Merge branch 'master' into 'events-refactor'

* origin/master: (193 commits)

.gitignore

@@ -18,6 +18,8 @@
 /src/Makefile.in
 /src/zscanner/Makefile
 /src/zscanner/Makefile.in
+/python/Makefile
+/python/Makefile.in
 /samples/Makefile
 /samples/Makefile.in
 /samples/knot.sample.conf
@@ -72,6 +74,7 @@
 /src/kdig
 /src/keymgr
 /src/khost
+/src/kjournalprint
 /src/knot1to2
 /src/knotc
 /src/knotd

.ycm_extra_conf.py

@@ -14,7 +14,7 @@ DIR = os.path.dirname(__file__)
 FLAGS = [
     '-std=gnu99',
     '-Wall', '-Wno-unused', '-Werror=implicit', '-Wno-#warnings',
-    '-DCONFIG_DIR=', '-DRUN_DIR=', '-DSTORAGE_DIR=',
+    '-DCONFIG_DIR=', '-DRUN_DIR=', '-DSTORAGE_DIR=', '-DPACKAGE_VERSION=',
 ]
 
 CONFIG_H = 'src/config.h'

Knot.files

@@ -29,7 +29,6 @@ src/contrib/fnv/hash_64a.c
 src/contrib/fnv/longlong.h
 src/contrib/getline.c
 src/contrib/getline.h
-src/contrib/hat-trie/hat-trie.c
 src/contrib/hat-trie/hat-trie.h
 src/contrib/hhash.c
 src/contrib/hhash.h
@@ -50,6 +49,8 @@ src/contrib/openbsd/strlcpy.c
 src/contrib/openbsd/strlcpy.h
 src/contrib/print.c
 src/contrib/print.h
+src/contrib/qp-trie/qp.c
+src/contrib/qp-trie/qp.h
 src/contrib/sockaddr.c
 src/contrib/sockaddr.h
 src/contrib/string.c
@@ -80,8 +81,10 @@ src/dnssec/lib/dnssec/event.h
 src/dnssec/lib/dnssec/kasp.h
 src/dnssec/lib/dnssec/key.h
 src/dnssec/lib/dnssec/keyid.h
+src/dnssec/lib/dnssec/keystate.h
 src/dnssec/lib/dnssec/keystore.h
 src/dnssec/lib/dnssec/keytag.h
+src/dnssec/lib/dnssec/keyusage.h
 src/dnssec/lib/dnssec/list.h
 src/dnssec/lib/dnssec/nsec.h
 src/dnssec/lib/dnssec/random.h
@@ -94,7 +97,6 @@ src/dnssec/lib/event/action/nsec3_resalt.c
 src/dnssec/lib/event/action/zsk_rollover.c
 src/dnssec/lib/event/event.c
 src/dnssec/lib/event/keystate.c
-src/dnssec/lib/event/keystate.h
 src/dnssec/lib/event/utils.c
 src/dnssec/lib/event/utils.h
 src/dnssec/lib/kasp/dir/dir.c
@@ -136,6 +138,7 @@ src/dnssec/lib/keystore/keystore.c
 src/dnssec/lib/keystore/pkcs11.c
 src/dnssec/lib/keystore/pkcs8.c
 src/dnssec/lib/keystore/pkcs8_dir.c
+src/dnssec/lib/keyusage/keyusage.c
 src/dnssec/lib/list/list.c
 src/dnssec/lib/list/ucw_clists.h
 src/dnssec/lib/nsec/bitmap.c
@@ -185,6 +188,7 @@ src/dnssec/tests/keystore_pkcs11.c
 src/dnssec/tests/keystore_pkcs8.c
 src/dnssec/tests/keystore_pkcs8_dir.c
 src/dnssec/tests/keytag.c
+src/dnssec/tests/keyusage.c
 src/dnssec/tests/list.c
 src/dnssec/tests/nsec_bitmap.c
 src/dnssec/tests/nsec_hash.c
@@ -208,6 +212,8 @@ src/knot/common/process.c
 src/knot/common/process.h
 src/knot/common/ref.c
 src/knot/common/ref.h
+src/knot/common/stats.c
+src/knot/common/stats.h
 src/knot/conf/base.c
 src/knot/conf/base.h
 src/knot/conf/conf.c
@@ -216,6 +222,8 @@ src/knot/conf/confdb.c
 src/knot/conf/confdb.h
 src/knot/conf/confio.c
 src/knot/conf/confio.h
+src/knot/conf/migration.c
+src/knot/conf/migration.h
 src/knot/conf/scheme.c
 src/knot/conf/scheme.h
 src/knot/conf/tools.c
@@ -256,23 +264,35 @@ src/knot/events/log.c
 src/knot/events/log.h
 src/knot/events/replan.c
 src/knot/events/replan.h
-src/knot/modules/dnsproxy.c
-src/knot/modules/dnsproxy.h
-src/knot/modules/dnstap.c
-src/knot/modules/dnstap.h
-src/knot/modules/noudp.c
-src/knot/modules/noudp.h
-src/knot/modules/online_sign/module.c
-src/knot/modules/online_sign/module.h
+src/knot/journal/journal.c
+src/knot/journal/journal.h
+src/knot/journal/old_journal.c
+src/knot/journal/old_journal.h
+src/knot/journal/serialization.c
+src/knot/journal/serialization.h
+src/knot/modules/dnsproxy/dnsproxy.c
+src/knot/modules/dnsproxy/dnsproxy.h
+src/knot/modules/dnstap/dnstap.c
+src/knot/modules/dnstap/dnstap.h
+src/knot/modules/noudp/noudp.c
+src/knot/modules/noudp/noudp.h
