Newer
Older
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
Knot DNS 3.1.0 (2021-08-02)
===========================
Features:
---------
- knotd: automatic zone catalog generation based on actual configuration
- knotd: zone catalog supports configuration groups
- knotd: support for ZONEMD validation and generation
- knotd: basic support for TCP over XDP processing
- knotd: configuration option for enabling IP route check in the XDP mode
- knotd: support for epoll (Linux) and kqueue (*BSD, macOS) socket polling
- knotd: extended EDNS error (EDE) is added to the response if appropriate
- knotd: DNSSEC operation with extra ready public-only KSK is newly allowed
- knotd: new zone backup/restore filters for more variable component specification
- knotd: adaptive systemd service start timeout and new zone loading status #733
- knotd: configuration option for enabling TCP Fast Open on outbound communication
- knotd: when the server starts, zone NOTIFY is send only if not sent already
- knotc: zone reload with the force flag triggers reload of the zone and its modules
- libs: support for parsing and dumping SVCB and HTTPS resource records
- kdig: support for TCP Fast Open along with DoT/DoH #549
- kxdpgun: basic support for DNS over TCP processing
- kxdpgun: current traffic statistics can be printed using a USR1 signal
- python: new libknot/probe API wrapper
Improvements:
-------------
- knotd: PID file is created even in the foreground mode
- knotd: more robust and enhanced zone data backup and restore operations
- knotd: maximum length of an XFR message is limited to 16 KiB for better compression
- knotd: maximum CNAME/DNAME chain depth per reply was decreased from 20 to 5
- knotd: improved performance of processing domain names with many short labels
- knotd: adaptive limit on the number of LMDB readers to avoid problems with many workers
- knotd: TTL of generated NSEC(3) records is set to min(SOA TTL, SOA minimum)
- knotd: TTL of generated NSEC3PARAM is equal to TTL of NSEC3 records
- knotd: maximum TCP segment size is restricted to 1220 octets on Linux #468
- knotc: various improvements in error reporting
- knotc: default control timeout is infinity in the blocking mode
- dnssec: dnskey generator tries to return a key with a unique keytag
- kxdpgun: RLIMIT_MEMLOCK is increased only if not high enough
- kxdpgun: RTNETLINK is used for getting network information instead of the ip command
Bugfixes:
---------
- knotd: DNAME not applied more than once to resolve the query #714
- knotd: root zone not correctly purged from the journal
- kzonecheck: incorrect check for opt-outed empty non-terminal nodes
- libzscanner: wrong error line number
- libzscanner: broken multiline rdata processing if an error occurs
- mod-geoip: NXDOMAIN is responded instead of NODATA #745
- make: build fails with undefined references if building using slibtool #722
Packaging:
----------
- knotd: systemd service reload uses 'kill -HUP' instead of 'knotc reload'
- kxdpgun: new library dependency libmnl
- mod-dnstap: new package separate from the knot package
- mod-geoip: new package separate from the knot package
Compatibility:
--------------
- configure: option '--enable-xdp=yes' means use an external libbpf if available
or use the embedded one
- libzscanner: omitted TTL value is correctly set to the last explicitly stated value (RFC 1035)
- knotc: zone restore from an old backup (3.0.x) requires forced operation
- knotd: configuration option 'server.listen-xdp' is replaced with 'xdp.listen'
- knotd: zone file loading with automatic SOA serial incrementation newly
requires having full zone in the journal
- knotd: obsolete configuration options 'zone.disable-any', 'server.tcp-handshake-timeout'
are silently ignored
- knotd: obsolete configuration options 'zone.max-zone-size', 'zone.max-journal-depth',
'zone.max-journal-usage', 'zone.max-refresh-interval', 'zone.min-refresh-interval'
'server.max-ipv4-udp-payload', 'server.max-ipv6-udp-payload', 'server.max-udp-payload',
'server.tcp-reply-timeout', 'server.max-tcp-clients' are ignored
- knotd: obsolete default template options 'template.journal-db',
'template.kasp-db', 'template.timer-db', 'template.max-journal-db-size',
'template.journal-db-mode', 'template.max-timer-db-size',
'template.max-kasp-db-size' are ignored
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
Knot DNS 3.0.8 (2021-07-16)
===========================
Features:
---------
- knotc: new command for loading DNSSEC keys without dropping all RRSIGs when re-signing
- knotd: new policy configuration option for disabling some DNSSEC safety features #741
- mod-geoip: new dnssec and policy configuration options
Bugfixes:
---------
- knotd: early KSK removal during a KSK rollover if automatic KSK submission check
is enabled and DNSKEY TTL is lower than the corresponding DS TTL
- knotd: failed to generate a new DNSKEY if previously generated shared key not available
- knotd: periodical error logging when a PKCS #11 keystore failed to initialize #742
- knotd: zone commit doesn't check for missing SOA record
Knot DNS 3.0.7 (2021-06-16)
===========================
Features:
---------
- knotd: new configuration policy option for CDS digest algorithm setting #738
