.4
* Tue Oct 19 2021 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.1.3-1
- Update to 3.1.3
* Thu Sep 09 2021 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.1.2-1
- Update to 3.1.2
* Tue Aug 10 2021 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.1.1-1
- Update to 3.1.1
- Enable XDP on ARM and improve XDP config macros
- Remove patch included upstream
* Wed Aug 04 2021 Jakub Ružička <jakub.ruzicka@nic.cz> 3.1.0-2
- Introduce a patch to fix tests on ppc64le
- Use autosetup macro to apply patches
* Mon Aug 02 2021 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.1.0-1
- Update to 3.1.0
- Add missing BuildRequires including new libmnl for kxdpgun
- Temporarily disable XDP on ARM until issues are resolved
* Fri Jul 16 2021 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.0.8-1
- Update to 3.0.8
- Print failed tests during check
* Thu Jun 17 2021 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.0.7-1
- Update to 3.0.7
* Fri May 14 2021 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.0.6-1
- Update to 3.0.6
* Tue Mar 30 2021 Jakub Ružička <jakub.ruzicka@nic.cz> 3.0.5-1
- Update to 3.0.5
- Properly escape BASE_VERSION macro
- Include module dirs in main package
* Mon Feb 01 2021 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.0.4-1
- Update to 3.0.4
- Move dnstap module to subpackage
- Move geoip module to subpackage
- Remove redundant VERSION macro
* Thu Dec 17 2020 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.0.3-1
- Update to 3.0.3
* Wed Nov 11 2020 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.0.2-1
- Update to 3.0.2
* Mon Oct 12 2020 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.0.1-1
- Update to 3.0.1
- Sync packaging from upstream
* Fri Sep 25 2020 Jakub Ružička <jakub.ruzicka@nic.cz> 3.0.0-2
- Rebuild
* Thu Sep 10 2020 Jakub Ružička <jakub.ruzicka@nic.cz> 3.0.0-1
- New major upstream release 3.0.0
- Sync packaging from upstream
* Wed Sep 02 2020 Jakub Ružička <jakub.ruzicka@nic.cz> 2.9.6-1
- Update to 2.9.6
* Mon May 25 2020 Tomas Krizek <tomas.krizek@nic.cz> - 2.9.5-1
- new upstream release 2.9.5
* Tue May 05 2020 Tomas Krizek <tomas.krizek@nic.cz> - 2.9.4-1
- new upstream release 2.9.4
* Tue Mar 03 2020 Tomas Krizek <tomas.krizek@nic.cz> - 2.9.3-1
- new upstream release 2.9.3
* Fri Dec 13 2019 Tomas Krizek <tomas.krizek@nic.cz> - 2.9.2-1
- new upstream release 2.9.2
* Tue Nov 12 2019 Tomas Krizek <tomas.krizek@nic.cz> - 2.9.1-1
- New upstream release 2.9.1
- add EPEL8 compatibility
- fix unsafe PGP keyring permissions
* Tue Sep 24 2019 Tomas Krizek <tomas.krizek@nic.cz> - 2.8.4-1
- new upstream release 2.8.4
* Wed Aug 21 2019 Tomas Krizek <tomas.krizek@nic.cz> - 2.8.3-1
- new upstream release 2.8.3
* Thu Jul 11 2019 Tomas Krizek <tomas.krizek@nic.cz> - 2.8.2-1
- rebase to latest upstream version 2.8.2
* Mon Oct 01 2018 Tomas Krizek <tomas.krizek@nic.cz> - 2.6.9-1
Knot DNS 2.6.9 (2018-08-14)
===========================
Improvements:
-------------
- Added zone wire size to zone loading log message
- Added debug log message for each unsuccessful remote address operation
Bugfixes:
---------
- Zone not flushed after re-signing during zone load #594
- Server crashes when committing empty zone transaction
- Incoming IXFR with on-slave signing sometimes leads to memory corruption #595
* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.6.8-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
* Wed Jul 11 2018 Tomas Krizek <tomas.krizek@nic.cz> - 2.6.8-1
Knot DNS 2.6.8 (2018-07-10)
===========================
Features:
---------
- New 'import-pkcs11' command in keymgr
Improvements:
-------------
- Unixtime serial policy mimics Bind – increment if lower #593
Bugfixes:
---------
- Creeping memory consuption upon server reload #584
- Kdig incorrectly detects QNAME if 'notify' is a prefix
- Server crashes when zone sign fails #587
- CSK->KZSK rollover retires CSK early #588
- Server crashes when zone expires during outgoing multi-message transfer
- Kjournalprint doesn't convert zone name argument to lower-case
- Cannot switch to a previously used ksk-shared dnssec policy #589
* Thu May 17 2018 Tomas Krizek <tomas.krizek@nic.cz> - 2.6.7-1
Knot DNS 2.6.7 (2018-05-17)
===========================
Features:
---------
