Log message:
knot: Update to 3.3.5

Changelog:
Version 3.3.5

Features:

      + knotd: new module mod-authsignal for automatic authenticated DNSSEC
        bootstrapping records synthesis (Thanks to Peter Thomassen)
      + kzonecheck: new optional ZONEMD verification (see option '-z')

Improvements:

      + knotd: new DNSSEC key rollover log informs about next planned key
        action
      + knotd, kzonecheck: added limit on non-matching keys with a duplicate
        keytag
      + knot-exporter: added counter-type variant for each metric (Thanks to
        Marcel Koch)
      + libs: upgraded embedded libngtcp2 to 1.3.0
      + doc: various fixes and updates

Bugfixes:

      + knotd, kzonecheck: failed to validate RRSIG if there are more keys with
        the same keytag
      + knotd, kzonecheck: failed to validate zone with more CSK keys
      + libknot: insufficient check for malformed TCP header options over XDP
      + libzscanner: incorrect alpn processing #923

Version 3.3.4

Features:

      + knotd: new configuration item for clearing configuration sections (see
        'clear')
      + knotc: configuration import can preserve database contents (see
        '+nopurge' flag)
      + kxdpgun: new parameter for setting UDP payload size in EDNS (see
        '--edns-size') #915

Improvements:

      + knotd: extended configuration check for 'zonefile-load' and
        'journal-content'
      + knotd: lowered check limit for additional NSEC3 iterations to 0
      + knotd: lowered severity level of an informational backup log
      + knotd: better log message when flushing the journal
      + knotd: zone restore checks if requested contents are in the provided
        backup
      + knotc: '+quic' is default for zone backup, '+noquic' is default for
        zone restore
      + kdig: better processing of timeouts and reduced sent datagrams over
        QUIC
      + kdig: no retries are attempted over QUIC
      + keymgr: improved compatibility with bind9-generated keys
      + libs: some improvements in XDP buffer allocation
      + libs: upgraded embedded libngtcp2 to 1.2.0
      + doc: various fixes and updates

Bugfixes:

      + knotd: failed to build on macOS #909
      + knotd: 'nsec3-salt-lifetime: -1' doesn't work if 'ixfr-from-axfr' is
        enabled
      + knotd: unnecessarily updated RRSIGs if 'ixfr-from-axfr' and signing are
        enabled
      + knotc: zone check complains about missing zone file #913
      + kdig: failed to try another target address over QUIC
      + libknot: infinite loop in knot_rrset_to_wire_extra() #916

Log message:
knot: Update to 3.3.3

Changelog:
Version 3.3.3

Wednesday, December 13, 2023

Features:

      + knotd: new 'pattern' mode of ACL update owner matching (see
        'acl.update-owner-match')
      + knotc: new '+keysonly' filter for zone backup/restore

Improvements:

      + knotd: zone purging waits for finished zone expiration for better
        reliability
      + knotd: remote configuration considers more 'via' with the same address
        family
      + knotd: refresh doesn't fall back from IXFR to AXFR upon a network error
      + knotd: increased default for 'policy.rrsig-refresh' by (0.1 *
        'rrsig-lifetime')
      + knotd: new control flag 'u' for unix time output format from zone
        status
      + knotd: extended check for inconsistent acl settings
      + knotd/libknot: simplified TCP/QUIC sweep logging
      + mod-dnsproxy: all configured remote addresses are used for fallback
        operation
      + mod-dnsproxy: module responds locally if forwarding fails instead of
        SERVFAIL
      + libs: upgraded embedded libngtcp2 to 1.1.0
      + doc: various fixes and extensions

Bugfixes:

      + knotd: zone backup fails due to improper backup context
        deinitialization #891
      + knotd: failed to sign the zone if maximum zone's TTL is too high
      + knotd: malformed TCP header if used with QUIC in the generic XDP mode
      + knotd: server can crash when processing new TCP connections over XDP
      + knotd: incorrect initialization of TCP limits
      + knotd: orphaned PEM file not deleted when key generation fails
      + knotd/libknot: connection timeouts over QUIC due to incomplete
        retransfer handling #894
      + kdig: crashed when querying DNS over TLS if TLS handshake times out #
        896
      + kzonecheck: failed to check DS with SHA-1 or GOST if not supported by
        local policy
      + libdnssec: failed to compile with GnuTLS if PKCS #11 support is
        disabled

