diff --git a/contrib/bind9/CHANGES b/contrib/bind9/CHANGES
index 80ac38a8b27e..3e48dd639434 100644
--- a/contrib/bind9/CHANGES
+++ b/contrib/bind9/CHANGES
@@ -1,28 +1,60 @@
- --- 9.8.0-P4 released ---
+ --- 9.8.1 released ---
-3124. [bug] Use an rdataset attribute flag to indicate
- negative-cache records rather than using rrtype 0;
- this will prevent problems when that rrtype is
- used in actual DNS packets. [RT #24777]
+ --- 9.8.1rc1 released ---
- --- 9.8.0-P3 released (withdrawn) ---
+3141. [bug] Silence spurious "zone serial (0) unchanged" messages
+ associated with empty zones. [RT #25079]
+
+3138. [bug] Address memory leaks and out-of-order operations when
+ shutting named down. [RT #25210]
+
+3136. [func] Add RFC 1918 reverse zones to the list of built-in
+ empty zones switched on by the 'empty-zones-enable'
+ option. [RT #24990]
+
+ Note: empty-zones-enable must be "yes;" or a empty
+ zone needs to be disabled in named.conf for RFC 1918
+ zones to be activated. This requirement may be
+ removed in future releases.
+
+3135. [port] FreeBSD: workaround broken IPV6_USE_MIN_MTU processing.
+ See http://www.freebsd.org/cgi/query-pr.cgi?pr=158307
+ [RT #24950]
+
+3134. [bug] Improve the accuracy of dnssec-signzone's signing
+ statistics. [RT #16030]
+
+ --- 9.8.1b3 released ---
+
+3133. [bug] Change #3114 was incomplete. [RT #24577]
+
+3131. [tuning] Improve scalability by allocating one zone task
+ per 100 zones at startup time, rather than using a
+ fixed-size task table. [RT #24406]
+
+3129. [bug] Named could crash on 'rndc reconfig' when
+ allow-new-zones was set to yes and named ACLs
+ were used. [RT #22739]
+
+ --- 9.8.1b2 released ---
3126. [security] Using DNAME record to generate replacements caused
- RPZ to exit with a assertion failure. [RT #23766]
+ RPZ to exit with a assertion failure. [RT #24766]
3125. [security] Using wildcard CNAME records as a replacement with
RPZ caused named to exit with a assertion failure.
[RT #24715]
+3124. [bug] Use an rdataset attribute flag to indicate
+ negative-cache records rather than using rrtype 0;
+ this will prevent problems when that rrtype is
+ used in actual DNS packets. [RT #24777]
+
3123. [security] Change #2912 exposed a latent flaw in
dns_rdataset_totext() that could cause named to
crash with an assertion failure. [RT #24777]
-3115. [bug] Named could fail to return requested data when
- following a CNAME that points into the same zone.
- [RT #2445]
-
- --- 9.8.0-P2 released ---
+3122. [cleanup] dnssec-settime: corrected usage message. [RT #24664]
3121. [security] An authoritative name server sending a negative
response containing a very large RRset could
@@ -33,12 +65,256 @@
that validated insecure without using DLV and had
DS records in the parent zone. [RT #24631]
- --- 9.8.0-P1 released ---
+3119. [bug] When rolling to a new DNSSEC key, a private-type
+ record could be created and never marked complete.
+ [RT #23253]
+
+3118. [bug] nsupdate could dump core on shutdown when using
+ SIG(0) keys. [RT #24604]
+
+3117. [cleanup] Remove doc and parser references to the
+ never-implemented 'auto-dnssec create' option.
+ [RT #24533]
+
+3115. [bug] Named could fail to return requested data when
+ following a CNAME that points into the same zone.
+ [RT #24455]
+
+3114. [bug] Retain expired RRSIGs in dynamic zones if key is
+ inactive and there is no replacement key. [RT #23136]
+
+3113. [doc] Document the relationship between serial-query-rate
+ and NOTIFY messages.
+
+ --- 9.8.1b1 released ---
+
+3112. [doc] Add missing descriptions of the update policy name
+ types "ms-self", "ms-subdomain", "krb5-self" and
+ "krb5-subdomain", which allow machines to update
+ their own records, to the BIND 9 ARM.
+
+3111. [bug] Improved consistency checks for dnssec-enable and
+ dnssec-validation, added test cases to the
+ checkconf system test. [RT #24398]
+
+3110. [bug] dnssec-signzone: Wrong error message could appear
+ when attempting to sign with no KSK. [RT #24369]
+
+3107. [bug] dnssec-signzone: Report the correct number of ZSKs
+ when using -x. [RT #20852]
+
+3105. [bug] GOST support can be suppressed by "configure
+ --without-gost" [RT #24367]
+
+3104. [bug] Better support for cross-compiling. [RT #24367]
+
+3103. [bug] Configuring 'dnssec-validation auto' in a view
+ instead of in the options statement could trigger
+ an assertion failure in named-checkconf. [RT #24382]
+
+3101. [bug] Zones using automatic key maintenance could fail
+ to check the key repository for updates. [RT #23744]
3100. [security] Certain response policy zone configurations could
trigger an INSIST when receiving a query of type
RRSIG. [RT #24280]
+3099. [test] "dlz" system test now runs but gives R:SKIPPED if
+ not compiled with --with-dlz-filesystem. [RT #24146]
+
+3098. [bug] DLZ zones were answering without setting the AA bit.
+ [RT #24146]
+
+3097. [test] Add a tool to test handling of malformed packets.
+ [RT #24096]
+
+3096. [bug] Set KRB5_KTNAME before calling log_cred() in
+ dst_gssapi_acceptctx(). [RT #24004]
+
+3095. [bug] Handle isolated reserved ports in the port range.
+ [RT #23957]
+
+3094. [doc] Expand dns64 documentation.
+
+3093. [bug] Fix gssapi/kerberos dependencies [RT #23836]
+
+3092. [bug] Signatures for records at the zone apex could go
+ stale due to an incorrect timer setting. [RT #23769]
+
+3091. [bug] Fixed a bug in which zone keys that were published
+ and then subsequently activated could fail to trigger
+ automatic signing. [RT #22911]
+
+3090. [func] Make --with-gssapi default [RT #23738]
+
+3088. [bug] Remove bin/tests/system/logfileconfig/ns1/named.conf
+ and add setup.sh in order to resolve changing
+ named.conf issue. [RT #23687]
+
+3087. [bug] DDNS updates using SIG(0) with update-policy match
+ type "external" could cause a crash. [RT #23735]
+
+3086. [bug] Running dnssec-settime -f on an old-style key will
+ now force an update to the new key format even if no
+ other change has been specified, using "-P now -A now"
+ as default values. [RT #22474]
+
+3083. [bug] NOTIFY messages were not being sent when generating
+ a NSEC3 chain incrementally. [RT #23702]
+
+3082. [port] strtok_r is threads only. [RT #23747]
+
+3081. [bug] Failure of DNAME substitution did not return
+ YXDOMAIN. [RT #23591]
+
+3080. [cleanup] Replaced compile time constant by STDTIME_ON_32BITS.
+ [RT #23587]
+
+3079. [bug] Handle isc_event_allocate failures in t_tasks.
+ [RT #23572]
+
+3078. [func] Added a new include file with function typedefs
+ for the DLZ "dlopen" driver. [RT #23629]
+
+3077. [bug] zone.c:zone_refreshkeys() incorrectly called
+ dns_zone_attach(), use zone->irefs instead. [RT #23303]
+
+3075. [bug] dns_dnssec_findzonekeys{2} used a inconsistant
+ timestamp when determining which keys are active.
+ [RT #23642]
+
+3074. [bug] Make the adb cache read through for zone data and
+ glue learn for zone named is authoritative for.
+ [RT #22842]
+
+3073. [bug] managed-keys changes were not properly being recorded.
+ [RT #20256]
+
+3072. [bug] dns_dns64_aaaaok() potential NULL pointer dereference.
+ [RT #20256]
+
+3071. [bug] has_nsec could be used unintialised in
+ update.c:next_active. [RT #20256]
+
+3070. [bug] dnssec-signzone potential NULL pointer dereference.
+ [RT #20256]
+
+3069. [cleanup] Silence warnings messages from clang static analysis.
+ [RT #20256]
+
+3068. [bug] Named failed to build with a OpenSSL without engine
+ support. [RT #23473]
+
+3067. [bug] ixfr-from-differences {master|slave}; failed to
+ select the master/slave zones. [RT #23580]
+
+3066. [func] The DLZ "dlopen" driver is now built by default,
+ no longer requiring a configure option. To
+ disable it, use "configure --without-dlopen".
+ (Note: driver not supported on win32.) [RT #23467]
+
+3065. [bug] RRSIG could have time stamps too far in the future.
+ [RT #23356]
+
+3064. [bug] powerpc: add sync instructions to the end of atomic
+ operations. [RT #23469]
+
+3063. [contrib] More verbose error reporting from DLZ LDAP. [RT #23402]
+
+3059. [test] Added a regression test for change #3023.
+
+3058. [bug] Cause named to terminate at startup or rndc reconfig/
+ reload to fail, if a log file specified in the conf
+ file isn't a plain file. [RT #22771]
+
+3057. [bug] "rndc secroots" would abort after the first error
+ and so could miss some views. [RT #23488]
+
+3054. [bug] Added elliptic curve support check in
+ GOST OpenSSL engine detection. [RT #23485]
+
+3053. [bug] Under a sustained high query load with a finite
+ max-cache-size, it was possible for cache memory
+ to be exhausted and not recovered. [RT #23371]
+
+3052. [test] Fixed last autosign test report. [RT #23256]
+
+3051. [bug] NS records obsure DNAME records at the bottom of the
+ zone if both are present. [RT #23035]
+
+3050. [bug] The autosign system test was timing dependent.
+ Wait for the initial autosigning to complete
+ before running the rest of the test. [RT #23035]
+
+3049. [bug] Save and restore the gid when creating creating
+ named.pid at startup. [RT #23290]
+
+3048. [bug] Fully separate view key mangement. [RT #23419]
+
+3047. [bug] DNSKEY NODATA responses not cached fixed in
+ validator.c. Tests added to dnssec system test.
+ [RT #22908]
+
+3046. [bug] Use RRSIG original TTL to compute validated RRset
+ and RRSIG TTL. [RT #23332]
+
+3044. [bug] Hold the socket manager lock while freeing the socket.
+ [RT #23333]
+
+3043. [test] Merged in the NetBSD ATF test framework (currently
+ version 0.12) for development of future unit tests.
+ Use configure --with-atf to build ATF internally
+ or configure --with-atf=prefix to use an external
+ copy. [RT #23209]
+
+3042. [bug] dig +trace could fail attempting to use IPv6
+ addresses on systems with only IPv4 connectivity.
+ [RT #23297]
+
+3041. [bug] dnssec-signzone failed to generate new signatures on
+ ttl changes. [RT #23330]
+
+3040. [bug] Named failed to validate insecure zones where a node
+ with a CNAME existed between the trust anchor and the
+ top of the zone. [RT #23338]
+
+3038. [bug] Install . [RT #23342]
+
+3037. [doc] Update COPYRIGHT to contain all the individual
+ copyright notices that cover various parts.
+
+3036. [bug] Check built-in zone arguments to see if the zone
+ is re-usable or not. [RT #21914]
+
+3035. [cleanup] Simplify by using strlcpy. [RT #22521]
+
+3034. [cleanup] nslookup: use strlcpy instead of safecopy. [RT #22521]
+
+3033. [cleanup] Add two INSIST(bucket != DNS_ADB_INVALIDBUCKET).
+ [RT #22521]
+
+3032. [bug] rdatalist.c: add missing REQUIREs. [RT #22521]
+
+3031. [bug] dns_rdataclass_format() handle a zero sized buffer.
+ [RT #22521]
+
+3030. [bug] dns_rdatatype_format() handle a zero sized buffer.
+ [RT #22521]
+
+3029. [bug] isc_netaddr_format() handle a zero sized buffer.
+ [RT #22521]
+
+3028. [bug] isc_sockaddr_format() handle a zero sized buffer.
+ [RT #22521]
+
+3027. [bug] Add documented REQUIREs to cfg_obj_asnetprefix() to
+ catch NULL pointer dereferences before they happen.
+ [RT #22521]
+
+3026. [bug] lib/isc/httpd.c: check that we have enough space
+ after calling grow_headerspace() and if not
+ re-call grow_headerspace() until we do. [RT #22521]
+
--- 9.8.0 released ---
3025. [bug] Fixed a possible deadlock due to zone resigning.
@@ -51,8 +327,8 @@
receiving multiple AXFR response messages that were
not all TSIG-signed. [RT #23254]
-3022. [bug] Fixed rpz SERVFAILs after failed zone transfers
- [RT #23246]
+3022. [bug] Fixed rpz SERVFAILs after failed zone transfers
+ [RT #23246]
3021. [bug] Change #3010 was incomplete. [RT #22296]
@@ -86,7 +362,7 @@
'resolver-query-timeout' option, which specifies a max
time in seconds. 0 means 'default' and anything longer
than 30 will be silently set to 30. [RT #22852]
-
+
3010. [bug] Fixed a bug where "rndc reconfig" stopped the timer
for refreshing managed-keys. [RT #22296]
@@ -436,7 +712,7 @@
2927. [placeholder]
2926. [placeholder]
-h
+
2925. [bug] Named failed to accept uncachable negative responses
from insecure zones. [RT# 21555]
@@ -495,7 +771,7 @@ h
2905. [port] aix: set use_atomic=yes with native compiler.
[RT #21402]
-2904. [bug] When using DLV, sub-zones of the zones in the DLV,
+2904. [bug] When using DLV, sub-zones of the zones in the DLV,
could be incorrectly marked as insecure instead of
secure leading to negative proofs failing. This was
a unintended outcome from change 2890. [RT# 21392]
@@ -783,7 +1059,7 @@ h
[RT #20710]
2812. [bug] Make sure updates can't result in a zone with
- NSEC-only keys and NSEC3 records. [RT 20748]
+ NSEC-only keys and NSEC3 records. [RT #20748]
2811. [cleanup] Add "rndc sign" to list of commands in rndc usage
output. [RT #20733]
@@ -864,7 +1140,7 @@ h
2790. [bug] Handle DS queries to stub zones. [RT #20440]
-2789. [bug] Fixed an INSIST in dispatch.c [RT #20576]
+2789. [bug] Fixed an INSIST in dispatch.c [RT #20576]
2788. [bug] dnssec-signzone could sign with keys that were
not requested [RT #20625]
@@ -1760,7 +2036,7 @@ h
2529. [cleanup] Upgrade libtool to silence complaints from recent
version of autoconf. [RT #18657]
-2528. [cleanup] Silence spurious configure warning about
+2528. [cleanup] Silence spurious configure warning about
--datarootdir [RT #19096]
2527. [placeholder]
@@ -2045,13 +2321,13 @@ h
2441. [bug] isc_radix_insert() could copy radix tree nodes
incompletely. [RT #18573]
-2440. [bug] named-checkconf used an incorrect test to determine
+2440. [bug] named-checkconf used an incorrect test to determine
if an ACL was set to none.
-2439. [bug] Potential NULL dereference in dns_acl_isanyornone().
+2439. [bug] Potential NULL dereference in dns_acl_isanyornone().
[RT #18559]
-2438. [bug] Timeouts could be logged incorrectly under win32.
+2438. [bug] Timeouts could be logged incorrectly under win32.
2437. [bug] Sockets could be closed too early, leading to
inconsistent states in the socket module. [RT #18298]
@@ -2065,7 +2341,7 @@ h
2433. [tuning] Set initial timeout to 800ms.
-2432. [bug] More Windows socket handling improvements. Stop
+2432. [bug] More Windows socket handling improvements. Stop
using I/O events and use IO Completion Ports
throughout. Rewrite the receive path logic to make
it easier to support multiple simultaneous
@@ -2100,7 +2376,7 @@ h
epoll and /dev/poll to be selected at compile
time. [RT #18277]
-2423. [security] Randomize server selection on queries, so as to
+2423. [security] Randomize server selection on queries, so as to
make forgery a little more difficult. Instead of
always preferring the server with the lowest RTT,
pick a server with RTT within the same 128
@@ -2114,7 +2390,7 @@ h
Use caution: this option may not work for some
operating systems without rebuilding named.
-2420. [bug] Windows socket handling cleanup. Let the io
+2420. [bug] Windows socket handling cleanup. Let the io
completion event send out canceled read/write
done events, which keeps us from writing to memory
we no longer have ownership of. Add debugging
@@ -2436,8 +2712,8 @@ h
2316. [port] Missing #include in lib/dns/gssapictx.c.
[RT #17513]
-2315. [bug] Used incorrect address family for mapped IPv4
- addresses in acl.c. [RT #17519]
+2315. [bug] Used incorrect address family for mapped IPv4
+ addresses in acl.c. [RT #17519]
2314. [bug] Uninitialized memory use on error path in
bin/named/lwdnoop.c. [RT #17476]
@@ -2448,14 +2724,14 @@ h
2312. [cleanup] Silence Coverity warning in lib/isc/unix/socket.c.
[RT #17458]
-2311. [bug] IPv6 addresses could match IPv4 ACL entries and
- vice versa. [RT #17462]
+2311. [bug] IPv6 addresses could match IPv4 ACL entries and
+ vice versa. [RT #17462]
2310. [bug] dig, host, nslookup: flush stdout before emitting
debug/fatal messages. [RT #17501]
-2309. [cleanup] Fix Coverity warnings in lib/dns/acl.c and iptable.c.
- [RT #17455]
+2309. [cleanup] Fix Coverity warnings in lib/dns/acl.c and iptable.c.
+ [RT #17455]
2308. [cleanup] Silence Coverity warning in bin/named/controlconf.c.
[RT #17495]
@@ -2507,7 +2783,7 @@ h
2292. [bug] Log if the working directory is not writable.
[RT #17312]
-2291. [bug] PR_SET_DUMPABLE may be set too late. Also report
+2291. [bug] PR_SET_DUMPABLE may be set too late. Also report
failure to set PR_SET_DUMPABLE. [RT #17312]
2290. [bug] Let AD in the query signal that the client wants AD
@@ -2545,7 +2821,7 @@ h
2280. [func] Allow the experimental http server to be reached
over IPv6 as well as IPv4. [RT #17332]
-2279. [bug] Use setsockopt(SO_NOSIGPIPE), when available,
+2279. [bug] Use setsockopt(SO_NOSIGPIPE), when available,
to protect applications from receiving spurious
SIGPIPE signals when using the resolver.
@@ -2580,9 +2856,9 @@ h
--- 9.5.0b1 released ---
-2267. [bug] Radix tree node_num value could be set incorrectly,
- causing positive ACL matches to look like negative
- ones. [RT #17311]
+2267. [bug] Radix tree node_num value could be set incorrectly,
+ causing positive ACL matches to look like negative
+ ones. [RT #17311]
2266. [bug] client.c:get_clientmctx() returned the same mctx
once the pool of mctx's was filled. [RT #17218]
@@ -2598,7 +2874,7 @@ h
2262. [bug] Error status from all but the last view could be
lost. [RT #17292]
-2261. [bug] Fix memory leak with "any" and "none" ACLs [RT #17272]
+2261. [bug] Fix memory leak with "any" and "none" ACLs [RT #17272]
2260. [bug] Reported wrong clients-per-query when increasing the
value. [RT #17236]
diff --git a/contrib/bind9/COPYRIGHT b/contrib/bind9/COPYRIGHT
index 8721ceca8462..6f94496d4ba5 100644
--- a/contrib/bind9/COPYRIGHT
+++ b/contrib/bind9/COPYRIGHT
@@ -13,9 +13,15 @@ LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
PERFORMANCE OF THIS SOFTWARE.
-$Id: COPYRIGHT,v 1.17 2011-01-04 23:47:13 tbox Exp $
+$Id: COPYRIGHT,v 1.17.14.1 2011-02-22 06:34:47 marka Exp $
-Portions Copyright (C) 1996-2001 Nominum, Inc.
+ Portions of this code release fall under one or more of the
+ following Copyright notices. Please see individual source
+ files for details.
+
+ For binary releases also see: OpenSSL-LICENSE.
+
+Copyright (C) 1996-2001 Nominum, Inc.
Permission to use, copy, modify, and distribute this software for any
purpose with or without fee is hereby granted, provided that the above
@@ -28,3 +34,485 @@ ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+ -----------------------------------------------------------------------------
+
+Copyright (C) 1995-2000 by Network Associates, Inc.
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND ISC AND NETWORK ASSOCIATES DISCLAIMS
+ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE
+FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
+IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+ -----------------------------------------------------------------------------
+
+Copyright (C) 2002 Stichting NLnet, Netherlands, stichting@nlnet.nl.
+
+Permission to use, copy, modify, and distribute this software for any
+purpose with or without fee is hereby granted, provided that the
+above copyright notice and this permission notice appear in all
+copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND STICHTING NLNET
+DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
+STICHTING NLNET BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
+CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
+OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
+USE OR PERFORMANCE OF THIS SOFTWARE.
+
+The development of Dynamically Loadable Zones (DLZ) for Bind 9 was
+conceived and contributed by Rob Butler.
+
+Permission to use, copy, modify, and distribute this software for any
+purpose with or without fee is hereby granted, provided that the
+above copyright notice and this permission notice appear in all
+copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND ROB BUTLER
+DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
+ROB BUTLER BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
+CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
+OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
+USE OR PERFORMANCE OF THIS SOFTWARE.
+
+ -----------------------------------------------------------------------------
+
+Copyright (c) 1987, 1990, 1993, 1994
+ The Regents of the University of California. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+1. Redistributions of source code must retain the above copyright
+ notice, this list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright
+ notice, this list of conditions and the following disclaimer in the
+ documentation and/or other materials provided with the distribution.
+3. All advertising materials mentioning features or use of this software
+ must display the following acknowledgement:
+ This product includes software developed by the University of
+ California, Berkeley and its contributors.
+4. Neither the name of the University nor the names of its contributors
+ may be used to endorse or promote products derived from this software
+ without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGE.
+
+ -----------------------------------------------------------------------------
+
+Copyright (C) The Internet Society 2005. This version of
+this module is part of RFC 4178; see the RFC itself for
+full legal notices.
+
+(The above copyright notice is per RFC 3978 5.6 (a), q.v.)
+
+ -----------------------------------------------------------------------------
+
+Copyright (c) 2004 Masarykova universita
+(Masaryk University, Brno, Czech Republic)
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice,
+ this list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright
+ notice, this list of conditions and the following disclaimer in the
+ documentation and/or other materials provided with the distribution.
+
+3. Neither the name of the University nor the names of its contributors may
+ be used to endorse or promote products derived from this software
+ without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGE.
+
+ -----------------------------------------------------------------------------
+
+Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan
+(Royal Institute of Technology, Stockholm, Sweden).
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+
+1. Redistributions of source code must retain the above copyright
+ notice, this list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright
+ notice, this list of conditions and the following disclaimer in the
+ documentation and/or other materials provided with the distribution.
+
+3. Neither the name of the Institute nor the names of its contributors
+ may be used to endorse or promote products derived from this software
+ without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGE.
+
+ -----------------------------------------------------------------------------
+
+Copyright (c) 1998 Doug Rabson
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+1. Redistributions of source code must retain the above copyright
+ notice, this list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright
+ notice, this list of conditions and the following disclaimer in the
+ documentation and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGE.
+
+ -----------------------------------------------------------------------------
+
+Copyright ((c)) 2002, Rice University
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+ * Redistributions of source code must retain the above copyright
+ notice, this list of conditions and the following disclaimer.
+
+ * Redistributions in binary form must reproduce the above
+ copyright notice, this list of conditions and the following
+ disclaimer in the documentation and/or other materials provided
+ with the distribution.
+
+ * Neither the name of Rice University (RICE) nor the names of its
+ contributors may be used to endorse or promote products derived
+ from this software without specific prior written permission.
+
+
+This software is provided by RICE and the contributors on an "as is"
+basis, without any representations or warranties of any kind, express
+or implied including, but not limited to, representations or
+warranties of non-infringement, merchantability or fitness for a
+particular purpose. In no event shall RICE or contributors be liable
+for any direct, indirect, incidental, special, exemplary, or
+consequential damages (including, but not limited to, procurement of
+substitute goods or services; loss of use, data, or profits; or
+business interruption) however caused and on any theory of liability,
+whether in contract, strict liability, or tort (including negligence
+or otherwise) arising in any way out of the use of this software, even
+if advised of the possibility of such damage.
+
+ -----------------------------------------------------------------------------
+
+Copyright (c) 1993 by Digital Equipment Corporation.
+
+Permission to use, copy, modify, and distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies, and that
+the name of Digital Equipment Corporation not be used in advertising or
+publicity pertaining to distribution of the document or software without
+specific, written prior permission.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND DIGITAL EQUIPMENT CORP. DISCLAIMS ALL
+WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES
+OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL DIGITAL EQUIPMENT
+CORPORATION BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
+ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
+SOFTWARE.
+
+ -----------------------------------------------------------------------------
+
+Copyright 2000 Aaron D. Gifford. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+1. Redistributions of source code must retain the above copyright
+ notice, this list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright
+ notice, this list of conditions and the following disclaimer in the
+ documentation and/or other materials provided with the distribution.
+3. Neither the name of the copyright holder nor the names of contributors
+ may be used to endorse or promote products derived from this software
+ without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE AUTHOR(S) AND CONTRIBUTOR(S) ``AS IS'' AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR(S) OR CONTRIBUTOR(S) BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGE.
+
+ -----------------------------------------------------------------------------
+
+Copyright (c) 1998 Doug Rabson.
+Copyright (c) 2001 Jake Burkholder.
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+1. Redistributions of source code must retain the above copyright
+ notice, this list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright
+ notice, this list of conditions and the following disclaimer in the
+ documentation and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGE.
+
+ -----------------------------------------------------------------------------
+
+Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+1. Redistributions of source code must retain the above copyright
+ notice, this list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright
+ notice, this list of conditions and the following disclaimer in the
+ documentation and/or other materials provided with the distribution.
+3. Neither the name of the project nor the names of its contributors
+ may be used to endorse or promote products derived from this software
+ without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGE.
+
+ -----------------------------------------------------------------------------
+
+Copyright (c) 1999-2000 by Nortel Networks Corporation
+
+Permission to use, copy, modify, and distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND NORTEL NETWORKS DISCLAIMS
+ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
+OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL NORTEL NETWORKS
+BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES
+OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
+WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION,
+ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
+SOFTWARE.
+
+ -----------------------------------------------------------------------------
+
+Copyright (c) 2000-2002 Japan Network Information Center. All rights reserved.
+
+By using this file, you agree to the terms and conditions set forth bellow.
+
+ LICENSE TERMS AND CONDITIONS
+
+The following License Terms and Conditions apply, unless a different
+license is obtained from Japan Network Information Center ("JPNIC"),
+a Japanese association, Kokusai-Kougyou-Kanda Bldg 6F, 2-3-4 Uchi-Kanda,
+Chiyoda-ku, Tokyo 101-0047, Japan.
+
+1. Use, Modification and Redistribution (including distribution of any
+ modified or derived work) in source and/or binary forms is permitted
+ under this License Terms and Conditions.
+
+2. Redistribution of source code must retain the copyright notices as they
+ appear in each source code file, this License Terms and Conditions.
+
+3. Redistribution in binary form must reproduce the Copyright Notice,
+ this License Terms and Conditions, in the documentation and/or other
+ materials provided with the distribution. For the purposes of binary
+ distribution the "Copyright Notice" refers to the following language:
+ "Copyright (c) 2000-2002 Japan Network Information Center. All rights
+ reserved."
+
+4. The name of JPNIC may not be used to endorse or promote products
+ derived from this Software without specific prior written approval of
+ JPNIC.
+
+5. Disclaimer/Limitation of Liability: THIS SOFTWARE IS PROVIDED BY JPNIC
+ "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+ PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL JPNIC BE LIABLE
+ FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
+ OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
+ ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
+
+ -----------------------------------------------------------------------------
+
+Copyright (C) 2004 Nominet, Ltd.
+
+Permission to use, copy, modify, and distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND NOMINET DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.
+
+ -----------------------------------------------------------------------------
+
+Portions Copyright RSA Security Inc.
+
+License to copy and use this software is granted provided that it is
+identified as "RSA Security Inc. PKCS #11 Cryptographic Token Interface
+(Cryptoki)" in all material mentioning or referencing this software.
+
+License is also granted to make and use derivative works provided that
+such works are identified as "derived from the RSA Security Inc. PKCS #11
+Cryptographic Token Interface (Cryptoki)" in all material mentioning or
+referencing the derived work.
+
+RSA Security Inc. makes no representations concerning either the
+merchantability of this software or the suitability of this software for
+any particular purpose. It is provided "as is" without express or implied
+warranty of any kind.
+
+ -----------------------------------------------------------------------------
+
+Copyright (c) 1996, David Mazieres
+Copyright (c) 2008, Damien Miller
+
+Permission to use, copy, modify, and distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+-----------------------------------------------------------------------------
+
+Copyright (c) 2000-2001 The OpenSSL Project. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+
+1. Redistributions of source code must retain the above copyright
+ notice, this list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright
+ notice, this list of conditions and the following disclaimer in
+ the documentation and/or other materials provided with the
+ distribution.
+
+3. All advertising materials mentioning features or use of this
+ software must display the following acknowledgment:
+ "This product includes software developed by the OpenSSL Project
+ for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+
+4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ endorse or promote products derived from this software without
+ prior written permission. For written permission, please contact
+ licensing@OpenSSL.org.
+
+5. Products derived from this software may not be called "OpenSSL"
+ nor may "OpenSSL" appear in their names without prior written
+ permission of the OpenSSL Project.
+
+6. Redistributions of any form whatsoever must retain the following
+ acknowledgment:
+ "This product includes software developed by the OpenSSL Project
+ for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+
+THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+OF THE POSSIBILITY OF SUCH DAMAGE.
+
diff --git a/contrib/bind9/Makefile.in b/contrib/bind9/Makefile.in
index 95944d9fa4ff..f0edc926ba78 100644
--- a/contrib/bind9/Makefile.in
+++ b/contrib/bind9/Makefile.in
@@ -1,4 +1,4 @@
-# Copyright (C) 2004-2009 Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004-2009, 2011 Internet Systems Consortium, Inc. ("ISC")
# Copyright (C) 1998-2002 Internet Software Consortium.
#
# Permission to use, copy, modify, and/or distribute this software for any
@@ -13,7 +13,7 @@
# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
# PERFORMANCE OF THIS SOFTWARE.
-# $Id: Makefile.in,v 1.58 2009-11-26 20:52:44 marka Exp $
+# $Id: Makefile.in,v 1.58.250.2 2011-02-28 01:19:57 tbox Exp $
srcdir = @srcdir@
VPATH = @srcdir@
@@ -21,7 +21,7 @@ top_srcdir = @top_srcdir@
@BIND9_VERSION@
-SUBDIRS = make lib bin doc @LIBEXPORT@
+SUBDIRS = make unit lib bin doc @LIBEXPORT@
TARGETS =
MANPAGES = isc-config.sh.1
@@ -65,6 +65,7 @@ check: test
test:
(cd bin/tests && ${MAKE} ${MAKEDEFS} test)
+ (test -f unit/unittest.sh && $(SHELL) unit/unittest.sh)
FAQ: FAQ.xml
${XSLTPROC} doc/xsl/isc-docbook-text.xsl FAQ.xml | \
diff --git a/contrib/bind9/README b/contrib/bind9/README
index 00010c3983f3..708def9dd3ee 100644
--- a/contrib/bind9/README
+++ b/contrib/bind9/README
@@ -48,6 +48,17 @@ BIND 9
For a detailed list of user-visible changes from
previous releases, see the CHANGES file.
+BIND 9.8.1
+
+ BIND 9.8.1 includes a number of bug fixes and enhancements from
+ BIND 9.8 and earlier releases. New features include:
+
+ - The DLZ "dlopen" driver is now built by default.
+ - Added a new include file with function typedefs
+ for the DLZ "dlopen" driver.
+ - Made "--with-gssapi" default.
+ - More verbose error reporting from DLZ LDAP.
+
BIND 9.8.0
BIND 9.8.0 includes a number of changes from BIND 9.7 and earlier
diff --git a/contrib/bind9/RELEASE-NOTES-BIND-9.8.1.html b/contrib/bind9/RELEASE-NOTES-BIND-9.8.1.html
new file mode 100644
index 000000000000..c4deae43a9cf
--- /dev/null
+++ b/contrib/bind9/RELEASE-NOTES-BIND-9.8.1.html
@@ -0,0 +1,368 @@
+
+
+
Introduction
+
+
+ BIND 9.8.1 is the current production release of BIND 9.8.
+
+
+ This document summarizes changes from BIND 9.8.0 to BIND 9.8.1.
+ Please see the CHANGES file in the source code release for a
+ complete list of all changes.
+
+
+
+
Download
+
+
+ The latest versions of BIND 9 software can always be found
+ on our web site at
+ http://www.isc.org/downloads/all.
+ There you will find additional information about each
+ release, source code, and some pre-compiled versions for certain operating systems.
+
+Added a new include file with function typedefs
+for the DLZ "dlopen" driver. [RT #23629]
+
+Added a tool able to generate malformed packets to allow testing
+of how named handles them.
+[RT #24096]
+
+The root key is now provided in the file bind.keys allowing DNSSEC validation to be switched on at start up by adding "dnssec-validation auto;" to named.conf. If the root key provided has expired, named will log the expiration and validation will not work. More information and the most current copy of bind.keys can be found at http://www.isc.org/bind-keys. *Please note this feature was actually added in 9.8.0 but was not included in the 9.8.0 release notes. [RT #21727]
+
+
+
+
+
Security Fixes
+
+
9.8.1
+
+
+If named is configured with a response policy zone (RPZ) and a query
+of type RRSIG is received for a name configured for RRset replacement
+in that RPZ, it will trigger an INSIST and crash the server.
+RRSIG. [RT #24280]
+
+named, set up to be a caching resolver, is vulnerable to a
+user querying a domain with very large resource record sets (RRSets)
+when trying to negatively cache the response. Due to an off-by-one
+error, caching the response could cause named to crash. [RT #24650]
+[CVE-2011-1910]
+
+Using Response Policy Zone (RPZ) to query a wildcard CNAME label with
+QUERY type SIG/RRSIG, it can cause named to crash. Fix is query type
+independant.
+[RT #24715]
+
+Using Response Policy Zone (RPZ) with DNAME records and querying the
+subdomain of that label can cause named to crash. Now logs that DNAME
+is not supported.
+[RT #24766]
+
+Change #2912 populated the message section in replies to UPDATE requests,
+which some Windows clients wanted. This exposed a latent bug that allowed
+the response message to crash named. With this fix, change 2912 has been
+reduced to copy only the zone section to the reply. A more complete fix
+for the latent bug will be released later.