- Added 'dateserial' (YYYYMMDDnn) serial policy configuration (Thanks to Wolfgang Jung)
Improvements:
-------------
- Trailing data indication from the packet parser (libknot)
- Better configuration check for a problematical option combination
Bugfixes:
---------
- Incomplete configuration option item name check
- Possible buffer overflow in 'knot_dname_to_str' (libknot)
- Module dnsproxy doesn't preserve letter case of QNAME
- Module dnsproxy duplicates OPT and TSIG in the non-fallback mode
* Wed Apr 11 2018 Tomas Krizek <tomas.krizek@nic.cz> - 2.6.6-1
Knot DNS 2.6.6 (2018-04-11)
===========================
Features:
---------
- New EDNS option counters in the statistics module
- New '+orphan' filter for the 'zone-purge' operation
Improvements:
-------------
- Reduced memory consuption of disabled statistics metrics
- Some spelling fixes (Thanks to Daniel Kahn Gillmor)
- Server no longer fails to start if MODULE_DIR doesn't exist
- Configuration include doesn't fail if empty wildcard match
- Added a configuration check for a problematical option combination
Bugfixes:
---------
- NSEC3 chain not re-created when SOA minimum TTL changed
- Failed to start server if no template is configured
- Possibly incorrect SOA serial upon changed zone reload with DNSSEC signing
- Inaccurate outgoing zone transfer size in the log message
- Invalid dname compression if empty question section
- Missing EDNS in EMALF responses
* Mon Mar 26 2018 Iryna Shcherbina <ishcherb@redhat.com> - 2.6.5-2
- Update Python 2 dependency declarations to new packaging standards
(See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3)
* Mon Feb 12 2018 Tomas Krizek <tomas.krizek@nic.cz> - 2.6.5-1
- New upstream release 2.6.5
Knot DNS 2.6.5 (2018-02-12)
===========================
Features:
---------
- New 'zone-notify' command in knotc
- Kdig uses '@server' as a hostname for TLS authenticaion if '+tls-ca' is set
Improvements:
-------------
- Better heap memory trimming for zone operations
- Added proper polling for TLS operations in kdig
- Configuration export uses stdout as a default output
- Simplified detection of atomic operations
- Added '--disable-modules' configure option
- Small documentation updates
Bugfixes:
---------
- Zone retransfer doesn't work well if more masters configured
- Kdig can leak or double free memory in corner cases
- Inconsistent error outputs from dynamic configuration operations
- Failed to generate documentation on OpenBSD
* Fri Feb 09 2018 Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 2.6.4-3
- Escape macros in %changelog
* Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.6.4-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
* Mon Jan 22 2018 Tomas Krizek <tomas.krizek@nic.cz> - 2.6.4-1
- Added PGP signature verification
- Added integration test
- New upstream release 2.6.4
Knot DNS 2.6.4 (2018-01-02)
===========================
Features:
---------
- Module synthrecord allows multiple 'network' specification
- New CSK handling support in keymgr
Improvements:
-------------
- Allowed configuration for infinite zsk lifetime
- Increased performance and security of the module synthrecord
- Signing changeset is stored into journal even if 'zonefile-load' is whole
Bugfixes:
---------
- Unintentional zone re-sign during reload if empty NSEC3 salt
- Inconsistent zone names in journald structured logs
- Malformed outgoing transfer for big zone with TSIG
- Some minor DNSSEC-related issues
Knot DNS 2.6.3 (2017-11-24)
===========================
Bugfixes:
---------
- Wrong detection of signing scheme rollover
Knot DNS 2.6.2 (2017-11-23)
===========================
Features:
---------
- CSK algorithm rollover and (KSK, ZSK) <-> CSK rollover support
Improvements:
-------------
- Allowed explicit configuration for infinite ksk lifetime
- Proper error messages instead of unclear error codes in server log
- Better support for old compilers
Bugfixes:
---------
- Unexpected reply for DS query with an owner below a delegation point
- Old dependencies in the pkg-config file
* Mon Nov 06 2017 Petr Špaček <petr.spacek@nic.cz> - 2.6.1-1
- New upstream release 2.6.1
Knot DNS 2.6.1 (2017-11-02)
===========================
Features:
---------
- NSEC3 Opt-Out support in the DNSSEC signing