- keymgr: new command for primary SOA serial manipulation in on-secondary signing mode
Improvements:
-------------
- knotd: improved algorithm rollover to shorten the last step of old RRSIG publication
Bugfixes:
---------
- knotd: zone is flushed upon server start, despite DNSSEC signing is up-to-date
- knotd: wildcard nonexistence is proved on empty-non-terminal query
- knotd: redundant wildcard proof for non-authoritative data in a reply
- knotd: missing wildcard proofs in a wildcard-cname loop reply
- knotd: incorrectly synthesized CNAME owner from a wildcard record #715
- knotd: zone-in-journal changeset ignores journal-max-usage limit #736
- knotd: incorrect processing of zone-in-journal changeset with SOA serial 0
- knotd: broken initialization of processing workers if SO_REUSEPORT(_LB) not available
- kjournalprint: reported journal usage is incorrect #736
- keymgr: cannot parse algorithm name ed448 #739
- keymgr: default key size not set properly
- kdig: failed to process huge DoH responses
- libknot/probe: some corner-case bugs
Knot DNS 3.0.6 (2021-05-12)
===========================
Features:
---------
- mod-probe: new module for simple traffic logging (Python API not yet included)
Improvements:
-------------
- keymgr: new mode for listing zones with at least one key stored
- keymgr: the pregenerate command accepts optional timestamp-from parameter
- kzonecheck: accept '-' as substitution for standard input #727
- knotd: print an error when unable to change owner of a logging file
- knotd: new warning log if no interface is configured
- knotd: new signing policy check for NSEC3 iterations higher than 20
- knotd: don't allow backup to/restore from the DB storage directory
- Various code (mostly zone backup/restore), tests, and documentation improvements
Bugfixes:
---------
- knotd: secondary fails to load zone file if HTTPS or SVCB record is present #725
- knotd: (KSK roll-over) new KSK is not signing DNSKEY long enough before DS submission
- knotd: (KSK roll-over) old KSK uselessly published after roll-over finished
- knotd: malformed address in TCP-related logs when listening on a UNIX socket
- knotd: server responds FORMERR instead of BADTIME if TSIG signed time is zero #730
- modules: incorrect local and remote addresses in the XDP mode
- modules: failed to read configuration from a section without identifiers
- mod-synthrecord: queries on synthesized empty-non-terminals not answered with NODATA
- keymgr: confusing error if del-all-old command fails
Knot DNS 3.0.5 (2021-03-25)
===========================
Improvements:
-------------
- kdig: added support for TCP Fast Open on FreeBSD
- keymgr: the SEP flag can be changed on already generated keys
- Some documentation improvements
Bugfixes:
---------
- knotd: journal contents can be considered malformed after changeset merge
- knotd: broken detection of TCP Fast Open availability
- knotd: zone restore can stuck in an infinite loop if zone configuration changed
- knotd: failed zone backup makes control socket unavailable
- knotd: zone not stored to journal after reload if difference-no-serial is enabled
- knotd: old key is being used after an algorithm rollover with a shared policy #721
- keymgr: keytag not recomputed upon key flag change
- kdig: TCP not used if +fastopen is set
- mod-dnstap: the local address is empty
- kzonecheck: missing letter lower-casing of the origin parameter
- XDP mode wrongly detected on NetBSD
- Failed to build knotd_stdio fuzzing utility
Knot DNS 3.0.4 (2021-01-20)
===========================
Improvements:
-------------
- Sockets to CPUs binding is no longer enabled by default but can be enabled
via new configuration option 'server.socket-affinity'
- Some documentation improvements
Bugfixes:
---------
- DNS queries without EDNS to the root zone apex are dropped in the XDP mode
- Deterministic ECDSA signing leaks memory
- Zone not stored to journal if zonefile-load isn't ZONEFILE_LOAD_WHOLE
- Server crashes if the catalog zone isn't configured for registered member zones
- Server crashes when loading conflicting catalog member zones
- CNAME and DNAME records below delegation are not ignored #713
- Not all udp/tcp workers are used if the number of NIC queues is lower than
the number of udp/tcp workers
- Failed to load statistics and geoip modules if built as shared
Knot DNS 3.0.3 (2020-12-15)
===========================
Features:
---------
- Kjournalprint can display changesets starting from specific SOA serial
Improvements:
-------------
- New configuration check on ambiguous 'storage' specification #706
- New configuration check on problematic 'zonefile-load' with 'journal-contents' combination
- Server logs positive ACL check in debug severity level (Thanks to Andreas Schrägle)
- More verbose logging of failed zone backup
- Extended documentation for catalog zones
Bugfixes:
---------
- On-slave signing produces broken NSEC(3) chain if glue node becomes (un-)orphaned #705
- Server responds CNAME query with NXDOMAIN for CNAME synthesized from DNAME
- Kdig crashes if source address and dnstap logging are specified together #702
- Knotc fails to display error returned from zone freeze or zone thaw
- Dynamically reconfigured zone isn't loaded upon configuration commit
