diff --git a/bin/dig/dig.1 b/bin/dig/dig.1
index f7f4370a59b1..c8704a1d3a27 100644
--- a/bin/dig/dig.1
+++ b/bin/dig/dig.1
@@ -1,7 +1,7 @@
.\" Copyright (C) 2004-2009 Internet Systems Consortium, Inc. ("ISC")
.\" Copyright (C) 2000-2003 Internet Software Consortium.
.\"
-.\" Permission to use, copy, modify, and distribute this software for any
+.\" Permission to use, copy, modify, and/or distribute this software for any
.\" purpose with or without fee is hereby granted, provided that the above
.\" copyright notice and this permission notice appear in all copies.
.\"
@@ -13,7 +13,7 @@
.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
.\" PERFORMANCE OF THIS SOFTWARE.
.\"
-.\" $Id: dig.1,v 1.50.44.2 2009/02/03 01:52:10 tbox Exp $
+.\" $Id: dig.1,v 1.50.44.3 2009/07/11 01:55:20 tbox Exp $
.\"
.hy 0
.ad l
diff --git a/bin/dig/dig.html b/bin/dig/dig.html
index 11b55cc75929..3fd3e75cdbe1 100644
--- a/bin/dig/dig.html
+++ b/bin/dig/dig.html
@@ -2,7 +2,7 @@
- Copyright (C) 2004-2009 Internet Systems Consortium, Inc. ("ISC")
- Copyright (C) 2000-2003 Internet Software Consortium.
-
- - Permission to use, copy, modify, and distribute this software for any
+ - Permission to use, copy, modify, and/or distribute this software for any
- purpose with or without fee is hereby granted, provided that the above
- copyright notice and this permission notice appear in all copies.
-
@@ -14,7 +14,7 @@
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
index 470261cb2da7..d730c0ee5f34 100644
--- a/bin/dig/dighost.c
+++ b/bin/dig/dighost.c
@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: dighost.c,v 1.311.70.8 2009/02/25 02:39:21 marka Exp $ */
+/* $Id: dighost.c,v 1.311.70.11 2009/11/10 17:27:13 each Exp $ */
/*! \file
* \note
@@ -1048,7 +1048,9 @@ setup_system(void) {
debug("ndots is %d.", ndots);
}
- copy_server_list(lwconf, &server_list);
+ /* If user doesn't specify server use nameservers from resolv.conf. */
+ if (ISC_LIST_EMPTY(server_list))
+ copy_server_list(lwconf, &server_list);
/* If we don't find a nameserver fall back to localhost */
if (ISC_LIST_EMPTY(server_list)) {
@@ -2397,11 +2399,9 @@ connect_timeout(isc_task_t *task, isc_event_t *event) {
if (!l->tcp_mode)
send_udp(ISC_LIST_NEXT(cq, link));
else {
- isc_socket_cancel(query->sock, NULL,
- ISC_SOCKCANCEL_ALL);
- isc_socket_detach(&query->sock);
- sockcount--;
- debug("sockcount=%d", sockcount);
+ if (query->sock != NULL)
+ isc_socket_cancel(query->sock, NULL,
+ ISC_SOCKCANCEL_ALL);
send_tcp_connect(ISC_LIST_NEXT(cq, link));
}
UNLOCK_LOOKUP;
@@ -2605,8 +2605,8 @@ connect_done(isc_task_t *task, isc_event_t *event) {
if (sevent->result == ISC_R_CANCELED) {
debug("in cancel handler");
isc_socket_detach(&query->sock);
+ INSIST(sockcount > 0);
sockcount--;
- INSIST(sockcount >= 0);
debug("sockcount=%d", sockcount);
query->waiting_connect = ISC_FALSE;
isc_event_free(&event);
diff --git a/bin/dig/host.1 b/bin/dig/host.1
index eebdad8fe80f..c538ae3d6249 100644
--- a/bin/dig/host.1
+++ b/bin/dig/host.1
@@ -1,7 +1,7 @@
.\" Copyright (C) 2004, 2005, 2007-2009 Internet Systems Consortium, Inc. ("ISC")
.\" Copyright (C) 2000-2002 Internet Software Consortium.
.\"
-.\" Permission to use, copy, modify, and distribute this software for any
+.\" Permission to use, copy, modify, and/or distribute this software for any
.\" purpose with or without fee is hereby granted, provided that the above
.\" copyright notice and this permission notice appear in all copies.
