diff --git a/01-test_net-disable-udp-send-on-unconnected.patch b/01-test_net-disable-udp-send-on-unconnected.patch new file mode 100644 index 0000000..f2b5b11 --- /dev/null +++ b/01-test_net-disable-udp-send-on-unconnected.patch @@ -0,0 +1,26 @@ +Author: Tomas Krizek +Date: 2019-02-28 14:26:56 +0100 + + test_net: disable UDP send on unconnected + + This test started to fail with 5.0 kernel in F30+ on aarch64 and s390x. + The functionality isn't used by Knot DNS, so disabling this test until + the issue is resolved should be safe. + + Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1675235 + +diff --git a/tests/contrib/test_net.c b/tests/contrib/test_net.c +index 0a22abbbc..6ec4bda31 100644 +--- a/tests/contrib/test_net.c ++++ b/tests/contrib/test_net.c +@@ -310,10 +310,6 @@ static void test_unconnected(void) + r = net_dgram_recv(sock, buffer, buffer_len, TIMEOUT_SHORT); + is_int(KNOT_ETIMEOUT, r, "UDP, receive timeout on unconnected socket"); + +- struct sockaddr_storage server_addr = addr_from_socket(server); +- r = net_dgram_send(sock, buffer, buffer_len, &server_addr); +- is_int(buffer_len, r, "UDP, send on defined address"); +- + close(sock); + + // TCP diff --git a/02-revert-AC_PROG_CC.patch b/02-revert-AC_PROG_CC.patch new file mode 100644 index 0000000..fb49c00 --- /dev/null +++ b/02-revert-AC_PROG_CC.patch @@ -0,0 +1,18 @@ +From: Daniel Salzman +Date: Sun, 20 Feb 2022 20:38:35 +0100 +Subject: [PATCH] Revert "configure: upgrade from AC_PROG_CC_C99 to AC_PROG_CC" + +diff --git a/configure.ac b/configure.ac +index 6506197ed..c7df7f815 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -38,7 +38,8 @@ release_date=$($SED -n 's/^Knot DNS .* (\(.*\))/\1/p;q;' ${srcdir}/NEWS) + AC_SUBST([RELEASE_DATE], $release_date) + + # Set compiler compatibility flags +-AC_PROG_CC ++AC_PROG_CC_C99 # AC_PROG_CC not supported by CentOS 7 ++AM_PROG_CC_C_O # Needed by CentOS 7 + AC_PROG_CPP_WERROR + + # Set default CFLAGS diff --git a/knot.spec b/knot.spec index 4b79d07..49320d8 100644 --- a/knot.spec +++ b/knot.spec @@ -2,19 +2,12 @@ %{!?_pkgdocdir: %global _pkgdocdir %{_docdir}/%{name}} %define GPG_CHECK 1 -%if 0%{?fedora} >= 40 || 0%{?rhel} >= 9 -# use modern %pyproject_* macros on distros which support them -%define PYPROJECT 1 -%else -# use older %py3_* macros on older/other distros -%define PYPROJECT 0 -%endif %define BASE_VERSION %(echo "%{version}" | sed 's/^\\([^.]\\+\\.[^.]\\+\\).*/\\1/') %define repodir %{_builddir}/%{name}-%{version} Summary: High-performance authoritative DNS server Name: knot -Version: 3.5.2 +Version: 3.2.13 Release: 1%{?dist} License: GPL-3.0-or-later URL: https://www.knot-dns.cz @@ -29,14 +22,23 @@ Source100: gpgkey-742FA4E95829B6C5EAC6B85710BB7AF6FEBBD6AB.gpg.asc BuildRequires: gnupg2 %endif +# Test fails on F30+ aarch/s390x for unknown reason, but it is not neccassary for Knot DNS +Patch1: 01-test_net-disable-udp-send-on-unconnected.patch +# Revert config improvement to support EL 7 +Patch2: 02-revert-AC_PROG_CC.patch + # Required dependencies BuildRequires: autoconf BuildRequires: automake BuildRequires: libtool BuildRequires: make +%if 0%{?rhel} == 7 +BuildRequires: devtoolset-12-gcc +%else BuildRequires: gcc +%endif BuildRequires: pkgconfig(liburcu) -BuildRequires: pkgconfig(gnutls) +BuildRequires: pkgconfig(gnutls) >= 3.3 BuildRequires: pkgconfig(libedit) # Optional dependencies @@ -46,26 +48,11 @@ BuildRequires: pkgconfig(libmnl) BuildRequires: pkgconfig(libnghttp2) BuildRequires: pkgconfig(libsystemd) BuildRequires: pkgconfig(systemd) -BuildRequires: pkgconfig(hiredis) -%if 0%{?fedora} || 0%{?rhel} -BuildRequires: softhsm -%endif # dnstap dependencies BuildRequires: pkgconfig(libfstrm) BuildRequires: pkgconfig(libprotobuf-c) # geoip dependencies BuildRequires: pkgconfig(libmaxminddb) -# XDP dependencies -BuildRequires: pkgconfig(libbpf) -# Python modules (python3-libknot, knot-exporter) dependencies -BuildRequires: python3-devel -%if 0%{?PYPROJECT} -BuildRequires: pyproject-rpm-macros -BuildRequires: python3-pip -BuildRequires: python3-hatchling -%else -BuildRequires: python3-setuptools -%endif # Distro-dependent dependencies %if 0%{?suse_version} @@ -73,21 +60,18 @@ BuildRequires: python3-Sphinx BuildRequires: lmdb-devel BuildRequires: protobuf-c Requires(pre): pwdutils -%if 0%{?sle_version} != 150400 -BuildRequires: pkgconfig(libxdp) %endif +%if 0%{?rhel} && 0%{?rhel} <= 7 +BuildRequires: python-sphinx +BuildRequires: lmdb-devel %endif -%if 0%{?fedora} || 0%{?rhel} +%if 0%{?fedora} || 0%{?rhel} > 7 BuildRequires: python3-sphinx BuildRequires: pkgconfig(lmdb) -%if 0%{?fedora} || 0%{?rhel} >= 9 -BuildRequires: pkgconfig(libxdp) -%endif %endif -%if 0%{?rhel} >= 9 || 0%{?suse_version} || 0%{?fedora} -%define configure_quic --enable-quic=yes -%endif +# disable XDP on old EL +%define configure_xdp --enable-xdp=no Requires(post): systemd %{_sbindir}/runuser Requires(preun): systemd @@ -95,19 +79,11 @@ Requires(postun): systemd Requires: %{name}-libs%{?_isa} = %{version}-%{release} -Recommends: %{name}-keymgr - -%if 0%{?suse_version} -Provides: group(knot) -%endif - %description Knot DNS is a high-performance authoritative DNS server implementation. %package libs Summary: Libraries used by the Knot DNS server and client applications -# Knot DNS 3.5+ isn't compatible with earlier knot-resolver -Conflicts: knot-resolver < 5.7.6-3 %description libs The package contains shared libraries used by the Knot DNS server and @@ -137,13 +113,6 @@ Requires: %{name}-libs%{?_isa} = %{version}-%{release} %description dnssecutils The package contains DNSSEC tools shipped with the Knot DNS server. -%package keymgr -Summary: Knot DNS key management utility -Requires: %{name}-libs%{?_isa} = %{version}-%{release} - -%description keymgr -The package contains keymgr program for Knot DNS key management. - %package module-dnstap Summary: dnstap module for Knot DNS Requires: %{name} = %{version}-%{release} @@ -158,30 +127,6 @@ Requires: %{name} = %{version}-%{release} %description module-geoip The package contains geoip Knot DNS module for geography-based responses. -%package exporter -Summary: Prometheus exporter for Knot DNS -BuildArch: noarch -Requires: %{name}-libs = %{version}-%{release} - -%description exporter -The package provides Python Prometheus exporter for Knot DNS. - -%package -n python3-libknot -Summary: Python bindings for libknot -BuildArch: noarch -Requires: %{name}-libs = %{version}-%{release} -%{?python_provide:%python_provide python3-libknot} - -%description -n python3-libknot -The package provides Python bindings for the libknot shared library. - -%package -n valkey-module-knot -Summary: Valkey module for Knot DNS. -Requires: %{name}-libs = %{version}-%{release} - -%description -n valkey-module-knot -The package provides Valkey module for Knot DNS. - %package doc Summary: Documentation for the Knot DNS server BuildArch: noarch @@ -201,12 +146,10 @@ gpg2 --verify %{SOURCE1} %{SOURCE0} %endif %autosetup -p1 -# Create a sysusers.d config file -cat >knot.sysusers.conf < 7 -install -p -m 0644 -D %{repodir}/distro/common/cz.nic.knotd.conf %{buildroot}%{_datadir}/dbus-1/system.d/cz.nic.knotd.conf +install -p -m 0644 -D %{repodir}/distro/common/cz.nic.knotd.conf %{buildroot}%{_sysconfdir}/dbus-1/system.d/cz.nic.knotd.conf %endif # install systemd files -install -p -m 0644 -D %{repodir}/distro/common/%{name}.service %{buildroot}%{_unitdir}/%{name}.service +install -p -m 0644 -D %{repodir}/distro/pkg/el-7/%{name}.service %{buildroot}%{_unitdir}/%{name}.service +install -p -m 0644 -D %{repodir}/distro/pkg/el-7/%{name}.tmpfiles %{buildroot}%{_tmpfilesdir}/%{name}.conf %if 0%{?suse_version} ln -s service %{buildroot}/%{_sbindir}/rcknot %endif @@ -299,17 +209,23 @@ install -d -m 0770 -D %{buildroot}%{_sharedstatedir}/knot # remove libarchive files find %{buildroot} -type f -name "*.la" -delete -print -install -m0644 -D knot.sysusers.conf %{buildroot}%{_sysusersdir}/knot.conf - %check +%if 0%{?rhel} == 7 +. /opt/rh/devtoolset-12/enable +%endif V=1 make check %pre +getent group knot >/dev/null || groupadd -r knot +getent passwd knot >/dev/null || \ + useradd -r -g knot -d %{_sharedstatedir}/knot -s /sbin/nologin \ + -c "Knot DNS server" knot %if 0%{?suse_version} %service_add_pre knot.service %endif %post +systemd-tmpfiles --create %{_tmpfilesdir}/knot.conf &>/dev/null || : %if 0%{?suse_version} %service_add_post knot.service %else @@ -341,17 +257,19 @@ V=1 make check %license COPYING %doc %{_pkgdocdir} %exclude %{_pkgdocdir}/html -%attr(750,root,knot) %dir %{_sysconfdir}/knot +%attr(770,root,knot) %dir %{_sysconfdir}/knot %config(noreplace) %attr(640,root,knot) %{_sysconfdir}/knot/knot.conf %if 0%{?fedora} || 0%{?rhel} > 7 -%config(noreplace) %attr(644,root,root) %{_datadir}/dbus-1/system.d/cz.nic.knotd.conf +%config(noreplace) %attr(644,root,root) %{_sysconfdir}/dbus-1/system.d/cz.nic.knotd.conf %endif %attr(770,root,knot) %dir %{_sharedstatedir}/knot %dir %{_libdir}/knot %dir %{_libdir}/knot/modules-* %{_unitdir}/knot.service +%{_tmpfilesdir}/knot.conf %{_sbindir}/kcatalogprint %{_sbindir}/kjournalprint +%{_sbindir}/keymgr %{_sbindir}/knotc %{_sbindir}/knotd %if 0%{?suse_version} @@ -360,17 +278,19 @@ V=1 make check %{_mandir}/man5/knot.conf.* %{_mandir}/man8/kcatalogprint.* %{_mandir}/man8/kjournalprint.* +%{_mandir}/man8/keymgr.* %{_mandir}/man8/knotc.* %{_mandir}/man8/knotd.