Adding upstream version 3.3.5.upstream/3.3.5

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 106 insertions, 84 deletions

diff --git a/doc/operation.rst b/doc/operation.rst
index f953719..43e13ff 100644
--- a/doc/operation.rst
+++ b/doc/operation.rst
@@ -35,6 +35,13 @@ or to the corresponding manual page.
 Also, the server needs to create :ref:`server_rundir` and :ref:`zone_storage`
 directories in order to run properly.
 
+.. NOTE::
+
+   Avoid editing of or other manipulation with configuration file during start
+   or reload of :doc:`knotd<man_knotd>` or start of :doc:`knotc<man_knotc>`
+   and other :doc:`utilities<utilities>` which use it. There is a risk of
+   malfunction or a :ref:`crash<Bus error>` otherwise.
+
 .. _Configuration database:
 
 Configuration database
@@ -199,10 +206,10 @@ Knot DNS allows you to read or change zone contents online using the server
 control interface.
 
 .. WARNING::
-   Avoid concurrent zone access when a zone event (zone file load, refresh,
-   DNSSEC signing, dynamic update) is in progress or pending. In such a case
-   zone events must be frozen before. For more information on how to freeze the
-   zone read :ref:`Editing zone file`.
+   Avoid concurrent zone access from a third party software when a zone event
+   (zone file load, refresh, DNSSEC signing, dynamic update) is in progress or
+   pending. In such a case, zone events must be frozen before. For more
+   information on how to freeze the zone read :ref:`Editing zone file`.
 
 To get contents of all configured zones, or a specific zone contents, or zone
 records with a specific owner, or even with a specific record type::
@@ -270,9 +277,9 @@ Reading and editing the zone file safely
 ========================================
 
 It's always possible to read and edit zone contents via zone file manipulation.
-It may lead to confusion, however, if the zone contents are continuously being
-changed by DDNS, DNSSEC signing and the like. In such a case, the safe way to
-modify the zone file is to freeze zone events first::
+It may lead to confusion or even a :ref:`program crash<Bus error>`, however, if
+the zone contents are continuously being changed by DDNS, DNSSEC signing and the like.
+In such a case, the safe way to modify the zone file is to freeze zone events first::
 
     $ knotc -b zone-freeze example.com.
     $ knotc -b zone-flush example.com.
@@ -419,6 +426,9 @@ only stored in the journal.
    current SOA serial in the zone (not in the zone file) if manually updated!
    This is important to ensure consistency of the journal and outgoing IXFR.
 
+.. NOTE::
+   This mode is not suitable if the zone can be modified externally (e.g. DDNS, knotc).
+
 Example 4
 ---------
 
@@ -436,6 +446,9 @@ the information about the last real SOA serial is preserved in case of server re
 The sizing of journal limits needs to be taken into consideration
 (see :ref:`Journal behaviour`).
 
+.. NOTE::
+   This mode is not suitable if the zone can be modified externally (e.g. DDNS, knotc).
+
 .. _Zone bootstrap:
 
 Zone bootstrapping on secondary
@@ -583,8 +596,8 @@ Automatic KSK and ZSK rollovers example
 
 Let's start with the following set of keys::
 
-  2021-05-10T20:50:00+0200 info: [example.com.] DNSSEC, key, tag 50613, algorithm ECDSAP256SHA256, KSK, public, active
-  2021-05-10T20:50:00+0200 info: [example.com.] DNSSEC, key, tag 62932, algorithm ECDSAP256SHA256, public, active
+  2024-02-14T15:20:00+0100 info: [example.com.] DNSSEC, key, tag 53594, algorithm ECDSAP256SHA256, KSK, public, active
+  2024-02-14T15:20:00+0100 info: [example.com.] DNSSEC, key, tag 36185, algorithm ECDSAP256SHA256, public, active
 
 The last fields hint the key state: ``public`` denotes a key that will be presented
 as the DNSKEY record, ``ready`` means that CDS/CDNSKEY records were created,
@@ -610,115 +623,121 @@ For demonstration purposes, the following configuration is used::
 Upon the zone's KSK lifetime expiration, a new KSK is generated and the rollover
 continues along the lines of :rfc:`6781#section-4.1.2`::
 
