NEWS

Knot DNS 3.0.0 (2020-09-09)
===========================

Features:
---------
 - High-performance networking mode using XDP sockets (requires Linux 4.18+)
 - Support for Catalog zones including kcatalogprint utility
 - New DNSSEC validation mode
 - New kzonesign utility — an interface for manual DNSSEC signing
 - New kxdpgun utility — high-performance DNS over UDP traffic generator for Linux
 - DoH support in kdig using GnuTLS and libnghttp2
 - New KSK revoked state (RFC 5011) in manual DNSSEC key management mode
 - Deterministic signing with ECDSA algorithms (requires GnuTLS 3.6.10+)
 - Module synthrecord supports reverse pointer shortening
 - Safe persistent zone data backup and restore

Improvements:
-------------
 - Processing depth of CNAME and DNAME chains is limited to 20
 - Non-FQDN is allowed as 'update-owner-name' configuration option value
 - Kdig prints detailed algorithm idendifier for PRIVATEDNS and PRIVATEOID
   in multiline mode #334
 - Queries with QTYPE ANY or RRSIG are always responded with at most one random RRSet
 - The statistics module has negligible performance overhead on modern CPUs
 - If multithreaded zone signing is enabled, some additional zone maintenance
   steps are newly parallelized
 - ACL can be configured by reference to a remote
 - Better CPU cache locality for higher query processing performance
 - Logging to non-syslog streams contains timestamps with the timezone
 - Keeping initial DNSKEY TTL and zone maximum TTL in KASP database to ensure
   proper rollover timing in case of TTL changes during the rollover
 - Responding FORMERR to queries with more OPT records

Bugfixes:
---------
 - Module onlinesign responds NXDOMAIN insted of NOERROR (NODATA) if DNSSEC not requested
 - Outgoing multi-message transfer can contain invalid compression pointers under specific conditions

Knot DNS 2.9.6 (2020-08-31)
===========================

Features:
---------
 - New kdig option '+[no]opttext' to print unknown EDNS options as text if possible (Thanks to Robert Edmonds)

Improvements:
-------------
 - Better error message if no key is ready for submission
 - Improved logging when master is not usable
 - Improved control logging of zone-flush errors if output directory is specified
 - More precise system error messages when a zone transfer fails
 - Some documentation improvements (especially Offline KSK)

Bugfixes:
---------
 - In the case of many zones, control operations over all zones take lots of memory
 - Misleading error message on keymgr import-bind #683
 - DS push is triggered upon every zone change even though CDS wasn't changed
 - Kzonecheck performance penalty with passive keys #688
 - CSK->KSK+ZSK scheme rollover can end too early

Knot DNS 2.9.5 (2020-05-25)
===========================

Bugfixes:
---------
 - Old ZSK can be withdrawn too early during a ZSK rollover if maximum zone TTL
   is computed automatically
 - Server responds SERVFAIL to ANY queries on empty non-terminal nodes

Improvements:
-------------
 - Also module onlinesign returns minimized responses to ANY queries
 - Linking against libcap-ng can be disabled via a configure option

Knot DNS 2.9.4 (2020-05-05)
===========================

Improvements:
-------------
 - ANY query over UDP is always answered with one RRSet + possible RRSIG instead
   of truncated reply
 - Server tries to resolve CNAME record generated by geoip module (Thanks to Conrad Hoffmann)
 - Earlier OCSP validity check in kdig certificate verification (Thanks to Alexander Schultz)
 - Module onlinesign allows KSK + ZSK mode
 - Server control listen backlog limit was increased to 5
 - Zone signing event is always re-scheduled even after a signing error
 - Extended error checks and tiny enhancements in kjournalprint
 - kdig logs a more detailed error message when failed to acquire a remote address
 - Some documentation improvements

Bugfixes:
---------
 - Server can crash when zone update fails due to exceeded zone size limit
 - keymgr 'share' command doesn't work
 - Shared KSK doesn't work with an initial key
 - Self-created RRSIGs are still cryptographically verified in some unnecessary cases
 - Changed NSEC3PARAM not correctly detected during zone update
 - NSEC(3) chain not fixed if affected by zone udpate
 - knotc orphan purge doesn't work on journal
 - Online signing configured along with DNSSEC signing can cause MDB_BAD_RSLOT
   error during server reload
 - Zone journal access can stuck if mismanaged zone serial
 - Concurrently added and removed same records in a DDNS message are not properly handled
 - Zone check logs error instead of warning after a first error occured