+[RT #24777]
+
+
+
+
+
+
Feature Changes
+
+
9.8.1
+
+
+Merged in the NetBSD ATF test framework (currently
+version 0.12) for development of future unit tests.
+Use configure --with-atf to build ATF internally
+or configure --with-atf=prefix to use an external
+copy. [RT #23209]
+
+Added more verbose error reporting from DLZ LDAP. [RT #23402]
+
+The DLZ "dlopen" driver is now built by default,
+no longer requiring a configure option. To
+disable it, use "configure --without-dlopen".
+(Note: driver not supported on win32.) [RT #23467]
+
+Replaced compile time constant with STDTIME_ON_32BITS.
+[RT #23587]
+
+Make --with-gssapi default for ./configure. [RT #23738]
+
+Improved the startup time for an authoritative server with a large
+number of zones by making the zone task table of variable size
+rather than fixed size. This means that authoritative servers with
+lots of zones will be serving that zone data much sooner. [RT #24406]
+
+Per RFC 6303, RFC 1918 reverse zones are now part of the built-in list of empty zones. [RT #24990]
+
+
+
+
Bug Fixes
+
+
9.8.1
+
+
+During RFC5011 processing some journal write errors were not detected.
+This could lead to managed-keys changes being committed but not
+recorded in the journal files, causing potential inconsistencies
+during later processing. [RT #20256]
+
+A potential NULL pointer deference in the DNS64 code could cause
+named to terminate unexpectedly. [RT #20256]
+
+A state variable relating to DNSSEC could fail to be set during
+some infrequently-executed code paths, allowing it to be used whilst
+in an unitialized state during cache updates, with unpredictable results.
+[RT #20256]
+
+A potential NULL pointer deference in DNSSEC signing code could
+cause named to terminate unexpectedly [RT #20256]
+
+Several cosmetic code changes were made to silence warnings
+generated by a static code analysis tool. [RT #20256]
+
+When using the -x (sign with only KSK) option on dnssec-signzone,
+it could incorrectly count the number of ZSKs in the zone. (And in 9.9.0,
+some code cleanup and improved warning messages). [RT #20852]
+
+When using _builtin in named.conf, named.conf changes were not found
+when reloading the config file. Now checks _builtin zone arguments
+to see if the zone is re-usable or not. [RT #21914]
+
+Running dnssec-settime -f on an old-style key will
+now force the key to be rewritten to the new key format even if no
+other change has been specified, using "-P now -A now"
+as default values. [RT #22474]
+
+After an external code review, a code cleanup was done. [RT #22521]
+
+Cause named to terminate at startup or rndc reconfig
+reload to fail, if a log file specified in the
+conf file isn't a plain file. (RT #22771]
+
+named now forces the ADB cache time for glue related data to zero
+instead of relying on TTL. This corrects problematic behavior in cases
+where a server was authoritative for the A record of a nameserver for a
+delegated zone and was queried to recursively resolve records within
+that zone. [RT #22842]
+
+When a validating resolver got a NODATA response for DNSKEY, it was
+not caching the NODATA. Fixed and test added. [RT #22908]
+
+Fixed a bug in which zone keys that were published
+and but not immediately activated, automatic signing could fail to trigger.
+[RT #22911]
+
+Fixed precedence order bug with NS and DNAME records if both are present.
+(Also fixed timing of autosign test in 9.7+) [RT #23035]
+
+When a DNSSEC signed dynamic zone's signatures need to be refreshed,
+named would first delete the old signatures in the zone. If a private
+key of the same algorithm isn't available to named, the signing would
+fail but the old signatures would already be deleted. named now checks
+if it can access the private key before deleting the old signatures and
+leaves the old signature if no private key is found. [RT #23136]
+
+When using "auto-dnssec maintain" and rolling to a new key, a
+private-type record (only used internally by named) could be created
+and not marked as complete. [RT #23253]
+
+Fixed last autosign test report. [RT #23256]
+
+named didn't save gid at startup and later assumed gid 0.
+named now saves/restores the gid when creating creating
+named.pid at startup. [RT #23290]
+
+If the server has an IPv6 address but does not have IPv6 connectivity
+to the internet, dig +trace could fail attempting to use IPv6
+addresses. [RT #23297]
+
+If named is configured with managed zones, the managed key maint timer
+can exercise a race condition that can crash the server.
+[RT #23303]
+
+Changing TTL did not cause dnssec-signzone to generate new signatures.
+[RT #23330]
+
+Have the validating resolver use RRSIG original TTL to compute
+validated RRset and RRSIG TTL. [RT #23332]
+
+In "make test" bin/tests/resolver, hold the socket manager lock
+while freeing the socket.
+[RT #23333]
+
+If named encountered a CNAME instead of a DS record when walking
+the chain of trust down from the trust anchor, it incorrectly stopped
+validating. [RT #23338]
+
+dns/view.h needed dns/rpz.h but it wasn't in the Makfile.in
+HEADERS variable. [RT #23342]
+
+RRSIG records could have time stamps too far in the future.
+[RT #23356]
+
+named stores cached data in an in-memory database and keeps track of
+how recently the data is used with a heap. The heap is stored within the
+cache's memory space. Under a sustained high query load and with a small
+cache size, this could lead to the heap exhausting the cache space. This
+would result in cache misses and SERVFAILs, with named never releasing
+the cache memory the heap used up and never recovering.
+
+This fix removes the heap into its own memory space, preventing the heap
+from exhausting the cache space and allowing named to recover gracefully
+when the high query load abates. [RT #23371]
+
+Fully separated key management on a per view basis. [RT #23419]
+
+If running on a powerpc CPU and with atomic operations enabled,
+named could lock up. Added sync instructions to the end of atomic
+operations. [RT #23469]
+
+If OpenSSL was built without engine support, named would have
+compile errors and fail to build.
+[RT #23473]
+
+If ./configure finds GOST but not elliptic curve, named fails to
+build. Added elliptic curve support check in GOST OpenSSL engine
+detection. [RT #23485]
+
+"rndc secroots" would abort on the first error
+and so could miss remaining views. [RT #23488]
+
+Handle isc_event_allocate failures in t_tasks test.
+[RT #23572]
+
+ixfr-from-differences {master|slave};
+failed to select the master/slave zones, resulting in on diff/journal
+file being created.
+[RT #23580]
+
+If a DNAME substitution failed, named returned NOERROR. The correct
+response should be YXDOMAIN.
+[RT #23591]
+
+dns_dnssec_findzonekeys{2} used a inconsistant
+timestamp when determining which keys are active. This could result in
+some RRsets not being signed/re-signed.
+[RT #23642]
+
+Remove bin/tests/system/logfileconfig/ns1/named.conf and
+add setup.sh in order to resolve changing named.conf issue. [RT #23687]
+
+NOTIFY messages were not being sent when generating
+a NSEC3 chain incrementally. [RT #23702]
+
+DDNS updates using SIG(0) with update-policy match
+type "external" could cause a crash. Also fixed nsupdate core
+dump on shutdown when using a SIG(0) key, due to the key
+not being freed. [RT #23735]
+
+Zones using automatic key maintenance could fail to check the key
+repository for updates. named now checks once per hour and the
+automatic check bug has been fixed. [RT #23744]
+
+named now uses the correct strtok/strtok_r/strtok_s based on OS.
+[RT #23747]
+
+Signatures for records at the zone apex could go
+stale due to an incorrect timer setting. [RT #23769]
+
+The autosign tests attempted to open ports within reserved ranges. Test
+now avoids those ports.
+[RT #23957]
+
+GSS TGIS test was failing, since log_cred() caused KRB5_KTNAME to
+be cached. Now sets KRB5_KTNAME before calling log_cred() in
+dst_gssapi_acceptctx(). [RT #24004]
+
+named, acting as authoritative server for DLZ zones, was not correctly
+setting the authoritative (AA) bit.
+[RT #24146]
+
+Clean up some cross-compiling issues and added two undocumented
+configure options, --with-gost and --with-rlimtype, to allow over-riding
+default settings (gost=no and rlimtype="long int") when cross-compiling.
+[RT #24367]
+
+When trying sign with NSEC3, if dnssec-signzone couldn't find the
+KSK, it would give an incorrect error "NSEC3 iterations too big for
+weakest DNSKEY strength" rather than the correct "failed to find
+keys at the zone apex: not found" [RT #24369]
+
+Configuring 'dnssec-validation auto' in a view instead of in the
+options statement could trigger an assertion failure in named-checkconf.
+[RT #24382]
+
+Improved consistency checks for dnssec-enable and
+dnssec-validation, added test cases to the
+checkconf system test. [RT #24398]
+
+If named is configured to be both authoritative and recursive and receives
+a recursive query for a CNAME in a zone that it is authoritative for, if that
+CNAME also points to a zone the server is authoritative for, the recursive part of name will not follow the CNAME change and the response will not be a
+complete CNAME chain. [RT #24455]
+
+nsupdate could dump core on shutdown when using SIG(0) keys. [RT #24604]
+
+Named could fail to validate zones list in a DLV that validated insecure
+without using DLV and had DS records in the parent zone. [RT #24631]
+
+dnssec-signzone now records timestamps just before and just after signing, improving the accuracy of signing statistics. [RT #16030]
+
+If allow-new-zones was set to yes and name-based ACLs were used, named could crash when "rndc reconfig" was issued. [RT #22739]
+
+RT #23136 fixed a problem where named would delete old signatures even
+when the private key wasn't available to re-sign the zone, resulting in
+a zone with missing signatures. This fix (CHANGES 3114) did not
+completely fix all issues. [RT #24577]
+
+A bug in FreeBSD kernels causes IPv6 UDP responses greater than
+1280 bytes to not fragment as they should. Until there is a kernel
+fix, named will work around this by setting IPV6_USE_MIN_MTU on a
+per packet basis. [RT #24950]
+
+
+
+
+
Known issues in this release
+
+
+
+ None.
+
+
+
+
+
Thank You
+
+
+ Thank you to everyone who assisted us in making this release possible.
+ If you would like to contribute to ISC to assist us in continuing to make
+ quality open source software, please visit our donations page at
+ http://www.isc.org/supportisc.
+
+
+
diff --git a/contrib/bind9/RELEASE-NOTES-BIND-9.8.1.pdf b/contrib/bind9/RELEASE-NOTES-BIND-9.8.1.pdf
new file mode 100644
index 000000000000..b2b5de5df5bd
Binary files /dev/null and b/contrib/bind9/RELEASE-NOTES-BIND-9.8.1.pdf differ
diff --git a/contrib/bind9/RELEASE-NOTES-BIND-9.8.1.txt b/contrib/bind9/RELEASE-NOTES-BIND-9.8.1.txt
new file mode 100644
index 000000000000..3fdb9b0ac6e7
--- /dev/null
+++ b/contrib/bind9/RELEASE-NOTES-BIND-9.8.1.txt
@@ -0,0 +1,268 @@
+ __________________________________________________________________
+
+Introduction
+
+ BIND 9.8.1 is the current production release of BIND 9.8.
+
+ This document summarizes changes from BIND 9.8.0 to BIND 9.8.1. Please
+ see the CHANGES file in the source code release for a complete list of
+ all changes.
+
+Download
+
+ The latest versions of BIND 9 software can always be found on our web
+ site at http://www.isc.org/downloads/all. There you will find
+ additional information about each release, source code, and some
+ pre-compiled versions for certain operating systems.
+
+Support
+
+ Product support information is available on
+ http://www.isc.org/services/support for paid support options. Free
+ support is provided by our user community via a mailing list.
+ Information on all public email lists is available at
+ https://lists.isc.org/mailman/listinfo.
+
+New Features
+
+9.8.1
+
+ * Added a new include file with function typedefs for the DLZ
+ "dlopen" driver. [RT #23629]
+ * Added a tool able to generate malformed packets to allow testing of
+ how named handles them. [RT #24096]
+ * The root key is now provided in the file bind.keys allowing DNSSEC
+ validation to be switched on at start up by adding
+ "dnssec-validation auto;" to named.conf. If the root key provided
+ has expired, named will log the expiration and validation will not
+ work. More information and the most current copy of bind.keys can
+ be found at http://www.isc.org/bind-keys. *Please note this feature
+ was actually added in 9.8.0 but was not included in the 9.8.0
+ release notes. [RT #21727]
+
+Security Fixes
+
+9.8.1
+
+ * If named is configured with a response policy zone (RPZ) and a
+ query of type RRSIG is received for a name configured for RRset
+ replacement in that RPZ, it will trigger an INSIST and crash the
+ server. RRSIG. [RT #24280]
+ * named, set up to be a caching resolver, is vulnerable to a user
+ querying a domain with very large resource record sets (RRSets)
+ when trying to negatively cache the response. Due to an off-by-one
+ error, caching the response could cause named to crash. [RT #24650]
+ [CVE-2011-1910]
+ * Using Response Policy Zone (RPZ) to query a wildcard CNAME label
+ with QUERY type SIG/RRSIG, it can cause named to crash. Fix is
+ query type independant. [RT #24715]
+ * Using Response Policy Zone (RPZ) with DNAME records and querying
+ the subdomain of that label can cause named to crash. Now logs that
+ DNAME is not supported. [RT #24766]
+ * Change #2912 populated the message section in replies to UPDATE
+ requests, which some Windows clients wanted. This exposed a latent
+ bug that allowed the response message to crash named. With this
+ fix, change 2912 has been reduced to copy only the zone section to
+ the reply. A more complete fix for the latent bug will be released
+ later. [RT #24777]
+
+Feature Changes
+
+9.8.1
+
+ * Merged in the NetBSD ATF test framework (currently version 0.12)
+ for development of future unit tests. Use configure --with-atf to
+ build ATF internally or configure --with-atf=prefix to use an
+ external copy. [RT #23209]
+ * Added more verbose error reporting from DLZ LDAP. [RT #23402]
+ * The DLZ "dlopen" driver is now built by default, no longer
+ requiring a configure option. To disable it, use "configure
+ --without-dlopen". (Note: driver not supported on win32.) [RT
+ #23467]
+ * Replaced compile time constant with STDTIME_ON_32BITS. [RT #23587]
+ * Make --with-gssapi default for ./configure. [RT #23738]
+ * Improved the startup time for an authoritative server with a large
+ number of zones by making the zone task table of variable size
+ rather than fixed size. This means that authoritative servers with
+ lots of zones will be serving that zone data much sooner. [RT
+ #24406]
+ * Per RFC 6303, RFC 1918 reverse zones are now part of the built-in
+ list of empty zones. [RT #24990]
+
+Bug Fixes
+
+9.8.1
+
+ * During RFC5011 processing some journal write errors were not
+ detected. This could lead to managed-keys changes being committed
+ but not recorded in the journal files, causing potential
+ inconsistencies during later processing. [RT #20256]
+ * A potential NULL pointer deference in the DNS64 code could cause
+ named to terminate unexpectedly. [RT #20256]
+ * A state variable relating to DNSSEC could fail to be set during
+ some infrequently-executed code paths, allowing it to be used
+ whilst in an unitialized state during cache updates, with
+ unpredictable results. [RT #20256]
+ * A potential NULL pointer deference in DNSSEC signing code could
+ cause named to terminate unexpectedly [RT #20256]
+ * Several cosmetic code changes were made to silence warnings
+ generated by a static code analysis tool. [RT #20256]
+ * When using the -x (sign with only KSK) option on dnssec-signzone,
+ it could incorrectly count the number of ZSKs in the zone. (And in
+ 9.9.0, some code cleanup and improved warning messages). [RT
+ #20852]
+ * When using _builtin in named.conf, named.conf changes were not
+ found when reloading the config file. Now checks _builtin zone
+ arguments to see if the zone is re-usable or not. [RT #21914]
+ * Running dnssec-settime -f on an old-style key will now force the
+ key to be rewritten to the new key format even if no other change
+ has been specified, using "-P now -A now" as default values. [RT
+ #22474]
+ * After an external code review, a code cleanup was done. [RT #22521]
+ * Cause named to terminate at startup or rndc reconfig reload to
+ fail, if a log file specified in the conf file isn't a plain file.
+ (RT #22771]
+ * named now forces the ADB cache time for glue related data to zero
+ instead of relying on TTL. This corrects problematic behavior in
+ cases where a server was authoritative for the A record of a
+ nameserver for a delegated zone and was queried to recursively
+ resolve records within that zone. [RT #22842]
+ * When a validating resolver got a NODATA response for DNSKEY, it was
+ not caching the NODATA. Fixed and test added. [RT #22908]
+ * Fixed a bug in which zone keys that were published and but not
+ immediately activated, automatic signing could fail to trigger. [RT
+ #22911]
+ * Fixed precedence order bug with NS and DNAME records if both are
+ present. (Also fixed timing of autosign test in 9.7+) [RT #23035]
+ * When a DNSSEC signed dynamic zone's signatures need to be
+ refreshed, named would first delete the old signatures in the zone.
+ If a private key of the same algorithm isn't available to named,
+ the signing would fail but the old signatures would already be
+ deleted. named now checks if it can access the private key before
+ deleting the old signatures and leaves the old signature if no
+ private key is found. [RT #23136]
+ * When using "auto-dnssec maintain" and rolling to a new key, a
+ private-type record (only used internally by named) could be
+ created and not marked as complete. [RT #23253]
+ * Fixed last autosign test report. [RT #23256]
+ * named didn't save gid at startup and later assumed gid 0. named now
+ saves/restores the gid when creating creating named.pid at startup.
+ [RT #23290]
+ * If the server has an IPv6 address but does not have IPv6
+ connectivity to the internet, dig +trace could fail attempting to
+ use IPv6 addresses. [RT #23297]
+ * If named is configured with managed zones, the managed key maint
+ timer can exercise a race condition that can crash the server. [RT
+ #23303]
+ * Changing TTL did not cause dnssec-signzone to generate new
+ signatures. [RT #23330]
+ * Have the validating resolver use RRSIG original TTL to compute
+ validated RRset and RRSIG TTL. [RT #23332]
+ * In "make test" bin/tests/resolver, hold the socket manager lock
+ while freeing the socket. [RT #23333]
+ * If named encountered a CNAME instead of a DS record when walking
+ the chain of trust down from the trust anchor, it incorrectly
+ stopped validating. [RT #23338]
+ * dns/view.h needed dns/rpz.h but it wasn't in the Makfile.in HEADERS
+ variable. [RT #23342]
+ * RRSIG records could have time stamps too far in the future. [RT
+ #23356]
+ * named stores cached data in an in-memory database and keeps track
+ of how recently the data is used with a heap. The heap is stored
+ within the cache's memory space. Under a sustained high query load
+ and with a small cache size, this could lead to the heap exhausting
+ the cache space. This would result in cache misses and SERVFAILs,
+ with named never releasing the cache memory the heap used up and
+ never recovering. This fix removes the heap into its own memory
+ space, preventing the heap from exhausting the cache space and
+ allowing named to recover gracefully when the high query load
+ abates. [RT #23371]
+ * Fully separated key management on a per view basis. [RT #23419]
+ * If running on a powerpc CPU and with atomic operations enabled,
+ named could lock up. Added sync instructions to the end of atomic
+ operations. [RT #23469]
+ * If OpenSSL was built without engine support, named would have
+ compile errors and fail to build. [RT #23473]
+ * If ./configure finds GOST but not elliptic curve, named fails to
+ build. Added elliptic curve support check in GOST OpenSSL engine
+ detection. [RT #23485]
+ * "rndc secroots" would abort on the first error and so could miss
+ remaining views. [RT #23488]
+ * Handle isc_event_allocate failures in t_tasks test. [RT #23572]
+ * ixfr-from-differences {master|slave}; failed to select the
+ master/slave zones, resulting in on diff/journal file being
+ created. [RT #23580]
+ * If a DNAME substitution failed, named returned NOERROR. The correct
+ response should be YXDOMAIN. [RT #23591]
+ * dns_dnssec_findzonekeys{2} used a inconsistant timestamp when
+ determining which keys are active. This could result in some RRsets
+ not being signed/re-signed. [RT #23642]
+ * Remove bin/tests/system/logfileconfig/ns1/named.conf and add
+ setup.sh in order to resolve changing named.conf issue. [RT #23687]
+ * NOTIFY messages were not being sent when generating a NSEC3 chain
+ incrementally. [RT #23702]
+ * DDNS updates using SIG(0) with update-policy match type "external"
+ could cause a crash. Also fixed nsupdate core dump on shutdown when
+ using a SIG(0) key, due to the key not being freed. [RT #23735]
+ * Zones using automatic key maintenance could fail to check the key
+ repository for updates. named now checks once per hour and the
+ automatic check bug has been fixed. [RT #23744]
+ * named now uses the correct strtok/strtok_r/strtok_s based on OS.
+ [RT #23747]
+ * Signatures for records at the zone apex could go stale due to an
+ incorrect timer setting. [RT #23769]
+ * The autosign tests attempted to open ports within reserved ranges.
+ Test now avoids those ports. [RT #23957]
+ * GSS TGIS test was failing, since log_cred() caused KRB5_KTNAME to
+ be cached. Now sets KRB5_KTNAME before calling log_cred() in
+ dst_gssapi_acceptctx(). [RT #24004]
+ * named, acting as authoritative server for DLZ zones, was not
+ correctly setting the authoritative (AA) bit. [RT #24146]
+ * Clean up some cross-compiling issues and added two undocumented
+ configure options, --with-gost and --with-rlimtype, to allow
+ over-riding default settings (gost=no and rlimtype="long int") when
+ cross-compiling. [RT #24367]
+ * When trying sign with NSEC3, if dnssec-signzone couldn't find the
+ KSK, it would give an incorrect error "NSEC3 iterations too big for
+ weakest DNSKEY strength" rather than the correct "failed to find
+ keys at the zone apex: not found" [RT #24369]
+ * Configuring 'dnssec-validation auto' in a view instead of in the
+ options statement could trigger an assertion failure in
+ named-checkconf. [RT #24382]
+ * Improved consistency checks for dnssec-enable and
+ dnssec-validation, added test cases to the checkconf system test.
+ [RT #24398]
+ * If named is configured to be both authoritative and recursive and
+ receives a recursive query for a CNAME in a zone that it is
+ authoritative for, if that CNAME also points to a zone the server
+ is authoritative for, the recursive part of name will not follow
+ the CNAME change and the response will not be a complete CNAME
+ chain. [RT #24455]
+ * nsupdate could dump core on shutdown when using SIG(0) keys. [RT
+ #24604]
+ * Named could fail to validate zones list in a DLV that validated
+ insecure without using DLV and had DS records in the parent zone.
+ [RT #24631]
+ * dnssec-signzone now records timestamps just before and just after
+ signing, improving the accuracy of signing statistics. [RT #16030]
+ * If allow-new-zones was set to yes and name-based ACLs were used,
+ named could crash when "rndc reconfig" was issued. [RT #22739]
+ * RT #23136 fixed a problem where named would delete old signatures
+ even when the private key wasn't available to re-sign the zone,
+ resulting in a zone with missing signatures. This fix (CHANGES
+ 3114) did not completely fix all issues. [RT #24577]
+ * A bug in FreeBSD kernels causes IPv6 UDP responses greater than
+ 1280 bytes to not fragment as they should. Until there is a kernel
+ fix, named will work around this by setting IPV6_USE_MIN_MTU on a
+ per packet basis. [RT #24950]
+
+Known issues in this release
+
+ * None.
+
+Thank You
+
+ Thank you to everyone who assisted us in making this release possible.
+ If you would like to contribute to ISC to assist us in continuing to
+ make quality open source software, please visit our donations page at
+ http://www.isc.org/supportisc.
diff --git a/contrib/bind9/bin/check/named-checkconf.c b/contrib/bind9/bin/check/named-checkconf.c
index 521ed31916c5..11a429c649cd 100644
--- a/contrib/bind9/bin/check/named-checkconf.c
+++ b/contrib/bind9/bin/check/named-checkconf.c
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2004-2007, 2009, 2010 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007, 2009-2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2002 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: named-checkconf.c,v 1.54 2010-09-07 01:49:08 marka Exp $ */
+/* $Id: named-checkconf.c,v 1.54.62.2 2011-03-12 04:59:13 tbox Exp $ */
/*! \file */
@@ -190,7 +190,7 @@ configure_zone(const char *vclass, const char *view,
if (obj != NULL)
maps[i++] = obj;
}
- maps[i++] = NULL;
+ maps[i] = NULL;
cfg_map_get(zoptions, "type", &typeobj);
if (typeobj == NULL)
diff --git a/contrib/bind9/bin/confgen/ddns-confgen.c b/contrib/bind9/bin/confgen/ddns-confgen.c
index 814a5657bb4d..3fdf4d47417f 100644
--- a/contrib/bind9/bin/confgen/ddns-confgen.c
+++ b/contrib/bind9/bin/confgen/ddns-confgen.c
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2009 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2009, 2011 Internet Systems Consortium, Inc. ("ISC")
*
* Permission to use, copy, modify, and/or distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
@@ -14,7 +14,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: ddns-confgen.c,v 1.9 2009-09-29 15:06:05 fdupont Exp $ */
+/* $Id: ddns-confgen.c,v 1.9.308.2 2011-03-12 04:59:13 tbox Exp $ */
/*! \file */
@@ -160,6 +160,7 @@ main(int argc, char **argv) {
argc -= isc_commandline_index;
argv += isc_commandline_index;
+ POST(argv);
if (self_domain != NULL && zone != NULL)
usage(1); /* -s and -z cannot coexist */
diff --git a/contrib/bind9/bin/confgen/rndc-confgen.c b/contrib/bind9/bin/confgen/rndc-confgen.c
index 766e3b49444e..0eac35fefac6 100644
--- a/contrib/bind9/bin/confgen/rndc-confgen.c
+++ b/contrib/bind9/bin/confgen/rndc-confgen.c
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2004, 2005, 2007-2009 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007-2009, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 2001, 2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: rndc-confgen.c,v 1.5 2009-09-29 15:06:05 fdupont Exp $ */
+/* $Id: rndc-confgen.c,v 1.5.308.2 2011-03-12 04:59:13 tbox Exp $ */
/*! \file */
@@ -200,6 +200,7 @@ main(int argc, char **argv) {
argc -= isc_commandline_index;
argv += isc_commandline_index;
+ POST(argv);
if (argc > 0)
usage(1);
diff --git a/contrib/bind9/bin/dig/dig.c b/contrib/bind9/bin/dig/dig.c
index a3143c93d273..728838721275 100644
--- a/contrib/bind9/bin/dig/dig.c
+++ b/contrib/bind9/bin/dig/dig.c
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2004-2010 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 2000-2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: dig.c,v 1.237 2010-05-13 00:40:46 marka Exp $ */
+/* $Id: dig.c,v 1.237.124.3 2011-03-11 06:46:58 marka Exp $ */
/*! \file */
@@ -44,8 +44,6 @@
#include
#include
-#include
-
#include
#define ADD_STRING(b, s) { \
@@ -479,8 +477,6 @@ printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) {
if (!query->lookup->comments)
flags |= DNS_MESSAGETEXTFLAG_NOCOMMENTS;
- result = ISC_R_SUCCESS;
-
result = isc_buffer_allocate(mctx, &buf, len);
check_result(result, "isc_buffer_allocate");
@@ -1437,30 +1433,6 @@ preparse_args(int argc, char **argv) {
}
}
-static void
-getaddresses(dig_lookup_t *lookup, const char *host) {
- isc_result_t result;
- isc_sockaddr_t sockaddrs[DIG_MAX_ADDRESSES];
- isc_netaddr_t netaddr;
- int count, i;
- dig_server_t *srv;
- char tmp[ISC_NETADDR_FORMATSIZE];
-
- result = bind9_getaddresses(host, 0, sockaddrs,
- DIG_MAX_ADDRESSES, &count);
- if (result != ISC_R_SUCCESS)
- fatal("couldn't get address for '%s': %s",
- host, isc_result_totext(result));
-
- for (i = 0; i < count; i++) {
- isc_netaddr_fromsockaddr(&netaddr, &sockaddrs[i]);
- isc_netaddr_format(&netaddr, tmp, sizeof(tmp));
- srv = make_server(tmp, host);
- ISC_LIST_APPEND(lookup->my_server_list, srv, link);
- }
- addresscount = count;
-}
-
static void
parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
int argc, char **argv) {
@@ -1555,7 +1527,7 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
if (strncmp(rv[0], "%", 1) == 0)
break;
if (strncmp(rv[0], "@", 1) == 0) {
- getaddresses(lookup, &rv[0][1]);
+ addresscount = getaddresses(lookup, &rv[0][1]);
} else if (rv[0][0] == '+') {
plus_option(&rv[0][1], is_batchfile,
lookup);
@@ -1592,7 +1564,6 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
(isc_textregion_t *)&tr);
if (result == ISC_R_SUCCESS &&
rdtype == dns_rdatatype_ixfr) {
- result = DNS_R_UNKNOWN;
fprintf(stderr, ";; Warning, "
"ixfr requires a "
"serial number\n");
diff --git a/contrib/bind9/bin/dig/dighost.c b/contrib/bind9/bin/dig/dighost.c
index e92bc6edceec..319ba3e74727 100644
--- a/contrib/bind9/bin/dig/dighost.c
+++ b/contrib/bind9/bin/dig/dighost.c
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2004-2010 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 2000-2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: dighost.c,v 1.336 2010-12-09 00:54:33 marka Exp $ */
+/* $Id: dighost.c,v 1.336.22.4 2011-03-11 06:46:58 marka Exp $ */
/*! \file
* \note
@@ -566,10 +566,8 @@ make_server(const char *servname, const char *userarg) {
if (srv == NULL)
fatal("memory allocation failure in %s:%d",
__FILE__, __LINE__);
- strncpy(srv->servername, servname, MXNAME);
- strncpy(srv->userarg, userarg, MXNAME);
- srv->servername[MXNAME-1] = 0;
- srv->userarg[MXNAME-1] = 0;
+ strlcpy(srv->servername, servname, MXNAME);
+ strlcpy(srv->userarg, userarg, MXNAME);
ISC_LINK_INIT(srv, link);
return (srv);
}
@@ -1767,8 +1765,7 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section)
dns_rdata_freestruct(&ns);
/* Initialize lookup if we've not yet */
- debug("found NS %d %s", numLookups, namestr);
- numLookups++;
+ debug("found NS %s", namestr);
if (!success) {
success = ISC_TRUE;
lookup_counter++;
@@ -1790,9 +1787,8 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section)
domain = dns_fixedname_name(&lookup->fdomain);
dns_name_copy(name, domain, NULL);
}
- srv = make_server(namestr, namestr);
- debug("adding server %s", srv->servername);
- ISC_LIST_APPEND(lookup->my_server_list, srv, link);
+ debug("adding server %s", namestr);
+ numLookups += getaddresses(lookup, namestr);
dns_rdata_reset(&rdata);
}
}
@@ -1808,17 +1804,25 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section)
if (numLookups > 1) {
isc_uint32_t i, j;
dig_serverlist_t my_server_list;
+ dig_server_t *next;
ISC_LIST_INIT(my_server_list);
- for (i = numLookups; i > 0; i--) {
+ i = numLookups;
+ for (srv = ISC_LIST_HEAD(lookup->my_server_list);
+ srv != NULL;
+ srv = ISC_LIST_HEAD(lookup->my_server_list)) {
+ INSIST(i > 0);
isc_random_get(&j);
j %= i;
- srv = ISC_LIST_HEAD(lookup->my_server_list);
- while (j-- > 0)
- srv = ISC_LIST_NEXT(srv, link);
+ next = ISC_LIST_NEXT(srv, link);
+ while (j-- > 0 && next != NULL) {
+ srv = next;
+ next = ISC_LIST_NEXT(srv, link);
+ }
ISC_LIST_DEQUEUE(lookup->my_server_list, srv, link);
ISC_LIST_APPEND(my_server_list, srv, link);
+ i--;
}
ISC_LIST_APPENDLIST(lookup->my_server_list,
my_server_list, link);
@@ -3541,6 +3545,31 @@ get_address(char *host, in_port_t port, isc_sockaddr_t *sockaddr) {
return (ISC_R_SUCCESS);
}
+int
+getaddresses(dig_lookup_t *lookup, const char *host) {
+ isc_result_t result;
+ isc_sockaddr_t sockaddrs[DIG_MAX_ADDRESSES];
+ isc_netaddr_t netaddr;
+ int count, i;
+ dig_server_t *srv;
+ char tmp[ISC_NETADDR_FORMATSIZE];
+
+ result = bind9_getaddresses(host, 0, sockaddrs,
+ DIG_MAX_ADDRESSES, &count);
+ if (result != ISC_R_SUCCESS)
+ fatal("couldn't get address for '%s': %s",
+ host, isc_result_totext(result));
+
+ for (i = 0; i < count; i++) {
+ isc_netaddr_fromsockaddr(&netaddr, &sockaddrs[i]);
+ isc_netaddr_format(&netaddr, tmp, sizeof(tmp));
+ srv = make_server(tmp, host);
+ ISC_LIST_APPEND(lookup->my_server_list, srv, link);
+ }
+
+ return count;
+}
+
/*%
* Initiate either a TCP or UDP lookup
*/
diff --git a/contrib/bind9/bin/dig/host.c b/contrib/bind9/bin/dig/host.c
index 13569f63ac98..c7a8e0eb575f 100644
--- a/contrib/bind9/bin/dig/host.c
+++ b/contrib/bind9/bin/dig/host.c
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2004-2007, 2009, 2010 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007, 2009-2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 2000-2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: host.c,v 1.124 2010-11-16 05:38:30 marka Exp $ */
+/* $Id: host.c,v 1.124.40.3 2011-03-11 06:46:59 marka Exp $ */
/*! \file */
@@ -521,6 +521,7 @@ printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) {
if ((msg->flags & DNS_MESSAGEFLAG_CD) != 0) {
printf("%scd", did_flag ? " " : "");
did_flag = ISC_TRUE;
+ POST(did_flag);
}
printf("; QUERY: %u, ANSWER: %u, "
"AUTHORITY: %u, ADDITIONAL: %u\n",
@@ -824,8 +825,8 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) {
if (isc_commandline_index >= argc)
show_usage();
- strncpy(hostname, argv[isc_commandline_index], sizeof(hostname));
- hostname[sizeof(hostname)-1]=0;
+ strlcpy(hostname, argv[isc_commandline_index], sizeof(hostname));
+
if (argc > isc_commandline_index + 1) {
set_nameserver(argv[isc_commandline_index+1]);
debug("server is %s", argv[isc_commandline_index+1]);
diff --git a/contrib/bind9/bin/dig/include/dig/dig.h b/contrib/bind9/bin/dig/include/dig/dig.h
index c0f778b5f142..2db5de552fc3 100644
--- a/contrib/bind9/bin/dig/include/dig/dig.h
+++ b/contrib/bind9/bin/dig/include/dig/dig.h
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2004-2009 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2009, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 2000-2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: dig.h,v 1.111 2009-09-29 15:06:06 fdupont Exp $ */
+/* $Id: dig.h,v 1.111.306.2 2011-02-28 01:19:58 tbox Exp $ */
#ifndef DIG_H
#define DIG_H
@@ -288,6 +288,9 @@ extern int idnoptions;
isc_result_t
get_address(char *host, in_port_t port, isc_sockaddr_t *sockaddr);
+int
+getaddresses(dig_lookup_t *lookup, const char *host);
+
isc_result_t
get_reverse(char *reverse, size_t len, char *value, isc_boolean_t ip6_int,
isc_boolean_t strict);
diff --git a/contrib/bind9/bin/dig/nslookup.c b/contrib/bind9/bin/dig/nslookup.c
index 0d368b15c800..e327c0f7fce4 100644
--- a/contrib/bind9/bin/dig/nslookup.c
+++ b/contrib/bind9/bin/dig/nslookup.c
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2004-2010 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 2000-2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: nslookup.c,v 1.127 2010-11-17 23:47:08 tbox Exp $ */
+/* $Id: nslookup.c,v 1.127.38.2 2011-02-28 01:19:58 tbox Exp $ */
#include
@@ -535,12 +535,6 @@ testclass(char *typetext) {
}
}
-static void
-safecpy(char *dest, char *src, int size) {
- strncpy(dest, src, size);
- dest[size-1] = 0;
-}
-
static void
set_port(const char *value) {
isc_uint32_t n;
@@ -571,34 +565,34 @@ setoption(char *opt) {
show_settings(ISC_TRUE, ISC_FALSE);
} else if (strncasecmp(opt, "class=", 6) == 0) {
if (testclass(&opt[6]))
- safecpy(defclass, &opt[6], sizeof(defclass));
+ strlcpy(defclass, &opt[6], sizeof(defclass));
} else if (strncasecmp(opt, "cl=", 3) == 0) {
if (testclass(&opt[3]))
- safecpy(defclass, &opt[3], sizeof(defclass));
+ strlcpy(defclass, &opt[3], sizeof(defclass));
} else if (strncasecmp(opt, "type=", 5) == 0) {
if (testtype(&opt[5]))
- safecpy(deftype, &opt[5], sizeof(deftype));
+ strlcpy(deftype, &opt[5], sizeof(deftype));
} else if (strncasecmp(opt, "ty=", 3) == 0) {
if (testtype(&opt[3]))
- safecpy(deftype, &opt[3], sizeof(deftype));
+ strlcpy(deftype, &opt[3], sizeof(deftype));
} else if (strncasecmp(opt, "querytype=", 10) == 0) {
if (testtype(&opt[10]))
- safecpy(deftype, &opt[10], sizeof(deftype));
+ strlcpy(deftype, &opt[10], sizeof(deftype));
} else if (strncasecmp(opt, "query=", 6) == 0) {
if (testtype(&opt[6]))
- safecpy(deftype, &opt[6], sizeof(deftype));
+ strlcpy(deftype, &opt[6], sizeof(deftype));
} else if (strncasecmp(opt, "qu=", 3) == 0) {
if (testtype(&opt[3]))
- safecpy(deftype, &opt[3], sizeof(deftype));
+ strlcpy(deftype, &opt[3], sizeof(deftype));
} else if (strncasecmp(opt, "q=", 2) == 0) {
if (testtype(&opt[2]))
- safecpy(deftype, &opt[2], sizeof(deftype));
+ strlcpy(deftype, &opt[2], sizeof(deftype));
} else if (strncasecmp(opt, "domain=", 7) == 0) {
- safecpy(domainopt, &opt[7], sizeof(domainopt));
+ strlcpy(domainopt, &opt[7], sizeof(domainopt));
set_search_domain(domainopt);
usesearch = ISC_TRUE;
} else if (strncasecmp(opt, "do=", 3) == 0) {
- safecpy(domainopt, &opt[3], sizeof(domainopt));
+ strlcpy(domainopt, &opt[3], sizeof(domainopt));
set_search_domain(domainopt);
usesearch = ISC_TRUE;
} else if (strncasecmp(opt, "port=", 5) == 0) {
@@ -677,11 +671,11 @@ addlookup(char *opt) {
lookup = make_empty_lookup();
if (get_reverse(store, sizeof(store), opt, lookup->ip6_int, ISC_TRUE)
== ISC_R_SUCCESS) {
- safecpy(lookup->textname, store, sizeof(lookup->textname));
+ strlcpy(lookup->textname, store, sizeof(lookup->textname));
lookup->rdtype = dns_rdatatype_ptr;
lookup->rdtypeset = ISC_TRUE;
} else {
- safecpy(lookup->textname, opt, sizeof(lookup->textname));
+ strlcpy(lookup->textname, opt, sizeof(lookup->textname));
lookup->rdtype = rdtype;
lookup->rdtypeset = ISC_TRUE;
}
diff --git a/contrib/bind9/bin/dnssec/dnssec-keyfromlabel.8 b/contrib/bind9/bin/dnssec/dnssec-keyfromlabel.8
index d8c19f2e527a..a0fd69351bdc 100644
--- a/contrib/bind9/bin/dnssec/dnssec-keyfromlabel.8
+++ b/contrib/bind9/bin/dnssec/dnssec-keyfromlabel.8
@@ -12,7 +12,7 @@
.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
.\" PERFORMANCE OF THIS SOFTWARE.