- New CDS/CDNSKEY publish configuration option
Improvements:
-------------
- Simplified DNSSEC log message with DNSKEY details
- +tls-hostname in kdig implies +tls-ca if neither +tls-ca nor +tls-pin is given
- New documentation sections for DNSSEC key rollovers and shared keys
- Keymgr no longer prints useless algorithm number for generated key
- Kdig prints unknown RCODE in a numeric format
- Better support for LLVM libFuzzer
Bugfixes:
---------
- Faulty DNAME semantic check if present in the zone apex and NSEC3 is used
- Immediate zone flush not scheduled during the zone load event
- Server crashes upon dynamic zone addition if a query module is loaded
- Kdig fails to connect over TLS due to SNI is set to server IP address
- Possible out-of-bounds memory access at the end of the input
- TCP Fast Open enabled by default in kdig breaks TLS connection
Knot DNS 2.6.0 (2017-09-29)
===========================
Features:
---------
- On-slave (inline) signing support
- Automatic DNSSEC key algorithm rollover
- Ed25519 algorithm support in DNSSEC (requires GnuTLS 3.6.0)
- New 'journal-content' and 'zonefile-load' configuration options
- keymgr tries to run as user/group set in the configuration
- Public-only DNSSEC key import into KASP DB via keymgr
- NSEC3 resalt and parent DS query events are persistent in timer DB
- New processing state for a response suppression within a query module
- Enabled server side TCP Fast Open if supported
- TCP Fast Open support in kdig
Improvements:
-------------
- Better record owner compression if related to the previous rdata dname
- NSEC(3) chain is no longer recomputed whole on every update
- Remove inconsistent and unnecessary quoting in log files
- Avoiding of overlapping key rollovers at a time
- More DNSSSEC-related semantic checks
- Extended timestamp format in keymgr
Bugfixes:
---------
- Incorrect journal free space computation causing inefficient space handling
- Interface-automatic broken on Linux in the presence of asymmetric routing
Knot DNS 2.5.5 (2017-09-29)
===========================
Improvements:
-------------
- Constant time memory comparison in the TSIG processing
- Proper use of the ctype functions
- Generated RRSIG records have inception time 90 minutes in the past
Bugfixes:
---------
- Incorrect online signature for NSEC in the case of a CNAME record
- Incorrect timestamps in dnstap records
- EDNS Subnet Client validation rejects valid payloads
- Module configuration semantic checks are not executed
- Kzonecheck segfaults with unusual inputs
Knot DNS 2.5.4 (2017-08-31)
===========================
Improvements:
-------------
- New minimum and maximum refresh interval config options (Thanks to Manabu Sonoda)
- New warning when unforced flush with disabled zone file synchronization
- New 'dnskey' keymgr command
- Linking with libatomic on architectures that require it (Thanks to Pierre-Olivier Mercier)
- Removed 'OK' from listing keymgr command outputs
- Extended journal and keymgr documentation and logging
Bugfixes:
---------
- Incorrect handling of specific corner-cases with zone-in-journal
- The 'share' keymgr command doesn't work
- Server crashes if configured with query-size and reply-size statistics options
- Malformed big integer configuration values on some 32-bit platforms
- Keymgr uses local time when parsing date inputs
- Memory leak in kdig upon IXFR query
* Mon Jul 31 2017 Petr Spacek <petr.spacek@nic.cz> - 2.5.3-1
- new upstream release
WARNING: Automatic upgrade from versions 1.y.z is no longer possible.
To migrate, upgrade your packages gradually or use contacts listed on
https://www.knot-dns.cz/support/ (if you are in trouble).
* Mon Jul 31 2017 Petr Spacek <petr.spacek@nic.cz> - 2.5.3-2
- disable dnstap on RHEL (depedencies are missing)
* Mon Jul 31 2017 Petr Spacek <petr.spacek@nic.cz> - 2.5.3-1
- new upstream release
WARNING: Automatic upgrade from versions 1.y.z is no longer possible.
To migrate, upgrade your packages gradually or use contacts listed on
https://www.knot-dns.cz/support/ (if you are in trouble).
Knot DNS 2.5.3 (2017-07-14)
===========================
Features:
---------
- CSK rollover support for Single-Type Signing Scheme
Improvements:
-------------
- Allowed binding to non-local adresses for TCP (Thanks to Julian Brost!)