Knot DNS 2.9.3 (2020-03-03)
===========================

Features:
---------
 - New configuration option 'remote.block-notify-after-transfer' to suppress
   sending NOTIFY messages
 - Enabled testing support for Ed448 DNSSEC algorithm (requires GnuTLS 3.6.12+
   and not-yet-released Nettle 3.6+)
 - New keymgr parameter 'local-serial' for getting/setting signed zone SOA serial
   in the KASP database
 - keymgr can import Ed25519 and Ed448 keys in the BIND format (Thanks to Conrad Hoffmann)

Improvements:
-------------
 - kdig returns error if the query name is invalid
 - Increased 'server.tcp-io-timeout' default value to 500 ms
 - Decreased 'database.journal-db-max-size' default value to 512 MiB on 32-bit systems
 - Server no longer falls back to AXFR if master is outdated during zone refresh
 - Some documentation improvements (including new EPUB format and compatibility
   with Ultra Electronics CIS Keyper Plus HSM)
 - Some packaging improvements (including new python3-libknot deb package)

Bugfixes:
---------
 - Outgoing IXFR can be malformed if the message size has specific size
 - Server can crash if the zone contains solo NSEC3 record
 - Improved compatibility with older journal format
 - Incorrect SOA TTL in negative answers — SOA minimum not considered
 - Cannot unset uppercase nodes via control interface #668
 - Module RRL doesn't set AA flag and NOERROR rcode in slipped responses
 - Server returns FORMERR instead of NOTIMP if empty QUESTION and unknown OPCODE

Knot DNS 2.9.2 (2019-12-12)
===========================

Improvements:
-------------
 - Tiny ds-check log message rewording
 - Some unnecessary code cleanup

Bugfixes:
---------
 - ds-push doesn't replace the DS RRset on the parent #661
 - Server gets stuck in a never-ending logging loop when changing SOA TTL
 - Server can crash when the journal database size limit is reached
 - Server can create a bogus changeset with equal serials from and to
 - Unreasonable re-signing of the NSEC3PARAM record when reloading the zone
   and 'zonefile-load: difference-no-serial' is configured
 - SOA RRSIG not updated if the only changed record is SOA
 - Failed to remove NSEC3 records through the control interface #666
 - Failed to stop the server if a zone transaction is active

Knot DNS 2.9.1 (2019-11-11)
===========================

Features:
---------
 - New option for OCSP stapling '+[no]tls-ocsp-stapling[=H]' in kdig (Thanks to Alexander Schultz)

Improvements:
-------------
 - Kdig always randomizes source TCP port on recent Linux #575
 - Server no longer warns about disabled zone file synchronization during shutdown
 - Zone loading stops if failed to load zone from the journal
 - Speed-up of insertion to big RRSets
 - Various code and documentation improvements

Bugfixes:
---------
 - Failed to apply journal changes after upgrade #659
 - Failed to finish zone loading if journal changeset serials from and to are equal
 - Incorrect handling of 0 value for 'tcp-io-timeout' and 'tcp-remote-io-timeout' configuration
 - Server can crash if zone transaction is open during zone update
 - NSEC3 chain not fully updated if NSEC3 salt changes during zone update
 - Server can crash when flushing zone to a specified directory
 - Server can respond incorrect NSEC3 records after NSEC3 salt change
 - Delegation glue records not updated after specific zone change

Knot DNS 2.9.0 (2019-10-10)
===========================

Features:
---------
 - Full support for different master/slave serial arithmetics when on-slave signing
 - Module geoip newly supports wildcard records #650
 - New DNSSEC policy configuration option 'rrsig-pre-refresh' for reducing
   frequency of the zone signing event
 - New server configuration option 'tcp-reuseport' for setting SO_REUSEPORT(_LB)
   mode on TCP sockets
 - New server configuration option 'tcp-io-timeout' [ms] for restricting inbound
   IO operations over TCP #474

Improvements:
-------------
 - Significant speed-up of zone contents modifications
 - Avoided double zone signing during CSK rollovers
 - Self-created RRSIGs are not cryptographically verified if not necessary
 - Zone journal can store two changesets if zone file difference computing
   and DNSSEC signing are enabled. The first one containing the difference of
   zone history needed by slave servers, the second one containing the difference
   between zone file and zone needed for server restart
 - Universal and more robust memory clearing
 - More precise socket timeout handling
 - New notice log message for configuration changes requiring server restart
 - Module RRL logs both trigger source address and affected subnet
 - Various code (especially zone and TCP processing) and documentation improvements

Bugfixes:
---------
 - RRSIGs are wrongly checked for inconsistent RRSet TTLs during zone update
 - DS check/push warnings after disabled DNSSEC signing
 - NSEC3 records not accessible through control interface
 - Module geoip doesn't accept underscore character in dname specification #655