.\"
-.\" $Id: dnssec-keyfromlabel.8,v 1.18.14.1.2.1 2011-06-09 03:41:05 tbox Exp $
+.\" $Id: dnssec-keyfromlabel.8,v 1.18.14.2 2011-02-28 02:37:42 tbox Exp $
.\"
.hy 0
.ad l
diff --git a/contrib/bind9/bin/dnssec/dnssec-keyfromlabel.c b/contrib/bind9/bin/dnssec/dnssec-keyfromlabel.c
index 323f9187c64a..1323ed718691 100644
--- a/contrib/bind9/bin/dnssec/dnssec-keyfromlabel.c
+++ b/contrib/bind9/bin/dnssec/dnssec-keyfromlabel.c
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2007-2010 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2007-2011 Internet Systems Consortium, Inc. ("ISC")
*
* Permission to use, copy, modify, and/or distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
@@ -14,7 +14,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: dnssec-keyfromlabel.c,v 1.32 2010-12-23 04:07:59 marka Exp $ */
+/* $Id: dnssec-keyfromlabel.c,v 1.32.14.2 2011-03-12 04:59:14 tbox Exp $ */
/*! \file */
@@ -518,6 +518,9 @@ main(int argc, char **argv) {
{
isc_buffer_clear(&buf);
ret = dst_key_buildfilename(key, 0, directory, &buf);
+ if (ret != ISC_R_SUCCESS)
+ fatal("dst_key_buildfilename returned: %s\n",
+ isc_result_totext(ret));
if (exact)
fatal("%s: %s already exists\n", program, filename);
@@ -542,6 +545,9 @@ main(int argc, char **argv) {
isc_buffer_clear(&buf);
ret = dst_key_buildfilename(key, 0, NULL, &buf);
+ if (ret != ISC_R_SUCCESS)
+ fatal("dst_key_buildfilename returned: %s\n",
+ isc_result_totext(ret));
printf("%s\n", filename);
dst_key_free(&key);
diff --git a/contrib/bind9/bin/dnssec/dnssec-keyfromlabel.docbook b/contrib/bind9/bin/dnssec/dnssec-keyfromlabel.docbook
index be38a2465785..c731e6eab606 100644
--- a/contrib/bind9/bin/dnssec/dnssec-keyfromlabel.docbook
+++ b/contrib/bind9/bin/dnssec/dnssec-keyfromlabel.docbook
@@ -17,7 +17,7 @@
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
February 8, 2008
diff --git a/contrib/bind9/bin/dnssec/dnssec-keyfromlabel.html b/contrib/bind9/bin/dnssec/dnssec-keyfromlabel.html
index 2b1b23690bb1..c939ed68d75c 100644
--- a/contrib/bind9/bin/dnssec/dnssec-keyfromlabel.html
+++ b/contrib/bind9/bin/dnssec/dnssec-keyfromlabel.html
@@ -13,7 +13,7 @@
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
diff --git a/contrib/bind9/bin/dnssec/dnssec-keygen.c b/contrib/bind9/bin/dnssec/dnssec-keygen.c
index f369326aaf82..9a93ee3c9418 100644
--- a/contrib/bind9/bin/dnssec/dnssec-keygen.c
+++ b/contrib/bind9/bin/dnssec/dnssec-keygen.c
@@ -1,5 +1,5 @@
/*
- * Portions Copyright (C) 2004-2010 Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
* Portions Copyright (C) 1999-2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -29,7 +29,7 @@
* IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: dnssec-keygen.c,v 1.115 2010-12-23 04:07:59 marka Exp $ */
+/* $Id: dnssec-keygen.c,v 1.115.14.2 2011-03-12 04:59:14 tbox Exp $ */
/*! \file */
@@ -975,12 +975,15 @@ main(int argc, char **argv) {
if (verbose > 0) {
isc_buffer_clear(&buf);
- dst_key_buildfilename(key, 0, directory, &buf);
- fprintf(stderr,
- "%s: %s already exists, or might "
- "collide with another key upon "
- "revokation. Generating a new key\n",
- program, filename);
+ ret = dst_key_buildfilename(key, 0,
+ directory, &buf);
+ if (ret == ISC_R_SUCCESS)
+ fprintf(stderr,
+ "%s: %s already exists, or "
+ "might collide with another "
+ "key upon revokation. "
+ "Generating a new key\n",
+ program, filename);
}
dst_key_free(&key);
@@ -1001,6 +1004,9 @@ main(int argc, char **argv) {
isc_buffer_clear(&buf);
ret = dst_key_buildfilename(key, 0, NULL, &buf);
+ if (ret != ISC_R_SUCCESS)
+ fatal("dst_key_buildfilename returned: %s\n",
+ isc_result_totext(ret));
printf("%s\n", filename);
dst_key_free(&key);
if (prevkey != NULL)
diff --git a/contrib/bind9/bin/dnssec/dnssec-settime.8 b/contrib/bind9/bin/dnssec/dnssec-settime.8
index 4390494474ce..cbe4092e52a1 100644
--- a/contrib/bind9/bin/dnssec/dnssec-settime.8
+++ b/contrib/bind9/bin/dnssec/dnssec-settime.8
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2009, 2010 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2009-2011 Internet Systems Consortium, Inc. ("ISC")
.\"
.\" Permission to use, copy, modify, and/or distribute this software for any
.\" purpose with or without fee is hereby granted, provided that the above
@@ -12,7 +12,7 @@
.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
.\" PERFORMANCE OF THIS SOFTWARE.
.\"
-.\" $Id: dnssec-settime.8,v 1.14 2010-08-17 01:15:26 tbox Exp $
+.\" $Id: dnssec-settime.8,v 1.14.70.1 2011-03-22 02:37:44 tbox Exp $
.\"
.hy 0
.ad l
@@ -59,7 +59,7 @@ and
.RS 4
Force an update of an old\-format key with no metadata fields. Without this option,
\fBdnssec\-settime\fR
-will fail when attempting to update a legacy key. With this option, the key will be recreated in the new format, but with the original key data retained. The key's creation date will be set to the present time.
+will fail when attempting to update a legacy key. With this option, the key will be recreated in the new format, but with the original key data retained. The key's creation date will be set to the present time. If no other values are specified, then the key's publication and activation dates will also be set to the present time.
.RE
.PP
\-K \fIdirectory\fR
@@ -162,5 +162,5 @@ RFC 5011.
.PP
Internet Systems Consortium
.SH "COPYRIGHT"
-Copyright \(co 2009, 2010 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2009\-2011 Internet Systems Consortium, Inc. ("ISC")
.br
diff --git a/contrib/bind9/bin/dnssec/dnssec-settime.c b/contrib/bind9/bin/dnssec/dnssec-settime.c
index 364e2ab59268..a1258ef30cda 100644
--- a/contrib/bind9/bin/dnssec/dnssec-settime.c
+++ b/contrib/bind9/bin/dnssec/dnssec-settime.c
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2009, 2010 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2009-2011 Internet Systems Consortium, Inc. ("ISC")
*
* Permission to use, copy, modify, and/or distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
@@ -14,7 +14,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: dnssec-settime.c,v 1.28 2010-12-19 07:29:36 each Exp $ */
+/* $Id: dnssec-settime.c,v 1.28.16.3 2011-06-02 20:24:11 each Exp $ */
/*! \file */
@@ -81,8 +81,7 @@ usage(void) {
"deletion date\n");
fprintf(stderr, "Printing options:\n");
fprintf(stderr, " -p C/P/A/R/I/D/all: print a particular time "
- "value or values "
- "[default: all]\n");
+ "value or values\n");
fprintf(stderr, " -u: print times in unix epoch "
"format\n");
fprintf(stderr, "Output:\n");
@@ -513,6 +512,16 @@ main(int argc, char **argv) {
else if (unsetdel)
dst_key_unsettime(key, DST_TIME_DELETE);
+ /*
+ * No metadata changes were made but we're forcing an upgrade
+ * to the new format anyway: use "-P now -A now" as the default
+ */
+ if (force && !changed) {
+ dst_key_settime(key, DST_TIME_PUBLISH, now);
+ dst_key_settime(key, DST_TIME_ACTIVATE, now);
+ changed = ISC_TRUE;
+ }
+
/*
* Print out time values, if -p was used.
*/
diff --git a/contrib/bind9/bin/dnssec/dnssec-settime.docbook b/contrib/bind9/bin/dnssec/dnssec-settime.docbook
index 1096cb7ec5ae..daf720ba9362 100644
--- a/contrib/bind9/bin/dnssec/dnssec-settime.docbook
+++ b/contrib/bind9/bin/dnssec/dnssec-settime.docbook
@@ -2,7 +2,7 @@
"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
[]>
-
+
July 15, 2009
@@ -38,6 +38,7 @@
20092010
+ 2011Internet Systems Consortium, Inc. ("ISC")
@@ -98,7 +99,9 @@
fail when attempting to update a legacy key. With this option,
the key will be recreated in the new format, but with the
original key data retained. The key's creation date will be
- set to the present time.
+ set to the present time. If no other values are specified,
+ then the key's publication and activation dates will also
+ be set to the present time.
diff --git a/contrib/bind9/bin/dnssec/dnssec-settime.html b/contrib/bind9/bin/dnssec/dnssec-settime.html
index 84c8dde49a1d..baca8f56ece5 100644
--- a/contrib/bind9/bin/dnssec/dnssec-settime.html
+++ b/contrib/bind9/bin/dnssec/dnssec-settime.html
@@ -1,5 +1,5 @@
-
+
@@ -31,7 +31,7 @@
dnssec-settime
reads a DNSSEC private key file and sets the key timing metadata
as specified by the -P, -A,
@@ -56,7 +56,7 @@
-
OPTIONS
+
OPTIONS
-f
@@ -65,7 +65,9 @@
fail when attempting to update a legacy key. With this option,
the key will be recreated in the new format, but with the
original key data retained. The key's creation date will be
- set to the present time.
+ set to the present time. If no other values are specified,
+ then the key's publication and activation dates will also
+ be set to the present time.
-K directory
@@ -87,7 +89,7 @@
-
TIMING OPTIONS
+
TIMING OPTIONS
Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.
If the argument begins with a '+' or '-', it is interpreted as
@@ -166,7 +168,7 @@
-
PRINTING OPTIONS
+
PRINTING OPTIONS
dnssec-settime can also be used to print the
timing metadata associated with a key.
@@ -192,7 +194,7 @@
diff --git a/contrib/bind9/bin/dnssec/dnssec-signzone.c b/contrib/bind9/bin/dnssec/dnssec-signzone.c
index 3997a135b465..fe02d2e6bcec 100644
--- a/contrib/bind9/bin/dnssec/dnssec-signzone.c
+++ b/contrib/bind9/bin/dnssec/dnssec-signzone.c
@@ -1,5 +1,5 @@
/*
- * Portions Copyright (C) 2004-2010 Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
* Portions Copyright (C) 1999-2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -29,7 +29,7 @@
* IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: dnssec-signzone.c,v 1.262 2010-06-03 23:51:04 tbox Exp $ */
+/* $Id: dnssec-signzone.c,v 1.262.110.9 2011-07-19 23:47:12 tbox Exp $ */
/*! \file */
@@ -338,7 +338,7 @@ keythatsigned(dns_rdata_rrsig_t *rrsig) {
} else {
dns_dnsseckey_create(mctx, &pubkey, &key);
}
- key->force_publish = ISC_TRUE;
+ key->force_publish = ISC_FALSE;
key->force_sign = ISC_FALSE;
ISC_LIST_APPEND(keylist, key, link);
@@ -486,32 +486,32 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
if (!expired)
keep = ISC_TRUE;
} else if (issigningkey(key)) {
- if (!expired && setverifies(name, set, key->key,
- &sigrdata)) {
+ if (!expired && rrsig.originalttl == set->ttl &&
+ setverifies(name, set, key->key, &sigrdata)) {
vbprintf(2, "\trrsig by %s retained\n", sigstr);
keep = ISC_TRUE;
wassignedby[key->index] = ISC_TRUE;
nowsignedby[key->index] = ISC_TRUE;
} else {
vbprintf(2, "\trrsig by %s dropped - %s\n",
- sigstr,
- expired ? "expired" :
- "failed to verify");
+ sigstr, expired ? "expired" :
+ rrsig.originalttl != set->ttl ?
+ "ttl change" : "failed to verify");
wassignedby[key->index] = ISC_TRUE;
resign = ISC_TRUE;
}
} else if (iszonekey(key)) {
- if (!expired && setverifies(name, set, key->key,
- &sigrdata)) {
+ if (!expired && rrsig.originalttl == set->ttl &&
+ setverifies(name, set, key->key, &sigrdata)) {
vbprintf(2, "\trrsig by %s retained\n", sigstr);
keep = ISC_TRUE;
wassignedby[key->index] = ISC_TRUE;
nowsignedby[key->index] = ISC_TRUE;
} else {
vbprintf(2, "\trrsig by %s dropped - %s\n",
- sigstr,
- expired ? "expired" :
- "failed to verify");
+ sigstr, expired ? "expired" :
+ rrsig.originalttl != set->ttl ?
+ "ttl change" : "failed to verify");
wassignedby[key->index] = ISC_TRUE;
}
} else if (!expired) {
@@ -522,7 +522,8 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
}
if (keep) {
- nowsignedby[key->index] = ISC_TRUE;
+ if (key != NULL)
+ nowsignedby[key->index] = ISC_TRUE;
INCSTAT(nretained);
if (sigset.ttl != ttl) {
vbprintf(2, "\tfixing ttl %s\n", sigstr);
@@ -1387,6 +1388,13 @@ verifyset(dns_rdataset_t *rdataset, dns_name_t *name, dns_dbnode_t *node,
dns_rdataset_current(&sigrdataset, &rdata);
dns_rdata_tostruct(&rdata, &sig, NULL);
+ if (rdataset->ttl != sig.originalttl) {
+ dns_name_format(name, namebuf, sizeof(namebuf));
+ type_format(rdataset->type, typebuf, sizeof(typebuf));
+ fprintf(stderr, "TTL mismatch for %s %s keytag %u\n",
+ namebuf, typebuf, sig.keyid);
+ continue;
+ }
if ((set_algorithms[sig.algorithm] != 0) ||
(ksk_algorithms[sig.algorithm] == 0))
continue;
@@ -1443,14 +1451,14 @@ verifynode(dns_name_t *name, dns_dbnode_t *node, isc_boolean_t delegation,
/*%
* Verify that certain things are sane:
*
- * The apex has a DNSKEY record with at least one KSK, and at least
+ * The apex has a DNSKEY RRset with at least one KSK, and at least
* one ZSK if the -x flag was not used.
*
- * The DNSKEY record was signed with at least one of the KSKs in this
- * set.
+ * The DNSKEY record was signed with at least one of the KSKs in
+ * the DNSKEY RRset.
*
* The rest of the zone was signed with at least one of the ZSKs
- * present in the DNSKEY RRSET.
+ * present in the DNSKEY RRset.
*/
static void
verifyzone(void) {
@@ -1461,13 +1469,12 @@ verifyzone(void) {
dns_name_t *name, *nextname, *zonecut;
dns_rdata_dnskey_t dnskey;
dns_rdata_t rdata = DNS_RDATA_INIT;
- dns_rdataset_t rdataset;
- dns_rdataset_t sigrdataset;
+ dns_rdataset_t keyset, soaset;
+ dns_rdataset_t keysigs, soasigs;
int i;
isc_boolean_t done = ISC_FALSE;
isc_boolean_t first = ISC_TRUE;
isc_boolean_t goodksk = ISC_FALSE;
- isc_boolean_t goodzsk = ISC_FALSE;
isc_result_t result;
unsigned char revoked_ksk[256];
unsigned char revoked_zsk[256];
@@ -1489,18 +1496,30 @@ verifyzone(void) {
fatal("failed to find the zone's origin: %s",
isc_result_totext(result));
- dns_rdataset_init(&rdataset);
- dns_rdataset_init(&sigrdataset);
+ dns_rdataset_init(&keyset);
+ dns_rdataset_init(&keysigs);
+ dns_rdataset_init(&soaset);
+ dns_rdataset_init(&soasigs);
+
result = dns_db_findrdataset(gdb, node, gversion,
dns_rdatatype_dnskey,
- 0, 0, &rdataset, &sigrdataset);
- dns_db_detachnode(gdb, &node);
+ 0, 0, &keyset, &keysigs);
if (result != ISC_R_SUCCESS)
fatal("cannot find DNSKEY rrset\n");
- if (!dns_rdataset_isassociated(&sigrdataset))
+ result = dns_db_findrdataset(gdb, node, gversion,
+ dns_rdatatype_soa,
+ 0, 0, &soaset, &soasigs);
+ dns_db_detachnode(gdb, &node);
+ if (result != ISC_R_SUCCESS)
+ fatal("cannot find SOA rrset\n");
+
+ if (!dns_rdataset_isassociated(&keysigs))
fatal("cannot find DNSKEY RRSIGs\n");
+ if (!dns_rdataset_isassociated(&soasigs))
+ fatal("cannot find SOA RRSIGs\n");
+
memset(revoked_ksk, 0, sizeof(revoked_ksk));
memset(revoked_zsk, 0, sizeof(revoked_zsk));
memset(standby_ksk, 0, sizeof(standby_ksk));
@@ -1517,10 +1536,10 @@ verifyzone(void) {
* and one ZSK per algorithm in it (or, if -x was used, one
* self-signing KSK).
*/
- for (result = dns_rdataset_first(&rdataset);
+ for (result = dns_rdataset_first(&keyset);
result == ISC_R_SUCCESS;
- result = dns_rdataset_next(&rdataset)) {
- dns_rdataset_current(&rdataset, &rdata);
+ result = dns_rdataset_next(&keyset)) {
+ dns_rdataset_current(&keyset, &rdata);
result = dns_rdata_tostruct(&rdata, &dnskey, NULL);
check_result(result, "dns_rdata_tostruct");
@@ -1528,8 +1547,8 @@ verifyzone(void) {
;
else if ((dnskey.flags & DNS_KEYFLAG_REVOKE) != 0) {
if ((dnskey.flags & DNS_KEYFLAG_KSK) != 0 &&
- !dns_dnssec_selfsigns(&rdata, gorigin, &rdataset,
- &sigrdataset, ISC_FALSE,
+ !dns_dnssec_selfsigns(&rdata, gorigin, &keyset,
+ &keysigs, ISC_FALSE,
mctx)) {
char namebuf[DNS_NAME_FORMATSIZE];
char buffer[1024];
@@ -1551,8 +1570,8 @@ verifyzone(void) {
revoked_zsk[dnskey.algorithm] != 255)
revoked_zsk[dnskey.algorithm]++;
} else if ((dnskey.flags & DNS_KEYFLAG_KSK) != 0) {
- if (dns_dnssec_selfsigns(&rdata, gorigin, &rdataset,
- &sigrdataset, ISC_FALSE, mctx)) {
+ if (dns_dnssec_selfsigns(&rdata, gorigin, &keyset,
+ &keysigs, ISC_FALSE, mctx)) {
if (ksk_algorithms[dnskey.algorithm] != 255)
ksk_algorithms[dnskey.algorithm]++;
goodksk = ISC_TRUE;
@@ -1560,8 +1579,8 @@ verifyzone(void) {
if (standby_ksk[dnskey.algorithm] != 255)
standby_ksk[dnskey.algorithm]++;
}
- } else if (dns_dnssec_selfsigns(&rdata, gorigin, &rdataset,
- &sigrdataset, ISC_FALSE,
+ } else if (dns_dnssec_selfsigns(&rdata, gorigin, &keyset,
+ &keysigs, ISC_FALSE,
mctx)) {
#ifdef ALLOW_KSKLESS_ZONES
if (self_algorithms[dnskey.algorithm] != 255)
@@ -1569,7 +1588,10 @@ verifyzone(void) {
#endif
if (zsk_algorithms[dnskey.algorithm] != 255)
zsk_algorithms[dnskey.algorithm]++;
- goodzsk = ISC_TRUE;
+ } else if (dns_dnssec_signs(&rdata, gorigin, &soaset,
+ &soasigs, ISC_FALSE, mctx)) {
+ if (zsk_algorithms[dnskey.algorithm] != 255)
+ zsk_algorithms[dnskey.algorithm]++;
} else {
if (standby_zsk[dnskey.algorithm] != 255)
standby_zsk[dnskey.algorithm]++;
@@ -1580,7 +1602,9 @@ verifyzone(void) {
dns_rdata_freestruct(&dnskey);
dns_rdata_reset(&rdata);
}
- dns_rdataset_disassociate(&sigrdataset);
+ dns_rdataset_disassociate(&keysigs);
+ dns_rdataset_disassociate(&soaset);
+ dns_rdataset_disassociate(&soasigs);
#ifdef ALLOW_KSKLESS_ZONES
if (!goodksk) {
@@ -1595,7 +1619,7 @@ verifyzone(void) {
}
#else
if (!goodksk) {
- fatal("no self signed KSK's found");
+ fatal("No self signed KSK's found");
}
#endif
@@ -1669,7 +1693,7 @@ verifyzone(void) {
dns_name_copy(name, zonecut, NULL);
isdelegation = ISC_TRUE;
}
- verifynode(name, node, isdelegation, &rdataset,
+ verifynode(name, node, isdelegation, &keyset,
ksk_algorithms, bad_algorithms);
result = dns_dbiterator_next(dbiter);
nextnode = NULL;
@@ -1706,13 +1730,13 @@ verifyzone(void) {
result = dns_dbiterator_next(dbiter) ) {
result = dns_dbiterator_current(dbiter, &node, name);
check_dns_dbiterator_current(result);
- verifynode(name, node, ISC_FALSE, &rdataset,
+ verifynode(name, node, ISC_FALSE, &keyset,
ksk_algorithms, bad_algorithms);
dns_db_detachnode(gdb, &node);
}
dns_dbiterator_destroy(&dbiter);
- dns_rdataset_disassociate(&rdataset);
+ dns_rdataset_disassociate(&keyset);
/*
* If we made it this far, we have what we consider a properly signed
@@ -2192,6 +2216,7 @@ addnsec3param(const unsigned char *salt, size_t salt_length,
result = dns_rdata_fromstruct(&rdata, gclass,
dns_rdatatype_nsec3param,
&nsec3param, &b);
+ check_result(result, "dns_rdata_fromstruct()");
rdatalist.rdclass = rdata.rdclass;
rdatalist.type = rdata.type;
rdatalist.covers = 0;
@@ -2801,7 +2826,7 @@ loadzonekeys(isc_boolean_t preserve_keys, isc_boolean_t load_public) {
}
keyttl = rdataset.ttl;
- /* Load keys corresponding to the existing DNSKEY RRset */
+ /* Load keys corresponding to the existing DNSKEY RRset. */
result = dns_dnssec_keylistfromrdataset(gorigin, directory, mctx,
&rdataset, &keysigs, &soasigs,
preserve_keys, load_public,
@@ -3320,28 +3345,36 @@ removetempfile(void) {
}
static void
-print_stats(isc_time_t *timer_start, isc_time_t *timer_finish) {
- isc_uint64_t runtime_us; /* Runtime in microseconds */
- isc_uint64_t runtime_ms; /* Runtime in milliseconds */
+print_stats(isc_time_t *timer_start, isc_time_t *timer_finish,
+ isc_time_t *sign_start, isc_time_t *sign_finish)
+{
+ isc_uint64_t time_us; /* Time in microseconds */
+ isc_uint64_t time_ms; /* Time in milliseconds */
isc_uint64_t sig_ms; /* Signatures per millisecond */
- runtime_us = isc_time_microdiff(timer_finish, timer_start);
-
printf("Signatures generated: %10d\n", nsigned);
printf("Signatures retained: %10d\n", nretained);
printf("Signatures dropped: %10d\n", ndropped);
printf("Signatures successfully verified: %10d\n", nverified);
printf("Signatures unsuccessfully verified: %10d\n", nverifyfailed);
- runtime_ms = runtime_us / 1000;
- printf("Runtime in seconds: %7u.%03u\n",
- (unsigned int) (runtime_ms / 1000),
- (unsigned int) (runtime_ms % 1000));
- if (runtime_us > 0) {
- sig_ms = ((isc_uint64_t)nsigned * 1000000000) / runtime_us;
+
+ time_us = isc_time_microdiff(sign_finish, sign_start);
+ time_ms = time_us / 1000;
+ printf("Signing time in seconds: %7u.%03u\n",
+ (unsigned int) (time_ms / 1000),
+ (unsigned int) (time_ms % 1000));
+ if (time_us > 0) {
+ sig_ms = ((isc_uint64_t)nsigned * 1000000000) / time_us;
printf("Signatures per second: %7u.%03u\n",
(unsigned int) sig_ms / 1000,
(unsigned int) sig_ms % 1000);
}
+
+ time_us = isc_time_microdiff(timer_finish, timer_start);
+ time_ms = time_us / 1000;
+ printf("Runtime in seconds: %7u.%03u\n",
+ (unsigned int) (time_ms / 1000),
+ (unsigned int) (time_ms % 1000));
}
int
@@ -3355,6 +3388,7 @@ main(int argc, char *argv[]) {
int ndskeys = 0;
char *endp;
isc_time_t timer_start, timer_finish;
+ isc_time_t sign_start, sign_finish;
dns_dnsseckey_t *key;
isc_result_t result;
isc_log_t *log = NULL;
@@ -3805,6 +3839,8 @@ main(int argc, char *argv[]) {
nokeys = ISC_TRUE;
}
+ warnifallksk(gdb);
+
if (IS_NSEC3) {
unsigned int max;
result = dns_nsec3_maxiterations(gdb, NULL, mctx, &max);
@@ -3814,8 +3850,6 @@ main(int argc, char *argv[]) {
"strength. Maximum iterations allowed %u.", max);
}
- warnifallksk(gdb);
-
gversion = NULL;
result = dns_db_newversion(gdb, &gversion);
check_result(result, "dns_db_newversion()");
@@ -3895,6 +3929,7 @@ main(int argc, char *argv[]) {
RUNTIME_CHECK(isc_mutex_init(&statslock) == ISC_R_SUCCESS);
presign();
+ TIME_NOW(&sign_start);
signapex();
if (!finished) {
/*
@@ -3919,6 +3954,7 @@ main(int argc, char *argv[]) {
isc_taskmgr_destroy(&taskmgr);
isc_mem_put(mctx, tasks, ntasks * sizeof(isc_task_t *));
postsign();
+ TIME_NOW(&sign_finish);
verifyzone();
if (outputformat != dns_masterformat_text) {
@@ -3972,7 +4008,8 @@ main(int argc, char *argv[]) {
if (printstats) {
TIME_NOW(&timer_finish);
- print_stats(&timer_start, &timer_finish);
+ print_stats(&timer_start, &timer_finish,
+ &sign_start, &sign_finish);
}
return (0);
diff --git a/contrib/bind9/bin/named/Makefile.in b/contrib/bind9/bin/named/Makefile.in
index a3dbb3802dc9..86400c47f026 100644
--- a/contrib/bind9/bin/named/Makefile.in
+++ b/contrib/bind9/bin/named/Makefile.in
@@ -1,4 +1,4 @@
-# Copyright (C) 2004-2010 Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
# Copyright (C) 1998-2002 Internet Software Consortium.
#
# Permission to use, copy, modify, and/or distribute this software for any
@@ -13,7 +13,7 @@
# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
# PERFORMANCE OF THIS SOFTWARE.
-# $Id: Makefile.in,v 1.114 2010-12-22 09:00:40 marka Exp $
+# $Id: Makefile.in,v 1.114.14.2 2011-03-10 23:47:25 tbox Exp $
srcdir = @srcdir@
VPATH = @srcdir@
@@ -45,7 +45,7 @@ CINCLUDES = -I${srcdir}/include -I${srcdir}/unix/include -I. \
${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} ${ISC_INCLUDES} \
${DLZDRIVER_INCLUDES} ${DBDRIVER_INCLUDES} @DST_OPENSSL_INC@
-CDEFINES = @USE_DLZ@ @USE_PKCS11@ @USE_OPENSSL@
+CDEFINES = @CONTRIB_DLZ@ @USE_PKCS11@ @USE_OPENSSL@
CWARNINGS =
@@ -89,7 +89,7 @@ OBJS = builtin.@O@ client.@O@ config.@O@ control.@O@ \
lwdgnba.@O@ lwdgrbn.@O@ lwdnoop.@O@ lwsearch.@O@ \
${DLZDRIVER_OBJS} ${DBDRIVER_OBJS}
-UOBJS = unix/os.@O@
+UOBJS = unix/os.@O@ unix/dlz_dlopen_driver.@O@
SYMOBJS = symtbl.@O@
diff --git a/contrib/bind9/bin/named/client.c b/contrib/bind9/bin/named/client.c
index bc9cc878adbc..2115ac101bcf 100644
--- a/contrib/bind9/bin/named/client.c
+++ b/contrib/bind9/bin/named/client.c
@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: client.c,v 1.271 2011-01-11 23:47:12 tbox Exp $ */
+/* $Id: client.c,v 1.271.10.2 2011-07-28 04:30:54 marka Exp $ */
#include
@@ -633,6 +633,7 @@ ns_client_endrequest(ns_client_t *client) {
dns_message_puttemprdataset(client->message, &client->opt);
}
+ client->signer = NULL;
client->udpsize = 512;
client->extflags = 0;
client->ednsversion = -1;
@@ -1312,6 +1313,12 @@ ns_client_isself(dns_view_t *myview, dns_tsigkey_t *mykey,
UNUSED(arg);
+ /*
+ * ns_g_server->interfacemgr is task exclusive locked.
