diff --git a/01-test_net-disable-udp-send-on-unconnected.patch b/01-test_net-disable-udp-send-on-unconnected.patch deleted file mode 100644 index f2b5b11..0000000 --- a/01-test_net-disable-udp-send-on-unconnected.patch +++ /dev/null @@ -1,26 +0,0 @@ -Author: Tomas Krizek -Date: 2019-02-28 14:26:56 +0100 - - test_net: disable UDP send on unconnected - - This test started to fail with 5.0 kernel in F30+ on aarch64 and s390x. - The functionality isn't used by Knot DNS, so disabling this test until - the issue is resolved should be safe. - - Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1675235 - -diff --git a/tests/contrib/test_net.c b/tests/contrib/test_net.c -index 0a22abbbc..6ec4bda31 100644 ---- a/tests/contrib/test_net.c -+++ b/tests/contrib/test_net.c -@@ -310,10 +310,6 @@ static void test_unconnected(void) - r = net_dgram_recv(sock, buffer, buffer_len, TIMEOUT_SHORT); - is_int(KNOT_ETIMEOUT, r, "UDP, receive timeout on unconnected socket"); - -- struct sockaddr_storage server_addr = addr_from_socket(server); -- r = net_dgram_send(sock, buffer, buffer_len, &server_addr); -- is_int(buffer_len, r, "UDP, send on defined address"); -- - close(sock); - - // TCP diff --git a/02-revert-AC_PROG_CC.patch b/02-revert-AC_PROG_CC.patch deleted file mode 100644 index fb49c00..0000000 --- a/02-revert-AC_PROG_CC.patch +++ /dev/null @@ -1,18 +0,0 @@ -From: Daniel Salzman -Date: Sun, 20 Feb 2022 20:38:35 +0100 -Subject: [PATCH] Revert "configure: upgrade from AC_PROG_CC_C99 to AC_PROG_CC" - -diff --git a/configure.ac b/configure.ac -index 6506197ed..c7df7f815 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -38,7 +38,8 @@ release_date=$($SED -n 's/^Knot DNS .* (\(.*\))/\1/p;q;' ${srcdir}/NEWS) - AC_SUBST([RELEASE_DATE], $release_date) - - # Set compiler compatibility flags --AC_PROG_CC -+AC_PROG_CC_C99 # AC_PROG_CC not supported by CentOS 7 -+AM_PROG_CC_C_O # Needed by CentOS 7 - AC_PROG_CPP_WERROR - - # Set default CFLAGS diff --git a/knot.spec b/knot.spec index 49320d8..4b79d07 100644 --- a/knot.spec +++ b/knot.spec @@ -2,12 +2,19 @@ %{!?_pkgdocdir: %global _pkgdocdir %{_docdir}/%{name}} %define GPG_CHECK 1 +%if 0%{?fedora} >= 40 || 0%{?rhel} >= 9 +# use modern %pyproject_* macros on distros which support them +%define PYPROJECT 1 +%else +# use older %py3_* macros on older/other distros +%define PYPROJECT 0 +%endif %define BASE_VERSION %(echo "%{version}" | sed 's/^\\([^.]\\+\\.[^.]\\+\\).*/\\1/') %define repodir %{_builddir}/%{name}-%{version} Summary: High-performance authoritative DNS server Name: knot -Version: 3.2.13 +Version: 3.5.2 Release: 1%{?dist} License: GPL-3.0-or-later URL: https://www.knot-dns.cz @@ -22,23 +29,14 @@ Source100: gpgkey-742FA4E95829B6C5EAC6B85710BB7AF6FEBBD6AB.gpg.asc BuildRequires: gnupg2 %endif -# Test fails on F30+ aarch/s390x for unknown reason, but it is not neccassary for Knot DNS -Patch1: 01-test_net-disable-udp-send-on-unconnected.patch -# Revert config improvement to support EL 7 -Patch2: 02-revert-AC_PROG_CC.patch - # Required dependencies BuildRequires: autoconf BuildRequires: automake BuildRequires: libtool BuildRequires: make -%if 0%{?rhel} == 7 -BuildRequires: devtoolset-12-gcc -%else BuildRequires: gcc -%endif BuildRequires: pkgconfig(liburcu) -BuildRequires: pkgconfig(gnutls) >= 3.3 +BuildRequires: pkgconfig(gnutls) BuildRequires: pkgconfig(libedit) # Optional dependencies @@ -48,11 +46,26 @@ BuildRequires: pkgconfig(libmnl) BuildRequires: pkgconfig(libnghttp2) BuildRequires: pkgconfig(libsystemd) BuildRequires: pkgconfig(systemd) +BuildRequires: pkgconfig(hiredis) +%if 0%{?fedora} || 0%{?rhel} +BuildRequires: softhsm +%endif # dnstap dependencies BuildRequires: pkgconfig(libfstrm) BuildRequires: pkgconfig(libprotobuf-c) # geoip dependencies BuildRequires: pkgconfig(libmaxminddb) +# XDP dependencies +BuildRequires: pkgconfig(libbpf) +# Python modules (python3-libknot, knot-exporter) dependencies +BuildRequires: python3-devel +%if 0%{?PYPROJECT} +BuildRequires: pyproject-rpm-macros +BuildRequires: python3-pip +BuildRequires: python3-hatchling +%else +BuildRequires: python3-setuptools +%endif # Distro-dependent dependencies %if 0%{?suse_version} @@ -60,18 +73,21 @@ BuildRequires: python3-Sphinx BuildRequires: lmdb-devel BuildRequires: protobuf-c Requires(pre): pwdutils +%if 0%{?sle_version} != 150400 +BuildRequires: pkgconfig(libxdp) %endif -%if 0%{?rhel} && 0%{?rhel} <= 7 -BuildRequires: python-sphinx -BuildRequires: lmdb-devel %endif -%if 0%{?fedora} || 0%{?rhel} > 7 +%if 0%{?fedora} || 0%{?rhel} BuildRequires: python3-sphinx BuildRequires: pkgconfig(lmdb) +%if 0%{?fedora} || 0%{?rhel} >= 9 +BuildRequires: pkgconfig(libxdp) +%endif %endif -# disable XDP on old EL -%define configure_xdp --enable-xdp=no +%if 0%{?rhel} >= 9 || 0%{?suse_version} || 0%{?fedora} +%define configure_quic --enable-quic=yes +%endif Requires(post): systemd %{_sbindir}/runuser Requires(preun): systemd @@ -79,11 +95,19 @@ Requires(postun): systemd Requires: %{name}-libs%{?