Compatibility:
--------------
 - Removed runtime reconfiguration of network workers and interfaces since
   it was imperfect and also couldn't work after dropped process privileges
 - Removed inaccurate and misleading knotc command 'zone-memstats' because
   memory consumption varies during zone modifications or transfers
 - Removed useless 'zone.request-edns-option' configuration option
 - Reimplemented DNS Cookies to be interoperable (based on draft-ietf-dnsop-server-cookies
   and work by Witold Kręcicki)
 - Default limit on TCP clients is auto-configured to one half of the file
   descriptor limit for the server process
 - Number of open files limit is set to 1048576 in upstream packages
 - Default number of TCP workers is equal to the number of online CPUs or at least 10
 - Default EDNS buffer size is 1232 for both IPv4 and IPv6
 - Removed 'tcp-handshake-timeout' server configuration option
 - Some configuration options were renamed and possibly moved. Old names will
   be supported at least until next major release:
    - 'server.tcp-reply-timeout' [s] to 'server.tcp-remote-io-timeout' [ms]
    - 'server.max-tcp-clients'       to 'server.tcp-max-clients'
    - 'server.max-udp-payload'       to 'server.udp-max-payload'
    - 'server.max-ipv4-udp-payload'  to 'server.udp-max-payload-ipv4'
    - 'server.max-ipv6-udp-payload'  to 'server.udp-max-payload-ipv6'
    - 'template.journal-db'          to 'database.journal-db'
    - 'template.journal-db-mode'     to 'database.journal-db-mode'
    - 'template.max-journal-db-size' to 'database.journal-db-max-size'
    - 'template.kasp-db'             to 'database.kasp-db'
    - 'template.max-kasp-db-size'    to 'database.kasp-db-max-size'
    - 'template.timer-db'            to 'database.timer-db'
    - 'template.max-timer-db-size'   to 'database.timer-db-max-size'
    - 'zone.max-journal-usage'       to 'zone.journal-max-usage'
    - 'zone.max-journal-depth'       to 'zone.journal-max-depth'
    - 'zone.max-zone-size'           to 'zone.zone-max-size'
    - 'zone.max-refresh-interval'    to 'zone.refresh-max-interval'
    - 'zone.min-refresh-interval'    to 'zone.refresh-min-interval'

Knot DNS 2.8.5 (2020-01-01)
===========================

Improvements:
-------------
 - Tiny ds-check log message rewording
 - Various code and documentation improvements

Bugfixes:
---------
 - RRSIGs are wrongly checked for inconsistent RRSet TTLs during zone update
 - Server can crash when flushing zone to a specified directory
 - ds-push doesn't replace the DS RRset on the parent #661
 - Server gets stuck in a never-ending logging loop when changing SOA TTL
 - Server can crash when the journal database size limit is reached
 - Server can create a bogus changeset with equal serials from and to
 - Server returns FORMERR instead of NOTIMP if empty QUESTION and unknown OPCODE

Knot DNS 2.8.4 (2019-09-24)
===========================

Features:
---------
 - Automatic uploading of DS records to parent zone using DDNS,
   see 'policy.ds-push' configuration option

Improvements:
-------------
 - Incoming IXFR no longer falls back to AXFR if connection error #642
 - More accurate semantic checks for missing glue records
 - Various code and documentation improvements

Bugfixes:
---------
 - Failed to read/export configuration if 'acl.update-type' is set #651
 - Failed to generate initial zero-length salt
 - Missing error log for invalid rrtype input to dynamic configuration #652
 - Missing error log when AXFR processing fails to store zone data
 - Redundant notice log about unavailable persistent configuration DB
 - Zone not flushed after retransfer if SOA serial not changed
 - Zone contents not properly fixed during zone transfers
 - No changeset created for updated rrset's TTL if changed by RR addition

Knot DNS 2.8.3 (2019-07-16)
===========================

Features:
---------
 - Added cert/key file configuration for TLS in kdig (Thanks to Alexander Schultz)

Improvements:
-------------
 - More verbose log message for offline-KSK signing
 - Module RRL logs affected source address subnet instead of only one source address
 - Extended DNSSEC policy configuration checks
 - Various improvements in the documentation

Bugfixes:
---------
 - Excessive server load when maximum TCP clients limit is reached
 - Incorrect reply after zone update with a node changed from non-authoritative to delegation
 - Wrong error line number in a config file if it contains leading tab character
 - Config file error message contains unrelated parsing context
 - NSEC3 salt not updated when reconfigured to zero length
 - Kjournalprint sometimes prints a random value for per-zone occupation
 - Missing debug log for failed zone refresh triggered by zone notification
 - DS check not scheduled when reconfigured
 - Broken unit test on NetBSD 8.x

Knot DNS 2.8.2 (2019-06-05)
===========================

Features:
---------
 - New blocking mode for zone event triggers in knotc
 - New weighted records mode in the module geoip (Thanks to Conrad Hoffmann)
 - Module noudp allows UDP allow rate configuration

