-
Mon Jul 31 2017 Petr Spacek <petr.spacek@nic.cz> - 2.5.3-2
- disable dnstap on RHEL (depedencies are missing)
-
Mon Jul 31 2017 Petr Spacek <petr.spacek@nic.cz> - 2.5.3-1
- new upstream release
WARNING: Automatic upgrade from versions 1.y.z is no longer possible.
To migrate, upgrade your packages gradually or use contacts listed on
https://www.knot-dns.cz/support/ (if you are in trouble).
Knot DNS 2.5.3 (2017-07-14)
===========================
Features:
---------
- CSK rollover support for Single-Type Signing Scheme
Improvements:
-------------
- Allowed binding to non-local adresses for TCP (Thanks to Julian Brost!)
- New documentation section for manual DNSSEC key algorithm rollover
- Initial KSK also generated in the submission state
- The 'ds' keymgr command with no parameter uses all KSK keys
- New debug mode in kjournalprint
- Updated keymgr documentation
Bugfixes:
---------
- Sometimes missing RRSIG by KSK in submission state.
- Minor DNSSEC-related issues
Knot DNS 2.5.2 (2017-06-23)
===========================
Security:
---------
- CVE-2017-11104: Improper TSIG validity period check can allow TSIG forgery (Thanks to Synacktiv!)
Improvements:
-------------
- Extended debug logging for TSIG errors
- Better error message for unknown module section in the configuration
- Module documentation compilation no longer depends on module configuration
- Extended policy section configuration semantic checks
- Improved python version compatibility in pykeymgr
- Extended migration section in the documentation
- Improved DNSSEC event timing on 32-bit systems
- New KSK rollover start log info message
- NULL qtype support in kdig
Bugfixes:
---------
- Failed to process included configuration
- dnskey_ttl policy option in the configuration has no effect on DNSKEY TTL
- Corner case journal fixes (huge changesets, OpenWRT operation)
- Confusing event timestamps in knotc zone-status output
- NSEC/NSEC3 bitmap not updated for CDS/CDNSKEY
- CDS/CDNSKEY RRSIG not updated
Knot DNS 2.5.1 (2017-06-07)
===========================
Bugfixes:
---------
- pykeymgr no longer crash on empty json files in the KASP DB directory
- pykeymgr no longer imports keys in the "removed" state
- Imported keys in the "removed" state no longer makes knotd to crash
- Including an empty configuration directory no longer makes knotd to crash
- pykeymgr is distributed and installed to the distribution tarball
Knot DNS 2.5.0 (2017-06-05)
===========================
Features:
---------
- KASP database switched from JSON files to LMDB database
- KSK rollover support using CDNSKEY and CDS in the automatic DNSSEC signing
- Dynamic module loading support with proper module API
- Journal can store full zone contents (not only differences)
- Zone freeze/thaw support
- Updated knotc zone-status output with optional column filters
- New '[no]crypto' option in kdig
- New keymgr implementation reflecting KASP database changes
- New pykeymgr for JSON-based KASP database migration
- Removed obsolete knot1to2 utility
Improvements:
-------------
- Added libidn2 support to kdig (with libidn fallback)
- Maximum timer database switched from configure to the server configuration
Knot DNS 2.4.4 (2017-06-05)
===========================
Improvements:
-------------
- Improved error handling in kjournalprint
Bugfixes:
---------
- Zone flush not replanned upon unsuccessful flush
- Journal inconsistency after deleting deleted zone
- Zone events not rescheduled upon server reload (Thanks to Mark Warren)
- Unreliable LMDB mapsize detection in kjournalprint
- Some minor issues found by AddressSanitizer
Knot DNS 2.4.3 (2017-04-11)
===========================
Improvements:
-------------
- New 'journal-db-mode' optimization configuration option
- The default TSIG algorithm for utilities input is HMAC-SHA256