.\"
@@ -13,7 +13,7 @@
.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
.\" PERFORMANCE OF THIS SOFTWARE.
.\"
-.\" $Id: host.1,v 1.29.114.1 2009/01/23 01:53:33 tbox Exp $
+.\" $Id: host.1,v 1.29.114.2 2009/07/11 01:55:20 tbox Exp $
.\"
.hy 0
.ad l
diff --git a/bin/dig/host.c b/bin/dig/host.c
index 9f302068adf3..8cd5b3db29a8 100644
--- a/bin/dig/host.c
+++ b/bin/dig/host.c
@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: host.c,v 1.116.216.2 2009/05/06 23:47:18 tbox Exp $ */
+/* $Id: host.c,v 1.116.216.3 2009/09/08 23:28:20 marka Exp $ */
/*! \file */
@@ -839,11 +839,10 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) {
} else {
strncpy(lookup->textname, hostname, sizeof(lookup->textname));
lookup->textname[sizeof(lookup->textname)-1]=0;
+ usesearch = ISC_TRUE;
}
lookup->new_search = ISC_TRUE;
ISC_LIST_APPEND(lookup_list, lookup, link);
-
- usesearch = ISC_TRUE;
}
int
diff --git a/bin/dig/host.html b/bin/dig/host.html
index f21073174ba8..3928c93e7649 100644
--- a/bin/dig/host.html
+++ b/bin/dig/host.html
@@ -2,7 +2,7 @@
- Copyright (C) 2004, 2005, 2007-2009 Internet Systems Consortium, Inc. ("ISC")
- Copyright (C) 2000-2002 Internet Software Consortium.
-
- - Permission to use, copy, modify, and distribute this software for any
+ - Permission to use, copy, modify, and/or distribute this software for any
- purpose with or without fee is hereby granted, provided that the above
- copyright notice and this permission notice appear in all copies.
-
@@ -14,7 +14,7 @@
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
diff --git a/bin/dig/nslookup.1 b/bin/dig/nslookup.1
index 2d195345e6f2..68b419ae59b3 100644
--- a/bin/dig/nslookup.1
+++ b/bin/dig/nslookup.1
@@ -1,6 +1,6 @@
.\" Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
.\"
-.\" Permission to use, copy, modify, and distribute this software for any
+.\" Permission to use, copy, modify, and/or distribute this software for any
.\" purpose with or without fee is hereby granted, provided that the above
.\" copyright notice and this permission notice appear in all copies.
.\"
@@ -12,7 +12,7 @@
.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
.\" PERFORMANCE OF THIS SOFTWARE.
.\"
-.\" $Id: nslookup.1,v 1.14 2007/05/16 06:12:01 marka Exp $
+.\" $Id: nslookup.1,v 1.14.354.1 2009/07/11 01:55:20 tbox Exp $
.\"
.hy 0
.ad l
diff --git a/bin/dig/nslookup.c b/bin/dig/nslookup.c
index 56796268d90f..000f54e9b637 100644
--- a/bin/dig/nslookup.c
+++ b/bin/dig/nslookup.c
@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: nslookup.c,v 1.117.334.4 2009/05/06 11:41:57 fdupont Exp $ */
+/* $Id: nslookup.c,v 1.117.334.5 2009/10/20 01:11:22 marka Exp $ */
#include
@@ -373,6 +373,7 @@ detailsection(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers,
printrdata(&rdata);
}
dns_rdata_reset(&rdata);
+ printf("\tttl = %u\n", rdataset->ttl);
loopresult = dns_rdataset_next(rdataset);
}
}
diff --git a/bin/dig/nslookup.html b/bin/dig/nslookup.html
index 0f3817653c01..3984a16b8a22 100644
--- a/bin/dig/nslookup.html
+++ b/bin/dig/nslookup.html
@@ -1,7 +1,7 @@
-
+
diff --git a/bin/dnssec/dnssec-dsfromkey.c b/bin/dnssec/dnssec-dsfromkey.c
index 653aa3ea7a5a..8bd4aa566e35 100644
--- a/bin/dnssec/dnssec-dsfromkey.c
+++ b/bin/dnssec/dnssec-dsfromkey.c
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2008, 2009 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2008-2010 Internet Systems Consortium, Inc. ("ISC")