_isa} = %{version}-%{release} +Recommends: %{name}-keymgr + +%if 0%{?suse_version} +Provides: group(knot) +%endif + %description Knot DNS is a high-performance authoritative DNS server implementation. %package libs Summary: Libraries used by the Knot DNS server and client applications +# Knot DNS 3.5+ isn't compatible with earlier knot-resolver +Conflicts: knot-resolver < 5.7.6-3 %description libs The package contains shared libraries used by the Knot DNS server and @@ -113,6 +137,13 @@ Requires: %{name}-libs%{?_isa} = %{version}-%{release} %description dnssecutils The package contains DNSSEC tools shipped with the Knot DNS server. +%package keymgr +Summary: Knot DNS key management utility +Requires: %{name}-libs%{?_isa} = %{version}-%{release} + +%description keymgr +The package contains keymgr program for Knot DNS key management. + %package module-dnstap Summary: dnstap module for Knot DNS Requires: %{name} = %{version}-%{release} @@ -127,6 +158,30 @@ Requires: %{name} = %{version}-%{release} %description module-geoip The package contains geoip Knot DNS module for geography-based responses. +%package exporter +Summary: Prometheus exporter for Knot DNS +BuildArch: noarch +Requires: %{name}-libs = %{version}-%{release} + +%description exporter +The package provides Python Prometheus exporter for Knot DNS. + +%package -n python3-libknot +Summary: Python bindings for libknot +BuildArch: noarch +Requires: %{name}-libs = %{version}-%{release} +%{?python_provide:%python_provide python3-libknot} + +%description -n python3-libknot +The package provides Python bindings for the libknot shared library. + +%package -n valkey-module-knot +Summary: Valkey module for Knot DNS. +Requires: %{name}-libs = %{version}-%{release} + +%description -n valkey-module-knot +The package provides Valkey module for Knot DNS. + %package doc Summary: Documentation for the Knot DNS server BuildArch: noarch @@ -146,10 +201,12 @@ gpg2 --verify %{SOURCE1} %{SOURCE0} %endif %autosetup -p1 +# Create a sysusers.d config file +cat >knot.sysusers.conf < 7 -install -p -m 0644 -D %{repodir}/distro/common/cz.nic.knotd.conf %{buildroot}%{_sysconfdir}/dbus-1/system.d/cz.nic.knotd.conf +install -p -m 0644 -D %{repodir}/distro/common/cz.nic.knotd.conf %{buildroot}%{_datadir}/dbus-1/system.d/cz.nic.knotd.conf %endif # install systemd files -install -p -m 0644 -D %{repodir}/distro/pkg/el-7/%{name}.service %{buildroot}%{_unitdir}/%{name}.service -install -p -m 0644 -D %{repodir}/distro/pkg/el-7/%{name}.tmpfiles %{buildroot}%{_tmpfilesdir}/%{name}.conf +install -p -m 0644 -D %{repodir}/distro/common/%{name}.service %{buildroot}%{_unitdir}/%{name}.service %if 0%{?suse_version} ln -s service %{buildroot}/%{_sbindir}/rcknot %endif @@ -209,23 +299,17 @@ install -d -m 0770 -D %{buildroot}%{_sharedstatedir}/knot # remove libarchive files find %{buildroot} -type f -name "*.la" -delete -print +install -m0644 -D knot.sysusers.conf %{buildroot}%{_sysusersdir}/knot.conf + %check -%if 0%{?rhel} == 7 -. /opt/rh/devtoolset-12/enable -%endif V=1 make check %pre -getent group knot >/dev/null || groupadd -r knot -getent passwd knot >/dev/null || \ - useradd -r -g knot -d %{_sharedstatedir}/knot -s /sbin/nologin \ - -c "Knot DNS server" knot %if 0%{?suse_version} %service_add_pre knot.service %endif %post -systemd-tmpfiles --create %{_tmpfilesdir}/knot.conf &>/dev/null || : %if 0%{?suse_version} %service_add_post knot.service %else @@ -257,19 +341,17 @@ systemd-tmpfiles --create %{_tmpfilesdir}/knot.conf &>/dev/null || : %license COPYING %doc %{_pkgdocdir} %exclude %{_pkgdocdir}/html -%attr(770,root,knot) %dir %{_sysconfdir}/knot +%attr(750,root,knot) %dir %{_sysconfdir}/knot %config(noreplace) %attr(640,root,knot) %{_sysconfdir}/knot/knot.conf %if 0%{?fedora} || 0%{?rhel} > 7 -%config(noreplace) %attr(644,root,root) %{_sysconfdir}/dbus-1/system.d/cz.nic.knotd.conf +%config(noreplace) %attr(644,root,root) %{_datadir}/dbus-1/system.d/cz.nic.knotd.conf %endif %attr(770,root,knot) %dir %{_sharedstatedir}/knot %dir %{_libdir}/knot %dir %{_libdir}/knot/modules-* %{_unitdir}/knot.service -%{_tmpfilesdir}/knot.conf %{_sbindir}/kcatalogprint %{_sbindir}/kjournalprint -%{_sbindir}/keymgr %{_sbindir}/knotc %{_sbindir}/knotd %if 0%{?suse_version} @@ -278,19 +360,17 @@ systemd-tmpfiles --create %{_tmpfilesdir}/knot.conf &>/dev/null || : %{_mandir}/man5/knot.conf.* %{_mandir}/man8/kcatalogprint.* %{_mandir}/man8/kjournalprint.* -%{_mandir}/man8/keymgr.* %{_mandir}/man8/knotc.* %{_mandir}/man8/knotd.* %ghost %attr(770,root,knot) %dir %{_rundir}/knot +%{_sysusersdir}/knot.conf %files utils %{_bindir}/kdig %{_bindir}/khost %{_bindir}/knsupdate -%if 0%{?use_xdp} %{_sbindir}/kxdpgun %{_mandir}/man8/kxdpgun.* -%endif %{_mandir}/man1/kdig.* %{_mandir}/man1/khost.* %{_mandir}/man1/knsupdate.* @@ -303,12 +383,28 @@ systemd-tmpfiles --create %{_tmpfilesdir}/knot.conf &>/dev/null || : %{_mandir}/man1/kzonecheck.* %{_mandir}/man1/kzonesign.* +%files keymgr +%{_sbindir}/keymgr +%{_mandir}/man8/keymgr.* + %files module-dnstap %{_libdir}/knot/modules-*/dnstap.so %files module-geoip %{_libdir}/knot/modules-*/geoip.so +%files exporter +%{_bindir}/knot-exporter +%{python3_sitelib}/knot_exporter +%{python3_sitelib}/knot_exporter-*-info + +%files -n python3-libknot +%{python3_sitelib}/libknot +%{python3_sitelib}/libknot-*-info + +%files -n valkey-module-knot +%attr(0755, root, root) %{_libdir}/valkey/modules/knot.so + %files libs %license COPYING %doc NEWS @@ -335,40 +431,126 @@ systemd-tmpfiles --create %{_tmpfilesdir}/knot.conf &>/dev/null || : %doc %{_pkgdocdir}/html %changelog -* Tue Jun 25 2024 Jakub Ružička - 3.2.13-1 -- Update to 3.2.13 +* Fri Dec 19 2025 Jakub Ružička - 3.5.2-1 +- Update to 3.5.2 -* Wed Jan 24 2024 Jakub Ružička - 3.2.12-1 -- Update to 3.2.12 +* Thu Oct 16 2025 Jakub Ružička - 3.5.1-1 +- Update to 3.5.1 +- Add new valkey-module-knot package +- Split keymgr into knot-keymgr package -* Mon Oct 30 2023 Jakub Ružička - 3.2.11-1 -- Update to 3.2.11 +* Fri Sep 19 2025 Python Maint - 3.4.8-3 +- Rebuilt for Python 3.14.0rc3 bytecode -* Tue Sep 12 2023 Jakub Ružička - 3.2.10-1 -- Update to 3.2.10 +* Fri Aug 15 2025 Python Maint - 3.4.8-2 +- Rebuilt for Python 3.14.0rc2 bytecode + +* Wed Jul 30 2025 Jakub Ružička - 3.4.8-1 +- Update to 3.4.8 + +* Thu Jul 24 2025 Fedora Release Engineering - 3.4.7-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + +* Thu Jun 12 2025 Jakub Ružička - 3.4.7-1 +- Update to 3.4.7 +- Add new knot-exporter and python3-libknot packages + +* Thu Apr 10 2025 Jakub Ružička - 3.4.6-1 +- Update to 3.4.6 + +* Wed Mar 19 2025 Jakub Ružička - 3.4.5-1 +- Update to 3.4.5 + +* Thu Jan 23 2025 Zbigniew Jędrzejewski-Szmek - 3.4.4-2 +- Add sysusers.d config file to allow rpm to create users/groups automatically + +* Thu Jan 23 2025 Jakub Ružička - 3.4.4-1 +- Update to 3.4.4 + +* Fri Jan 17 2025 Fedora Release Engineering - 3.4.3-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + +* Tue Dec 10 2024 Jakub Ružička - 3.4.3-1 +- Update to 3.4.3 + +* Mon Nov 25 2024 Jakub Ružička - 3.4.2-1 +- Update to 3.4.2 + +* Mon Aug 26 2024 Jakub Ružička - 3.3.9-1 +- Update to 3.3.9 + +* Mon Jul 22 2024 Jakub Ružička - 3.3.8-1 +- Update to 3.3.8 + +* Thu Jul 18 2024 Fedora Release Engineering - 3.3.7-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + +* Tue Jun 25 2024 Jakub Ružička - 3.3.7-1 +- Update to 3.3.7 + +* Thu Jun 13 2024 Jakub Ružička - 3.3.6-1 +- Update to 3.3.6 + +* Thu Mar 07 2024 Jakub Ružička - 3.3.5-1 +- Update to 3.3.5 + +* Wed Jan 24 2024 Jakub Ružička - 3.3.4-1 +- Update to 3.3.4 + +* Sun Jan 21 2024 Fedora Release Engineering - 3.3.3-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Wed Dec 13 2023 Jakub Ružička - 3.3.3-1 +- Update to 3.3.3 + +* Fri Oct 20 2023 Jakub Ružička - 3.3.2-1 +- Update to 3.3.2 + +* Tue Sep 12 2023 Jakub Ružička - 3.3.1-1 +- Update to 3.3.1 + +* Mon Aug 28 2023 Jakub Ružička - 3.3.0-1 +- Update to 3.3.0 * Thu Jul 27 2023 Jakub Ružička - 3.2.9-1 - Update to 3.2.9 +* Thu Jul 20 2023 Fedora Release Engineering - 3.2.8-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + * Mon Jun 26 2023 Jakub Ružička - 3.2.8-1 - Update to 3.2.8 * Tue Jun 06 2023 Jakub Ružička - 3.2.7-1 - Update to 3.2.7 +- Remove unneeded tests patch +- Use _datadir for config + +* Fri May 12 2023 Michel Alexandre Salim - 3.2.6-2 +- Add BR on libxdp on RHEL >= 9 to use with libbpf-1.x * Thu Apr 06 2023 Jakub Ružička - 3.2.6-1 - Update to 3.2.6 +- Sync upstream packaging improvements * Thu Feb 02 2023 Jakub Ružička - 3.2.5-1 - Update to 3.2.5 +* Thu Jan 19 2023 Fedora Release Engineering - 3.2.4-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + * Mon Dec 12 2022 Jakub Ružička - 3.2.4-1 - Update to 3.2.4 -- Use devtoolset-12-gcc on EPEL 7 + +* Mon Nov 28 2022 Jakub Ružička - 3.2.3-2 +- Rebuilt for libbpf 1.0 transition * Mon Nov 21 2022 Jakub Ružička - 3.2.3-1 - Update to 3.2.3 +* Fri Nov 04 2022 Jakub Ružička - 3.2.2-2 +- New BuildRequires: libxdp (needed for libbpf >= 1.0) + * Tue Nov 01 2022 Jakub Ružička - 3.2.2-1 - Update to 3.2.2 @@ -381,11 +563,14 @@ systemd-tmpfiles --create %{_tmpfilesdir}/knot.conf &>/dev/null || : - Update to 3.2.0 - Patch: fix tests on 32-bit platforms - Patch: revert problematic hardening of service file -- Patch: revert config improvement to support EL 7 +- Enable QUIC - New knot-dnssecutils subpackage - Debian compat (knot-utils vs knot-dnsutils) - Remove bundled(jquery) version as it