- New documentation section for manual DNSSEC key algorithm rollover
- Initial KSK also generated in the submission state
- The 'ds' keymgr command with no parameter uses all KSK keys
- New debug mode in kjournalprint
- Updated keymgr documentation
Bugfixes:
---------
- Sometimes missing RRSIG by KSK in submission state.
- Minor DNSSEC-related issues
Knot DNS 2.5.2 (2017-06-23)
===========================
Security:
---------
- CVE-2017-11104: Improper TSIG validity period check can allow TSIG forgery (Thanks to Synacktiv!)
Improvements:
-------------
- Extended debug logging for TSIG errors
- Better error message for unknown module section in the configuration
- Module documentation compilation no longer depends on module configuration
- Extended policy section configuration semantic checks
- Improved python version compatibility in pykeymgr
- Extended migration section in the documentation
- Improved DNSSEC event timing on 32-bit systems
- New KSK rollover start log info message
- NULL qtype support in kdig
Bugfixes:
---------
- Failed to process included configuration
- dnskey_ttl policy option in the configuration has no effect on DNSKEY TTL
- Corner case journal fixes (huge changesets, OpenWRT operation)
- Confusing event timestamps in knotc zone-status output
- NSEC/NSEC3 bitmap not updated for CDS/CDNSKEY
- CDS/CDNSKEY RRSIG not updated
Knot DNS 2.5.1 (2017-06-07)
===========================
Bugfixes:
---------
- pykeymgr no longer crash on empty json files in the KASP DB directory
- pykeymgr no longer imports keys in the "removed" state
- Imported keys in the "removed" state no longer makes knotd to crash
- Including an empty configuration directory no longer makes knotd to crash
- pykeymgr is distributed and installed to the distribution tarball
Knot DNS 2.5.0 (2017-06-05)
===========================
Features:
---------
- KASP database switched from JSON files to LMDB database
- KSK rollover support using CDNSKEY and CDS in the automatic DNSSEC signing
- Dynamic module loading support with proper module API
- Journal can store full zone contents (not only differences)
- Zone freeze/thaw support
- Updated knotc zone-status output with optional column filters
- New '[no]crypto' option in kdig
- New keymgr implementation reflecting KASP database changes
- New pykeymgr for JSON-based KASP database migration
- Removed obsolete knot1to2 utility
Improvements:
-------------
- Added libidn2 support to kdig (with libidn fallback)
- Maximum timer database switched from configure to the server configuration
Knot DNS 2.4.4 (2017-06-05)
===========================
Improvements:
-------------
- Improved error handling in kjournalprint
Bugfixes:
---------
- Zone flush not replanned upon unsuccessful flush
- Journal inconsistency after deleting deleted zone
- Zone events not rescheduled upon server reload (Thanks to Mark Warren)
- Unreliable LMDB mapsize detection in kjournalprint
- Some minor issues found by AddressSanitizer
Knot DNS 2.4.3 (2017-04-11)
===========================
Improvements:
-------------
- New 'journal-db-mode' optimization configuration option
- The default TSIG algorithm for utilities input is HMAC-SHA256
- Implemented sensible default EDNS(0) padding policy (Thanks to D. K. Gillmor)
- Added some more semantic checks on the knotc configuration operations
Bugfixes:
---------
- Missing 'zone' keyword in the YAML output
- Missing trailing dot in the keymgr DS owner output
- Journal logs 'invalid parameter' in several cases
- Some minor journal-related problems
Knot DNS 2.4.2 (2017-03-23)
===========================
Features:
---------
- Zscanner can store record comments placed on the same line
- Knotc status extension with version, configure, and workers parameters
Improvements:
-------------
- Significant incoming XFR speed-up in the case of many zones
Bugfixes:
---------
- Double OPT RR insertion when a global module returns KNOT_STATE_FAIL
- User-driven zscanner parsing logic inconsistency
- Lower serial at master doesn't trigger any errors
- Queries with too long DNAME substitution do not return YXDOMAIN response
- Incorrect elapsed time in the DDNS log
- Failed to process forwarded DDNS request with TSIG
* Mon Mar 13 2017 Petr Spacek <petr.spacek@nic.cz> - 2.4.1-2
- configuration checking was fixed to be compatible with Knot 2.4.x
* Mon Feb 27 2017 Petr Spacek <petr.spacek@nic.cz> - 2.4.1-1
- new upstream release 2.4.1 replaces old 1.6.x series which is not supported
- configuration should be upgraded automatically using knot1to2 tool
- make sure you reviewed the new configuration in /etc/knot directory!