*
* Permission to use, copy, modify, and/or distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
@@ -14,7 +14,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: dnssec-dsfromkey.c,v 1.2.14.3 2009/03/02 02:54:15 marka Exp $ */
+/* $Id: dnssec-dsfromkey.c,v 1.2.14.6 2010/01/11 23:47:22 tbox Exp $ */
/*! \file */
@@ -78,10 +78,18 @@ loadkeys(char *dirname, char *setname)
isc_buffer_init(&buf, filename, sizeof(filename));
if (dirname != NULL) {
+ if (isc_buffer_availablelength(&buf) < strlen(dirname))
+ fatal("directory name '%s' too long", dirname);
isc_buffer_putstr(&buf, dirname);
- if (dirname[strlen(dirname) - 1] != '/')
+ if (dirname[strlen(dirname) - 1] != '/') {
+ if (isc_buffer_availablelength(&buf) < 1)
+ fatal("directory name '%s' too long", dirname);
isc_buffer_putstr(&buf, "/");
+ }
}
+
+ if (isc_buffer_availablelength(&buf) < strlen("keyset-"))
+ fatal("directory name '%s' too long", dirname);
isc_buffer_putstr(&buf, "keyset-");
result = dns_name_tofilenametext(name, ISC_FALSE, &buf);
check_result(result, "dns_name_tofilenametext()");
@@ -210,12 +218,12 @@ emitds(unsigned int dtype, dns_rdata_t *rdata)
putchar(' ');
isc_buffer_usedregion(&classb, &r);
- fwrite(r.base, 1, r.length, stdout);
+ isc_util_fwrite(r.base, 1, r.length, stdout);
printf(" DS ");
isc_buffer_usedregion(&textb, &r);
- fwrite(r.base, 1, r.length, stdout);
+ isc_util_fwrite(r.base, 1, r.length, stdout);
putchar('\n');
}
diff --git a/bin/dnssec/dnssec-keyfromlabel.8 b/bin/dnssec/dnssec-keyfromlabel.8
index 622205820db0..03f13e9d30ad 100644
--- a/bin/dnssec/dnssec-keyfromlabel.8
+++ b/bin/dnssec/dnssec-keyfromlabel.8
@@ -1,6 +1,6 @@
-.\" Copyright (C) 2008 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2008, 2010 Internet Systems Consortium, Inc. ("ISC")
.\"
-.\" Permission to use, copy, modify, and distribute this software for any
+.\" Permission to use, copy, modify, and/or distribute this software for any
.\" purpose with or without fee is hereby granted, provided that the above
.\" copyright notice and this permission notice appear in all copies.
.\"
@@ -12,7 +12,7 @@
.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
.\" PERFORMANCE OF THIS SOFTWARE.
.\"
-.\" $Id: dnssec-keyfromlabel.8,v 1.6 2008/11/08 01:11:47 tbox Exp $
+.\" $Id: dnssec-keyfromlabel.8,v 1.6.14.3 2010/01/16 01:55:32 tbox Exp $
.\"
.hy 0
.ad l
@@ -43,7 +43,13 @@ gets keys with the given label from a crypto hardware and builds key files for D
.RS 4
Selects the cryptographic algorithm. The value of
\fBalgorithm\fR
-must be one of RSAMD5 (RSA) or RSASHA1, DSA, NSEC3RSASHA1, NSEC3DSA or DH (Diffie Hellman). These values are case insensitive.
+must be one of RSAMD5, RSASHA1, DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512 or DH (Diffie Hellman). These values are case insensitive.
+.sp
+If no algorithm is specified, then RSASHA1 will be used by default, unless the
+\fB\-3\fR
+option is specified, in which case NSEC3RSASHA1 will be used instead. (If
+\fB\-3\fR
+is used and an algorithm is specified, that algorithm will be checked for compatibility with NSEC3.)
.sp
Note 1: that for DNSSEC, RSASHA1 is a mandatory to implement algorithm, and DSA is recommended.
.sp
@@ -138,12 +144,10 @@ file contains algorithm specific fields. For obvious security reasons, this file
\fBdnssec\-keygen\fR(8),
\fBdnssec\-signzone\fR(8),
BIND 9 Administrator Reference Manual,
-RFC 2539,
-RFC 2845,
-RFC 4033.
+RFC 4034.