* %ghost %attr(770,root,knot) %dir %{_rundir}/knot -%{_sysusersdir}/knot.conf %files utils %{_bindir}/kdig %{_bindir}/khost %{_bindir}/knsupdate +%if 0%{?use_xdp} %{_sbindir}/kxdpgun %{_mandir}/man8/kxdpgun.* +%endif %{_mandir}/man1/kdig.* %{_mandir}/man1/khost.* %{_mandir}/man1/knsupdate.* @@ -383,28 +303,12 @@ V=1 make check %{_mandir}/man1/kzonecheck.* %{_mandir}/man1/kzonesign.* -%files keymgr -%{_sbindir}/keymgr -%{_mandir}/man8/keymgr.* - %files module-dnstap %{_libdir}/knot/modules-*/dnstap.so %files module-geoip %{_libdir}/knot/modules-*/geoip.so -%files exporter -%{_bindir}/knot-exporter -%{python3_sitelib}/knot_exporter -%{python3_sitelib}/knot_exporter-*-info - -%files -n python3-libknot -%{python3_sitelib}/libknot -%{python3_sitelib}/libknot-*-info - -%files -n valkey-module-knot -%attr(0755, root, root) %{_libdir}/valkey/modules/knot.so - %files libs %license COPYING %doc NEWS @@ -431,126 +335,40 @@ V=1 make check %doc %{_pkgdocdir}/html %changelog -* Fri Dec 19 2025 Jakub Ružička - 3.5.2-1 -- Update to 3.5.2 +* Tue Jun 25 2024 Jakub Ružička - 3.2.13-1 +- Update to 3.2.13 -* Thu Oct 16 2025 Jakub Ružička - 3.5.1-1 -- Update to 3.5.1 -- Add new valkey-module-knot package -- Split keymgr into knot-keymgr package +* Wed Jan 24 2024 Jakub Ružička - 3.2.12-1 +- Update to 3.2.12 -* Fri Sep 19 2025 Python Maint - 3.4.8-3 -- Rebuilt for Python 3.14.0rc3 bytecode +* Mon Oct 30 2023 Jakub Ružička - 3.2.11-1 +- Update to 3.2.11 -* Fri Aug 15 2025 Python Maint - 3.4.8-2 -- Rebuilt for Python 3.14.0rc2 bytecode - -* Wed Jul 30 2025 Jakub Ružička - 3.4.8-1 -- Update to 3.4.8 - -* Thu Jul 24 2025 Fedora Release Engineering - 3.4.7-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild - -* Thu Jun 12 2025 Jakub Ružička - 3.4.7-1 -- Update to 3.4.7 -- Add new knot-exporter and python3-libknot packages - -* Thu Apr 10 2025 Jakub Ružička - 3.4.6-1 -- Update to 3.4.6 - -* Wed Mar 19 2025 Jakub Ružička - 3.4.5-1 -- Update to 3.4.5 - -* Thu Jan 23 2025 Zbigniew Jędrzejewski-Szmek - 3.4.4-2 -- Add sysusers.d config file to allow rpm to create users/groups automatically - -* Thu Jan 23 2025 Jakub Ružička - 3.4.4-1 -- Update to 3.4.4 - -* Fri Jan 17 2025 Fedora Release Engineering - 3.4.3-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild - -* Tue Dec 10 2024 Jakub Ružička - 3.4.3-1 -- Update to 3.4.3 - -* Mon Nov 25 2024 Jakub Ružička - 3.4.2-1 -- Update to 3.4.2 - -* Mon Aug 26 2024 Jakub Ružička - 3.3.9-1 -- Update to 3.3.9 - -* Mon Jul 22 2024 Jakub Ružička - 3.3.8-1 -- Update to 3.3.8 - -* Thu Jul 18 2024 Fedora Release Engineering - 3.3.7-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - -* Tue Jun 25 2024 Jakub Ružička - 3.3.7-1 -- Update to 3.3.7 - -* Thu Jun 13 2024 Jakub Ružička - 3.3.6-1 -- Update to 3.3.6 - -* Thu Mar 07 2024 Jakub Ružička - 3.3.5-1 -- Update to 3.3.5 - -* Wed Jan 24 2024 Jakub Ružička - 3.3.4-1 -- Update to 3.3.4 - -* Sun Jan 21 2024 Fedora Release Engineering - 3.3.3-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - -* Wed Dec 13 2023 Jakub Ružička - 3.3.3-1 -- Update to 3.3.3 - -* Fri Oct 20 2023 Jakub Ružička - 3.3.2-1 -- Update to 3.3.2 - -* Tue Sep 12 2023 Jakub Ružička - 3.3.1-1 -- Update to 3.3.1 - -* Mon Aug 28 2023 Jakub Ružička - 3.3.0-1 -- Update to 3.3.0 +* Tue Sep 12 2023 Jakub Ružička - 3.2.10-1 +- Update to 3.2.10 * Thu Jul 27 2023 Jakub Ružička - 3.2.9-1 - Update to 3.2.9 -* Thu Jul 20 2023 Fedora Release Engineering - 3.2.8-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - * Mon Jun 26 2023 Jakub Ružička - 3.2.8-1 - Update to 3.2.8 * Tue Jun 06 2023 Jakub Ružička - 3.2.7-1 - Update to 3.2.7 -- Remove unneeded tests patch -- Use _datadir for config - -* Fri May 12 2023 Michel Alexandre Salim - 3.2.6-2 -- Add BR on libxdp on RHEL >= 9 to use with libbpf-1.x * Thu Apr 06 2023 Jakub Ružička - 3.2.6-1 - Update to 3.2.6 -- Sync upstream packaging improvements * Thu Feb 02 2023 Jakub Ružička - 3.2.5-1 - Update to 3.2.5 -* Thu Jan 19 2023 Fedora Release Engineering - 3.2.4-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - * Mon Dec 12 2022 Jakub Ružička - 3.2.4-1 - Update to 3.2.4 - -* Mon Nov 28 2022 Jakub Ružička - 3.2.3-2 -- Rebuilt for libbpf 1.0 transition +- Use devtoolset-12-gcc on EPEL 7 * Mon Nov 21 2022 Jakub Ružička - 3.2.3-1 - Update to 3.2.3 -* Fri Nov 04 2022 Jakub Ružička - 3.2.2-2 -- New BuildRequires: libxdp (needed for libbpf >= 1.0) - * Tue Nov 01 2022 Jakub Ružička - 3.2.2-1 - Update to 3.2.2 @@ -563,14 +381,11 @@ V=1 make check - Update to 3.2.0 - Patch: fix tests on 32-bit platforms - Patch: revert problematic hardening of service file -- Enable QUIC +- Patch: revert config improvement to support EL 7 - New knot-dnssecutils subpackage - Debian compat (knot-utils vs knot-dnsutils) - Remove bundled(jquery) version as it differes between