differes between distros +* Thu Jul 21 2022 Fedora Release Engineering - 3.1.8-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + * Thu Apr 28 2022 Jakub Ružička - 3.1.8-1 - Update to 3.1.8 @@ -394,14 +579,24 @@ systemd-tmpfiles --create %{_tmpfilesdir}/knot.conf &>/dev/null || : * Thu Feb 10 2022 Jakub Ružička - 3.1.6-1 - Update to 3.1.6 +- Add dbus config - Use _sharedstatedir for home -* Wed Jan 05 2022 Jakub Ružička - 3.1.5-1 +* Thu Jan 20 2022 Fedora Release Engineering - 3.1.5-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + +* Wed Jan 05 2022 Jakub Ružička 3.1.5-1 - Update to 3.1.5 +* Sat Nov 06 2021 Adrian Reber - 3.1.4-2 +- Rebuilt for protobuf 3.19.0 + * Thu Nov 04 2021 Jakub Ružička - 3.1.4-1 - Update to 3.1.4 +* Tue Oct 26 2021 Adrian Reber - 3.1.3-2 +- Rebuilt for protobuf 3.18.1 + * Tue Oct 19 2021 Jakub Ružička - 3.1.3-1 - Update to 3.1.3 @@ -422,6 +617,9 @@ systemd-tmpfiles --create %{_tmpfilesdir}/knot.conf &>/dev/null || : - Add missing BuildRequires including new libmnl for kxdpgun - Temporarily disable XDP on ARM until issues are resolved +* Thu Jul 22 2021 Fedora Release Engineering - 3.0.8-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + * Fri Jul 16 2021 Jakub Ružička - 3.0.8-1 - Update to 3.0.8 - Print failed tests during check @@ -437,24 +635,40 @@ systemd-tmpfiles --create %{_tmpfilesdir}/knot.conf &>/dev/null || : - Properly escape BASE_VERSION macro - Include module dirs in main package +* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek - 3.0.4-2 +- Rebuilt for updated systemd-rpm-macros + See https://pagure.io/fesco/issue/2583. + * Mon Feb 01 2021 Jakub Ružička - 3.0.4-1 - Update to 3.0.4 - Move dnstap module to subpackage - Move geoip module to subpackage - Remove redundant VERSION macro +* Tue Jan 26 2021 Fedora Release Engineering - 3.0.3-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + +* Thu Jan 14 08:45:48 CET 2021 Adrian Reber - 3.0.3-2 +- Rebuilt for protobuf 3.14 + * Thu Dec 17 2020 Jakub Ružička - 3.0.3-1 - Update to 3.0.3 +* Wed Nov 11 2020 Jakub Ružička - 3.0.2-2 +- Remove patch included in upstream release + * Wed Nov 11 2020 Jakub Ružička - 3.0.2-1 - Update to 3.0.2 +* Thu Oct 29 2020 Jakub Ružička - 3.0.1-2 +- Respect GnuTLS insecure algorithms + * Mon Oct 12 2020 Jakub Ružička - 3.0.1-1 - Update to 3.0.1 - Sync packaging from upstream -* Fri Sep 25 2020 Jakub Ružička 3.0.0-2 -- Rebuild +* Thu Sep 24 2020 Adrian Reber - 3.0.0-2 +- Rebuilt for protobuf 3.13 * Thu Sep 10 2020 Jakub Ružička 3.0.0-1 - New major upstream release 3.0.0 @@ -463,6 +677,12 @@ systemd-tmpfiles --create %{_tmpfilesdir}/knot.conf &>/dev/null || : * Wed Sep 02 2020 Jakub Ružička 2.9.6-1 - Update to 2.9.6 +* Tue Jul 28 2020 Fedora Release Engineering - 2.9.5-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + +* Sun Jun 14 2020 Adrian Reber - 2.9.5-2 +- Rebuilt for protobuf 3.12 + * Mon May 25 2020 Tomas Krizek - 2.9.5-1 - new upstream release 2.9.5 @@ -472,6 +692,9 @@ systemd-tmpfiles --create %{_tmpfilesdir}/knot.conf &>/dev/null || : * Tue Mar 03 2020 Tomas Krizek - 2.9.3-1 - new upstream release 2.9.3 +* Wed Jan 29 2020 Fedora Release Engineering - 2.9.2-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + * Fri Dec 13 2019 Tomas Krizek - 2.9.2-1 - new upstream release 2.9.2 @@ -483,27 +706,208 @@ systemd-tmpfiles --create %{_tmpfilesdir}/knot.conf &>/dev/null || : * Tue Sep 24 2019 Tomas Krizek - 2.8.4-1 - new upstream release 2.8.4 -* Wed Aug 21 2019 Tomas Krizek - 2.8.3-1 -- new upstream release 2.8.3 +* Thu Jul 25 2019 Fedora Release Engineering - 2.8.3-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild -* Thu Jul 11 2019 Tomas Krizek - 2.8.2-1 -- rebase to latest upstream version 2.8.2 +* Tue Jul 16 2019 Tomas Krizek - 2.8.3-1 +- New upstream release 2.8.3 -* Mon Oct 01 2018 Tomas Krizek - 2.6.9-1 -Knot DNS 2.6.9 (2018-08-14) +* Wed Jun 26 2019 Tomas Krizek - 2.8.2-1 +- New upstream release 2.8.2 + +* Wed May 29 2019 Tomas Krizek - 2.8.1-1 +- New upstream release 2.8.1 +- Resolves BZ#1700251 + +* Thu Feb 28 2019 Tomas Krizek - 2.7.6-3 +- Added 01-test_net-disable-udp-send-on-unconnected.patch to disable + unnecessary failing test. Fixes BZ#1675235 + +* Fri Feb 01 2019 Fedora Release Engineering - 2.7.6-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + +* Wed Jan 23 2019 Tomas Krizek - 2.7.6-1 +Knot DNS 2.7.6 (2019-01-23) =========================== Improvements: ------------- - - Added zone wire size to zone loading log message - - Added debug log message for each unsuccessful remote address operation + - Zone status also shows when the zone load is scheduled + - Server workers status also shows background workers utilization + - Default control timeout for knotc was increased to 10 seconds + - Pkg-config files contain auxiliary variable with library