- Keymgr is unable to import BIND-style private key if it contains empty lines
- Zone backup fails to backup keys if any of them is public-only
- Failed to build with XDP support on Debian testing
Knot DNS 3.0.2 (2020-11-11)
===========================
Features:
---------
- kdig prints Extended DNS Error (Gift for Marek Vavruša)
- kxdpgun allows source IP address/subnet specification
Improvements:
-------------
- Server doesn't start if any of listen addresses fails to bind
- knotc no longer stores empty and adjacent identical commands to interactive history
- Depth of interactive history of knotc was increased to 1000 commands
- keymgr prints error messages to stderr instead of stdout
- keymgr checks for proper offline-ksk configuration before processing KSR or SKR
- keymgr imports Revoked timer from BIND keys
- Additional XDP support detection in server
- Lots of spelling and grammar fixes in documentation (Thanks to Paul Dee)
- Some documentation improvements
Bugfixes:
---------
- If more masters configured, zone retransfer triggers AXFR from all masters
- Server can fail to bind address during restart due to missing SO_REUSEADDR
- KSK imported from BIND doesn't roll over automatically
- libdnssec respects local GnuTLS policy — affects DNSSEC operations and Knot Resolver
- kdig can stuck in infinite loop when solving BADCOOKIE responses
- Zone names received over control interface are not lower-cased
- Zone attributes not secured with multi-threaded changes
- kzonecheck ignores forced dnssec checks if zone not signed
- kzonecheck fails on case-sensitivity of owner names in NSEC records #699
- kdig fails to establish TLS connection #700
- Server responds NOTIMPL to queries with QDCOUNT 0 and known OPCODE
Knot DNS 3.0.1 (2020-10-10)
===========================
Features:
---------
- New command in keymgr for validation of RRSIGs in SKR
- Keymgr validates RRSIGs in SKR during import
- New option in kzonecheck to skip DNSSEC-related checks
Improvements:
-------------
- Module noudp has new configuration option for UDP truncation rate
- Better detection of reproducible signing availability
- Kxdpgun allows setting of network interface
- Default control timeout in knotc was increased to 60 seconds
- DNSSEC validation searches for invalid redundant RRSIGs
- Configuration source detection no longer considers empty confdb directory as active configuration
- Zone backup preserves original zone file if zone file synchronization is disabled
Bugfixes:
---------
- NSEC3 re-salt can cause server crash due to possible zone inconsistencies
- Zone reload logs 'invalid parameter' if zone file not changed
- Outgoing multi-message transfer can contain invalid compression pointers under specific conditions
- Improper handling of file descriptors in libdnssec
- Server crashes if no policy is configured with DNSSEC validation
- Server crashes if DNSSEC validation is enabled for unsigned zone
- Failed to build with libnghttp2 (Thanks to Robert Edmonds)
- Various bugs in zone data backup/restore
Knot DNS 3.0.0 (2020-09-09)
===========================
Features:
---------
- High-performance networking mode using XDP sockets (requires Linux 4.18+)
- Support for Catalog zones including kcatalogprint utility
- New DNSSEC validation mode
- New kzonesign utility — an interface for manual DNSSEC signing
- New kxdpgun utility — high-performance DNS over UDP traffic generator for Linux
- DoH support in kdig using GnuTLS and libnghttp2
- New KSK revoked state (RFC 5011) in manual DNSSEC key management mode
- Deterministic signing with ECDSA algorithms (requires GnuTLS 3.6.10+)
- Module synthrecord supports reverse pointer shortening
- Safe persistent zone data backup and restore
Improvements:
-------------
- Processing depth of CNAME and DNAME chains is limited to 20
- Non-FQDN is allowed as 'update-owner-name' configuration option value
- Kdig prints detailed algorithm identifier for PRIVATEDNS and PRIVATEOID
in multiline mode #334
- Queries with QTYPE ANY or RRSIG are always responded with at most one random RRSet
- The statistics module has negligible performance overhead on modern CPUs
- If multithreaded zone signing is enabled, some additional zone maintenance
steps are newly parallelized
- ACL can be configured by reference to a remote
- Better CPU cache locality for higher query processing performance
- Logging to non-syslog streams contains timestamps with the timezone
- Keeping initial DNSKEY TTL and zone maximum TTL in KASP database to ensure
proper rollover timing in case of TTL changes during the rollover
- Responding FORMERR to queries with more OPT or TSIG records
- Module onlinesign responds NXDOMAIN instead of NOERROR (NODATA) if DNSSEC not requested
- Outgoing multi-message transfer can contain invalid compression pointers under specific conditions
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
Knot DNS 2.9.9 (2021-04-01)
===========================
Improvements:
-------------
- keymgr: the SEP flag can be changed on already generated keys
- Some documentation improvements
Bugfixes:
---------
- knotd: journal contents can be considered malformed after changeset merge
- knotd: old key is being used after an algorithm rollover with a shared policy #721