distros -* Thu Jul 21 2022 Fedora Release Engineering - 3.1.8-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - * Thu Apr 28 2022 Jakub Ružička - 3.1.8-1 - Update to 3.1.8 @@ -579,24 +394,14 @@ V=1 make check * Thu Feb 10 2022 Jakub Ružička - 3.1.6-1 - Update to 3.1.6 -- Add dbus config - Use _sharedstatedir for home -* Thu Jan 20 2022 Fedora Release Engineering - 3.1.5-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - -* Wed Jan 05 2022 Jakub Ružička 3.1.5-1 +* Wed Jan 05 2022 Jakub Ružička - 3.1.5-1 - Update to 3.1.5 -* Sat Nov 06 2021 Adrian Reber - 3.1.4-2 -- Rebuilt for protobuf 3.19.0 - * Thu Nov 04 2021 Jakub Ružička - 3.1.4-1 - Update to 3.1.4 -* Tue Oct 26 2021 Adrian Reber - 3.1.3-2 -- Rebuilt for protobuf 3.18.1 - * Tue Oct 19 2021 Jakub Ružička - 3.1.3-1 - Update to 3.1.3 @@ -617,9 +422,6 @@ V=1 make check - Add missing BuildRequires including new libmnl for kxdpgun - Temporarily disable XDP on ARM until issues are resolved -* Thu Jul 22 2021 Fedora Release Engineering - 3.0.8-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - * Fri Jul 16 2021 Jakub Ružička - 3.0.8-1 - Update to 3.0.8 - Print failed tests during check @@ -635,40 +437,24 @@ V=1 make check - Properly escape BASE_VERSION macro - Include module dirs in main package -* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek - 3.0.4-2 -- Rebuilt for updated systemd-rpm-macros - See https://pagure.io/fesco/issue/2583. - * Mon Feb 01 2021 Jakub Ružička - 3.0.4-1 - Update to 3.0.4 - Move dnstap module to subpackage - Move geoip module to subpackage - Remove redundant VERSION macro -* Tue Jan 26 2021 Fedora Release Engineering - 3.0.3-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - -* Thu Jan 14 08:45:48 CET 2021 Adrian Reber - 3.0.3-2 -- Rebuilt for protobuf 3.14 - * Thu Dec 17 2020 Jakub Ružička - 3.0.3-1 - Update to 3.0.3 -* Wed Nov 11 2020 Jakub Ružička - 3.0.2-2 -- Remove patch included in upstream release - * Wed Nov 11 2020 Jakub Ružička - 3.0.2-1 - Update to 3.0.2 -* Thu Oct 29 2020 Jakub Ružička - 3.0.1-2 -- Respect GnuTLS insecure algorithms - * Mon Oct 12 2020 Jakub Ružička - 3.0.1-1 - Update to 3.0.1 - Sync packaging from upstream -* Thu Sep 24 2020 Adrian Reber - 3.0.0-2 -- Rebuilt for protobuf 3.13 +* Fri Sep 25 2020 Jakub Ružička 3.0.0-2 +- Rebuild * Thu Sep 10 2020 Jakub Ružička 3.0.0-1 - New major upstream release 3.0.0 @@ -677,12 +463,6 @@ V=1 make check * Wed Sep 02 2020 Jakub Ružička 2.9.6-1 - Update to 2.9.6 -* Tue Jul 28 2020 Fedora Release Engineering - 2.9.5-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - -* Sun Jun 14 2020 Adrian Reber - 2.9.5-2 -- Rebuilt for protobuf 3.12 - * Mon May 25 2020 Tomas Krizek - 2.9.5-1 - new upstream release 2.9.5 @@ -692,9 +472,6 @@ V=1 make check * Tue Mar 03 2020 Tomas Krizek - 2.9.3-1 - new upstream release 2.9.3 -* Wed Jan 29 2020 Fedora Release Engineering - 2.9.2-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - * Fri Dec 13 2019 Tomas Krizek - 2.9.2-1 - new upstream release 2.9.2 @@ -706,208 +483,27 @@ V=1 make check * Tue Sep 24 2019 Tomas Krizek - 2.8.4-1 - new upstream release 2.8.4 -* Thu Jul 25 2019 Fedora Release Engineering - 2.8.3-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild +* Wed Aug 21 2019 Tomas Krizek - 2.8.3-1 +- new upstream release 2.8.3 -* Tue Jul 16 2019 Tomas Krizek - 2.8.3-1 -- New upstream release 2.8.3 +* Thu Jul 11 2019 Tomas Krizek - 2.8.2-1 +- rebase to latest upstream version 2.8.2 -* Wed Jun 26 2019 Tomas Krizek - 2.8.2-1 -- New upstream release 2.8.2 - -* Wed May 29 2019 Tomas Krizek - 2.8.1-1 -- New upstream release 2.8.1 -- Resolves BZ#1700251 - -* Thu Feb 28 2019 Tomas Krizek - 2.7.6-3 -- Added 01-test_net-disable-udp-send-on-unconnected.patch to disable - unnecessary failing test. Fixes BZ#1675235 - -* Fri Feb 01 2019 Fedora Release Engineering - 2.7.6-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild - -* Wed Jan 23 2019 Tomas Krizek - 2.7.6-1 -Knot DNS 2.7.6 (2019-01-23) +* Mon Oct 01 2018 Tomas Krizek - 2.6.9-1 +Knot DNS 2.6.9 (2018-08-14) =========================== Improvements: ------------- - - Zone status also shows when the zone load is scheduled - - Server workers status also shows background workers utilization - - Default control timeout for knotc was increased to 10 seconds - - Pkg-config files contain auxiliary variable with library filename - -Bugfixes: ---------- - - Configuration commit or server reload can drop some pending zone events - - Nonempty zone journal is created even though it's disabled #635 - - Zone is completely re-signed during empty dynamic update processing - - Server can crash when storing a big zone difference to the journal - - Failed to link on FreeBSD 12 with Clang - -* Mon Jan 07 