* Fri Feb 10 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.0-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
* Tue Jan 24 2017 Petr Spacek <petr.spacek@nic.cz> - 2.4.0-1
- new upstream release:
+ fix: False positive semantic-check warning about invalid bitmap in NSEC
+ fix: Unnecessary SOA queries upon notify with up to date serial
+ fix: Timers for expired zones are reset on reload
+ fix: Zone doesn't expire when the server is down
+ fix: Failed to handle keys with duplicate keytags
+ fix: Per zone module and global module insconsistency
+ fix: Obsolete online signing module configuration
+ fix: Malformed output from kjournalprint
+ fix: Redundant SO_REUSEPORT activation on the TCP socket
+ fix: Failed to use higher number of background workers
+ improvement: Lower memory consumption with qp-trie
+ improvement: Zone events and zone timers improvements
+ improvement: Print all zone names in the FQDN format
+ improvement: Simplified query module interface
+ improvement: Shared TCP connection between SOA query and transfer
+ improvement: Response Rate Limiting as a module with statistics support
+ improvement: Key filters in keymgr
+ features: New unified LMDB-based zone journal
+ features: Server statistics support
+ features: New statistics module for traffic measuring
+ features: Automatic deletion of retired DNSSEC keys
+ features: New control logging category
* Fri Dec 09 2016 Jan Vcelak <jvcelak@fedoraproject.org> - 2.3.3-1
- new upstream release:
+ fix: double free when failed to apply zone journal
+ fix: zone bootstrap retry interval not preserved upon zone reload
+ fix: DNSSEC related records not flushed if not signed
+ fix: false semantic checks warning about incorrect type in NSEC bitmap
+ fix: memory leak in kzonecheck
+ improvement: all zone names are fully-qualified in log
+ features: new kjournalprint utility
* Thu Nov 17 2016 Jan Vcelak <jvcelak@fedoraproject.org> - 2.3.2-1
- new upstream release:
+ fix: missing glue in some responses
+ fix: knsupdate prompt printing on non-terminal
+ fix: configuration policy item names in documentation
+ fix: segfault on OS X Sierra
+ fix: incorrect %s expansion for the root zone
+ fix: refresh not existing slave zone after restart
+ fix: immediate zone refresh upon restart if refresh already scheduled
+ fix: early zone transfer after restart if transfer already scheduled
+ fix: not ignoring empty non-terminal parents during delegation lookup
+ fix: CD bit clearing in responses
+ fix: compilation error on GNU/kFreeBSD
+ fix: server crash after double zone-commit if journal error
+ improvement: significant speed-up of conf-commit and conf-diff operations
+ improvement: new EDNS Client Subnet API
+ improvement: better semantic-checks error messages
+ improvement: speed-up of knotc if control operation and known socket
+ improvement: zone purge operation purges also zone timers
+ feature: print TLS certificate hierarchy in kdig verbose mode
+ feature: new +subnet alias for +client
+ feature: new mod-whoami and mod-noudp modules
+ feature: new zone-purge control command
+ feature: new log-queries and log-responses options for mod-dnstap
+ feature: simple modules don't require empty configuration section
+ feature: new zone journal path configuration option
+ feature: new timeout configuration option for module dnsproxy
* Mon Aug 29 2016 Jan Vcelak <jvcelak@fedoraproject.org> - 2.3.0-3
- fix post-installation scriptlet (RHBZ #1370939)
* Thu Aug 11 2016 Jan Vcelak <jvcelak@fedoraproject.org> - 2.3.0-2
- endian independent DNS cookies (fixes build on ppc64 and s390x)
* Tue Aug 09 2016 Jan Vcelak <jvcelak@fedoraproject.org> - 2.3.0-1
- new upstream release:
+ fix: No wildcard expansion below empty non-terminal for NSEC signed zone
+ fix: Don't ignore non-existing records to be removed in IXFR
+ fix: Fix kdig IXFR response processing if the transfer content is empty
+ fix: Avoid multiple loads of the same PKCS #11 module
+ improvement: Refactored semantic checks and better error messages
+ improvement: Set TC flag in delegation only if mandatory glue doesn't fit the response
+ improvement: Separate EDNS(0) payload size configuration for IPv4 and IPv6