- keymgr: keytag not recomputed upon key flag change
- kzonecheck: missing letter lower-casing of the origin parameter
Knot DNS 2.9.8 (2020-12-15)
===========================
Bugfixes:
---------
- On-slave signing produces broken NSEC(3) chain if glue node becomes (un-)orphaned #705
- If more masters configured, zone retransfer triggers AXFR from all masters
- KSK imported from BIND doesn't roll over automatically
- kzonecheck fails on case-sensitivity of owner names in NSEC records #699
- Server responds NOTIMPL to queries with QDCOUNT 0 and known OPCODE
- Kdig crashes if source address and dnstap logging are specified together #702
- Keymgr is unable to import BIND-style private key if it contains empty lines
- Knotc fails to display error returned from zone freeze or zone thaw
Knot DNS 2.9.7 (2020-10-09)
===========================
Bugfixes:
---------
- NSEC3 re-salt can cause server crash due to possible zone inconsistencies
- Zone reload logs 'invalid parameter' if zone file not changed
- Outgoing multi-message transfer can contain invalid compression pointers under specific conditions
- Improper handling of file descriptors in libdnssec
Improvements:
-------------
- Module noudp has new configuration option for UDP truncation rate
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
Knot DNS 2.9.6 (2020-08-31)
===========================
Features:
---------
- New kdig option '+[no]opttext' to print unknown EDNS options as text if possible (Thanks to Robert Edmonds)
Improvements:
-------------
- Better error message if no key is ready for submission
- Improved logging when master is not usable
- Improved control logging of zone-flush errors if output directory is specified
- More precise system error messages when a zone transfer fails
- Some documentation improvements (especially Offline KSK)
Bugfixes:
---------
- In the case of many zones, control operations over all zones take lots of memory
- Misleading error message on keymgr import-bind #683
- DS push is triggered upon every zone change even though CDS wasn't changed
- Kzonecheck performance penalty with passive keys #688
- CSK->KSK+ZSK scheme rollover can end too early
Knot DNS 2.9.5 (2020-05-25)
===========================
Bugfixes:
---------
- Old ZSK can be withdrawn too early during a ZSK rollover if maximum zone TTL
is computed automatically
- Server responds SERVFAIL to ANY queries on empty non-terminal nodes
Improvements:
-------------
- Also module onlinesign returns minimized responses to ANY queries
- Linking against libcap-ng can be disabled via a configure option
Knot DNS 2.9.4 (2020-05-05)
===========================
Improvements:
-------------
- ANY query over UDP is always answered with one RRSet + possible RRSIG instead
of truncated reply
- Server tries to resolve CNAME record generated by geoip module (Thanks to Conrad Hoffmann)
- Earlier OCSP validity check in kdig certificate verification (Thanks to Alexander Schultz)
- Module onlinesign allows KSK + ZSK mode
- Server control listen backlog limit was increased to 5
- Zone signing event is always re-scheduled even after a signing error
- Extended error checks and tiny enhancements in kjournalprint
- kdig logs a more detailed error message when failed to acquire a remote address
- Some documentation improvements
Bugfixes:
---------
- Server can crash when zone update fails due to exceeded zone size limit
- keymgr 'share' command doesn't work
- Shared KSK doesn't work with an initial key
- Self-created RRSIGs are still cryptographically verified in some unnecessary cases
- Changed NSEC3PARAM not correctly detected during zone update
- knotc orphan purge doesn't work on journal
- Online signing configured along with DNSSEC signing can cause MDB_BAD_RSLOT
error during server reload
- Zone journal access can stuck if mismanaged zone serial
- Concurrently added and removed same records in a DDNS message are not properly handled
- Zone check logs error instead of warning after a first error occurred
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
Knot DNS 2.9.3 (2020-03-03)
===========================
Features:
---------
- New configuration option 'remote.block-notify-after-transfer' to suppress
sending NOTIFY messages
- Enabled testing support for Ed448 DNSSEC algorithm (requires GnuTLS 3.6.12+
and not-yet-released Nettle 3.6+)
- New keymgr parameter 'local-serial' for getting/setting signed zone SOA serial
in the KASP database
- keymgr can import Ed25519 and Ed448 keys in the BIND format (Thanks to Conrad Hoffmann)
Improvements:
-------------
- kdig returns error if the query name is invalid
- Increased 'server.tcp-io-timeout' default value to 500 ms
- Decreased 'database.journal-db-max-size' default value to 512 MiB on 32-bit systems
- Server no longer falls back to AXFR if master is outdated during zone refresh
- Some documentation improvements (including new EPUB format and compatibility
with Ultra Electronics CIS Keyper Plus HSM)
- Some packaging improvements (including new python3-libknot deb package)
Bugfixes:
---------
- Outgoing IXFR can be malformed if the message size has specific size
- Server can crash if the zone contains solo NSEC3 record
- Improved compatibility with older journal format