Improvements:
-------------
 - NSEC3 salt lifetime can be set to infinity
 - New 'running' zone event status in the knotc output
 - Knotc in the forced mode returns failure also if zone check emits any warning
 - Ignoring PMTU information for IPv4/UDP via IP_PMTUDISC_OMIT (Thanks to Daisuke Higashi)
 - Various improvements in the documentation

Bugfixes:
---------
 - Broken setting of CPU affinity for UDP workers
 - Unexpected results with the geoip subnet mode
 - Sometimes insufficient zone adjusting
 - Incoherent DNSKEY RRSIG lifetimes in SKR
 - Confusing output from keymgr if an error occurs during KSR generation
 - Non-functional changeset history depth limitation in kjournalprint
 - Wrong processing of multiple $INCLUDE directives #646

Knot DNS 2.8.1 (2019-04-09)
===========================

Improvements:
-------------
 - Possible zone transaction is aborted by zone events to avoid inconsistency
 - Added log message if no persistent config DB is available during 'conf-begin'
 - New environment setting 'KNOT_VERSION_FORMAT=release' for extended version suppression
 - Various improvements in the documentation

Bugfixes:
---------
 - Broken NSEC3-wildcard-nonexistence proof after NSEC3 re-salt
 - Glue records under delegation are sometimes signed
 - RRL doesn't work correctly on big-endian architectures
 - NSEC3 not re-salted during AXFR refresh
 - Failed to sign new zone contents if added dynamically #641
 - NSEC3 opt-out signing doesn't work in some cases
 - Broken NSEC3 chain after adding new sub-delegations
 - Redundant SOA RRSIG on slave if RRSIG TTL changed on master
 - Sometimes confusing log error message for NOTIFY event
 - Improper include for LMDB #638

Knot DNS 2.8.0 (2019-03-05)
===========================

Features:
---------
 - New offline-KSK mode of operation
 - Configurable multithreaded DNSSEC signing for large zones
 - Extended ACL configuration for dynamic updates
 - New knotc trigger 'zone-key-rollover' for immediate DNSKEY rollover
 - Added support for OPENPGPKEY, CSYNC, SMIMEA, and ZONEMD RR types
 - New 'double-ds' option for CDS/CDNSKEY publication

Improvements:
-------------
 - Significant speed-up of zone updates
 - Knotc supports force option in the interactive mode
 - Copy-on-write support for QP-trie (Thanks to Tony Finch)
 - Unified and more efficient LMDB layer for journal, timer, and KASP databases
 - DS check event is re-planned according to KASP even when purged timers
 - Module DNS Cookies supports explicit Server Secret configuration
 - Zone mtime is verified against full-precision timestamp (Thanks to Daniel Kahn Gillmor)
 - Extended logging (loaded SOA serials, refresh duration, tiny cleanup)
 - Relaxed fixed-length condition for DNSSEC key ID
 - Extended semantic checks for DNAME and NS RR types
 - Added support for FreeBSD's SO_REUSEPORT_LB
 - Improved performance of geoip module
 - Various improvements in the documentation

Compatibility:
--------------
 - Changed configuration default for 'cds-cdnskey-publish' to 'rollover'
 - Journal DB format changes are not downgrade-compatible
 - Keymgr no longer prints DS for algorithm SHA-1

Knot DNS 2.7.8 (2019-07-16)
===========================

Improvements:
-------------
 - Various improvements in the documentation

Bugfixes:
---------
 - Excessive server load when maximum TCP clients limit is reached
 - Incorrect reply after zone update with a node changed from non-authoritative to delegation
 - Missing debug log for failed zone refresh triggered by zone notification
 - Wrong processing of multiple $INCLUDE directives #646
 - Broken unit test on NetBSD 8.x

Knot DNS 2.7.7 (2019-04-15)
===========================

Improvements:
-------------
 - Possible zone transaction is aborted by zone events to avoid inconsistency
 - Added log message if no persistent config DB is available during 'conf-begin'
 - Tiny building improvements

Bugfixes:
---------
 - Glue records under delegation are sometimes signed
 - NSEC3 not re-salted during AXFR refresh
 - Broken NSEC3 chain after adding new sub-delegations
 - Failed to sign new zone contents if added dynamically #641
 - NSEC3 opt-out signing doesn't work in some cases
 - Redundant SOA RRSIG on slave if RRSIG TTL changed on master
 - Sometimes confusing log error message for NOTIFY event
 - Failed to explicit set value 0 for submission timeout