2019 Tomas Krizek - 2.7.5-1 -Knot DNS 2.7.5 (2019-01-07) -=========================== - -Features: ---------- - - Keymgr supports NSEC3 salt handling - -Improvements: -------------- - - Zone history in journal is dropped apon AXFR-like zone update - - Libdnssec is no longer linked against libm #628 - - Libdnssec is explicitly linked against libpthread if PKCS #11 enabled #629 - - Better support for libknot packaging in Python - - Manually generated KSK is 'ready' by default - - Kdig supports '+timeout' as an alias for '+time' - - Kdig supports '+nocomments' option - - Kdig no longer prints empty lines between retries - - Kdig returns failure if operations not successfully resolved #632 - - Fixed repeating of the 'KSK submission, waiting for confirmation' log - - Various improvements in documentation, Dockerfile, and tests - -Bugfixes: ---------- - - Knotc fails to unset huge configuration section - - Kjournalprint sometimes fails to display zone journal content - - Improper timing of ZSK removal during ZSK rollover - - Missing UTC time zone indication in the 'iso' keymgr list output - - A race condition in the online signing module - -* Tue Nov 13 2018 Tomas Krizek - 2.7.4-1 -Knot DNS 2.7.4 (2018-11-13) -=========================== - -Features: ---------- - - Added SNI configuration for TLS in kdig (Thanks to Alexander Schultz) - -Improvements: -------------- - - Added warning log when DNSSEC events not successfully scheduled - - New semantic check on timer values in keymgr - - DS query no longer asks other addresses if got a negative answer - - Reintroduced 'rollover' configuration option for CDS/CDNSKEY publication - - Extended logging for zone loading - - Various documentation improvements - -Bugfixes: ---------- - - Failed to import module configuration #613 - - Improper Cflags value in libknot.pc if built with embedded LMDB #615 - - IXFR doesn't fall back to AXFR if malformed reply - - DNSSEC events not correctly scheduled for empty zone updates - - During algorithm rollover old keys get removed before DS TTL expires #617 - - Maximum zone's RRSIG TTL not considered during algorithm rollover #620 - -* Fri Oct 12 2018 Tomas Krizek - 2.7.3-1 -Knot DNS 2.7.3 (2018-10-11) -=========================== - -Features: ---------- - - New queryacl module for query access control - - Configurable answer rrset rotation #612 - - Configurable NSEC bitmap in online signing - -Improvements: -------------- - - Better error logging for KASP DB operations #601 - - Some documentation improvements - -Bugfixes: ---------- - - Keymgr "list" output doesn't show key size for ECDSA algorithms #602 - - Failed to link statically with embedded LMDB - - Configuration commit causes zone reload for all zones - - The statistics module overlooks TSIG record in a request - - Improper processing of an AXFR-style-IXFR response consisting of one-record messages - - Race condition in online signing during key rollover #600 - - Server can crash if geoip module is enabled in the geo mode - -* Wed Aug 29 2018 Tomas Krizek - 2.7.2-1 -Knot DNS 2.7.2 (2018-08-29) -=========================== - -Improvements: -------------- - - Keymgr list command displays also key size - - Kjournalprint displays total occupied size in the debug mode - - Server doesn't stop if failed to load a shared module from the module directory - - Libraries libcap-ng, pthread, and dl are linked selectively if needed - -Bugfixes: ---------- - - Sometimes incorrect result from dnssec_nsec_bitmap_contains (libdnssec) - - Server can crash when loading zone file difference and zone-in-journal is set - - Incorrect treatment of specific queries in the module RRL - - Failed to link module Cookies as a shared library - -* Wed Aug 15 2018 Tomas Krizek - 2.7.1-1 -Knot DNS 2.7.1 (2018-08-14) -=========================== - -Improvements: -------------- - - Added zone wire size information to zone loading log message + - Added zone wire size to zone loading log message - Added debug log message for each unsuccessful remote address operation - - Various improvements for packaging Bugfixes: --------- - - Incompatible handling of RRSIG TTL value when creating a DNS message - - Incorrect RRSIG TTL value in zone differences and knotc zone operation outputs - - Default configure prefix is ignored - -Knot DNS 2.7.0 (2018-08-03) -=========================== - -Features: ---------- - - New DNS Cookies module and related '+cookie' kdig option - - New module for response tailoring according to client's subnet or geographic location - - General EDNS Client Subnet support in the server - - OSS-Fuzz integration (Thanks to Jonathan Foote) - - New '+ednsopt' kdig option (Thanks to Jan Včelák) - - Online Signing support for automatic