- Incorrect SOA TTL in negative answers — SOA minimum not considered
- Cannot unset uppercase nodes via control interface #668
- Module RRL doesn't set AA flag and NOERROR rcode in slipped responses
- Server returns FORMERR instead of NOTIMP if empty QUESTION and unknown OPCODE
Knot DNS 2.9.2 (2019-12-12)
===========================
Improvements:
-------------
- Tiny ds-check log message rewording
- Some unnecessary code cleanup
Bugfixes:
---------
- ds-push doesn't replace the DS RRset on the parent #661
- Server gets stuck in a never-ending logging loop when changing SOA TTL
- Server can crash when the journal database size limit is reached
- Server can create a bogus changeset with equal serials from and to
- Unreasonable re-signing of the NSEC3PARAM record when reloading the zone
and 'zonefile-load: difference-no-serial' is configured
- SOA RRSIG not updated if the only changed record is SOA
- Failed to remove NSEC3 records through the control interface #666
- Failed to stop the server if a zone transaction is active
Knot DNS 2.9.1 (2019-11-11)
===========================
Features:
---------
- New option for OCSP stapling '+[no]tls-ocsp-stapling[=H]' in kdig (Thanks to Alexander Schultz)
Improvements:
-------------
- Kdig always randomizes source TCP port on recent Linux #575
- Server no longer warns about disabled zone file synchronization during shutdown
- Zone loading stops if failed to load zone from the journal
- Speed-up of insertion to big RRSets
- Various code and documentation improvements
Bugfixes:
---------
- Failed to apply journal changes after upgrade #659
- Failed to finish zone loading if journal changeset serials from and to are equal
- Incorrect handling of 0 value for 'tcp-io-timeout' and 'tcp-remote-io-timeout' configuration
- Server can crash if zone transaction is open during zone update
- NSEC3 chain not fully updated if NSEC3 salt changes during zone update
- Server can crash when flushing zone to a specified directory
- Server can respond incorrect NSEC3 records after NSEC3 salt change
- Delegation glue records not updated after specific zone change
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
Knot DNS 2.9.0 (2019-10-10)
===========================
Features:
---------
- Full support for different master/slave serial arithmetics when on-slave signing
- Module geoip newly supports wildcard records #650
- New DNSSEC policy configuration option 'rrsig-pre-refresh' for reducing
frequency of the zone signing event
- New server configuration option 'tcp-reuseport' for setting SO_REUSEPORT(_LB)
mode on TCP sockets
- New server configuration option 'tcp-io-timeout' [ms] for restricting inbound
IO operations over TCP #474
Improvements:
-------------
- Significant speed-up of zone contents modifications
- Avoided double zone signing during CSK rollovers
- Self-created RRSIGs are not cryptographically verified if not necessary
- Zone journal can store two changesets if zone file difference computing
and DNSSEC signing are enabled. The first one containing the difference of
zone history needed by slave servers, the second one containing the difference
between zone file and zone needed for server restart
- Universal and more robust memory clearing
- More precise socket timeout handling
- New notice log message for configuration changes requiring server restart
- Module RRL logs both trigger source address and affected subnet
- Various code (especially zone and TCP processing) and documentation improvements
Bugfixes:
---------
- RRSIGs are wrongly checked for inconsistent RRSet TTLs during zone update
- DS check/push warnings after disabled DNSSEC signing
- NSEC3 records not accessible through control interface
- Module geoip doesn't accept underscore character in dname specification #655
Compatibility:
--------------
- Removed runtime reconfiguration of network workers and interfaces since
it was imperfect and also couldn't work after dropped process privileges
- Removed inaccurate and misleading knotc command 'zone-memstats' because
memory consumption varies during zone modifications or transfers
- Removed useless 'zone.request-edns-option' configuration option
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
- Reimplemented DNS Cookies to be interoperable (based on draft-ietf-dnsop-server-cookies
and work by Witold Kręcicki)
- Default limit on TCP clients is auto-configured to one half of the file
descriptor limit for the server process
- Number of open files limit is set to 1048576 in upstream packages
- Default number of TCP workers is equal to the number of online CPUs or at least 10
- Default EDNS buffer size is 1232 for both IPv4 and IPv6
- Removed 'tcp-handshake-timeout' server configuration option
- Some configuration options were renamed and possibly moved. Old names will
be supported at least until next major release:
- 'server.tcp-reply-timeout' [s] to 'server.tcp-remote-io-timeout' [ms]
- 'server.max-tcp-clients' to 'server.tcp-max-clients'
- 'server.max-udp-payload' to 'server.udp-max-payload'
- 'server.max-ipv4-udp-payload' to 'server.udp-max-payload-ipv4'
- 'server.max-ipv6-udp-payload' to 'server.udp-max-payload-ipv6'
- 'template.journal-db' to 'database.journal-db'
- 'template.journal-db-mode' to 'database.journal-db-mode'