Knot DNS 2.7.6 (2019-01-23)
===========================

Improvements:
-------------
 - Zone status also shows when the zone load is scheduled
 - Server workers status also shows background workers utilization
 - Default control timeout for knotc was increased to 10 seconds
 - Pkg-config files contain auxiliary variable with library filename

Bugfixes:
---------
 - Configuration commit or server reload can drop some pending zone events
 - Nonempty zone journal is created even though it's disabled #635
 - Zone is completely re-signed during empty dynamic update processing
 - Server can crash when storing a big zone difference to the journal
 - Failed to link on FreeBSD 12 with Clang

Knot DNS 2.7.5 (2019-01-07)
===========================

Features:
---------
 - Keymgr supports NSEC3 salt handling

Improvements:
-------------
 - Zone history in journal is dropped apon AXFR-like zone update
 - Libdnssec is no longer linked against libm #628
 - Libdnssec is explicitly linked against libpthread if PKCS #11 enabled #629
 - Better support for libknot packaging in Python
 - Manually generated KSK is 'ready' by default
 - Kdig supports '+timeout' as an alias for '+time'
 - Kdig supports '+nocomments' option
 - Kdig no longer prints empty lines between retries
 - Kdig returns failure if operations not successfully resolved #632
 - Fixed repeating of the 'KSK submission, waiting for confirmation' log
 - Various improvements in documentation, Dockerfile, and tests

Bugfixes:
---------
 - Knotc fails to unset huge configuration section
 - Kjournalprint sometimes fails to display zone journal content
 - Improper timing of ZSK removal during ZSK rollover
 - Missing UTC time zone indication in the 'iso' keymgr list output
 - A race condition in the online signing module

Knot DNS 2.7.4 (2018-11-13)
===========================

Features:
---------
 - Added SNI configuration for TLS in kdig (Thanks to Alexander Schultz)

Improvements:
-------------
 - Added warning log when DNSSEC events not successfully scheduled
 - New semantic check on timer values in keymgr
 - DS query no longer asks other addresses if got a negative answer
 - Reintroduced 'rollover' configuration option for CDS/CDNSKEY publication
 - Extended logging for zone loading
 - Various documentation improvements

Bugfixes:
---------
 - Failed to import module configuration #613
 - Improper Cflags value in libknot.pc if built with embedded LMDB #615
 - IXFR doesn't fall back to AXFR if malformed reply
 - DNSSEC events not correctly scheduled for empty zone updates
 - During algorithm rollover old keys get removed before DS TTL expires #617
 - Maximum zone's RRSIG TTL not considered during algorithm rollover #620

Knot DNS 2.7.3 (2018-10-11)
===========================

Features:
---------
 - New queryacl module for query access control
 - Configurable answer rrset rotation #612
 - Configurable NSEC bitmap in online signing

Improvements:
-------------
 - Better error logging for KASP DB operations #601
 - Some documentation improvements

Bugfixes:
---------
 - Keymgr "list" output doesn't show key size for ECDSA algorithms #602
 - Failed to link statically with embedded LMDB
 - Configuration commit causes zone reload for all zones
 - The statistics module overlooks TSIG record in a request
 - Improper processing of an AXFR-style-IXFR response consisting of one-record messages
 - Race condition in online signing during key rollover #600
 - Server can crash if geoip module is enabled in the geo mode

Knot DNS 2.7.2 (2018-08-29)
===========================

Improvements:
-------------
 - Keymgr list command displays also key size
 - Kjournalprint displays total occupied size in the debug mode
 - Server doesn't stop if failed to load a shared module from the module directory
 - Libraries libcap-ng, pthread, and dl are linked selectively if needed

Bugfixes:
---------
 - Sometimes incorrect result from dnssec_nsec_bitmap_contains (libdnssec)
 - Server can crash when loading zone file difference and zone-in-journal is set
 - Incorrect treatment of specific queries in the module RRL
 - Failed to link module Cookies as a shared library

Knot DNS 2.7.1 (2018-08-14)
===========================

Improvements:
-------------
 - Added zone wire size information to zone loading log message
 - Added debug log message for each unsuccessful remote address operation
 - Various improvements for packaging

Bugfixes:
---------
 - Incompatible handling of RRSIG TTL value when creating a DNS message
 - Incorrect RRSIG TTL value in zone differences and knotc zone operation outputs
 - Default configure prefix is ignored

Knot DNS 2.7.0 (2018-08-03)
===========================

Features:
---------
 - New DNS Cookies module and related '+cookie' kdig option
 - New module for response tailoring according to client's subnet or geographic location
 - General EDNS Client Subnet support in the server
 - OSS-Fuzz integration (Thanks to Jonathan Foote)
 - New '+ednsopt' kdig option (Thanks to Jan Včelák)
 - Online Signing support for automatic key rollover
 - Non-normal file (e.g. pipe) loading support in zscanner #542
 - Automatic SOA serial incrementation if non-empty zone difference
 - New zone file load option for ignoring zone file's SOA serial
 - New build-time option for alternative malloc specification
 - Structured logging for DNSSEC key submission event
 - Empty QNAME support in kdig

Improvements:
-------------
 - Various library and server optimizations
 - Reduced memory consumption of outgoing IXFR processing
 - Linux capabilities use overhaul #546 (Thanks to Robert Edmonds)
 - Online Signing properly signs delegations and CNAME records
 - CDS/CDNSKEY rrset is signed with KSK instead of ZSK
 - DNSSEC-related records are ignored when loading zone difference with signing enabled
 - Minimum allowed RSA key length was increased to 1024
 - Removed explicit dependency on Nettle

Bugfixes:
---------
 - Possible uninitialized address buffer use in zscanner
 - Possible index overflow during multiline record parsing in zscanner
 - kdig +tls sometimes consumes 100 % CPU #561
 - Single-Type Signing doesn't work with single ZSK key #566
 - Zone not flushed after re-signing during zone load #594
 - Server crashes when committing empty zone transaction
 - Incoming IXFR with on-slave signing sometimes leads to memory corruption #595

Compatibility:
--------------
 - Removed obsolete RRL configuration
 - Removed obsolete module names 'mod-online-sign' and 'mod-synth-record'
 - Removed obsolete 'ixfr-from-differences' configuration option
 - Removed old journal migration
 - Removed module rosedb

Knot DNS 2.6.9 (2018-08-14)
===========================

Improvements:
-------------
 - Added zone wire size to zone loading log message
 - Added debug log message for each unsuccessful remote address operation

Bugfixes:
---------
 - Zone not flushed after re-signing during zone load #594
 - Server crashes when committing empty zone transaction
 - Incoming IXFR with on-slave signing sometimes leads to memory corruption #595

Knot DNS 2.6.8 (2018-07-10)
===========================

Features:
---------
 - New 'import-pkcs11' command in keymgr

Improvements:
-------------
 - Unixtime serial policy mimics Bind – increment if lower #593

Bugfixes:
---------
 - Creeping memory consuption upon server reload #584
 - Kdig incorrectly detects QNAME if 'notify' is a prefix
 - Server crashes when zone sign fails #587
 - CSK->KZSK rollover retires CSK early #588
 - Server crashes when zone expires during outgoing multi-message transfer
 - Kjournalprint doesn't convert zone name argument to lower-case
 - Cannot switch to a previously used ksk-shared dnssec policy #589

Knot DNS 2.6.7 (2018-05-17)
===========================

Features:
---------
 - Added 'dateserial' (YYYYMMDDnn) serial policy configuration (Thanks to Wolfgang Jung)

Improvements:
-------------
 - Trailing data indication from the packet parser (libknot)
 - Better configuration check for a problematical option combination

Bugfixes:
---------
 - Incomplete configuration option item name check
 - Possible buffer overflow in 'knot_dname_to_str' (libknot)
 - Module dnsproxy doesn't preserve letter case of QNAME
 - Module dnsproxy duplicates OPT and TSIG in the non-fallback mode

Knot DNS 2.6.6 (2018-04-11)
===========================

Features:
---------
 - New EDNS option counters in the statistics module
 - New '+orphan' filter for the 'zone-purge' operation

Improvements:
-------------
 - Reduced memory consuption of disabled statistics metrics
 - Some spelling fixes (Thanks to Daniel Kahn Gillmor)
 - Server no longer fails to start if MODULE_DIR doesn't exist
 - Configuration include doesn't fail if empty wildcard match
 - Added a configuration check for a problematical option combination

Bugfixes:
---------
 - NSEC3 chain not re-created when SOA minimum TTL changed
 - Failed to start server if no template is configured
 - Possibly incorrect SOA serial upon changed zone reload with DNSSEC signing
 - Inaccurate outgoing zone transfer size in the log message
 - Invalid dname compression if empty question section
 - Missing EDNS in EMALF responses

Knot DNS 2.6.5 (2018-02-12)
===========================

Features:
---------
 - New 'zone-notify' command in knotc
 - Kdig uses '@server' as a hostname for TLS authenticaion if '+tls-ca' is set

Improvements:
-------------
 - Better heap memory trimming for zone operations
 - Added proper polling for TLS operations in kdig
 - Configuration export uses stdout as a default output
 - Simplified detection of atomic operations
 - Added '--disable-modules' configure option
 - Small documentation updates

Bugfixes:
---------
 - Zone retransfer doesn't work well if more masters configured
 - Kdig can leak or double free memory in corner cases
 - Inconsistent error outputs from dynamic configuration operations
 - Failed to generate documentation on OpenBSD