.SH "AUTHOR"
.PP
Internet Systems Consortium
.SH "COPYRIGHT"
-Copyright \(co 2008 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2008, 2010 Internet Systems Consortium, Inc. ("ISC")
.br
diff --git a/bin/dnssec/dnssec-keyfromlabel.c b/bin/dnssec/dnssec-keyfromlabel.c
index e7587c39663d..78bfda315398 100644
--- a/bin/dnssec/dnssec-keyfromlabel.c
+++ b/bin/dnssec/dnssec-keyfromlabel.c
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2007, 2008 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2007, 2008, 2010 Internet Systems Consortium, Inc. ("ISC")
*
* Permission to use, copy, modify, and/or distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
@@ -14,7 +14,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: dnssec-keyfromlabel.c,v 1.4 2008/09/24 02:46:21 marka Exp $ */
+/* $Id: dnssec-keyfromlabel.c,v 1.4.50.2 2010/01/15 23:47:31 tbox Exp $ */
/*! \file */
@@ -48,7 +48,8 @@ const char *program = "dnssec-keyfromlabel";
int verbose;
static const char *algs = "RSA | RSAMD5 | DH | DSA | RSASHA1 |"
- " NSEC3DSA | NSEC3RSASHA1";
+ " NSEC3DSA | NSEC3RSASHA1 |"
+ " RSASHA256 | RSASHA512";
static void
usage(void) {
diff --git a/bin/dnssec/dnssec-keyfromlabel.docbook b/bin/dnssec/dnssec-keyfromlabel.docbook
index 2bcf0a48da4a..f2ab15298331 100644
--- a/bin/dnssec/dnssec-keyfromlabel.docbook
+++ b/bin/dnssec/dnssec-keyfromlabel.docbook
@@ -2,7 +2,7 @@
"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
[]>
-
+
February 8, 2008
@@ -37,6 +37,7 @@
2008
+ 2010Internet Systems Consortium, Inc. ("ISC")
@@ -75,10 +76,18 @@
Selects the cryptographic algorithm. The value of
- must be one of RSAMD5 (RSA)
- or RSASHA1, DSA, NSEC3RSASHA1, NSEC3DSA or DH (Diffie Hellman).
+ must be one of RSAMD5,
+ RSASHA1, DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256,
+ RSASHA512 or DH (Diffie Hellman).
These values are case insensitive.
+
+ If no algorithm is specified, then RSASHA1 will be used by
+ default, unless the option is specified,
+ in which case NSEC3RSASHA1 will be used instead. (If
+ is used and an algorithm is specified,
+ that algorithm will be checked for compatibility with NSEC3.)
+
Note 1: that for DNSSEC, RSASHA1 is a mandatory to implement
algorithm, and DSA is recommended.
@@ -246,9 +255,7 @@
dnssec-signzone8
,
BIND 9 Administrator Reference Manual,
- RFC 2539,
- RFC 2845,
- RFC 4033.
+ RFC 4034.
diff --git a/bin/dnssec/dnssec-keyfromlabel.html b/bin/dnssec/dnssec-keyfromlabel.html
index cbea64b8d75f..1aafccd97c1a 100644
--- a/bin/dnssec/dnssec-keyfromlabel.html
+++ b/bin/dnssec/dnssec-keyfromlabel.html
@@ -1,7 +1,7 @@
-
+
@@ -31,7 +31,7 @@
dnssec-keyfromlabel
gets keys with the given label from a crypto hardware and builds
key files for DNSSEC (Secure DNS), as defined in RFC 2535
@@ -39,16 +39,24 @@
-
OPTIONS
+
OPTIONS
-a algorithm
Selects the cryptographic algorithm. The value of
- algorithm must be one of RSAMD5 (RSA)
- or RSASHA1, DSA, NSEC3RSASHA1, NSEC3DSA or DH (Diffie Hellman).
+ algorithm must be one of RSAMD5,
+ RSASHA1, DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256,
+ RSASHA512 or DH (Diffie Hellman).
These values are case insensitive.
+
+ If no algorithm is specified, then RSASHA1 will be used by
+ default, unless the -3 option is specified,
+ in which case NSEC3RSASHA1 will be used instead. (If
+ -3 is used and an algorithm is specified,
+ that algorithm will be checked for compatibility with NSEC3.)
+
Note 1: that for DNSSEC, RSASHA1 is a mandatory to implement
algorithm, and DSA is recommended.
@@ -112,7 +120,7 @@
-
GENERATED KEY FILES
+
GENERATED KEY FILES
When dnssec-keyfromlabel completes
successfully,
@@ -153,17 +161,15 @@
diff --git a/bin/dnssec/dnssec-keygen.8 b/bin/dnssec/dnssec-keygen.8
index 13db3d9db149..485ea6ef2442 100644
--- a/bin/dnssec/dnssec-keygen.8
+++ b/bin/dnssec/dnssec-keygen.8
@@ -1,7 +1,7 @@
-.\" Copyright (C) 2004, 2005, 2007, 2008 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004, 2005, 2007-2010 Internet Systems Consortium, Inc. ("ISC")
.\" Copyright (C) 2000-2003 Internet Software Consortium.
.\"
-.\" Permission to use, copy, modify, and distribute this software for any
+.\" Permission to use, copy, modify, and/or distribute this software for any
.\" purpose with or without fee is hereby granted, provided that the above
.\" copyright notice and this permission notice appear in all copies.
.\"
@@ -13,7 +13,7 @@
.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
.\" PERFORMANCE OF THIS SOFTWARE.
.\"
-.\" $Id: dnssec-keygen.8,v 1.40 2008/10/15 01:11:35 tbox Exp $
+.\" $Id: dnssec-keygen.8,v 1.40.44.4 2010/01/16 01:55:32 tbox Exp $
.\"
.hy 0
.ad l
@@ -38,13 +38,17 @@ dnssec\-keygen \- DNSSEC key generation tool
.PP
\fBdnssec\-keygen\fR
generates keys for DNSSEC (Secure DNS), as defined in RFC 2535 and RFC 4034. It can also generate keys for use with TSIG (Transaction Signatures), as defined in RFC 2845.
+.PP
+The
+\fBname\fR
+of the key is specified on the command line. For DNSSEC keys, this must match the name of the zone for which the key is being generated.
.SH "OPTIONS"
.PP
\-a \fIalgorithm\fR
.RS 4
-Selects the cryptographic algorithm. The value of
+Selects the cryptographic algorithm. For DNSSEC keys, the value of
\fBalgorithm\fR
-must be one of RSAMD5 (RSA) or RSASHA1, DSA, NSEC3RSASHA1, NSEC3DSA, DH (Diffie Hellman), or HMAC\-MD5. These values are case insensitive.
+must be one of RSAMD5, RSASHA1, DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256 or RSASHA512. For TSIG/TKEY, the value must be DH (Diffie Hellman), HMAC\-MD5, HMAC\-SHA1, HMAC\-SHA224, HMAC\-SHA256, HMAC\-SHA384, or HMAC\-SHA512. These values are case insensitive.
.sp
Note 1: that for DNSSEC, RSASHA1 is a mandatory to implement algorithm, and DSA is recommended. For TSIG, HMAC\-MD5 is mandatory.
.sp
@@ -53,7 +57,7 @@ Note 2: HMAC\-MD5 and DH automatically set the \-k flag.
.PP
\-b \fIkeysize\fR
.RS 4
-Specifies the number of bits in the key. The choice of key size depends on the algorithm used. RSAMD5 / RSASHA1 keys must be between 512 and 2048 bits. Diffie Hellman keys must be between 128 and 4096 bits. DSA keys must be between 512 and 1024 bits and an exact multiple of 64. HMAC\-MD5 keys must be between 1 and 512 bits.
+Specifies the number of bits in the key. The choice of key size depends on the algorithm used. RSA keys must be between 512 and 2048 bits. Diffie Hellman keys must be between 128 and 4096 bits. DSA keys must be between 512 and 1024 bits and an exact multiple of 64. HMAC keys must be between 1 and 512 bits.
.RE
.PP
\-n \fInametype\fR
@@ -189,12 +193,12 @@ and
BIND 9 Administrator Reference Manual,
RFC 2539,
RFC 2845,
-RFC 4033.
+RFC 4034.
.SH "AUTHOR"
.PP
Internet Systems Consortium
.SH "COPYRIGHT"
-Copyright \(co 2004, 2005, 2007, 2008 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004, 2005, 2007\-2010 Internet Systems Consortium, Inc. ("ISC")
.br
Copyright \(co 2000\-2003 Internet Software Consortium.
.br
diff --git a/bin/dnssec/dnssec-keygen.c b/bin/dnssec/dnssec-keygen.c
index 614d388eb7e2..2b9a863b7d46 100644
--- a/bin/dnssec/dnssec-keygen.c
+++ b/bin/dnssec/dnssec-keygen.c
@@ -1,5 +1,5 @@
/*
- * Portions Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 2004-2008, 2010 Internet Systems Consortium, Inc. ("ISC")
* Portions Copyright (C) 1999-2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -29,7 +29,7 @@
* IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: dnssec-keygen.c,v 1.81 2008/09/25 04:02:38 tbox Exp $ */
+/* $Id: dnssec-keygen.c,v 1.81.48.2 2010/01/15 23:47:31 tbox Exp $ */
/*! \file */
@@ -62,8 +62,8 @@
const char *program = "dnssec-keygen";
int verbose;
-static const char *algs = "RSA | RSAMD5 | DH | DSA | RSASHA1 | NSEC3DSA |"
- " NSEC3RSASHA1 | HMAC-MD5 |"
+static const char *algs = "RSA | RSAMD5 | DH | DSA | RSASHA1 | RSASHA256 |"
+ " RSASHA512 | NSEC3DSA | NSEC3RSASHA1 | HMAC-MD5 |"
" HMAC-SHA1 | HMAC-SHA224 | HMAC-SHA256 |"
" HMAC-SHA384 | HMAC-SHA512";
@@ -84,6 +84,8 @@ usage(void) {
fprintf(stderr, " RSAMD5:\t\t[512..%d]\n", MAX_RSA);
fprintf(stderr, " RSASHA1:\t\t[512..%d]\n", MAX_RSA);
fprintf(stderr, " NSEC3RSASHA1:\t\t[512..%d]\n", MAX_RSA);
+ fprintf(stderr, " RSASHA256:\t[512..%d]\n", MAX_RSA);
+ fprintf(stderr, " RSASHA512:\t[1024..%d]\n", MAX_RSA);
fprintf(stderr, " DH:\t\t[128..4096]\n");
fprintf(stderr, " DSA:\t\t[512..1024] and divisible by 64\n");
fprintf(stderr, " NSEC3DSA:\t\t[512..1024] and divisible by 64\n");
@@ -307,9 +309,14 @@ main(int argc, char **argv) {
case DNS_KEYALG_RSAMD5:
case DNS_KEYALG_RSASHA1:
case DNS_KEYALG_NSEC3RSASHA1:
+ case DNS_KEYALG_RSASHA256:
if (size != 0 && (size < 512 || size > MAX_RSA))
fatal("RSA key size %d out of range", size);
break;
+ case DNS_KEYALG_RSASHA512:
+ if (size != 0 && (size < 1024 || size > MAX_RSA))
+ fatal("RSA key size %d out of range", size);
+ break;
case DNS_KEYALG_DH:
if (size != 0 && (size < 128 || size > 4096))
fatal("DH key size %d out of range", size);
@@ -376,7 +383,8 @@ main(int argc, char **argv) {
}
if (!(alg == DNS_KEYALG_RSAMD5 || alg == DNS_KEYALG_RSASHA1 ||
- alg == DNS_KEYALG_NSEC3RSASHA1) && rsa_exp != 0)
+ alg == DNS_KEYALG_NSEC3RSASHA1 || alg == DNS_KEYALG_RSASHA256 ||
+ alg == DNS_KEYALG_RSASHA512) && rsa_exp != 0)
fatal("specified RSA exponent for a non-RSA key");
if (alg != DNS_KEYALG_DH && generator != 0)
@@ -440,12 +448,16 @@ main(int argc, char **argv) {
switch(alg) {
case DNS_KEYALG_RSAMD5:
case DNS_KEYALG_RSASHA1:
+ case DNS_KEYALG_NSEC3RSASHA1:
+ case DNS_KEYALG_RSASHA256:
+ case DNS_KEYALG_RSASHA512:
param = rsa_exp;
break;
case DNS_KEYALG_DH:
param = generator;
break;
case DNS_KEYALG_DSA:
+ case DNS_KEYALG_NSEC3DSA:
case DST_ALG_HMACMD5:
case DST_ALG_HMACSHA1:
case DST_ALG_HMACSHA224:
diff --git a/bin/dnssec/dnssec-keygen.docbook b/bin/dnssec/dnssec-keygen.docbook
index c267a1b4c25f..92ef9b9afc57 100644
--- a/bin/dnssec/dnssec-keygen.docbook
+++ b/bin/dnssec/dnssec-keygen.docbook
@@ -2,7 +2,7 @@
"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
[]>
-
+
June 30, 2000
@@ -41,6 +41,8 @@
200520072008
+ 2009
+ 2010Internet Systems Consortium, Inc. ("ISC")
@@ -80,6 +82,11 @@
and RFC 4034. It can also generate keys for use with
TSIG (Transaction Signatures), as defined in RFC 2845.
