diff options
Diffstat (limited to '')
53 files changed, 3410 insertions, 0 deletions
diff --git a/debian/TODO b/debian/TODO new file mode 100644 index 0000000..ee28e33 --- /dev/null +++ b/debian/TODO @@ -0,0 +1,32 @@ + * package python3-libknot + + * add more autopkgtest tests + - set up and run an authoritative resolver + - do dnssec signing + - validate the signatures + + * consider making the modules dynamic instead of static. i see three + possible approaches: + + a) each module could ship in a separate package, and would drop + into the path identified by --with-moduledir= + (/usr/lib/$(DEB_HOST_MULTIARCH)/knot/ , currently). They would + be automatically loaded by knotd as long as the packages were + installed. + + b) we could ship them all directly in the knot package. they would + live in /usr/lib/$(DEBHOST_MULTIARCH)/knot-$(VERSION)/ in this + case, and the admin would need to manually load them in + knot.conf. + + c) we could ship them in a separate knot-modules package (one + bundle of all modules, located in the same place as (b)). the + admin would need to manually load them in knot.conf. + + In either (b) or (c) we might want to change --with-moduledir to + point to somewhere that the admin is encouraged to edit, like + /etc/knot/modules or something. or maybe we should abandon + --with-moduledir entirely? + + Transitioning from static to dynamic modules seems like an awkward + process, though. diff --git a/debian/changelog b/debian/changelog new file mode 100644 index 0000000..faa1176 --- /dev/null +++ b/debian/changelog @@ -0,0 +1,1258 @@ +knot (2.7.6-2) unstable; urgency=medium + + * add libsofthsm2 when testing for libdnssec/test_keystore_pkcs11 + * Check fine-grained timestamps on zonefiles. + * Correct documentation about key formats + * Standards-Version: bump to 4.3.0 (no changes needed) + + -- Daniel Kahn Gillmor <dkg@fifthhorseman.net> Fri, 22 Feb 2019 16:51:08 -0500 + +knot (2.7.6-1) unstable; urgency=medium + + * new upstream release + + -- Ondřej Surý <ondrej@debian.org> Fri, 08 Feb 2019 12:53:57 +0000 + +knot (2.7.4-1) unstable; urgency=medium + + * new upstream release + * drop patch applied upstream + * d/upstream/signing-key.asc: minimize OpenPGP certificate + + -- Daniel Kahn Gillmor <dkg@fifthhorseman.net> Wed, 14 Nov 2018 01:16:27 -0500 + +knot (2.7.3-3) unstable; urgency=medium + + * update build-deps and autopkgtest deps + + -- Daniel Kahn Gillmor <dkg@fifthhorseman.net> Thu, 08 Nov 2018 08:39:43 +0700 + +knot (2.7.3-2) unstable; urgency=medium + + * postinst: use runuser instead of su for safety and simplicity + * fix get_kaspdb and test it against shipped config (Closes: #912210) + * added Build-Depends-Package: libknot-dev to symbols files + * cleaner diffs: put dh args on separate lines + * added authoritative nameserver autopkgtest + * Avoid including git version in debian packages + * fix broken python + * fix up get_user + * autopkgtest: test upgrade/conversion tooling + + -- Daniel Kahn Gillmor <dkg@fifthhorseman.net> Wed, 07 Nov 2018 22:55:37 +0700 + +knot (2.7.3-1) unstable; urgency=medium + + * new upstream release + + -- Daniel Kahn Gillmor <dkg@fifthhorseman.net> Mon, 15 Oct 2018 17:21:51 -0400 + +knot (2.7.2-2) unstable; urgency=medium + + * d/rules: try moving DEB_HOST_ARCH check for -latomic + * mips and powerpc both appear to build fine without -latomic + + -- Daniel Kahn Gillmor <dkg@fifthhorseman.net> Wed, 29 Aug 2018 16:07:02 -0400 + +knot (2.7.2-1) unstable; urgency=medium + + * new upstream release + * try to fix up architecture selection + + -- Daniel Kahn Gillmor <dkg@fifthhorseman.net> Wed, 29 Aug 2018 10:34:56 -0400 + +knot (2.7.1-3) unstable; urgency=medium + + [ Daniel Salzman ] + * remove obsolete dependency libjansson-dev + * remove obsolete --with-bash-completions + + -- Daniel Kahn Gillmor <dkg@fifthhorseman.net> Mon, 27 Aug 2018 19:18:20 -0400 + +knot (2.7.1-2) unstable; urgency=medium + + * Standards-Version: bump to 4.2.1 (no changes needed) + * add -latomic to riscv64 arch as well + + -- Daniel Kahn Gillmor <dkg@fifthhorseman.net> Mon, 27 Aug 2018 19:06:08 -0400 + +knot (2.7.1-1) unstable; urgency=medium + + * new upstream release + * SONAME bumps: move to libknot8, libdnssec6, and libzscanner2 + * adopted pykeymgr from upstream, renaming to + /usr/lib/knot/kasp_json2lmdb + * ship manpages with dh_installman + * kjournalprint is now a shipped as a system administration utility + * avoid more autogened files on package import + * drop THANKS, no longer shipped upstream + * update symbols files + * Standards-Version: bump to 4.2.0 (no changes needed) + * clean up kdns-utils description + * added libcap-ng to build-deps + * move to libidn2 + * d/copyright: correct license of TAP sources + * added build-dep on libmaxminddb-dev for GeoIP module + * Only conditionally add -latomic based on the platform + * record notes about dynamic modules instead of static modules + + -- Daniel Kahn Gillmor <dkg@fifthhorseman.net> Fri, 24 Aug 2018 18:02:44 -0400 + +knot (2.6.8-2) unstable; urgency=medium + + * d/knot.NEWS: fix spelling (thanks, Lintian!) + * refresh patches + * Standards-Version: bump to 4.1.5 (no changes needed) + + -- Daniel Kahn Gillmor <dkg@fifthhorseman.net> Tue, 10 Jul 2018 16:14:48 -0400 + +knot (2.6.8-1) unstable; urgency=medium + + * New upstream version 2.6.8 + + -- Daniel Salzman <daniel.salzman@nic.cz> Tue, 10 Jul 2018 16:23:19 +0200 + +knot (2.6.7-2) unstable; urgency=medium + + * use knot@packages.debian.org as Maintainer (Closes: #899825) + + -- Daniel Kahn Gillmor <dkg@fifthhorseman.net> Thu, 24 May 2018 16:00:33 -0400 + +knot (2.6.7-1) unstable; urgency=medium + + * New upstream version 2.6.7 + + -- Daniel Salzman <daniel.salzman@nic.cz> Thu, 17 May 2018 13:18:22 +0200 + +knot (2.6.6-2) unstable; urgency=medium + + [ Daniel Salzman ] + * Remove already included patches + * Add new symbol to libknot7.symbols + * Update changelog for 2.6.6-1 release + + [ Daniel Kahn Gillmor ] + * standards-version: bump to 4.1.4 (no changes needed) + * clean up libknot7.symbols + * prepare debian release + + -- Daniel Kahn Gillmor <dkg@fifthhorseman.net> Mon, 23 Apr 2018 02:07:36 -0400 + +knot (2.6.5-3) unstable; urgency=medium + + * accept suggestions from the Multiarch hinter + * d/tests/control: rely on ca-certificates to validate the + DNS-over-TLS cert + + -- Daniel Kahn Gillmor <dkg@fifthhorseman.net> Sun, 25 Feb 2018 15:49:46 -0800 + +knot (2.6.5-2) unstable; urgency=medium + + * re-ship /usr/lib/$(DEB_HOST_MULTIARCH)/knot" (Closes: #891319) + + -- Daniel Kahn Gillmor <dkg@fifthhorseman.net> Sun, 25 Feb 2018 10:17:49 -0800 + +knot (2.6.5-1) unstable; urgency=medium + + * new upstream release + + [ Daniel Salzman ] + * Update uploaders and dependencies in the control file + * Downgrade 'Recommends' to 'Suggests' for systemd + * Update upstream signing key + + [ Daniel Kahn Gillmor ] + * wrap-and-sort -ast + * add myself to uploaders + * move to debhelper 11 + * Standards-Version: 4.1.3 (no changes needed) + * build-depend on python3-sphinx instead of python-sphinx + * d/gbp.conf: clean up, use DEP-14 + * dh11: apply --fail-missing only to dh_missing + * remove doc/modules symlink on clean + * Use python3 instead of python2 for helper functions + * use python3 for pykeymgr + * move knot from python 2 to python 3 + * Move python3-lmdb to Recommends + * d/TODO: note future debian packaging work + * knot-doc: use system jquery and underscore javascript + * include upstream VCS in git history + * d/control: add Rules-Requires-Root: no + * d/changelog: strip trailing whitespace + * ship upstream ChangeLog + * d/copyright: drop hat-trie, removed upstream + * d/*.NEWS: stop using asterisks + * stop declaring unnecessary dirs + * stop shipping /usr/lib/$(DEB_HOST_MULTIARCH)/knot + * add doc-base entry for knot-doc + * d/gbp.conf: improve cleanup during import-orig + * fix spelling errors in manpages + * info: fix direntry and category + * add really simple autopkgtest + + -- Daniel Kahn Gillmor <dkg@fifthhorseman.net> Thu, 22 Feb 2018 23:38:33 -0800 + +knot (2.6.4-1) unstable; urgency=medium + + * Update Vcs-* links to salsa.d.o + * New upstream version 2.6.4 + + -- Ondřej Surý <ondrej@debian.org> Thu, 04 Jan 2018 15:02:46 +0000 + +knot (2.6.3-1) unstable; urgency=medium + + * New upstream version 2.6.3 + + -- Ondřej Surý <ondrej@debian.org> Fri, 24 Nov 2017 15:33:43 +0000 + +knot (2.6.1-2) unstable; urgency=medium + + * Add Breaks/Replaces for libdnssec5/libknot7 to remedy botched 2.6.0-1 + upload (Closes: #881638) + + -- Ondřej Surý <ondrej@debian.org> Mon, 13 Nov 2017 19:58:35 +0000 + +knot (2.6.1-1) unstable; urgency=medium + + * New upstream version 2.6.1 + * Remove upstream patch for disabling TCP Fastopen + + -- Ondřej Surý <ondrej@debian.org> Sun, 12 Nov 2017 03:11:26 +0000 + +knot (2.6.0-3) unstable; urgency=medium + + * kdig: disable TCP Fastopen by default as it breaks TLS connection + (Closes: #879079) + + -- Ondřej Surý <ondrej@debian.org> Thu, 19 Oct 2017 08:22:18 +0000 + +knot (2.6.0-2) unstable; urgency=medium + + [ John Bond ] + * fix get_kasp and get_user to support unquoted ipv6 addresses + + -- Ondřej Surý <ondrej@debian.org> Thu, 05 Oct 2017 13:08:26 +0000 + +knot (2.6.0-1) unstable; urgency=medium + + * New upstream version 2.6.0 + * Enable strict symbols checking + * Bump libknot 6->7 and libdnssec 4->5 SONAMEs and update symbols files + + -- Ondřej Surý <ondrej@debian.org> Fri, 29 Sep 2017 19:46:41 +0200 + +knot (2.5.4-2) unstable; urgency=medium + + * Drop conflicting links to dig, nsupdate and host (Closes: #741645) + * Build-Depend on latexmk (Closes: #872203) + + -- Ondřej Surý <ondrej@debian.org> Mon, 18 Sep 2017 07:11:39 +0200 + +knot (2.5.4-1) unstable; urgency=medium + + * New upstream version 2.5.4 + + -- Ondřej Surý <ondrej@debian.org> Fri, 01 Sep 2017 09:03:02 +0200 + +knot (2.5.3-3) unstable; urgency=medium + + * Simple rebuild to make knot-doc arch:all again. + + -- Ondřej Surý <ondrej@debian.org> Wed, 26 Jul 2017 14:41:26 +0200 + +knot (2.5.3-2) unstable; urgency=medium + + * Disable dh-exec usage as #831786 breaks dh_install --fail-missing + (Closes: #869199) + + -- Ondřej Surý <ondrej@debian.org> Mon, 24 Jul 2017 10:26:09 +0200 + +knot (2.5.3-1) unstable; urgency=medium + + * New upstream version 2.5.3 + + -- Ondřej Surý <ondrej@debian.org> Sat, 15 Jul 2017 07:26:12 +0200 + +knot (2.5.2-1) unstable; urgency=medium + + * New upstream version 2.5.2 + * Remove all patches merged upstream + + -- Ondřej Surý <ondrej@debian.org> Fri, 23 Jun 2017 11:46:34 +0200 + +knot (2.5.1-4) unstable; urgency=medium + + * Create the modules M-A directory to workaround the bug that fails to + start knot when modules directory is missing + + -- Ondřej Surý <ondrej@debian.org> Thu, 15 Jun 2017 11:32:09 +0200 + +knot (2.5.1-3) unstable; urgency=medium + + * Enable dnstap module and set default moduledir to multiarch path + + -- Ondřej Surý <ondrej@debian.org> Thu, 15 Jun 2017 08:32:34 +0200 + +knot (2.5.1-2) unstable; urgency=medium + + * Explicitly exclude example.com.zone to support older debhelpers + * Add patch to fix duplicate section merging in the config + + -- Ondřej Surý <ondrej@debian.org> Fri, 09 Jun 2017 13:47:17 +0200 + +knot (2.5.1-1) unstable; urgency=medium + + * New upstream version 2.5.1 + * Remove upstream patches released as Knot DNS 2.5.1 + + -- Ondřej Surý <ondrej@debian.org> Wed, 07 Jun 2017 16:04:16 +0200 + +knot (2.5.0-2) unstable; urgency=medium + + * Add upstream patches to fix old DNSSEC installations + * Skip already converted kasp-db directories + * Install pykeymgr from upstream tarball + + -- Ondřej Surý <ondrej@debian.org> Wed, 07 Jun 2017 14:20:38 +0200 + +knot (2.5.0-1) unstable; urgency=medium + + * New upstream version 2.5.0 + * Update maintscript to use dh-exec and remove obsolete cruft + * Bump the package names for libknot and libdnssec to match new + SOVERSIONs + * Simplify d/rules overrides + * Remove not-installed files from d/*.install + * Install local copy of pykeymgr (not included in the source + distribution) + * Add python-lmdb for pykeymgr migration utility + + -- Ondřej Surý <ondrej@debian.org> Wed, 07 Jun 2017 11:03:22 +0200 + +knot (2.4.3-1) unstable; urgency=medium + + * New upstream version 2.4.3 + + -- Ondřej Surý <ondrej@debian.org> Tue, 11 Apr 2017 21:17:47 +0200 + +knot (2.4.2-1) unstable; urgency=medium + + * New upstream version 2.4.2 + + -- Ondřej Surý <ondrej@debian.org> Thu, 23 Mar 2017 11:47:52 +0100 + +knot (2.4.1-2) unstable; urgency=medium + + * Enable dnstap module + + -- Ondřej Surý <ondrej@debian.org> Mon, 27 Feb 2017 11:35:15 +0100 + +knot (2.4.1-1) unstable; urgency=medium + + * New upstream version 2.4.1 + + -- Ondřej Surý <ondrej@debian.org> Fri, 10 Feb 2017 13:54:24 +0100 + +knot (2.4.0-3) unstable; urgency=medium + + * Fix timeout call syntax in dh_auto_test invocation + + -- Ondřej Surý <ondrej@debian.org> Wed, 25 Jan 2017 15:10:04 +0100 + +knot (2.4.0-2) unstable; urgency=medium + + * Add -latomic to LDFLAGS to fix FTBFS on platforms that need it + + -- Ondřej Surý <ondrej@debian.org> Mon, 23 Jan 2017 11:41:59 +0100 + +knot (2.4.0-1) unstable; urgency=medium + + * Fix gbp.conf to be readable by git config --file debian/gbp.conf on Jessie + * New upstream version 2.4.0 + * Bump libknot SONAME 4->5 + * Update symbols files for 2.4.0 release + + -- Ondřej Surý <ondrej@debian.org> Fri, 20 Jan 2017 12:15:30 +0100 + +knot (2.3.3-1) unstable; urgency=medium + + [ Daniel Kahn Gillmor ] + * Use secure URLs where possible + * Clean up debian/copyright. + * Drop duplicate Source: lines (clears lintian binary-control-field-duplicates-source) + * Avoid using asterisk in NEWS (clears lintian debian-news-entry-uses-asterisk) + * Knot needs a dependency on lsb-base (clears lintian init.d-script-needs-depends-on-lsb-base) + * Filter auto-reconfed files out during future gbp import-orig operations + * debian/control: clean up Description: lines + * Added Documentation= to knot.service + + [ Ondřej Surý ] + * Imported Upstream version 2.3.3 + * Add kjournalprint to knot package + + -- Ondřej Surý <ondrej@debian.org> Thu, 08 Dec 2016 14:49:31 +0100 + +knot (2.3.2-1) unstable; urgency=medium + + * Imported Upstream version 2.3.2 + * Add new symbols to libknot4.symbols + + -- Ondřej Surý <ondrej@debian.org> Fri, 04 Nov 2016 11:31:33 +0100 + +knot (2.3.1-1) unstable; urgency=medium + + * Imported Upstream version 2.3.1 + * Bump libknot3 to libknot4 + * kzonecheck was moved to /usr/bin + + -- Ondřej Surý <ondrej@debian.org> Mon, 10 Oct 2016 12:01:41 +0200 + +knot (2.3.0-4) unstable; urgency=medium + + * Don't fail if there's no knot user defined + * Don't list explicit -c or -C path and let daemon figure it out + + -- Ondřej Surý <ondrej@debian.org> Thu, 15 Sep 2016 12:44:57 +0200 + +knot (2.3.0-3) unstable; urgency=medium + + * Ignore the test results if they don't finish within 5 minutes + * Correctly break/replace libzscanner0 that contained libzscanner.so.1 + + -- Ondřej Surý <ondrej@debian.org> Thu, 11 Aug 2016 08:49:25 +0200 + +knot (2.3.0-2) unstable; urgency=medium + + * Move examples to knot-doc package (fix arch-only FTBFS) + + -- Ondřej Surý <ondrej@debian.org> Wed, 10 Aug 2016 10:17:17 +0200 + +knot (2.3.0-1) unstable; urgency=medium + + * Imported Upstream version 2.3.0 + + Zone size limit restriction for DDNS, AXFR, and IXFR (CVE-2016-6171) + (Closes: #830809) + * Restructure d/rules so dh_install --fail-missing works again + * Upstream bumped SOVERSION to libknot3, libdnssec2 and libzscanner1 + + -- Ondřej Surý <ondrej@debian.org> Wed, 10 Aug 2016 09:16:35 +0200 + +knot (2.2.1-2) unstable; urgency=high + + * Add texlive-generic-extra to B-D for missing iftex.sty + (Closes: #829428) + + -- Ondřej Surý <ondrej@debian.org> Mon, 11 Jul 2016 11:47:34 +0200 + +knot (2.2.1-1) unstable; urgency=medium + + * Imported Upstream version 2.2.1 + + -- Ondřej Surý <ondrej@debian.org> Tue, 24 May 2016 17:48:16 +0200 + +knot (2.2.0-3) unstable; urgency=medium + + * knotc checkconf is not knotc conf-check (Closes: #823574) + + -- Ondřej Surý <ondrej@debian.org> Fri, 20 May 2016 14:22:11 +0200 + +knot (2.2.0-2) unstable; urgency=medium + + * Do dbgsym migration of debug symbols + + -- Ondřej Surý <ondrej@debian.org> Wed, 27 Apr 2016 17:43:59 +0200 + +knot (2.2.0-1) unstable; urgency=medium + + * confdb should be in /var/lib/knot/ by default + * Imported Upstream version 2.2.0 + * Add libedit-dev to Build-Depends + + -- Ondřej Surý <ondrej@debian.org> Wed, 27 Apr 2016 10:10:10 +0200 + +knot (2.1.1-2) unstable; urgency=medium + + * Add python to Depends and run wrap-and-sort -a + * Parse correct /etc/default/knot instead of /etc/default/knotd + + -- Ondřej Surý <ondrej@debian.org> Fri, 15 Apr 2016 17:18:02 +0200 + +knot (2.1.1-1) unstable; urgency=medium + + * Imported Upstream version 2.1.1 + + -- Ondřej Surý <ondrej@debian.org> Wed, 10 Feb 2016 20:01:44 +0100 + +knot (2.1.0-3) unstable; urgency=medium + + * Add small python helper programs to get values from knot.conf + + -- Ondřej Surý <ondrej@debian.org> Mon, 25 Jan 2016 12:44:00 +0100 + +knot (2.1.0-2) unstable; urgency=medium + + * Revert "Run keymgr init on every upgrade (just to be sure it happens)" + * Add support for relative directories in kasp-db + + -- Ondřej Surý <ondrej@debian.org> Thu, 14 Jan 2016 11:46:35 +0100 + +knot (2.1.0-1) unstable; urgency=medium + + * Set knot user home directory to /var/lib/knot + * Imported Upstream version 2.1.0 + * Run keymgr init on every upgrade (just to be sure it happens) + + -- Ondřej Surý <ondrej@debian.org> Thu, 14 Jan 2016 10:55:26 +0100 + +knot (2.1.0~rc1-55-gf227348-1) unstable; urgency=medium + + * Add libgnutls28-dev and libjansson-dev as dependencies to libknot-dev + to satisfy pkg-config requirements + * Imported Upstream version 2.1.0~rc1-55-gf227348 + * Automatically upgrade all KASP databases found in the configuration + and restart the server afterwards when upgrading from 2.0.x to 2.1.x + + -- Ondřej Surý <ondrej@debian.org> Wed, 13 Jan 2016 14:03:17 +0100 + +knot (2.1.0~rc1-52-gd80ce77-1) unstable; urgency=medium + + * Imported Upstream version 2.1.0~rc1-52-gd80ce77 + + -- Ondřej Surý <ondrej@debian.org> Tue, 12 Jan 2016 16:56:12 +0100 + +knot (2.0.2-1) unstable; urgency=medium + + * Imported Upstream version 2.0.2 + * Delete d/p/series as we carry no patches + + -- Ondřej Surý <ondrej@debian.org> Tue, 24 Nov 2015 19:59:56 +0100 + +knot (2.0.1-4) unstable; urgency=medium + + * Split knot-libs into individual library packages + * Add knot.default file and use it from systemd and init.d scripts + + -- Ondřej Surý <ondrej@debian.org> Mon, 05 Oct 2015 20:34:02 +0200 + +knot (2.0.1-3) unstable; urgency=medium + + * The upstart conffile ends with .conf, fix the stale conffile removal + + -- Ondřej Surý <ondrej@debian.org> Mon, 21 Sep 2015 13:54:42 +0200 + +knot (2.0.1-2) unstable; urgency=medium + + * Compile the production version with NDEBUG + * Remove stale upstart init script via dpkg-maintscript-helper rm_config + + -- Ondřej Surý <ondrej@debian.org> Mon, 14 Sep 2015 13:41:29 +0200 + +knot (2.0.1-1) unstable; urgency=medium + + * Imported Upstream version 2.0.1 + * Fix the do_tmpfiles() in sysvrc script (Courtesy of Daniel Baumann) + (Closes: #796921) + * Disable -pedantic as it causes errors to be thrown in the tests + + -- Ondřej Surý <ondrej@debian.org> Thu, 03 Sep 2015 10:56:16 +0200 + +knot (2.0.0-1+0) unstable; urgency=medium + + * Bump the version to workaround ~exp* higher than ~bpo* + + -- Ondřej Surý <ondrej@debian.org> Mon, 17 Aug 2015 15:05:37 +0200 + +knot (2.0.0-1) unstable; urgency=medium + + * New upstream version 2.0.0 + + Bugfixes: + - Fix lost NOTIFY message if received during zone transfer + - Disable fast zone parser when compiled in Clang (workaround for Clang bug) + - kdig: Record correct dnstap SocketProtocol when retrying over TCP + - kdig: Hide TSIG section with +noall + - Do not set AA flag for AXFR/IXFR queries + + Features: + - DNSSEC: separate library, switch to GnuTLS, new utilities + - DNSSEC: basic KASP support (generate initial keys, ZSK rollover) + - Configuration: New text format in YAML, binary store in LMDB + - Zone parser: Split long TXT/SPF strings into multiple strings + - kdig: Add generic dump style option (+generic) + - Try all master servers in multi-master environment + - Improved remotes and ACLs (multiple addresses, multiple keys) + - Basic support for zone file patterns (%s to substitute zone name) + - Disable zone file synchronization by setting 'zonefile_sync' to '-1' + - knsupdate: Add input prompt in interactive mode and 'quit' command + - knsupdate: Allow TSIG algorithm specification in interactive prompt + + Improvements: + - Zone dump: Do not write class for SOA record (unified with other RR types) + - Zone dump: Do not write master server address into the zone file + - Documentation: Manual pages are included in HTML and PDF + * Install knot1to2 configuration file conversion tool + * Automatically convert knot.conf with some safety-checks + * Add note about the conversion to debian/knot.NEWS + * Make the build libsystem-{daemon,journal}-dev friendly to allow Ubuntu + and backported builds + + -- Ondřej Surý <ondrej@debian.org> Mon, 17 Aug 2015 11:56:43 +0200 + +knot (2.0.0-1~exp2) experimental; urgency=medium + + * Update prepare-environment to match the new config file syntax + + -- Ondřej Surý <ondrej@debian.org> Thu, 30 Jul 2015 09:26:52 +0200 + +knot (2.0.0-1~exp1) experimental; urgency=medium + + * New upstream version 2.0.0 + + Bugfixes: + - Fix lost NOTIFY message if received during zone transfer + - Disable fast zone parser when compiled in Clang (workaround for Clang bug) + - kdig: Record correct dnstap SocketProtocol when retrying over TCP + - kdig: Hide TSIG section with +noall + - Do not set AA flag for AXFR/IXFR queries + + Features: + - DNSSEC: separate library, switch to GnuTLS, new utilities + - DNSSEC: basic KASP support (generate initial keys, ZSK rollover) + - Configuration: New text format in YAML, binary store in LMDB + - Zone parser: Split long TXT/SPF strings into multiple strings + - kdig: Add generic dump style option (+generic) + - Try all master servers in multi-master environment + - Improved remotes and ACLs (multiple addresses, multiple keys) + - Basic support for zone file patterns (%s to substitute zone name) + - Disable zone file synchronization by setting 'zonefile_sync' to '-1' + - knsupdate: Add input prompt in interactive mode and 'quit' command + - knsupdate: Allow TSIG algorithm specification in interactive prompt + + Improvements: + - Zone dump: Do not write class for SOA record (unified with other RR types) + - Zone dump: Do not write master server address into the zone file + - Documentation: Manual pages are included in HTML and PDF + * Install knot1to2 configuration file conversion tool + * Automatically convert knot.conf with some safety-checks + * Add note about the conversion to debian/knot.NEWS + * Make the build libsystem-{daemon,journal}-dev friendly to allow Ubuntu + and backported builds + + -- Ondřej Surý <ondrej@debian.org> Mon, 29 Jun 2015 10:40:45 +0200 + +knot (1.6.1-1) unstable; urgency=medium + + * New upstream version 1.6.1 + + -- Ondřej Surý <ondrej@debian.org> Tue, 30 Dec 2014 09:50:54 +0100 + +knot (1.6.0-1) unstable; urgency=medium + + * New upstream version 1.6.0 + * Switch to network-online.target to mitigate some network not-yet-ready races + * Recommend systemd due journald enabled logging (Closes: #766596) + + -- Ondřej Surý <ondrej@debian.org> Fri, 24 Oct 2014 12:41:32 +0200 + +knot (1.6.0~rc2-1) unstable; urgency=medium + + * New upstream version 1.6.0~rc2 + * Update patches for 1.6.0~rc2 release + + -- Ondřej Surý <ondrej@debian.org> Fri, 17 Oct 2014 17:32:30 +0200 + +knot (1.6.0~rc1-1) unstable; urgency=medium + + * New upstream version 1.6.0~rc1 + * Knot needs lmdb for persistent timers + + -- Ondřej Surý <ondrej@debian.org> Mon, 13 Oct 2014 23:06:56 +0200 + +knot (1.5.3-1) unstable; urgency=medium + + * Move knot-libs to Section: net (Closes: #760795) + * New upstream version 1.5.3 + + -- Ondřej Surý <ondrej@debian.org> Mon, 15 Sep 2014 17:00:08 +0200 + +knot (1.5.2-1) unstable; urgency=high + + * Update Vcs-Urls to point to anonscm.debian.org + * New upstream version 1.5.2 + + [CVE-2014-0486]: Fixed remote crash with crafted DNS message + * Update patches for 1.5.2 release + + -- Ondřej Surý <ondrej@debian.org> Mon, 08 Sep 2014 11:11:56 +0200 + +knot (1.5.1-3) unstable; urgency=high + + * More arch/indep build rules splitting to fix binary-arch-only builds + * Add lintian override to override warning about internal libraries in + knot-libs + + -- Ondřej Surý <ondrej@debian.org> Tue, 26 Aug 2014 09:43:05 +0200 + +knot (1.5.1-2) unstable; urgency=medium + + * Enable full hardening via debhelper >= 9 + * Enable IDN in knot-dnsutils and knot-host packages + * Enable systemd libraries only on linux-any + * Split arch and indep builds to build the documentation just once + * Drop ragel from build depends to allow arm64 builds + + -- Ondřej Surý <ondrej@debian.org> Mon, 25 Aug 2014 15:54:34 +0200 + +knot (1.5.1-1) unstable; urgency=medium + + * New upstream version 1.5.1 + * Enable systemd notification mechanism + * Enable systemd journal enhanced logging + + -- Ondřej Surý <ondrej@debian.org> Wed, 20 Aug 2014 10:45:18 +0200 + +knot (1.5.0-1) unstable; urgency=medium + + * New upstream version 1.5.0 + + Features: + - Pluggable query processing modules + - Synthetic IPv4/IPv6 reverse/forward records (optional module) + - dnstap support in both utilities & server (optional module) + - NOTIFY message support and new TSIG section in kdig + - Multi-master support + - edns-client-subnet support in kdig + - Optional asynchronous startup (config "asynchronous-start") + - DDNS forwarding reimplemented + + Improvements: + - Query processing and core functionality overhaul + - Performance and reduced memory footprint + - Faster zone events scheduling + - RFC compliant queries/responses in some corner cases + - Log messages + - New documentation (Sphinx) + - Transfer sizes logged in bytes if needed + - Logging outgoing NOTIFY messages + - Logging unauthorized incoming NOTIFYs + - Preempt task queue for faster reload + - Lazy zone file write after zone transfer (governed by "zonefile-sync") + + Bugfixes: + - Close zone transfer after SERVFAIL response + - Incremental to full zone transfer fallback, wrong log message + - Zone events corner cases, reload replanning + - Zone flush planning after bootstrap + - Incorrect incoming AXFR message sizes + - DDNS signing changes were freed too soon, posibility of stale data + - knotc remote control key handling + * Debian packaging: + + d/control: New documentation is using sphinx + + d/control: New knot-libs package containing internal shared libraries + + -- Ondřej Surý <ondrej@debian.org> Wed, 09 Jul 2014 13:08:26 +0200 + +knot (1.4.6+hotfix-1) unstable; urgency=medium + + * New upstream version 1.4.6+hotfix + + -- Ondřej Surý <ondrej@debian.org> Thu, 22 May 2014 15:39:07 +0200 + +knot (1.4.6-1) unstable; urgency=medium + + * New upstream version 1.4.6 + * Update patches for 1.4.6 release + + -- Ondřej Surý <ondrej@debian.org> Thu, 22 May 2014 13:15:14 +0200 + +knot (1.4.5-2) unstable; urgency=high + + * Re-upload to fix botched amd64 upload in 1.4.5-1 + + -- Ondřej Surý <ondrej@debian.org> Tue, 22 Apr 2014 14:58:30 +0200 + +knot (1.4.5-1) unstable; urgency=high + + * New upstream version 1.4.5 + + Fix possible weakness in TSIG signature checking + * Refresh patches for 1.4.5 release + * Use dh-autoreconf to regenerate autotools files + + -- Ondřej Surý <ondrej@debian.org> Mon, 14 Apr 2014 15:11:12 +0200 + +knot (1.4.4-1) unstable; urgency=medium + + * New upstream version 1.4.4 + + Server is logging remote control commands + + 'knotc reload' doesn't refresh unchanged zones + + 'knotc -f refresh' forces zone retransfer + + Fixed missing notifications after DDNS/automatic resign + + Zone is rebootstrapped if the zone file is unreadable + + Progressive bootstrap retry backoff + + Zone file parser now allows asterisk as part of the label + + Fix journal maximum entry size + + Sign DNSKEYs in non-apex nodes as regular RR sets + + Various spelling and typo fixes (Courtesy of Robert Edmonds) + + -- Ondřej Surý <ondrej@debian.org> Thu, 27 Mar 2014 15:49:54 +0100 + +knot (1.4.3-2) unstable; urgency=medium + + * Add support for autotools-dev and dh-systemd + * Enable parallel builds in dh invocation + + -- Ondřej Surý <ondrej@debian.org> Tue, 18 Feb 2014 13:44:13 +0100 + +knot (1.4.3-1) unstable; urgency=low + + * New upstream version 1.4.3 + + -- Ondřej Surý <ondrej@debian.org> Tue, 18 Feb 2014 13:03:42 +0100 + +knot (1.4.2-1) unstable; urgency=low + + * New upstream version 1.4.2 + * Update OpenSSL << 1.0.0 compatibility patch + + -- Ondřej Surý <ondrej@debian.org> Mon, 27 Jan 2014 16:14:33 +0100 + +knot (1.4.1-2) unstable; urgency=low + + * Add patch to remove the requirement for OpenSSL 1.0.0 to build on + Debian squeeze, be warned though that the OpenSSL before 1.0.0 might + manifest some threading errors and crashes, so you really should + upgrade your system to Debian wheezy. + + -- Ondřej Surý <ondrej@debian.org> Thu, 23 Jan 2014 16:53:03 +0100 + +knot (1.4.1-1) unstable; urgency=low + + * New upstream version 1.4.1 + + Empty APL record support + + 'zonestatus' when using immediate zone syncing + + Immediate zone syncing after reload + + Race condition writing time values to zone file + + Require OpenSSL >= 1.0.0 + * Don't use dh-autoreconf, upstream uses recent enough autotools + * Bump standards version to 