- 'template.max-journal-db-size' to 'database.journal-db-max-size'
- 'template.kasp-db' to 'database.kasp-db'
- 'template.max-kasp-db-size' to 'database.kasp-db-max-size'
- 'template.timer-db' to 'database.timer-db'
- 'template.max-timer-db-size' to 'database.timer-db-max-size'
- 'zone.max-journal-usage' to 'zone.journal-max-usage'
- 'zone.max-journal-depth' to 'zone.journal-max-depth'
- 'zone.max-zone-size' to 'zone.zone-max-size'
- 'zone.max-refresh-interval' to 'zone.refresh-max-interval'
- 'zone.min-refresh-interval' to 'zone.refresh-min-interval'
Knot DNS 2.8.5 (2020-01-01)
===========================
Improvements:
-------------
- Tiny ds-check log message rewording
- Various code and documentation improvements
Bugfixes:
---------
- RRSIGs are wrongly checked for inconsistent RRSet TTLs during zone update
- Server can crash when flushing zone to a specified directory
- ds-push doesn't replace the DS RRset on the parent #661
- Server gets stuck in a never-ending logging loop when changing SOA TTL
- Server can crash when the journal database size limit is reached
- Server can create a bogus changeset with equal serials from and to
- Server returns FORMERR instead of NOTIMP if empty QUESTION and unknown OPCODE
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
Knot DNS 2.8.4 (2019-09-24)
===========================
Features:
---------
- Automatic uploading of DS records to parent zone using DDNS,
see 'policy.ds-push' configuration option
Improvements:
-------------
- Incoming IXFR no longer falls back to AXFR if connection error #642
- More accurate semantic checks for missing glue records
- Various code and documentation improvements
Bugfixes:
---------
- Failed to read/export configuration if 'acl.update-type' is set #651
- Failed to generate initial zero-length salt
- Missing error log for invalid rrtype input to dynamic configuration #652
- Missing error log when AXFR processing fails to store zone data
- Redundant notice log about unavailable persistent configuration DB
- Zone not flushed after retransfer if SOA serial not changed
- Zone contents not properly fixed during zone transfers
- No changeset created for updated rrset's TTL if changed by RR addition
Knot DNS 2.8.3 (2019-07-16)
===========================
Features:
---------
- Added cert/key file configuration for TLS in kdig (Thanks to Alexander Schultz)
Improvements:
-------------
- More verbose log message for offline-KSK signing
- Module RRL logs affected source address subnet instead of only one source address
- Extended DNSSEC policy configuration checks
- Various improvements in the documentation
Bugfixes:
---------
- Excessive server load when maximum TCP clients limit is reached
- Incorrect reply after zone update with a node changed from non-authoritative to delegation
- Wrong error line number in a config file if it contains leading tab character
- Config file error message contains unrelated parsing context
- NSEC3 salt not updated when reconfigured to zero length
- Kjournalprint sometimes prints a random value for per-zone occupation
- Missing debug log for failed zone refresh triggered by zone notification
- DS check not scheduled when reconfigured
- Broken unit test on NetBSD 8.x
Knot DNS 2.8.2 (2019-06-05)
===========================
Features:
---------
- New blocking mode for zone event triggers in knotc
- New weighted records mode in the module geoip (Thanks to Conrad Hoffmann)
- Module noudp allows UDP allow rate configuration
Improvements:
-------------
- NSEC3 salt lifetime can be set to infinity
- New 'running' zone event status in the knotc output
- Knotc in the forced mode returns failure also if zone check emits any warning
- Ignoring PMTU information for IPv4/UDP via IP_PMTUDISC_OMIT (Thanks to Daisuke Higashi)
- Various improvements in the documentation
Bugfixes:
---------
- Broken setting of CPU affinity for UDP workers
- Unexpected results with the geoip subnet mode
- Sometimes insufficient zone adjusting
- Incoherent DNSKEY RRSIG lifetimes in SKR
- Confusing output from keymgr if an error occurs during KSR generation
- Non-functional changeset history depth limitation in kjournalprint
- Wrong processing of multiple $INCLUDE directives #646
Knot DNS 2.8.1 (2019-04-09)
===========================
Improvements:
-------------
- Possible zone transaction is aborted by zone events to avoid inconsistency
- Added log message if no persistent config DB is available during 'conf-begin'
- New environment setting 'KNOT_VERSION_FORMAT=release' for extended version suppression
- Various improvements in the documentation
Bugfixes:
---------
- Broken NSEC3-wildcard-nonexistence proof after NSEC3 re-salt
- Glue records under delegation are sometimes signed
- RRL doesn't work correctly on big-endian architectures
- NSEC3 not re-salted during AXFR refresh
- Failed to sign new zone contents if added dynamically #641
- NSEC3 opt-out signing doesn't work in some cases
- Broken NSEC3 chain after adding new sub-delegations
- Redundant SOA RRSIG on slave if RRSIG TTL changed on master
- Sometimes confusing log error message for NOTIFY event
- Improper include for LMDB #638
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
Knot DNS 2.8.0 (2019-03-05)
