diff mbox series

knot: Update to 3.5.7

Message ID 20260818214037.110000-1-matthias.fischer@ipfire.org
State New
Headers
Series knot: Update to 3.5.7 |

Commit Message

Matthias Fischer 18 Aug 2026, 9:40 p.m. UTC 
For details see:
https://www.knot-dns.cz/2026-08-18-version-357.html

"Version 3.5.7

Tuesday, August 18, 2026
Improvements:

        knotd: new debug logging for DDNS prerequisite errors
        knotd: support for SO_BINDTODEVICE for remotes/via #977 (Thanks to Tore Anderson)
        keymgr: 'keystore-bench' is slow with many threads and a high-latency HSM connection
        keymgr: 'keystore-bench' command accepts a filter by signing algorithm
        libs: upgraded embedded libngtcp2 to 1.25.0
        doc: various improvements

Bugfixes:

        knotd: server crash due to a missing check for malformed TCP packet in XDP mode (Thanks to Arthur Chan)
        knotd: server crash when processing XFR or NOTIFY with non-IN records (Thanks to Qifan Zhang)
        knotd: server crash when processing an outbound reply with non-IN records (Thanks to Qifan Zhang)
        knotd: server crash on zone with NSEC3PARAM but without NSEC3 records (Thanks to Qifan Zhang)
        knotd: incorrect ACL address range evaluation (Thanks to Qifan Zhang)
        knotd: assertion failure if zone expire is set to maximum (Thanks to Qifan Zhang)
        knotd: server crash if SOA serial is not increased during IXFR from AXFR processing (Thanks to Qifan Zhang)
        knotd: default 'policy.rrsig-refresh' value not considered for DNSSEC validation
        knotd: missing '0.1 * policy.rrsig_lifetime' part in 'rrsig-refresh' default if 'policy.zone-max-ttl' is set #978
        libknot: defective QUIC stateless-reset handler vulnerable to a crash (Thanks to Arthur Chan and Kushal Das)
        libknot: insufficient check for oversized ECS EDNS option (Thanks to Qifan Zhang)
        libknot: TSIG truncation check not implemented (Thanks to Qifan Zhang)
        libs: inappropriate realloc failure handlings in heap structure
        mod-authsignal: server crash if insertion to packet fails (Thanks to Qifan Zhang)
        mod-authsignal: server crash if zone name contains _dsboot prefix (Thanks to Qifan Zhang)
        mod-dnsproxy: outbound packet insertion error not propagated to client (Thanks to Qifan Zhang)
        mod-onlinesign: server responds with SERVFAIL instead of NOERROR if reply is truncated
        man: incorrect default paths for files, databases and sockets #976"

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
---
 lfs/knot | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
diff mbox series

Patch

diff --git a/lfs/knot b/lfs/knot
index 24c083ea1..caa2a5e01 100644
--- a/lfs/knot
+++ b/lfs/knot
@@ -24,7 +24,7 @@ 
 
 include Config
 
-VER        = 3.5.6
+VER        = 3.5.7
 
 THISAPP    = knot-$(VER)
 DL_FILE    = $(THISAPP).tar.xz
@@ -40,7 +40,7 @@  objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_BLAKE2 = f03a2da9390e89bd7955505d3f59ca54689e2183b1ea0f82efbf5abedd71f16902c6d09f77adceaedd29573d52135c168441dbf46721709b370269220b68f49b
+$(DL_FILE)_BLAKE2 = 820ab9dc28fda30547c3989451f44eff2953b29d746cb2460da9726a627648c1aef69adbc13e7d1d71905c229bda1f36d56cec98b9a00f2f4f3bf27549ebaa0a
 
 install : $(TARGET)