Knot DNS 2.6.4 (2018-01-02)
===========================

Features:
---------
 - Module synthrecord allows multiple 'network' specification
 - New CSK handling support in keymgr

Improvements:
-------------
 - Allowed configuration for infinite zsk lifetime
 - Increased performance and security of the module synthrecord
 - Signing changeset is stored into journal even if 'zonefile-load' is whole

Bugfixes:
---------
 - Unintentional zone re-sign during reload if empty NSEC3 salt
 - Inconsistent zone names in journald structured logs
 - Malformed outgoing transfer for big zone with TSIG
 - Some minor DNSSEC-related issues

Knot DNS 2.6.3 (2017-11-24)
===========================

Bugfixes:
---------
 - Wrong detection of signing scheme rollover

Knot DNS 2.6.2 (2017-11-23)
===========================

Features:
---------
 - CSK algorithm rollover and (KSK, ZSK) <-> CSK rollover support

Improvements:
-------------
 - Allowed explicit configuration for infinite ksk lifetime
 - Proper error messages instead of unclear error codes in server log
 - Better support for old compilers

Bugfixes:
---------
 - Unexpected reply for DS query with an owner below a delegation point
 - Old dependencies in the pkg-config file

Knot DNS 2.6.1 (2017-11-02)
===========================

Features:
---------
 - NSEC3 Opt-Out support in the DNSSEC signing
 - New CDS/CDNSKEY publish configuration option

Improvements:
-------------
 - Simplified DNSSEC log message with DNSKEY details
 - +tls-hostname in kdig implies +tls-ca if neither +tls-ca nor +tls-pin is given
 - New documentation sections for DNSSEC key rollovers and shared keys
 - Keymgr no longer prints useless algorithm number for generated key
 - Kdig prints unknown RCODE in a numeric format
 - Better support for LLVM libFuzzer

Bugfixes:
---------
 - Faulty DNAME semantic check if present in the zone apex and NSEC3 is used
 - Immediate zone flush not scheduled during the zone load event
 - Server crashes upon dynamic zone addition if a query module is loaded
 - Kdig fails to connect over TLS due to SNI is set to server IP address
 - Possible out-of-bounds memory access at the end of the input
 - TCP Fast Open enabled by default in kdig breaks TLS connection

Knot DNS 2.6.0 (2017-09-29)
===========================

Features:
---------
 - On-slave (inline) signing support
 - Automatic DNSSEC key algorithm rollover
 - Ed25519 algorithm support in DNSSEC (requires GnuTLS 3.6.0)
 - New 'journal-content' and 'zonefile-load' configuration options
 - keymgr tries to run as user/group set in the configuration
 - Public-only DNSSEC key import into KASP DB via keymgr
 - NSEC3 resalt and parent DS query events are persistent in timer DB
 - New processing state for a response suppression within a query module
 - Enabled server side TCP Fast Open if supported
 - TCP Fast Open support in kdig

Improvements:
-------------
 - Better record owner compression if related to the previous rdata dname
 - NSEC(3) chain is no longer recomputed whole on every update
 - Remove inconsistent and unnecessary quoting in log files
 - Avoiding of overlapping key rollovers at a time
 - More DNSSSEC-related semantic checks
 - Extended timestamp format in keymgr

Bugfixes:
---------
 - Incorrect journal free space computation causing inefficient space handling
 - Interface-automatic broken on Linux in the presence of asymmetric routing

Knot DNS 2.5.7 (2018-01-02)
===========================

Bugfixes:
---------
 - Unintentional zone re-sign during reload if empty NSEC3 salt
 - Inconsistent zone names in journald structured logs
 - Malformed outgoing transfer for big zone with TSIG
 - Unexpected reply for DS query with an owner below a delegation point
 - Old dependencies in the pkg-config file

Knot DNS 2.5.6 (2017-11-02)
===========================

Improvements:
-------------
 - Keymgr no longer prints useless algorithm number for generated key

Bugfixes:
---------
 - Faulty DNAME semantic check if present in the zone apex and NSEC3 is used
 - Immediate zone flush not scheduled during the zone load event
 - Server crashes upon dynamic zone addition if a query module is loaded
 - Kdig fails to connect over TLS due to SNI is set to server IP address

Knot DNS 2.5.5 (2017-09-29)
===========================

Improvements:
-------------
 - Constant time memory comparison in the TSIG processing
 - Proper use of the ctype functions
 - Generated RRSIG records have inception time 90 minutes in the past

Bugfixes:
---------
 - Incorrect online signature for NSEC in the case of a CNAME record
 - Incorrect timestamps in dnstap records
 - EDNS Subnet Client validation rejects valid payloads
 - Module configuration semantic checks are not executed
 - Kzonecheck segfaults with unusual inputs