+
+ The of the key is specified on the command
+ line. For DNSSEC keys, this must match the name of the zone for
+ which the key is being generated.
+
@@ -90,10 +97,13 @@
-a algorithm
- Selects the cryptographic algorithm. The value of
- must be one of RSAMD5 (RSA) or RSASHA1,
- DSA, NSEC3RSASHA1, NSEC3DSA, DH (Diffie Hellman), or HMAC-MD5.
- These values are case insensitive.
+ Selects the cryptographic algorithm. For DNSSEC keys, the value
+ of must be one of RSAMD5, RSASHA1,
+ DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256 or RSASHA512.
+ For TSIG/TKEY, the value must
+ be DH (Diffie Hellman), HMAC-MD5, HMAC-SHA1, HMAC-SHA224,
+ HMAC-SHA256, HMAC-SHA384, or HMAC-SHA512. These values are
+ case insensitive.
Note 1: that for DNSSEC, RSASHA1 is a mandatory to implement
@@ -111,11 +121,10 @@
Specifies the number of bits in the key. The choice of key
- size depends on the algorithm used. RSAMD5 / RSASHA1 keys must be
- between
- 512 and 2048 bits. Diffie Hellman keys must be between
+ size depends on the algorithm used. RSA keys must be
+ between 512 and 2048 bits. Diffie Hellman keys must be between
128 and 4096 bits. DSA keys must be between 512 and 1024
- bits and an exact multiple of 64. HMAC-MD5 keys must be
+ bits and an exact multiple of 64. HMAC keys must be
between 1 and 512 bits.
@@ -343,7 +352,7 @@
BIND 9 Administrator Reference Manual,
RFC 2539,
RFC 2845,
- RFC 4033.
+ RFC 4034.
diff --git a/bin/dnssec/dnssec-keygen.html b/bin/dnssec/dnssec-keygen.html
index 696ef88c3701..fccec6f684c8 100644
--- a/bin/dnssec/dnssec-keygen.html
+++ b/bin/dnssec/dnssec-keygen.html
@@ -1,8 +1,8 @@
-
+
@@ -32,23 +32,31 @@
dnssec-keygen
generates keys for DNSSEC (Secure DNS), as defined in RFC 2535
and RFC 4034. It can also generate keys for use with
TSIG (Transaction Signatures), as defined in RFC 2845.
+
+ The name of the key is specified on the command
+ line. For DNSSEC keys, this must match the name of the zone for
+ which the key is being generated.
+
-
OPTIONS
+
OPTIONS
-a algorithm
- Selects the cryptographic algorithm. The value of
- algorithm must be one of RSAMD5 (RSA) or RSASHA1,
- DSA, NSEC3RSASHA1, NSEC3DSA, DH (Diffie Hellman), or HMAC-MD5.
- These values are case insensitive.
+ Selects the cryptographic algorithm. For DNSSEC keys, the value
+ of algorithm must be one of RSAMD5, RSASHA1,
+ DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256 or RSASHA512.
+ For TSIG/TKEY, the value must
+ be DH (Diffie Hellman), HMAC-MD5, HMAC-SHA1, HMAC-SHA224,
+ HMAC-SHA256, HMAC-SHA384, or HMAC-SHA512. These values are
+ case insensitive.
Note 1: that for DNSSEC, RSASHA1 is a mandatory to implement
@@ -62,11 +70,10 @@
-b keysize
Specifies the number of bits in the key. The choice of key
- size depends on the algorithm used. RSAMD5 / RSASHA1 keys must be
- between
- 512 and 2048 bits. Diffie Hellman keys must be between
+ size depends on the algorithm used. RSA keys must be
+ between 512 and 2048 bits. Diffie Hellman keys must be between
128 and 4096 bits. DSA keys must be between 512 and 1024
- bits and an exact multiple of 64. HMAC-MD5 keys must be
+ bits and an exact multiple of 64. HMAC keys must be
between 1 and 512 bits.