 src/knot/modules/online_sign/nsec_next.c
 src/knot/modules/online_sign/nsec_next.h
-src/knot/modules/rosedb.c
-src/knot/modules/rosedb.h
-src/knot/modules/rosedb_tool.c
-src/knot/modules/synth_record.c
-src/knot/modules/synth_record.h
-src/knot/modules/whoami.c
-src/knot/modules/whoami.h
+src/knot/modules/online_sign/online_sign.c
+src/knot/modules/online_sign/online_sign.h
+src/knot/modules/rosedb/rosedb.c
+src/knot/modules/rosedb/rosedb.h
+src/knot/modules/rosedb/rosedb_tool.c
+src/knot/modules/rrl/functions.c
+src/knot/modules/rrl/functions.h
+src/knot/modules/rrl/rrl.c
+src/knot/modules/rrl/rrl.h
+src/knot/modules/stats/stats.c
+src/knot/modules/stats/stats.h
+src/knot/modules/synth_record/synth_record.c
+src/knot/modules/synth_record/synth_record.h
+src/knot/modules/whoami/whoami.c
+src/knot/modules/whoami/whoami.h
 src/knot/nameserver/axfr.c
 src/knot/nameserver/axfr.h
 src/knot/nameserver/chaos.c
@@ -306,12 +326,6 @@ src/knot/query/requestor.c
 src/knot/query/requestor.h
 src/knot/server/dthreads.c
 src/knot/server/dthreads.h
-src/knot/server/journal.c
-src/knot/server/journal.h
-src/knot/server/rrl.c
-src/knot/server/rrl.h
-src/knot/server/serialization.c
-src/knot/server/serialization.h
 src/knot/server/server.c
 src/knot/server/server.h
 src/knot/server/tcp-handler.c
@@ -488,6 +502,7 @@ src/utils/keymgr/options.h
 src/utils/khost/khost_main.c
 src/utils/khost/khost_params.c
 src/utils/khost/khost_params.h
+src/utils/kjournalprint/main.c
 src/utils/knot1to2/cf-lex.c
 src/utils/knot1to2/cf-lex.l
 src/utils/knot1to2/cf-parse.tab.c
@@ -530,35 +545,26 @@ src/zscanner/tests/processing.h
 src/zscanner/tests/tests.c
 src/zscanner/tests/tests.h
 src/zscanner/tests/zscanner-tool.c
+tests-fuzz/afl-loop.h
 tests-fuzz/packet.c
 tests-fuzz/packet_libfuzzer.c
 tests-fuzz/wrap/server.c
 tests-fuzz/wrap/tcp-handler.c
 tests-fuzz/wrap/udp-handler.c
-tests/acl.c
-tests/changeset.c
-tests/conf.c
-tests/conf_tools.c
-tests/confdb.c
-tests/confio.c
 tests/contrib/test_base32hex.c
 tests/contrib/test_base64.c
 tests/contrib/test_endian.c
-tests/contrib/test_hat-trie.c
 tests/contrib/test_heap.c
 tests/contrib/test_hhash.c
 tests/contrib/test_net.c
 tests/contrib/test_net_shortwrite.c
+tests/contrib/test_qp-trie.c
 tests/contrib/test_sockaddr.c
 tests/contrib/test_string.c
 tests/contrib/test_strtonum.c
 tests/contrib/test_time.c
 tests/contrib/test_wire.c
 tests/contrib/test_wire_ctx.c
-tests/dthreads.c
-tests/fake_server.h
-tests/fdset.c
-tests/journal.c
 tests/libknot/test_control.c
 tests/libknot/test_cookies-client.c
 tests/libknot/test_cookies-opt.c
@@ -578,21 +584,31 @@ tests/libknot/test_tsig.c
 tests/libknot/test_yparser.c
 tests/libknot/test_ypscheme.c
 tests/libknot/test_yptrafo.c
-tests/modules/online_sign.c
-tests/node.c
-tests/process_query.c
-tests/query_module.c
-tests/requestor.c
-tests/rrl.c
-tests/server.c
+tests/modules/test_online_sign.c
+tests/modules/test_rrl.c
+tests/test_acl.c
+tests/test_changeset.c
+tests/test_conf.c
 tests/test_conf.h
+tests/test_conf_tools.c
+tests/test_confdb.c
+tests/test_confio.c
+tests/test_dthreads.c
+tests/test_fdset.c
+tests/test_journal.c
+tests/test_node.c
+tests/test_process_query.c
+tests/test_query_module.c
+tests/test_requestor.c
+tests/test_server.c
+tests/test_server.h
+tests/test_worker_pool.c
+tests/test_worker_queue.c
+tests/test_zone-tree.c
+tests/test_zone-update.c
+tests/test_zone_events.c
+tests/test_zone_serial.c
+tests/test_zone_timers.c
+tests/test_zonedb.c
 tests/utils/test_cert.c
 tests/utils/test_lookup.c
-tests/worker_pool.c
-tests/worker_queue.c
-tests/zone_events.c
-tests/zone_serial.c
-tests/zone_timers.c
-tests/zone_update.c
-tests/zonedb.c
-tests/ztree.c