Knot DNS 2.5.4 (2017-08-31)
===========================

Improvements:
-------------
 - New minimum and maximum refresh interval config options (Thanks to Manabu Sonoda)
 - New warning when unforced flush with disabled zone file synchronization
 - New 'dnskey' keymgr command
 - Linking with libatomic on architectures that require it (Thanks to Pierre-Olivier Mercier)
 - Removed 'OK' from listing keymgr command outputs
 - Extended journal and keymgr documentation and logging

Bugfixes:
---------
 - Incorrect handling of specific corner-cases with zone-in-journal
 - The 'share' keymgr command doesn't work
 - Server crashes if configured with query-size and reply-size statistics options
 - Malformed big integer configuration values on some 32-bit platforms
 - Keymgr uses local time when parsing date inputs
 - Memory leak in kdig upon IXFR query

Knot DNS 2.5.3 (2017-07-14)
===========================

Features:
---------
 - CSK rollover support for Single-Type Signing Scheme

Improvements:
-------------
 - Allowed binding to non-local adresses for TCP (Thanks to Julian Brost!)
 - New documentation section for manual DNSSEC key algorithm rollover
 - Initial KSK also generated in the submission state
 - The 'ds' keymgr command with no parameter uses all KSK keys
 - New debug mode in kjournalprint
 - Updated keymgr documentation

Bugfixes:
---------
 - Sometimes missing RRSIG by KSK in submission state.
 - Minor DNSSEC-related issues

Knot DNS 2.5.2 (2017-06-23)
===========================

Security:
---------
 - CVE-2017-11104: Improper TSIG validity period check can allow TSIG forgery (Thanks to Synacktiv!)

Improvements:
-------------
 - Extended debug logging for TSIG errors
 - Better error message for unknown module section in the configuration
 - Module documentation compilation no longer depends on module configuration
 - Extended policy section configuration semantic checks
 - Improved python version compatibility in pykeymgr
 - Extended migration section in the documentation
 - Improved DNSSEC event timing on 32-bit systems
 - New KSK rollover start log info message
 - NULL qtype support in kdig

Bugfixes:
---------
 - Failed to process included configuration
 - dnskey_ttl policy option in the configuration has no effect on DNSKEY TTL
 - Corner case journal fixes (huge changesets, OpenWRT operation)
 - Confusing event timestamps in knotc zone-status output
 - NSEC/NSEC3 bitmap not updated for CDS/CDNSKEY
 - CDS/CDNSKEY RRSIG not updated

Knot DNS 2.5.1 (2017-06-07)
===========================

Bugfixes:
---------
 - pykeymgr no longer crash on empty json files in the KASP DB directory
 - pykeymgr no longer imports keys in the "removed" state
 - Imported keys in the "removed" state no longer makes knotd to crash
 - Including an empty configuration directory no longer makes knotd to crash
 - pykeymgr is distributed and installed to the distribution tarball

Knot DNS 2.5.0 (2017-06-05)
===========================

Features:
---------
 - KASP database switched from JSON files to LMDB database
 - KSK rollover support using CDNSKEY and CDS in the automatic DNSSEC signing
 - Dynamic module loading support with proper module API
 - Journal can store full zone contents (not only differences)
 - Zone freeze/thaw support
 - Updated knotc zone-status output with optional column filters
 - New '[no]crypto' option in kdig
 - New keymgr implementation reflecting KASP database changes
 - New pykeymgr for JSON-based KASP database migration
 - Removed obsolete knot1to2 utility

Improvements:
-------------
 - Added libidn2 support to kdig (with libidn fallback)
 - Maximum timer database switched from configure to the server configuration

Knot DNS 2.4.4 (2017-06-05)
===========================

Improvements:
-------------
 - Improved error handling in kjournalprint

Bugfixes:
---------
 - Zone flush not replanned upon unsuccessful flush
 - Journal inconsistency after deleting deleted zone
 - Zone events not rescheduled upon server reload (Thanks to Mark Warren)
 - Unreliable LMDB mapsize detection in kjournalprint
 - Some minor issues found by AddressSanitizer

Knot DNS 2.4.3 (2017-04-11)
===========================

Improvements:
-------------
 - New 'journal-db-mode' optimization configuration option
 - The default TSIG algorithm for utilities input is HMAC-SHA256
 - Implemented sensible default EDNS(0) padding policy (Thanks to D. K. Gillmor)
 - Added some more semantic checks on the knotc configuration operations

Bugfixes:
---------
 - Missing 'zone' keyword in the YAML output
 - Missing trailing dot in the keymgr DS owner output
 - Journal logs 'invalid parameter' in several cases
 - Some minor journal-related problems