key rollover - - Non-normal file (e.g. pipe) loading support in zscanner #542 - - Automatic SOA serial incrementation if non-empty zone difference - - New zone file load option for ignoring zone file's SOA serial - - New build-time option for alternative malloc specification - - Structured logging for DNSSEC key submission event - - Empty QNAME support in kdig - -Improvements: -------------- - - Various library and server optimizations - - Reduced memory consumption of outgoing IXFR processing - - Linux capabilities use overhaul #546 (Thanks to Robert Edmonds) - - Online Signing properly signs delegations and CNAME records - - CDS/CDNSKEY rrset is signed with KSK instead of ZSK - - DNSSEC-related records are ignored when loading zone difference with signing enabled - - Minimum allowed RSA key length was increased to 1024 - - Removed explicit dependency on Nettle - -Bugfixes: ---------- - - Possible uninitialized address buffer use in zscanner - - Possible index overflow during multiline record parsing in zscanner - - kdig +tls sometimes consumes 100 % CPU #561 - - Single-Type Signing doesn't work with single ZSK key #566 - Zone not flushed after re-signing during zone load #594 - Server crashes when committing empty zone transaction - Incoming IXFR with on-slave signing sometimes leads to memory corruption #595 -Compatibility: --------------- - - Removed obsolete RRL configuration - - Removed obsolete module names 'mod-online-sign' and 'mod-synth-record' - - Removed obsolete 'ixfr-from-differences' configuration option - - Removed old journal migration - - Removed module rosedb - - * Fri Jul 13 2018 Fedora Release Engineering - 2.6.8-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild @@ -1172,6 +768,15 @@ WARNING: Automatic upgrade from versions 1.y.z is no longer possible. To migrate, upgrade your packages gradually or use contacts listed on https://www.knot-dns.cz/support/ (if you are in trouble). +* Mon Jul 31 2017 Petr Spacek - 2.5.3-2 +- disable dnstap on RHEL (depedencies are missing) + +* Mon Jul 31 2017 Petr Spacek - 2.5.3-1 +- new upstream release +WARNING: Automatic upgrade from versions 1.y.z is no longer possible. +To migrate, upgrade your packages gradually or use contacts listed on +https://www.knot-dns.cz/support/ (if you are in trouble). + Knot DNS 2.5.3 (2017-07-14) =========================== @@ -1253,23 +858,6 @@ Improvements: - Added libidn2 support to kdig (with libidn fallback) - Maximum timer database switched from configure to the server configuration -* Wed Jul 26 2017 Fedora Release Engineering - 2.4.5-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild - -* Mon Jul 10 2017 Petr Spacek - 2.4.5-1 -New upstream release: 2.4.5 - -Knot DNS 2.4.5 (2017-06-23) -=========================== - -Security: ---------- - - Improper TSIG validity period check can allow TSIG forgery (Thanks to Synacktiv!) - -Bugfixes: ---------- - - Corner case journal fixes (huge changesets, OpenWRT operation) - Knot DNS 2.4.4 (2017-06-05) =========================== @@ -1323,22 +911,13 @@ Bugfixes: - Incorrect elapsed time in the DDNS log - Failed to process forwarded DDNS request with TSIG +* Mon Mar 13 2017 Petr Spacek - 2.4.1-2 +- configuration checking was fixed to be compatible with Knot 2.4.x + * Mon Feb 27 2017 Petr Spacek - 2.4.1-1 -- new upstream release: - + fix: Transfer of a huge rrset goes into an infinite loop - + fix: Huge response over TCP contains useless TC bit instead of SERVFAIL - + fix: Failed to build utilities with disabled daemon - + fix: Memory leaks during keys removal - + fix: Rough TSIG packet reservation causes early truncation - + fix: Minor out-of-bounds string termination write in rrset dump - + fix: Server crash during stop if failed to open timers DB - + fix: Failed to compile on OS X older than Sierra - + fix: Poor minimum UDP-max-size configuration check - + fix: Failed to receive one-record-per-message IXFR-style AXFR - + fix: Kdig timeouts when receiving RCODE != NOERROR on subsequent transfer message - + improvement: Speed-up of rdata addition into a huge rrset - + improvement: Introduce check of minumum timeout for next refresh - + improvement: Dnsproxy module can forward all queries without local resolving +- new upstream release 2.4.1 replaces old 1.6.x series which is not supported +- configuration should be upgraded automatically using knot1to2 tool +- make sure you reviewed the new configuration in /etc/knot directory! * Fri Feb 10 2017 Fedora Release Engineering - 2.4.0-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild @@ -1422,129 +1001,51 @@ Bugfixes: + improvement: Set TC flag in delegation only if mandatory glue doesn't fit the response + improvement: Separate EDNS(0) payload