+ */
+ if (ns_g_server->interfacemgr == NULL)
+ return (ISC_TRUE);
+
if (!ns_interfacemgr_listeningon(ns_g_server->interfacemgr, dstaddr))
return (ISC_FALSE);
@@ -2095,6 +2102,7 @@ client_create(ns_clientmgr_t *manager, ns_client_t **clientp) {
client->next = NULL;
client->shutdown = NULL;
client->shutdown_arg = NULL;
+ client->signer = NULL;
dns_name_init(&client->signername, NULL);
client->mortal = ISC_FALSE;
client->tcpquota = NULL;
diff --git a/contrib/bind9/bin/named/config.c b/contrib/bind9/bin/named/config.c
index 704d7ecc55ef..e34e5c4e63bf 100644
--- a/contrib/bind9/bin/named/config.c
+++ b/contrib/bind9/bin/named/config.c
@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: config.c,v 1.113.16.1.2.1 2011-06-02 23:47:28 tbox Exp $ */
+/* $Id: config.c,v 1.113.16.2 2011-02-28 01:19:58 tbox Exp $ */
/*! \file */
diff --git a/contrib/bind9/bin/named/controlconf.c b/contrib/bind9/bin/named/controlconf.c
index 16d375b0083a..bd269e519b3e 100644
--- a/contrib/bind9/bin/named/controlconf.c
+++ b/contrib/bind9/bin/named/controlconf.c
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2008, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 2001-2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: controlconf.c,v 1.60 2008-07-23 23:27:54 marka Exp $ */
+/* $Id: controlconf.c,v 1.60.544.2 2011-03-12 04:59:14 tbox Exp $ */
/*! \file */
@@ -859,7 +859,7 @@ get_rndckey(isc_mem_t *mctx, controlkeylist_t *keyids) {
cfg_obj_log(key, ns_g_lctx, ISC_LOG_WARNING,
"secret for key '%s' on command channel: %s",
keyid->keyname, isc_result_totext(result));
- CHECK(result);
+ goto cleanup;
}
keyid->secret.length = isc_buffer_usedlength(&b);
diff --git a/contrib/bind9/bin/named/include/dlz/dlz_dlopen_driver.h b/contrib/bind9/bin/named/include/dlz/dlz_dlopen_driver.h
new file mode 100644
index 000000000000..fc51c49da767
--- /dev/null
+++ b/contrib/bind9/bin/named/include/dlz/dlz_dlopen_driver.h
@@ -0,0 +1,27 @@
+/*
+ * Copyright (C) 2011 Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: dlz_dlopen_driver.h,v 1.1.4.4 2011-03-17 09:41:06 fdupont Exp $ */
+
+#ifndef DLZ_DLOPEN_DRIVER_H
+#define DLZ_DLOPEN_DRIVER_H
+
+isc_result_t
+dlz_dlopen_init(isc_mem_t *mctx);
+
+void
+dlz_dlopen_clear(void);
+#endif
diff --git a/contrib/bind9/bin/named/include/named/globals.h b/contrib/bind9/bin/named/include/named/globals.h
index f155c7f05ed5..7bea32d52b55 100644
--- a/contrib/bind9/bin/named/include/named/globals.h
+++ b/contrib/bind9/bin/named/include/named/globals.h
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2004-2010 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: globals.h,v 1.89 2010-09-15 12:07:55 marka Exp $ */
+/* $Id: globals.h,v 1.89.54.2 2011-06-17 23:47:10 tbox Exp $ */
#ifndef NAMED_GLOBALS_H
#define NAMED_GLOBALS_H 1
@@ -26,6 +26,7 @@
#include
#include
+#include
#include
#include
@@ -102,6 +103,7 @@ EXTERN const char * lwresd_g_resolvconffile INIT("/etc"
EXTERN isc_boolean_t ns_g_conffileset INIT(ISC_FALSE);
EXTERN isc_boolean_t lwresd_g_useresolvconf INIT(ISC_FALSE);
EXTERN isc_uint16_t ns_g_udpsize INIT(4096);
+EXTERN cfg_aclconfctx_t * ns_g_aclconfctx INIT(NULL);
/*
* Initial resource limits.
diff --git a/contrib/bind9/bin/named/interfacemgr.c b/contrib/bind9/bin/named/interfacemgr.c
index e99d3b9cfe38..513fb2491094 100644
--- a/contrib/bind9/bin/named/interfacemgr.c
+++ b/contrib/bind9/bin/named/interfacemgr.c
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2004-2009 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2009, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2002 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: interfacemgr.c,v 1.95 2009-01-17 23:47:42 tbox Exp $ */
+/* $Id: interfacemgr.c,v 1.95.426.2 2011-03-12 04:59:14 tbox Exp $ */
/*! \file */
@@ -379,7 +379,7 @@ ns_interface_setup(ns_interfacemgr_t *mgr, isc_sockaddr_t *addr,
}
}
*ifpret = ifp;
- return (ISC_R_SUCCESS);
+ return (result);
cleanup_interface:
ISC_LIST_UNLINK(ifp->mgr->interfaces, ifp, link);
@@ -964,7 +964,6 @@ isc_boolean_t
ns_interfacemgr_listeningon(ns_interfacemgr_t *mgr, isc_sockaddr_t *addr) {
isc_sockaddr_t *old;
- old = ISC_LIST_HEAD(mgr->listenon);
for (old = ISC_LIST_HEAD(mgr->listenon);
old != NULL;
old = ISC_LIST_NEXT(old, link))
diff --git a/contrib/bind9/bin/named/logconf.c b/contrib/bind9/bin/named/logconf.c
index 8ae55ff7c54e..4fcb4e8dcaed 100644
--- a/contrib/bind9/bin/named/logconf.c
+++ b/contrib/bind9/bin/named/logconf.c
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2001 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -15,12 +15,13 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: logconf.c,v 1.42 2007-06-19 23:46:59 tbox Exp $ */
+/* $Id: logconf.c,v 1.42.816.3 2011-03-05 23:52:06 tbox Exp $ */
/*! \file */
#include
+#include
#include
#include
#include
@@ -130,7 +131,7 @@ channel_fromconf(const cfg_obj_t *channel, isc_logconfig_t *lctx) {
}
type = ISC_LOG_TONULL;
-
+
if (fileobj != NULL) {
const cfg_obj_t *pathobj = cfg_tuple_get(fileobj, "file");
const cfg_obj_t *sizeobj = cfg_tuple_get(fileobj, "size");
@@ -140,7 +141,7 @@ channel_fromconf(const cfg_obj_t *channel, isc_logconfig_t *lctx) {
isc_offset_t size = 0;
type = ISC_LOG_TOFILE;
-
+
if (versionsobj != NULL && cfg_obj_isuint32(versionsobj))
versions = cfg_obj_asuint32(versionsobj);
if (versionsobj != NULL && cfg_obj_isstring(versionsobj) &&
@@ -219,26 +220,38 @@ channel_fromconf(const cfg_obj_t *channel, isc_logconfig_t *lctx) {
if (result == ISC_R_SUCCESS && type == ISC_LOG_TOFILE) {
FILE *fp;
-
- /*
- * Test that the file can be opened, since isc_log_open()
- * can't effectively report failures when called in
- * isc_log_doit().
- */
- result = isc_stdio_open(dest.file.name, "a", &fp);
- if (result != ISC_R_SUCCESS)
- isc_log_write(ns_g_lctx, CFG_LOGCATEGORY_CONFIG,
- NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
- "logging channel '%s' file '%s': %s",
- channelname, dest.file.name,
- isc_result_totext(result));
- else
- (void)isc_stdio_close(fp);
/*
- * Allow named to continue by returning success.
- */
- result = ISC_R_SUCCESS;
+ * Test to make sure that file is a plain file.
+ * Fix defect #22771
+ */
+ result = isc_file_isplainfile(dest.file.name);
+ if (result == ISC_R_SUCCESS ||
+ result == ISC_R_FILENOTFOUND) {
+ /*
+ * Test that the file can be opened, since
+ * isc_log_open() can't effectively report
+ * failures when called in
+ * isc_log_doit().
+ */
+ result = isc_stdio_open(dest.file.name, "a", &fp);
+ if (result != ISC_R_SUCCESS) {
+ syslog(LOG_ERR,
+ "isc_stdio_open '%s' failed: %s",
+ dest.file.name,
+ isc_result_totext(result));
+ fprintf(stderr,
+ "isc_stdio_open '%s' failed: %s",
+ dest.file.name,
+ isc_result_totext(result));
+ } else
+ (void)isc_stdio_close(fp);
+ } else {
+ syslog(LOG_ERR, "isc_file_isplainfile '%s' failed: %s",
+ dest.file.name, isc_result_totext(result));
+ fprintf(stderr, "isc_file_isplainfile '%s' failed: %s",
+ dest.file.name, isc_result_totext(result));
+ }
}
return (result);
diff --git a/contrib/bind9/bin/named/main.c b/contrib/bind9/bin/named/main.c
index 84d86b146f4c..d22611360120 100644
--- a/contrib/bind9/bin/named/main.c
+++ b/contrib/bind9/bin/named/main.c
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2004-2010 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: main.c,v 1.180 2010-12-22 03:59:02 marka Exp $ */
+/* $Id: main.c,v 1.180.14.3 2011-03-11 06:47:00 marka Exp $ */
/*! \file */
@@ -51,6 +51,8 @@
#include
+#include
+
/*
* Defining NS_MAIN provides storage declarations (rather than extern)
* for variables in named/globals.h.
@@ -81,10 +83,10 @@
*/
/* #include "xxdb.h" */
+#ifdef CONTRIB_DLZ
/*
- * Include DLZ drivers if appropriate.
+ * Include contributed DLZ drivers if appropriate.
*/
-#ifdef DLZ
#include
#endif
@@ -560,6 +562,7 @@ parse_command_line(int argc, char *argv[]) {
argc -= isc_commandline_index;
argv += isc_commandline_index;
+ POST(argv);
if (argc > 0) {
usage();
@@ -856,9 +859,19 @@ setup(void) {
*/
/* xxdb_init(); */
-#ifdef DLZ
+#ifdef ISC_DLZ_DLOPEN
/*
- * Register any DLZ drivers.
+ * Register the DLZ "dlopen" driver.
+ */
+ result = dlz_dlopen_init(ns_g_mctx);
+ if (result != ISC_R_SUCCESS)
+ ns_main_earlyfatal("dlz_dlopen_init() failed: %s",
+ isc_result_totext(result));
+#endif
+
+#if CONTRIB_DLZ
+ /*
+ * Register any other contributed DLZ drivers.
*/
result = dlz_drivers_init();
if (result != ISC_R_SUCCESS)
@@ -882,12 +895,18 @@ cleanup(void) {
*/
/* xxdb_clear(); */
-#ifdef DLZ
+#ifdef CONTRIB_DLZ
/*
- * Unregister any DLZ drivers.
+ * Unregister contributed DLZ drivers.
*/
dlz_drivers_clear();
#endif
+#ifdef ISC_DLZ_DLOPEN
+ /*
+ * Unregister "dlopen" DLZ driver.
+ */
+ dlz_dlopen_clear();
+#endif
dns_name_destroy();
diff --git a/contrib/bind9/bin/named/query.c b/contrib/bind9/bin/named/query.c
index 1950257dca2c..9be178beddb0 100644
--- a/contrib/bind9/bin/named/query.c
+++ b/contrib/bind9/bin/named/query.c
@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: query.c,v 1.353.8.2.2.5 2011-06-09 03:17:10 marka Exp $ */
+/* $Id: query.c,v 1.353.8.11 2011-06-09 03:14:03 marka Exp $ */
/*! \file */
@@ -31,9 +31,7 @@
#include
#include
#include
-#ifdef DLZ
#include
-#endif
#include
#include
#include
@@ -1027,7 +1025,6 @@ query_getdb(ns_client_t *client, dns_name_t *name, dns_rdatatype_t qtype,
{
isc_result_t result;
-#ifdef DLZ
isc_result_t tresult;
unsigned int namelabels;
unsigned int zonelabels;
@@ -1093,16 +1090,10 @@ query_getdb(ns_client_t *client, dns_name_t *name, dns_rdatatype_t qtype,
result = tresult;
}
}
-#else
- result = query_getzonedb(client, name, qtype, options,
- zonep, dbp, versionp);
-#endif
/* If successful, Transfer ownership of zone. */
if (result == ISC_R_SUCCESS) {
-#ifdef DLZ
*zonep = zone;
-#endif
/*
* If neither attempt above succeeded, return the cache instead
*/
@@ -1633,6 +1624,7 @@ query_addadditional2(void *arg, dns_name_t *name, dns_rdatatype_t qtype) {
need_addname = ISC_FALSE;
zone = NULL;
needadditionalcache = ISC_FALSE;
+ POST(needadditionalcache);
additionaltype = dns_rdatasetadditional_fromauth;
dns_name_init(&cfname, NULL);
@@ -4305,11 +4297,12 @@ rpz_rewrite(ns_client_t *client, dns_rdatatype_t qtype,
* Check rules for the name if this it the first time,
* i.e. we've not been recursing.
*/
- result = DNS_R_SERVFAIL;
st->state &= ~(DNS_RPZ_HAVE_IP | DNS_RPZ_HAVE_NSIPv4 |
DNS_RPZ_HAVE_NSIPv6 | DNS_RPZ_HAD_NSDNAME);
result = rpz_rewrite_name(client, qtype, client->query.qname,
DNS_RPZ_TYPE_QNAME, &rdataset);
+ if (result != ISC_R_SUCCESS)
+ goto cleanup;
if (st->m.policy != DNS_RPZ_POLICY_MISS)
goto cleanup;
if ((st->state & (DNS_RPZ_HAVE_NSIPv4 | DNS_RPZ_HAVE_NSIPv6 |
@@ -4415,9 +4408,10 @@ rpz_rewrite(ns_client_t *client, dns_rdatatype_t qtype,
(st->state & DNS_RPZ_HAVE_NSIPv6) != 0 &&
st->m.type != DNS_RPZ_TYPE_NSDNAME) {
result = rpz_rewrite_nsip(client,
- dns_rdatatype_aaaa,
- &ns.name, &ipdb, version,
- &rdataset, resuming);
+ dns_rdatatype_aaaa,
+ &ns.name, &ipdb,
+ version, &rdataset,
+ resuming);
}
dns_rdata_freestruct(&ns);
if (ipdb != NULL)
@@ -4932,12 +4926,14 @@ dns64_aaaaok(ns_client_t *client, dns_rdataset_t *rdataset,
break;
}
}
- if (i == count)
+ if (i == count && aaaaok != NULL)
isc_mem_put(client->mctx, aaaaok,
sizeof(isc_boolean_t) * count);
return (ISC_TRUE);
}
- isc_mem_put(client->mctx, aaaaok, sizeof(isc_boolean_t) * count);
+ if (aaaaok != NULL)
+ isc_mem_put(client->mctx, aaaaok,
+ sizeof(isc_boolean_t) * count);
return (ISC_FALSE);
}
@@ -5198,25 +5194,22 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
}
is_staticstub_zone = ISC_FALSE;
- if (is_zone && zone != NULL) {
+ if (is_zone) {
authoritative = ISC_TRUE;
- if (dns_zone_gettype(zone) == dns_zone_staticstub)
+ if (zone != NULL &&
+ dns_zone_gettype(zone) == dns_zone_staticstub)
is_staticstub_zone = ISC_TRUE;
}
if (event == NULL && client->query.restarts == 0) {
if (is_zone) {
-#ifdef DLZ
if (zone != NULL) {
/*
* if is_zone = true, zone = NULL then this is
* a DLZ zone. Don't attempt to attach zone.
*/
-#endif
dns_zone_attach(zone, &client->query.authzone);
-#ifdef DLZ
}
-#endif
dns_db_attach(db, &client->query.authdb);
}
client->query.authdbset = ISC_TRUE;
@@ -5290,7 +5283,6 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
dns_name_copy(fname, rpz_st->fname, NULL);
rpz_st->q.result = result;
client->query.attributes |= NS_QUERYATTR_RECURSING;
- result = ISC_R_SUCCESS;
goto cleanup;
default:
RECURSE_ERROR(rresult);
@@ -5743,8 +5735,6 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
goto db_find;
}
- result = DNS_R_NXRRSET;
-
/*
* Look for a NSEC3 record if we don't have a NSEC record.
*/
@@ -5880,9 +5870,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
* resolver and not have it cached.
*/
if (qtype == dns_rdatatype_soa &&
-#ifdef DLZ
zone != NULL &&
-#endif
dns_zone_getzeronosoattl(zone))
result = query_addsoa(client, db, version, 0,
dns_rdataset_isassociated(rdataset));
@@ -6161,17 +6149,17 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
}
result = dns_name_concatenate(prefix, tname, fname, NULL);
dns_message_puttempname(client->message, &tname);
- if (result != ISC_R_SUCCESS) {
- if (result == ISC_R_NOSPACE) {
- /*
- * RFC2672, section 4.1, subsection 3c says
- * we should return YXDOMAIN if the constructed
- * name would be too long.
- */
- client->message->rcode = dns_rcode_yxdomain;
- }
+
+ /*
+ * RFC2672, section 4.1, subsection 3c says
+ * we should return YXDOMAIN if the constructed
+ * name would be too long.
+ */
+ if (result == DNS_R_NAMETOOLONG)
+ client->message->rcode = dns_rcode_yxdomain;
+ if (result != ISC_R_SUCCESS)
goto cleanup;
- }
+
query_keepname(client, fname, dbuf);
/*
* Synthesize a CNAME consisting of
@@ -6642,9 +6630,8 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
/*
* Add a fake SOA record.
*/
- result = query_addsoa(client, db,
- version, 600,
- ISC_FALSE);
+ (void)query_addsoa(client, db, version,
+ 600, ISC_FALSE);
goto cleanup;
}
#endif
diff --git a/contrib/bind9/bin/named/server.c b/contrib/bind9/bin/named/server.c
index 5bbf94b9b604..f19a0bbb9371 100644
--- a/contrib/bind9/bin/named/server.c
+++ b/contrib/bind9/bin/named/server.c
@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: server.c,v 1.599.8.4 2011-02-16 19:46:12 each Exp $ */
+/* $Id: server.c,v 1.599.8.12 2011-08-02 04:58:45 each Exp $ */
/*! \file */
@@ -60,9 +60,7 @@
#include
#include
#include
-#ifdef DLZ
#include
-#endif
#include
#include
#include
@@ -206,13 +204,15 @@ struct zonelistentry {
/*%
* Configuration context to retain for each view that allows
- * new zones to be added at runtime
+ * new zones to be added at runtime.
*/
struct cfg_context {
isc_mem_t * mctx;
- cfg_obj_t * config;
cfg_parser_t * parser;
- cfg_aclconfctx_t actx;
+ cfg_obj_t * config;
+ cfg_parser_t * nzparser;
+ cfg_obj_t * nzconfig;
+ cfg_aclconfctx_t * actx;
};
/*
@@ -222,7 +222,6 @@ static const struct {
const char *zone;
isc_boolean_t rfc1918;
} empty_zones[] = {
-#ifdef notyet
/* RFC 1918 */
{ "10.IN-ADDR.ARPA", ISC_TRUE },
{ "16.172.IN-ADDR.ARPA", ISC_TRUE },
@@ -242,7 +241,6 @@ static const struct {
{ "30.172.IN-ADDR.ARPA", ISC_TRUE },
{ "31.172.IN-ADDR.ARPA", ISC_TRUE },
{ "168.192.IN-ADDR.ARPA", ISC_TRUE },
-#endif
/* RFC 5735 and RFC 5737 */
{ "0.IN-ADDR.ARPA", ISC_FALSE }, /* THIS NETWORK */
@@ -304,7 +302,7 @@ static void
end_reserved_dispatches(ns_server_t *server, isc_boolean_t all);
static void
-cfgctx_destroy(void **cfgp);
+newzone_cfgctx_destroy(void **cfgp);
/*%
* Configure a single view ACL at '*aclp'. Get its configuration from
@@ -847,18 +845,13 @@ get_view_querysource_dispatch(const cfg_obj_t **maps,
int af, dns_dispatch_t **dispatchp,
isc_boolean_t is_firstview)
{
- isc_result_t result;
+ isc_result_t result = ISC_R_FAILURE;
dns_dispatch_t *disp;
isc_sockaddr_t sa;
unsigned int attrs, attrmask;
const cfg_obj_t *obj = NULL;
unsigned int maxdispatchbuffers;
- /*
- * Make compiler happy.
- */
- result = ISC_R_FAILURE;
-
switch (af) {
case AF_INET:
result = ns_config_get(maps, "query-source", &obj);
@@ -1340,7 +1333,6 @@ cache_sharable(dns_view_t *originview, dns_view_t *view,
return (ISC_TRUE);
}
-#ifdef DLZ
/*
* Callback from DLZ configure when the driver sets up a writeable zone
*/
@@ -1358,7 +1350,6 @@ dlzconfigure_callback(dns_view_t *view, dns_zone_t *zone) {
return ns_zone_configure_writeable_dlz(view->dlzdatabase,
zone, zclass, origin);
}
-#endif
static isc_result_t
dns64_reverse(dns_view_t *view, isc_mem_t *mctx, isc_netaddr_t *na,
@@ -1554,8 +1545,7 @@ configure_rpz(dns_view_t *view, const cfg_listelt_t *element) {
* global defaults in 'config' used exclusively.
*/
static isc_result_t
-configure_view(dns_view_t *view, cfg_parser_t* parser,
- cfg_obj_t *config, cfg_obj_t *vconfig,
+configure_view(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig,
ns_cachelist_t *cachelist, const cfg_obj_t *bindkeys,
isc_mem_t *mctx, cfg_aclconfctx_t *actx,
isc_boolean_t need_hints)
@@ -1569,11 +1559,9 @@ configure_view(dns_view_t *view, cfg_parser_t* parser,
const cfg_obj_t *forwarders;
const cfg_obj_t *alternates;
const cfg_obj_t *zonelist;
-#ifdef DLZ
const cfg_obj_t *dlz;
unsigned int dlzargc;
char **dlzargv;
-#endif
const cfg_obj_t *disabled;
const cfg_obj_t *obj;
const cfg_listelt_t *element;
@@ -1587,7 +1575,7 @@ configure_view(dns_view_t *view, cfg_parser_t* parser,
isc_uint32_t lame_ttl;
dns_tsig_keyring_t *ring = NULL;
dns_view_t *pview = NULL; /* Production view */
- isc_mem_t *cmctx;
+ isc_mem_t *cmctx = NULL, *hmctx = NULL;
dns_dispatch_t *dispatch4 = NULL;
dns_dispatch_t *dispatch6 = NULL;
isc_boolean_t reused_cache = ISC_FALSE;
@@ -1612,15 +1600,12 @@ configure_view(dns_view_t *view, cfg_parser_t* parser,
isc_boolean_t auto_root = ISC_FALSE;
ns_cache_t *nsc;
isc_boolean_t zero_no_soattl;
- cfg_parser_t *newzones_parser = NULL;
- cfg_obj_t *nzfconf = NULL;
dns_acl_t *clients = NULL, *mapped = NULL, *excluded = NULL;
unsigned int query_timeout;
+ struct cfg_context *nzctx;
REQUIRE(DNS_VIEW_VALID(view));
- cmctx = NULL;
-
if (config != NULL)
(void)cfg_map_get(config, "options", &options);
@@ -1651,6 +1636,7 @@ configure_view(dns_view_t *view, cfg_parser_t* parser,
sep = "";
viewname = "";
forview = "";
+ POST(forview);
}
/*
@@ -1722,6 +1708,10 @@ configure_view(dns_view_t *view, cfg_parser_t* parser,
(void)cfg_map_get(voptions, "zone", &zonelist);
else
(void)cfg_map_get(config, "zone", &zonelist);
+
+ /*
+ * Load zone configuration
+ */
for (element = cfg_list_first(zonelist);
element != NULL;
element = cfg_list_next(element))
@@ -1731,62 +1721,32 @@ configure_view(dns_view_t *view, cfg_parser_t* parser,
actx, ISC_FALSE));
}
- /*
- * Are we allowing zones to be added and deleted dynamically?
- */
- obj = NULL;
- result = ns_config_get(maps, "allow-new-zones", &obj);
- if (result == ISC_R_SUCCESS) {
- isc_boolean_t allow = cfg_obj_asboolean(obj);
- struct cfg_context *cfg = NULL;
- if (allow) {
- cfg = isc_mem_get(view->mctx, sizeof(*cfg));
- if (cfg == NULL) {
- result = ISC_R_NOMEMORY;
- goto cleanup;
- }
- memset(cfg, 0, sizeof(*cfg));
- isc_mem_attach(view->mctx, &cfg->mctx);
- if (config != NULL)
- cfg_obj_attach(config, &cfg->config);
- cfg_parser_attach(parser, &cfg->parser);
- cfg_aclconfctx_clone(actx, &cfg->actx);
- }
- dns_view_setnewzones(view, allow, cfg, cfgctx_destroy);
- }
-
/*
* If we're allowing added zones, then load zone configuration
* from the newzone file for zones that were added during previous
* runs.
*/
- if (view->new_zone_file != NULL) {
+ nzctx = view->new_zone_config;
+ if (nzctx != NULL && nzctx->nzconfig != NULL) {
isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
NS_LOGMODULE_SERVER, ISC_LOG_INFO,
"loading additional zones for view '%s'",
view->name);
- CHECK(cfg_parser_create(view->mctx, ns_g_lctx,
- &newzones_parser));
- result = cfg_parse_file(newzones_parser, view->new_zone_file,
- &cfg_type_newzones, &nzfconf);
- if (result == ISC_R_SUCCESS) {
- zonelist = NULL;
- cfg_map_get(nzfconf, "zone", &zonelist);
- for (element = cfg_list_first(zonelist);
- element != NULL;
- element = cfg_list_next(element))
- {
- const cfg_obj_t *zconfig =
- cfg_listelt_value(element);
- CHECK(configure_zone(config, zconfig, vconfig,
- mctx, view, actx,
- ISC_TRUE));
- }
+ zonelist = NULL;
+ cfg_map_get(nzctx->nzconfig, "zone", &zonelist);
+
+ for (element = cfg_list_first(zonelist);
+ element != NULL;
+ element = cfg_list_next(element))
+ {
+ const cfg_obj_t *zconfig = cfg_listelt_value(element);
+ CHECK(configure_zone(config, zconfig, vconfig,
+ mctx, view, actx,
+ ISC_TRUE));
}
}
-#ifdef DLZ
/*
* Create Dynamically Loadable Zone driver.
*/
@@ -1831,7 +1791,6 @@ configure_view(dns_view_t *view, cfg_parser_t* parser,
goto cleanup;
}
}
-#endif
/*
* Obtain configuration parameters that affect the decision of whether
@@ -2103,13 +2062,21 @@ configure_view(dns_view_t *view, cfg_parser_t* parser,
* view but is not yet configured. If it is not the
* view name but not a forward reference either, then it
* is simply a named cache that is not shared.
+ *
+ * We use two separate memory contexts for the
+ * cache, for the main cache memory and the heap
+ * memory.
*/
CHECK(isc_mem_create(0, 0, &cmctx));
isc_mem_setname(cmctx, "cache", NULL);
- CHECK(dns_cache_create2(cmctx, ns_g_taskmgr,
+ CHECK(isc_mem_create(0, 0, &hmctx));
+ isc_mem_setname(hmctx, "cache_heap", NULL);
+ CHECK(dns_cache_create3(cmctx, hmctx, ns_g_taskmgr,
ns_g_timermgr, view->rdclass,
cachename, "rbt", 0, NULL,
&cache));
+ isc_mem_detach(&cmctx);
+ isc_mem_detach(&hmctx);
}
nsc = isc_mem_get(mctx, sizeof(*nsc));
if (nsc == NULL) {
@@ -2910,8 +2877,8 @@ configure_view(dns_view_t *view, cfg_parser_t* parser,
if (result == ISC_R_SUCCESS)
cfg_map_get(obj, "zone", &zonelist);
}
- if (zonelist != NULL) {
+ if (zonelist != NULL) {
for (element = cfg_list_first(zonelist);
element != NULL;
element = cfg_list_next(element)) {
@@ -2947,16 +2914,12 @@ configure_view(dns_view_t *view, cfg_parser_t* parser,
dns_order_detach(&order);
if (cmctx != NULL)
isc_mem_detach(&cmctx);
+ if (hmctx != NULL)
+ isc_mem_detach(&hmctx);
if (cache != NULL)
dns_cache_detach(&cache);
- if (newzones_parser != NULL) {
- if (nzfconf != NULL)
- cfg_obj_destroy(newzones_parser, &nzfconf);
- cfg_parser_destroy(&newzones_parser);
- }
-
return (result);
}
@@ -3161,21 +3124,16 @@ configure_forward(const cfg_obj_t *config, dns_view_t *view, dns_name_t *origin,
return (result);
}
-/*
- * Create a new view and add it to the list.
- *
- * If 'vconfig' is NULL, create the default view.
- *
- * The view created is attached to '*viewp'.
- */
static isc_result_t
-create_view(const cfg_obj_t *vconfig, dns_viewlist_t *viewlist,
- dns_view_t **viewp)
+get_viewinfo(const cfg_obj_t *vconfig, const char **namep,
+ dns_rdataclass_t *classp)
{
- isc_result_t result;
+ isc_result_t result = ISC_R_SUCCESS;
const char *viewname;
dns_rdataclass_t viewclass;
- dns_view_t *view = NULL;
+
+ REQUIRE(namep != NULL && *namep == NULL);
+ REQUIRE(classp != NULL);
if (vconfig != NULL) {
const cfg_obj_t *classobj = NULL;
@@ -3188,6 +3146,59 @@ create_view(const cfg_obj_t *vconfig, dns_viewlist_t *viewlist,
viewname = "_default";
viewclass = dns_rdataclass_in;
}
+
+ *namep = viewname;
+ *classp = viewclass;
+
+ return (result);
+}
+
+/*
+ * Find a view based on its configuration info and attach to it.
+ *
+ * If 'vconfig' is NULL, attach to the default view.
+ */
+static isc_result_t
+find_view(const cfg_obj_t *vconfig, dns_viewlist_t *viewlist,
+ dns_view_t **viewp)
+{
+ isc_result_t result;
+ const char *viewname = NULL;
+ dns_rdataclass_t viewclass;
+ dns_view_t *view = NULL;
+
+ result = get_viewinfo(vconfig, &viewname, &viewclass);
+ if (result != ISC_R_SUCCESS)
+ return (result);
+
+ result = dns_viewlist_find(viewlist, viewname, viewclass, &view);
+ if (result != ISC_R_SUCCESS)
+ return (result);
+
+ *viewp = view;
+ return (ISC_R_SUCCESS);
+}
+
+/*
+ * Create a new view and add it to the list.
+ *
+ * If 'vconfig' is NULL, create the default view.
+ *
+ * The view created is attached to '*viewp'.
+ */
+static isc_result_t
+create_view(const cfg_obj_t *vconfig, dns_viewlist_t *viewlist,
+ dns_view_t **viewp)
+{
+ isc_result_t result;
+ const char *viewname = NULL;
+ dns_rdataclass_t viewclass;
+ dns_view_t *view = NULL;
+
+ result = get_viewinfo(vconfig, &viewname, &viewclass);
+ if (result != ISC_R_SUCCESS)
+ return (result);
+
result = dns_viewlist_find(viewlist, viewname, viewclass, &view);
if (result == ISC_R_SUCCESS)
return (ISC_R_EXISTS);
@@ -4145,11 +4156,99 @@ configure_session_key(const cfg_obj_t **maps, ns_server_t *server,
return (result);
}
+static isc_result_t
+setup_newzones(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig,
+ cfg_parser_t *parser, cfg_aclconfctx_t *actx)
+{
+ isc_result_t result = ISC_R_SUCCESS;
+ isc_boolean_t allow = ISC_FALSE;
+ struct cfg_context *nzcfg = NULL;
+ cfg_parser_t *nzparser = NULL;
+ cfg_obj_t *nzconfig = NULL;
+ const cfg_obj_t *maps[4];
+ const cfg_obj_t *options = NULL, *voptions = NULL;
+ const cfg_obj_t *nz = NULL;
+ int i = 0;
+
+ REQUIRE (config != NULL);
+
+ if (vconfig != NULL)
+ voptions = cfg_tuple_get(vconfig, "options");
+ if (voptions != NULL)
+ maps[i++] = voptions;
+ result = cfg_map_get(config, "options", &options);
+ if (result == ISC_R_SUCCESS)
+ maps[i++] = options;
+ maps[i++] = ns_g_defaults;
+ maps[i] = NULL;
+
+ result = ns_config_get(maps, "allow-new-zones", &nz);
+ if (result == ISC_R_SUCCESS)
+ allow = cfg_obj_asboolean(nz);
+
+ if (!allow) {
+ dns_view_setnewzones(view, ISC_FALSE, NULL, NULL);
+ return (ISC_R_SUCCESS);
+ }
+
+ nzcfg = isc_mem_get(view->mctx, sizeof(*nzcfg));
+ if (nzcfg == NULL) {
+ dns_view_setnewzones(view, ISC_FALSE, NULL, NULL);
+ return (ISC_R_NOMEMORY);
+ }
+
+ dns_view_setnewzones(view, allow, nzcfg, newzone_cfgctx_destroy);
+
+ memset(nzcfg, 0, sizeof(*nzcfg));
+ isc_mem_attach(view->mctx, &nzcfg->mctx);
+ cfg_obj_attach(config, &nzcfg->config);
+ cfg_parser_attach(parser, &nzcfg->parser);
+ cfg_aclconfctx_attach(actx, &nzcfg->actx);
+
+ /*
+ * Attempt to create a parser and parse the newzones
+ * file. If successful, preserve both; otherwise leave
+ * them NULL.
+ */
+ result = cfg_parser_create(view->mctx, ns_g_lctx, &nzparser);
+ if (result == ISC_R_SUCCESS)
+ result = cfg_parse_file(nzparser, view->new_zone_file,
+ &cfg_type_newzones, &nzconfig);
+ if (result == ISC_R_SUCCESS) {
+ cfg_parser_attach(nzparser, &nzcfg->nzparser);
+ cfg_obj_attach(nzconfig, &nzcfg->nzconfig);
+ }
+
+ if (nzparser != NULL) {
+ if (nzconfig != NULL)
+ cfg_obj_destroy(nzparser, &nzconfig);
+ cfg_parser_destroy(&nzparser);
+ }
+
+ return (ISC_R_SUCCESS);
+}
+
+static int
+count_zones(const cfg_obj_t *conf) {
+ const cfg_obj_t *zonelist = NULL;
+ const cfg_listelt_t *element;
+ int n = 0;
+
+ REQUIRE(conf != NULL);
+
+ cfg_map_get(conf, "zone", &zonelist);
+ for (element = cfg_list_first(zonelist);
+ element != NULL;
+ element = cfg_list_next(element))
+ n++;
+
+ return (n);
+}
+
static isc_result_t
load_configuration(const char *filename, ns_server_t *server,
isc_boolean_t first_time)
{
- cfg_aclconfctx_t aclconfctx;
cfg_obj_t *config = NULL, *bindkeys = NULL;
cfg_parser_t *conf_parser = NULL, *bindkeys_parser = NULL;
const cfg_listelt_t *element;
@@ -4177,8 +4276,9 @@ load_configuration(const char *filename, ns_server_t *server,
ns_cachelist_t cachelist, tmpcachelist;
unsigned int maxsocks;
ns_cache_t *nsc;
+ struct cfg_context *nzctx;
+ int num_zones = 0;
- cfg_aclconfctx_init(&aclconfctx);
ISC_LIST_INIT(viewlist);
ISC_LIST_INIT(builtin_viewlist);
ISC_LIST_INIT(cachelist);
@@ -4187,6 +4287,11 @@ load_configuration(const char *filename, ns_server_t *server,
result = isc_task_beginexclusive(server->task);
RUNTIME_CHECK(result == ISC_R_SUCCESS);
+ /* Create the ACL configuration context */
+ if (ns_g_aclconfctx != NULL)
+ cfg_aclconfctx_detach(&ns_g_aclconfctx);
+ CHECK(cfg_aclconfctx_create(ns_g_mctx, &ns_g_aclconfctx));
+
/*
* Parse the global default pseudo-config file.