3.9.5 + * Run the tests on every arch without the condition, but don't fail + anywhere + + -- Ondřej Surý <ondrej@debian.org> Mon, 13 Jan 2014 18:00:18 +0100 + +knot (1.4.0-1) unstable; urgency=low + + * New major upstream version 1.4.0 + + Experimental automatic DNSSEC signing + + Fastest ragel parser enabled by default + + Reduced memory usage + + Zone SOA SERIAL policies (INCREMENT, UNIXTIME) for DDNS and + automatic DNSSEC signing + + IDN support in Knot utilities (kdig, knsupdate, ...) + + DNSSEC: support for GOST algorithm + + Support for DNSSEC key pre-publication + * Remove PATH_MAX patch, it's already included in upstream + * Run the tests on all archs, but don't fail the build if the tests fail + on broken archs + * Update watch file to match (alpha|beta|rc)\d* versions + + -- Ondřej Surý <ondrej@debian.org> Mon, 06 Jan 2014 11:00:07 +0100 + +knot (1.4.0~rc2-1) experimental; urgency=low + + * New upstream version 1.4.0~rc2 + + -- Ondřej Surý <ondrej@debian.org> Fri, 13 Dec 2013 17:53:26 +0100 + +knot (1.4.0~rc1-1) experimental; urgency=low + + * Disable tests on GNU Hurd + * New upstream version 1.4.0~rc1 + + -- Ondřej Surý <ondrej@debian.org> Mon, 25 Nov 2013 16:19:27 +0100 + +knot (1.4.0~beta-1) experimental; urgency=low + + * New upstream version 1.4.0~beta + * Update patches for 1.4.0~beta release + * Disable fastparser since the ragel is broken in one test + * Add knsec3hash to knot package + + -- Ondřej Surý <ondrej@debian.org> Tue, 29 Oct 2013 12:25:49 +0100 + +knot (1.3.4-1) unstable; urgency=low + + * Disable tests on GNU Hurd + * New upstream version 1.3.4 + + -- Ondřej Surý <ondrej@debian.org> Fri, 13 Dec 2013 17:23:52 +0100 + +knot (1.3.3-1) unstable; urgency=low + + * New upstream version 1.3.3 + + -- Ondřej Surý <ondrej@debian.org> Mon, 28 Oct 2013 11:40:13 +0100 + +knot (1.3.2-3) unstable; urgency=low + + * Add ufw applications.d rule for Knot DNS + * Disable recvmmsg on GNU Hurd (since recvmmsg is not implemented on GNU + Hurd and will always fail) + * Enable fastparser (requires Ragel) + + -- Ondřej Surý <ondrej@debian.org> Fri, 11 Oct 2013 17:23:35 +0200 + +knot (1.3.2-2) unstable; urgency=low + + * Define #PATH_MAX to make GNU Hurd happy + * Don't enable LTO, it doesn't play well with debugging symbols + + -- Ondřej Surý <ondrej@debian.org> Sun, 06 Oct 2013 01:57:13 +0200 + +knot (1.3.2-1) unstable; urgency=low + + * New upstream version 1.3.2 + * Enable link-time-optimizations by default + + -- Ondřej Surý <ondrej@debian.org> Mon, 30 Sep 2013 15:04:01 +0200 + +knot (1.3.1-1) unstable; urgency=low + + * New upstream version 1.3.1 + * Add new debian/watch file (Courtesy of Debian QA) + * Bump standards to 3.9.4 + * Stop using /lib/init/vars.sh, we don't use $VERBOSE anymore anyway + * Drop syslog.target as it is not needed anymore + * Remove SSE detection patch as it was merged upstream + + -- Ondřej Surý <ondrej@debian.org> Tue, 27 Aug 2013 14:27:44 +0200 + +knot (1.3.0-2) unstable; urgency=low + + * Disable SSE detection in the packaged version of Knot DNS + + -- Ondřej Surý <ondrej@debian.org> Fri, 16 Aug 2013 13:04:39 +0200 + +knot (1.3.0-1) unstable; urgency=low + + * New upstream version 1.3.0 + * Remove upstream patch from 1.3.0~rc5-2 as it is included in + this release. + + -- Ondřej Surý <ondrej@debian.org> Mon, 05 Aug 2013 17:01:23 +0200 + +knot (1.3.0~rc5-2) unstable; urgency=low + + * Pull some pre 1.3.0 patches (mainly to test before release): + + Initialize secondary groups for user <user>.<group>. + + Reworked CH TXT records support (RFC 4892). + + Fixed inactive xfers may be disconnected depending on the previous + result. + + Add server starting information to log. + + -- Ondřej Surý <ondrej@debian.org> Mon, 05 Aug 2013 10:39:48 +0200 + +knot (1.3.0~rc5-1) unstable; urgency=low + + * New upstream version 1.3.0~rc5 + * Remove last upstream patch, all our changes have been merged. Yay\! + + -- Ondřej Surý <ondrej@debian.org> Mon, 29 Jul 2013 17:15:56 +0200 + +knot (1.3.0~rc4-2) unstable; urgency=low + + * Disable tests on big endian architectures (but the code still needs to + be fixed) + + -- Ondřej Surý <ondrej@debian.org> Tue, 23 Jul 2013 14:07:39 +0200 + +knot (1.3.0~rc4-1) unstable; urgency=low + + * New upstream version 1.3.0~rc4 + * Add upstream patch to honour CONFIG_DIR + * Remove now obsolete patch to run as knot:knot + * The knot/ is now added by upstream to @sysconfdir@ + + -- Ondřej Surý <ondrej@debian.org> Mon, 15 Jul 2013 15:15:05 +0200 + +knot (1.3.0~rc3-2) unstable; urgency=low + + * Add proper support for upstart and systemd along with sysvinit + * Add /usr/lib/knot/prepare-environment script which will parse + knot configuration file and properly create rundir and set + correct permissions to configured values in /etc/knot/knot.conf + * Remove /etc/default/knot since the values are now parsed + directly from the configuration file + * Add /var/lib/knot to knot.dirs, so it gets created on package + install + * Drop checking for $VERBOSE variable and properly log start/stop from + sysvinit script + + -- Ondřej Surý <ondrej@debian.org> Tue, 02 Jul 2013 13:08:33 +0200 + +knot (1.3.0~rc3-1) unstable; urgency=low + + * New upstream version 1.3.0~rc3 + * Packaging changes: + + Use --fail-missing to check for all new files + + Remove obsolete patches and update installed conffile with latest + options + + Don't install knot-zcompile as it is no more + + Install minimal example configuration file as /etc/knot/knot.conf + + Add --disable-silent-rules to configure invocation + + Add patch to fix missing $(DESTDIR) in src/Makefile.am + + Set --with-rundir and --with-storage to correct locations + + Run under knot:knot by default (create and delete knot user) + + Add knot-dnsutils and knot-host packages + + Add patch to move knot-{host,dnsutils} manpages to correct location + + Add samples/knot.{full,keys}.conf and example zone to examples. + * Add knot-doc package with generated documentation (PDF and HTML) + + -- Ondřej Surý <ondrej@debian.org> Fri, 28 Jun 2013 12:59:55 +0200 + +knot (1.2.0-2) unstable; urgency=low + + * /etc/init.d/knot now sources /etc/default/knot instead of + /etc/init.d/knotd (Closes: #707683) + * Pull upstream fix for pidfile creation before dropping priviledges + (Closes: #707685) + * Enable SSE2 support again (we will simply not support anything older + than Pentium M) + + -- Ondřej Surý <ondrej@debian.org> Wed, 26 Jun 2013 14:41:04 +0200 + +knot (1.2.0-1) unstable; urgency=low + + * Imported Upstream version 1.2.0 + + Final release. + + Some small memory leaks fixes. + + -- Ondřej Surý <ondrej@debian.org> Wed, 03 Apr 2013 09:16:25 +0200 + +knot (1.2.0~rc4-1) unstable; urgency=low + + * Imported Upstream version 1.2.0~rc4 + + knotc 'zonestatus' command + + Changing logfile ownership before dropping privileges + + knotc respects 'control' section from configuration + + RRL: resolved bucket collisions + + RRL: updated bucket mapping to conform RRL technical memo + + -- Ondřej Surý <ondrej@debian.org> Fri, 22 Mar 2013 15:35:50 +0100 + +knot (1.2.0~rc3-1) unstable; urgency=low + + * Imported Upstream version 1.2.0~rc3 + + New functionality: Response Rate Limiting as a response to + reflection DNS DDoS attacks in the wild + + Add missing RRSIG in ANY queries + + -- Ondřej Surý <ondrej@debian.org> Fri, 01 Mar 2013 13:24:28 +0100 + +knot (1.2~rc2-1) unstable; urgency=low + + * Imported Upstream version 1.2~rc2 + * Fix git location + * Update patches for 1.2 release + + -- Ondřej Surý <ondrej@debian.org> Mon, 18 Feb 2013 12:40:01 +0100 + +knot (1.1.3-1) unstable; urgency=low + + * Imported Upstream version 1.1.3 + + -- Ondřej Surý <ondrej@debian.org> Thu, 20 Dec 2012 10:50:41 +0100 + +knot (1.1.3~rc1-1) unstable; urgency=low + + * Imported Upstream version 1.1.3~rc1 + + Fixed answering DS queries (RRSIGs not together with DS, AA bit + missing). + + Fixed setting ARCOUNT in some error responses with EDNS enabled. + + Fixed crash when compiling zone zone with NSEC3PARAM but no NSEC3 + and semantic checks enabled. + + -- Ondřej Surý <ondrej@debian.org> Fri, 07 Dec 2012 11:19:35 +0100 + +knot (1.1.2-1) unstable; urgency=low + + * Imported Upstream version 1.1.2 + + -- Ondřej Surý <ondrej@debian.org> Wed, 21 Nov 2012 14:45:34 +0100 + +knot (1.1.2~rc1-1) unstable; urgency=low + + * Imported Upstream version 1.1.2~rc1 + * Update patches for new release + + -- Ondřej Surý <ondrej@debian.org> Wed, 14 Nov 2012 14:04:17 +0100 + +knot (1.1.1-1) unstable; urgency=low + + * Imported Upstream version 1.1.1 + * Update and remove obsolete patches for new release + + -- Ondřej Surý <ondrej@debian.org> Wed, 31 Oct 2012 10:42:09 +0100 + +knot (1.1.0-5) unstable; urgency=low + + * Disable SSE2 instruction set, might solve some strange crashes. + + -- Ondřej Surý <ondrej@debian.org> Wed, 10 Oct 2012 13:09:54 +0200 + +knot (1.1.0-4) unstable; urgency=low + + * Disable extra hardening via dpkg-buildflags, which is not needed + by debhelper 9, but breaks builds on squeeze + * Install man5 and knot.info documentation + + -- Ondřej Surý <ondrej@debian.org> Mon, 03 Sep 2012 16:43:26 +0200 + +knot (1.1.0-3) unstable; urgency=low + + * Bump dependency on debhelper >= 9 + * Bump standards version to 3.9.3 + * Fix installation of manpages to correct directories + + -- Ondřej Surý <ondrej@debian.org> Mon, 03 Sep 2012 16:02:11 +0200 + +knot (1.1.0-2) unstable; urgency=low + + * Disable AM_MAINTAINER_MODE and re-run autoreconf -fi + * Enable hardening build by default + * Update pidfile patch to 1.1.0 + * Cope with default MultiArch in dh_compat==9 and don't install + unittests* binaries + + -- Ondřej Surý <ondrej@debian.org> Mon, 03 Sep 2012 15:32:53 +0200 + +knot (1.1.0-1) unstable; urgency=low + + * Imported Upstream version 1.1.0 + - User manual now available. + - Optionally disable ANY queries for authoritative answers. + - Dropping identical records in zone and incoming transfers. + - Support for '/' in zone names. + - Generating journal from reloaded zone (EXPERIMENTAL). + - Outgoing-only interfaces in configuration file. + - Following DNAME if the synthetized name is in the same zone. + - IXFR-in optimized. + - Many zones loading optimized. + - Signing SOA with TSIG queries when checking zone version with master. + * Enable maintainer mode to generate version.texi as a workaround. + + -- Ondřej Surý <ondrej@debian.org> Fri, 31 Aug 2012 16:27:07 +0200 + +knot (1.0.6-1) unstable; urgency=low + + * Imported Upstream version 1.0.6 + - Add NSEC/NSEC3 for all wildcard CNAMEs in the response. + - Fixed potential problems with RCU synchronization. + + -- Ondřej Surý <ondrej@debian.org> Wed, 13 Jun 2012 15:31:52 +0200 + +knot (1.0.5-1) unstable; urgency=low + + * Imported Upstream version 1.0.5 + - Fixed bug with creating journal files which didn't get merged + by accident + + -- Ondřej Surý <ondrej@debian.org> Thu, 17 May 2012 12:25:27 +0200 + +knot (1.0.4-1) unstable; urgency=low + + * Imported Upstream version 1.0.4 + - Speed-up loading of many zones due parallelization + - Support for TLSA resource record (Type 52) + - New commands knotc checkzone and knotc refresh (forced update) + - Fixed responses to CNAME queries if the canonical name was also + an alias + - Fixed crash when NS or MX points to an alias + - Fixed crash when bootstraping/compiling a lot of zones + - Significant speed-up and memory usage reduction of IXFR-in + + -- Ondřej Surý <ondrej@debian.org> Wed, 16 May 2012 09:33:26 +0200 + +knot (1.0.3-1) unstable; urgency=low + + * Imported Upstream version 1.0.3 + - Fixed bug in non-EDNS0 queries over TCP + - Zone compilation time regression fixed + + -- Ondřej Surý <ondrej@debian.org> Wed, 18 Apr 2012 09:06:57 +0200 + +knot (1.0.2-1) unstable; urgency=low + + * Imported Upstream version 1.0.2 + - Bugfix release + + -- Ondřej Surý <ondrej@debian.org> Fri, 13 Apr 2012 16:09:11 +0200 + +knot (1.0.1-1) unstable; urgency=low + + * Imported Upstream version 1.0.1 + - Implemented jitter to REFRESH/RETRY timers + - Fixed problem with creating IXFR journal for bootstrapped zone + - Fixed race condition in processing NOTIFY/SOA queries + - Fixed improper assignment of TSIG algorithm type + + -- Ondřej Surý <ondrej@debian.org> Fri, 09 Mar 2012 20:18:37 +0100 + +knot (1.0.0-1) unstable; urgency=low + + * Imported Upstream version 1.0.0 + * Update pidfile patch + + -- Ondřej Surý <ondrej@debian.org> Wed, 29 Feb 2012 18:46:13 +0100 + +knot (1.0~rc1-1) unstable; urgency=low + + * Imported Upstream version 1.0~rc1 + * Move knotd.pid to /var/run where it belongs + + -- Ondřej Surý <ondrej@debian.org> Wed, 15 Feb 2012 21:12:56 +0100 + +knot (0.9.1-3) unstable; urgency=low + + * Install files into knot package (broken build after added debug + package) + + -- Ondřej Surý <ondrej@debian.org> Mon, 23 Jan 2012 15:01:42 +0100 + +knot (0.9.1-2) unstable; urgency=low + + * Build knot-dbg package with debug symbols + + -- Ondřej Surý <ondrej@debian.org> Mon, 23 Jan 2012 13:27:20 +0100 + +knot (0.9.1-1) unstable; urgency=low + + * Imported Upstream version 0.9.1 + + RRSet rotation functionality added + + New pseudo-random number generator (new BSD licensed) + + Fixed build on BSD + + Fixes in parsing and dumping of some RR types + * Add correct git-buildpackage configuration + * Update copyright for new PRNG + + -- Ondřej Surý <ondrej@debian.org> Sat, 21 Jan 2012 15:47:30 +0100 + +knot (0.9-1) unstable; urgency=low + + * Imported Upstream version 0.9 + + Add TSIG support + + Several smaller bugfixes + * Add correct git-buildpackage configuration + * Imported Upstream version 0.9.1 + * Update copyright for new PRNG + + -- Ondřej Surý <ondrej@debian.org> Sat, 21 Jan 2012 15:46:54 +0100 + +knot (0.8.1-1) unstable; urgency=low + + * Imported Upstream version 0.8.1 + + Correctly handle SPF resource records + + Fix wrong text dumping of unknown records. + + -- Ondřej Surý <ondrej@debian.org> Thu, 01 Dec 2011 16:27:44 +0100 + +knot (0.8-1) unstable; urgency=low + + * Initial release (Closes: #647461) + * Add some dependencies in the init.d script + * Add flex and bison to b-d + * Add versioned dependency on liburcu + * Daemonize on the start + * Update copyright file to include all licenses + + -- Ondřej Surý <ondrej@debian.org> Wed, 16 Nov 2011 07:14:55 +0100 diff --git a/debian/clean b/debian/clean new file mode 100644 index 0000000..7e5c111 --- /dev/null +++ b/debian/clean @@ -0,0 +1 @@ +doc/modules diff --git a/debian/compat b/debian/compat new file mode 100644 index 0000000..b4de394 --- /dev/null +++ b/debian/compat @@ -0,0 +1 @@ +11 diff --git a/debian/control b/debian/control new file mode 100644 index 0000000..3f1bd7f --- /dev/null +++ b/debian/control @@ -0,0 +1,228 @@ +Source: knot +Section: net +Priority: optional +Maintainer: knot packagers <knot@packages.debian.org> +Uploaders: + Ondřej Surý <ondrej@debian.org>, + Daniel Salzman <daniel.salzman@nic.cz>, + Daniel Kahn Gillmor <dkg@fifthhorseman.net>, +Build-Depends-Indep: + ghostscript, + python3-sphinx, + texinfo, + texlive, + texlive-font-utils, + texlive-generic-extra, + texlive-latex-extra, +Build-Depends: + debhelper (>= 11~), + latexmk, + libcap-ng-dev, + libedit-dev, + libfstrm-dev, + libgnutls28-dev, + libidn2-dev, + liblmdb-dev, + libmaxminddb-dev, + libprotobuf-c-dev, + libsofthsm2 <!nocheck>, + libsystemd-dev [linux-any] | libsystemd-daemon-dev [linux-any], + libsystemd-dev [linux-any] | libsystemd-journal-dev [linux-any], + liburcu-dev (>= 0.4), + pkg-config, + protobuf-c-compiler, + python3-yaml <!nocheck>, +Standards-Version: 4.3.0 +Homepage: https://www.knot-dns.cz/ +Vcs-Browser: https://salsa.debian.org/dns-team/knot-dns +Vcs-Git: https://salsa.debian.org/dns-team/knot-dns.git +Rules-Requires-Root: no + +Package: knot +Architecture: any +Depends: + adduser, + libdnssec6 (= ${binary:Version}), + libknot8 (= ${binary:Version}), + libzscanner2 (= ${binary:Version}), + lsb-base (>= 3.0-6), + python3, + python3-yaml, + ${misc:Depends}, + ${shlibs:Depends}, +Recommends: + python3-lmdb, +Suggests: + systemd, +Description: Authoritative domain name server + Knot DNS is a fast, authoritative only, high performance, feature + full and open source name server. + . + Knot DNS is developed by CZ.NIC Labs, the R&D department of .CZ + registry and hence is well suited to run anything from the root + zone, the top-level domain, to many smaller standard domain names. + +Package: libknot8 +Architecture: any +Multi-Arch: same +Depends: + ${misc:Depends}, + ${shlibs:Depends}, +Section: libs +Replaces: + knot-libs (<< 2.0.1-4), + libknot6 (<< 2.6.1-1~), +Breaks: + knot-libs (<< 2.0.1-4), + libknot6 (<< 2.6.1-1~), +Description: Authoritative domain name server (shared library) + Knot DNS is a fast, authoritative only, high performance, feature + full and open source name server. + . + Knot DNS is developed by CZ.NIC Labs, the R&D department of .CZ + registry and hence is well suited to run anything from the root + zone, the top-level domain, to many smaller standard domain names. + . + This package provides libknot shared library used by Knot DNS and + Knot Resolver. + +Package: libzscanner2 +Architecture: any +Multi-Arch: same +Depends: + ${misc:Depends}, + ${shlibs:Depends}, +Section: libs +Replaces: + knot-libs (<< 2.0.1-4), + libzscanner0 (<< 2.3.0~), +Breaks: + knot-libs (<< 2.0.1-4), + libzscanner0 (<< 2.3.0~), +Description: DNS zone-parsing library from Knot + Knot DNS is a fast, authoritative only, high performance, feature + full and open source name server. + . + Knot DNS is developed by CZ.NIC Labs, the R&D department of .CZ + registry and hence is well suited to run anything from the root + zone, the top-level domain, to many smaller standard domain names. + . + This package provides a fast zone parser shared library used by Knot + DNS and Knot Resolver. + +Package: libdnssec6 +Architecture: any +Multi-Arch: same +Depends: + ${misc:Depends}, + ${shlibs:Depends}, +Section: libs +Replaces: + knot-libs (<< 2.0.1-4), + libdnssec4 (<< 2.6.1-1~), +Breaks: + knot-libs (<< 2.0.1-4), + libdnssec4 (<< 2.6.1-1~), +Description: DNSSEC shared library from Knot + Knot DNS is a fast, authoritative only, high performance, feature + full and open source name server. + . + Knot DNS is developed by CZ.NIC Labs, the R&D department of .CZ + registry and hence is well suited to run anything from the root + zone, the top-level domain, to many smaller standard domain names. + . + This package provides common DNSSEC shared library used by Knot DNS + and Knot Resolver. + +Package: libknot-dev +Architecture: any +Multi-Arch: same +Depends: + libdnssec6 (= ${binary:Version}), + libgnutls28-dev, + libknot8 (= ${binary:Version}), + libzscanner2 (= ${binary:Version}), + ${misc:Depends}, + ${shlibs:Depends}, +Section: libdevel +Replaces: + knot-libs (<< 2.0.1-4), +Breaks: + knot-libs (<< 2.0.1-4), +Description: Knot DNS shared library development files + Knot DNS is a fast, authoritative only, high performance, feature + full and open source name server. + . + Knot DNS is developed by CZ.NIC Labs, the R&D department of .CZ + registry and hence is well suited to run anything from the root + zone, the top-level domain, to many smaller standard domain names. + . + This package provides development files for internal common shared + libraries. + +Package: knot-dnsutils +Architecture: any +Depends: + libdnssec6 (= ${binary:Version}), + libknot8 (= ${binary:Version}), + libzscanner2 (= ${binary:Version}), + ${misc:Depends}, + ${shlibs:Depends}, +Description: Clients provided with Knot DNS (kdig, knslookup, knsupdate) + Knot DNS is a fast, authoritative only, high performance, feature + full and open source name server. + . + Knot DNS is developed by CZ.NIC Labs, the R&D department of .CZ + registry and hence is well suited to run anything from the root + zone, the top-level domain, to many smaller standard domain names. + . + This package delivers various client programs related to DNS that are + derived from the Knot DNS source tree. + . + - kdig - query the DNS in various ways + - knsupdate - perform dynamic updates (See RFC2136) + . + Those clients were designed to be 1:1 compatible with BIND dnsutils, + but they provide some enhancements, which are documented in respective + manpages. + . + WARNING: knslookup is not provided as it is considered obsolete. + +Package: knot-host +Architecture: any +Depends: + libdnssec6 (= ${binary:Version}), + libknot8 (= ${binary:Version}), + libzscanner2 (= ${binary:Version}), + ${misc:Depends}, + ${shlibs:Depends}, +Description: Version of 'host' bundled with Knot DNS + Knot DNS is a fast, authoritative only, high performance, feature + full and open source name server. + . + Knot DNS is developed by CZ.NIC Labs, the R&D department of .CZ + registry and hence is well suited to run anything from the root + zone, the top-level domain, to many smaller standard domain names. + . + This package provides the 'host' program in the form that is bundled + with the Knot DNS. The 'host' command is designed to be 1:1 + compatible with BIND 9.x 'host' program. + +Package: knot-doc +Architecture: all +Multi-Arch: foreign +Depends: + libjs-jquery, + libjs-underscore, + ${misc:Depends}, +Section: doc +Description: Documentation for Knot DNS + Knot DNS is a fast, authoritative only, high performance, feature + full and open source name server. + . + Knot DNS is developed by CZ.NIC Labs, the R&D department of .CZ + registry and hence is well suited to run anything from the root + zone, the top-level domain, to many smaller standard domain names. + . + This package provides various documents that are useful for + maintaining a working Knot DNS installation. diff --git a/debian/copyright b/debian/copyright new file mode 100644 index 0000000..f96f58e --- /dev/null +++ b/debian/copyright @@ -0,0 +1,83 @@ +Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/ +Upstream-Name: Knot DNS +Upstream-Contact: knot-dns@labs.nic.cz +Source: https://secure.nic.cz/files/knot-dns/ + +Files: * +Copyright: 2011-2012 CZ.NIC, z.s.p.o. +License: GPL-3+ with OpenSSL exception + This program is free software: you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation, either version 3 of the License, or + (at your option) any later version. + . + In addition, as a special exception, the author of this program gives + permission to link the code of its release with the OpenSSL project's + "OpenSSL" library (or with modified versions of it that use the same + license as the "OpenSSL" library), and distribute the linked + executables. You must obey the GNU General Public License in all + respects for all of the code used other than "OpenSSL". If you + modify this file, you may extend this exception to your version of + the file, but you are not obligated to do so. If you do not wish to + do so, delete this exception statement from your version. + . + This program is distributed in the hope that it will be useful, but + WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + General Public License for more details. + . + You should have received a copy of the GNU General Public License + along with this program. If not, see <https://www.gnu.org/licenses/>. + . + On Debian systems, the full text of the GNU General Public License + version 3 can be found in the file `/usr/share/common-licenses/GPL-3'. + +Files: tests/tap/* +Copyright: 2000-2001, 2004, 2006-2011 Russ Allbery <rra@stanford.edu> +License: Expat + +Files: src/contrib/ucw/lists.c +Copyright: 1998 Martin Mares <mj@ucw.cz> +License: GPL-3+ + +Files: debian/* +Copyright: 2011 Ondřej Surý <ondrej@debian.org> +License: GPL-3+ + +License: Expat + Permission is hereby granted, free of charge, to any person obtaining + a copy of this software and associated documentation files (the + "Software"), to deal in the Software without restriction, including + without limitation the rights to use, copy, modify, merge, publish, + distribute, sublicense, and/or sell copies of the Software, and to + permit persons to whom the Software is furnished to do so, subject to + the following conditions: + . + The above copyright notice and this permission notice shall be + included in all copies or substantial portions of the Software. + . + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, + EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF + MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND + NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS + BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN + ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN + CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE + SOFTWARE. + +License: GPL-3+ + This program is free software: you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation, either version 3 of the License, or + (at your option) any later version. + . + This program is distributed in the hope that it will be useful, but + WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + General Public License for more details. + . + You should have received a copy of the GNU General Public License + along with this program. If not, see <https://www.gnu.org/licenses/>. + . + On Debian systems, the full text of the GNU General Public License + version 3 can be found in the file `/usr/share/common-licenses/GPL-3'. diff --git a/debian/docs b/debian/docs new file mode 100644 index 0000000..e845566 --- /dev/null +++ b/debian/docs @@ -0,0 +1 @@ +README diff --git a/debian/gbp.conf b/debian/gbp.conf new file mode 100644 index 0000000..71bf28a --- /dev/null +++ b/debian/gbp.conf @@ -0,0 +1,28 @@ +[DEFAULT] +debian-branch = debian/master +pristine-tar = True +upstream-vcs-tag = v%(version)s + +[dch] +meta = 1 + +[import-orig] +filter = [ + 'configure', + '*/Makefile.in', + '*/*/Makefile.in', + '*/*/*/Makefile.in', + 'install-sh', + 'ltmain.sh', + 'm4/libtool.m4', + '*/*/version.h', + 'src/dnssec/lib/dnssec/version.h', + 'INSTALL', + 'aclocal.m4', + 'ar-lib', + 'depcomp', + 'compile', + 'missing', + 'test-driver', + ] +filter-pristine-tar = False diff --git a/debian/get_kaspdb b/debian/get_kaspdb new file mode 100755 index 0000000..5562c1d --- /dev/null +++ b/debian/get_kaspdb @@ -0,0 +1,59 @@ +#!/usr/bin/python3 + +import yaml, os.path, sys + +conf_file = '/etc/knot/knot.conf' if len(sys.argv) < 2 else sys.argv[1] +ip_fields = ['listen', 'address', 'via', 'whitelist', 'network'] + +try: + conf = yaml.load(open(conf_file, 'r')) +except (yaml.scanner.ScannerError, yaml.parser.ParserError): + conf = False + +if not conf: + import io + conf_io = io.StringIO() + with open(conf_file) as f: + for line in f: + if line.split(':')[0].strip() not in ip_fields: + conf_io.write(line) + conf_io.seek(0) + try: + conf = yaml.load(conf_io) + except (yaml.scanner.ScannerError, yaml.parser.ParserError): + sys.exit(1) + +dirs = set() +# if we have valid yaml use it +if "template" in conf and conf["template"]: + + for template in conf["template"]: + if "kasp-db" in template: + kasp_db = template["kasp-db"] + else: + continue + + if not os.path.isabs(kasp_db): + if "storage" in template: + kasp_db = os.path.join(template["storage"], kasp_db) + else: + continue + dirs.add(kasp_db) + +if "zone" in conf and conf["zone"]: + + for domain in conf["zone"]: + if "kasp-db" in domain: + kasp_db = domain["kasp-db"] + else: + continue + + if not os.path.isabs(kasp_db): + if "storage" in kaspdomain: + kasp_db = os.path.join(domain["storage"], kasp_db) + else: + continue + dirs.add(kasp_db) + +for dir in dirs: + print(dir) diff --git a/debian/get_user b/debian/get_user new file mode 100755 index 0000000..1e0f258 --- /dev/null +++ b/debian/get_user @@ -0,0 +1,28 @@ +#!/usr/bin/python3 + +import yaml, sys + +conf_file = '/etc/knot/knot.conf' if len(sys.argv) < 2 else sys.argv[1] +ip_fields = ['listen', 'address', 'via', 'whitelist', 'network'] + +try: + conf = yaml.load(open(conf_file, 'r')) +except (yaml.scanner.ScannerError, yaml.parser.ParserError): + conf = False + +if not conf: + import io + conf_io = io.StringIO() + with open(conf_file) as f: + for line in f: + if line.split(':')[0].strip() not in ip_fields: + conf_io.write(line) + conf_io.seek(0) + try: + conf = yaml.load(conf_io) + except (yaml.scanner.ScannerError, yaml.parser.ParserError): + sys.exit(1) + +if "server" in conf and conf["server"]: + if "user" in conf["server"] and conf["server"]["user"]: + print(conf["server"]["user"].split(":")[0].split(".")[0]) diff --git a/debian/kasp_json2lmdb b/debian/kasp_json2lmdb new file mode 100755 index 0000000..f6aa785 --- /dev/null +++ b/debian/kasp_json2lmdb @@ -0,0 +1,458 @@ +#!