+ feature: Zone size limit restriction for DDNS, AXFR, and IXFR (CVE-2016-6171)
* Tue Aug 09 2016 Jan Vcelak <jvcelak@fedoraproject.org> - 1.6.8-1
- new upstream release:
+ fix: Transfer of a huge rrset goes into an infinite loop
+ fix: Huge response over TCP contains useless TC bit instead of SERVFAIL
+ fix: Failed to build utilities with disabled daemon
+ fix: Memory leaks during keys removal
+ fix: Rough TSIG packet reservation causes early truncation
+ fix: Minor out-of-bounds string termination write in rrset dump
+ fix: Server crash during stop if failed to open timers DB
+ fix: Failed to compile on OS X older than Sierra
+ fix: Poor minimum UDP-max-size configuration check
+ fix: Failed to receive one-record-per-message IXFR-style AXFR
+ fix: Kdig timeouts when receiving RCODE != NOERROR on subsequent transfer message
+ improvement: Speed-up of rdata addition into a huge rrset
+ improvement: Introduce check of minumum timeout for next refresh
+ improvement: Dnsproxy module can forward all queries without local resolving
* Wed Feb 10 2016 Jan Vcelak <jvcelak@fedoraproject.org> 1.6.7-1
- new upstream release:
+ improvement: Log change of the zone serial number after IXFR transfer
+ improvement: Document operational impact of various RRL settings
+ improvement: Add support for rate-limit-slip zero
+ improvement: Add 'timer-db' configuration option
* Wed Nov 25 2015 Jan Vcelak <jvcelak@fedoraproject.org> 1.6.6-1
- new upstream release:
+ security fix: out-of-bound read in packet parser for malformed NAPTR record
+ fix: systemd startup notifications
* Wed Sep 02 2015 Jan Vcelak <jvcelak@fedoraproject.org> 1.6.5-1
- new upstream release:
+ fix: don't load expired zones on reload and startup
+ fix: remove race condition in scheduling causing delaying of events
+ fix: NSEC proof construction in zones with many delegations
+ fix: TC flag setting in RRL slipped answers
+ fix: disable domain name compression for root label
+ fix: check if executed under systemd before using journald log sink
+ feature: write persistent timers on server shutdown for better performance
+ feature: support time unit specification for 'max-conn-idle',
'max-conn-handshake', 'max-conn-reply', and 'notify-timeout' config options
+ feature: add 'request-edns-config' config option
* Thu Jun 18 2015 Jan Vcelak <jvcelak@fedoraproject.org> 1.6.4-1
- new upstream release:
+ fix: lost NOTIFY message if received during zone transfer
+ fix: kdig, record correct dnstap SocketProtocol when retrying over TCP
+ fix: kdig, hide TSIG section with +noall
+ fix: do not set AA flag for AXFR/IXFR queries
+ feature: new configuration format in YAML, binary store im LMDB
+ feature: DNSSEC, separate library, switch to GnuTLS, new utilities
+ feature: DNSSEC, basic KASP support (generate initial keys, ZSK rollover)
+ feature: zone parser, split long TXT/SPF strings into multiple strings
+ feature: kdig, add generic dump style option (+generic)
+ feature: try all master servers on failure in multi-master environment
+ feature: improved remotes and ACLs (multiple addresses, multiple keys)
+ feature: basic support for zone file patterns (%s to substitute zone name)
+ improvement: do not write class for SOA record (unified with other RR types)
+ improvement: do not write master server address into the zone file
+ documentation: manual pages also in HTML and PDF format
* Wed Jun 17 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.99.1-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
* Mon May 04 2015 Kalev Lember <kalevlember@gmail.com> - 1.99.1-3
- Rebuilt for nettle soname bump
* Fri Feb 13 2015 Jan Vcelak <jvcelak@fedoraproject.org> 1.99.1-2
- fix BuildRequires for systemd integration
* Fri Feb 13 2015 Jan Vcelak <jvcelak@fedoraproject.org> 1.99.1-1
- new upstream pre-release version:
+ DNSSEC: switch from OpenSSL to GnuTLS
+ DNSSEC: initial support for KASP
- split package into subpackages
- add documentation building
- restart daemon on updated
/usr/bin/knsec3hash /usr/bin/kzonecheck /usr/bin/kzonesign /usr/share/man/man1/knsec3hash.1.gz /usr/share/man/man1/kzonecheck.1.gz /usr/share/man/man1/kzonesign.1.gz
Generated by rpm2html 1.8.1
Fabrice Bellet, Tue Jul 9 13:32:59 2024