===========================
Features:
---------
- New offline-KSK mode of operation
- Configurable multithreaded DNSSEC signing for large zones
- Extended ACL configuration for dynamic updates
- New knotc trigger 'zone-key-rollover' for immediate DNSKEY rollover
- Added support for OPENPGPKEY, CSYNC, SMIMEA, and ZONEMD RR types
- New 'double-ds' option for CDS/CDNSKEY publication
Improvements:
-------------
- Significant speed-up of zone updates
- Knotc supports force option in the interactive mode
- Copy-on-write support for QP-trie (Thanks to Tony Finch)
- Unified and more efficient LMDB layer for journal, timer, and KASP databases
- DS check event is re-planned according to KASP even when purged timers
- Module DNS Cookies supports explicit Server Secret configuration
- Zone mtime is verified against full-precision timestamp (Thanks to Daniel Kahn Gillmor)
- Extended logging (loaded SOA serials, refresh duration, tiny cleanup)
- Relaxed fixed-length condition for DNSSEC key ID
- Extended semantic checks for DNAME and NS RR types
- Added support for FreeBSD's SO_REUSEPORT_LB
- Improved performance of geoip module
- Various improvements in the documentation
Compatibility:
--------------
- Changed configuration default for 'cds-cdnskey-publish' to 'rollover'
- Journal DB format changes are not downgrade-compatible
- Keymgr no longer prints DS for algorithm SHA-1
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
Knot DNS 2.7.8 (2019-07-16)
===========================
Improvements:
-------------
- Various improvements in the documentation
Bugfixes:
---------
- Excessive server load when maximum TCP clients limit is reached
- Incorrect reply after zone update with a node changed from non-authoritative to delegation
- Missing debug log for failed zone refresh triggered by zone notification
- Wrong processing of multiple $INCLUDE directives #646
- Broken unit test on NetBSD 8.x
Knot DNS 2.7.7 (2019-04-15)
===========================
Improvements:
-------------
- Possible zone transaction is aborted by zone events to avoid inconsistency
- Added log message if no persistent config DB is available during 'conf-begin'
- Tiny building improvements
Bugfixes:
---------
- Glue records under delegation are sometimes signed
- NSEC3 not re-salted during AXFR refresh
- Broken NSEC3 chain after adding new sub-delegations
- Failed to sign new zone contents if added dynamically #641
- NSEC3 opt-out signing doesn't work in some cases
- Redundant SOA RRSIG on slave if RRSIG TTL changed on master
- Sometimes confusing log error message for NOTIFY event
- Failed to explicit set value 0 for submission timeout
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
Knot DNS 2.7.6 (2019-01-23)
===========================
Improvements:
-------------
- Zone status also shows when the zone load is scheduled
- Server workers status also shows background workers utilization
- Default control timeout for knotc was increased to 10 seconds
- Pkg-config files contain auxiliary variable with library filename
Bugfixes:
---------
- Configuration commit or server reload can drop some pending zone events
- Nonempty zone journal is created even though it's disabled #635
- Zone is completely re-signed during empty dynamic update processing
- Server can crash when storing a big zone difference to the journal
- Failed to link on FreeBSD 12 with Clang
Knot DNS 2.7.5 (2019-01-07)
===========================
Features:
---------
- Keymgr supports NSEC3 salt handling
Improvements:
-------------
- Zone history in journal is dropped apon AXFR-like zone update
- Libdnssec is no longer linked against libm #628
- Libdnssec is explicitly linked against libpthread if PKCS #11 enabled #629
- Better support for libknot packaging in Python
- Manually generated KSK is 'ready' by default
- Kdig supports '+timeout' as an alias for '+time'
- Kdig supports '+nocomments' option
- Kdig no longer prints empty lines between retries
- Kdig returns failure if operations not successfully resolved #632
- Fixed repeating of the 'KSK submission, waiting for confirmation' log
- Various improvements in documentation, Dockerfile, and tests
Bugfixes:
---------
- Knotc fails to unset huge configuration section
- Kjournalprint sometimes fails to display zone journal content
- Improper timing of ZSK removal during ZSK rollover
- Missing UTC time zone indication in the 'iso' keymgr list output
- A race condition in the online signing module
Knot DNS 2.7.4 (2018-11-13)
===========================
Features:
---------
- Added SNI configuration for TLS in kdig (Thanks to Alexander Schultz)
Improvements:
-------------
- Added warning log when DNSSEC events not successfully scheduled
- New semantic check on timer values in keymgr
- DS query no longer asks other addresses if got a negative answer
- Reintroduced 'rollover' configuration option for CDS/CDNSKEY publication
- Extended logging for zone loading
- Various documentation improvements
Bugfixes:
---------
- Failed to import module configuration #613
- Improper Cflags value in libknot.pc if built with embedded LMDB #615
- IXFR doesn't fall back to AXFR if malformed reply
- DNSSEC events not correctly scheduled for empty zone updates
- During algorithm rollover old keys get removed before DS TTL expires #617
