Changes

5.0.2

  • add new permission to set attributes on pools (#242)

  • fix group_by clause when returning views for a zone (#243)

  • fix moving pools between layer3domains with subnets smaller than /24 (#233)

  • fix missing check if pool is already in target layer3domain (#232)

  • fix missing check to avoid creating A or AAAA records in zone profiles (#238)

  • update dependencies (#248)

5.0.1

  • fix .hex is not a function

  • fix freeing free ip

5.0.0rc4

  • fix collision detection when moving between layer3domains

5.0.0rc3

  • make layer3domain optional for history ipblock (#222)

  • deprecate login_prompt() in dimclient (#182)

5.0.0rc2

  • fix missing /32 entries in list containers (#104)

  • allow NetworkAdmins and DNSAdmins to grant rights to all groups (#171)

  • add option layer3domain to history ipblock (#183)

5.0.0rc1

  • Version String changed due to packaging issues

5.0.0-rc1

  • also bump dimclient-lib to 1.0.0-rc1 and ndcli to 5.0.0-rc1

  • dimclient removed feature script_client

  • ndcli now understands the Environment variables NDCLI_USERNAME, NDCLI_SERVER, NDCLI_CONFIG, NDCLI_COOKIEPATH, NDCLI_LAYER3DOMAIN (see man page)

  • default layer3domain can be set in .ndclirc

  • add option to view all containers in all layer3domains

  • adjust error message when deleting a layer3domain

  • migrate to ldap3 python library

  • allow modifying the type of layer3domains

  • make layer3domain rd option optional

  • do not allow layer3domain named all

  • fix ldap_sync and ldap_auth for ldap3

  • allow unsetting the owning group of pools

  • dimclient: fix username prompt on Python 3

  • minor fixes to testsuite

  • add ldapsync dryrun and delete limit option

  • support running on python3.6

  • DIM Server process configfile can now be passed by ENV DIM_CONFIG

4.0.9

  • restore old behavoir and send http status 403 on reject request

4.0.8

  • avoid conversion to float

4.0.7

  • .hex is now an attribute

  • port sort order fixes to rr_list2

  • disable sqlalchemy speedup hack for query.count()

4.0.6

  • pin Flask and dependencies to specific, working versions

4.0.5

  • remove global option bigint_as_string (Flask 2.x)

4.0.x — * change code to work on Python3 * update dependencies like Flask, sqlalchemy, mysql driver to latest * dim, ndcli - add attribute output to list pools

3.0

API Changes:

  • Most ip-related function calls now also have a layer3domain option.

2.11.0

  • GPHDIM-513 SRV target can be a NS record

  • pdns-output bugfixes and optimizations

  • GPHDOMDEV-1260 Fix ldap_sync deleting departments on ldap errors/timeouts

  • GPHDIM-378 listing reverse zones fails when a rr name looks like an invalid IP

  • GPHDIM-261 ndcli history zone <U> must list grant and revoke rights events

API Changes:

  • Timestamps returned by the API can include microseconds.

  • GPHDIM-432 Creating subnets without a pool is not allowed

  • Added zone_create and zone_admin rights. Deleted manage_forward_zones, modify_zone_group and manage_zone_views rights.

Migration procedure:

  • Run manage_db migrate_pdns_databases in order to set for each output records.rev_name to reverse(records.name).

2.10.0

API Changes:

2.9.4

  • GPHDIM-443 pdns-output.jar: Fix update_soa overwriting all rrs in the zone

2.9.3

2.9.2

  • Only dns_admin are able to run registrar actions

  • Cleanup rights when deleting a zone-group

  • GPHDIM-400 Fix code trying to select from the zonealias table

  • GPHDIM-270 Fix incorrectly updating ip parent with a different ip version ipblock

2.9.1

  • DIM-346 migration does not work well at live DIM size

  • DIM-347 Migration merges _sign outputs with their non-sign counterparts

  • manage_db upgrade now uses the mysql client.

  • GPHDIM-356 Update jdnssec-tools version

  • GPHDIM-357 pdns-output.jar: configure logging

  • GPHDIM-354 Retry transactions if they fail with deadlock-related mysql errors

  • GPHDIM-364 Recreate all DNSKEY rrs at resign

  • GPHDIM-365 Don’t try to sign without zsks

  • GPHDIM-377 Fix update_validity

  • GPHDIM-375 Don’t hold the lock while generating zone keys

  • GPHDIM-379 Parallelize DNSSEC whole zone signing

  • GPHDIM-387 Configurable max size of sql queries

  • GPHDIM-358 Faster RSA in pdns-output using libgmp

  • pdns-output bugfixes and optimizations

  • rr_list(): Fixed not returning @ records when using the limit option

2.9.0

  • Output plugin pdns-sign-agent was merged with the reimplemented pdns-db output plugin.

  • DIM-200 Framework for uploading KSKs to the autodns3 registrar (see autodns3 registrar).

  • DIM-270 Script for resigning zones (see manage_dim update_validity).

  • DIM-271 Automatically create DS records in DIM managed parent zones.

  • DIM-313 Fix limit option in ndcli history user.

  • DIM-263 DS record type

  • History for DNSSEC events

  • Fixed manage_dim rebuild_tree

API Changes:

Database schema changed version from 9 to 10. Lossless rollback is not possible because the migration scripts delete the zone-alias, softhsm, pdns-sign and pdns-slave related information from the database.