filename Bugfixes: --------- + - Configuration commit or server reload can drop some pending zone events + - Nonempty zone journal is created even though it's disabled #635 + - Zone is completely re-signed during empty dynamic update processing + - Server can crash when storing a big zone difference to the journal + - Failed to link on FreeBSD 12 with Clang + +* Mon Jan 07 2019 Tomas Krizek - 2.7.5-1 +Knot DNS 2.7.5 (2019-01-07) +=========================== + +Features: +--------- + - Keymgr supports NSEC3 salt handling + +Improvements: +------------- + - Zone history in journal is dropped apon AXFR-like zone update + - Libdnssec is no longer linked against libm #628 + - Libdnssec is explicitly linked against libpthread if PKCS #11 enabled #629 + - Better support for libknot packaging in Python + - Manually generated KSK is 'ready' by default + - Kdig supports '+timeout' as an alias for '+time' + - Kdig supports '+nocomments' option + - Kdig no longer prints empty lines between retries + - Kdig returns failure if operations not successfully resolved #632 + - Fixed repeating of the 'KSK submission, waiting for confirmation' log + - Various improvements in documentation, Dockerfile, and tests + +Bugfixes: +--------- + - Knotc fails to unset huge configuration section + - Kjournalprint sometimes fails to display zone journal content + - Improper timing of ZSK removal during ZSK rollover + - Missing UTC time zone indication in the 'iso' keymgr list output + - A race condition in the online signing module + +* Tue Nov 13 2018 Tomas Krizek - 2.7.4-1 +Knot DNS 2.7.4 (2018-11-13) +=========================== + +Features: +--------- + - Added SNI configuration for TLS in kdig (Thanks to Alexander Schultz) + +Improvements: +------------- + - Added warning log when DNSSEC events not successfully scheduled + - New semantic check on timer values in keymgr + - DS query no longer asks other addresses if got a negative answer + - Reintroduced 'rollover' configuration option for CDS/CDNSKEY publication + - Extended logging for zone loading + - Various documentation improvements + +Bugfixes: +--------- + - Failed to import module configuration #613 + - Improper Cflags value in libknot.pc if built with embedded LMDB #615 + - IXFR doesn't fall back to AXFR if malformed reply + - DNSSEC events not correctly scheduled for empty zone updates + - During algorithm rollover old keys get removed before DS TTL expires #617 + - Maximum zone's RRSIG TTL not considered during algorithm rollover #620 + +* Fri Oct 12 2018 Tomas Krizek - 2.7.3-1 +Knot DNS 2.7.3 (2018-10-11) +=========================== + +Features: +--------- + - New queryacl module for query access control + - Configurable answer rrset rotation #612 + - Configurable NSEC bitmap in online signing + +Improvements: +------------- + - Better error logging for KASP DB operations #601 + - Some documentation improvements + +Bugfixes: +--------- + - Keymgr "list" output doesn't show key size for ECDSA algorithms #602 + - Failed to link statically with embedded LMDB + - Configuration commit causes zone reload for all zones + - The statistics module overlooks TSIG record in a request + - Improper processing of an AXFR-style-IXFR response consisting of one-record messages + - Race condition in online signing during key rollover #600 + - Server can crash if geoip module is enabled in the geo mode + +* Wed Aug 29 2018 Tomas Krizek - 2.7.2-1 +Knot DNS 2.7.2 (2018-08-29) +=========================== + +Improvements: +------------- + - Keymgr list command displays also key size + - Kjournalprint displays total occupied size in the debug mode + - Server doesn't stop if failed to load a shared module from the module directory + - Libraries libcap-ng, pthread, and dl are linked selectively if needed + +Bugfixes: +--------- + - Sometimes incorrect result from dnssec_nsec_bitmap_contains (libdnssec) + - Server can crash when loading zone file difference and zone-in-journal is set + - Incorrect treatment of specific queries in the module RRL + - Failed to link module Cookies as a shared library + +* Wed Aug 15 2018 Tomas Krizek - 2.7.1-1 +Knot DNS 2.7.1 (2018-08-14) +=========================== + +Improvements: +------------- + - Added zone wire size information to zone loading log message + - Added debug log message for each unsuccessful remote address operation + - Various improvements for packaging + +Bugfixes: +--------- + - Incompatible handling of RRSIG TTL value when creating a DNS message + - Incorrect RRSIG TTL value in zone differences and knotc zone operation outputs + - Default configure prefix is ignored + +Knot DNS 2.7.0 (2018-08-03) +=========================== + +Features: +--------- + - New DNS Cookies module and related '+cookie' kdig option + - New module for response tailoring according to client's subnet or geographic location + - General EDNS Client Subnet support in the server + - OSS-Fuzz integration (Thanks to Jonathan Foote) + - New '+ednsopt' kdig option (Thanks to Jan Včelák) + - Online Signing support for automatic key rollover + - Non-normal file (e.g. pipe) loading support in zscanner #542 + - Automatic SOA serial incrementation if non-empty zone difference + - New zone file load option for ignoring zone file's SOA serial + - New build-time option for alternative malloc specification + - Structured logging for DNSSEC key submission event + - Empty QNAME support in kdig + +Improvements: +------------- + - Various library and server optimizations + - Reduced memory consumption of outgoing IXFR processing + - Linux capabilities use overhaul #546 (Thanks to Robert Edmonds) + - Online Signing properly signs delegations and CNAME records + - CDS/CDNSKEY rrset is signed with KSK instead of ZSK + - DNSSEC-related records are ignored when loading zone difference with signing enabled + - Minimum allowed RSA key length was increased to 1024 + - Removed explicit dependency on Nettle + +Bugfixes: +--------- + - Possible uninitialized address buffer use in zscanner + - Possible index overflow during multiline record parsing in zscanner + - kdig +tls sometimes consumes 100 % CPU #561 + - Single-Type Signing doesn't work with single ZSK key #566 - Zone not flushed after re-signing during zone load #594 - Server crashes when committing empty zone transaction - Incoming IXFR with on-slave signing sometimes leads to memory corruption #595 +Compatibility: +-------------- + - Removed obsolete RRL configuration + - Removed obsolete module names 'mod-online-sign' and 'mod-synth-record' + - Removed obsolete 'ixfr-from-differences' configuration option + - Removed old journal migration + - Removed module rosedb + + * Fri Jul 13 2018 Fedora Release Engineering - 2.6.8-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild @@ -768,15 +1172,6 @@ WARNING: Automatic upgrade from versions 1.y.z is no longer possible. To migrate, upgrade your packages gradually or use contacts listed on https://www.knot-dns.cz/support/ (if you are in trouble). -* Mon Jul 31 2017 Petr Spacek - 2.5.3-2 -- disable dnstap on RHEL (depedencies are missing) - -* Mon Jul 31 2017 Petr Spacek - 2.5.3-1 -- new upstream release -WARNING: Automatic upgrade from versions 1.y.z is no longer possible. -To migrate, upgrade your packages gradually or use contacts listed on -https://www.knot-dns.cz/support/ (if you are in trouble). - Knot DNS 2.5.3 (2017-07-14) =========================== @@ -858,6 +1253,23 @@ Improvements: - Added libidn2 support to kdig (with libidn fallback) - Maximum timer database switched from configure to the server configuration +* Wed Jul 26 2017 Fedora Release Engineering - 2.4.5-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild + +* Mon Jul 10 2017 Petr Spacek - 2.4.5-1 +New upstream release: 2.4.5 + +Knot DNS 2.4.5 (2017-06-23) +=========================== + +Security: +--------- + - Improper TSIG validity period check can allow TSIG forgery (Thanks to Synacktiv!) + +Bugfixes: +--------- + - Corner case journal fixes (huge changesets, OpenWRT operation) + Knot DNS 2.4.4 (2017-06-05) =========================== @@ -911,13 +1323,22 @@ Bugfixes: - Incorrect elapsed time in the DDNS log - Failed to process forwarded DDNS request with TSIG -* Mon Mar 13 2017 Petr Spacek - 2.4.1-2 -- configuration checking was fixed to be compatible with Knot 2.4.x - * Mon Feb 27 2017 Petr Spacek - 2.4.1-1 -- new upstream release 2.4.1 replaces old 1.6.x series which is not supported -- configuration should be upgraded automatically using knot1to2 tool -- make sure you reviewed the new configuration in /etc/knot directory! +- new upstream release: + + fix: Transfer of a huge rrset goes into an infinite loop + + fix: Huge response over TCP contains useless TC bit instead of SERVFAIL + + fix: Failed to build utilities with disabled daemon + + fix: Memory leaks during keys removal + + fix: Rough TSIG packet reservation causes early truncation + + fix: Minor out-of-bounds string termination write in rrset dump + + fix: Server crash during stop if failed to open timers DB + + fix: Failed to compile on OS X older than Sierra + + fix: Poor minimum UDP-max-size configuration check + + fix: Failed to receive one-record-per-message IXFR-style AXFR + + fix: Kdig timeouts when receiving RCODE != NOERROR on subsequent transfer message + + improvement: Speed-up of rdata addition into a huge rrset + + improvement: Introduce check of minumum timeout for next refresh + + improvement: Dnsproxy module can forward all queries without local resolving * Fri Feb 10 2017 Fedora Release Engineering - 2.4.0-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild @@ -1001,51 +1422,129 @@ Bugfixes: + improvement: Set TC flag in delegation only if mandatory glue doesn't fit the response + improvement: Separate EDNS(0) payload size configuration for IPv4 and IPv6 + feature: Zone size limit restriction for DDNS, AXFR, and IXFR (CVE-2016-6171) + + feature: DNS-over-TLS support in kdig (RFC 7858) + + feature: EDNS(0) padding and alignment support in kdig (RFC 7830) -* Tue Aug 09 2016 Jan Vcelak - 1.6.8-1 +* Fri Jun 24 2016 Jan Vcelak - 2.2.1-2 +- rebuild for updated userspace-rcu + +* Mon May 30 2016 Jan Vcelak - 2.2.1-1 - new upstream release: - + fix: Transfer of a huge rrset goes into an infinite loop - + fix: Huge response over TCP contains useless TC bit instead of SERVFAIL - + fix: Failed to build utilities with disabled daemon - + fix: Memory leaks during keys removal - + fix: Rough TSIG packet reservation causes early truncation - + fix: Minor out-of-bounds string termination write in rrset dump - + fix: Server crash during stop if failed to open timers DB - + fix: Failed to compile on OS X older than Sierra - + fix: Poor minimum UDP-max-size configuration check - + fix: Failed to receive one-record-per-message IXFR-style AXFR - + fix: Kdig timeouts when receiving RCODE != NOERROR on subsequent transfer message - + improvement: Speed-up of rdata addition into a huge rrset - + improvement: Introduce check of minumum timeout for next refresh - + improvement: Dnsproxy module can forward all queries without local resolving + + fix: Separate logging of server and zone events + + fix: Concurrent zone file flushing with many zones + + fix: Control timeout parsing in knotc + + fix: "Environment maxreaders limit reached" error in knotc + + fix: Don't apply journal changes on modified zone file + + fix: Enable multiple zone names completion in interactive knotc + + fix: Set the TC flag in a response if a glue doesn't fit the response + + fix: Disallow server reload when there is an active configuration transaction + + improvement: Distinguish unavailable zones from zones with zero serial in log messages + + improvement: Log warning and error messages to standard error output in all utilities + + improvement: Document tested PKCS #11 devices + + improvement: Extended Python configuration interface +- update requirements for Fedora 25 -* Wed Feb 10 2016 Jan Vcelak 1.6.7-1 +* Sun May 29 2016 Jan Vcelak - 2.2.0-3 +- update default configuration file + +* Sun May 08 2016 Jan Vcelak - 2.2.0-2 +- fix: systemd service starting + +* Tue Apr 26 2016 Jan Vcelak - 2.2.0-1 - new upstream release: - + improvement: Log change of the zone serial number after IXFR transfer - + improvement: Document operational impact of various RRL settings - + improvement: Add support for rate-limit-slip zero - + improvement: Add 'timer-db' configuration option + + fix: Query/response message type setting in dnstap module + + fix: Remote address retrieval from dnstap capture in kdig + + fix: Global modules execution for queries hitting existing zones + + fix: Execution of semantic checks after an IXFR transfer + + fix: kdig failure when the first AXFR message contains just the SOA record + + fix: Exclude non-authoritative types from NSEC/NSEC3 bitmap at a delegation + + fix: Mark PKCS#11 generated keys as sensitive + + fix: Error when removing the only zone from the server + + fix: Don't abort knotc transaction when some check fails + + feature: URI and CAA resource record types support + + feature: RRL client address based white list + + feature: knotc interactive mode + + improvement: Consistent IXFR error messages + + improvement: Various fixes for better compatibility with PKCS#11 devices + + improvement: Various keymgr user interface improvements + + improvement: Better zone event scheduler performance with many zones + + improvement: New server control interface + + improvement: kdig uses local resolver if resolv.conf is empty -* Wed Nov 25 2015 Jan Vcelak 1.6.6-1 +* Wed Feb 10 2016 Jan Vcelak 2.1.1-1 +- new upstream release: + + fix: Allow import of duplicate private key into the KASP + + fix: Avoid duplicate NSEC for Wildcard No Data answer + + fix: Server crash when an incomming transfer is in progress and reload is issued + + fix: Socket polling when configured with many interfaces and threads + + improvement: Use correct source address for UDP messages recieved on ANY address + + improvement: Extend documentation of knotc commands + +* Thu Feb 04 2016 Fedora Release Engineering - 2.1.0-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild + +* Thu Jan 14 2016 Jan Vcelak 2.1.0-1 +- new upstream release: + + improvement: Remove implementation limit for the number of network interfaces + + improvement: Remove possibly insecure server control over a network socket + + fix: Schedule zone bootstrap