Makefile.am

 ACLOCAL_AMFLAGS = -I m4
-SUBDIRS = libtap src tests tests-fuzz samples doc
+SUBDIRS = libtap src tests tests-fuzz python samples doc
 
 .PHONY: singlehtml install-singlehtml
 singlehtml install-singlehtml:

NEWS

-Knot DNS 2.4.0-dev
-==================
+Knot DNS 2.4.0-dev (unreleased)
+===============================
+
+Bugfixes:
+--------
+ - Schedule zone refresh after load only if not already scheduled
+ - Purge the timers together with zone-purge
+ - Don't preserve CD flag in the answers
+ - Fix incorrect type bitmap in NSEC
+ - Dump DNSSEC related records also if DNSSEC is not active
+ - Preserve bootstrap_retry interval after zone reload
+ - Don't set SO_REUSEPORT on the TCP socket as SO_REUSEPORT on TCP
+   is buggy
+ - Allow deleting non-apex DNSKEY and NSEC3PARAM records via DDNS
+
+Improvements:
+-------------
+ - Lower memory consumption when used with many zones due hat-trie
+   replacement with qp-trie in zone-tree
+ - Improve the event scheduler
+ - Store the XFER timer between restarts
+ - Print all zone names in the FQDN format
+ - Improve and simplify modules interface
+
+Features:
+---------
+ - New unified LMDB-based zone journal
+ - Add kjournalprint utility
+ - New mod-stats module for detailed server metrics
+ - Automatically delete retired DNSSEC keys
+
+Knot DNS 2.3.1 (2016-10-07)
+===========================
+
+Bugfixes:
+---------
+ - Missing glue records in some responses
+ - Knsupdate prompt printing on non-terminal
+ - Mismatch between configuration policy item names and documentation
+ - Segfault on OS X (Sierra)
+
+Improvements:
+-------------
+ - Significant speed-up of conf-commit and conf-diff operations (in most cases)
+ - New EDNS Client Subnet libknot API
+ - Better semantic-checks error messages
+
+Features:
+---------
+ - Print TLS certificate hierarchy in kdig verbose mode
+ - New +subnet alias for +client
+ - New mod-whoami and mod-noudp modules
+ - New zone-purge control command
+ - New log-queries and log-responses options for mod-dnstap
 