Log message:
knot: Update to 3.3.2

Changelog:
Version 3.3.2

Friday, October 20, 2023

Features:

      + knotd: support for IXFR from AXFR computation (see
        'zone.ixfr-from-axfr')
      + knotd: support benevolent IXFR (see 'zone.ixfr-benevolent')
      + knot-exporter: new configuration option '--no-zone-serial' #880

Improvements:

      + libs: upgraded embedded libngtcp2 to 1.0.0
      + knotd: added logging of new SOA serial when signing is finished
      + knotd: unified some XDP-related logging
      + keymgr: improved error message if a key file is not accessible
      + keymgr: added offline RRSIGs validation at the end of their validity
        intervals
      + kdig: upgraded EDNS presentation format to draft version -02
      + kdig: simplified QUIC connection without extra PING frames
      + kzonecheck: removed requirement that DS is at delegation point
      + doc: various fixes and improvements

Bugfixes:

      + knotd: logged incorrect new SOA serial if 'zonefile-load: difference'
        is set #875
      + knotd: more signing threads with a PKCS #11 keystore has no effect #876
      + knotd: DNAME record returned with query domain name instead of actual
        name #873
      + knotd: failed to import configuration file if mod-geoip is in use #881
      + knotd: failed to sign RRSet that fits to 64k only if compressed
      + knotd: broken zone update context upon failed operation over control
        interface
      + keymgr: offline RRSIGs not refreshed if 'rrsig-refresh' is not set
      + knsupdate: incorrect processing of @ in the delete operation #879
      + knot-exporter: failed to parse knotd PIDs on FreeBSD

Version 3.2.11

Thursday, October 19, 2023

Improvements:

      + keymgr: improved error message if a key file is not accessible
      + keymgr: added offline RRSIGs validation at the end of their validity
        intervals
      + doc: fixed some typos

Bugfixes:

      + knotd: DNAME record returned with query domain name instead of actual
        name #873
      + knotd: failed to import configuration file if mod-geoip is in use #881
      + knotd: failed to sign RRSet that fits to 64k only if compressed
      + keymgr: offline RRSIGs not refreshed if 'rrsig-refresh' is not set
      + knsupdate: incorrect processing of @ in the delete operation #879

Version 3.3.1

Monday, September 11, 2023

Improvements:

      + knotd: multiple catalog groups per member are tolerated, but only one
        is used
      + modules: added const qualifier to various function parameters #877
        (Thanks to Robert Edmonds)
      + libs: upgraded embedded libngtcp2 to 0.19.1

Bugfixes:

      + knotd: TCP over XDP fails to respond
      + knotd: server can crash when adjusting a wildcard glue
      + knotd: failed to forward DDNS if 'zone.master' points to 'remotes'
      + knotd: broken YAML statistics if more modules are configured #874
      + knotd: DDNS forwarding isn't RFC 8945 compliant

Version 3.2.10

Sunday, September 10, 2023

Improvements:

      + knotd: multiple catalog groups per member are tolerated, but only one
        is used
      + knotd: server cleans up stale LMDB readers when opening a RW
        transaction

Bugfixes:

      + knotd: server can crash when adjusting a wildcard glue
      + knotd: failed to forward DDNS if 'zone.master' points to 'remotes'
      + knotd: subsequent addition and removal to catalog zone isn't handled
        properly
      + knotd: server can crash if a shared module is loaded and dynamic
        configuration used
      + knotc: configuration import fails if an explicit shared module is
        configured
      + kdig: double-free on some malformed responses over QUIC #869
      + kdig: some TLS parameters override QUIC parameters
      + libs: NULL record with empty RDATA isn't allowed

Version 3.3.0

Monday, August 28, 2023

Features:

      + knotd: full DNS over QUIC (DoQ, RFC 9250) implementation, also without
        XDP
      + knotd: bidirectional XFR over QUIC (XoQ) support with opportunistic,
        strict, and mutual authentication profiles
      + knotd: automatic reverse PTR records pre-generation (see
        'zone.reverse-generate')
      + knotd: new per zone statistic counters 'zone.size' and 'zone.max-ttl'
      + knotd: new primary server pinning (see 'zone.master-pin-tolerance')
      + knotd: new SOA serial modulo policy (see 'zone.serial-modulo')
      + knotd: new multi-signer operation mode (see 'policy.dnskey-sync' and
        'DNSSEC multi-signer')
      + kdig: support for EDNS presentation format, also in JSON mode (see
        '+optpresent')
      + kxdpgun: new TCP/QUIC debug mode 'R' for connection reuse
      + kxdpgun: new XDP mode parameter '--mode' (Thanks to Jan V?el??k)
      + kxdpgun: new parameter '--qlog' for qlog destination specification
      + kzonecheck: new '--print' parameter for dumping the zone on stdout

Improvements:

      + knotd: secondary can be configured not to forward DDNS (see
        'zone.ddns-master')
      + knotd: extended support for UNIX socket configuration (remote, acl)
      + knotd: stats no longer dump empty or zero counters
      + knotd: new 'keys-updated' D-Bus event
      + knotd: added transport protocol information to outgoing event and
        nameserver logs
      + knotd: server cleans up stale LMDB readers when opening a RW
        transaction
      + knotd,kzonecheck: semantic check allows DS only at delegation point
      + knotc: new zone backup filters '+quic' and '+noquic' for QUIC key
        backup
      + mod-dnstap: DNS over QUIC traffic is marked as QUIC
      + kxdpgun: QUIC connections are closed by default
      + libs: upgraded embedded libngtcp2 to 0.18.0
      + kdig: QUIC, TLS, or HTTPS protocol is printed in the final statistics
      + doc: new sections 'DNS over QUIC' and 'DNSSEC multi-signer'
      + doc: various improvements

Bugfixes:

      + knotd: server can crash if a shared module is loaded and dynamic
        configuration used
      + knotd: inaccurate transfer size is logged if EDNS EXPIRE, PADDING, or
        TSIG is present
      + knotd: subsequent addition and removal to catalog zone isn't handled
        properly
      + knotc: configuration import fails if an explicit shared module is
        configured
      + utils: database transactions not properly closed when terminated
        prematurely
      + kdig: double-free on some malformed responses over QUIC #869
      + kdig: some TLS parameters override QUIC parameters
      + libs: NULL record with empty RDATA isn't allowed
      + tests: dthreads destructor test sometimes fails

Compatibility:

      + knotd: responses to forwarded DDNS requests are signed with local TSIG
        key
      + knotd: NOTIFY-initiated refresh tries all configured addresses of the
        remote
      + knotd: configuration option 'xdp.quic-log' was replaced with 'log.quic'
      + libs: removed embedded libbpf, an external one is necessary for XDP
      + libs: DNS over QUIC implementation only supports 'doq' ALPN
      + ctl: removed 'Version: ' prefix from 'status version' output
      + modules: reduced parameters of 'knotd_qdata_local_addr()'

Packaging:

      + knot-exporter: Prometheus exporter imported from GitHub
      + knot-exporter: packages for Debian, Ubuntu, and PyPI
      + debian,ubuntu: new self-hosted repository (see https://pkg.labs.nic.cz/
        doc/)
      + docker: upgraded to Debian bookworm-slim

Version 3.2.9

Thursday, July 27, 2023

Improvements:

      + keymgr: 'import-pkcs11' not allowed if no PKCS #11 keystore backend is
        configured
      + keymgr: more verbose key import errors
      + doc: extended migration notes
      + doc: various improvements

Bugfixes:

      + knotd: server may crash when storing changeset of a big zone migrating
        to/from NSEC3
      + knotd: zone refresh loop when all masters are outdated and timers
        cleared
      + knotd: failed to active D-Bus notifications if not started as systemd
        service
      + kjournalprint: database transaction not properly closed when terminated
        prematurely

Log message:
*: recursive bump for icu 74.1

Log message:
*: bump for openssl 3

Log message:
*: recursive bump for Python 3.11 as new default

Log message:
*: Use FORCE_C_STD=c99 for C packages that use for loop initial
declarations without setting -std=c99.

Log message:
knot: Assumes compiler defaults to c99.