after slave zone fails to load from disk + +* Sun Dec 20 2015 Jan Vcelak 2.1.0-0.1.rc1 +- new upstream pre-release: + + feature: Per-thread UDP socket binding using SO_REUSEPORT + + feature: Support for dynamic configuration database + + feature: DNSSEC, Support for cryptographic tokens via PKCS #11 interface + + feature: DNSSEC, Experimental support for online signing + + improvement: Support for zone file name patterns + + improvement: Configurable location of zone timer database + + improvement: Non-blocking network operations and better timeout handling + + improvement: Caching of Critical configuration values for better performance + + improvement: Logging of ACL failures + + improvement: RRL: Add rate-limit-slip zero support to drop all responses + + improvement: RRL: Document behavior for different rate-limit-slip options + + improvement: kdig: Warning instead of error on TSIG validation failure + + improvement: Cleanup of support libraries interfaces (libknot, libzscanner, libdnssec) + + fix: synth-record module: Fix application of default configuration options + + fix: TSIG: Allow compressed TSIG name when forwarding DDNS updates + +* Wed Nov 25 2015 Jan Vcelak 2.0.2-1 - new upstream release: + security fix: out-of-bound read in packet parser for malformed NAPTR record - + fix: systemd startup notifications -* Wed Sep 02 2015 Jan Vcelak 1.6.5-1 +* Thu Sep 03 2015 Jan Vcelak 2.0.1-1 - new upstream release: - + fix: don't load expired zones on reload and startup - + fix: remove race condition in scheduling causing delaying of events - + fix: NSEC proof construction in zones with many delegations + + fix: do not reload expired zones on 'knotc reload' and server startup + + fix: rare race-condition in event scheduling causing delayed event execution + + fix: skipping of non-authoritative nodes in NSEC proofs + fix: TC flag setting in RRL slipped answers + fix: disable domain name compression for root label - + fix: check if executed under systemd before using journald log sink - + feature: write persistent timers on server shutdown for better performance - + feature: support time unit specification for 'max-conn-idle', - 'max-conn-handshake', 'max-conn-reply', and 'notify-timeout' config options - + feature: add 'request-edns-config' config option + + fix: fix CNAME following when quering for NSEC RR type + + fix: fix refreshing of DNSSEC signatures for zone keys + + fix: fix binding an unavailable IPv6 address (IP_FREEBIND) + + fix: fix infinite loop in knotc zonestatus and memstats + + fix: fix memory leak in configuration on server shutdown + + fix: fix broken dnsproxy module + + fix: fix multi value parsing on big-endian + + fix: adapt to Nettle 3 API break causing base64 decoding failures on big-endian + + feature: add 'keymgr zone key ds' to show key's DS record + + feature: add 'keymgr tsig generate' to generate TSIG keys + + feature: add query module scoping to process either all queries or zone queries only + + feature: add support for file name globbing in config file includes + + feature: add 'request-edns-option' config option to add custom EDNS0 option into server initiated queries + + improvement: send minimal responses (remove NS from Authority section for NOERROR) + + improvement: update persistent timers only on shutdown for better performance + + improvement: allow change of RR TTL over DDNS + + improvement: documentation fixes, updates, and improvements in formatting + + improvement: install yparser and zscanner header files -* Thu Jun 18 2015 Jan Vcelak 1.6.4-1 +* Mon Jul 20 2015 Jan Vcelak 2.0.0-1 - new upstream release: + + feature: possibility to disable zone file synchronization + + feature: knsupdate, add input prompt in interactive mode + + feature: knsupdate, TSIG algorithm specification in interactive mode + +* Thu Jun 18 2015 Jan Vcelak 2.0.0-0.1.rc1 +- new upstream pre-release: + fix: lost NOTIFY message if received during zone transfer + fix: kdig, record correct dnstap SocketProtocol when retrying over TCP + fix: kdig, hide TSIG section with +noall diff --git a/sources b/sources index bfd502b..b941cb1 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (knot-3.2.13.tar.xz) = ed68faa1d8eba375ca7e22599bafab782f82c3510ec4e3d8a063cbf55c4ee5d5be91a1a045d71e53a36769ec099e252c959471cbc70c1afee2bee4d453732f10 -SHA512 (knot-3.2.13.tar.xz.asc) = e5c58e06fa637b0a3e020383e7bd8ebca47d094085680a5c65ff4fbbbce47453c887e0ebd4cd05947a704ce1eac2268cdfda27c32c35db7d1ac5b0cb644f311e +SHA512 (knot-3.5.2.tar.xz) = 4dd8e42088f792459859da807427024ded926c2a8fb5b9fd4596b631a184269e3d84f0cd4be9192f2546977c598c418f8d44cabccbc393f9f7cf2f0dd5adc595 +SHA512 (knot-3.5.2.tar.xz.asc) = 5f6ee7fedc0d5b904572d2f6d47858065cdc4efa7217b4e9dcbb38ae63a1533646ba2b042bb0c1fe533a3caf6ba41c81010616393d2a0adcea77712608931b38