- Implemented sensible default EDNS(0) padding policy (Thanks to D. K. Gillmor)
- Added some more semantic checks on the knotc configuration operations
Bugfixes:
---------
- Missing 'zone' keyword in the YAML output
- Missing trailing dot in the keymgr DS owner output
- Journal logs 'invalid parameter' in several cases
- Some minor journal-related problems
Knot DNS 2.4.2 (2017-03-23)
===========================
Features:
---------
- Zscanner can store record comments placed on the same line
- Knotc status extension with version, configure, and workers parameters
Improvements:
-------------
- Significant incoming XFR speed-up in the case of many zones
Bugfixes:
---------
- Double OPT RR insertion when a global module returns KNOT_STATE_FAIL
- User-driven zscanner parsing logic inconsistency
- Lower serial at master doesn't trigger any errors
- Queries with too long DNAME substitution do not return YXDOMAIN response
- Incorrect elapsed time in the DDNS log
- Failed to process forwarded DDNS request with TSIG
-
Mon Mar 13 2017 Petr Spacek <petr.spacek@nic.cz> - 2.4.1-2
- configuration checking was fixed to be compatible with Knot 2.4.x
-
Mon Feb 27 2017 Petr Spacek <petr.spacek@nic.cz> - 2.4.1-1
- new upstream release 2.4.1 replaces old 1.6.x series which is not supported
- configuration should be upgraded automatically using knot1to2 tool
- make sure you reviewed the new configuration in /etc/knot directory!
-
Tue Aug 09 2016 Jan Vcelak <jvcelak@fedoraproject.org> - 1.6.8-1
- new upstream release:
+ feature: Zone size limit restriction for DDNS, AXFR, and IXFR (CVE-2016-6171)
-
Wed Feb 10 2016 Jan Vcelak <jvcelak@fedoraproject.org> 1.6.7-1
- new upstream release:
+ improvement: Log change of the zone serial number after IXFR transfer
+ improvement: Document operational impact of various RRL settings
+ improvement: Add support for rate-limit-slip zero
+ improvement: Add 'timer-db' configuration option
-
Wed Nov 25 2015 Jan Vcelak <jvcelak@fedoraproject.org> 1.6.6-1
- new upstream release:
+ security fix: out-of-bound read in packet parser for malformed NAPTR record
+ fix: systemd startup notifications
-
Wed Sep 02 2015 Jan Vcelak <jvcelak@fedoraproject.org> 1.6.5-1
- new upstream release:
+ fix: don't load expired zones on reload and startup
+ fix: remove race condition in scheduling causing delaying of events
+ fix: NSEC proof construction in zones with many delegations
+ fix: TC flag setting in RRL slipped answers
+ fix: disable domain name compression for root label
+ fix: check if executed under systemd before using journald log sink
+ feature: write persistent timers on server shutdown for better performance
+ feature: support time unit specification for 'max-conn-idle',
'max-conn-handshake', 'max-conn-reply', and 'notify-timeout' config options
+ feature: add 'request-edns-config' config option
-
Thu Jun 18 2015 Jan Vcelak <jvcelak@fedoraproject.org> 1.6.4-1
- new upstream release:
+ fix: lost NOTIFY message if received during zone transfer
+ fix: kdig, record correct dnstap SocketProtocol when retrying over TCP
+ fix: kdig, hide TSIG section with +noall
+ fix: do not set AA flag for AXFR/IXFR queries
+ feature: zone scanner, split long TXT/SPF strings into multiple strings
+ feature: kdig, add +generic dump style option
+ feature: try all servers on failure in multi-master environment
+ improvement: zone dump, do not print class for SOA record for consistency
-
Wed Apr 08 2015 Jan Vcelak <jvcelak@fedoraproject.org> 1.6.3-1
- new upstream release:
+ fix: performance drop for NSEC-signed zones
+ fix: proper handling of TCP short-writes
+ fix: possible out-of-bound reads in zone parser and packet parser
+ feature: CDS and CDNSKEY support in zone parser
+ improvement: add defaults for TCP config options into documentation
+ improvement: detailed error message if zone reload fails