 Knot DNS 2.3.0 (2016-08-09)
 ===========================

README

@@ -4,6 +4,7 @@ Dependencies
 Knot DNS has several dependencies:
 * libtool
 * autoconf > 2.65
+* pkg-config
 * liburcu >= 0.5.4
 * gnutls >= 3.0
 * jansson >= 2.3
@@ -40,7 +41,7 @@ $ sudo apt-get upgrade
 
 Install prerequisites:
 $ sudo apt-get install \
-  libtool autoconf make liburcu-dev libgnutls28-dev libjansson-dev libedit-dev
+  libtool autoconf make pkg-config liburcu-dev libgnutls28-dev libjansson-dev libedit-dev
 
 Install optional packages to override embedded libraries:
 $ sudo apt-get install liblmdb-dev
@@ -51,20 +52,20 @@ $ sudo apt-get install libcap-ng-dev libsystemd-dev libidn11-dev protobuf-c-comp
 Fedora like distributions
 -------------------------
 Update the system:
-# yum upgrade
+# dnf upgrade
 
 Install basic development tools:
-# yum install @buildsys-build
+# dnf install @buildsys-build
 
 Install prerequisites:
-# yum install \
-  libtool autoconf automake userspace-rcu-devel gnutls-devel jansson-devel libedit-devel
+# dnf install \
+  libtool autoconf pkgconfig automake userspace-rcu-devel gnutls-devel jansson-devel libedit-devel
 
 Install optional packages to override embedded libraries:
-# yum install lmdb-devel
+# dnf install lmdb-devel
 
 Install optional packages:
-# yum install libcap-ng-devel systemd-devel libidn-devel protobuf-c-devel fstrm-devel
+# dnf install libcap-ng-devel systemd-devel libidn-devel protobuf-c-devel fstrm-devel
 
 When compiling on RHEL based system, the Fedora EPEL repository has to be
 enabled. Also for RHEL 6, forward compatibility package gnutls30-devel

configure.ac

@@ -28,7 +28,7 @@ AC_CONFIG_FILES([src/libknot/version.h
 
 # Updating version info
 # https://www.gnu.org/software/libtool/manual/html_node/Updating-version-info.html
-AC_SUBST([libknot_VERSION_INFO],["-version-info 3:0:0"])
+AC_SUBST([libknot_VERSION_INFO],["-version-info 4:0:0"])
 AC_SUBST([libdnssec_VERSION_INFO],["-version-info 2:0:0"])
 AC_SUBST([libzscanner_VERSION_INFO],["-version-info 1:0:0"])
 
@@ -123,27 +123,21 @@ PKG_CHECK_MODULES([gnutls], [gnutls >= 3.3 nettle], [
 # JSON for DNSSEC status storage
 PKG_CHECK_MODULES([jansson], [jansson >= 2.3])
 