Migration procedure:

1. Run the usual manage_db upgrade to update the database schema. This will convert pdns-sign-agent outputs to pdns-db by setting db_uri to the previous pdns_slave_db_uri.

2. For importing private keys into the dim database a modified version of SoftHSMv2 generates SQL statements:

softhsm2-util --export --slot 0 --pin 1234 > private_keys.sql

  1. To complete the data migration:

  • Zone aliases must be deleted and re-created as zones.

  • The new signing algorithm doesn’t use NSEC3 opt-out so all zones must have the NSEC3 opt-out bit set to 0.

  • AAAA/TLSA records from all ouputs need to be adjusted to prevent any problems with deleting rrs.

To fix all of these issues and resign the zones run:

manage_db migrate_new_pdns

2.8.0

  • LDAP-related functionality was rewritten for the new zone and pool ownership feature.

API Changes:

Configuration changes:

  • New options: LDAP_USER_BASE, LDAP_DEPARTMENT_BASE

  • Removed options: LDAP_SYNC_BASE, LDAP_SYNC_FILTER

Database schema changed version from 8 to 9.

2.7.0

  • DIM-224 - If a user is added to a user-group again a confusing error message is displayed

  • DIM-226, DIM-236 - pdns_sign_agent: ‘MySQL server has gone away’ not handled

  • DIM-235 - DIM accepts broken content for certain recordtypes

  • DIM-126 - Permission bug: ndcli modify zone mailcore.server.lan set attrs comment:foo

  • DIM-195 - a zone-group must not be shared among pdns-sign-agent outputs and pdns-db/bind outputs

  • DIM-204 - CIDR notation on the comandline should be rounded to the next valid container configured in DIM

2.6.1

  • DNSSEC technical concept in the documentation

2.6.0

  • DIM-100 Numerical sorting for reverse zones in ndcli list zone

  • DIM-119 New Unmanaged status for ips which don’t have a top level container

  • DIM-142 Fix auditing information in ndcli history group and ndcli history user

  • DIM-173 Dynamic LDAP-based group-names

  • DIM-203 A subnet must always have a container as a parent

2.5.1

  • Fixed pdns_sign_agent with multiple outputs.

2.5.0

  • New output plugin pdns-sign-agent for DNSSEC

  • PDNS signing agent (manage_dim pdns_sign_agent)

  • Softhsm2 agent (manage_dim softshm_agent)

  • Script for initiating AXFRs for all zones of a pdns-sign-agent output (manage_dim pdns_sign_agent_transfer)

  • SSHFP record type (DIM-6)

  • TLSA record type (DIM-127)

API Changes:

2.4.0

  • Fixed duplicate zone output updates when creating subzones (DIM-93)

  • Added the rights delete_reverse_zone and delete_rr on all zones for network admins (DIM-106)

  • Automatic reservation of the first address for IPv6 subnets (DIM-26)

  • ndcli list pool rights (DIM-4)

  • ndcli list zone rights (DIM-22)

  • Fixed warn-flag in dim-report script (DIM-92)

  • Changed the error message for modify rr (DIM-80)

  • The underscore character is no longer special in wildcards

API Changes:

2.3.2

  • Delete pool display a waring when still contains subnets (DIM-75)

  • Fix rights and output-queue inheritance feature for new subzone (DIM-93)

2.3.1

  • SOA record changes will require dns_admin rights (DIM-11)

  • zone_list(): Fix option exclude_reverse

2.3

  • Performance improvement for pdns soa update (ND-98).

  • Fix rr_create(type=’PTR’, create_linked=False) pointing to a CNAME (ND-100).

  • Don’t create IPv6 rev zones smaller than /64 (ND-96).

  • Record tool & ip of requests (ND-102).

  • Added manage_dim sync_ldap command (ND-103).

API Changes:

2.2.1

  • Modifying the ttl of a zoneview gets reflected in pdns (ND-83).

  • Subzones inherit rights/zone-group membership from parents (ND-84).

  • Validate zone alias name (ND-87).

  • Fix begin and end options for some history api calls.

  • ippool_add_subnet() succeeds even if some ip reserving fails (ND-94).

  • Fix pdns blocking outputs (ND-76).

2.2

2.1.1

2.1

  • If an A/AAAA record targets to space outside the ip pools, the network_admin right is not necessary (fixes ND-58).

  • Fix bugs in ip_list() and rr_create_from_pool().

  • Change ip free behavior: delete all rrs that reference the ip.

  • DIM must receive dns character-strings as input (old behavior was to escapify the strings received).

  • Support for DIM Frontend.

  • Issue error when trying to delete inexistent rr.

  • Improved error message for zone create.

  • Fix unicode rr parameters validation.

  • Comments accept unicode values.

  • Fix rr names in messages.

  • Don’t accept rr CERT if the certificate field has spaces.

  • Bugfixes for dns functions.

API Changes:

2.0

  • DNS functionality.

API Changes:

1.0.6

  • Fixed the --warning parameter for the pool report.

1.0.5

API Changes:

1.0.4

  • Performance improvements, especially for IPv6.

  • Changes in user rights are applied immediately (re-login no longer required).

  • Users with the network_admin right can set container attributes (fixes ND-32).

  • Setting the ip ipblock attribute is no longer allowed (fixes ND-31).

  • Custom attributes starting with - are no longer allowed.

  • Fixed two allocator bugs.

  • Configurable template for pool_report.

  • db_upgrade and db_check scripts.

API Changes: