Hello Knot users,
We discovered today that When Knot 1.4.0 dumps zones to disk, it
sometimes writes out the dates in RRSIG expiry and inception fields like
this:
20140230203521
Yes, that's apparently 30 February! If you later restart Knot, or reload
it, it will refuse to load this zone, and begin returning REFUSED
responses for it.
I spoke with the good folk at CZNIC, and Marek quickly provided me with
a patch, attached here. It turns off pretty-printing of the dates, so
that the expiry and inception dates are written in unix time. This fixes
the problem for us, so if you're running Knot in production, you may
want to apply this patch too.
We don't yet know where this bug is, but needless to say Marek and his
colleagues are investigating, and I'm sure a proper fix for it will
appear in due course.
Regards,
Anand Buddhdev
RIPE NCC