size configuration for IPv4 and IPv6 + feature: Zone size limit restriction for DDNS, AXFR, and IXFR (CVE-2016-6171) - + feature: DNS-over-TLS support in kdig (RFC 7858) - + feature: EDNS(0) padding and alignment support in kdig (RFC 7830) -* Fri Jun 24 2016 Jan Vcelak - 2.2.1-2 -- rebuild for updated userspace-rcu - -* Mon May 30 2016 Jan Vcelak - 2.2.1-1 +* Tue Aug 09 2016 Jan Vcelak - 1.6.8-1 - new upstream release: - + fix: Separate logging of server and zone events - + fix: Concurrent zone file flushing with many zones - + fix: Control timeout parsing in knotc - + fix: "Environment maxreaders limit reached" error in knotc - + fix: Don't apply journal changes on modified zone file - + fix: Enable multiple zone names completion in interactive knotc - + fix: Set the TC flag in a response if a glue doesn't fit the response - + fix: Disallow server reload when there is an active configuration transaction - + improvement: Distinguish unavailable zones from zones with zero serial in log messages - + improvement: Log warning and error messages to standard error output in all utilities - + improvement: Document tested PKCS #11 devices - + improvement: Extended Python configuration interface -- update requirements for Fedora 25 + + fix: Transfer of a huge rrset goes into an infinite loop + + fix: Huge response over TCP contains useless TC bit instead of SERVFAIL + + fix: Failed to build utilities with disabled daemon + + fix: Memory leaks during keys removal + + fix: Rough TSIG packet reservation causes early truncation + + fix: Minor out-of-bounds string termination write in rrset dump + + fix: Server crash during stop if failed to open timers DB + + fix: Failed to compile on OS X older than Sierra + + fix: Poor minimum UDP-max-size configuration check + + fix: Failed to receive one-record-per-message IXFR-style AXFR + + fix: Kdig timeouts when receiving RCODE != NOERROR on subsequent transfer message + + improvement: Speed-up of rdata addition into a huge rrset + + improvement: Introduce check of minumum timeout for next refresh + + improvement: Dnsproxy module can forward all queries without local resolving -* Sun May 29 2016 Jan Vcelak - 2.2.0-3 -- update default configuration file - -* Sun May 08 2016 Jan Vcelak - 2.2.0-2 -- fix: systemd service starting - -* Tue Apr 26 2016 Jan Vcelak - 2.2.0-1 +* Wed Feb 10 2016 Jan Vcelak 1.6.7-1 - new upstream release: - + fix: Query/response message type setting in dnstap module - + fix: Remote address retrieval from dnstap capture in kdig - + fix: Global modules execution for queries hitting existing zones - + fix: Execution of semantic checks after an IXFR transfer - + fix: kdig failure when the first AXFR message contains just the SOA record - + fix: Exclude non-authoritative types from NSEC/NSEC3 bitmap at a delegation - + fix: Mark PKCS#11 generated keys as sensitive - + fix: Error when removing the only zone from the server - + fix: Don't abort knotc transaction when some check fails - + feature: URI and CAA resource record types support - + feature: RRL client address based white list - + feature: knotc interactive mode - + improvement: Consistent IXFR error messages - + improvement: Various fixes for better compatibility with PKCS#11 devices - + improvement: Various keymgr user interface improvements - + improvement: Better zone event scheduler performance with many zones - + improvement: New server control interface - + improvement: kdig uses local resolver if resolv.conf is empty + + improvement: Log change of the zone serial number after IXFR transfer + + improvement: Document operational impact of various RRL settings + + improvement: Add support for rate-limit-slip zero + + improvement: Add 'timer-db' configuration option -* Wed Feb 10 2016 Jan Vcelak 2.1.1-1 -- new upstream release: - + fix: Allow import of duplicate private key into the KASP - + fix: Avoid duplicate NSEC for Wildcard No Data answer - + fix: Server crash when an incomming transfer is in progress and reload is issued - + fix: Socket polling when configured with many interfaces and threads - + improvement: Use correct source address for UDP messages recieved on ANY address - + improvement: Extend documentation of knotc commands - -* Thu Feb 04 2016 Fedora Release Engineering - 2.1.0-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild - -* Thu Jan 14 2016 Jan Vcelak 2.1.0-1 -- new upstream release: - + improvement: Remove implementation limit for the number of network interfaces - + improvement: Remove possibly insecure server control over a network socket - + fix: Schedule zone bootstrap after slave zone fails to load from disk - -* Sun Dec 20 2015 Jan Vcelak 2.1.0-0.1.rc1 -- new upstream pre-release: - + feature: Per-thread UDP socket binding using SO_REUSEPORT - + feature: Support for dynamic configuration database - + feature: DNSSEC, Support for cryptographic tokens via PKCS #11 interface - + feature: DNSSEC, Experimental support for online signing - + improvement: Support for zone file name patterns - + improvement: Configurable location of zone timer database - + improvement: Non-blocking network operations and better timeout handling - + improvement: Caching of Critical configuration values for better performance - + improvement: Logging of ACL failures - + improvement: RRL: Add rate-limit-slip zero support to drop all responses - + improvement: RRL: Document behavior for different rate-limit-slip options - + improvement: kdig: Warning instead of error on TSIG validation failure - + improvement: Cleanup of support libraries interfaces (libknot, libzscanner, libdnssec) - + fix: synth-record module: Fix application of default configuration options - + fix: TSIG: Allow compressed TSIG name when forwarding DDNS updates - -* Wed Nov 25 2015 Jan Vcelak 2.0.2-1 +* Wed Nov 25 2015 Jan Vcelak 1.6.6-1 - new upstream release: + security fix: out-of-bound read in packet parser for malformed NAPTR record + + fix: systemd startup notifications -* Thu Sep 03 2015 Jan Vcelak 2.0.1-1 +* Wed Sep 02 2015 Jan Vcelak 1.6.5-1 - new upstream release: - + fix: do not reload expired zones on 'knotc reload' and server startup - + fix: rare race-condition in event scheduling causing delayed event execution - + fix: skipping of non-authoritative nodes in NSEC proofs + + fix: don't load expired zones on reload and startup + + fix: remove race condition in scheduling causing delaying of events + + fix: NSEC proof construction in zones with many delegations + fix: TC flag setting in RRL slipped answers + fix: disable domain name compression for root label - + fix: fix CNAME following when quering for NSEC RR type - + fix: fix refreshing of DNSSEC signatures for zone keys - + fix: fix binding an unavailable IPv6 address (IP_FREEBIND) - + fix: fix infinite loop in knotc zonestatus and memstats - + fix: fix memory leak in configuration on server shutdown - + fix: fix broken dnsproxy module - + fix: fix multi value parsing on big-endian - + fix: adapt to Nettle 3 API break causing base64 decoding failures on big-endian - + feature: add 'keymgr zone key ds' to show key's DS record - + feature: add 'keymgr tsig generate' to generate TSIG keys - + feature: add query module scoping to process either all queries or zone queries only - + feature: add support for file name globbing in config file includes - + feature: add 'request-edns-option' config option to add custom EDNS0 option into server initiated queries - + improvement: send minimal responses (remove NS from Authority section for NOERROR) - + improvement: update persistent timers only on shutdown for better performance - + improvement: allow change of RR TTL over DDNS - + improvement: documentation fixes, updates, and improvements in formatting - + improvement: install yparser and zscanner header files + + fix: check if executed under systemd before using journald log sink + + feature: write persistent timers on server shutdown for better performance + + feature: support time unit specification for 'max-conn-idle', + 'max-conn-handshake', 'max-conn-reply', and 'notify-timeout' config options + + feature: add 'request-edns-config' config option -* Mon Jul 20 2015 Jan Vcelak 2.0.0-1 +* Thu Jun 18 2015 Jan Vcelak 1.6.4-1 - new upstream release: - + feature: possibility to disable zone file synchronization - + feature: knsupdate, add input prompt in interactive mode - + feature: knsupdate, TSIG algorithm specification in interactive mode - -* Thu Jun 18 2015 Jan Vcelak 2.0.0-0.1.rc1 -- new upstream pre-release: + fix: lost NOTIFY message if received during zone transfer + fix: kdig, record correct dnstap SocketProtocol when retrying over TCP + fix: kdig, hide TSIG section with +noall diff --git a/sources b/sources index b941cb1..bfd502b 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (knot-3.5.2.tar.xz) = 4dd8e42088f792459859da807427024ded926c2a8fb5b9fd4596b631a184269e3d84f0cd4be9192f2546977c598c418f8d44cabccbc393f9f7cf2f0dd5adc595 -SHA512 (knot-3.5.2.tar.xz.asc) = 5f6ee7fedc0d5b904572d2f6d47858065cdc4efa7217b4e9dcbb38ae63a1533646ba2b042bb0c1fe533a3caf6ba41c81010616393d2a0adcea77712608931b38 +SHA512 (knot-3.2.13.tar.xz) = ed68faa1d8eba375ca7e22599bafab782f82c3510ec4e3d8a063cbf55c4ee5d5be91a1a045d71e53a36769ec099e252c959471cbc70c1afee2bee4d453732f10 +SHA512 (knot-3.2.13.tar.xz.asc) = e5c58e06fa637b0a3e020383e7bd8ebca47d094085680a5c65ff4fbbbce47453c887e0ebd4cd05947a704ce1eac2268cdfda27c32c35db7d1ac5b0cb644f311e