-# recvmmsg() (valgrind doesn't support it, so disable for debugging)
-# The check for struct mmsghdr is required when libc doesn't have an API but the function links
 AC_ARG_ENABLE([recvmmsg],
-    AS_HELP_STRING([--enable-recvmmsg=yes|no], [enable recvmmsg() network API under Linux (kernel support required) (set to 'no' if you have trouble running server under valgrind) [default=yes]]),
-    [case "${enableval}" in
-      yes)
-          AC_CHECK_FUNCS([sendmmsg])
-          AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include <sys/socket.h>]], [[struct mmsghdr v; recvmmsg(0,0,0,0,0);]])],
-          [AC_DEFINE(HAVE_RECVMMSG, 1, [Define if struct mmsghdr and recvmmsg() exists.])])
-          ;;
-      no)
-          ;;
-      *)
-          AC_MSG_ERROR([bad value ${enableval} for --enable-recvmmsg])
-          ;;
-    esac],
-    [
-      AC_CHECK_FUNCS([sendmmsg])
-      AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include <sys/socket.h>]], [[struct mmsghdr v; recvmmsg(0,0,0,0,0);]])],
-      [AC_DEFINE(HAVE_RECVMMSG, 1, [Define if struct mmsghdr and recvmmsg() exists.])])
-    ])
+   AS_HELP_STRING([--enable-recvmmsg=auto|yes|no], [enable recvmmsg() network API [default=auto]]),
+   [], [enable_recvmmsg=auto])
+
+AS_CASE([$enable_recvmmsg],
+   [auto|yes],[
+      AC_CHECK_FUNC([recvmmsg],
+                    [AC_CHECK_FUNC([sendmmsg],[enable_recvmmsg=yes],[enable_recvmmsg=no])],
+                    [enable_recvmmsg=no])],
+   [no],[],
+   [*], [AC_MSG_ERROR([Invalid value of --enable-recvmmsg.]
+ )])
+
+AS_IF([test "$enable_recvmmsg" = yes],[
+   AC_DEFINE([ENABLE_RECVMMSG], [1], [Use recvmmsg().])])
 
 AC_ARG_ENABLE([reuseport],
     AS_HELP_STRING([--enable-reuseport=auto|yes|no], [enable Linux SO_REUSEPORT support [default=auto]]),
@@ -178,6 +172,8 @@ AS_IF([test "$enable_reuseport" = yes],[
    AC_DEFINE([ENABLE_REUSEPORT], [1], [Use SO_REUSEPORT.])])
 
 AX_CHECK_COMPILE_FLAG("-fpredictive-commoning", [CFLAGS="$CFLAGS -fpredictive-commoning"], [], "-Werror")
+AX_CHECK_LINK_FLAG(["-Wl,--exclude-libs,ALL"], [ldflag_exclude_libs="-Wl,--exclude-libs,ALL"], [ldflag_exclude_libs=""], "")
+AC_SUBST([LDFLAG_EXCLUDE_LIBS], $ldflag_exclude_libs)
 
 # Default directories
 run_dir="${localstatedir}/run/knot"
@@ -353,13 +349,14 @@ AS_IF([test "$with_lmdb" != "no"],[
     ])
 
 AS_IF([test "$have_lmdb" != "no"],[
-    AC_SUBST([lmdb_CFLAGS])
     AC_SUBST([lmdb_LIBS])
     enable_lmdb=shared
     ],[
     enable_lmdb=embedded
+    lmdb_CFLAGS='-I$(srcdir)/contrib/lmdb'
     ])
-AM_CONDITIONAL([HAVE_LMDB], test "$have_lmdb" != "no")
+AM_CONDITIONAL([HAVE_LMDB], test "$enable_lmdb" = "shared")
+AC_SUBST([lmdb_CFLAGS])
 
 # LMDB mapping sizes
 conf_mapsize_default=500
@@ -534,6 +531,7 @@ AC_CONFIG_FILES([Makefile
                  tests/Makefile
                  tests-fuzz/Makefile
                  samples/Makefile
+                 python/Makefile
                  src/Makefile
                  src/contrib/dnstap/Makefile
                  src/dnssec/Makefile
@@ -572,6 +570,7 @@ AC_MSG_RESULT([
     Knot DNS utils:         ${enable_utilities}
     Knot DNS documentation: ${enable_documentation}
 