-  # KSK Rollover (50613 -> 9081)
+  # KSK Rollover (53594 -> 3375)
 
-  2021-05-10T20:50:00+0200 info: [example.com.] DNSSEC, signing zone
-  2021-05-10T20:50:00+0200 info: [example.com.] DNSSEC, KSK rollover started
-  2021-05-10T20:50:00+0200 info: [example.com.] DNSSEC, key, tag 50613, algorithm ECDSAP256SHA256, KSK, public, active
-  2021-05-10T20:50:00+0200 info: [example.com.] DNSSEC, key, tag 62932, algorithm ECDSAP256SHA256, public, active
-  2021-05-10T20:50:00+0200 info: [example.com.] DNSSEC, key, tag  9081, algorithm ECDSAP256SHA256, KSK, public, active+
-  2021-05-10T20:50:00+0200 info: [example.com.] DNSSEC, signing started
-  2021-05-10T20:50:00+0200 info: [example.com.] DNSSEC, successfully signed
-  2021-05-10T20:50:00+0200 info: [example.com.] DNSSEC, next signing at 2021-05-10T20:50:12+0200
+  2024-02-14T15:20:00+0100 info: [example.com.] DNSSEC, signing zone
+  2024-02-14T15:20:00+0100 info: [example.com.] DNSSEC, KSK rollover started
+  2024-02-14T15:20:00+0100 info: [example.com.] DNSSEC, next key action, KSK tag 3375, submit at 2024-02-14T15:20:12+0100
+  2024-02-14T15:20:00+0100 info: [example.com.] DNSSEC, key, tag 53594, algorithm ECDSAP256SHA256, KSK, public, active
+  2024-02-14T15:20:00+0100 info: [example.com.] DNSSEC, key, tag 36185, algorithm ECDSAP256SHA256, public, active
+  2024-02-14T15:20:00+0100 info: [example.com.] DNSSEC, key, tag  3375, algorithm ECDSAP256SHA256, KSK, public, active+
+  2024-02-14T15:20:00+0100 info: [example.com.] DNSSEC, signing started
+  2024-02-14T15:20:00+0100 info: [example.com.] DNSSEC, successfully signed, serial 2010111204
+  2024-02-14T15:20:00+0100 info: [example.com.] DNSSEC, next signing at 2024-02-14T15:20:12+0100
 
   ... (propagation-delay + dnskey-ttl) ...
 
-  2021-05-10T20:50:12+0200 info: [example.com.] DNSSEC, signing zone
-  2021-05-10T20:50:12+0200 notice: [example.com.] DNSSEC, KSK submission, waiting for confirmation
-  2021-05-10T20:50:12+0200 info: [example.com.] DNSSEC, key, tag 50613, algorithm ECDSAP256SHA256, KSK, public, active
-  2021-05-10T20:50:12+0200 info: [example.com.] DNSSEC, key, tag 62932, algorithm ECDSAP256SHA256, public, active
-  2021-05-10T20:50:12+0200 info: [example.com.] DNSSEC, key, tag  9081, algorithm ECDSAP256SHA256, KSK, public, ready, active+
-  2021-05-10T20:50:12+0200 info: [example.com.] DNSSEC, signing started
-  2021-05-10T20:50:12+0200 info: [example.com.] DNSSEC, successfully signed
-  2021-05-10T20:50:12+0200 info: [example.com.] DNSSEC, next signing at 2021-05-17T20:49:56+0200
+  2024-02-14T15:20:12+0100 info: [example.com.] DNSSEC, signing zone
+  2024-02-14T15:20:12+0100 notice: [example.com.] DNSSEC, KSK submission, waiting for confirmation
+  2024-02-14T15:20:12+0100 info: [example.com.] DNSSEC, key, tag 53594, algorithm ECDSAP256SHA256, KSK, public, active
+  2024-02-14T15:20:12+0100 info: [example.com.] DNSSEC, key, tag 36185, algorithm ECDSAP256SHA256, public, active
+  2024-02-14T15:20:12+0100 info: [example.com.] DNSSEC, key, tag  3375, algorithm ECDSAP256SHA256, KSK, public, ready, active+
+  2024-02-14T15:20:12+0100 info: [example.com.] DNSSEC, signing started
+  2024-02-14T15:20:12+0100 info: [example.com.] DNSSEC, successfully signed, serial 2010111205
+  2024-02-14T15:20:12+0100 info: [example.com.] DNSSEC, next signing at 2024-02-28T15:19:37+0100
 
 At this point the new KSK has to be submitted to the parent zone. Knot detects the updated parent's DS
 record automatically (and waits for additional period of the DS's TTL before retiring the old key)
 if :ref:`parent DS check<Submission section>` is configured, otherwise the
 operator must confirm it manually (using ``knotc zone-ksk-submitted``)::
 
-  2021-05-10T20:50:12+0200 info: [example.com.] DS check, outgoing, remote 127.0.0.1@5300, KSK submission check: negative
-  2021-05-10T20:50:14+0200 info: [example.com.] DS check, outgoing, remote 127.0.0.1@5300, KSK submission check: negative
-  2021-05-10T20:50:16+0200 info: [example.com.] DS check, outgoing, remote 127.0.0.1@5300, KSK submission check: positive
-  2021-05-10T20:50:16+0200 notice: [example.com.] DNSSEC, KSK submission, confirmed
-  2021-05-10T20:50:16+0200 info: [example.com.] DNSSEC, signing zone
-  2021-05-10T20:50:16+0200 info: [example.com.] DNSSEC, key, tag 50613, algorithm ECDSAP256SHA256, KSK, public, active+
-  2021-05-10T20:50:16+0200 info: [example.com.] DNSSEC, key, tag 62932, algorithm ECDSAP256SHA256, public, active
-  2021-05-10T20:50:16+0200 info: [example.com.] DNSSEC, key, tag  9081, algorithm ECDSAP256SHA256, KSK, public, active
-  2021-05-10T20:50:16+0200 info: [example.com.] DNSSEC, signing started
-  2021-05-10T20:50:16+0200 info: [example.com.] DNSSEC, successfully signed
-  2021-05-10T20:50:16+0200 info: [example.com.] DNSSEC, next signing at 2021-05-10T20:50:23+0200
+  2024-02-14T15:20:12+0100 info: [example.com.] DS check, outgoing, remote 127.0.0.1@5300 TCP, KSK submission check: negative
+  2024-02-14T15:20:14+0100 info: [example.com.] DS check, outgoing, remote 127.0.0.1@5300 TCP/pool, KSK submission check: negative
+  2024-02-14T15:20:16+0100 info: [example.com.] DS check, outgoing, remote 127.0.0.1@5300 TCP/pool, KSK submission check: positive
+  2024-02-14T15:20:16+0100 notice: [example.com.] DNSSEC, KSK submission, confirmed
+  2024-02-14T15:20:16+0100 info: [example.com.] DNSSEC, signing zone
+  2024-02-14T15:20:16+0100 info: [example.com.] DNSSEC, key, tag 53594, algorithm ECDSAP256SHA256, KSK, public, active+
+  2024-02-14T15:20:16+0100 info: [example.com.] DNSSEC, key, tag 36185, algorithm ECDSAP256SHA256, public, active
+  2024-02-14T15:20:16+0100 info: [example.com.] DNSSEC, key, tag  3375, algorithm ECDSAP256SHA256, KSK, public, active
+  2024-02-14T15:20:16+0100 info: [example.com.] DNSSEC, signing started
+  2024-02-14T15:20:16+0100 info: [example.com.] DNSSEC, successfully signed, serial 2010111206
+  2024-02-14T15:20:16+0100 info: [example.com.] DNSSEC, next signing at 2024-02-14T15:20:23+0100
 
   ... (parent's DS TTL is 7 seconds) ...
 