/usr/bin/env python3 +# vim: et ts=4 sw=4 sts=4 +# +# import from obsolete JSON KASP to LMDB-beckended KASP database. +# + +from __future__ import print_function + +import datetime +import time +import json +import sys +import re +import glob +import argparse +import time +import traceback +import os +import hashlib +import importlib +import codecs + +opt_force = False +lmdb = None + +def lmdb_requirement(): + global lmdb + + try: + lmdb = importlib.import_module('lmdb') + except ImportError: + print("Error: unable to import module LMDB.") + print("Probably you need to 'apt install python3-lmdb'.") + sys.exit(10) + +# workarounding that python 2 doesn't have int.to_bytes() +def to_bytes(n, length, endianness='big'): + h = '%x' % n + assert len(h) <= length * 2 + s = ('0'*(len(h) % 2) + h).zfill(length * 2) + if sys.version_info >= (3,0): + sb = codecs.decode(s, 'hex') + else: + sb = s.decode('hex') + return bytearray(sb) if endianness == 'big' else bytearray(sb[::-1]) + +def from_bytes(ba, endianness='big'): + x = ba if endianness == 'big' else bytearray(s[::-1]) + if sys.version_info >= (3,0): + hx = codecs.encode(x, 'hex') + else: + hx = str(x).encode('hex') + return int(hx, 16) + +# aka knot_dname_from_str_alloc() +def str2dname(s): + if s.endswith('.') is False: + s += '.' + res = bytearray(b"") + nodes = s.lower().split('.') + if nodes[-1] != "": + nodes.append("") + + for node in nodes: + res.append(len(node)) + res.extend(bytearray(node.lower(), 'ascii')) + + return res + +def dname2str(dn): + res = "" + beg = 0 + end = ord(dn[0]) + 1 + while ord(dn[beg]) > 0: + res += str(dn[beg+1:end]) + "." + beg = end + end = beg + ord(dn[beg]) + 1 + + return res + +# this is just helper for shuffling time +def shuffle_unixtime(base_time, shuffle_years, shuffle_months): + rsm = shuffle_months + 12 * shuffle_years + dt = datetime.datetime.fromtimestamp(base_time) + newmonth = (dt.month - 1 + rsm) % 12 + 1 # in python, % always returns [0, 11] + sameyear = dt.month + rsm % 12 + newyear = dt.year + rsm // 12 + (0 if sameyear in range(1, 13) else 1) # in python, (-1)//12 = -1 + dt2 = dt.replace(month=newmonth, year=newyear) + print(dt2.month, "/", dt2.year) + ttuple = dt2.timetuple() + return int(time.mktime(ttuple)) + +def timespec2unix(spec): + if re.match(r"^\d+$", spec): + return int(spec) + + now = int(time.time()) + s = re.sub(r"^now", "t", spec) + if s == "t": + return now + + unitmap = { "" : 1, "mi" : 60, "h" : 3600, "d" : 86400 } + unitmap_mo = { "mo" : 1, "y" : 12 } + + if re.match(r"^t[-+]\d+", s): + unit = re.sub(r"^t[-+]\d+", "", s) + cutend = len(s) if unit == "" else -len(unit) + if unit in list(unitmap.keys()): + return now + int(s[1:cutend]) * unitmap[unit] + elif unit in list(unitmap_mo.keys()): + return shuffle_unixtime(now, 0, int(s[1:cutend]) * unitmap_mo[unit]) + else: + print("Error in time unit specification") + + print("Error in time specification") + +class Keykey: + '''Kasp DB key serialized (type, zone_name, key_id)''' + + def __init__(self, raw_bytearray): + self.raw = bytearray(raw_bytearray) + + @classmethod + def from_params(self, valtype, zone_name, key_id): + selfraw = to_bytes(valtype, 1) + if zone_name is not None: + selfraw.extend(zone_name) + if key_id is not None: + selfraw.extend(bytearray(key_id.encode("ascii"))) + selfraw.append(0) + return Keykey(selfraw) + + def getRaw(self): + return bytearray(self.raw) + + def getType(self): + return self.raw[0] + + def __getSplit(self): + x = self.raw.find(to_bytes(0, 1)) + assert x > 0 + return x + 1 + + def getZone(self): + if self.getType() == 2: + return None + return str(self.raw[1:self.__getSplit()]) + + def getKeyid(self): + if self.getType() != 1: + return None + return str(self.raw[self.__getSplit():]) + +class Keyparams: + '''Serialized key parameters for kasp-db.''' + + def __init__(self, raw_bytearray): + self.raw = bytearray(raw_bytearray) + self.timers_dict = { "created" : [ 0, 20, 28 ], + "publish" : [ 1, 28, 36 ], + "ready" : [ 2, 36, 44 ], + "active" : [ 3, 44, 52 ], + "retire" : [ 4, 52, 60 ], + "remove" : [ 5, 60, 68 ] } + + @classmethod + def from_params(self, pubkey, keytag, algorithm, isksk, timers): + assert len(timers) == 6 + if sys.version_info >= (3,0): + pk = codecs.decode(bytearray(pubkey, 'ascii'), "base64") + else: + pk = pubkey.decode("base64") + selfraw = to_bytes(len(pk), 8) + selfraw.extend(to_bytes(0, 8)) # zero length of unused-future + selfraw.extend(to_bytes(int(keytag), 2)) + selfraw.extend(to_bytes(int(algorithm), 1)) + selfraw.extend(to_bytes((1 if isksk else 0), 1)) + for t in timers: + if t < 0: + print("keytag=%i timers=(%i, %i, %i, %i, %i, %i)" % (keytag, + timers[0], timers[1], timers[2], timers[3], timers[4], timers[5])) + assert False + selfraw.extend(to_bytes(t, 8)) + selfraw.extend(pk) + return Keyparams(selfraw) + + def _check(self): + assert len(self.raw) >= 16 + pkl = from_bytes(self.raw[0:8]) + ufl = from_bytes(self.raw[8:16]) + assert len(self.raw) == 68 + pkl + ufl + assert self.raw[19] < 2 + + def getRaw(self): + self._check() + return bytearray(self.raw) + + def getAlgorithm(self): + self._check() + return int(self.raw[18]) + + def setAlgorithm(self, algorithm): + self._check() + self.raw[18] = to_bytes(algorithm, 1)[0] + + def isKSK(self): + self._check() + return 1 if self.raw[19] != 0 else 0 + + def setKSK(self, isksk): + self._check() + self.raw[11] = (b"\01" if isksk else b"\00")[0] + + def getKeytag(self): + self._check() + return from_bytes(self.raw[16:18]) + + def setKeytag(self, keytag): + self._check() + self.raw[16:18] = to_bytes(keytag, 2) + + def getTimers(self): + self._check() + res = [ 0, 0, 0, 0, 0, 0 ] + for i, x, y in list(self.timers_dict.values()): + res[i] = from_bytes(self.raw[x:y]) + return res + + def getTimersString(self): + self._check() + res = "[" + for ti in list(self.timers_dict.keys()): + _, x, y = self.timers_dict[ti]; + res += (" " if res == "[" else ", ") + ti + ": " + str(from_bytes(self.raw[x:y])) + return res + " ]" + + def setTimers(self, timers): + self._check() + assert len(timers) == 5 + for i, x, y in list(self.timers_dict.values()): + self.raw[x:y] = to_bytes(timers[i], 8) + + def getPubKey(self): + self._check() + pkl = from_bytes(self.raw[0:8]) + return self.raw[68:68+pkl].encode("base64") + + def getParams(self): + return [ self.getPubKey(), self.getKeytag(), self.getAlgorithm(), + self.isKSK(), self.getTimers() ]; + + def setByParamName(self, param_name, new_val): + if param_name == "algorithm": + self.setAlgorithm(int(new_val)) + elif param_name == "isksk": + if new_val in ("1", "True", "true", "on", "yes", "Yes"): + self.setKSK(True) + elif new_val in ("0", "False", "false", "off", "no", "No"): + self.setKSK(False) + else: + print("Error: bad true/false value", new_val) + elif param_name == "keytag": + self.setKeytag(int(new_val)) + elif param_name in list(self.timers_dict.keys()): + _, x, y = self.timers_dict[param_name] + self.raw[x:y] = to_bytes(timespec2unix(new_val), 8) + else: + print("Error: bad parameter", param_name) + + def computeDS(self, zone_str, digestalg): + ds_raw = bytearray(str2dname(zone_str)) + ds_raw.extend(to_bytes(257 if self.isKSK() else 256, 2)) + ds_raw.extend(b"\x03") # protocol is always == 3 + ds_raw.extend(self.raw[18:19]) # algorithm + pkl = from_bytes(self.raw[0:8]) + ds_raw.extend(self.raw[68:68+pkl]) # pubkey + if digestalg == "sha1": + ds_hash = hashlib.sha1(ds_raw).hexdigest() + algno = " 1 " + elif digestalg == "sha256": + ds_hash = hashlib.sha256(ds_raw).hexdigest() + algno = " 2 " + elif digestalg == "sha384": + ds_hash = hashlib.sha384(ds_raw).hexdigest() + algno = " 4 " + else: + print("Error: bad DS digest algorith", ds_hash) + return + return zone_str + ' DS ' + str(self.getKeytag()) + ' ' + str(self.getAlgorithm()) + algno + ds_hash + + def isPublished(self, moment): + tmrs = self.getTimers() + if tmrs[self.timers_dict["publish"][0]] <= moment: + if moment < tmrs[self.timers_dict["remove"][0]]: + return True + return False + + def isReady(self, moment): + tmrs = self.getTimers() + if tmrs[self.timers_dict["ready"][0]] <= moment: + if moment < tmrs[self.timers_dict["ready"][0]]: + return True + return False + + def isActive(self, moment): + tmrs = self.getTimers() + if tmrs[self.timers_dict["active"][0]] <= moment: + if moment < tmrs[self.timers_dict["retire"][0]]: + return True + return False + + def isRetired(self, moment): + tmrs = self.getTimers() + if tmrs[self.timers_dict["retire"][0]] <= moment: + return True + return False + + def isRemoved(self, moment): + tmrs = self.getTimers() + if tmrs[self.timers_dict["remove"][0]] <= moment: + return True + return False + +# static: just for use in following method +def arr_ind2unix(arr, ind, defaul): + try: + ttuple = datetime.datetime.strptime(arr[ind], "%Y-%m-%dT%H:%M:%S+0000").timetuple() + res = int(time.mktime(ttuple)) + return res if res >= 0 else 0 + except KeyError: + return defaul + +def import_nsec3salt(keys, env, db_keys, zname): + try: + with lmdb.Transaction(env, db_keys, write=True) as txn_keys: + dbk1 = Keykey.from_params(3, zname, None).getRaw() + dbv1 = keys["nsec3_salt"] + if dbv1 is None: + return + if sys.version_info >= (3,0): + dbv1d = codecs.decode(bytearray(dbv1, 'ascii'), "base64") + else: + dbv1d = dbv1.decode("base64") + txn_keys.put(dbk1, dbv1d, dupdata=False, overwrite=True) + + dbk2 = Keykey.from_params(4, zname, None).getRaw() + dbv2 = to_bytes(arr_ind2unix(keys, "nsec3_salt_created", 0), 8) + txn_keys.put(dbk2, dbv2, dupdata=False, overwrite=True) + except (KeyError, AttributeError): + pass # nsec3salt not configured or set to null, no problem + +# import single JSON zone config into open LMDB env +def import_file(fname, env, db_keys): + try: + with open(fname) as f: + keys = json.load(f) + + except ValueError: + print("Warning: not imported ", fname) + return False + + try: + zname_str = re.sub(r'^zone_', '', re.sub(r'\.json$', '', re.sub(r'.*/', '', fname))) + print("Importing zone", zname_str) + zname = str2dname(zname_str) + import_nsec3salt(keys, env, db_keys, zname) + + import_now = int(time.time()) + + for key in keys["keys"]: + dbk3 = Keykey.from_params(1, zname, key["id"]).getRaw() + + infty = 0x00ffffffffffff00 # time infinity, this is year 142'715'360 + + dbv3 = Keyparams.from_params(key["public_key"], key["keytag"], + key["algorithm"], key["ksk"], [ + arr_ind2unix(key, "created", 0), + arr_ind2unix(key, "publish", 0), + arr_ind2unix(key, "active", 0), # taking active for ready + arr_ind2unix(key, "active", 0), + arr_ind2unix(key, "retire", infty), + arr_ind2unix(key, "remove", infty) + ]) + + if dbv3.isRemoved(import_now): + continue + + with lmdb.Transaction(env, db_keys, write=True) as txn_keys: + txn_keys.put(dbk3, dbv3.getRaw(), dupdata=False, overwrite=True) + + except (KeyError, KeyboardInterrupt, TypeError): + print("Warning: not imported ", fname) + return False + + return True + +def import_dir(dirname): + print("Importing json key config in", dirname) + if os.path.isfile(dirname + "/data.mdb"): + print("Warning: LMDB key configuration in", dirname, "already exists.") + if opt_force: + print("...deleting it.") + os.remove(dirname + "/data.mdb") + os.remove(dirname + "/lock.mdb") + else: + print("If you want to delete it and import again, use 'force' option.") + return False + + env = lmdb.open(dirname, max_dbs=2, map_size=500*1024*1024) + db_keys = env.open_db(b"keys_db") + something_imported = False + for json_file in glob.glob(dirname + "/*.json"): + something_imported = import_file(json_file, env, db_keys) or something_imported + + if not something_imported: + print("Warning: nothing imported in", dirname) + +class VersionAction(argparse.Action): + def __init__(self, option_strings, version=None, dest=argparse.SUPPRESS, + default=argparse.SUPPRESS, help="show program's version number and exit"): + super(VersionAction, self).__init__(option_strings=option_strings, dest=dest, + default=default, nargs=0, help=help) + self.version = version + + def __call__(self, parser, namespace, values, option_string=None): + version = self.version + if version is None: + version = parser.version + formatter = parser._get_formatter() + formatter.add_text(version) + sys.stdout.write(formatter.format_help()) + sys.exit(0) + +def main(): + global opt_force + parser = argparse.ArgumentParser(description="Knot DNSSEC KASP converter (JSON to LMDB)", + formatter_class=argparse.RawTextHelpFormatter) + parser.add_argument("-i", "--import", action="append", nargs="?", dest="importdir", + help='''Import zone-key configuration from JSON. +Syntax: -i <key_dir> +(You can import multiple key_dirs at once by repeating this option.)''') + parser.add_argument("-f", "--force", action="store_true", dest="force", help="Do stuff even if dangerous.") + parser.add_argument("-V", "--version", action=VersionAction, version="knot KASP legacy JSON importer (debian support for Knot DNS), version 2.7.1") + args = parser.parse_args() + opt_force = args.force + + if args.importdir is not None: + lmdb_requirement() + if isinstance(args.importdir, (list, tuple)): + importdir = args.importdir + else: + importdir = [args.importdir] + + for dirn in importdir: + import_dir(dirn) + +if __name__ == "__main__": + main() diff --git a/debian/knot-dnsutils.NEWS b/debian/knot-dnsutils.NEWS new file mode 100644 index 0000000..20045dc --- /dev/null +++ b/debian/knot-dnsutils.NEWS @@ -0,0 +1,6 @@ +knot (2.5.4-2) unstable; urgency=medium + + The compatibility links with dig and nsupdate has been dropped + in favour of coinstallability with dnsutils (from BIND9). + + -- Ondřej Surý <ondrej@debian.org> Mon, 18 Sep 2017 07:07:49 +0200 diff --git a/debian/knot-dnsutils.install b/debian/knot-dnsutils.install new file mode 100644 index 0000000..960fa92 --- /dev/null +++ b/debian/knot-dnsutils.install @@ -0,0 +1,2 @@ +usr/bin/kdig +usr/bin/knsupdate diff --git a/debian/knot-dnsutils.manpages b/debian/knot-dnsutils.manpages new file mode 100644 index 0000000..3cc29ec --- /dev/null +++ b/debian/knot-dnsutils.manpages @@ -0,0 +1,2 @@ +usr/share/man/man1/kdig.1 +usr/share/man/man1/knsupdate.1 diff --git a/debian/knot-doc.doc-base b/debian/knot-doc.doc-base new file mode 100644 index 0000000..c137e28 --- /dev/null +++ b/debian/knot-doc.doc-base @@ -0,0 +1,20 @@ +Document: knot +Title: Documentation for the Knot authoritative DNS server +Author: Knot DNS authors at CZ.NIC Labs (https://www.knot-dns.cz) +Abstract: Knot DNS is a high-performance open-source authoritative DNS server +Section: Network/Communication + +Format: HTML +Index: /usr/share/doc/knot-doc/index.html +Files: /usr/share/doc/knot-doc + +Format: PDF +Files: /usr/share/doc/knot-doc/knot.pdf.gz + +Format: Info +Files: /usr/share/info/knot.info.gz +Index: /usr/share/info/knot.info.gz + +Format: Text +Index: /usr/share/doc/knot-doc/_sources/index.rst.txt +Files: /usr/share/doc/knot-doc/_sources/ diff --git a/debian/knot-doc.install b/debian/knot-doc.install new file mode 100644 index 0000000..c19da52 --- /dev/null +++ b/debian/knot-doc.install @@ -0,0 +1,2 @@ +usr/share/doc/knot/* /usr/share/doc/knot-doc/ +usr/share/info diff --git a/debian/knot-doc.links b/debian/knot-doc.links new file mode 100644 index 0000000..3949022 --- /dev/null +++ b/debian/knot-doc.links @@ -0,0 +1,2 @@ +usr/share/javascript/jquery/jquery.min.js usr/share/doc/knot-doc/_static/jquery.js +usr/share/javascript/underscore/underscore.min.js usr/share/doc/knot-doc/_static/underscore.js diff --git a/debian/knot-host.NEWS b/debian/knot-host.NEWS new file mode 100644 index 0000000..20045dc --- /dev/null +++ b/debian/knot-host.NEWS @@ -0,0 +1,6 @@ +knot (2.5.4-2) unstable; urgency=medium + + The compatibility links with dig and nsupdate has been dropped + in favour of coinstallability with dnsutils (from BIND9). + + -- Ondřej Surý <ondrej@debian.org> Mon, 18 Sep 2017 07:07:49 +0200 diff --git a/debian/knot-host.install b/debian/knot-host.install new file mode 100644 index 0000000..51bacf0 --- /dev/null +++ b/debian/knot-host.install @@ -0,0 +1 @@ +usr/bin/khost diff --git a/debian/knot-host.manpages b/debian/knot-host.manpages new file mode 100644 index 0000000..4891e2c --- /dev/null +++ b/debian/knot-host.manpages @@ -0,0 +1 @@ +usr/share/man/man1/khost.1 diff --git a/debian/knot.NEWS b/debian/knot.NEWS new file mode 100644 index 0000000..fa22ec4 --- /dev/null +++ b/debian/knot.NEWS @@ -0,0 +1,12 @@ +knot (2.0.0-1) unstable; urgency=medium + + The configuration file format has changed with Knot DNS 2.0 release. + The knot1to2 conversion tools has been provided for your convenience + and the package will automatically save the existing configuration + file to /var/backups/knot/<TIMESTAMP> directory and convert the + configuration file into the new format. The Knot DNS team worked + hard to make this transition as smooth as possible, but you are + strongly advised to check the results if everything went as + expected. + + -- Ondřej Surý <ondrej@debian.org> Mon, 29 Jun 2015 10:36:08 +0200 diff --git a/debian/knot.default b/debian/knot.default new file mode 100644 index 0000000..12d6cc5 --- /dev/null +++ b/debian/knot.default @@ -0,0 +1 @@ +KNOTD_ARGS="" diff --git a/debian/knot.dirs b/debian/knot.dirs new file mode 100644 index 0000000..6e937aa --- /dev/null +++ b/debian/knot.dirs @@ -0,0 +1 @@ +var/lib/knot diff --git a/debian/knot.init b/debian/knot.init new file mode 100644 index 0000000..ec6e3f5 --- /dev/null +++ b/debian/knot.init @@ -0,0 +1,168 @@ +#!/bin/sh +### BEGIN INIT INFO +# Provides: knot +# Required-Start: $network $local_fs $remote_fs $syslog +# Required-Stop: $remote_fs $syslog +# Default-Start: 2 3 4 5 +# Default-Stop: 0 1 6 +# Short-Description: authoritative domain name server +# Description: Knot DNS is a authoritative-only domain name server +### END INIT INFO + +# Author: Ondřej Surý <ondrej@debian.org> + +# PATH should only include /usr/* if it runs after the mountnfs.sh script +PATH=/sbin:/usr/sbin:/bin:/usr/bin +DESC="Knot DNS server" # Introduce a short description here +NAME=knotd # Introduce the short server's name here +DAEMON=/usr/sbin/$NAME # Introduce the server's location here +PIDFILE=/run/knot/knot.pid +SCRIPTNAME=/etc/init.d/knot +KNOTC=/usr/sbin/knotc + +# Exit if the package is not installed +[ -x $DAEMON ] || exit 0 + +KNOTD_ARGS="-c /etc/knot/knot.conf" + +# Read configuration variable file if it is present +[ -r /etc/default/knot ] && . /etc/default/knot + +DAEMON_ARGS="-d $KNOTD_ARGS" + +# Define LSB log_* functions. +# Depend on lsb-base (>= 3.0-6) to ensure that this file is present. +. /lib/lsb/init-functions + +# +# Function that starts the daemon/service +# +do_start() +{ + # Return + # 0 if daemon has been started + # 1 if daemon was already running + # 2 if daemon could not be started + + $KNOTC status >/dev/null 2>/dev/null \ + && return 1 + + start-stop-daemon --start --quiet --pidfile $PIDFILE --exec $DAEMON --test > /dev/null \ + || return 1 + start-stop-daemon --start --quiet --pidfile $PIDFILE --exec $DAEMON -- \ + $DAEMON_ARGS \ + || return 2 +} + +# +# Function that stops the daemon/service +# +do_stop() +{ + # Return + # 0 if daemon has been stopped + # 1 if daemon was already stopped + # 2 if daemon could not be stopped + # other if a failure occurred + + $KNOTC status >/dev/null 2>/dev/null \ + || return 1 + + $KNOTC stop >/dev/null + RETVAL="$?" + [ $? = 1 ] && return 2 + + # Many daemons don't delete their pidfiles when they exit. + rm -f $PIDFILE + return 0 +} + +do_reload() { + $KNOTC reload >/dev/null + return $? +} + +do_tmpfiles() { + local type path mode user group age argument + if [ -r "$1" ]; then + if [ -x /bin/systemd-tmpfiles ]; then + /bin/systemd-tmpfiles --create "$1" + else + while read type path mode user group age argument; do + case "$type" in + d) + mkdir -p "$path"; + chmod "$mode" "$path"; + chown "$user:$group" "$path"; + ;; + \#*) + ;; + *) + log_warning_msg "tmpfile.d type '$type' is not supported yet" + ;; + esac + done < "$1" + fi + else + log_warning_msg "tmpfiles.d file '$1' doesn't exist or is not readable" + fi +} + +case "$1" in + start) + do_tmpfiles /usr/lib/tmpfiles.d/knot.conf + log_daemon_msg "Starting $DESC " "$NAME" + do_start + case "$?" in + 0|1) log_end_msg 0 ;; + 2) log_end_msg 1 ;; + esac + ;; + stop) + log_daemon_msg "Stopping $DESC" "$NAME" + do_stop + case "$?" in + 0|1) log_end_msg 0 ;; + 2) log_end_msg 1 ;; + esac + ;; + status) + STATUS=$($KNOTC status 2>&1 >/dev/null) + RETVAL=$? + if [ $RETVAL = 0 ]; then + log_success_msg "$NAME is running" + else + log_failure_msg "$NAME is not running ($STATUS)" + fi + exit $RETVAL + ;; + reload|force-reload) + log_daemon_msg "Reloading $DESC" "$NAME" + do_reload + log_end_msg $? + ;; + restart) + log_daemon_msg "Restarting $DESC" "$NAME" + do_stop + case "$?" in + 0|1) + do_start + case "$?" in + 0) log_end_msg 0 ;; + 1) log_end_msg 1 ;; # Old process is still running + *) log_end_msg 1 ;; # Failed to start + esac + ;; + *) + # Failed to stop + log_end_msg 1 + ;; + esac + ;; + *) + echo "Usage: $SCRIPTNAME {start|stop|status|restart|reload|force-reload}" >&2 + exit 3 + ;; +esac + +: diff --git a/debian/knot.install b/debian/knot.install new file mode 100644 index 0000000..57c6815 --- /dev/null +++ b/debian/knot.install @@ -0,0 +1,11 @@ +debian/get_kaspdb usr/lib/knot/ +debian/get_user usr/lib/knot/ +debian/kasp_json2lmdb usr/lib/knot/ +debian/ufw/knot etc/ufw/applications.d/ +etc/knot/knot.conf +usr/bin/knsec3hash +usr/bin/kzonecheck +usr/sbin/keymgr +usr/sbin/kjournalprint +usr/sbin/knotc +usr/sbin/knotd diff --git a/debian/knot.lintian-overrides b/debian/knot.lintian-overrides new file mode 100644 index 0000000..5ac0537 --- /dev/null +++ b/debian/knot.lintian-overrides @@ -0,0 +1,5 @@ +# knot currently requires that the MODULE_DIR exists, even if it +# is empty: +# https://gitlab.labs.nic.cz/knot/knot-dns/issues/567 +# https://bugs.debian.org/891319 +knot: package-contains-empty-directory usr/lib/*/knot/ diff --git a/debian/knot.maintscript b/debian/knot.maintscript new file mode 100644 index 0000000..42bc330 --- /dev/null +++ b/debian/knot.maintscript @@ -0,0 +1 @@ +rm_conffile /etc/init/knot.conf 2.0.0-1~ diff --git a/debian/knot.manpages b/debian/knot.manpages new file mode 100644 index 0000000..bb40303 --- /dev/null +++ b/debian/knot.manpages @@ -0,0 +1,7 @@ +usr/share/man/man1/knsec3hash.1 +usr/share/man/man1/kzonecheck.1 +usr/share/man/man5/knot.conf.5 +usr/share/man/man8/keymgr.8 +usr/share/man/man8/kjournalprint.8 +usr/share/man/man8/knotc.8 +usr/share/man/man8/knotd.8 diff --git a/debian/knot.postinst b/debian/knot.postinst new file mode 100644 index 0000000..7a69d85 --- /dev/null +++ b/debian/knot.postinst @@ -0,0 +1,26 @@ +#!/bin/sh +set -e + +if [ "$1" = "configure" ]; then + if ! getent passwd knot > /dev/null; then + adduser --quiet --system --group --no-create-home --home /var/lib/knot knot + fi + + dpkg-statoverride --list /var/lib/knot > /dev/null || dpkg-statoverride --update --add knot knot 0755 /var/lib/knot + dpkg-statoverride --list /etc/knot/knot.conf > /dev/null || dpkg-statoverride --update --add knot knot 0640 /etc/knot/knot.conf + dpkg-statoverride --list /etc/knot > /dev/null || dpkg-statoverride --update --add knot knot 0750 /etc/knot +fi + +if [ "$1" = "configure" ] && [ -n "$2" ] && dpkg --compare-versions "$2" lt "2.5.0-1~"; then + KNOT_USER=$(/usr/lib/knot/get_user 2>/dev/null || echo "knot") + + /usr/lib/knot/get_kaspdb | while read KASPDB; do + if [ ! -f "${KASPDB}/data.mdb" ]; then + runuser -u "${KNOT_USER}" -- /usr/lib/knot/kasp_json2lmdb -i "${KASPDB}" + fi + done +fi + +#DEBHELPER# + +exit 0 diff --git a/debian/knot.postrm b/debian/knot.postrm new file mode 100644 index 0000000..76dccba --- /dev/null +++ b/debian/knot.postrm @@ -0,0 +1,18 @@ +#!/bin/sh +set -e + +if test "$1" = "purge"; then + spool=/var/lib/knot + rm -rf $spool/timers $spool/keys $spool/journal + rmdir $spool 2>/dev/null || true + + dpkg-statoverride --remove /var/lib/knot >/dev/null 2>/dev/null || true + dpkg-statoverride --remove /etc/knot/knot.conf >/dev/null 2>/dev/null || true + dpkg-statoverride --remove /etc/knot >/dev/null 2>/dev/null || true + + deluser --quiet knot > /dev/null || true +fi + +#DEBHELPER# + +exit 0 diff --git a/debian/knot.service b/debian/knot.service new file mode 100644 index 0000000..191fd3d --- /dev/null +++ b/debian/knot.service @@ -0,0 +1,14 @@ +[Unit] +Description=Knot DNS server +Wants=network-online.target +After=network-online.target +Documentation=man:knotd(8) man:knot.conf(5) man:knotc(8) + +[Service] +EnvironmentFile=/etc/default/knot +ExecReload=/usr/sbin/knotc reload +ExecStart=/usr/sbin/knotd $KNOTD_ARGS +Restart=on-abort + +[Install] +WantedBy=multi-user.target diff --git a/debian/knot.tmpfile b/debian/knot.tmpfile new file mode 100644 index 0000000..aab7815 --- /dev/null +++ b/debian/knot.tmpfile @@ -0,0 +1,2 @@ +#Type Path Mode UID GID Age Argument + d /run/knot 0755 knot knot - - diff --git a/debian/libdnssec6.install b/debian/libdnssec6.install new file mode 100644 index 0000000..17a9fe6 --- /dev/null +++ b/debian/libdnssec6.install @@ -0,0 +1 @@ +usr/lib/*/libdnssec.so.* diff --git a/debian/libdnssec6.symbols b/debian/libdnssec6.symbols new file mode 100644 index 0000000..35a8c99 --- /dev/null +++ b/debian/libdnssec6.symbols @@ -0,0 +1,109 @@ +libdnssec.so.6 libdnssec6 #MINVER# +* Build-Depends-Package: libknot-dev + dnssec_algorithm_digest_support@Base 2.6.0 + dnssec_algorithm_key_size_check@Base 2.3.0 + dnssec_algorithm_key_size_default@Base 2.3.0 + dnssec_algorithm_key_size_range@Base 2.3.0 + dnssec_algorithm_key_support@Base 2.6.0 + dnssec_binary_alloc@Base 2.3.0 + dnssec_binary_cmp@Base 2.3.0 + dnssec_binary_dup@Base 2.3.0 + dnssec_binary_free@Base 2.3.0 + dnssec_binary_from_base64@Base 2.3.0 + dnssec_binary_resize@Base 2.3.0 + dnssec_binary_to_base64@Base 2.3.0 + dnssec_crypto_cleanup@Base 2.3.0 + dnssec_crypto_init@Base 2.3.0 + dnssec_crypto_reinit@Base 2.3.0 + dnssec_item_get@Base 2.3.0 + dnssec_item_set@Base 2.3.0 + dnssec_key_can_sign@Base 2.3.0 + dnssec_key_can_verify@Base 2.3.0 + dnssec_key_clear@Base 2.3.0 + dnssec_key_create_ds@Base 2.3.0 + dnssec_key_dup@Base 2.3.0 + dnssec_key_free@Base 2.3.0 + dnssec_key_get_algorithm@Base 2.3.0 + dnssec_key_get_dname@Base 2.3.0 + dnssec_key_get_flags@Base 2.3.0 + dnssec_key_get_keyid@Base 2.6.0 + dnssec_key_get_keytag@Base 2.3.0 + dnssec_key_get_protocol@Base 2.3.0 + dnssec_key_get_pubkey@Base 2.3.0 + dnssec_key_get_rdata@Base 2.3.0 + dnssec_key_get_size@Base 2.3.0 + dnssec_key_import_keystore@Base 2.3.0 + dnssec_key_load_pkcs8@Base 2.3.0 + dnssec_key_new@Base 2.3.0 + dnssec_key_set_algorithm@Base 2.3.0 + dnssec_key_set_dname@Base 2.3.0 + dnssec_key_set_flags@Base 2.3.0 + dnssec_key_set_protocol@Base 2.3.0 + dnssec_key_set_pubkey@Base 2.3.0 + dnssec_key_set_rdata@Base 2.3.0 + dnssec_keyid_copy@Base 2.3.0 + dnssec_keyid_equal@Base 2.3.0 + dnssec_keyid_is_valid@Base 2.3.0 + dnssec_keyid_normalize@Base 2.3.0 + dnssec_keystore_close@Base 2.3.0 + dnssec_keystore_deinit@Base 2.3.0 + dnssec_keystore_generate_key@Base 2.3.0 + dnssec_keystore_import@Base 2.3.0 + dnssec_keystore_init@Base 2.3.0 + dnssec_keystore_init_pkcs11@Base 2.3.0 + dnssec_keystore_init_pkcs8_custom@Base 2.3.0 + dnssec_keystore_init_pkcs8_dir@Base 2.3.0 + dnssec_keystore_list_keys@Base 2.3.0 + dnssec_keystore_open@Base 2.3.0 + dnssec_keystore_remove_key@Base 2.3.0 + dnssec_keytag@Base 2.3.0 + dnssec_list_append@Base 2.3.0 + dnssec_list_clear@Base 2.3.0 + dnssec_list_clear_full@Base 2.3.0 + dnssec_list_contains@Base 2.3.0 + dnssec_list_free@Base 2.3.0 + dnssec_list_free_full@Base 2.3.0 + dnssec_list_head@Base 2.3.0 + dnssec_list_insert_after@Base 2.3.0 + dnssec_list_insert_before@Base 2.3.0 + dnssec_list_is_empty@Base 2.3.0 + dnssec_list_new@Base 2.3.0 + dnssec_list_next@Base 2.3.0 + dnssec_list_nth@Base 2.3.0 + dnssec_list_prepend@Base 2.3.0 + dnssec_list_prev@Base 2.3.0 + dnssec_list_remove@Base 2.3.0 + dnssec_list_search@Base 2.3.0 + dnssec_list_size@Base 2.3.0 + dnssec_list_tail@Base 2.3.0 + dnssec_nsec3_hash@Base 2.3.0 + dnssec_nsec3_hash_length@Base 2.3.0 + dnssec_nsec3_params_free@Base 2.3.0 + dnssec_nsec3_params_from_rdata@Base 2.3.0 + dnssec_nsec_bitmap_add@Base 2.3.0 + dnssec_nsec_bitmap_clear@Base 2.3.0 + dnssec_nsec_bitmap_contains@Base 2.7.0 + dnssec_nsec_bitmap_free@Base 2.3.0 + dnssec_nsec_bitmap_new@Base 2.3.0 + dnssec_nsec_bitmap_size@Base 2.3.0 + dnssec_nsec_bitmap_write@Base 2.3.0 + dnssec_random_binary@Base 2.3.0 + dnssec_random_buffer@Base 2.3.0 + dnssec_sign_add@Base 2.3.0 + dnssec_sign_free@Base 2.3.0 + dnssec_sign_init@Base 2.3.0 + dnssec_sign_new@Base 2.3.0 + dnssec_sign_verify@Base 2.3.0 + dnssec_sign_write@Base 2.3.0 + dnssec_strerror@Base 2.3.0 + dnssec_tsig_add@Base 2.3.0 + dnssec_tsig_algorithm_from_dname@Base 2.3.0 + dnssec_tsig_algorithm_from_name@Base 2.3.0 + dnssec_tsig_algorithm_size@Base 2.3.0 + dnssec_tsig_algorithm_to_dname@Base 2.3.0 + dnssec_tsig_algorithm_to_name@Base 2.3.0 + dnssec_tsig_free@Base 2.3.0 + dnssec_tsig_new@Base 2.3.0 + dnssec_tsig_optimal_key_size@Base 2.3.0 + dnssec_tsig_size@Base 2.3.0 + dnssec_tsig_write@Base 2.3.0 diff --git a/debian/libknot-dev.install b/debian/libknot-dev.install new file mode 100644 index 0000000..54f2635 --- /dev/null +++ b/debian/libknot-dev.install @@ -0,0 +1,4 @@ +usr/include/ +usr/lib/*/*.a +usr/lib/*/*.so +usr/lib/*/pkgconfig/* diff --git a/debian/libknot8.install b/debian/libknot8.install new file mode 100644 index 0000000..f9b9f93 --- /dev/null +++ b/debian/libknot8.install @@ -0,0 +1 @@ +usr/lib/*/libknot.so.