*/
@@ -4250,7 +4355,7 @@ load_configuration(const char *filename, ns_server_t *server,
if (result == ISC_R_SUCCESS)
maps[i++] = options;
maps[i++] = ns_g_defaults;
- maps[i++] = NULL;
+ maps[i] = NULL;
/*
* If bind.keys exists, load it. If "dnssec-lookaside auto"
@@ -4337,8 +4442,9 @@ load_configuration(const char *filename, ns_server_t *server,
else
isc_quota_soft(&server->recursionquota, 0);
- CHECK(configure_view_acl(NULL, config, "blackhole", NULL, &aclconfctx,
- ns_g_mctx, &server->blackholeacl));
+ CHECK(configure_view_acl(NULL, config, "blackhole", NULL,
+ ns_g_aclconfctx, ns_g_mctx,
+ &server->blackholeacl));
if (server->blackholeacl != NULL)
dns_dispatchmgr_setblackhole(ns_g_dispatchmgr,
server->blackholeacl);
@@ -4348,7 +4454,7 @@ load_configuration(const char *filename, ns_server_t *server,
INSIST(result == ISC_R_SUCCESS);
server->aclenv.match_mapped = cfg_obj_asboolean(obj);
- CHECKM(ns_statschannels_configure(ns_g_server, config, &aclconfctx),
+ CHECKM(ns_statschannels_configure(ns_g_server, config, ns_g_aclconfctx),
"configuring statistics server(s)");
/*
@@ -4476,11 +4582,10 @@ load_configuration(const char *filename, ns_server_t *server,
if (options != NULL)
(void)cfg_map_get(options, "listen-on", &clistenon);
if (clistenon != NULL) {
- result = ns_listenlist_fromconfig(clistenon,
- config,
- &aclconfctx,
- ns_g_mctx,
- &listenon);
+ /* check return code? */
+ (void)ns_listenlist_fromconfig(clistenon, config,
+ ns_g_aclconfctx,
+ ns_g_mctx, &listenon);
} else if (!ns_g_lwresdonly) {
/*
* Not specified, use default.
@@ -4504,11 +4609,10 @@ load_configuration(const char *filename, ns_server_t *server,
if (options != NULL)
(void)cfg_map_get(options, "listen-on-v6", &clistenon);
if (clistenon != NULL) {
- result = ns_listenlist_fromconfig(clistenon,
- config,
- &aclconfctx,
- ns_g_mctx,
- &listenon);
+ /* check return code? */
+ (void)ns_listenlist_fromconfig(clistenon, config,
+ ns_g_aclconfctx,
+ ns_g_mctx, &listenon);
} else if (!ns_g_lwresdonly) {
isc_boolean_t enable;
/*
@@ -4601,25 +4705,87 @@ load_configuration(const char *filename, ns_server_t *server,
*/
(void)configure_session_key(maps, server, ns_g_mctx);
- /*
- * Configure and freeze all explicit views. Explicit
- * views that have zones were already created at parsing
- * time, but views with no zones must be created here.
- */
views = NULL;
(void)cfg_map_get(config, "view", &views);
+
+ /*
+ * Create the views and count all the configured zones in
+ * order to correctly size the zone manager's task table.
+ * (We only count zones for configured views; the built-in
+ * "bind" view can be ignored as it only adds a negligible
+ * number of zones.)
+ *
+ * If we're allowing new zones, we need to be able to find the
+ * new zone file and count those as well. So we setup the new
+ * zone configuration context, but otherwise view configuration
+ * waits until after the zone manager's task list has been sized.
+ */
for (element = cfg_list_first(views);
element != NULL;
element = cfg_list_next(element))
{
cfg_obj_t *vconfig = cfg_listelt_value(element);
+ const cfg_obj_t *voptions = cfg_tuple_get(vconfig, "options");
view = NULL;
CHECK(create_view(vconfig, &viewlist, &view));
INSIST(view != NULL);
- CHECK(configure_view(view, conf_parser, config, vconfig,
- &cachelist, bindkeys,
- ns_g_mctx, &aclconfctx, ISC_TRUE));
+
+ num_zones += count_zones(voptions);
+ CHECK(setup_newzones(view, config, vconfig, conf_parser,
+ ns_g_aclconfctx));
+
+ nzctx = view->new_zone_config;
+ if (nzctx != NULL && nzctx->nzconfig != NULL)
+ num_zones += count_zones(nzctx->nzconfig);
+
+ dns_view_detach(&view);
+ }
+
+ /*
+ * If there were no explicit views then we do the default
+ * view here.
+ */
+ if (views == NULL) {
+ CHECK(create_view(NULL, &viewlist, &view));
+ INSIST(view != NULL);
+
+ num_zones = count_zones(config);
+
+ CHECK(setup_newzones(view, config, NULL, conf_parser,
+ ns_g_aclconfctx));
+
+ nzctx = view->new_zone_config;
+ if (nzctx != NULL && nzctx->nzconfig != NULL)
+ num_zones += count_zones(nzctx->nzconfig);
+
+ dns_view_detach(&view);
+ }
+
+ /*
+ * Zones have been counted; set the zone manager task pool size.
+ */
+ isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
+ NS_LOGMODULE_SERVER, ISC_LOG_INFO,
+ "sizing zone task pool based on %d zones", num_zones);
+ CHECK(dns_zonemgr_setsize(ns_g_server->zonemgr, num_zones));
+
+ /*
+ * Configure and freeze all explicit views. Explicit
+ * views that have zones were already created at parsing
+ * time, but views with no zones must be created here.
+ */
+ for (element = cfg_list_first(views);
+ element != NULL;
+ element = cfg_list_next(element))
+ {
+ cfg_obj_t *vconfig = cfg_listelt_value(element);
+
+ view = NULL;
+ CHECK(find_view(vconfig, &viewlist, &view));
+ CHECK(configure_view(view, config, vconfig,
+ &cachelist, bindkeys, ns_g_mctx,
+ ns_g_aclconfctx, ISC_TRUE));
dns_view_freeze(view);
dns_view_detach(&view);
}
@@ -4629,16 +4795,11 @@ load_configuration(const char *filename, ns_server_t *server,
* were no explicit views.
*/
if (views == NULL) {
- /*
- * No explicit views; there ought to be a default view.
- * There may already be one created as a side effect
- * of zone statements, or we may have to create one.
- * In either case, we need to configure and freeze it.
- */
- CHECK(create_view(NULL, &viewlist, &view));
- CHECK(configure_view(view, conf_parser, config, NULL,
+ view = NULL;
+ CHECK(find_view(NULL, &viewlist, &view));
+ CHECK(configure_view(view, config, NULL,
&cachelist, bindkeys,
- ns_g_mctx, &aclconfctx, ISC_TRUE));
+ ns_g_mctx, ns_g_aclconfctx, ISC_TRUE));
dns_view_freeze(view);
dns_view_detach(&view);
}
@@ -4656,9 +4817,9 @@ load_configuration(const char *filename, ns_server_t *server,
cfg_obj_t *vconfig = cfg_listelt_value(element);
CHECK(create_view(vconfig, &builtin_viewlist, &view));
- CHECK(configure_view(view, conf_parser, config, vconfig,
+ CHECK(configure_view(view, config, vconfig,
&cachelist, bindkeys,
- ns_g_mctx, &aclconfctx, ISC_FALSE));
+ ns_g_mctx, ns_g_aclconfctx, ISC_FALSE));
dns_view_freeze(view);
dns_view_detach(&view);
view = NULL;
@@ -4699,7 +4860,7 @@ load_configuration(const char *filename, ns_server_t *server,
* Bind the control port(s).
*/
CHECKM(ns_controls_configure(ns_g_server->controls, config,
- &aclconfctx),
+ ns_g_aclconfctx),
"binding control channel(s)");
/*
@@ -4941,8 +5102,6 @@ load_configuration(const char *filename, ns_server_t *server,
if (v6portset != NULL)
isc_portset_destroy(ns_g_mctx, &v6portset);
- cfg_aclconfctx_clear(&aclconfctx);
-
if (conf_parser != NULL) {
if (config != NULL)
cfg_obj_destroy(conf_parser, &config);
@@ -5149,6 +5308,9 @@ shutdown_server(isc_task_t *task, isc_event_t *event) {
end_reserved_dispatches(server, ISC_TRUE);
cleanup_session_key(server, server->mctx);
+ if (ns_g_aclconfctx != NULL)
+ cfg_aclconfctx_detach(&ns_g_aclconfctx);
+
cfg_obj_destroy(ns_g_parser, &ns_g_config);
cfg_parser_destroy(&ns_g_parser);
@@ -5200,8 +5362,8 @@ shutdown_server(isc_task_t *task, isc_event_t *event) {
void
ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
isc_result_t result;
-
ns_server_t *server = isc_mem_get(mctx, sizeof(*server));
+
if (server == NULL)
fatal("allocating server object", ISC_R_NOMEMORY);
@@ -5274,6 +5436,8 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
CHECKFATAL(dns_zonemgr_create(ns_g_mctx, ns_g_taskmgr, ns_g_timermgr,
ns_g_socketmgr, &server->zonemgr),
"dns_zonemgr_create");
+ CHECKFATAL(dns_zonemgr_setsize(server->zonemgr, 1000),
+ "dns_zonemgr_setsize");
server->statsfile = isc_mem_strdup(server->mctx, "named.stats");
CHECKFATAL(server->statsfile == NULL ? ISC_R_NOMEMORY : ISC_R_SUCCESS,
@@ -5383,7 +5547,8 @@ ns_server_destroy(ns_server_t **serverp) {
if (server->server_id != NULL)
isc_mem_free(server->mctx, server->server_id);
- dns_zonemgr_detach(&server->zonemgr);
+ if (server->zonemgr != NULL)
+ dns_zonemgr_detach(&server->zonemgr);
if (server->tkeyctx != NULL)
dns_tkeyctx_destroy(&server->tkeyctx);
@@ -5947,7 +6112,6 @@ ns_server_dumpstats(ns_server_t *server) {
"could not open statistics dump file", server->statsfile);
result = ns_stats_dump(server, fp);
- CHECK(result);
cleanup:
if (fp != NULL)
@@ -6135,6 +6299,7 @@ dumpdone(void *arg, isc_result_t result) {
fprintf(dctx->fp, "; %s\n",
dns_result_totext(result));
result = ISC_R_SUCCESS;
+ POST(result);
goto nextzone;
}
if (result != ISC_R_SUCCESS)
@@ -6260,28 +6425,29 @@ ns_server_dumpsecroots(ns_server_t *server, char *args) {
isc_time_formattimestamp(&now, tbuf, sizeof(tbuf));
fprintf(fp, "%s\n", tbuf);
- nextview:
- for (view = ISC_LIST_HEAD(server->viewlist);
- view != NULL;
- view = ISC_LIST_NEXT(view, link))
- {
- if (ptr != NULL && strcmp(view->name, ptr) != 0)
- continue;
- if (secroots != NULL)
- dns_keytable_detach(&secroots);
- result = dns_view_getsecroots(view, &secroots);
- if (result == ISC_R_NOTFOUND) {
- result = ISC_R_SUCCESS;
- continue;
+ do {
+ for (view = ISC_LIST_HEAD(server->viewlist);
+ view != NULL;
+ view = ISC_LIST_NEXT(view, link))
+ {
+ if (ptr != NULL && strcmp(view->name, ptr) != 0)
+ continue;
+ if (secroots != NULL)
+ dns_keytable_detach(&secroots);
+ result = dns_view_getsecroots(view, &secroots);
+ if (result == ISC_R_NOTFOUND) {
+ result = ISC_R_SUCCESS;
+ continue;
+ }
+ fprintf(fp, "\n Start view %s\n\n", view->name);
+ result = dns_keytable_dump(secroots, fp);
+ if (result != ISC_R_SUCCESS)
+ fprintf(fp, " dumpsecroots failed: %s\n",
+ isc_result_totext(result));
}
- fprintf(fp, "\n Start view %s\n\n", view->name);
- CHECK(dns_keytable_dump(secroots, fp));
- }
- if (ptr != NULL) {
- ptr = next_token(&args, " \t");
if (ptr != NULL)
- goto nextview;
- }
+ ptr = next_token(&args, " \t");
+ } while (ptr != NULL);
cleanup:
if (secroots != NULL)
@@ -7188,7 +7354,7 @@ ns_server_add_zone(ns_server_t *server, char *args) {
/* Mark view unfrozen so that zone can be added */
dns_view_thaw(view);
result = configure_zone(cfg->config, parms, vconfig,
- server->mctx, view, &cfg->actx, ISC_FALSE);
+ server->mctx, view, cfg->actx, ISC_FALSE);
dns_view_freeze(view);
if (result != ISC_R_SUCCESS) {
goto cleanup;
@@ -7437,23 +7603,27 @@ ns_server_del_zone(ns_server_t *server, char *args) {
}
static void
-cfgctx_destroy(void **cfgp) {
+newzone_cfgctx_destroy(void **cfgp) {
struct cfg_context *cfg;
- isc_mem_t *mctx;
REQUIRE(cfgp != NULL && *cfgp != NULL);
+
cfg = *cfgp;
- mctx = cfg->mctx;
- cfg->mctx = NULL;
+
+ if (cfg->actx != NULL)
+ cfg_aclconfctx_detach(&cfg->actx);
if (cfg->parser != NULL) {
if (cfg->config != NULL)
cfg_obj_destroy(cfg->parser, &cfg->config);
cfg_parser_destroy(&cfg->parser);
}
- cfg_aclconfctx_clear(&cfg->actx);
+ if (cfg->nzparser != NULL) {
+ if (cfg->nzconfig != NULL)
+ cfg_obj_destroy(cfg->nzparser, &cfg->nzconfig);
+ cfg_parser_destroy(&cfg->nzparser);
+ }
- isc_mem_put(mctx, cfg, sizeof(*cfg));
- isc_mem_detach(&mctx);
+ isc_mem_putanddetach(&cfg->mctx, cfg, sizeof(*cfg));
*cfgp = NULL;
}
diff --git a/contrib/bind9/bin/named/statschannel.c b/contrib/bind9/bin/named/statschannel.c
index 6dce8e0a77c5..1f726941a004 100644
--- a/contrib/bind9/bin/named/statschannel.c
+++ b/contrib/bind9/bin/named/statschannel.c
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2008-2010 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2008-2011 Internet Systems Consortium, Inc. ("ISC")
*
* Permission to use, copy, modify, and/or distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
@@ -14,7 +14,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: statschannel.c,v 1.26 2010-02-04 23:49:13 tbox Exp $ */
+/* $Id: statschannel.c,v 1.26.150.2 2011-03-12 04:59:14 tbox Exp $ */
/*! \file */
@@ -638,7 +638,7 @@ rdatasetstats_dump(dns_rdatastatstype_t type, isc_uint64_t val, void *arg) {
static void
opcodestat_dump(dns_opcode_t code, isc_uint64_t val, void *arg) {
- FILE *fp = arg;
+ FILE *fp;
isc_buffer_t b;
char codebuf[64];
stats_dumparg_t *dumparg = arg;
diff --git a/contrib/bind9/bin/named/unix/Makefile.in b/contrib/bind9/bin/named/unix/Makefile.in
index ca92c49b5c78..a7155a0e358a 100644
--- a/contrib/bind9/bin/named/unix/Makefile.in
+++ b/contrib/bind9/bin/named/unix/Makefile.in
@@ -1,4 +1,4 @@
-# Copyright (C) 2004, 2007, 2009 Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007, 2009, 2011 Internet Systems Consortium, Inc. ("ISC")
# Copyright (C) 1999-2001 Internet Software Consortium.
#
# Permission to use, copy, modify, and/or distribute this software for any
@@ -13,7 +13,7 @@
# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
# PERFORMANCE OF THIS SOFTWARE.
-# $Id: Makefile.in,v 1.13 2009-12-05 23:31:40 each Exp $
+# $Id: Makefile.in,v 1.13.244.2 2011-03-10 23:47:26 tbox Exp $
srcdir = @srcdir@
VPATH = @srcdir@
@@ -22,14 +22,15 @@ top_srcdir = @top_srcdir@
@BIND9_MAKE_INCLUDES@
CINCLUDES = -I${srcdir}/include -I${srcdir}/../include \
+ ${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} \
${DNS_INCLUDES} ${ISC_INCLUDES}
CDEFINES =
CWARNINGS =
-OBJS = os.@O@
+OBJS = os.@O@ dlz_dlopen_driver.@O@
-SRCS = os.c
+SRCS = os.c dlz_dlopen_driver.c
TARGETS = ${OBJS}
diff --git a/contrib/bind9/bin/named/unix/dlz_dlopen_driver.c b/contrib/bind9/bin/named/unix/dlz_dlopen_driver.c
new file mode 100644
index 000000000000..35dbcab65c01
--- /dev/null
+++ b/contrib/bind9/bin/named/unix/dlz_dlopen_driver.c
@@ -0,0 +1,616 @@
+/*
+ * Copyright (C) 2011 Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: dlz_dlopen_driver.c,v 1.1.4.4 2011-03-17 09:41:06 fdupont Exp $ */
+
+#include
+
+#include
+#include
+#include
+#include
+
+#include
+#include
+#include
+
+#include
+#include
+#include
+#include
+
+#include
+
+#include
+
+#ifdef ISC_DLZ_DLOPEN
+static dns_sdlzimplementation_t *dlz_dlopen = NULL;
+
+
+typedef struct dlopen_data {
+ isc_mem_t *mctx;
+ char *dl_path;
+ char *dlzname;
+ void *dl_handle;
+ void *dbdata;
+ unsigned int flags;
+ isc_mutex_t lock;
+ int version;
+ isc_boolean_t in_configure;
+
+ dlz_dlopen_version_t *dlz_version;
+ dlz_dlopen_create_t *dlz_create;
+ dlz_dlopen_findzonedb_t *dlz_findzonedb;
+ dlz_dlopen_lookup_t *dlz_lookup;
+ dlz_dlopen_authority_t *dlz_authority;
+ dlz_dlopen_allnodes_t *dlz_allnodes;
+ dlz_dlopen_allowzonexfr_t *dlz_allowzonexfr;
+ dlz_dlopen_newversion_t *dlz_newversion;
+ dlz_dlopen_closeversion_t *dlz_closeversion;
+ dlz_dlopen_configure_t *dlz_configure;
+ dlz_dlopen_ssumatch_t *dlz_ssumatch;
+ dlz_dlopen_addrdataset_t *dlz_addrdataset;
+ dlz_dlopen_subrdataset_t *dlz_subrdataset;
+ dlz_dlopen_delrdataset_t *dlz_delrdataset;
+ dlz_dlopen_destroy_t *dlz_destroy;
+} dlopen_data_t;
+
+/* Modules can choose whether they are lock-safe or not. */
+#define MAYBE_LOCK(cd) \
+ do { \
+ if ((cd->flags & DNS_SDLZFLAG_THREADSAFE) == 0 && \
+ cd->in_configure == ISC_FALSE) \
+ LOCK(&cd->lock); \
+ } while (0)
+
+#define MAYBE_UNLOCK(cd) \
+ do { \
+ if ((cd->flags & DNS_SDLZFLAG_THREADSAFE) == 0 && \
+ cd->in_configure == ISC_FALSE) \
+ UNLOCK(&cd->lock); \
+ } while (0)
+
+/*
+ * Log a message at the given level.
+ */
+static void dlopen_log(int level, const char *fmt, ...)
+{
+ va_list ap;
+ va_start(ap, fmt);
+ isc_log_vwrite(dns_lctx, DNS_LOGCATEGORY_DATABASE,
+ DNS_LOGMODULE_DLZ, ISC_LOG_DEBUG(level),
+ fmt, ap);
+ va_end(ap);
+}
+
+/*
+ * SDLZ methods
+ */
+
+static isc_result_t
+dlopen_dlz_allnodes(const char *zone, void *driverarg, void *dbdata,
+ dns_sdlzallnodes_t *allnodes)
+{
+ dlopen_data_t *cd = (dlopen_data_t *) dbdata;
+ isc_result_t result;
+
+
+ UNUSED(driverarg);
+
+ if (cd->dlz_allnodes == NULL) {
+ return (ISC_R_NOPERM);
+ }
+
+ MAYBE_LOCK(cd);
+ result = cd->dlz_allnodes(zone, cd->dbdata, allnodes);
+ MAYBE_UNLOCK(cd);
+ return (result);
+}
+
+
+static isc_result_t
+dlopen_dlz_allowzonexfr(void *driverarg, void *dbdata, const char *name,
+ const char *client)
+{
+ dlopen_data_t *cd = (dlopen_data_t *) dbdata;
+ isc_result_t result;
+
+ UNUSED(driverarg);
+
+
+ if (cd->dlz_allowzonexfr == NULL) {
+ return (ISC_R_NOPERM);
+ }
+
+ MAYBE_LOCK(cd);
+ result = cd->dlz_allowzonexfr(cd->dbdata, name, client);
+ MAYBE_UNLOCK(cd);
+ return (result);
+}
+
+static isc_result_t
+dlopen_dlz_authority(const char *zone, void *driverarg, void *dbdata,
+ dns_sdlzlookup_t *lookup)
+{
+ dlopen_data_t *cd = (dlopen_data_t *) dbdata;
+ isc_result_t result;
+
+ UNUSED(driverarg);
+
+ if (cd->dlz_authority == NULL) {
+ return (ISC_R_NOTIMPLEMENTED);
+ }
+
+ MAYBE_LOCK(cd);
+ result = cd->dlz_authority(zone, cd->dbdata, lookup);
+ MAYBE_UNLOCK(cd);
+ return (result);
+}
+
+static isc_result_t
+dlopen_dlz_findzonedb(void *driverarg, void *dbdata, const char *name)
+{
+ dlopen_data_t *cd = (dlopen_data_t *) dbdata;
+ isc_result_t result;
+
+ UNUSED(driverarg);
+
+ MAYBE_LOCK(cd);
+ result = cd->dlz_findzonedb(cd->dbdata, name);
+ MAYBE_UNLOCK(cd);
+ return (result);
+}
+
+
+static isc_result_t
+dlopen_dlz_lookup(const char *zone, const char *name, void *driverarg,
+ void *dbdata, dns_sdlzlookup_t *lookup)
+{
+ dlopen_data_t *cd = (dlopen_data_t *) dbdata;
+ isc_result_t result;
+
+ UNUSED(driverarg);
+
+ MAYBE_LOCK(cd);
+ result = cd->dlz_lookup(zone, name, cd->dbdata, lookup);
+ MAYBE_UNLOCK(cd);
+ return (result);
+}
+
+/*
+ * Load a symbol from the library
+ */
+static void *
+dl_load_symbol(dlopen_data_t *cd, const char *symbol, isc_boolean_t mandatory) {
+ void *ptr = dlsym(cd->dl_handle, symbol);
+ if (ptr == NULL && mandatory) {
+ dlopen_log(ISC_LOG_ERROR,
+ "dlz_dlopen: library '%s' is missing "
+ "required symbol '%s'", cd->dl_path, symbol);
+ }
+ return (ptr);
+}
+
+/*
+ * Called at startup for each dlopen zone in named.conf
+ */
+static isc_result_t
+dlopen_dlz_create(const char *dlzname, unsigned int argc, char *argv[],
+ void *driverarg, void **dbdata)
+{
+ dlopen_data_t *cd;
+ isc_mem_t *mctx = NULL;
+ isc_result_t result = ISC_R_FAILURE;
+ int dlopen_flags = 0;
+
+ UNUSED(driverarg);
+
+ if (argc < 2) {
+ dlopen_log(ISC_LOG_ERROR,
+ "dlz_dlopen driver for '%s' needs a path to "
+ "the shared library", dlzname);
+ return (ISC_R_FAILURE);
+ }
+
+ isc_mem_create(0, 0, &mctx);
+
+ cd = isc_mem_get(mctx, sizeof(*cd));
+ if (cd == NULL) {
+ isc_mem_destroy(&mctx);
+ return (ISC_R_NOMEMORY);
+ }
+ memset(cd, 0, sizeof(*cd));
+
+ cd->mctx = mctx;
+
+ cd->dl_path = isc_mem_strdup(cd->mctx, argv[1]);
+ if (cd->dl_path == NULL) {
+ goto failed;
+ }
+
+ cd->dlzname = isc_mem_strdup(cd->mctx, dlzname);
+ if (cd->dlzname == NULL) {
+ goto failed;
+ }
+
+ /* Initialize the lock */
+ isc_mutex_init(&cd->lock);
+
+ /* Open the library */
+ dlopen_flags = RTLD_NOW;
+
+#ifdef RTLD_DEEPBIND
+ /*
+ * If RTLD_DEEPBIND is available then use it. This can avoid
+ * issues with a module using a different version of a system
+ * library than one that bind9 uses. For example, bind9 may link
+ * to MIT kerberos, but the module may use Heimdal. If we don't
+ * use RTLD_DEEPBIND then we could end up with Heimdal functions
+ * calling MIT functions, which leads to bizarre results (usually
+ * a segfault).
+ */
+ dlopen_flags |= RTLD_DEEPBIND;
+#endif
+
+ cd->dl_handle = dlopen(cd->dl_path, dlopen_flags);
+ if (cd->dl_handle == NULL) {
+ dlopen_log(ISC_LOG_ERROR,
+ "dlz_dlopen failed to open library '%s' - %s",
+ cd->dl_path, dlerror());
+ goto failed;
+ }
+
+ /* Find the symbols */
+ cd->dlz_version = (dlz_dlopen_version_t *)
+ dl_load_symbol(cd, "dlz_version", ISC_TRUE);
+ cd->dlz_create = (dlz_dlopen_create_t *)
+ dl_load_symbol(cd, "dlz_create", ISC_TRUE);
+ cd->dlz_lookup = (dlz_dlopen_lookup_t *)
+ dl_load_symbol(cd, "dlz_lookup", ISC_TRUE);
+ cd->dlz_findzonedb = (dlz_dlopen_findzonedb_t *)
+ dl_load_symbol(cd, "dlz_findzonedb", ISC_TRUE);
+
+ if (cd->dlz_create == NULL ||
+ cd->dlz_lookup == NULL ||
+ cd->dlz_findzonedb == NULL)
+ {
+ /* We're missing a required symbol */
+ goto failed;
+ }
+
+ cd->dlz_allowzonexfr = (dlz_dlopen_allowzonexfr_t *)
+ dl_load_symbol(cd, "dlz_allowzonexfr", ISC_FALSE);
+ cd->dlz_allnodes = (dlz_dlopen_allnodes_t *)
+ dl_load_symbol(cd, "dlz_allnodes",
+ ISC_TF(cd->dlz_allowzonexfr != NULL));
+ cd->dlz_authority = (dlz_dlopen_authority_t *)
+ dl_load_symbol(cd, "dlz_authority", ISC_FALSE);
+ cd->dlz_newversion = (dlz_dlopen_newversion_t *)
+ dl_load_symbol(cd, "dlz_newversion", ISC_FALSE);
+ cd->dlz_closeversion = (dlz_dlopen_closeversion_t *)
+ dl_load_symbol(cd, "dlz_closeversion",
+ ISC_TF(cd->dlz_newversion != NULL));
+ cd->dlz_configure = (dlz_dlopen_configure_t *)
+ dl_load_symbol(cd, "dlz_configure", ISC_FALSE);
+ cd->dlz_ssumatch = (dlz_dlopen_ssumatch_t *)
+ dl_load_symbol(cd, "dlz_ssumatch", ISC_FALSE);
+ cd->dlz_addrdataset = (dlz_dlopen_addrdataset_t *)
+ dl_load_symbol(cd, "dlz_addrdataset", ISC_FALSE);
+ cd->dlz_subrdataset = (dlz_dlopen_subrdataset_t *)
+ dl_load_symbol(cd, "dlz_subrdataset", ISC_FALSE);
+ cd->dlz_delrdataset = (dlz_dlopen_delrdataset_t *)
+ dl_load_symbol(cd, "dlz_delrdataset", ISC_FALSE);
+
+ /* Check the version of the API is the same */
+ cd->version = cd->dlz_version(&cd->flags);
+ if (cd->version != DLZ_DLOPEN_VERSION) {
+ dlopen_log(ISC_LOG_ERROR,
+ "dlz_dlopen: incorrect version %d "
+ "should be %d in '%s'",
+ cd->version, DLZ_DLOPEN_VERSION, cd->dl_path);
+ goto failed;
+ }
+
+ /*
+ * Call the library's create function. Note that this is an
+ * extended version of dlz create, with the addition of
+ * named function pointers for helper functions that the
+ * driver will need. This avoids the need for the backend to
+ * link the BIND9 libraries
+ */
+ MAYBE_LOCK(cd);
+ result = cd->dlz_create(dlzname, argc-1, argv+1,
+ &cd->dbdata,
+ "log", dlopen_log,
+ "putrr", dns_sdlz_putrr,
+ "putnamedrr", dns_sdlz_putnamedrr,
+ "writeable_zone", dns_dlz_writeablezone,
+ NULL);
+ MAYBE_UNLOCK(cd);
+ if (result != ISC_R_SUCCESS)
+ goto failed;
+
+ *dbdata = cd;
+
+ return (ISC_R_SUCCESS);
+
+failed:
+ dlopen_log(ISC_LOG_ERROR, "dlz_dlopen of '%s' failed", dlzname);
+ if (cd->dl_path)
+ isc_mem_free(mctx, cd->dl_path);
+ if (cd->dlzname)
+ isc_mem_free(mctx, cd->dlzname);
+ if (dlopen_flags)
+ (void) isc_mutex_destroy(&cd->lock);
+#ifdef HAVE_DLCLOSE
+ if (cd->dl_handle)
+ dlclose(cd->dl_handle);
+#endif
+ isc_mem_put(mctx, cd, sizeof(*cd));
+ isc_mem_destroy(&mctx);
+ return (result);
+}
+
+
+/*
+ * Called when bind is shutting down
+ */
+static void
+dlopen_dlz_destroy(void *driverarg, void *dbdata) {
+ dlopen_data_t *cd = (dlopen_data_t *) dbdata;
+ isc_mem_t *mctx;
+
+ UNUSED(driverarg);
+
+ if (cd->dlz_destroy) {
+ MAYBE_LOCK(cd);
+ cd->dlz_destroy(cd->dbdata);
+ MAYBE_UNLOCK(cd);
+ }
+
+ if (cd->dl_path)
+ isc_mem_free(cd->mctx, cd->dl_path);
+ if (cd->dlzname)
+ isc_mem_free(cd->mctx, cd->dlzname);
+
+#ifdef HAVE_DLCLOSE
+ if (cd->dl_handle)
+ dlclose(cd->dl_handle);
+#endif
+
+ (void) isc_mutex_destroy(&cd->lock);
+
+ mctx = cd->mctx;
+ isc_mem_put(mctx, cd, sizeof(*cd));
+ isc_mem_destroy(&mctx);
+}
+
+/*
+ * Called to start a transaction
+ */
+static isc_result_t
+dlopen_dlz_newversion(const char *zone, void *driverarg, void *dbdata,
+ void **versionp)
+{
+ dlopen_data_t *cd = (dlopen_data_t *) dbdata;
+ isc_result_t result;
+
+ UNUSED(driverarg);
+
+ if (cd->dlz_newversion == NULL)
+ return (ISC_R_NOTIMPLEMENTED);
+
+ MAYBE_LOCK(cd);
+ result = cd->dlz_newversion(zone, cd->dbdata, versionp);
+ MAYBE_UNLOCK(cd);
+ return (result);
+}
+
+/*
+ * Called to end a transaction
+ */
+static void
+dlopen_dlz_closeversion(const char *zone, isc_boolean_t commit,
+ void *driverarg, void *dbdata, void **versionp)
+{
+ dlopen_data_t *cd = (dlopen_data_t *) dbdata;
+
+ UNUSED(driverarg);
+
+ if (cd->dlz_newversion == NULL) {
+ *versionp = NULL;
+ return;
+ }
+
+ MAYBE_LOCK(cd);
+ cd->dlz_closeversion(zone, commit, cd->dbdata, versionp);
+ MAYBE_UNLOCK(cd);
+}
+
+/*
+ * Called on startup to configure any writeable zones
+ */
+static isc_result_t
+dlopen_dlz_configure(dns_view_t *view, void *driverarg, void *dbdata) {
+ dlopen_data_t *cd = (dlopen_data_t *) dbdata;
+ isc_result_t result;
+
+ UNUSED(driverarg);
+
+ if (cd->dlz_configure == NULL)
+ return (ISC_R_SUCCESS);
+
+ MAYBE_LOCK(cd);
+ cd->in_configure = ISC_TRUE;
+ result = cd->dlz_configure(view, cd->dbdata);
+ cd->in_configure = ISC_FALSE;
+ MAYBE_UNLOCK(cd);
+
+ return (result);
+}
+
+
+/*
+ * Check for authority to change a name
+ */
+static isc_boolean_t
+dlopen_dlz_ssumatch(const char *signer, const char *name, const char *tcpaddr,
+ const char *type, const char *key, isc_uint32_t keydatalen,
+ unsigned char *keydata, void *driverarg, void *dbdata)
+{
+ dlopen_data_t *cd = (dlopen_data_t *) dbdata;
+ isc_boolean_t ret;
+
+ UNUSED(driverarg);
+
+ if (cd->dlz_ssumatch == NULL)
+ return (ISC_FALSE);
+
+ MAYBE_LOCK(cd);
+ ret = cd->dlz_ssumatch(signer, name, tcpaddr, type, key, keydatalen,
+ keydata, cd->dbdata);
+ MAYBE_UNLOCK(cd);
+
+ return (ret);
+}
+
+
+/*
+ * Add an rdataset
+ */
+static isc_result_t
+dlopen_dlz_addrdataset(const char *name, const char *rdatastr,
+ void *driverarg, void *dbdata, void *version)
+{
+ dlopen_data_t *cd = (dlopen_data_t *) dbdata;
+ isc_result_t result;
+
+ UNUSED(driverarg);
+
+ if (cd->dlz_addrdataset == NULL)
+ return (ISC_R_NOTIMPLEMENTED);
+
+ MAYBE_LOCK(cd);
+ result = cd->dlz_addrdataset(name, rdatastr, cd->dbdata, version);
+ MAYBE_UNLOCK(cd);
+
+ return (result);
+}
+
+/*
+ * Subtract an rdataset
+ */
+static isc_result_t
+dlopen_dlz_subrdataset(const char *name, const char *rdatastr,
+ void *driverarg, void *dbdata, void *version)
+{
+ dlopen_data_t *cd = (dlopen_data_t *) dbdata;
+ isc_result_t result;
+
+ UNUSED(driverarg);
+
+ if (cd->dlz_subrdataset == NULL)
+ return (ISC_R_NOTIMPLEMENTED);
+
+ MAYBE_LOCK(cd);
+ result = cd->dlz_subrdataset(name, rdatastr, cd->dbdata, version);
+ MAYBE_UNLOCK(cd);
+
+ return (result);
+}
+
+/*
+ delete a rdataset
+ */
+static isc_result_t
+dlopen_dlz_delrdataset(const char *name, const char *type,
+ void *driverarg, void *dbdata, void *version)
+{
+ dlopen_data_t *cd = (dlopen_data_t *) dbdata;
+ isc_result_t result;
+
+ UNUSED(driverarg);
+
+ if (cd->dlz_delrdataset == NULL)
+ return (ISC_R_NOTIMPLEMENTED);
+
+ MAYBE_LOCK(cd);
+ result = cd->dlz_delrdataset(name, type, cd->dbdata, version);
+ MAYBE_UNLOCK(cd);
+
+ return (result);
+}
+
+
+static dns_sdlzmethods_t dlz_dlopen_methods = {
+ dlopen_dlz_create,
+ dlopen_dlz_destroy,
+ dlopen_dlz_findzonedb,
+ dlopen_dlz_lookup,
+ dlopen_dlz_authority,
+ dlopen_dlz_allnodes,
+ dlopen_dlz_allowzonexfr,
+ dlopen_dlz_newversion,
+ dlopen_dlz_closeversion,
+ dlopen_dlz_configure,
+ dlopen_dlz_ssumatch,
+ dlopen_dlz_addrdataset,
+ dlopen_dlz_subrdataset,
+ dlopen_dlz_delrdataset
+};
+#endif
+
+/*
+ * Register driver with BIND
+ */
+isc_result_t
+dlz_dlopen_init(isc_mem_t *mctx) {
+#ifndef ISC_DLZ_DLOPEN
+ UNUSED(mctx);
+ return (ISC_R_NOTIMPLEMENTED);
+#else
+ isc_result_t result;
+
+ dlopen_log(2, "Registering DLZ_dlopen driver");
+
+ result = dns_sdlzregister("dlopen", &dlz_dlopen_methods, NULL,
+ DNS_SDLZFLAG_RELATIVEOWNER |
+ DNS_SDLZFLAG_THREADSAFE,
+ mctx, &dlz_dlopen);
+
+ if (result != ISC_R_SUCCESS) {
+ UNEXPECTED_ERROR(__FILE__, __LINE__,
+ "dns_sdlzregister() failed: %s",
+ isc_result_totext(result));
+ result = ISC_R_UNEXPECTED;
+ }
+
+ return (result);
+#endif
+}
+
+
+/*
+ * Unregister the driver
+ */
+void
+dlz_dlopen_clear(void) {
+#ifdef ISC_DLZ_DLOPEN
+ dlopen_log(2, "Unregistering DLZ_dlopen driver");
+ if (dlz_dlopen != NULL)
+ dns_sdlzunregister(&dlz_dlopen);
+#endif
+}
diff --git a/contrib/bind9/bin/named/unix/os.c b/contrib/bind9/bin/named/unix/os.c
index 53e9e4501249..5fd654738600 100644
--- a/contrib/bind9/bin/named/unix/os.c
+++ b/contrib/bind9/bin/named/unix/os.c
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2004-2010 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2002 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: os.c,v 1.104 2010-11-17 23:47:08 tbox Exp $ */
+/* $Id: os.c,v 1.104.38.3 2011-03-02 00:04:01 marka Exp $ */
/*! \file */
@@ -790,6 +790,9 @@ ns_os_openfile(const char *filename, mode_t mode, isc_boolean_t switch_user) {
free(f);
if (switch_user && runas_pw != NULL) {
+#ifndef HAVE_LINUXTHREADS
+ gid_t oldgid = getgid();
+#endif
/* Set UID/GID to the one we'll be running with eventually */
setperms(runas_pw->pw_uid, runas_pw->pw_gid);
@@ -797,7 +800,7 @@ ns_os_openfile(const char *filename, mode_t mode, isc_boolean_t switch_user) {
#ifndef HAVE_LINUXTHREADS
/* Restore UID/GID to root */
- setperms(0, 0);
+ setperms(0, oldgid);
#endif /* HAVE_LINUXTHREADS */
if (fd == -1) {
@@ -950,7 +953,7 @@ ns_os_shutdownmsg(char *command, isc_buffer_t *text) {
isc_buffer_availablelength(text),
"pid: %ld", (long)pid);
/* Only send a message if it is complete. */
- if (n < isc_buffer_availablelength(text))
+ if (n > 0 && n < isc_buffer_availablelength(text))
isc_buffer_add(text, n);
}
diff --git a/contrib/bind9/bin/named/update.c b/contrib/bind9/bin/named/update.c
index eb1ed1d64ef9..c99db5f8c46c 100644
--- a/contrib/bind9/bin/named/update.c
+++ b/contrib/bind9/bin/named/update.c
@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: update.c,v 1.186.16.1.2.1 2011-06-02 23:47:28 tbox Exp $ */
+/* $Id: update.c,v 1.186.16.5 2011-03-25 23:53:52 each Exp $ */
#include
@@ -1692,7 +1692,7 @@ next_active(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
{
isc_result_t result;
dns_dbiterator_t *dbit = NULL;
- isc_boolean_t has_nsec;
+ isc_boolean_t has_nsec = ISC_FALSE;
unsigned int wraps = 0;
isc_boolean_t secure = dns_db_issecure(db);
@@ -2395,7 +2395,7 @@ update_signatures(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
name, diff));
}
CHECK(add_exposed_sigs(client, zone, db, newver, name,
- cut, diff, zone_keys, nkeys,
+ cut, &sig_diff, zone_keys, nkeys,
inception, expire, check_ksk,
keyset_kskonly));
}
@@ -2554,7 +2554,7 @@ update_signatures(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
privatetype, &nsec_diff));
} else {
CHECK(add_exposed_sigs(client, zone, db, newver, name,
- cut, diff, zone_keys, nkeys,
+ cut, &sig_diff, zone_keys, nkeys,
inception, expire, check_ksk,
keyset_kskonly));
CHECK(dns_nsec3_addnsec3sx(db, newver, name, nsecttl,
@@ -3734,7 +3734,6 @@ update_action(isc_task_t *task, isc_event_t *event) {
* Check Requestor's Permissions. It seems a bit silly to do this
* only after prerequisite testing, but that is what RFC2136 says.
*/
- result = ISC_R_SUCCESS;
if (ssutable == NULL)
CHECK(checkupdateacl(client, dns_zone_getupdateacl(zone),
"update", zonename, ISC_FALSE, ISC_FALSE));
diff --git a/contrib/bind9/bin/named/xfrout.c b/contrib/bind9/bin/named/xfrout.c
index b036ed14d57f..83c64f27954e 100644
--- a/contrib/bind9/bin/named/xfrout.c
+++ b/contrib/bind9/bin/named/xfrout.c
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2004-2010 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: xfrout.c,v 1.139 2010-12-18 01:56:19 each Exp $ */
+/* $Id: xfrout.c,v 1.139.16.3 2011-07-28 04:30:54 marka Exp $ */
#include
@@ -28,9 +28,7 @@
#include
#include
-#ifdef DLZ
#include
-#endif
#include
#include
#include
@@ -752,9 +750,7 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
char msg[NS_CLIENT_ACLMSGSIZE("zone transfer")];
char keyname[DNS_NAME_FORMATSIZE];
isc_boolean_t is_poll = ISC_FALSE;
-#ifdef DLZ
isc_boolean_t is_dlz = ISC_FALSE;
-#endif
switch (reqtype) {
case dns_rdatatype_axfr:
@@ -806,9 +802,7 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
result = dns_zt_find(client->view->zonetable, question_name, 0, NULL,
&zone);
- if (result != ISC_R_SUCCESS)
-#ifdef DLZ
- {
+ if (result != ISC_R_SUCCESS) {
/*
* Normal zone table does not have a match.
* Try the DLZ database
@@ -836,10 +830,8 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
goto failure;
}
if (result != ISC_R_SUCCESS)
-#endif
- FAILQ(DNS_R_NOTAUTH, "non-authoritative zone",
- question_name, question_class);
-#ifdef DLZ
+ FAILQ(DNS_R_NOTAUTH, "non-authoritative zone",
+ question_name, question_class);
is_dlz = ISC_TRUE;
/*
* DLZ only support full zone transfer, not incremental
@@ -859,7 +851,6 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
}
} else {
/* zone table has a match */
-#endif
switch(dns_zone_gettype(zone)) {
case dns_zone_master:
case dns_zone_slave:
@@ -870,9 +861,7 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
}
CHECK(dns_zone_getdb(zone, &db));
dns_db_currentversion(db, &ver);
-#ifdef DLZ
}
-#endif
xfrout_log1(client, question_name, question_class, ISC_LOG_DEBUG(6),
"%s question section OK", mnemonic);
@@ -926,22 +915,15 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
"%s authority section OK", mnemonic);
/*
- * Decide whether to allow this transfer.
- */
-#ifdef DLZ
- /*
- * if not a DLZ zone decide whether to allow this transfer.
+ * If not a DLZ zone, decide whether to allow this transfer.
*/
if (!is_dlz) {
-#endif
ns_client_aclmsg("zone transfer", question_name, reqtype,
client->view->rdclass, msg, sizeof(msg));
CHECK(ns_client_checkacl(client, NULL, msg,
dns_zone_getxfracl(zone),
ISC_TRUE, ISC_LOG_ERROR));
-#ifdef DLZ
}
-#endif
/*
* AXFR over UDP is not possible.
@@ -965,10 +947,9 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
/*
* Get a dynamically allocated copy of the current SOA.
*/
-#ifdef DLZ
if (is_dlz)
dns_db_currentversion(db, &ver);
-#endif
+
CHECK(dns_db_createsoatuple(db, ver, mctx, DNS_DIFFOP_EXISTS,
¤t_soa_tuple));
@@ -1054,7 +1035,6 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
-#ifdef DLZ
if (is_dlz)
CHECK(xfrout_ctx_create(mctx, client, request->id,
question_name, reqtype, question_class,
@@ -1067,7 +1047,6 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
ISC_TRUE : ISC_FALSE,
&xfr));
else
-#endif
CHECK(xfrout_ctx_create(mctx, client, request->id,
question_name, reqtype, question_class,
zone, db, ver, quota, stream,
@@ -1085,9 +1064,9 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
CHECK(xfr->stream->methods->first(xfr->stream));
- if (xfr->tsigkey != NULL) {
+ if (xfr->tsigkey != NULL)
dns_name_format(&xfr->tsigkey->name, keyname, sizeof(keyname));
- } else
+ else
keyname[0] = '\0';
if (is_poll)
xfrout_log1(client, question_name, question_class,
@@ -1157,7 +1136,8 @@ xfrout_ctx_create(isc_mem_t *mctx, ns_client_t *client, unsigned int id,
xfr = isc_mem_get(mctx, sizeof(*xfr));
if (xfr == NULL)
return (ISC_R_NOMEMORY);
- xfr->mctx = mctx;
+ xfr->mctx = NULL;
+ isc_mem_attach(mctx, &xfr->mctx);
xfr->client = NULL;
ns_client_attach(client, &xfr->client);
xfr->id = id;
@@ -1531,6 +1511,7 @@ sendstream(xfrout_ctx_t *xfr) {
static void
xfrout_ctx_destroy(xfrout_ctx_t **xfrp) {
xfrout_ctx_t *xfr = *xfrp;
+ ns_client_t *client = NULL;
INSIST(xfr->sends == 0);
@@ -1554,9 +1535,14 @@ xfrout_ctx_destroy(xfrout_ctx_t **xfrp) {
if (xfr->db != NULL)
dns_db_detach(&xfr->db);
+ /*
+ * We want to detch the client after we have released the memory
+ * context as ns_client_detach checks the memory reference count.
+ */
+ ns_client_attach(xfr->client, &client);
ns_client_detach(&xfr->client);
-
- isc_mem_put(xfr->mctx, xfr, sizeof(*xfr));
+ isc_mem_putanddetach(&xfr->mctx, xfr, sizeof(*xfr));
+ ns_client_detach(&client);
*xfrp = NULL;
}
diff --git a/contrib/bind9/bin/named/zoneconf.c b/contrib/bind9/bin/named/zoneconf.c
index eb93f1bbe45b..a3e713b4e94d 100644
--- a/contrib/bind9/bin/named/zoneconf.c
+++ b/contrib/bind9/bin/named/zoneconf.c
@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: zoneconf.c,v 1.170 2011-01-06 23:47:00 tbox Exp $ */
+/* $Id: zoneconf.c,v 1.170.14.4 2011-05-23 20:56:10 each Exp $ */
/*% */
@@ -127,7 +127,7 @@ configure_zone_acl(const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,
/* First check to see if ACL is defined within the zone */
if (zconfig != NULL) {
maps[0] = cfg_tuple_get(zconfig, "options");
- ns_config_get(maps, aclname, &aclobj);
+ (void)ns_config_get(maps, aclname, &aclobj);
if (aclobj != NULL) {
aclp = NULL;
goto parse_acl;
@@ -155,7 +155,7 @@ configure_zone_acl(const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,
maps[i++] = ns_g_defaults;
maps[i] = NULL;
- result = ns_config_get(maps, aclname, &aclobj);
+ (void)ns_config_get(maps, aclname, &aclobj);
if (aclobj == NULL) {
(*clearzacl)(zone);
return (ISC_R_SUCCESS);
@@ -605,7 +605,8 @@ configure_staticstub(const cfg_obj_t *zconfig, dns_zone_t *zone,
/* Prepare zone RRs from the configuration */
obj = NULL;
result = cfg_map_get(zconfig, "server-addresses", &obj);
- if (obj != NULL) {
+ if (result == ISC_R_SUCCESS) {
+ INSIST(obj != NULL);
result = configure_staticstub_serveraddrs(obj, zone,
&rdatalist_ns,
&rdatalist_a,
@@ -616,7 +617,8 @@ configure_staticstub(const cfg_obj_t *zconfig, dns_zone_t *zone,
obj = NULL;
result = cfg_map_get(zconfig, "server-names", &obj);
- if (obj != NULL) {
+ if (result == ISC_R_SUCCESS) {
+ INSIST(obj != NULL);
result = configure_staticstub_servernames(obj, zone,
&rdatalist_ns,
zname);
@@ -714,7 +716,7 @@ zonetype_fromconfig(const cfg_obj_t *map) {
isc_result_t result;
result = cfg_map_get(map, "type", &obj);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
return (ns_config_getzonetype(obj));
}
@@ -778,7 +780,7 @@ checknames(dns_zonetype_t ztype, const cfg_obj_t **maps,
INSIST(0);
}
result = ns_checknames_get(maps, zone, objp);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && objp != NULL && *objp != NULL);
}
isc_result_t
@@ -832,7 +834,7 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
maps[i++] = options;
}
maps[i++] = ns_g_defaults;
- maps[i++] = NULL;
+ maps[i] = NULL;
if (vconfig != NULL)
RETERR(ns_config_getclass(cfg_tuple_get(vconfig, "class"),
@@ -934,7 +936,7 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
obj = NULL;
result = ns_config_get(maps, "dialup", &obj);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
if (cfg_obj_isboolean(obj)) {
if (cfg_obj_asboolean(obj))
dialup = dns_dialuptype_yes;
@@ -957,7 +959,7 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
obj = NULL;
result = ns_config_get(maps, "zone-statistics", &obj);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
zonestats_on = cfg_obj_asboolean(obj);
zoneqrystats = NULL;
if (zonestats_on) {
@@ -976,7 +978,7 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
if (ztype != dns_zone_stub && ztype != dns_zone_staticstub) {
obj = NULL;
result = ns_config_get(maps, "notify", &obj);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
if (cfg_obj_isboolean(obj)) {
if (cfg_obj_asboolean(obj))
notifytype = dns_notifytype_yes;
@@ -1012,19 +1014,19 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
obj = NULL;
result = ns_config_get(maps, "notify-source", &obj);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
RETERR(dns_zone_setnotifysrc4(zone, cfg_obj_assockaddr(obj)));
ns_add_reserved_dispatch(ns_g_server, cfg_obj_assockaddr(obj));
obj = NULL;
result = ns_config_get(maps, "notify-source-v6", &obj);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
RETERR(dns_zone_setnotifysrc6(zone, cfg_obj_assockaddr(obj)));
ns_add_reserved_dispatch(ns_g_server, cfg_obj_assockaddr(obj));
obj = NULL;
result = ns_config_get(maps, "notify-to-soa", &obj);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
dns_zone_setoption(zone, DNS_ZONEOPT_NOTIFYTOSOA,
cfg_obj_asboolean(obj));
@@ -1037,17 +1039,17 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
obj = NULL;
result = ns_config_get(maps, "max-transfer-time-out", &obj);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
dns_zone_setmaxxfrout(zone, cfg_obj_asuint32(obj) * 60);
obj = NULL;
result = ns_config_get(maps, "max-transfer-idle-out", &obj);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
dns_zone_setidleout(zone, cfg_obj_asuint32(obj) * 60);
obj = NULL;
result = ns_config_get(maps, "max-journal-size", &obj);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
dns_zone_setjournalsize(zone, -1);
if (cfg_obj_isstring(obj)) {
const char *str = cfg_obj_asstring(obj);
@@ -1071,13 +1073,13 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
obj = NULL;
result = ns_config_get(maps, "ixfr-from-differences", &obj);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
if (cfg_obj_isboolean(obj))
ixfrdiff = cfg_obj_asboolean(obj);
- else if (strcasecmp(cfg_obj_asstring(obj), "master") &&
+ else if (!strcasecmp(cfg_obj_asstring(obj), "master") &&
ztype == dns_zone_master)
ixfrdiff = ISC_TRUE;
- else if (strcasecmp(cfg_obj_asstring(obj), "slave") &&
+ else if (!strcasecmp(cfg_obj_asstring(obj), "slave") &&
ztype == dns_zone_slave)
ixfrdiff = ISC_TRUE;
else
@@ -1100,23 +1102,23 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
obj = NULL;
result = ns_config_get(maps, "notify-delay", &obj);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
dns_zone_setnotifydelay(zone, cfg_obj_asuint32(obj));
obj = NULL;
result = ns_config_get(maps, "check-sibling", &obj);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
dns_zone_setoption(zone, DNS_ZONEOPT_CHECKSIBLING,
cfg_obj_asboolean(obj));
obj = NULL;
result = ns_config_get(maps, "zero-no-soa-ttl", &obj);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
dns_zone_setzeronosoattl(zone, cfg_obj_asboolean(obj));
obj = NULL;
result = ns_config_get(maps, "nsec3-test-zone", &obj);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
dns_zone_setoption(zone, DNS_ZONEOPT_NSEC3TESTZONE,
cfg_obj_asboolean(obj));
}
@@ -1145,7 +1147,7 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
obj = NULL;
result = ns_config_get(maps, "sig-validity-interval", &obj);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
{
const cfg_obj_t *validity, *resign;
@@ -1176,28 +1178,28 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
obj = NULL;
result = ns_config_get(maps, "sig-signing-signatures", &obj);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
dns_zone_setsignatures(zone, cfg_obj_asuint32(obj));
obj = NULL;
result = ns_config_get(maps, "sig-signing-nodes", &obj);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
dns_zone_setnodes(zone, cfg_obj_asuint32(obj));
obj = NULL;
result = ns_config_get(maps, "sig-signing-type", &obj);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
dns_zone_setprivatetype(zone, cfg_obj_asuint32(obj));
obj = NULL;
result = ns_config_get(maps, "update-check-ksk", &obj);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
dns_zone_setoption(zone, DNS_ZONEOPT_UPDATECHECKKSK,
cfg_obj_asboolean(obj));
obj = NULL;
result = ns_config_get(maps, "dnssec-dnskey-kskonly", &obj);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
dns_zone_setoption(zone, DNS_ZONEOPT_DNSKEYKSKONLY,
cfg_obj_asboolean(obj));
} else if (ztype == dns_zone_slave) {
@@ -1212,7 +1214,6 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
*/
if (ztype == dns_zone_master) {
isc_boolean_t allow = ISC_FALSE, maint = ISC_FALSE;
- isc_boolean_t create = ISC_FALSE;
obj = NULL;
result = ns_config_get(maps, "check-wildcard", &obj);
@@ -1224,7 +1225,7 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
obj = NULL;
result = ns_config_get(maps, "check-dup-records", &obj);
- INSIST(obj != NULL);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
if (strcasecmp(cfg_obj_asstring(obj), "warn") == 0) {
fail = ISC_FALSE;
check = ISC_TRUE;
@@ -1239,7 +1240,7 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
obj = NULL;
result = ns_config_get(maps, "check-mx", &obj);
- INSIST(obj != NULL);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
if (strcasecmp(cfg_obj_asstring(obj), "warn") == 0) {
fail = ISC_FALSE;
check = ISC_TRUE;
@@ -1254,13 +1255,13 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
obj = NULL;
result = ns_config_get(maps, "check-integrity", &obj);
- INSIST(obj != NULL);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
dns_zone_setoption(zone, DNS_ZONEOPT_CHECKINTEGRITY,
cfg_obj_asboolean(obj));
obj = NULL;
result = ns_config_get(maps, "check-mx-cname", &obj);
- INSIST(obj != NULL);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
if (strcasecmp(cfg_obj_asstring(obj), "warn") == 0) {
warn = ISC_TRUE;
ignore = ISC_FALSE;
@@ -1275,7 +1276,7 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
obj = NULL;
result = ns_config_get(maps, "check-srv-cname", &obj);
- INSIST(obj != NULL);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
if (strcasecmp(cfg_obj_asstring(obj), "warn") == 0) {
warn = ISC_TRUE;
ignore = ISC_FALSE;
@@ -1290,7 +1291,7 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
obj = NULL;
result = ns_config_get(maps, "dnssec-secure-to-insecure", &obj);
- INSIST(obj != NULL);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
dns_zone_setoption(zone, DNS_ZONEOPT_SECURETOINSECURE,
cfg_obj_asboolean(obj));
@@ -1302,15 +1303,12 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
allow = ISC_TRUE;
else if (strcasecmp(arg, "maintain") == 0)
allow = maint = ISC_TRUE;
- else if (strcasecmp(arg, "create") == 0)
- allow = maint = create = ISC_TRUE;
else if (strcasecmp(arg, "off") == 0)
;
else
INSIST(0);
dns_zone_setkeyopt(zone, DNS_ZONEKEY_ALLOW, allow);
dns_zone_setkeyopt(zone, DNS_ZONEKEY_MAINTAIN, maint);
- dns_zone_setkeyopt(zone, DNS_ZONEKEY_CREATE, create);
}
}
@@ -1322,7 +1320,7 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
case dns_zone_stub:
count = 0;
obj = NULL;
- result = cfg_map_get(zoptions, "masters", &obj);
+ (void)cfg_map_get(zoptions, "masters", &obj);
if (obj != NULL) {
addrs = NULL;
keynames = NULL;
@@ -1341,61 +1339,61 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
if (count > 1) {
obj = NULL;
result = ns_config_get(maps, "multi-master", &obj);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
multi = cfg_obj_asboolean(obj);
}
dns_zone_setoption(zone, DNS_ZONEOPT_MULTIMASTER, multi);
obj = NULL;
result = ns_config_get(maps, "max-transfer-time-in", &obj);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
dns_zone_setmaxxfrin(zone, cfg_obj_asuint32(obj) * 60);
obj = NULL;
result = ns_config_get(maps, "max-transfer-idle-in", &obj);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
dns_zone_setidlein(zone, cfg_obj_asuint32(obj) * 60);
obj = NULL;
result = ns_config_get(maps, "max-refresh-time", &obj);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
dns_zone_setmaxrefreshtime(zone, cfg_obj_asuint32(obj));
obj = NULL;
result = ns_config_get(maps, "min-refresh-time", &obj);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
dns_zone_setminrefreshtime(zone, cfg_obj_asuint32(obj));
obj = NULL;
result = ns_config_get(maps, "max-retry-time", &obj);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
dns_zone_setmaxretrytime(zone, cfg_obj_asuint32(obj));
obj = NULL;
result = ns_config_get(maps, "min-retry-time", &obj);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
dns_zone_setminretrytime(zone, cfg_obj_asuint32(obj));
obj = NULL;
result = ns_config_get(maps, "transfer-source", &obj);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
RETERR(dns_zone_setxfrsource4(zone, cfg_obj_assockaddr(obj)));
ns_add_reserved_dispatch(ns_g_server, cfg_obj_assockaddr(obj));
obj = NULL;
result = ns_config_get(maps, "transfer-source-v6", &obj);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
RETERR(dns_zone_setxfrsource6(zone, cfg_obj_assockaddr(obj)));
ns_add_reserved_dispatch(ns_g_server, cfg_obj_assockaddr(obj));
obj = NULL;
result = ns_config_get(maps, "alt-transfer-source", &obj);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
RETERR(dns_zone_setaltxfrsource4(zone, cfg_obj_assockaddr(obj)));
obj = NULL;
result = ns_config_get(maps, "alt-transfer-source-v6", &obj);
- INSIST(result == ISC_R_SUCCESS);
+ INSIST(result == ISC_R_SUCCESS && obj != NULL);
RETERR(dns_zone_setaltxfrsource6(zone, cfg_obj_assockaddr(obj)));
obj = NULL;
@@ -1433,7 +1431,6 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
}
-#ifdef DLZ
/*
* Set up a DLZ zone as writeable
*/
@@ -1455,7 +1452,6 @@ ns_zone_configure_writeable_dlz(dns_dlzdb_t *dlzdatabase, dns_zone_t *zone,
dns_db_detach(&db);
return result;
}
-#endif
isc_boolean_t
ns_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig) {
diff --git a/contrib/bind9/bin/nsupdate/nsupdate.c b/contrib/bind9/bin/nsupdate/nsupdate.c
index ed01a47ac263..058088c8996e 100644
--- a/contrib/bind9/bin/nsupdate/nsupdate.c
+++ b/contrib/bind9/bin/nsupdate/nsupdate.c
@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: nsupdate.c,v 1.193 2011-01-10 05:32:03 marka Exp $ */
+/* $Id: nsupdate.c,v 1.193.12.3 2011-05-23 22:12:14 each Exp $ */
/*! \file */
@@ -145,7 +145,7 @@ static dns_name_t tmpzonename;
static dns_name_t restart_master;
static dns_tsig_keyring_t *gssring = NULL;
static dns_tsigkey_t *tsigkey = NULL;
-static dst_key_t *sig0key;
+static dst_key_t *sig0key = NULL;
static lwres_context_t *lwctx = NULL;
static lwres_conf_t *lwconf;
static isc_sockaddr_t *servers;
@@ -2262,6 +2262,7 @@ recvsoa(isc_task_t *task, isc_event_t *event) {
}
check_result(result, "dns_request_getresponse");
section = DNS_SECTION_ANSWER;
+ POST(section);
if (debugging)
show_message(stderr, rcvmsg, "Reply from SOA query:");
@@ -2881,6 +2882,9 @@ cleanup(void) {
}
#endif
+ if (sig0key != NULL)
+ dst_key_free(&sig0key);
+
ddebug("Shutting down task manager");
isc_taskmgr_destroy(&taskmgr);
diff --git a/contrib/bind9/bin/rndc/rndc.c b/contrib/bind9/bin/rndc/rndc.c
index 1976d9ce3322..1e9c3b064a8d 100644
--- a/contrib/bind9/bin/rndc/rndc.c
+++ b/contrib/bind9/bin/rndc/rndc.c
@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: rndc.c,v 1.131.20.1.2.1 2011-06-02 23:47:28 tbox Exp $ */
+/* $Id: rndc.c,v 1.131.20.2 2011-02-28 01:19:59 tbox Exp $ */
/*! \file */
diff --git a/contrib/bind9/bin/tools/genrandom.8 b/contrib/bind9/bin/tools/genrandom.8
index 32a4ff02efb6..5005658c9a14 100644
--- a/contrib/bind9/bin/tools/genrandom.8
+++ b/contrib/bind9/bin/tools/genrandom.8
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2009, 2010 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2009-2011 Internet Systems Consortium, Inc. ("ISC")
.\"
.\" Permission to use, copy, modify, and/or distribute this software for any
.\" purpose with or without fee is hereby granted, provided that the above
@@ -12,7 +12,7 @@
.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
.\" PERFORMANCE OF THIS SOFTWARE.
.\"
-.\" $Id: genrandom.8,v 1.8 2010-05-19 01:14:14 tbox Exp $
+.\" $Id: genrandom.8,v 1.8.124.1 2011-08-09 01:52:58 tbox Exp $
.\"
.hy 0
.ad l
@@ -53,7 +53,7 @@ size
The size of the file, in kilobytes, to generate.
.RE
.PP
-domain
+filename
.RS 4
The file name into which random data should be written.
.RE
@@ -65,5 +65,5 @@ The file name into which random data should be written.
.PP
Internet Systems Consortium
.SH "COPYRIGHT"
-Copyright \(co 2009, 2010 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2009\-2011 Internet Systems Consortium, Inc. ("ISC")
.br
diff --git a/contrib/bind9/bin/tools/genrandom.docbook b/contrib/bind9/bin/tools/genrandom.docbook
index 84e45534a822..b52ab4932a19 100644
--- a/contrib/bind9/bin/tools/genrandom.docbook
+++ b/contrib/bind9/bin/tools/genrandom.docbook
@@ -2,7 +2,7 @@
"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
[]>
-
+
Feb 19, 2009
@@ -38,6 +38,7 @@
20092010
+ 2011Internet Systems Consortium, Inc. ("ISC")
@@ -84,7 +85,7 @@
- domain
+ filename
The file name into which random data should be written.
diff --git a/contrib/bind9/bin/tools/genrandom.html b/contrib/bind9/bin/tools/genrandom.html
index c14af9bbd0e0..c3b2993a05cc 100644
--- a/contrib/bind9/bin/tools/genrandom.html
+++ b/contrib/bind9/bin/tools/genrandom.html
@@ -1,5 +1,5 @@
-
+
@@ -31,7 +31,7 @@
genrandom [-n number] {size} {filename}
-
DESCRIPTION
+
DESCRIPTION
genrandom
generates a file or a set of files containing a specified quantity
@@ -40,7 +40,7 @@
-
ARGUMENTS
+
ARGUMENTS
-n number
@@ -51,21 +51,21 @@
The size of the file, in kilobytes, to generate.
-
domain
+
filename
The file name into which random data should be written.
-
SEE ALSO
+
SEE ALSO
rand(3),
arc4random(3)
-
AUTHOR
+
AUTHOR
Internet Systems Consortium
diff --git a/contrib/bind9/config.h.in b/contrib/bind9/config.h.in
index 01f8b166acb2..477291da29fc 100644
--- a/contrib/bind9/config.h.in
+++ b/contrib/bind9/config.h.in
@@ -16,7 +16,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: config.h.in,v 1.143.8.1 2011-02-03 05:52:35 marka Exp $ */
+/* $Id: config.h.in,v 1.143.8.4 2011-03-10 04:29:14 each Exp $ */
/*! \file */
@@ -144,12 +144,12 @@ int sigwait(const unsigned int *set, int *sig);
/* Define if threads need PTHREAD_SCOPE_SYSTEM */
#undef NEED_PTHREAD_SCOPE_SYSTEM
-/* Define if building universal (internal helper macro) */
-#undef AC_APPLE_UNIVERSAL_BUILD
-
/* Define to enable the "filter-aaaa-on-v4" option. */
#undef ALLOW_FILTER_AAAA_ON_V4
+/* define if ATF unit tests are to be built. */
+#undef ATF_TEST
+
/* Define if recvmsg() does not meet all of the BSD socket API specifications.
*/
#undef BROKEN_RECVMSG
@@ -241,9 +241,6 @@ int sigwait(const unsigned int *set, int *sig);
/* Define to 1 if you have the `c_r' library (-lc_r). */
#undef HAVE_LIBC_R
-/* Define to 1 if you have the `dl' library (-ldl). */
-#undef HAVE_LIBDL
-
/* Define to 1 if you have the `nsl' library (-lnsl). */
#undef HAVE_LIBNSL
@@ -361,6 +358,9 @@ int sigwait(const unsigned int *set, int *sig);
/* Define to the flags type used by getnameinfo(3). */
#undef IRS_GETNAMEINFO_FLAGS_T
+/* Define to allow building of objects for dlopen(). */
+#undef ISC_DLZ_DLOPEN
+
/* Defined if extern char *optarg is not declared. */
#undef NEED_OPTARG
@@ -380,9 +380,6 @@ int sigwait(const unsigned int *set, int *sig);
/* Define to the one symbol short name of this package. */
#undef PACKAGE_TARNAME
-/* Define to the home page for this package. */
-#undef PACKAGE_URL
-
/* Define to the version of this package. */
#undef PACKAGE_VERSION
@@ -403,17 +400,9 @@ int sigwait(const unsigned int *set, int *sig);
/* define if idnkit support is to be included. */
#undef WITH_IDN
-/* Define WORDS_BIGENDIAN to 1 if your processor stores words with the most
- significant byte first (like Motorola and SPARC, unlike Intel). */
-#if defined AC_APPLE_UNIVERSAL_BUILD
-# if defined __BIG_ENDIAN__
-# define WORDS_BIGENDIAN 1
-# endif
-#else
-# ifndef WORDS_BIGENDIAN
-# undef WORDS_BIGENDIAN
-# endif
-#endif
+/* Define to 1 if your processor stores words with the most significant byte
+ first (like Motorola and SPARC, unlike Intel and VAX). */
+#undef WORDS_BIGENDIAN
/* Define to empty if `const' does not conform to ANSI C. */
#undef const
diff --git a/contrib/bind9/configure.in b/contrib/bind9/configure.in
index d5fb15cfb909..ff41067bdae2 100644
--- a/contrib/bind9/configure.in
+++ b/contrib/bind9/configure.in
@@ -18,7 +18,7 @@ AC_DIVERT_PUSH(1)dnl
esyscmd([sed "s/^/# /" COPYRIGHT])dnl
AC_DIVERT_POP()dnl
-AC_REVISION($Revision: 1.512.8.1 $)
+AC_REVISION($Revision: 1.512.8.12 $)
AC_INIT(lib/dns/name.c)
AC_PREREQ(2.59)
@@ -267,6 +267,14 @@ case "$host" in
STD_CDEFINES="$STD_CDEFINES -D_GNU_SOURCE"
CPPFLAGS="$CPPFLAGS -D_GNU_SOURCE"
;;
+ #
+ # Starting with OSX 10.7 (Lion) we must choose which IPv6 API to use.