- Maximum zone's RRSIG TTL not considered during algorithm rollover #620
Knot DNS 2.7.3 (2018-10-11)
===========================
Features:
---------
- New queryacl module for query access control
- Configurable answer rrset rotation #612
- Configurable NSEC bitmap in online signing
Improvements:
-------------
- Better error logging for KASP DB operations #601
- Some documentation improvements
Bugfixes:
---------
- Keymgr "list" output doesn't show key size for ECDSA algorithms #602
- Failed to link statically with embedded LMDB
- Configuration commit causes zone reload for all zones
- The statistics module overlooks TSIG record in a request
- Improper processing of an AXFR-style-IXFR response consisting of one-record messages
- Race condition in online signing during key rollover #600
- Server can crash if geoip module is enabled in the geo mode
Knot DNS 2.7.2 (2018-08-29)
===========================
Improvements:
-------------
- Keymgr list command displays also key size
- Kjournalprint displays total occupied size in the debug mode
- Server doesn't stop if failed to load a shared module from the module directory
- Libraries libcap-ng, pthread, and dl are linked selectively if needed
Bugfixes:
---------
- Sometimes incorrect result from dnssec_nsec_bitmap_contains (libdnssec)
- Server can crash when loading zone file difference and zone-in-journal is set
- Incorrect treatment of specific queries in the module RRL
- Failed to link module Cookies as a shared library
Knot DNS 2.7.1 (2018-08-14)
===========================
Improvements:
-------------
- Added zone wire size information to zone loading log message
- Added debug log message for each unsuccessful remote address operation
- Various improvements for packaging
Bugfixes:
---------
- Incompatible handling of RRSIG TTL value when creating a DNS message
- Incorrect RRSIG TTL value in zone differences and knotc zone operation outputs
- Default configure prefix is ignored
===========================
Features:
---------
- New DNS Cookies module and related '+cookie' kdig option
- New module for response tailoring according to client's subnet or geographic location
- General EDNS Client Subnet support in the server
- OSS-Fuzz integration (Thanks to Jonathan Foote)
- New '+ednsopt' kdig option (Thanks to Jan Včelák)
- Online Signing support for automatic key rollover
- Non-normal file (e.g. pipe) loading support in zscanner #542
- Automatic SOA serial incrementation if non-empty zone difference
- New zone file load option for ignoring zone file's SOA serial
- New build-time option for alternative malloc specification
- Structured logging for DNSSEC key submission event
- Empty QNAME support in kdig
- Various library and server optimizations
- Reduced memory consumption of outgoing IXFR processing
- Linux capabilities use overhaul #546 (Thanks to Robert Edmonds)
- Online Signing properly signs delegations and CNAME records
- CDS/CDNSKEY rrset is signed with KSK instead of ZSK
- DNSSEC-related records are ignored when loading zone difference with signing enabled
- Minimum allowed RSA key length was increased to 1024
- Removed explicit dependency on Nettle
- Possible uninitialized address buffer use in zscanner
- Possible index overflow during multiline record parsing in zscanner
- kdig +tls sometimes consumes 100 % CPU #561
- Single-Type Signing doesn't work with single ZSK key #566
- Zone not flushed after re-signing during zone load #594
- Server crashes when committing empty zone transaction
- Incoming IXFR with on-slave signing sometimes leads to memory corruption #595
- Removed obsolete RRL configuration
- Removed obsolete module names 'mod-online-sign' and 'mod-synth-record'
- Removed obsolete 'ixfr-from-differences' configuration option
- Removed old journal migration
- Removed module rosedb
Knot DNS 2.6.9 (2018-08-14)
===========================
Improvements:
-------------
- Added zone wire size to zone loading log message
- Added debug log message for each unsuccessful remote address operation
Bugfixes:
---------
- Zone not flushed after re-signing during zone load #594
- Server crashes when committing empty zone transaction
- Incoming IXFR with on-slave signing sometimes leads to memory corruption #595
Knot DNS 2.6.8 (2018-07-10)
===========================
Features:
---------
- New 'import-pkcs11' command in keymgr
Improvements:
-------------
- Unixtime serial policy mimics Bind – increment if lower #593
Bugfixes:
---------
- Kdig incorrectly detects QNAME if 'notify' is a prefix
- Server crashes when zone sign fails #587
- CSK->KZSK rollover retires CSK early #588
- Server crashes when zone expires during outgoing multi-message transfer
- Kjournalprint doesn't convert zone name argument to lower-case
- Cannot switch to a previously used ksk-shared dnssec policy #589
Knot DNS 2.6.7 (2018-05-17)
===========================
Features:
---------
- Added 'dateserial' (YYYYMMDDnn) serial policy configuration (Thanks to Wolfgang Jung)
Improvements:
-------------
- Trailing data indication from the packet parser (libknot)
- Better configuration check for a problematical option combination
Bugfixes:
---------
- Incomplete configuration option item name check