* diff --git a/debian/libknot8.symbols b/debian/libknot8.symbols new file mode 100644 index 0000000..4c7d0dd --- /dev/null +++ b/debian/libknot8.symbols @@ -0,0 +1,207 @@ +libknot.so.8 libknot8 #MINVER# +* Build-Depends-Package: libknot-dev + KNOT_DB_LMDB_DUPSORT@Base 2.5.0 + KNOT_DB_LMDB_INTEGERKEY@Base 2.4.0 + KNOT_DB_LMDB_MAPASYNC@Base 2.5.0 + KNOT_DB_LMDB_NOSYNC@Base 2.4.0 + KNOT_DB_LMDB_NOTLS@Base 2.3.0 + KNOT_DB_LMDB_RDONLY@Base 2.3.0 + KNOT_DB_LMDB_WRITEMAP@Base 2.5.0 + KNOT_DUMP_STYLE_DEFAULT@Base 2.3.0 + knot_ctl_accept@Base 2.3.0 + knot_ctl_alloc@Base 2.3.0 + knot_ctl_bind@Base 2.3.0 + knot_ctl_close@Base 2.3.0 + knot_ctl_connect@Base 2.3.0 + knot_ctl_free@Base 2.3.0 + knot_ctl_receive@Base 2.3.0 + knot_ctl_send@Base 2.3.0 + knot_ctl_set_timeout@Base 2.3.0 + knot_ctl_unbind@Base 2.3.0 + knot_db_lmdb_api@Base 2.3.0 + knot_db_lmdb_del_exact@Base 2.5.0 + knot_db_lmdb_get_mapsize@Base 2.4.0 + knot_db_lmdb_get_usage@Base 2.4.0 + knot_db_lmdb_iter_del@Base 2.3.0 + knot_db_lmdb_txn_begin@Base 2.3.0 + knot_db_trie_api@Base 2.3.0 + knot_dname_cmp@Base 2.3.0 + knot_dname_copy@Base 2.3.0 + knot_dname_free@Base 2.3.0 + knot_dname_from_str@Base 2.3.0 + knot_dname_in_bailiwick@Base 2.7.0 + knot_dname_is_equal@Base 2.3.0 + knot_dname_labels@Base 2.3.0 + knot_dname_lf@Base 2.3.0 + knot_dname_matched_labels@Base 2.3.0 + knot_dname_prefixlen@Base 2.3.0 + knot_dname_realsize@Base 2.3.0 + knot_dname_replace_suffix@Base 2.3.0 + knot_dname_size@Base 2.3.0 + knot_dname_store@Base 2.7.0 + knot_dname_to_lower@Base 2.3.0 + knot_dname_to_str@Base 2.3.0 + knot_dname_to_wire@Base 2.3.0 + knot_dname_unpack@Base 2.3.0 + knot_dname_wire_check@Base 2.3.0 + knot_dnssec_alg_names@Base 2.3.0 + knot_edns_add_option@Base 2.3.0 + knot_edns_alignment_size@Base 2.7.0 + knot_edns_chain_parse@Base 2.4.0 + knot_edns_chain_size@Base 2.4.0 + knot_edns_chain_write@Base 2.4.0 + knot_edns_client_subnet_get_addr@Base 2.3.1 + knot_edns_client_subnet_parse@Base 2.3.0 + knot_edns_client_subnet_set_addr@Base 2.3.1 + knot_edns_client_subnet_size@Base 2.3.1 + knot_edns_client_subnet_write@Base 2.3.1 + knot_edns_cookie_client_check@Base 2.7.0 + knot_edns_cookie_client_generate@Base 2.7.0 + knot_edns_cookie_parse@Base 2.7.0 + knot_edns_cookie_server_check@Base 2.7.0 + knot_edns_cookie_server_generate@Base 2.7.0 + knot_edns_cookie_size@Base 2.7.0 + knot_edns_cookie_write@Base 2.7.0 + knot_edns_get_ext_rcode@Base 2.3.0 + knot_edns_get_option@Base 2.3.0 + knot_edns_get_options@Base 2.7.0 + knot_edns_get_version@Base 2.3.0 + knot_edns_init@Base 2.3.0 + knot_edns_keepalive_parse@Base 2.4.0 + knot_edns_keepalive_size@Base 2.4.0 + knot_edns_keepalive_write@Base 2.4.0 + knot_edns_reserve_option@Base 2.3.0 + knot_edns_set_ext_rcode@Base 2.3.0 + knot_edns_set_version@Base 2.3.0 + knot_error_from_libdnssec@Base 2.5.0 + knot_get_obsolete_rdata_descriptor@Base 2.3.0 + knot_get_rdata_descriptor@Base 2.3.0 + knot_naptr_header_size@Base 2.3.0 + knot_opcode_names@Base 2.3.0 + knot_opt_code_to_string@Base 2.6.6 + knot_pkt_begin@Base 2.3.0 + knot_pkt_clear@Base 2.3.0 + knot_pkt_copy@Base 2.3.0 + knot_pkt_ext_rcode@Base 2.4.0 + knot_pkt_ext_rcode_name@Base 2.4.0 + knot_pkt_free@Base 2.3.0 + knot_pkt_init_response@Base 2.3.0 + knot_pkt_new@Base 2.3.0 + knot_pkt_parse@Base 2.3.0 + knot_pkt_parse_question@Base 2.3.0 + knot_pkt_put_question@Base 2.3.0 + knot_pkt_put_rotate@Base 2.7.0 + knot_pkt_reclaim@Base 2.3.0 + knot_pkt_reserve@Base 2.3.0 + knot_rcode_names@Base 2.3.0 + knot_rdataset_add@Base 2.3.0 + knot_rdataset_at@Base 2.3.0 + knot_rdataset_clear@Base 2.3.0 + knot_rdataset_copy@Base 2.3.0 + knot_rdataset_eq@Base 2.3.0 + knot_rdataset_intersect@Base 2.3.0 + knot_rdataset_member@Base 2.3.0 + knot_rdataset_merge@Base 2.3.0 + knot_rdataset_reserve@Base 2.3.0 + knot_rdataset_size@Base 2.3.0 + knot_rdataset_subtract@Base 2.3.0 + knot_rdataset_unreserve@Base 2.3.0 + knot_rrclass_from_string@Base 2.3.0 + knot_rrclass_to_string@Base 2.3.0 + knot_rrset_add_rdata@Base 2.3.0 + knot_rrset_clear@Base 2.3.0 + knot_rrset_copy@Base 2.3.0 + knot_rrset_equal@Base 2.3.0 + knot_rrset_free@Base 2.3.0 + knot_rrset_is_nsec3rel@Base 2.3.0 + knot_rrset_new@Base 2.3.0 + knot_rrset_rr_from_wire@Base 2.3.0 + knot_rrset_rr_to_canonical@Base 2.3.0 + knot_rrset_size@Base 2.3.0 + knot_rrset_to_wire_extra@Base 2.7.0 + knot_rrset_to_wire_rotate@Base 2.7.0 + knot_rrset_txt_dump@Base 2.3.0 + knot_rrset_txt_dump_data@Base 2.3.0 + knot_rrset_txt_dump_header@Base 2.3.0 + knot_rrtype_additional_needed@Base 2.3.0 + knot_rrtype_from_string@Base 2.3.0 + knot_rrtype_is_dnssec@Base 2.3.0 + knot_rrtype_is_metatype@Base 2.3.0 + knot_rrtype_should_be_lowercased@Base 2.3.0 + knot_rrtype_to_string@Base 2.3.0 + knot_strerror@Base 2.3.0 + knot_tsig_add@Base 2.3.0 + knot_tsig_append@Base 2.3.0 + knot_tsig_client_check@Base 2.3.0 + knot_tsig_client_check_next@Base 2.3.0 + knot_tsig_create_rdata@Base 2.3.0 + knot_tsig_key_copy@Base 2.3.0 + knot_tsig_key_deinit@Base 2.3.0 + knot_tsig_key_init@Base 2.3.0 + knot_tsig_key_init_file@Base 2.3.0 + knot_tsig_key_init_str@Base 2.3.0 + knot_tsig_rcode_names@Base 2.4.0 + knot_tsig_rdata_alg@Base 2.3.0 + knot_tsig_rdata_alg_name@Base 2.3.0 + knot_tsig_rdata_error@Base 2.3.0 + knot_tsig_rdata_fudge@Base 2.3.0 + knot_tsig_rdata_is_ok@Base 2.3.0 + knot_tsig_rdata_mac@Base 2.3.0 + knot_tsig_rdata_mac_length@Base 2.3.0 + knot_tsig_rdata_orig_id@Base 2.3.0 + knot_tsig_rdata_other_data@Base 2.3.0 + knot_tsig_rdata_other_data_length@Base 2.3.0 + knot_tsig_rdata_set_fudge@Base 2.3.0 + knot_tsig_rdata_set_mac@Base 2.3.0 + knot_tsig_rdata_set_orig_id@Base 2.3.0 + knot_tsig_rdata_set_other_data@Base 2.3.0 + knot_tsig_rdata_set_time_signed@Base 2.3.0 + knot_tsig_rdata_time_signed@Base 2.3.0 + knot_tsig_rdata_tsig_timers_length@Base 2.3.0 + knot_tsig_rdata_tsig_variables_length@Base 2.3.0 + knot_tsig_server_check@Base 2.3.0 + knot_tsig_sign@Base 2.3.0 + knot_tsig_sign_next@Base 2.3.0 + knot_tsig_wire_maxsize@Base 2.3.0 + knot_tsig_wire_size@Base 2.4.1 + yp_addr@Base 2.5.0 + yp_addr_noport@Base 2.5.0 + yp_addr_noport_to_bin@Base 2.5.0 + yp_addr_noport_to_txt@Base 2.5.0 + yp_addr_range_to_bin@Base 2.5.0 + yp_addr_range_to_txt@Base 2.5.0 + yp_addr_to_bin@Base 2.5.0 + yp_addr_to_txt@Base 2.5.0 + yp_base64_to_bin@Base 2.5.0 + yp_base64_to_txt@Base 2.5.0 + yp_bool_to_bin@Base 2.5.0 + yp_bool_to_txt@Base 2.5.0 + yp_deinit@Base 2.5.0 + yp_dname_to_bin@Base 2.5.0 + yp_dname_to_txt@Base 2.5.0 + yp_format_id@Base 2.5.0 + yp_format_key0@Base 2.5.0 + yp_format_key1@Base 2.5.0 + yp_hex_to_bin@Base 2.5.0 + yp_hex_to_txt@Base 2.5.0 + yp_init@Base 2.5.0 + yp_int_to_bin@Base 2.5.0 + yp_int_to_txt@Base 2.5.0 + yp_item_to_bin@Base 2.5.0 + yp_item_to_txt@Base 2.5.0 + yp_option_to_bin@Base 2.5.0 + yp_option_to_txt@Base 2.5.0 + yp_parse@Base 2.5.0 + yp_schema_check_deinit@Base 2.5.0 + yp_schema_check_init@Base 2.5.0 + yp_schema_check_parser@Base 2.5.0 + yp_schema_check_str@Base 2.5.0 + yp_schema_copy@Base 2.5.0 + yp_schema_find@Base 2.5.0 + yp_schema_free@Base 2.5.0 + yp_schema_merge@Base 2.5.0 + yp_schema_purge_dynamic@Base 2.5.0 + yp_set_input_file@Base 2.5.0 + yp_set_input_string@Base 2.5.0 + yp_str_to_bin@Base 2.5.0 + yp_str_to_txt@Base 2.5.0 diff --git a/debian/libzscanner2.install b/debian/libzscanner2.install new file mode 100644 index 0000000..a8dc226 --- /dev/null +++ b/debian/libzscanner2.install @@ -0,0 +1 @@ +usr/lib/*/libzscanner.so.* diff --git a/debian/libzscanner2.symbols b/debian/libzscanner2.symbols new file mode 100644 index 0000000..3477f9c --- /dev/null +++ b/debian/libzscanner2.symbols @@ -0,0 +1,11 @@ +libzscanner.so.2 libzscanner2 #MINVER# +* Build-Depends-Package: libknot-dev + zs_deinit@Base 2.3.0 + zs_errorname@Base 2.3.0 + zs_init@Base 2.3.0 + zs_parse_all@Base 2.3.0 + zs_parse_record@Base 2.3.0 + zs_set_input_file@Base 2.3.0 + zs_set_input_string@Base 2.3.0 + zs_set_processing@Base 2.3.0 + zs_strerror@Base 2.3.0 diff --git a/debian/not-installed b/debian/not-installed new file mode 100644 index 0000000..c928be1 --- /dev/null +++ b/debian/not-installed @@ -0,0 +1 @@ +etc/knot/example.com.zone diff --git a/debian/patches/0001-avoid-git-version-inclusion-in-debian-packages.patch b/debian/patches/0001-avoid-git-version-inclusion-in-debian-packages.patch new file mode 100644 index 0000000..1ed81bf --- /dev/null +++ b/debian/patches/0001-avoid-git-version-inclusion-in-debian-packages.patch @@ -0,0 +1,23 @@ +From: Daniel Kahn Gillmor <dkg@fifthhorseman.net> +Date: Fri, 2 Nov 2018 18:53:10 +0300 +Subject: avoid git version inclusion in debian packages + +--- + m4/knot-version.m4 | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/m4/knot-version.m4 b/m4/knot-version.m4 +index 6e9158d..d4abe1d 100644 +--- a/m4/knot-version.m4 ++++ b/m4/knot-version.m4 +@@ -11,9 +11,6 @@ + ################################################################################ + + m4_define([knot_PATCH], m4_ifblank(knot_VERSION_PATCH, [dev], knot_VERSION_PATCH))dnl +-m4_define([knot_GIT_HASH], m4_esyscmd_s(git rev-parse --short HEAD 2>/dev/null))dnl +-m4_define([knot_GIT_TAG], m4_esyscmd_s(git describe --exact-match 2>/dev/null))dnl + m4_define([knot_TIMESTAMP], m4_esyscmd_s(date -u +'%s' 2>/dev/null))dnl +-m4_define([knot_GIT_INFO], m4_ifblank(knot_GIT_TAG, m4_ifnblank(knot_GIT_HASH, .knot_TIMESTAMP.knot_GIT_HASH, []), []))dnl + +-m4_define([knot_PKG_VERSION], [knot_VERSION_MAJOR.knot_VERSION_MINOR.knot_PATCH]knot_GIT_INFO)dnl ++m4_define([knot_PKG_VERSION], [knot_VERSION_MAJOR.knot_VERSION_MINOR.knot_PATCH])dnl diff --git a/debian/patches/0002-zonefile-Verify-mtime-against-full-precision-timesta.patch b/debian/patches/0002-zonefile-Verify-mtime-against-full-precision-timesta.patch new file mode 100644 index 0000000..fa79f5d --- /dev/null +++ b/debian/patches/0002-zonefile-Verify-mtime-against-full-precision-timesta.patch @@ -0,0 +1,129 @@ +From: Daniel Kahn Gillmor <dkg@fifthhorseman.net> +Date: Fri, 22 Feb 2019 16:05:38 -0500 +Subject: zonefile: Verify mtime against full-precision timestamp + +We've just used 1-second granularity mtime to check if a file has +changed. + +But if two updates happen within a calendar second, and knotd notices +the first one and reloads the file, it might never notice the second +change and continue serving the old file. We can see this happening +in intermittent test suite failures in the debian continuous +integration servers: + + https://ci.debian.net/packages/k/knot/unstable/amd64 + +Using nanosecond-granularity timestamps should make these problems go +away. + +Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net> +--- + src/knot/events/handlers/load.c | 6 ++++-- + src/knot/zone/zone.c | 2 +- + src/knot/zone/zone.h | 2 +- + src/knot/zone/zonedb-load.c | 6 ++++-- + src/knot/zone/zonefile.c | 4 ++-- + src/knot/zone/zonefile.h | 2 +- + 6 files changed, 13 insertions(+), 9 deletions(-) + +diff --git a/src/knot/events/handlers/load.c b/src/knot/events/handlers/load.c +index 7410d30..1f8f368 100644 +--- a/src/knot/events/handlers/load.c ++++ b/src/knot/events/handlers/load.c +@@ -73,10 +73,12 @@ int event_load(conf_t *conf, zone_t *zone) + + // If configured, attempt to load zonefile. + if (zf_from != ZONEFILE_LOAD_NONE) { +- time_t mtime; ++ struct timespec mtime; + char *filename = conf_zonefile(conf, zone->name); + ret = zonefile_exists(filename, &mtime); +- bool zonefile_unchanged = (zone->zonefile.exists && zone->zonefile.mtime == mtime); ++ bool zonefile_unchanged = (zone->zonefile.exists && ++ zone->zonefile.mtime.tv_sec == mtime.tv_sec && ++ zone->zonefile.mtime.tv_nsec == mtime.tv_nsec); + free(filename); + if (ret == KNOT_EOK) { + ret = zone_load_contents(conf, zone->name, &zf_conts); +diff --git a/src/knot/zone/zone.c b/src/knot/zone/zone.c +index efc0caa..0ec29f1 100644 +--- a/src/knot/zone/zone.c ++++ b/src/knot/zone/zone.c +@@ -145,7 +145,7 @@ static int flush_journal(conf_t *conf, zone_t *zone, bool allow_empty_zone) + + /* Update zone file attributes. */ + zone->zonefile.exists = true; +- zone->zonefile.mtime = st.st_mtime; ++ zone->zonefile.mtime = st.st_mtim; + zone->zonefile.serial = serial_to; + zone->zonefile.resigned = false; + +diff --git a/src/knot/zone/zone.h b/src/knot/zone/zone.h +index 360e222..09c92cc 100644 +--- a/src/knot/zone/zone.h ++++ b/src/knot/zone/zone.h +@@ -50,7 +50,7 @@ typedef struct zone + + /*! \brief Zonefile parameters. */ + struct { +- time_t mtime; ++ struct timespec mtime; + uint32_t serial; + bool exists; + bool resigned; +diff --git a/src/knot/zone/zonedb-load.c b/src/knot/zone/zonedb-load.c +index a6e9834..f23b4b1 100644 +--- a/src/knot/zone/zonedb-load.c ++++ b/src/knot/zone/zonedb-load.c +@@ -35,12 +35,14 @@ static bool zone_file_updated(conf_t *conf, const zone_t *old_zone, + assert(zone_name); + + char *zonefile = conf_zonefile(conf, zone_name); +- time_t mtime; ++ struct timespec mtime; + int ret = zonefile_exists(zonefile, &mtime); + free(zonefile); + + return (ret == KNOT_EOK && old_zone != NULL && +- !(old_zone->zonefile.exists && old_zone->zonefile.mtime == mtime)); ++ !(old_zone->zonefile.exists && ++ old_zone->zonefile.mtime.tv_sec == mtime.tv_sec && ++ old_zone->zonefile.mtime.tv_nsec == mtime.tv_nsec)); + } + + static zone_t *create_zone_from(const knot_dname_t *name, server_t *server) +diff --git a/src/knot/zone/zonefile.c b/src/knot/zone/zonefile.c +index 37fc90b..0e02d21 100644 +--- a/src/knot/zone/zonefile.c ++++ b/src/knot/zone/zonefile.c +@@ -248,7 +248,7 @@ fail: + return NULL; + } + +-int zonefile_exists(const char *path, time_t *mtime) ++int zonefile_exists(const char *path, struct timespec *mtime) + { + if (path == NULL) { + return KNOT_EINVAL; +@@ -260,7 +260,7 @@ int zonefile_exists(const char *path, time_t *mtime) + } + + if (mtime != NULL) { +- *mtime = zonefile_st.st_mtime; ++ *mtime = zonefile_st.st_mtim; + } + + return KNOT_EOK; +diff --git a/src/knot/zone/zonefile.h b/src/knot/zone/zonefile.h +index 90283ee..9d0542e 100644 +--- a/src/knot/zone/zonefile.h ++++ b/src/knot/zone/zonefile.h +@@ -79,7 +79,7 @@ zone_contents_t *zonefile_load(zloader_t *loader); + * + * \return KNOT_E* + */ +-int zonefile_exists(const char *path, time_t *mtime); ++int zonefile_exists(const char *path, struct timespec *mtime); + + /*! + * \brief Write zone contents to zone file. diff --git a/debian/patches/0003-correct-kdig-documentation-about-no-crypto.patch b/debian/patches/0003-correct-kdig-documentation-about-no-crypto.patch new file mode 100644 index 0000000..02d2e15 --- /dev/null +++ b/debian/patches/0003-correct-kdig-documentation-about-no-crypto.patch @@ -0,0 +1,39 @@ +From: Daniel Kahn Gillmor <dkg@fifthhorseman.net> +Date: Fri, 4 Jan 2019 15:14:32 -0500 +Subject: correct kdig documentation about +[no]crypto + +kdig displays cryptographic signatures and keys in base64 encoding, +not in hexdump format. + +Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net> +--- + doc/man/kdig.1in | 2 +- + doc/man_kdig.rst | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/doc/man/kdig.1in b/doc/man/kdig.1in +index 8bb2d01..df2fb3c 100644 +--- a/doc/man/kdig.1in ++++ b/doc/man/kdig.1in +@@ -159,7 +159,7 @@ Use the generic representation format when printing resource record types + and data. + .TP + \fB+\fP[\fBno\fP]\fBcrypto\fP +-Display the DNSSEC keys and signatures values in hexdump, instead of omitting them. ++Display the DNSSEC keys and signatures values in base64, instead of omitting them. + .TP + \fB+\fP[\fBno\fP]\fBaaflag\fP + Set the AA flag. +diff --git a/doc/man_kdig.rst b/doc/man_kdig.rst +index c1b3961..7fa2db0 100644 +--- a/doc/man_kdig.rst ++++ b/doc/man_kdig.rst +@@ -138,7 +138,7 @@ Options + and data. + + **+**\ [\ **no**\ ]\ **crypto** +- Display the DNSSEC keys and signatures values in hexdump, instead of omitting them. ++ Display the DNSSEC keys and signatures values in base64, instead of omitting them. + + **+**\ [\ **no**\ ]\ **aaflag** + Set the AA flag. diff --git a/debian/patches/series b/debian/patches/series new file mode 100644 index 0000000..404f14f --- /dev/null +++ b/debian/patches/series @@ -0,0 +1,3 @@ +0001-avoid-git-version-inclusion-in-debian-packages.patch +0002-zonefile-Verify-mtime-against-full-precision-timesta.patch +0003-correct-kdig-documentation-about-no-crypto.patch diff --git a/debian/prepare-environment b/debian/prepare-environment new file mode 100755 index 0000000..7176f5e --- /dev/null +++ b/debian/prepare-environment @@ -0,0 +1,38 @@ +#!