+ # Setting this is sufficient to select the correct behavior for BIND 9.
+ #
+ *-darwin*)
+ STD_CDEFINES="$STD_CDEFINES -D__APPLE_USE_RFC_3542"
+ CPPFLAGS="$CPPFLAGS -D__APPLE_USE_RFC_3542"
+ ;;
esac
AC_HEADER_STDC
@@ -682,7 +690,9 @@ esac
int main() {
#if (OPENSSL_VERSION_NUMBER >= 0x10000000L)
ENGINE *e;
+ EC_KEY *ek;
+ ek = NULL;
OPENSSL_config(NULL);
e = ENGINE_by_id("gost");
@@ -699,7 +709,25 @@ int main() {
[AC_MSG_RESULT(yes)
have_gost="yes"],
[AC_MSG_RESULT(no)
- have_gost="no"])
+ have_gost="no"],
+ [AC_MSG_RESULT(using --with-gost)])
+ AC_ARG_WITH(gost, , with_gost="$withval", with_gost="auto")
+ case "$with_gost" in
+ yes)
+ case "$have_gost" in
+ no) AC_MSG_ERROR([gost not supported]) ;;
+ *) have_gost=yes ;;
+ esac
+ ;;
+ no)
+ have_gost=no ;;
+ *)
+ case "$have_gost" in
+ yes|no) ;;
+ *) AC_MSG_ERROR([need --with-gost=[[yes or no]]]) ;;
+ esac
+ ;;
+ esac
case $have_gost in
yes)
OPENSSL_GOST="yes"
@@ -795,20 +823,42 @@ AC_SUBST(PKCS11_PROVIDER)
AC_MSG_CHECKING(for GSSAPI library)
AC_ARG_WITH(gssapi,
-[ --with-gssapi=PATH Specify path for system-supplied GSSAPI],
- use_gssapi="$withval", use_gssapi="no")
+[ --with-gssapi=PATH Specify path for system-supplied GSSAPI [[default=yes]]],
+ use_gssapi="$withval", use_gssapi="yes")
-gssapidirs="/usr/local /usr/pkg /usr/kerberos /usr"
+# gssapi is just the framework, we really require kerberos v5, so
+# look for those headers (the gssapi headers must be there, too)
+# The problem with this implementation is that it doesn't allow
+# for the specification of gssapi and krb5 headers in different locations,
+# which probably ought to be fixed although fixing might raise the issue of
+# trying to build with incompatible versions of gssapi and krb5.
if test "$use_gssapi" = "yes"
then
- for d in $gssapidirs
- do
- if test -f $d/include/gssapi/gssapi.h -o -f $d/include/gssapi.h
+ # first, deal with the obvious
+ if test \( -f /usr/include/kerberosv5/krb5.h -o \
+ -f /usr/include/krb5/krb5.h -o \
+ -f /usr/include/krb5.h \) -a \
+ \( -f /usr/include/gssapi.h -o \
+ -f /usr/include/gssapi/gssapi.h \)
+ then
+ use_gssapi=/usr
+ else
+ krb5dirs="/usr/local /usr/local/krb5 /usr/local/kerberosv5 /usr/local/kerberos /usr/pkg /usr/krb5 /usr/kerberosv5 /usr/kerberos /usr"
+ for d in $krb5dirs
+ do
+ if test -f $d/include/gssapi/gssapi_krb5.h -o \
+ -f $d/include/krb5.h
then
- use_gssapi=$d
- break
+ if test -f $d/include/gssapi/gssapi.h -o \
+ -f $d/include/gssapi.h
+ then
+ use_gssapi=$d
+ break
+ fi
fi
- done
+ use_gssapi="no"
+ done
+ fi
fi
case "$use_gssapi" in
@@ -1821,10 +1871,8 @@ char a[16],b[64]; return(inet_ntop(AF_INET6, a, b, sizeof(b)) == (char*)0);}],
ISC_EXTRA_OBJS="$ISC_EXTRA_OBJS inet_ntop.$O"
ISC_EXTRA_SRCS="$ISC_EXTRA_SRCS inet_ntop.c"
ISC_PLATFORM_NEEDNTOP="#define ISC_PLATFORM_NEEDNTOP 1"],
- [AC_MSG_RESULT(assuming inet_ntop needed)
- ISC_EXTRA_OBJS="$ISC_EXTRA_OBJS inet_ntop.$O"
- ISC_EXTRA_SRCS="$ISC_EXTRA_SRCS inet_ntop.c"
- ISC_PLATFORM_NEEDNTOP="#define ISC_PLATFORM_NEEDNTOP 1"])
+ [AC_MSG_RESULT(assuming inet_ntop not needed)
+ ISC_PLATFORM_NEEDNTOP="#undef ISC_PLATFORM_NEEDNTOP"])
# On NetBSD 1.4.2 and maybe others, inet_pton() incorrectly accepts
@@ -1846,14 +1894,10 @@ main() { char a[16]; return (inet_pton(AF_INET, "1.2.3", a) == 1 ? 1 :
ISC_EXTRA_OBJS="$ISC_EXTRA_OBJS inet_pton.$O"
ISC_EXTRA_SRCS="$ISC_EXTRA_SRCS inet_pton.c"
ISC_PLATFORM_NEEDPTON="#define ISC_PLATFORM_NEEDPTON 1"],
- [AC_MSG_RESULT(assuming target platform has working inet_pton)
- ISC_PLATFORM_NEEDPTON="#undef ISC_PLATFORM_NEEDPTON"],
[AC_MSG_RESULT(assuming inet_pton needed)
ISC_EXTRA_OBJS="$ISC_EXTRA_OBJS inet_pton.$O"
ISC_EXTRA_SRCS="$ISC_EXTRA_SRCS inet_pton.c"
- ISC_PLATFORM_NEEDPTON="#define ISC_PLATFORM_NEEDPTON 1"],
- [AC_MSG_RESULT(assuming target platform has working inet_pton)
- ISC_PLATFORM_NEEDPTON="#undef ISC_PLATFORM_NEEDPTON"])
+ ISC_PLATFORM_NEEDPTON="#define ISC_PLATFORM_NEEDPTON 1"])
AC_SUBST(ISC_PLATFORM_NEEDNTOP)
AC_SUBST(ISC_PLATFORM_NEEDPTON)
@@ -2357,8 +2401,9 @@ ISC_PLATFORM_RLIMITTYPE="#define ISC_PLATFORM_RLIMITTYPE long long int"],
],[AC_MSG_ERROR(this cannot happen)])
],[AC_MSG_ERROR(this cannot happen)])
],[
-ISC_PLATFORM_RLIMITTYPE="#define ISC_PLATFORM_RLIMITTYPE long long int"
-AC_MSG_RESULT(cannot determine type of rlim_cur when cross compiling - assuming long long int)])
+AC_ARG_WITH(rlimtype, , rlimtype="$withval", rlimtype="long long int")
+ISC_PLATFORM_RLIMITTYPE="#define ISC_PLATFORM_RLIMITTYPE $rlimtype"
+AC_MSG_RESULT(cannot determine type of rlim_cur when cross compiling - assuming $rlimtype)])
])
AC_SUBST(ISC_PLATFORM_RLIMITTYPE)
@@ -2567,27 +2612,22 @@ if test "$use_atomic" = "yes"; then
[i[3456]86-*])
# XXX: some old x86 architectures actually do not support
# (some of) these operations. Do we need stricter checks?
-AC_TRY_RUN([
-main() {
- exit((sizeof(void *) == 8) ? 0 : 1);
-}
-],
- [arch=x86_64
- have_xaddq=yes],
- [arch=x86_32],
- [arch=x86_32])
+ AC_CHECK_SIZEOF([void *])
+ if test $ac_cv_sizeof_void_p = 8; then
+ arch=x86_64
+ have_xaddq=yes
+ else
+ arch=x86_32
+ fi
;;
x86_64-*|amd64-*)
-AC_TRY_RUN([
-main() {
- exit((sizeof(void *) == 8) ? 0 : 1);
-}
-],
- [arch=x86_64
- have_xaddq=yes],
- [arch=x86_32],
- [arch=x86_64
- have_xaddq=yes])
+ AC_CHECK_SIZEOF([void *])
+ if test $ac_cv_sizeof_void_p = 8; then
+ arch=x86_64
+ have_xaddq=yes
+ else
+ arch=x86_32
+ fi
;;
alpha*-*)
arch=alpha
@@ -3033,6 +3073,34 @@ if test "$use_idn" != no; then
fi
AC_SUBST(IDNLIBS)
+#
+# Check whether to build Automated Test Framework unit tests
+#
+AC_ARG_WITH(atf,
+ [ --with-atf=ARG Automated Test Framework support],
+ atf="$withval", atf="no")
+if test "$atf" = yes; then
+ atf=`pwd`/unit/atf
+ ATFBUILD=atf-src
+ AC_SUBST(ATFBUILD)
+ AC_CONFIG_COMMANDS([atf-config],
+ [cd unit/atf-src; ${SHELL} ./configure MISSING=: --prefix $atfdir; cd ../..],
+ [atfdir=`pwd`/unit/atf])
+ AC_MSG_RESULT(building ATF from bind9/unit/atf-src)
+fi
+
+ATFLIBS=
+if test "$atf" != no; then
+ AC_DEFINE(ATF_TEST, 1, [define if ATF unit tests are to be built.])
+ STD_CINCLUDES="$STD_CINCLUDES -I$atf/include"
+ ATFBIN="$atf/bin"
+ ATFLIBS="-L$atf/lib -latf-c"
+ UNITTESTS=tests
+fi
+AC_SUBST(ATFBIN)
+AC_SUBST(ATFLIBS)
+AC_SUBST(UNITTESTS)
+
AC_CHECK_HEADERS(locale.h)
AC_CHECK_FUNCS(setlocale)
@@ -3111,28 +3179,98 @@ LIBIRS_API=$srcdir/lib/irs/api
# Configure any DLZ drivers.
#
# If config.dlz.in selects one or more DLZ drivers, it will set
-# USE_DLZ to a non-empty value, which will be our clue to
-# enable the DLZ core functions.
+# CONTRIB_DLZ to a non-empty value, which will be our clue to
+# build DLZ drivers in contrib.
#
# This section has to come after the libtool stuff because it needs to
# know how to name the driver object files.
#
-USE_DLZ=""
+CONTRIB_DLZ=""
DLZ_DRIVER_INCLUDES=""
DLZ_DRIVER_LIBS=""
DLZ_DRIVER_SRCS=""
DLZ_DRIVER_OBJS=""
DLZ_SYSTEM_TEST=""
+#
+# Configure support for building a shared library object
+#
+# Even when libtool is available it can't always be relied upon
+# to build an object that can be dlopen()'ed, but this is necessary
+# for building the dlzexternal system test, so we'll try it the
+# old-fashioned way.
+#
+SO="so"
+SO_CFLAGS=""
+SO_LD=""
+SO_TARGETS=""
+
+AC_ARG_WITH(dlopen,
+ [ --with-dlopen=ARG Support dynamically loadable DLZ drivers],
+ dlopen="$withval", dlopen="yes")
+
+if test "$dlopen" = "yes"; then
+ AC_CHECK_LIB(dl, dlopen, have_dl=yes, have_dl=no)
+ if test "$have_dl" = "yes"; then
+ LIBS="-ldl $LIBS"
+ fi
+ AC_CHECK_FUNCS(dlopen dlclose dlsym,,dlopen=no)
+fi
+
+if test "$dlopen" = "yes"; then
+ case $host in
+ *-linux*)
+ SO_CFLAGS="-fPIC"
+ if test "$have_dl" = "yes"
+ then
+ SO_LD="${CC} -shared"
+ else
+ SO_LD="ld -shared"
+ fi
+ ;;
+ *-freebsd*|*-openbsd*|*-netbsd*)
+ SO_CFLAGS="-fpic"
+ SO_LD="ld -Bshareable -x"
+ ;;
+ *-solaris*)
+ SO_CFLAGS="-KPIC"
+ SO_LD="ld -G -z text"
+ ;;
+ *-hp-hpux*)
+ SO=sl
+ SO_CFLAGS="+z"
+ SO_LD="ld -b"
+ ;;
+ *)
+ SO_CFLAGS="-fPIC"
+ ;;
+ esac
+
+ if test "X$GCC" = "Xyes"; then
+ SO_CFLAGS="-fPIC"
+ test -n "$SO_LD" || SO_LD="${CC} -shared"
+ fi
+
+ # If we still don't know how to make shared objects, don't make any.
+ if test -n "$SO_LD"; then
+ SO_TARGETS="\${SO_TARGETS}"
+ AC_DEFINE(ISC_DLZ_DLOPEN, 1,
+ [Define to allow building of objects for dlopen().])
+ fi
+fi
+
+AC_SUBST(SO)
+AC_SUBST(SO_CFLAGS)
+AC_SUBST(SO_LD)
+AC_SUBST(SO_TARGETS)
+
sinclude(contrib/dlz/config.dlz.in)
+AC_MSG_CHECKING(contributed DLZ drivers)
-AC_MSG_CHECKING(for DLZ)
-
-if test -n "$USE_DLZ"
+if test -n "$CONTRIB_DLZ"
then
AC_MSG_RESULT(yes)
- USE_DLZ="-DDLZ $USE_DLZ"
DLZ_DRIVER_RULES=contrib/dlz/drivers/rules
AC_CONFIG_FILES([$DLZ_DRIVER_RULES])
else
@@ -3140,7 +3278,7 @@ else
DLZ_DRIVER_RULES=/dev/null
fi
-AC_SUBST(USE_DLZ)
+AC_SUBST(CONTRIB_DLZ)
AC_SUBST(DLZ_DRIVER_INCLUDES)
AC_SUBST(DLZ_DRIVER_LIBS)
AC_SUBST(DLZ_DRIVER_SRCS)
@@ -3303,11 +3441,15 @@ AC_CONFIG_FILES([
bin/tests/sockaddr/Makefile
bin/tests/system/Makefile
bin/tests/system/conf.sh
+ bin/tests/system/dlz/prereq.sh
+ bin/tests/system/dlzexternal/Makefile
+ bin/tests/system/dlzexternal/ns1/named.conf
bin/tests/system/filter-aaaa/Makefile
bin/tests/system/gost/prereq.sh
bin/tests/system/lwresd/Makefile
bin/tests/system/rpz/Makefile
bin/tests/system/tkey/Makefile
+ bin/tests/system/tsiggss/Makefile
bin/tests/tasks/Makefile
bin/tests/timers/Makefile
bin/tests/virtual-time/Makefile
@@ -3335,6 +3477,7 @@ AC_CONFIG_FILES([
lib/dns/include/Makefile
lib/dns/include/dns/Makefile
lib/dns/include/dst/Makefile
+ lib/dns/tests/Makefile
lib/export/Makefile
lib/export/dns/Makefile
lib/export/dns/include/Makefile
@@ -3373,6 +3516,7 @@ AC_CONFIG_FILES([
lib/isc/include/Makefile
lib/isc/include/isc/Makefile
lib/isc/include/isc/platform.h
+ lib/isc/tests/Makefile
lib/isc/nls/Makefile
lib/isc/unix/Makefile
lib/isc/unix/include/Makefile
@@ -3395,6 +3539,8 @@ AC_CONFIG_FILES([
lib/tests/Makefile
lib/tests/include/Makefile
lib/tests/include/tests/Makefile
+ unit/Makefile
+ unit/unittest.sh
])
#
diff --git a/contrib/bind9/doc/arm/Bv9ARM-book.xml b/contrib/bind9/doc/arm/Bv9ARM-book.xml
index c3517843175d..b899c8b40596 100644
--- a/contrib/bind9/doc/arm/Bv9ARM-book.xml
+++ b/contrib/bind9/doc/arm/Bv9ARM-book.xml
@@ -18,7 +18,7 @@
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
BIND 9 Administrator Reference Manual
@@ -70,7 +70,7 @@
- This version of the manual corresponds to BIND version 9.7.
+ This version of the manual corresponds to BIND version 9.8.
@@ -1188,11 +1188,11 @@ zone "eng.example.com" {
This command requires that the
- auto-dnssec zone option to be set
- to allow,
- maintain, or
- create, and also requires
- the zone to be configured to allow dynamic DNS.
+ auto-dnssec zone option be set
+ to allow or
+ maintain,
+ and also requires the zone to be configured to
+ allow dynamic DNS.
See for
more details.
@@ -1217,10 +1217,10 @@ zone "eng.example.com" {
This command requires that the
- auto-dnssec zone option to
- be set to maintain or
- create, and also requires
- the zone to be configured to allow dynamic DNS.
+ auto-dnssec zone option
+ be set to maintain,
+ and also requires the zone to be configured to
+ allow dynamic DNS.
See for
more details.
@@ -5791,12 +5791,15 @@ options {
any;.
- Each dns64 supports an optional
- exclude ACL that selects which
- IPv6 addresses will be ignored for the purposes
- of determining whether dns64 is to be applied.
- Any non-matching address will prevent further
- DNS64 processing from occurring for this client.
+ Normally, DNS64 won't apply to a domain name that
+ owns one or more AAAA records; these records will
+ simply be returned. The optional
+ exclude ACL allows specification
+ of a list of IPv6 addresses that will be ignored
+ if they appear in a domain name's AAAA records, and
+ DNS64 will be applied to any A records the domain
+ name owns. If not defined, exclude
+ defaults to none.
A optional suffix can also
@@ -5806,6 +5809,21 @@ options {
matching the prefix and mapped IPv4 address
must be zero.
+
+ If recursive-only is set to
+ yes the DNS64 synthesis will
+ only happen for recursive queries. The default
+ is no.
+
+
+ If break-dnssec is set to
+ yes the DNS64 synthesis will
+ happen even if the result, if validated, would
+ cause a DNSSEC validation failure. If this option
+ is set to no (the default), the DO
+ is set on the incoming query, and there are RRSIGs on
+ the applicable records, then synthesis will not happen.
+
acl rfc1918 { 10/8; 192.168/16; 172.16/12; };
@@ -7570,22 +7588,27 @@ avoid-v6-udp-ports {};
serial-query-rate
-
-
- Slave servers will periodically query master servers
- to find out if zone serial numbers have changed. Each such
- query uses
- a minute amount of the slave server's network bandwidth. To
- limit the
- amount of bandwidth used, BIND 9 limits the rate at which
- queries are
- sent. The value of the serial-query-rate option,
- an integer, is the maximum number of queries sent per
- second.
- The default is 20.
-
-
-
+
+
+ Slave servers will periodically query master
+ servers to find out if zone serial numbers have
+ changed. Each such query uses a minute amount of
+ the slave server's network bandwidth. To limit
+ the amount of bandwidth used, BIND 9 limits the
+ rate at which queries are sent. The value of the
+ serial-query-rate option, an
+ integer, is the maximum number of queries sent
+ per second. The default is 20.
+
+
+ In addition to controlling the rate SOA refresh
+ queries are issued at
+ serial-query-rate also controls
+ the rate at which NOTIFY messages are sent from
+ both master and slave zones.
+
+
+ serial-queries
@@ -8618,7 +8641,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
Sets the advertised EDNS UDP buffer size in bytes
to control the size of packets received.
- Valid values are 1024 to 4096 (values outside this range
+ Valid values are 512 to 4096 (values outside this range
will be silently adjusted). The default value
is 4096. The usual reason for setting
edns-udp-size to a non-default
@@ -8731,6 +8754,10 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
The delay, in seconds, between sending sets of notify
messages for a zone. The default is five (5) seconds.
+
+ The overall rate that NOTIFY messages are sent for all
+ zones is controlled by serial-query-rate.
+
@@ -8839,7 +8866,6 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
The current list of empty zones is:
-
0.IN-ADDR.ARPA127.IN-ADDR.ARPA254.169.IN-ADDR.ARPA
@@ -9986,7 +10011,7 @@ view "external" {
min-retry-time number ; max-retry-time number ; key-directory path_name;
- auto-dnssec allow|maintain|create|off;
+ auto-dnssec allow|maintain|off; zero-no-soa-ttl yes_or_no ;
};
@@ -9998,6 +10023,7 @@ zone zone_nameclass allow-transfer { address_match_list }; allow-update-forwarding { address_match_list }; update-check-ksk yes_or_no;
+ dnssec-update-mode ( maintain | no-resign ); dnssec-dnskey-kskonly yes_or_no; dnssec-secure-to-insecure yes_or_no ; try-tcp-refresh yes_or_no;
@@ -11043,7 +11069,7 @@ example.com. NS ns2.example.net.
Zones configured for dynamic DNS may also use this
option to allow varying levels of automatic DNSSEC key
- management. There are four possible settings:
+ management. There are three possible settings:
auto-dnssec allow; permits
@@ -11067,7 +11093,12 @@ example.com. NS ns2.example.net.
named to load keys from the key
repository and schedule key maintenance events to occur
in the future, but it does not sign the full zone
- immediately.
+ immediately. Note: once keys have been loaded for a
+ zone the first time, the repository will be searched
+ for changes periodically, regardless of whether
+ rndc loadkeys is used. The recheck
+ interval is hard-coded to
+ one hour.
auto-dnssec create; includes the
@@ -11220,7 +11251,13 @@ example.com. NS ns2.example.net.
The identity field must
contain a fully-qualified domain name.
-
+
+ For nametypes krb5-self,
+ ms-self, krb5-subdomain,
+ and ms-subdomain the
+ identity field specifies
+ the Windows or Kerberos realm of the machine belongs to.
+
The nametype field has 13
values:
@@ -11352,6 +11389,70 @@ example.com. NS ns2.example.net.
+
+
+
+ ms-self
+
+
+
+ This rule takes a Windows machine principal
+ (machine$@REALM) for machine in REALM and
+ and converts it machine.realm allowing the machine
+ to update machine.realm. The REALM to be matched
+ is specified in the identity
+ field.
+
+
+
+
+
+
+ ms-subdomain
+
+
+
+ This rule takes a Windows machine principal
+ (machine$@REALM) for machine in REALM and
+ converts it to machine.realm allowing the machine
+ to update subdomains of machine.realm. The REALM
+ to be matched is specified in the
+ identity field.
+
+
+
+
+
+
+ krb5-self
+
+
+
+ This rule takes a Kerberos machine principal
+ (host/machine@REALM) for machine in REALM and
+ and converts it machine.realm allowing the machine
+ to update machine.realm. The REALM to be matched
+ is specified in the identity
+ field.
+
+
+
+
+
+
+ krb5-subdomain
+
+
+
+ This rule takes a Kerberos machine principal
+ (host/machine@REALM) for machine in REALM and
+ converts it to machine.realm allowing the machine
+ to update subdomains of machine.realm. The REALM
+ to be matched is specified in the
+ identity field.
+
+
+
diff --git a/contrib/bind9/doc/arm/Bv9ARM.ch01.html b/contrib/bind9/doc/arm/Bv9ARM.ch01.html
index ff2c5ceec6e4..f0ec1299e5ab 100644
--- a/contrib/bind9/doc/arm/Bv9ARM.ch01.html
+++ b/contrib/bind9/doc/arm/Bv9ARM.ch01.html
@@ -14,7 +14,7 @@
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
@@ -82,7 +82,7 @@
system administrators.
- This version of the manual corresponds to BIND version 9.7.
+ This version of the manual corresponds to BIND version 9.8.
diff --git a/contrib/bind9/doc/arm/Bv9ARM.ch03.html b/contrib/bind9/doc/arm/Bv9ARM.ch03.html
index e01d69ec2992..aaaa96a52b71 100644
--- a/contrib/bind9/doc/arm/Bv9ARM.ch03.html
+++ b/contrib/bind9/doc/arm/Bv9ARM.ch03.html
@@ -14,7 +14,7 @@
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
@@ -54,7 +54,7 @@
This command requires that the
- auto-dnssec zone option to be set
- to allow,
- maintain, or
- create, and also requires
- the zone to be configured to allow dynamic DNS.
+ auto-dnssec zone option be set
+ to allow or
+ maintain,
+ and also requires the zone to be configured to
+ allow dynamic DNS.
See the section called “Dynamic Update Policies” for
more details.
@@ -518,10 +518,10 @@ zone "eng.example.com" {
This command requires that the
- auto-dnssec zone option to
- be set to maintain or
- create, and also requires
- the zone to be configured to allow dynamic DNS.
+ auto-dnssec zone option
+ be set to maintain,
+ and also requires the zone to be configured to
+ allow dynamic DNS.
See the section called “Dynamic Update Policies” for
more details.
@@ -873,7 +873,7 @@ controls {
-Signals
+Signals
Certain UNIX signals cause the name server to take specific
actions, as described in the following table. These signals can
diff --git a/contrib/bind9/doc/arm/Bv9ARM.ch04.html b/contrib/bind9/doc/arm/Bv9ARM.ch04.html
index 77b74cb43ad2..f1d0a6ccf13a 100644
--- a/contrib/bind9/doc/arm/Bv9ARM.ch04.html
+++ b/contrib/bind9/doc/arm/Bv9ARM.ch04.html
@@ -14,7 +14,7 @@
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
Setting up different views, or visibility, of the DNS space to
internal and external resolvers is usually referred to as a
@@ -286,7 +286,7 @@
-Example split DNS setup
+Example split DNS setup
Let's say a company named Example, Inc.
(example.com)
@@ -543,7 +543,7 @@ nameserver 172.16.72.4
-Generate Shared Keys for Each Pair of Hosts
+Generate Shared Keys for Each Pair of Hosts
A shared secret is generated to be shared between host1 and host2.
An arbitrary key name is chosen: "host1-host2.". The key name must
@@ -551,7 +551,7 @@ nameserver 172.16.72.4
-Automatic Generation
+Automatic Generation
The following command will generate a 128-bit (16 byte) HMAC-SHA256
key as described above. Longer keys are better, but shorter keys
@@ -575,7 +575,7 @@ nameserver 172.16.72.4
-Manual Generation
+Manual Generation
The shared secret is simply a random sequence of bits, encoded
in base-64. Most ASCII strings are valid base-64 strings (assuming
@@ -590,7 +590,7 @@ nameserver 172.16.72.4
-Copying the Shared Secret to Both Machines
+Copying the Shared Secret to Both Machines
This is beyond the scope of DNS. A secure transport mechanism
should be used. This could be secure FTP, ssh, telephone, etc.
@@ -598,7 +598,7 @@ nameserver 172.16.72.4
-Informing the Servers of the Key's Existence
+Informing the Servers of the Key's Existence
Imagine host1 and host 2
are
@@ -625,7 +625,7 @@ key host1-host2. {
-Instructing the Server to Use the Key
+Instructing the Server to Use the Key
Since keys are shared between two hosts only, the server must
be told when keys are to be used. The following is added to the named.conf file
@@ -657,7 +657,7 @@ server 10.1.2.3 {
-TSIG Key Based Access Control
+TSIG Key Based Access Control
BIND allows IP addresses and ranges
to be specified in ACL
@@ -684,7 +684,7 @@ allow-update { key host1-host2. ;};
-Errors
+Errors
The processing of TSIG signed messages can result in
several errors. If a signed message is sent to a non-TSIG aware
@@ -710,7 +710,7 @@ allow-update { key host1-host2. ;};
-TKEY
+TKEY
TKEY
is a mechanism for automatically generating a shared secret
between two hosts. There are several "modes" of
@@ -746,7 +746,7 @@ allow-update { key host1-host2. ;};
-SIG(0)
+SIG(0)
BIND 9 partially supports DNSSEC SIG(0)
transaction signatures as specified in RFC 2535 and RFC 2931.
@@ -807,7 +807,7 @@ allow-update { key host1-host2. ;};
-Generating Keys
+Generating Keys
The dnssec-keygen program is used to
generate keys.
@@ -863,7 +863,7 @@ allow-update { key host1-host2. ;};
-Signing the Zone
+Signing the Zone
The dnssec-signzone program is used
to sign a zone.
@@ -905,7 +905,7 @@ allow-update { key host1-host2. ;};
-Configuring Servers
+Configuring Servers
To enable named to respond appropriately
to DNS requests from DNSSEC aware clients,
@@ -1065,7 +1065,7 @@ options {
from insecure to signed and back again. A secure zone can use
either NSEC or NSEC3 chains.
-Converting from insecure to secure
+Converting from insecure to secure
Changing a zone from insecure to secure can be done in two
ways: using a dynamic DNS update, or the
auto-dnssec zone option.
@@ -1091,7 +1091,7 @@ options {
well. An NSEC chain will be generated as part of the initial
signing process.
-Dynamic DNS update method
+Dynamic DNS update method
To insert the keys via dynamic update:
% nsupdate
@@ -1127,7 +1127,7 @@ options {
While the initial signing and NSEC/NSEC3 chain generation
is happening, other updates are possible as well.
-Fully automatic zone signing
+Fully automatic zone signing
To enable automatic signing, add the
auto-dnssec option to the zone statement in
named.conf.
@@ -1162,7 +1162,7 @@ options {
configuration. If this has not been done, the configuration will
fail.
-Private-type records
+Private-type records
The state of the signing process is signaled by
private-type records (with a default type value of 65534). When
signing is complete, these records will have a nonzero value for
@@ -1203,12 +1203,12 @@ options {
-DNSKEY rollovers
+DNSKEY rollovers
As with insecure-to-secure conversions, rolling DNSSEC
keys can be done in two ways: using a dynamic DNS update, or the
auto-dnssec zone option.
-Dynamic DNS update method
+Dynamic DNS update method
To perform key rollovers via dynamic update, you need to add
the K* files for the new keys so that
named can find them. You can then add the new
@@ -1230,7 +1230,7 @@ options {
named will clean out any signatures generated
by the old key after the update completes.
-Automatic key rollovers
+Automatic key rollovers
When a new key reaches its activation date (as set by
dnssec-keygen or dnssec-settime),
if the auto-dnssec zone option is set to
@@ -1245,27 +1245,27 @@ options {
completes in 30 days, after which it will be safe to remove the
old key from the DNSKEY RRset.
-NSEC3PARAM rollovers via UPDATE
+NSEC3PARAM rollovers via UPDATE
Add the new NSEC3PARAM record via dynamic update. When the
new NSEC3 chain has been generated, the NSEC3PARAM flag field
will be zero. At this point you can remove the old NSEC3PARAM
record. The old chain will be removed after the update request
completes.
-Converting from NSEC to NSEC3
+Converting from NSEC to NSEC3
To do this, you just need to add an NSEC3PARAM record. When
the conversion is complete, the NSEC chain will have been removed
and the NSEC3PARAM record will have a zero flag field. The NSEC3
chain will be generated before the NSEC chain is
destroyed.
-Converting from NSEC3 to NSEC
+Converting from NSEC3 to NSEC
To do this, use nsupdate to
remove all NSEC3PARAM records with a zero flag
field. The NSEC chain will be generated before the NSEC3 chain is
removed.
-Converting from secure to insecure
+Converting from secure to insecure
To convert a signed zone to unsigned using dynamic DNS,
delete all the DNSKEY records from the zone apex using
nsupdate. All signatures, NSEC or NSEC3 chains,
@@ -1280,14 +1280,14 @@ options {
allow instead (or it will re-sign).
-Periodic re-signing
+Periodic re-signing
In any secure zone which supports dynamic updates, named
will periodically re-sign RRsets which have not been re-signed as
a result of some update action. The signature lifetimes will be
adjusted so as to spread the re-sign load over time rather than
all at once.
-NSEC3 and OPTOUT
+NSEC3 and OPTOUT
named only supports creating new NSEC3 chains
where all the NSEC3 records in the zone have the same OPTOUT
@@ -1309,7 +1309,7 @@ options {
configuration files.
-Validating Resolver
+Validating Resolver
To configure a validating resolver to use RFC 5011 to
maintain a trust anchor, configure the trust anchor using a
managed-keys statement. Information about
@@ -1320,7 +1320,7 @@ options {
-Authoritative Server
+Authoritative Server
To set up an authoritative zone for RFC 5011 trust anchor
maintenance, generate two (or more) key signing keys (KSKs) for
the zone. Sign the zone with one of them; this is the "active"
@@ -1394,7 +1394,7 @@ $ dnssec-signzone -S -K keys example.net<
Debian Linux, Solaris x86 and Windows Server 2003.
-Prerequisites
+Prerequisites
See the HSM vendor documentation for information about
installing, initializing, testing and troubleshooting the
HSM.
@@ -1468,7 +1468,7 @@ $ patch -p1 -d openssl-0.9.8l \
when we configure BIND 9.
-Building OpenSSL for the AEP Keyper on Linux
+Building OpenSSL for the AEP Keyper on Linux
The AEP Keyper is a highly secure key storage device,
but does not provide hardware cryptographic acceleration. It
can carry out cryptographic operations, but it is probably
@@ -1500,7 +1500,7 @@ $ ./Configure linux-generic32 -m32 -pthread \
-Building OpenSSL for the SCA 6000 on Solaris
+Building OpenSSL for the SCA 6000 on Solaris
The SCA-6000 PKCS #11 provider is installed as a system
library, libpkcs11. It is a true crypto accelerator, up to 4
times faster than any CPU, so the flavor shall be
@@ -1544,12 +1544,12 @@ $ ./Configure solaris64-x86_64-cc \
-Building BIND 9 with PKCS#11
+Building BIND 9 with PKCS#11
When building BIND 9, the location of the custom-built
OpenSSL library must be specified via configure.
-Configuring BIND 9 for Linux
+Configuring BIND 9 for Linux
To link with the PKCS #11 provider, threads must be
enabled in the BIND 9 build.
The PKCS #11 library for the AEP Keyper is currently
@@ -1565,7 +1565,7 @@ $ ./configure CC="gcc -m32" --enable-threads \
-Configuring BIND 9 for Solaris
+Configuring BIND 9 for Solaris
To link with the PKCS #11 provider, threads must be
enabled in the BIND 9 build.