-  2021-05-10T20:50:23+0200 info: [example.com.] DNSSEC, signing zone
-  2021-05-10T20:50:23+0200 info: [example.com.] DNSSEC, key, tag 62932, algorithm ECDSAP256SHA256, public, active
-  2021-05-10T20:50:23+0200 info: [example.com.] DNSSEC, key, tag  9081, algorithm ECDSAP256SHA256, KSK, public, active
-  2021-05-10T20:50:23+0200 info: [example.com.] DNSSEC, signing started
-  2021-05-10T20:50:23+0200 info: [example.com.] DNSSEC, successfully signed
-  2021-05-10T20:50:23+0200 info: [example.com.] DNSSEC, next signing at 2021-05-10T20:51:56+0200
+  2024-02-14T15:20:23+0100 info: [example.com.] DNSSEC, signing zone
+  2024-02-14T15:20:23+0100 info: [example.com.] DNSSEC, next key action, ZSK, generate at 2024-02-14T15:21:54+0100
+  2024-02-14T15:20:23+0100 info: [example.com.] DNSSEC, key, tag 36185, algorithm ECDSAP256SHA256, public, active
+  2024-02-14T15:20:23+0100 info: [example.com.] DNSSEC, key, tag  3375, algorithm ECDSAP256SHA256, KSK, public, active
+  2024-02-14T15:20:23+0100 info: [example.com.] DNSSEC, signing started
+  2024-02-14T15:20:23+0100 info: [example.com.] DNSSEC, successfully signed, serial 2010111207
+  2024-02-14T15:20:23+0100 info: [example.com.] DNSSEC, next signing at 2024-02-14T15:21:54+0100
 
 Upon the zone's ZSK lifetime expiration, a new ZSK is generated and the rollover
 continues along the lines of :rfc:`6781#section-4.1.1`::
 
-  # ZSK Rollover (62932 -> 33255)
+  # ZSK Rollover (36185 -> 38559)
 
-  2021-05-10T20:51:56+0200 info: [example.com.] DNSSEC, signing zone
-  2021-05-10T20:51:56+0200 info: [example.com.] DNSSEC, ZSK rollover started
-  2021-05-10T20:51:56+0200 info: [example.com.] DNSSEC, key, tag 62932, algorithm ECDSAP256SHA256, public, active
-  2021-05-10T20:51:56+0200 info: [example.com.] DNSSEC, key, tag  9081, algorithm ECDSAP256SHA256, KSK, public, active
-  2021-05-10T20:51:56+0200 info: [example.com.] DNSSEC, key, tag 33255, algorithm ECDSAP256SHA256, public
-  2021-05-10T20:51:56+0200 info: [example.com.] DNSSEC, signing started
-  2021-05-10T20:51:56+0200 info: [example.com.] DNSSEC, successfully signed
-  2021-05-10T20:51:56+0200 info: [example.com.] DNSSEC, next signing at 2021-05-10T20:52:08+0200
+  2024-02-14T15:21:54+0100 info: [example.com.] DNSSEC, signing zone
+  2024-02-14T15:21:54+0100 info: [example.com.] DNSSEC, ZSK rollover started
+  2024-02-14T15:21:54+0100 info: [example.com.] DNSSEC, next key action, ZSK tag 38559, replace at 2024-02-14T15:22:06+0100
+  2024-02-14T15:21:54+0100 info: [example.com.] DNSSEC, key, tag 36185, algorithm ECDSAP256SHA256, public, active
+  2024-02-14T15:21:54+0100 info: [example.com.] DNSSEC, key, tag  3375, algorithm ECDSAP256SHA256, KSK, public, active
+  2024-02-14T15:21:54+0100 info: [example.com.] DNSSEC, key, tag 38559, algorithm ECDSAP256SHA256, public
+  2024-02-14T15:21:54+0100 info: [example.com.] DNSSEC, signing started
+  2024-02-14T15:21:54+0100 info: [example.com.] DNSSEC, successfully signed, serial 2010111208
+  2024-02-14T15:21:54+0100 info: [example.com.] DNSSEC, next signing at 2024-02-14T15:22:06+0100
 
   ... (propagation-delay + dnskey-ttl) ...
 
-  2021-05-10T20:52:08+0200 info: [example.com.] DNSSEC, signing zone
-  2021-05-10T20:52:08+0200 info: [example.com.] DNSSEC, key, tag 62932, algorithm ECDSAP256SHA256, public
-  2021-05-10T20:52:08+0200 info: [example.com.] DNSSEC, key, tag  9081, algorithm ECDSAP256SHA256, KSK, public, active
-  2021-05-10T20:52:08+0200 info: [example.com.] DNSSEC, key, tag 33255, algorithm ECDSAP256SHA256, public, active
-  2021-05-10T20:52:08+0200 info: [example.com.] DNSSEC, signing started
-  2021-05-10T20:52:08+0200 info: [example.com.] DNSSEC, successfully signed
-  2021-05-10T20:52:08+0200 info: [example.com.] DNSSEC, next signing at 2021-05-10T20:52:25+0200
+  2024-02-14T15:22:06+0100 info: [example.com.] DNSSEC, signing zone
+  2024-02-14T15:22:06+0100 info: [example.com.] DNSSEC, next key action, ZSK tag 36185, remove at 2024-02-14T15:22:23+0100
+  2024-02-14T15:22:06+0100 info: [example.com.] DNSSEC, key, tag 36185, algorithm ECDSAP256SHA256, public
+  2024-02-14T15:22:06+0100 info: [example.com.] DNSSEC, key, tag  3375, algorithm ECDSAP256SHA256, KSK, public, active
+  2024-02-14T15:22:06+0100 info: [example.com.] DNSSEC, key, tag 38559, algorithm ECDSAP256SHA256, public, active
+  2024-02-14T15:22:06+0100 info: [example.com.] DNSSEC, signing started
+  2024-02-14T15:22:06+0100 info: [example.com.] DNSSEC, successfully signed, serial 2010111209
+  2024-02-14T15:22:06+0100 info: [example.com.] DNSSEC, next signing at 2024-02-14T15:22:23+0100
 
   ... (propagation-delay + zone-max-ttl) ...
 
-  2021-05-10T20:52:25+0200 info: [example.com.] DNSSEC, signing zone
-  2021-05-10T20:52:25+0200 info: [example.com.] DNSSEC, key, tag  9081, algorithm ECDSAP256SHA256, KSK, public, active
-  2021-05-10T20:52:25+0200 info: [example.com.] DNSSEC, key, tag 33255, algorithm ECDSAP256SHA256, public, active
-  2021-05-10T20:52:25+0200 info: [example.com.] DNSSEC, signing started
-  2021-05-10T20:52:25+0200 info: [example.com.] DNSSEC, successfully signed
-  2021-05-10T20:52:25+0200 info: [example.com.] DNSSEC, next signing at 2021-05-10T20:54:08+0200
-  2021-05-10T20:54:08+0200 info: [example.com.] DNSSEC, signing zone
+  2024-02-14T15:22:23+0100 info: [example.com.] DNSSEC, signing zone
+  2024-02-14T15:22:23+0100 info: [example.com.] DNSSEC, next key action, ZSK, generate at 2024-02-14T15:24:06+0100
+  2024-02-14T15:22:23+0100 info: [example.com.] DNSSEC, key, tag  3375, algorithm ECDSAP256SHA256, KSK, public, active
+  2024-02-14T15:22:23+0100 info: [example.com.] DNSSEC, key, tag 38559, algorithm ECDSAP256SHA256, public, active
+  2024-02-14T15:22:23+0100 info: [example.com.] DNSSEC, signing started
+  2024-02-14T15:22:23+0100 info: [example.com.] DNSSEC, successfully signed, serial 2010111210
+  2024-02-14T15:22:23+0100 info: [example.com.] DNSSEC, next signing at 2024-02-14T15:24:06+0100
 
 Further rollovers::
 
   ... (zsk-lifetime - propagation-delay - zone-max-ttl) ...
 
-  # Another ZSK Rollover (33255 -> 49526)
+  # Another ZSK Rollover (38559 -> 59825)
 
-  2021-05-10T20:54:08+0200 info: [example.com.] DNSSEC, signing zone
-  2021-05-10T20:54:08+0200 info: [example.com.] DNSSEC, ZSK rollover started
-  2021-05-10T20:54:08+0200 info: [example.com.] DNSSEC, key, tag  9081, algorithm ECDSAP256SHA256, KSK, public, active
-  2021-05-10T20:54:08+0200 info: [example.com.] DNSSEC, key, tag 33255, algorithm ECDSAP256SHA256, public, active
-  2021-05-10T20:54:08+0200 info: [example.com.] DNSSEC, key, tag 49526, algorithm ECDSAP256SHA256, public
-  2021-05-10T20:54:08+0200 info: [example.com.] DNSSEC, signing started
-  2021-05-10T20:54:08+0200 info: [example.com.] DNSSEC, successfully signed
-  2021-05-10T20:54:08+0200 info: [example.com.] DNSSEC, next signing at 2021-05-10T20:54:20+0200
+  2024-02-14T15:24:06+0100 info: [example.com.] DNSSEC, signing zone
+  2024-02-14T15:24:06+0100 info: [example.com.] DNSSEC, ZSK rollover started
+  2024-02-14T15:24:06+0100 info: [example.com.] DNSSEC, next key action, ZSK tag 59825, replace at 2024-02-14T15:24:18+0100
+  2024-02-14T15:24:06+0100 info: [example.com.] DNSSEC, key, tag  3375, algorithm ECDSAP256SHA256, KSK, public, active
+  2024-02-14T15:24:06+0100 info: [example.com.] DNSSEC, key, tag 38559, algorithm ECDSAP256SHA256, public, active
+  2024-02-14T15:24:06+0100 info: [example.com.] DNSSEC, key, tag 59825, algorithm ECDSAP256SHA256, public
+  2024-02-14T15:24:06+0100 info: [example.com.] DNSSEC, signing started
+  2024-02-14T15:24:06+0100 info: [example.com.] DNSSEC, successfully signed, serial 2010111211
+  2024-02-14T15:24:06+0100 info: [example.com.] DNSSEC, next signing at 2024-02-14T15:24:18+0100
 
   ...
 
-  # Another KSK Rollover (9081 -> 9179)
+  # Another KSK Rollover (3375 -> 50822)
 
-  2021-05-10T20:55:00+0200 info: [example.com.] DNSSEC, signing zone
-  2021-05-10T20:55:00+0200 info: [example.com.] DNSSEC, KSK rollover started
-  2021-05-10T20:55:00+0200 info: [example.com.] DNSSEC, key, tag  9081, algorithm ECDSAP256SHA256, KSK, public, active
-  2021-05-10T20:55:00+0200 info: [example.com.] DNSSEC, key, tag 49526, algorithm ECDSAP256SHA256, public, active
-  2021-05-10T20:55:00+0200 info: [example.com.] DNSSEC, key, tag  9179, algorithm ECDSAP256SHA256, KSK, public, active+
-  2021-05-10T20:55:00+0200 info: [example.com.] DNSSEC, signing started
-  2021-05-10T20:55:00+0200 info: [example.com.] DNSSEC, successfully signed
-  2021-05-10T20:55:00+0200 info: [example.com.] DNSSEC, next signing at 2021-05-10T20:55:12+0200
+  2024-02-14T15:25:00+0100 info: [example.com.] DNSSEC, signing zone
+  2024-02-14T15:25:00+0100 info: [example.com.] DNSSEC, KSK rollover started
+  2024-02-14T15:25:00+0100 info: [example.com.] DNSSEC, next key action, KSK tag 50822, submit at 2024-02-14T15:25:12+0100
+  2024-02-14T15:25:00+0100 info: [example.com.] DNSSEC, key, tag  3375, algorithm ECDSAP256SHA256, KSK, public, active
+  2024-02-14T15:25:00+0100 info: [example.com.] DNSSEC, key, tag 59825, algorithm ECDSAP256SHA256, public, active
+  2024-02-14T15:25:00+0100 info: [example.com.] DNSSEC, key, tag 50822, algorithm ECDSAP256SHA256, KSK, public, active+
+  2024-02-14T15:25:00+0100 info: [example.com.] DNSSEC, signing started
+  2024-02-14T15:25:00+0100 info: [example.com.] DNSSEC, successfully signed, serial 2010111214
+  2024-02-14T15:25:00+0100 info: [example.com.] DNSSEC, next signing at 2024-02-14T15:25:12+0100
 
   ...
 
@@ -1360,6 +1379,7 @@ Pre-requisites
 
     ethtool -K <interface> tx-vlan-offload off rx-vlan-offload off
 
+.. _Mode XDP_optimizations:
 
 Optimizations
 -------------
@@ -1372,6 +1392,8 @@ Some helpful commands::
  ethtool -G <interface> rx <?> tx <?>
  renice -n 19 -p $(pgrep '^ksoftirqd/[0-9]*$')
 
+.. _Mode XDP_limitations:
+
 Limitations
 -----------