/bin/sh + +set -eu + +CONFFILE=${1:-/etc/knot/knot.conf} + +if [ ! -r $CONFFILE ]; then + echo "$CONFFILE doesn't exist or has wrong permissions." + exit 1; +fi + +KNOT_RUNDIR=$(sed -ne "s/#.*$//;s/.*rundir: \"*\([^\";]*\\).*/\\1/p;" $CONFFILE) +[ -z "$KNOT_RUNDIR" ] && KNOT_RUNDIR=/run/knot + +mkdir --parents "$KNOT_RUNDIR"; + +KNOT_USER=$(sed -ne "s/#.*$//;s/.*user:[ \"]*\\([^\\:\"]*\\)[ \"]*/\\1/p;" $CONFFILE) + +if [ -n "$KNOT_USER" ]; then + if ! getent passwd $KNOT_USER >/dev/null; then + echo "Configured user '$KNOT_USER' doesn't exist." + exit 1 + fi + + KNOT_GROUP=$(sed -ne "s/#.*$//;s/.*user:[ \"]*[^\\:\"]*\\:\\([^\"]*\\)[ \"]*/\\1/p;" $CONFFILE) + if [ -z "$KNOT_GROUP" ]; then + KNOT_GROUP=$(getent group $(getent passwd "$KNOT_USER" | cut -f 4 -d :) | cut -f 1 -d :) + fi + + if ! getent group $KNOT_GROUP >/dev/null; then + echo "Configured group '$KNOT_GROUP' doesn't exist." + exit 1 + fi + chown --silent "$KNOT_USER:$KNOT_GROUP" "$KNOT_RUNDIR" + chmod 775 "$KNOT_RUNDIR" +fi + +: diff --git a/debian/rules b/debian/rules new file mode 100755 index 0000000..2d6cbb6 --- /dev/null +++ b/debian/rules @@ -0,0 +1,89 @@ +#!/usr/bin/make -f + +export DEB_BUILD_MAINT_OPTIONS = hardening=+all +export DEB_CFLAGS_MAINT_APPEND = -Wall -DNDEBUG +export DEB_LDFLAGS_MAINT_APPEND = -Wl,--as-needed + +export DPKG_GENSYMBOLS_CHECK_LEVEL := 4 +export KNOT_SOFTHSM2_DSO = /usr/lib/softhsm/libsofthsm2.so + +ifeq ($(DEB_HOST_ARCH),$(filter $(DEB_HOST_ARCH),riscv64)) + export DEB_LDFLAGS_MAINT_APPEND += -latomic +endif + +include /usr/share/dpkg/default.mk + +ifeq (maint,$(filter $(DEB_BUILD_OPTIONS),maint)) + FASTPARSER := --disable-fastparser +else + FASTPARSER := --enable-fastparser +endif + +ifeq ($(DEB_HOST_ARCH),$(filter $(DEB_HOST_ARCH),hurd-i386)) + RECVMMSG:=--enable-recvmmsg=no +else + RECVMMSG:=--enable-recvmmsg=yes +endif + +ifeq ($(DEB_HOST_ARCH),$(filter $(DEB_HOST_ARCH),amd64 i386)) + RUN_TEST := +else + RUN_TEST := -timeout --kill-after=5s 5m +endif + +%: + dh $@ \ + --dbgsym-migration='knot-dbg (<< 2.2.0-2~)' \ + --exclude=.la --exclude=example.com.zone + +override_dh_auto_configure: + echo confirming architecture... + echo 'arch:' $(DEB_HOST_ARCH) + echo 'filtered arch:' $(filter $(DEB_HOST_ARCH),mips powerpc riscv64) + echo 'DEB_LDFLAGS_MAINT_APPEND:' $(DEB_LDFLAGS_MAINT_APPEND) + echo done + dh_auto_configure -- \ + --sysconfdir=/etc \ + --localstatedir=/var/lib \ + --libexecdir=/usr/lib/knot \ + --with-rundir=/run/knot \ + --with-moduledir=/usr/lib/$(DEB_HOST_MULTIARCH)/knot \ + --with-storage=/var/lib/knot \ + --enable-systemd=auto \ + --enable-dnstap \ + --with-module-dnstap=yes \ + $(RECVMMSG) \ + $(FASTPARSER) \ + --disable-silent-rules + +override_dh_auto_build-indep: + dh_auto_build -- info pdf html + +override_dh_auto_install-arch: + dh_auto_install -- install + # rename knot.sample.conf to knot.conf + mv $(CURDIR)/debian/tmp/etc/knot/knot.sample.conf $(CURDIR)/debian/tmp/etc/knot/knot.conf + +override_dh_auto_install-indep: + dh_auto_install -- install-info install-pdf install-html + # rename knot.sample.conf to knot.conf + mv $(CURDIR)/debian/tmp/etc/knot/knot.sample.conf $(CURDIR)/debian/tmp/etc/knot/knot.conf + +override_dh_auto_test-indep: +override_dh_auto_test-arch: +ifeq (,$(filter nocheck,$(DEB_BUILD_OPTIONS))) + $(RUN_TEST) dh_auto_test + $(MAKE) -C samples knot.sample.conf + debian/get_kaspdb samples/knot.sample.conf + [ $$(debian/get_user samples/knot.sample.conf) = knot ] +endif + +override_dh_installdirs-arch: + dh_installdirs --arch --package=knot /usr/lib/$(DEB_HOST_MULTIARCH)/knot + dh_installdirs --arch --remaining-packages + +override_dh_missing: + dh_missing --fail-missing + +override_dh_installchangelogs: + dh_installchangelogs NEWS diff --git a/debian/source/format b/debian/source/format new file mode 100644 index 0000000..163aaf8 --- /dev/null +++ b/debian/source/format @@ -0,0 +1 @@ +3.0 (quilt) diff --git a/debian/tests/authoritative-server b/debian/tests/authoritative-server new file mode 100755 index 0000000..a2ae9c5 --- /dev/null +++ b/debian/tests/authoritative-server @@ -0,0 +1,193 @@ +#!/bin/bash + +# Author: Daniel Kahn Gillmor <dkg@fifthhorseman.net> +# 2018-11-02 +# License: GPLv3+ + +# error on exit +set -e +# for handling jobspecs: +set -m + +if [ -z "$AUTOPKGTEST_ARTIFACTS" ]; then + d="$(mktemp -d)" + remove="$d" +else + d="$AUTOPKGTEST_ARTIFACTS" +fi +ip="${TESTIP:-127.$(( $RANDOM % 256 )).$(( $RANDOM % 256 )).$(( $RANDOM % 256 ))}" +port="${PORT:-8123}" +knotd="${KNOTD:-/usr/sbin/knotd}" +kdig="${KDIG:-$(which kdig)}" +kzonecheck="${KZONECHECK:-$(which kzonecheck)}" +knotc="${KNOTC:-/usr/sbin/knotc}" +test_address="${TEST_ADDRESS:-192.0.2.199}" +get_kaspdb="${GET_KASPDB:-/usr/lib/knot/get_kaspdb}" +get_user="${GET_USER:-/usr/lib/knot/get_user}" +kasp_json2lmdb="${KASP_JSON2LMDB:-/usr/lib/knot/kasp_json2lmdb}" + +declare -a knot_args=(--socket "$d/knot.sock" --config="$d/knot.conf" --verbose) + +printf "%s + %s roundtrip tests\n------------\n workdir: %s\n IP addr: %s\n knot args: %s\n" "$knotd" "$kdig" "$d" "$ip" "${knot_args[*]}" + +section() { + printf "\n%s\n" "$1" + sed 's/./-/g' <<<"$1" +} + +cleanup () { + section "cleaning up" + find "$d" -ls + "${knotc}" "${knot_args[@]}" stop + wait %1 + tail -n +1 -v "$d"/*.err + if [ "$remove" ]; then + printf "\ncleaning up working directory %s\n" "$remove" + rm -rf "$remove" + fi +} +trap cleanup EXIT + +section "set up config file and zonefile" + +user=$(id -nu) +group=$(id -ng) +cat > "$d/knot.conf" <<EOF +server: + rundir: "$d/run" + listen: $ip@$port + user: $user:$group +template: + - id: default + storage: "$d" + file: "%s.zone" +zone: + - domain: example.net +EOF + +cat > "$d/example.net.zone" <<EOF +@ 1D IN SOA a.ns hostmaster 2018103100 3h 15m 1w 1d +@ 1D IN NS a.ns.example.net. +@ 1D IN NS b.ns.example.net. +a.ns 1D IN A 192.0.2.1 +b.ns 1D IN A 192.0.2.2 +test 1D IN A $test_address +EOF + +mkdir -p "$d/kasp-db/keys" +keytime="$(TZ=UTC date +%FT%T%z -d 'yesterday')" +cat >"$d/kasp-db/zone_example.net.json" <<EOF +{ + "policy": "default", + "nsec3_salt": null, + "nsec3_salt_created": null, + "keys": [ + { + "id": "ff81022ffd8e16256b3ac8e136f5f068fbe9b714", + "keytag": 24401, + "algorithm": 13, + "public_key": "6J7vEzP9NI/vgkLRToCmgNZ8XOWoUrwrSJyxqcL8Ll/t1Ucy6arTtzsjBQ32SDJEHfQhg0u/fABsp9HVZnFo3g==", + "ksk": true, + "created": "$keytime", + "publish": "$keytime", + "active": "$keytime" + }, + { + "id": "bf033546160229f56a8c90ca6ed3b599060b0067", + "keytag": 46765, + "algorithm": 13, + "public_key": "TczXowY+XyfUlvHFThLnPnM1zL/kH9lJP1B+WbhgksgHt/Bt93RrOWMgASoYWlBgW2uTVqqoNzLCk9YbPz5ViA==", + "ksk": false, + "created": "$keytime", + "publish": "$keytime", + "active": "$keytime" + } + ] +} +EOF +cat > "$d/kasp-db/keys/bf033546160229f56a8c90ca6ed3b599060b0067.pem" <<EOF +-----BEGIN PRIVATE KEY----- +MIGTAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBHkwdwIBAQQgEVKLYtyI4lZ7JiAM +xziZ/May2VI20QseJGS2AD0U3HKgCgYIKoZIzj0DAQehRANCAARNzNejBj5fJ9SW +8cVOEuc+czXMv+Qf2Uk/UH5ZuGCSyAe38G33dGs5YyABKhhaUGBba5NWqqg3MsKT +1hs/PlWI +-----END PRIVATE KEY----- +EOF +cat > "$d/kasp-db/keys/ff81022ffd8e16256b3ac8e136f5f068fbe9b714.pem" <<EOF +-----BEGIN PRIVATE KEY----- +MIGUAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBHoweAIBAQQhALYx6iXAqIQPL8aI +Bw0RtWKEOMSW/XawlfPM+7Gdkx9GoAoGCCqGSM49AwEHoUQDQgAE6J7vEzP9NI/v +gkLRToCmgNZ8XOWoUrwrSJyxqcL8Ll/t1Ucy6arTtzsjBQ32SDJEHfQhg0u/fABs +p9HVZnFo3g== +-----END PRIVATE KEY----- +EOF + + +find "$d" -maxdepth 1 -type f -print0 | xargs -0 tail -n +1 -v + +mkdir -p "${d}/run" + +section "kzonecheck'ing zonefile" +"${kzonecheck}" -v "$d/example.net.zone" + +section "launching knot" +"${knotd}" "${knot_args[@]}" 2> "$d/knotd.err" & + +# FIXME: this is an annoying poll -- would be better if we could be +# alerted when the daemon is done setting up the socket, but i don't +# want to "--daemonize" if i can avoid it because i want the shell to +# remain in direct supervision of all its processes +tried=0 +while [ $tried -lt 10 ] ; do + if "${knotc}" "${knot_args[@]}" status 2>&1; then + break; + fi + sleep 0.5 + tried=$(( $tried + 1 )) +done +if [ $tried -ge 10 ]; then + printf "failed to use %s\n" "${knotc}" >&2 + exit 1 +fi + + +section "querying knot" +"${kdig}" -p "${port}" @"${ip}" -t A test.example.net test2.example.net +answer="$("${kdig}" +short -p "${port}" @"${ip}" -t A test.example.net)" +if ! [ "$answer" = "$test_address" ]; then + printf "test.example.net mismatch!\nexpected: %s\n got: %s\n" "$test_address" "$answer" >&2 + exit 1 +fi +answer2="$("${kdig}" +short -p "${port}" @"${ip}" -t A test2.example.net)" +if ! [ "$answer2" = "" ]; then + printf "test2.example.net gave unexpected answer!\n got: %s\n" "$answer2" >&2 + exit 1 +fi + +section "modifying zone" +printf "test2 1D IN A $test_address\n" >>"$d/example.net.zone" +sed -i 's/^@ 1D IN SOA.*/@ 1D IN SOA a.ns hostmaster 2018110100 3h 15m 1w 1d/' "$d/example.net.zone" +"${knotc}" "${knot_args[@]}" reload + +section "querying again" +"${kdig}" -p "${port}" @"${ip}" -t A test.example.net test2.example.net +answer="$("${kdig}" +short -p "${port}" @"${ip}" -t A test.example.net)" +if ! [ "$answer" = "$test_address" ]; then + printf "test.example.net mismatch!\nexpected: %s\n got: %s\n" "$test_address" "$answer" >&2 + exit 1 +fi +answer2="$("${kdig}" +short -p "${port}" @"${ip}" -t A test2.example.net)" +if ! [ "$answer2" = "$test_address" ]; then + printf "test2.example.net mismatch!\nexpected: %s\n got: %s\n" "$test_address" "$answer2" >&2 + exit 1 +fi + +section "testing python transition helpers" +"${get_kaspdb}" "$d/knot.conf" +got_user="$(${get_user} "$d/knot.conf")" +if [ "$got_user" != "$user" ]; then + printf "user account mismatch!\nexpected: %s\n got: %s\n" "$user" "$got_user" >&2 + exit 1 +fi +"${kasp_json2lmdb}" --import "$d/kasp-db" + diff --git a/debian/tests/control b/debian/tests/control new file mode 100644 index 0000000..c654e9b --- /dev/null +++ b/debian/tests/control @@ -0,0 +1,5 @@ +Tests: kdig +Depends: knot-dnsutils, ca-certificates + +Tests: authoritative-server +Depends: knot, knot-dnsutils, findutils, python3-lmdb, python3-yaml diff --git a/debian/tests/kdig b/debian/tests/kdig new file mode 100755 index 0000000..a2f388e --- /dev/null +++ b/debian/tests/kdig @@ -0,0 +1,11 @@ +#!/bin/bash + +set -e + +expected=93.184.216.34 +answer=$(kdig +short +tls-ca +tls-hostname=dns.cmrg.net @dns.cmrg.net example.org) + +if [ "$answer" != "$expected" ]; then + printf "expected: %s\ngot: %s\n" "$expected" "$answer" >&2 + kdig +tls-ca +tls-hostname=dns.cmrg.net @dns.cmrg.net example.org +fi diff --git a/debian/ufw/knot b/debian/ufw/knot new file mode 100644 index 0000000..ee36916 --- /dev/null +++ b/debian/ufw/knot @@ -0,0 +1,4 @@ +[Knot] +title=Internet Domain Name Server +description=The Knot DNS implements an Internet domain name server. +ports=53 diff --git a/debian/upstream/signing-key.asc b/debian/upstream/signing-key.asc new file mode 100644 index 0000000..7935cee --- /dev/null +++ b/debian/upstream/signing-key.asc @@ -0,0 +1,51 @@ +-----BEGIN PGP PUBLIC KEY BLOCK----- + +mQINBFljlBcBEACuCSBlN1vTS9eEDqowZcLAAF8NytcTlRjXTLWMQtjU+fXkz9Vz +10n9TIFj9Kcec0p0+8F+SowybecwhmYoUzhKI7S9M1ziUmaIhFs2KvZ1GzigE/W5 +L448P/7pugh875e1tIrkrbbcIp6+SxaLbgvXlFl630ILZl/gbYOa/Wk21sLu4RjQ +Y39oHb0WTiwPnKhdMdwlnxm6HeWkHzlvI9N8tlDc6oVnUfqVI8gUyExLnEYjDpZf +orTVgHRq6RNyfTRZkh8zRsXSTnJlk/bVEDW5i/VgIQugzkgpuTGWlCstryi/MRhe +NxU1YEUenT69okb96QStfr1J00n8L4VAs8V5IuFUcSc8UqSpB+LgERRTMRFo9IrE +XAW/gEKlEVR+501BvJ0/Qggxbgz4PEnKNaxXmAnykJzot2VDKTzrr26a9LnrT0GW +om9rg89Ih876PA53vUXBB+FWP9QOFDcOfz3nMjCrLbMzhTsAzrNFXxchzLq+66CL +qsQQytDVFpLI+X++sKRTOHkq6vV1bAPjlljrannLnn1y/DvkOOkiHOdYyjmR7Dfk +vxgcWh/3Gx4J9gipxZITOr7LamEYgHfElY/UWCtc1Vjt8Xvgt4dofDpvSwY9YzgR +WxJKC5ewYdqTCI+zxL1f0fjkeiRYNi959UMMjgdcY7Zpi8oPPQmlyBw15QARAQAB +tCZEYW5pZWwgU2Fsem1hbiA8ZGFuaWVsLnNhbHptYW5AbmljLmN6PokCPQQTAQoA +JwUCWWOUFwIbAwUJA8JnAAULCQgHAwUVCgkICwUWAgMBAAIeAQIXgAAKCRAQu3r2 +/rvWq1+eEAClhOEK2MZOz+nwJSeX7iINKbw477Y+LSvYkKG81pve+xtblQEn7rI3 +cYnDrqlUb3bXdbMHujYrg1fPoccpCvf6d/JvlN6WXCE25R+GR6vxr6v7jycHdSOb +Fe4sTcwce6IViwiWiSizh4UCkz8285LjLcf3AnT2v6GJwHiZbPOeMQUNIRj6PEYL +SQsq0ZlqEx8LGKLTc5Ukrkoi4lN44SI1rzSwDPIqvlvrVnDXcDB8M7E2Ii51zU8/ +TVk920KeayUeCPxpmgQW3USI45NrE/jEgyodyxMGp5lg3OqzHT2wu9BVLWkQvTjF +fLfEsTay4K4kUSbYzbpS93b33J+I20rYLGBBYlTrN5417IgF6Bb8NzyrfVy1Wdqh +cggAEKX5EkOmZM8oduRxsHqiRLC/xKF8GqTo6t3GMS5i8RClNvmdq0WUkQUvld4b +OnXBCZ2QLbjV7sXjcr56ee+qdpiuRQjEidjHzpibcIBN8LVupVgXAZl9lsiBtoJX +OHsvSdU3VgGWnRGtzFjSHzl3TRPIsaVVqD7aCzQDfXDjrGlmhzgDfMwkqmBGgsku +8tSR3Ag0MRAouJFXiZrcM3XGeYVbHT6dt7UMAB27Xc5foc0kGRo5tzlK6rWG2sJI +lcQB7tKvwI/tE9lwJDjw+XNekEdIpcdcQ7mWa1COYkcYTre3oPmN+7kCDQRZY5QX +ARAA6RnxYG82/X+A49srgHR9yIxlHqSq6IhNn+iJQ5lpVpfeBItOG4NDu4Aq5X41 +pAJ3NKxsCPV62gEald/C7gJrTI5rag/87GYFFo6QRrwGsWVGORGs9G1pBF7ZZwhP +JwD3MeagGZNfWZzRxXefL1P3mrpO3etSEEwENHtCqEMP6x/JHh3SKonKAlL4xfj3 +F54aKj4upIcjxGBAJH8u66bN1GmYjstBzzbD4TWNTwfKgp15XxjrTgbThFy7CBoO +gcaApiYTPE7D5nB1+AyhGjnO3ZlNgy1ZIHVDFk6HEakaqKM9QlkJnZsB2+cTqXlV +0etmFQsedCg2sUier0hhIrEOOtGQbY1P+0vv+VRoaNym3ritl+70RG8WgrHNLMRH +VGeLRq3gOFnt+d/3h7meAKbORW/ZY30UpwthtlZYgciFzoDJCW8Be1i1X4toiUaM +kFh79jd7YTvZ87+P4DllC9MNsoq5cY/bHBNZYtXf7y6XqVqYo2IbFUR3VXKtzSN5 +eYm5YpFPczzmg1bNgl3i6WBcOF4EPEJEVjZ+u1r59NvfVLQ8XVh/QmLoG7x8oFcv +hWctMy17Vdm4qZjpSA+B1sQocehdra+xT+PWV0kcrYpsqwkYeFRQnJGqIupWHnot +qGOBNAyQWIcjK6K5y0CeioJZpNN5Oe5XloMXsYmgXsR+gTUAEQEAAYkCJQQYAQoA +DwUCWWOUFwIbDAUJA8JnAAAKCRAQu3r2/rvWq+IQD/9ikZ5MtdDOVLtULPqXXeP3 +6Oss2Ie4/4IQ7xkUZZ/Ujig0x1rW+d21o92VryH1s4K+nyCIW31rbtexK/0a54/w +Zyyjbqfh6Tgo9n3f5bMV9qyubb49cfTSKfgzoOkG8Xdc/TIO1IjWHy1NBDl8GWKJ +0QPYz78SCCkEFiVCAFBjuIQsoPqDKcZTs7k661w0A75ken88JJLgUgffZJRQK0i1 +dCw8kS4c2pqm24Q6d0AF5EdqXn2IFH82p49Pp5bRMY3LnibRL3Sq0xvXs7i5vY+o +JLuPAdomiGbdEbxcLytqQ2KitVdrGvrnZJxPs16m0uuTeM06krorDlgGBXFp5+Z9 +JbQpViHkVpLo+vf/GuT9WOWWH8gG0r14ZLVQTvCGXiAR4Aju7W5jPMPmVDJ+wMrD +cLta1Jv0U0+AnVe67mRXb0n5E/7kVshB3rfGzunPSlqT5kEiOXq6fJWB2l0lzCv0 +WtNuINmU9U3ap1oZBGSYl83vyuRUIlx61/tlnJvwseBL1FmASXOgfedCsxjHIlgF +SUeScLxnOSyap/4ePqZ0C76Nkvzx43SfM1LJUeCHwon0o+LZv2GlBmlEp6PbekRQ +Tz1hewLBbfAeXZRnwxvmkRqTP4DJCIVu2AE47+rbqVEjJZuEO4ORlkKoBdLOV3HN +xWbfbG7+n/h2cnUw3pqbHw== +=4CxJ +-----END PGP PUBLIC KEY BLOCK----- diff --git a/debian/watch b/debian/watch new file mode 100644 index 0000000..a763cd4 --- /dev/null +++ b/debian/watch @@ -0,0 +1,4 @@ +version=3 +opts=uversionmangle=s/-((alpha|beta|rc)\d*)$/~$1/,pgpsigurlmangle=s/$/.asc/,dversionmangle=s/\+hotfix// \ +https://secure.nic.cz/files/knot-dns/ \ +(?:|.*/)knot(?:[_\-]v?|)(\d\S*)\.(?:tar\.xz|txz|tar\.bz2|tbz2|tar\.gz|tgz) |