BIND 9 includes a minimal set of tools to operate the
HSM, including
pkcs11-keygen to generate a new key pair
@@ -1606,7 +1606,7 @@ $ ./configure CC="cc -xarch=amd64" --enable-thre
-Using the HSM
+Using the HSM
First, we must set up the runtime environment so the
OpenSSL and PKCS #11 libraries can be loaded:
@@ -1694,7 +1694,7 @@ example.net.signed
-Specifying the engine on the command line
+Specifying the engine on the command line
The OpenSSL engine can be specified in
named and all of the BIND
dnssec-* tools by using the "-E
@@ -1715,7 +1715,7 @@ $ dnssec-signzone -E '' -S example.net
-Running named with automatic zone re-signing
+Running named with automatic zone re-signing
If you want
named to dynamically re-sign zones using HSM
keys, and/or to to sign new records inserted via nsupdate, then
@@ -1751,7 +1751,7 @@ $ dnssec-signzone -E '' -S example.net
-IPv6 Support in BIND 9
+IPv6 Support in BIND 9
BIND 9 fully supports all currently
defined forms of IPv6 name to address and address to name
@@ -1789,7 +1789,7 @@ $ dnssec-signzone -E '' -S example.net
-Address Lookups Using AAAA Records
+Address Lookups Using AAAA Records
The IPv6 AAAA record is a parallel to the IPv4 A record,
and, unlike the deprecated A6 record, specifies the entire
@@ -1808,7 +1808,7 @@ host 3600 IN AAAA 2001:db8::1
-Address to Name Lookups Using Nibble Format
+Address to Name Lookups Using Nibble Format
When looking up an address in nibble format, the address
components are simply reversed, just as in IPv4, and
diff --git a/contrib/bind9/doc/arm/Bv9ARM.ch05.html b/contrib/bind9/doc/arm/Bv9ARM.ch05.html
index 3b60755fe0f9..99e2a9db6617 100644
--- a/contrib/bind9/doc/arm/Bv9ARM.ch05.html
+++ b/contrib/bind9/doc/arm/Bv9ARM.ch05.html
@@ -14,7 +14,7 @@
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
Traditionally applications have been linked with a stub resolver
library that sends recursive DNS queries to a local caching name
diff --git a/contrib/bind9/doc/arm/Bv9ARM.ch06.html b/contrib/bind9/doc/arm/Bv9ARM.ch06.html
index 35243484d128..24338616ed00 100644
--- a/contrib/bind9/doc/arm/Bv9ARM.ch06.html
+++ b/contrib/bind9/doc/arm/Bv9ARM.ch06.html
@@ -14,7 +14,7 @@
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
-masters Statement Definition and
+masters Statement Definition and
Usage
masters
lists allow for a common set of masters to be easily used by
@@ -2065,7 +2065,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
-options Statement Grammar
+options Statement Grammar
This is the grammar of the options
statement in the named.conf file:
@@ -2737,12 +2737,15 @@ options {
any;.
- Each dns64 supports an optional
- exclude ACL that selects which
- IPv6 addresses will be ignored for the purposes
- of determining whether dns64 is to be applied.
- Any non-matching address will prevent further
- DNS64 processing from occurring for this client.
+ Normally, DNS64 won't apply to a domain name that
+ owns one or more AAAA records; these records will
+ simply be returned. The optional
+ exclude ACL allows specification
+ of a list of IPv6 addresses that will be ignored
+ if they appear in a domain name's AAAA records, and
+ DNS64 will be applied to any A records the domain
+ name owns. If not defined, exclude
+ defaults to none.
A optional suffix can also
@@ -2752,6 +2755,21 @@ options {
matching the prefix and mapped IPv4 address
must be zero.
+
+ If recursive-only is set to
+ yes the DNS64 synthesis will
+ only happen for recursive queries. The default
+ is no.
+
+
+ If break-dnssec is set to
+ yes the DNS64 synthesis will
+ happen even if the result, if validated, would
+ cause a DNSSEC validation failure. If this option
+ is set to no (the default), the DO
+ is set on the incoming query, and there are RRSIGs on
+ the applicable records, then synthesis will not happen.
+
The forwarding facility can be used to create a large site-wide
cache on a few servers, reducing traffic over links to external
@@ -3675,7 +3693,7 @@ options {
-Dual-stack Servers
+Dual-stack Servers
Dual-stack servers are used as servers of last resort to work
around
@@ -3886,7 +3904,7 @@ options {
-Interfaces
+Interfaces
The interfaces and ports that the server will answer queries
from may be specified using the listen-on option. listen-on takes
@@ -4160,19 +4178,26 @@ avoid-v6-udp-ports {};
hour). The maximum value is 28 days (40320 minutes).
serial-query-rate
-
- Slave servers will periodically query master servers
- to find out if zone serial numbers have changed. Each such
- query uses
- a minute amount of the slave server's network bandwidth. To
- limit the
- amount of bandwidth used, BIND 9 limits the rate at which
- queries are
- sent. The value of the serial-query-rate option,
- an integer, is the maximum number of queries sent per
- second.
- The default is 20.
-
+
+
+ Slave servers will periodically query master
+ servers to find out if zone serial numbers have
+ changed. Each such query uses a minute amount of
+ the slave server's network bandwidth. To limit
+ the amount of bandwidth used, BIND 9 limits the
+ rate at which queries are sent. The value of the
+ serial-query-rate option, an
+ integer, is the maximum number of queries sent
+ per second. The default is 20.
+
+
+ In addition to controlling the rate SOA refresh
+ queries are issued at
+ serial-query-rate also controls
+ the rate at which NOTIFY messages are sent from
+ both master and slave zones.
+
+
serial-queries
In BIND 8, the serial-queries
@@ -4338,7 +4363,7 @@ avoid-v6-udp-ports {};
The server's usage of many system resources can be limited.
Scaled values are allowed when specifying resource limits. For
@@ -4542,7 +4567,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
Sets the advertised EDNS UDP buffer size in bytes
to control the size of packets received.
- Valid values are 1024 to 4096 (values outside this range
+ Valid values are 512 to 4096 (values outside this range
will be silently adjusted). The default value
is 4096. The usual reason for setting
edns-udp-size to a non-default
@@ -5102,10 +5127,16 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
notify-delay
-
+
+
The delay, in seconds, between sending sets of notify
messages for a zone. The default is five (5) seconds.
-
+
+
+ The overall rate that NOTIFY messages are sent for all
+ zones is controlled by serial-query-rate.
+
+
@@ -5193,6 +5224,24 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
The current list of empty zones is:
BIND 9 provides the ability to filter
out DNS responses from external DNS servers containing
@@ -5480,7 +5529,7 @@ deny-answer-aliases { "example.net"; };
-Response Policy Zone (RPZ) Rewriting
+Response Policy Zone (RPZ) Rewriting
BIND 9 includes an intentionally limited
mechanism to modify DNS responses for recursive requests
@@ -5818,7 +5867,7 @@ ns.domain.com.rpz-nsdname CNAME .
-statistics-channels Statement Definition and
+statistics-channels Statement Definition and
Usage
The statistics-channels statement
@@ -5878,7 +5927,7 @@ ns.domain.com.rpz-nsdname CNAME .
-trusted-keys Statement Definition
+trusted-keys Statement Definition
and Usage
Zones configured for dynamic DNS may also use this
option to allow varying levels of automatic DNSSEC key
- management. There are four possible settings:
+ management. There are three possible settings:
auto-dnssec allow; permits
@@ -7049,7 +7099,12 @@ example.com. NS ns2.example.net.
named to load keys from the key
repository and schedule key maintenance events to occur
in the future, but it does not sign the full zone
- immediately.
+ immediately. Note: once keys have been loaded for a
+ zone the first time, the repository will be searched
+ for changes periodically, regardless of whether
+ rndc loadkeys is used. The recheck
+ interval is hard-coded to
+ one hour.
auto-dnssec create; includes the
@@ -7180,6 +7235,13 @@ example.com. NS ns2.example.net.
The identity field must
contain a fully-qualified domain name.
+
+ For nametypes krb5-self,
+ ms-self, krb5-subdomain,
+ and ms-subdomain the
+ identity field specifies
+ the Windows or Kerberos realm of the machine belongs to.
+
The nametype field has 13
values:
@@ -7319,6 +7381,74 @@ example.com. NS ns2.example.net.
+
+
+ ms-self
+
+
+
+
+ This rule takes a Windows machine principal
+ (machine$@REALM) for machine in REALM and
+ and converts it machine.realm allowing the machine
+ to update machine.realm. The REALM to be matched
+ is specified in the <replacable>identity</replacable>
+ field.
+
+
+
+
+
+
+ ms-subdomain
+
+
+
+
+ This rule takes a Windows machine principal
+ (machine$@REALM) for machine in REALM and
+ converts it to machine.realm allowing the machine
+ to update subdomains of machine.realm. The REALM
+ to be matched is specified in the
+ <replacable>identity</replacable> field.
+
+
+
+
+
+
+ krb5-self
+
+
+
+
+ This rule takes a Kerberos machine principal
+ (host/machine@REALM) for machine in REALM and
+ and converts it machine.realm allowing the machine
+ to update machine.realm. The REALM to be matched
+ is specified in the <replacable>identity</replacable>
+ field.
+
+
+
+
+
+
+ krb5-subdomain
+
+
+
+
+ This rule takes a Kerberos machine principal
+ (host/machine@REALM) for machine in REALM and
+ converts it to machine.realm allowing the machine
+ to update subdomains of machine.realm. The REALM
+ to be matched is specified in the
+ <replacable>identity</replacable> field.
+
A domain name identifies a node. Each node has a set of
resource information, which may be empty. The set of resource
@@ -8173,7 +8303,7 @@ example.com. NS ns2.example.net.
-Textual expression of RRs
+Textual expression of RRs
RRs are represented in binary form in the packets of the DNS
protocol, and are usually represented in highly encoded form
@@ -8376,7 +8506,7 @@ example.com. NS ns2.example.net.
-Discussion of MX Records
+Discussion of MX Records
As described above, domain servers store information as a
series of resource records, each of which contains a particular
@@ -8632,7 +8762,7 @@ example.com. NS ns2.example.net.
-Inverse Mapping in IPv4
+Inverse Mapping in IPv4
Reverse name resolution (that is, translation from IP address
to name) is achieved by means of the in-addr.arpa domain
@@ -8693,7 +8823,7 @@ example.com. NS ns2.example.net.
-Other Zone File Directives
+Other Zone File Directives
The Master File Format was initially defined in RFC 1035 and
has subsequently been extended. While the Master File Format
@@ -8708,7 +8838,7 @@ example.com. NS ns2.example.net.
-The @ (at-sign)
+The @ (at-sign)
When used in the label (or name) field, the asperand or
at-sign (@) symbol represents the current origin.
@@ -8719,7 +8849,7 @@ example.com. NS ns2.example.net.
Socket I/O statistics counters are defined per socket
types, which are
@@ -10476,7 +10606,7 @@ HOST-127.EXAMPLE. MX 0 .
-Compatibility with BIND 8 Counters
+Compatibility with BIND 8 Counters
Most statistics counters that were available
in BIND 8 are also supported in
diff --git a/contrib/bind9/doc/arm/Bv9ARM.ch07.html b/contrib/bind9/doc/arm/Bv9ARM.ch07.html
index 371f4a94eca5..f2c50e286562 100644
--- a/contrib/bind9/doc/arm/Bv9ARM.ch07.html
+++ b/contrib/bind9/doc/arm/Bv9ARM.ch07.html
@@ -14,7 +14,7 @@
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
On UNIX servers, it is possible to run BIND
@@ -148,7 +148,7 @@ zone "example.com" {
-The chroot Environment
+The chroot Environment
In order for a chroot environment
to
@@ -176,7 +176,7 @@ zone "example.com" {
-Using the setuid Function
+Using the setuid Function
Prior to running the named daemon,
use
diff --git a/contrib/bind9/doc/arm/Bv9ARM.ch08.html b/contrib/bind9/doc/arm/Bv9ARM.ch08.html
index 0681e47ce1e5..faa3a0434c0b 100644
--- a/contrib/bind9/doc/arm/Bv9ARM.ch08.html
+++ b/contrib/bind9/doc/arm/Bv9ARM.ch08.html
@@ -14,7 +14,7 @@
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
-It's not working; how can I figure out what's wrong?
+It's not working; how can I figure out what's wrong?
The best solution to solving installation and
configuration issues is to take preventative measures by setting
@@ -68,7 +68,7 @@
-Incrementing and Changing the Serial Number
+Incrementing and Changing the Serial Number
Zone serial numbers are just numbers — they aren't
date related. A lot of people set them to a number that
@@ -95,7 +95,7 @@
-Where Can I Get Help?
+Where Can I Get Help?
The Internet Systems Consortium
(ISC) offers a wide range
diff --git a/contrib/bind9/doc/arm/Bv9ARM.ch09.html b/contrib/bind9/doc/arm/Bv9ARM.ch09.html
index fd532377bad5..cda5f6c30d3a 100644
--- a/contrib/bind9/doc/arm/Bv9ARM.ch09.html
+++ b/contrib/bind9/doc/arm/Bv9ARM.ch09.html
@@ -14,7 +14,7 @@
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
A Brief History of the DNS and BIND
@@ -172,7 +172,7 @@
-General DNS Reference Information
+General DNS Reference Information
IPv6 addresses (AAAA)
@@ -260,17 +260,17 @@
-Bibliography
+Bibliography
Standards
-
[RFC974] C.Partridge. Mail Routing and the Domain System. January 1986.
+
[RFC974] C.Partridge. Mail Routing and the Domain System. January 1986.
-
[RFC1034] P.V.Mockapetris. Domain Names — Concepts and Facilities. November 1987.
+
[RFC1034] P.V.Mockapetris. Domain Names — Concepts and Facilities. November 1987.
-
[RFC1035] P. V.Mockapetris. Domain Names — Implementation and
+
[RFC1035] P. V.Mockapetris. Domain Names — Implementation and
Specification. November 1987.
@@ -278,42 +278,42 @@
Proposed Standards
-
[RFC2181] R., R. BushElz. Clarifications to the DNS
+
[RFC2181] R., R. BushElz. Clarifications to the DNS
Specification. July 1997.
-
[RFC2308] M.Andrews. Negative Caching of DNS
+
[RFC2308] M.Andrews. Negative Caching of DNS
Queries. March 1998.
-
[RFC1995] M.Ohta. Incremental Zone Transfer in DNS. August 1996.
+
[RFC1995] M.Ohta. Incremental Zone Transfer in DNS. August 1996.
-
[RFC1996] P.Vixie. A Mechanism for Prompt Notification of Zone Changes. August 1996.
+
[RFC1996] P.Vixie. A Mechanism for Prompt Notification of Zone Changes. August 1996.
-
[RFC2136] P.Vixie, S.Thomson, Y.Rekhter, and J.Bound. Dynamic Updates in the Domain Name System. April 1997.
+
[RFC2136] P.Vixie, S.Thomson, Y.Rekhter, and J.Bound. Dynamic Updates in the Domain Name System. April 1997.
-
[RFC2671] P.Vixie. Extension Mechanisms for DNS (EDNS0). August 1997.
+
[RFC2671] P.Vixie. Extension Mechanisms for DNS (EDNS0). August 1997.
-
[RFC2672] M.Crawford. Non-Terminal DNS Name Redirection. August 1999.
+
[RFC2672] M.Crawford. Non-Terminal DNS Name Redirection. August 1999.
-
[RFC2845] P.Vixie, O.Gudmundsson, D.Eastlake, 3rd, and B.Wellington. Secret Key Transaction Authentication for DNS (TSIG). May 2000.
+
[RFC2845] P.Vixie, O.Gudmundsson, D.Eastlake, 3rd, and B.Wellington. Secret Key Transaction Authentication for DNS (TSIG). May 2000.
-
[RFC2930] D.Eastlake, 3rd. Secret Key Establishment for DNS (TKEY RR). September 2000.
+
[RFC2930] D.Eastlake, 3rd. Secret Key Establishment for DNS (TKEY RR). September 2000.
-
[RFC2931] D.Eastlake, 3rd. DNS Request and Transaction Signatures (SIG(0)s). September 2000.
+
[RFC2931] D.Eastlake, 3rd. DNS Request and Transaction Signatures (SIG(0)s). September 2000.
-
[RFC3007] B.Wellington. Secure Domain Name System (DNS) Dynamic Update. November 2000.
+
[RFC3007] B.Wellington. Secure Domain Name System (DNS) Dynamic Update. November 2000.
-
[RFC3645] S.Kwan, P.Garg, J.Gilroy, L.Esibov, J.Westhead, and R.Hall. Generic Security Service Algorithm for Secret
+
[RFC3645] S.Kwan, P.Garg, J.Gilroy, L.Esibov, J.Westhead, and R.Hall. Generic Security Service Algorithm for Secret
Key Transaction Authentication for DNS
(GSS-TSIG). October 2003.
@@ -322,19 +322,19 @@
DNS Security Proposed Standards
-
[RFC3225] D.Conrad. Indicating Resolver Support of DNSSEC. December 2001.
+
[RFC3225] D.Conrad. Indicating Resolver Support of DNSSEC. December 2001.
-
[RFC3833] D.Atkins and R.Austein. Threat Analysis of the Domain Name System (DNS). August 2004.
+
[RFC3833] D.Atkins and R.Austein. Threat Analysis of the Domain Name System (DNS). August 2004.
-
[RFC4033] R.Arends, R.Austein, M.Larson, D.Massey, and S.Rose. DNS Security Introduction and Requirements. March 2005.
+
[RFC4033] R.Arends, R.Austein, M.Larson, D.Massey, and S.Rose. DNS Security Introduction and Requirements. March 2005.
-
[RFC4034] R.Arends, R.Austein, M.Larson, D.Massey, and S.Rose. Resource Records for the DNS Security Extensions. March 2005.
+
[RFC4034] R.Arends, R.Austein, M.Larson, D.Massey, and S.Rose. Resource Records for the DNS Security Extensions. March 2005.
-
[RFC4035] R.Arends, R.Austein, M.Larson, D.Massey, and S.Rose. Protocol Modifications for the DNS
+
[RFC4035] R.Arends, R.Austein, M.Larson, D.Massey, and S.Rose. Protocol Modifications for the DNS
Security Extensions. March 2005.
@@ -342,146 +342,146 @@
Other Important RFCs About DNS
Implementation
-
[RFC1535] E.Gavron. A Security Problem and Proposed Correction With Widely
+
[RFC1535] E.Gavron. A Security Problem and Proposed Correction With Widely
Deployed DNS Software.. October 1993.
-
[RFC1536] A.Kumar, J.Postel, C.Neuman, P.Danzig, and S.Miller. Common DNS Implementation
+
[RFC1536] A.Kumar, J.Postel, C.Neuman, P.Danzig, and S.Miller. Common DNS Implementation
Errors and Suggested Fixes. October 1993.
-
[RFC1982] R.Elz and R.Bush. Serial Number Arithmetic. August 1996.
+
[RFC1982] R.Elz and R.Bush. Serial Number Arithmetic. August 1996.
-
[RFC4074] Y.Morishita and T.Jinmei. Common Misbehaviour Against DNS
+
[RFC4074] Y.Morishita and T.Jinmei. Common Misbehaviour Against DNS
Queries for IPv6 Addresses. May 2005.
Resource Record Types
-
[RFC1183] C.F.Everhart, L. A.Mamakos, R.Ullmann, and P.Mockapetris. New DNS RR Definitions. October 1990.
+
[RFC1183] C.F.Everhart, L. A.Mamakos, R.Ullmann, and P.Mockapetris. New DNS RR Definitions. October 1990.
-
[RFC1706] B.Manning and R.Colella. DNS NSAP Resource Records. October 1994.
+
[RFC1706] B.Manning and R.Colella. DNS NSAP Resource Records. October 1994.
-
[RFC2168] R.Daniel and M.Mealling. Resolution of Uniform Resource Identifiers using
+
[RFC2168] R.Daniel and M.Mealling. Resolution of Uniform Resource Identifiers using
the Domain Name System. June 1997.
-
[RFC1876] C.Davis, P.Vixie, T., and I.Dickinson. A Means for Expressing Location Information in the
+
[RFC1876] C.Davis, P.Vixie, T., and I.Dickinson. A Means for Expressing Location Information in the
Domain
Name System. January 1996.
-
[RFC2052] A.Gulbrandsen and P.Vixie. A DNS RR for Specifying the
+
[RFC2052] A.Gulbrandsen and P.Vixie. A DNS RR for Specifying the
Location of
Services.. October 1996.
-
[RFC2163] A.Allocchio. Using the Internet DNS to
+
[RFC2163] A.Allocchio. Using the Internet DNS to
Distribute MIXER
Conformant Global Address Mapping. January 1998.
-
[RFC2230] R.Atkinson. Key Exchange Delegation Record for the DNS. October 1997.
+
[RFC2230] R.Atkinson. Key Exchange Delegation Record for the DNS. October 1997.
-
[RFC2536] D.Eastlake, 3rd. DSA KEYs and SIGs in the Domain Name System (DNS). March 1999.
+
[RFC2536] D.Eastlake, 3rd. DSA KEYs and SIGs in the Domain Name System (DNS). March 1999.
-
[RFC2537] D.Eastlake, 3rd. RSA/MD5 KEYs and SIGs in the Domain Name System (DNS). March 1999.
+
[RFC2537] D.Eastlake, 3rd. RSA/MD5 KEYs and SIGs in the Domain Name System (DNS). March 1999.
-
[RFC2538] D.Eastlake, 3rd and O.Gudmundsson. Storing Certificates in the Domain Name System (DNS). March 1999.
+
[RFC2538] D.Eastlake, 3rd and O.Gudmundsson. Storing Certificates in the Domain Name System (DNS). March 1999.
-
[RFC2539] D.Eastlake, 3rd. Storage of Diffie-Hellman Keys in the Domain Name System (DNS). March 1999.
+
[RFC2539] D.Eastlake, 3rd. Storage of Diffie-Hellman Keys in the Domain Name System (DNS). March 1999.
-
[RFC2540] D.Eastlake, 3rd. Detached Domain Name System (DNS) Information. March 1999.
+
[RFC2540] D.Eastlake, 3rd. Detached Domain Name System (DNS) Information. March 1999.
-
[RFC2782] A.Gulbrandsen. P.Vixie. L.Esibov. A DNS RR for specifying the location of services (DNS SRV). February 2000.
+
[RFC2782] A.Gulbrandsen. P.Vixie. L.Esibov. A DNS RR for specifying the location of services (DNS SRV). February 2000.
-
[RFC2915] M.Mealling. R.Daniel. The Naming Authority Pointer (NAPTR) DNS Resource Record. September 2000.
+
[RFC2915] M.Mealling. R.Daniel. The Naming Authority Pointer (NAPTR) DNS Resource Record. September 2000.
-
[RFC3110] D.Eastlake, 3rd. RSA/SHA-1 SIGs and RSA KEYs in the Domain Name System (DNS). May 2001.
+
[RFC3110] D.Eastlake, 3rd. RSA/SHA-1 SIGs and RSA KEYs in the Domain Name System (DNS). May 2001.
-
[RFC3123] P.Koch. A DNS RR Type for Lists of Address Prefixes (APL RR). June 2001.
+
[RFC3123] P.Koch. A DNS RR Type for Lists of Address Prefixes (APL RR). June 2001.
-
[RFC3596] S.Thomson, C.Huitema, V.Ksinant, and M.Souissi. DNS Extensions to support IP
+
[RFC3596] S.Thomson, C.Huitema, V.Ksinant, and M.Souissi. DNS Extensions to support IP
version 6. October 2003.
-
[RFC3597] A.Gustafsson. Handling of Unknown DNS Resource Record (RR) Types. September 2003.
+
[RFC3597] A.Gustafsson. Handling of Unknown DNS Resource Record (RR) Types. September 2003.
DNS and the Internet
-
[RFC1101] P. V.Mockapetris. DNS Encoding of Network Names
+
[RFC1101] P. V.Mockapetris. DNS Encoding of Network Names
and Other Types. April 1989.
-
[RFC1123] Braden. Requirements for Internet Hosts - Application and
+
[RFC1123] Braden. Requirements for Internet Hosts - Application and
Support. October 1989.
-
[RFC1591] J.Postel. Domain Name System Structure and Delegation. March 1994.
+
[RFC1591] J.Postel. Domain Name System Structure and Delegation. March 1994.
-
[RFC2317] H.Eidnes, G.de Groot, and P.Vixie. Classless IN-ADDR.ARPA Delegation. March 1998.
+
[RFC2317] H.Eidnes, G.de Groot, and P.Vixie. Classless IN-ADDR.ARPA Delegation. March 1998.
-
[RFC2826] Internet Architecture Board. IAB Technical Comment on the Unique DNS Root. May 2000.
+
[RFC2826] Internet Architecture Board. IAB Technical Comment on the Unique DNS Root. May 2000.
-
[RFC2929] D.Eastlake, 3rd, E.Brunner-Williams, and B.Manning. Domain Name System (DNS) IANA Considerations. September 2000.
+
[RFC2929] D.Eastlake, 3rd, E.Brunner-Williams, and B.Manning. Domain Name System (DNS) IANA Considerations. September 2000.
DNS Operations
-
[RFC1033] M.Lottor. Domain administrators operations guide.. November 1987.
+
[RFC1033] M.Lottor. Domain administrators operations guide.. November 1987.
-
[RFC1537] P.Beertema. Common DNS Data File
+
[RFC1537] P.Beertema. Common DNS Data File
Configuration Errors. October 1993.
-
[RFC1912] D.Barr. Common DNS Operational and
+
[RFC1912] D.Barr. Common DNS Operational and
Configuration Errors. February 1996.
-
[RFC2010] B.Manning and P.Vixie. Operational Criteria for Root Name Servers.. October 1996.
+
[RFC2010] B.Manning and P.Vixie. Operational Criteria for Root Name Servers.. October 1996.
-
[RFC2219] M.Hamilton and R.Wright. Use of DNS Aliases for
+
[RFC2219] M.Hamilton and R.Wright. Use of DNS Aliases for
Network Services.. October 1997.
Internationalized Domain Names
-
[RFC2825] IAB and R.Daigle. A Tangled Web: Issues of I18N, Domain Names,
+
[RFC2825] IAB and R.Daigle. A Tangled Web: Issues of I18N, Domain Names,
and the Other Internet protocols. May 2000.
-
[RFC3490] P.Faltstrom, P.Hoffman, and A.Costello. Internationalizing Domain Names in Applications (IDNA). March 2003.
+
[RFC3490] P.Faltstrom, P.Hoffman, and A.Costello. Internationalizing Domain Names in Applications (IDNA). March 2003.
-
[RFC3491] P.Hoffman and M.Blanchet. Nameprep: A Stringprep Profile for Internationalized Domain Names. March 2003.
+
[RFC3491] P.Hoffman and M.Blanchet. Nameprep: A Stringprep Profile for Internationalized Domain Names. March 2003.
-
[RFC3492] A.Costello. Punycode: A Bootstring encoding of Unicode
+
[RFC3492] A.Costello. Punycode: A Bootstring encoding of Unicode
for Internationalized Domain Names in
Applications (IDNA). March 2003.
@@ -497,47 +497,47 @@
-
[RFC1464] R.Rosenbaum. Using the Domain Name System To Store Arbitrary String
+
[RFC1464] R.Rosenbaum. Using the Domain Name System To Store Arbitrary String
Attributes. May 1993.
-
[RFC1713] A.Romao. Tools for DNS Debugging. November 1994.
+
[RFC1713] A.Romao. Tools for DNS Debugging. November 1994.
-
[RFC1794] T.Brisco. DNS Support for Load
+
[RFC1794] T.Brisco. DNS Support for Load
Balancing. April 1995.
-
[RFC2240] O.Vaughan. A Legal Basis for Domain Name Allocation. November 1997.
+
[RFC2240] O.Vaughan. A Legal Basis for Domain Name Allocation. November 1997.
-
[RFC2345] J.Klensin, T.Wolf, and G.Oglesby. Domain Names and Company Name Retrieval. May 1998.
+
[RFC2345] J.Klensin, T.Wolf, and G.Oglesby. Domain Names and Company Name Retrieval. May 1998.
-
[RFC2352] O.Vaughan. A Convention For Using Legal Names as Domain Names. May 1998.
+
[RFC2352] O.Vaughan. A Convention For Using Legal Names as Domain Names. May 1998.
-
[RFC3071] J.Klensin. Reflections on the DNS, RFC 1591, and Categories of Domains. February 2001.
+
[RFC3071] J.Klensin. Reflections on the DNS, RFC 1591, and Categories of Domains. February 2001.
-
[RFC3258] T.Hardie. Distributing Authoritative Name Servers via
+
[RFC3258] T.Hardie. Distributing Authoritative Name Servers via
Shared Unicast Addresses. April 2002.
-
[RFC3901] A.Durand and J.Ihren. DNS IPv6 Transport Operational Guidelines. September 2004.
+
[RFC3901] A.Durand and J.Ihren. DNS IPv6 Transport Operational Guidelines. September 2004.
Obsolete and Unimplemented Experimental RFC
-
[RFC1712] C.Farrell, M.Schulze, S.Pleitner, and D.Baldoni. DNS Encoding of Geographical
+
[RFC1712] C.Farrell, M.Schulze, S.Pleitner, and D.Baldoni. DNS Encoding of Geographical
Location. November 1994.
-
[RFC2673] M.Crawford. Binary Labels in the Domain Name System. August 1999.
+
[RFC2673] M.Crawford. Binary Labels in the Domain Name System. August 1999.
-
[RFC2874] M.Crawford and C.Huitema. DNS Extensions to Support IPv6 Address Aggregation
+
[RFC2874] M.Crawford and C.Huitema. DNS Extensions to Support IPv6 Address Aggregation
and Renumbering. July 2000.
@@ -551,39 +551,39 @@
-
[RFC2065] D.Eastlake, 3rd and C.Kaufman. Domain Name System Security Extensions. January 1997.
+
[RFC2065] D.Eastlake, 3rd and C.Kaufman. Domain Name System Security Extensions. January 1997.
-
[RFC2137] D.Eastlake, 3rd. Secure Domain Name System Dynamic Update. April 1997.
+
[RFC2137] D.Eastlake, 3rd. Secure Domain Name System Dynamic Update. April 1997.
-
[RFC2535] D.Eastlake, 3rd. Domain Name System Security Extensions. March 1999.
+
[RFC2535] D.Eastlake, 3rd. Domain Name System Security Extensions. March 1999.
-
[RFC3008] B.Wellington. Domain Name System Security (DNSSEC)
+
[RFC3008] B.Wellington. Domain Name System Security (DNSSEC)
Signing Authority. November 2000.
-
[RFC3090] E.Lewis. DNS Security Extension Clarification on Zone Status. March 2001.
+
[RFC3090] E.Lewis. DNS Security Extension Clarification on Zone Status. March 2001.
-
[RFC3445] D.Massey and S.Rose. Limiting the Scope of the KEY Resource Record (RR). December 2002.
+
[RFC3445] D.Massey and S.Rose. Limiting the Scope of the KEY Resource Record (RR). December 2002.
-
[RFC3655] B.Wellington and O.Gudmundsson. Redefinition of DNS Authenticated Data (AD) bit. November 2003.
+
[RFC3655] B.Wellington and O.Gudmundsson. Redefinition of DNS Authenticated Data (AD) bit. November 2003.
-
[RFC3658] O.Gudmundsson. Delegation Signer (DS) Resource Record (RR). December 2003.
+
[RFC3658] O.Gudmundsson. Delegation Signer (DS) Resource Record (RR). December 2003.
-
[RFC3755] S.Weiler. Legacy Resolver Compatibility for Delegation Signer (DS). May 2004.
+
[RFC3755] S.Weiler. Legacy Resolver Compatibility for Delegation Signer (DS). May 2004.
-
[RFC3757] O.Kolkman, J.Schlyter, and E.Lewis. Domain Name System KEY (DNSKEY) Resource Record
+
[RFC3757] O.Kolkman, J.Schlyter, and E.Lewis. Domain Name System KEY (DNSKEY) Resource Record
(RR) Secure Entry Point (SEP) Flag. April 2004.
-
[RFC3845] J.Schlyter. DNS Security (DNSSEC) NextSECure (NSEC) RDATA Format. August 2004.
+
[RFC3845] J.Schlyter. DNS Security (DNSSEC) NextSECure (NSEC) RDATA Format. August 2004.
@@ -604,14 +604,14 @@
-Other Documents About BIND
+Other Documents About BIND
GNU make is required to build the export libraries (other
part of BIND 9 can still be built with other types of make). In
the reminder of this document, "make" means GNU make. Note that
@@ -657,7 +657,7 @@
-Compilation
+Compilation
$ ./configure --enable-exportlib [other flags]
$ make
@@ -672,7 +672,7 @@ $ make
-Installation
+Installation
$ cd lib/export
$ make install
@@ -694,7 +694,7 @@ $ make install
-Known Defects/Restrictions
+Known Defects/Restrictions
Currently, win32 is not supported for the export
library. (Normal BIND 9 application can be built as
@@ -734,7 +734,7 @@ $ make
-The dns.conf File
+The dns.conf File
The IRS library supports an "advanced" configuration file
related to the DNS library for configuration parameters that
would be beyond the capability of the
@@ -752,14 +752,14 @@ $ make
-Sample Applications
+Sample Applications
Some sample application programs using this API are
provided for reference. The following is a brief description of
these applications.
-sample: a simple stub resolver utility
+sample: a simple stub resolver utility
It sends a query of a given name (of a given optional RR type) to a
specified recursive server, and prints the result as a list of
@@ -823,7 +823,7 @@ $ make
-sample-async: a simple stub resolver, working asynchronously
+sample-async: a simple stub resolver, working asynchronously
Similar to "sample", but accepts a list
of (query) domain names as a separate file and resolves the names
@@ -864,7 +864,7 @@ $ make
-sample-request: a simple DNS transaction client
+sample-request: a simple DNS transaction client
It sends a query to a specified server, and
prints the response with minimal processing. It doesn't act as a
@@ -905,7 +905,7 @@ $ make
-sample-gai: getaddrinfo() and getnameinfo() test code
+sample-gai: getaddrinfo() and getnameinfo() test code
This is a test program
to check getaddrinfo() and getnameinfo() behavior. It takes a
@@ -922,7 +922,7 @@ $ make
-sample-update: a simple dynamic update client program
+sample-update: a simple dynamic update client program
It accepts a single update command as a
command-line argument, sends an update request message to the
@@ -1017,7 +1017,7 @@ $ sample-update -a sample-update -k Kxxx.+nnn+mm
-nsprobe: domain/name server checker in terms of RFC 4074
+nsprobe: domain/name server checker in terms of RFC 4074
It checks a set
of domains to see the name servers of the domains behave
@@ -1074,7 +1074,7 @@ $ sample-update -a sample-update -k Kxxx.+nnn+mm
-Library References
+Library References
As of this writing, there is no formal "manual" of the
libraries, except this document, header files (some of them
provide pretty detailed explanations), and sample application
diff --git a/contrib/bind9/doc/arm/Bv9ARM.html b/contrib/bind9/doc/arm/Bv9ARM.html
index 7341705aaad1..7751cfaf4f8d 100644
--- a/contrib/bind9/doc/arm/Bv9ARM.html
+++ b/contrib/bind9/doc/arm/Bv9ARM.html
@@ -14,7 +14,7 @@
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+