+    Use recvmmsg:        ${enable_recvmmsg}
     Use SO_REUSEPORT:    ${enable_reuseport}
     Fast zone parser:    ${enable_fastparser}
     Utilities with IDN:  ${with_libidn}

doc/.gitignore

@@ -4,6 +4,7 @@
 /man/kdig.1
 /man/keymgr.8
 /man/khost.1
+/man/kjournalprint.1
 /man/knot.conf.5
 /man/knot1to2.1
 /man/knotc.8

doc/Makefile.am

-MANPAGES_IN = man/knot.conf.5in man/knotc.8in man/knotd.8in man/kdig.1in man/khost.1in man/knsupdate.1in man/knot1to2.1in man/knsec3hash.1in man/keymgr.8in man/kzonecheck.1in
-MANPAGES_RST = reference.rst man_knotc.rst man_knotd.rst man_kdig.rst man_khost.rst man_knsupdate.rst man_knot1to2.rst man_knsec3hash.rst man_keymgr.rst man_kzonecheck.rst
+MANPAGES_IN = man/knot.conf.5in man/knotc.8in man/knotd.8in man/kdig.1in man/khost.1in man/kjournalprint.1in man/knsupdate.1in man/knot1to2.1in man/knsec3hash.1in man/keymgr.8in man/kzonecheck.1in
+MANPAGES_RST = reference.rst man_knotc.rst man_knotd.rst man_kdig.rst man_khost.rst man_kjournalprint.rst man_knsupdate.rst man_knot1to2.rst man_knsec3hash.rst man_keymgr.rst man_kzonecheck.rst
 
 EXTRA_DIST = \
 	conf.py		\
@@ -62,7 +62,7 @@ man_MANS += man/knot.conf.5 man/knotc.8 man/knotd.8
 endif # HAVE_DAEMON
 
 if HAVE_UTILS
-man_MANS += man/kdig.1 man/khost.1 man/knsupdate.1 man/knot1to2.1 man/knsec3hash.1 man/keymgr.8 man/kzonecheck.1
+man_MANS += man/kdig.1 man/khost.1 man/kjournalprint.1 man/knsupdate.1 man/knot1to2.1 man/knsec3hash.1 man/keymgr.8 man/kzonecheck.1
 endif # HAVE_UTILS
 
 man/knot.conf.5: man/knot.conf.5in
@@ -70,6 +70,7 @@ man/knotc.8: man/knotc.8in
 man/knotd.8: man/knotd.8in
 man/kdig.1: man/kdig.1in
 man/khost.1: man/khost.1in
+man/kjournalprint.1: man/kjournalprint.1in
 man/knsupdate.1: man/knsupdate.1in
 man/knot1to2.1: man/knot1to2.1in
 man/knsec3hash.1: man/knsec3hash.1in

doc/conf.py

@@ -13,6 +13,8 @@
 
 import sys, os, time
 
+sys.setrecursionlimit(1500)
+
 # If extensions (or modules to document with autodoc) are in another directory,
 # add these directories to sys.path here. If the directory is relative to the
 # documentation root, use os.path.abspath to make it absolute, like shown here.
@@ -220,6 +222,7 @@ man_pages = [
     ('man_kdig', 'kdig', 'Advanced DNS lookup utility', author, 1),
     ('man_keymgr', 'keymgr', ' DNSSEC key management utility', author, 8),
     ('man_khost', 'khost', 'Simple DNS lookup utility', author, 1),
+    ('man_kjournalprint', 'kjournalprint', 'Knot DNS journal print utility', author, 1),
     ('man_knot1to2', 'knot1to2', 'Knot DNS configuration conversion utility', author, 1),
     ('man_knotc', 'knotc', 'Knot DNS control utility', author, 8),
     ('man_knotd', 'knotd', 'Knot DNS server daemon', author, 8),

doc/index.rst

@@ -10,6 +10,7 @@ Welcome to Knot DNS's documentation!
    requirements
    installation
    configuration
+   modules
    operation
    troubleshooting
    reference

doc/introduction.rst

@@ -48,6 +48,7 @@ Server features:
 * Automatic DNSSEC signing
 * PKCS #11 interface
 * Forward and reverse records synthesis
+* DNS request traffic statistics
 
 For more info and downloads see `www.knot-dns.cz <https://www.knot-dns.cz>`_.
 

doc/man/kdig.1in

@@ -251,7 +251,7 @@ on libidn availability during project building!
 .sp
 Options \fB\-k\fP and \fB\-y\fP can not be used simultaneously.
 .sp
-Dnssec\-keygen keyfile format is not supported. Use \fIkeymgr(8)\fP instead.
+Dnssec\-keygen keyfile format is not supported. Use \fBkeymgr(8)\fP instead.
 .SH EXAMPLES
 .INDENT 0.0
 .IP 1. 3
@@ -312,10 +312,10 @@ $ kdig \-d @185.49.141.38 +tls\-ca +tls\-host=getdnsapi.net \e
 \fB/etc/resolv.conf\fP
 .SH SEE ALSO
 .sp
-\fIkhost(1)\fP, \fIknsupdate(1)\fP, \fIkeymgr(8)\fP\&.
+\fBkhost(1)\fP, \fBknsupdate(1)\fP, \fBkeymgr(8)\fP\&.
 .SH AUTHOR
 CZ.NIC Labs <http://www.knot-dns.cz>
 .SH COPYRIGHT
-Copyright 2010–2016, CZ.NIC, z.s.p.o.
+Copyright 2010–2017, CZ.NIC, z.s.p.o.
 .\" Generated by docutils manpage writer.
 .

doc/man/keymgr.8in

@@ -148,14 +148,16 @@ utilities.
 .SS zone commands
 .INDENT 0.0
 .TP
-\fBzone\fP \fBkey\fP \fBlist\fP \fIzone\-name\fP [\fBfilter\fP]
-List key IDs and tags of zone keys.
+\fBzone\fP \fBkey\fP \fBlist\fP \fIzone\-name\fP [\fBfilter\fP [\fBfilter\fP]]
+List key IDs and tags of zone keys. The \fBfilter\fP can be a key tag, a key ID prefix, a key state (active, published, retired, removed) or ksk/zsk. Key state and ksk/zsk combination is possible.
+Use these key state and ksk/zsk with prefix \(aq+\(aq (\(aq+ksk\(aq, \(aq+active\(aq).
 .TP
 \fBzone\fP \fBkey\fP \fBshow\fP \fIzone\-name\fP \fIkey\fP
 Show zone key details. The \fIkey\fP can be a key tag or a key ID prefix.
 .TP
-\fBzone\fP \fBkey\fP \fBds\fP \fIzone\-name\fP \fIkey\fP
-Show DS records for a zone key. The \fIkey\fP can be a key tag or a key ID prefix.
+\fBzone\fP \fBkey\fP \fBds\fP \fIzone\-name\fP \fIfilter\fP
+Show DS records for a zone key. The \fIfilter\fP can be a key tag, a key ID prefix or key state (limited to active and published ksk).
+Use these key state as \(aq+active\(aq or \(aq+published\(aq.
 .TP
 \fBzone\fP \fBkey\fP \fBgenerate\fP \fIzone\-name\fP [\fIkey\-parameter\fP\&...]
 Generate a new key for a zone.
@@ -386,12 +388,12 @@ $ keymgr tsig generate operator.key algorithm hmac\-sha512
 .sp
 \fI\%RFC 6781\fP \- DNSSEC Operational Practices.
 .sp
-\fIknot.conf(5)\fP,
-\fIknotc(8)\fP,
-\fIknotd(8)\fP\&.
+\fBknot.conf(5)\fP,
+\fBknotc(8)\fP,
+\fBknotd(8)\fP\&.
 .SH AUTHOR
 CZ.NIC Labs <http://www.knot-dns.cz>
 .SH COPYRIGHT
-Copyright 2010–2016, CZ.NIC, z.s.p.o.
+Copyright 2010–2017, CZ.NIC, z.s.p.o.
 .\" Generated by docutils manpage writer.