-n nametype
@@ -148,7 +155,7 @@
-
GENERATED KEYS
+
GENERATED KEYS
When dnssec-keygen completes
successfully,
@@ -194,7 +201,7 @@
-
EXAMPLE
+
EXAMPLE
To generate a 768-bit DSA key for the domain
example.com, the following command would be
@@ -215,16 +222,16 @@
dnssec-signzone
signs a zone. It generates
NSEC and RRSIG records and produces a signed version of the
- zone. The security status of delegations from the signed zone
- (that is, whether the child zones are secure or not) is
- determined by the presence or absence of a
- keyset file for each child zone.
+ zone. It also generates a keyset- file containing
+ the key-signing keys for the zone, and if signing a zone which
+ contains delegations, it can optionally generate DS records for
+ the child zones from their keyset- files.
-
OPTIONS
+
OPTIONS
-a
@@ -70,8 +70,10 @@
-g
- Generate DS records for child zones from keyset files.
- Existing DS records will be removed.
+ If the zone contains any delegations, and there are
+ keyset- files for any of the child zones,
+ then DS records for the child zones will be generated from the
+ keys in those files. Existing DS records will be removed.
-s start-time
@@ -202,6 +204,19 @@
may be useful when signing large zones or when the entropy
source is limited.
+
-P
+
+
+ Disable post sign verification tests.
+
+
+ The post sign verification test ensures that for each algorithm
+ in use there is at least one non revoked self signed KSK key,
+ that all revoked KSK keys are self signed, and that all records
+ in the zone are signed by the algorithm.
+ This option skips these tests.
+
+
-r randomdev
Specifies the source of randomness. If the operating
@@ -258,7 +273,7 @@
-
EXAMPLE
+
EXAMPLE
The following command signs the example.com
zone with the DSA key generated by dnssec-keygen
@@ -287,7 +302,7 @@ db.example.com.signed
%
-
KNOWN BUGS
+
KNOWN BUGS
dnssec-signzone was designed so that it could
sign a zone partially, using only a subset of the DNSSEC keys
@@ -312,14 +327,14 @@ db.example.com.signed
diff --git a/bin/dnssec/dnssectool.c b/bin/dnssec/dnssectool.c
index b89d76945b89..3a6b7f024b65 100644
--- a/bin/dnssec/dnssectool.c
+++ b/bin/dnssec/dnssectool.c
@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: dnssectool.c,v 1.45.334.4 2009/06/08 23:47:00 tbox Exp $ */
+/* $Id: dnssectool.c,v 1.45.334.5 2009/06/22 05:05:00 marka Exp $ */
/*! \file */
@@ -65,7 +65,7 @@ void
fatal(const char *format, ...) {
va_list args;
- fprintf(stderr, "%s: ", program);
+ fprintf(stderr, "%s: fatal: ", program);
va_start(args, format);
vfprintf(stderr, format, args);
va_end(args);
diff --git a/bin/dnssec/dnssectool.h b/bin/dnssec/dnssectool.h
index ee476f4ea78b..43b7375b26ea 100644
--- a/bin/dnssec/dnssectool.h
+++ b/bin/dnssec/dnssectool.h
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2004, 2007, 2008 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2007-2009 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 2000, 2001, 2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: dnssectool.h,v 1.22 2008/09/25 04:02:38 tbox Exp $ */
+/* $Id: dnssectool.h,v 1.22.48.2 2009/09/04 23:46:58 tbox Exp $ */
#ifndef DNSSECTOOL_H
#define DNSSECTOOL_H 1
@@ -45,7 +45,7 @@ type_format(const dns_rdatatype_t type, char *cp, unsigned int size);
void
alg_format(const dns_secalg_t alg, char *cp, unsigned int size);
-#define ALG_FORMATSIZE 10
+#define ALG_FORMATSIZE 20
void
sig_format(dns_rdata_rrsig_t *sig, char *cp, unsigned int size);
diff --git a/bin/named/control.c b/bin/named/control.c
index 8bd8f6ce361f..ac1ec4217dad 100644
--- a/bin/named/control.c
+++ b/bin/named/control.c
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007, 2009 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 2001-2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: control.c,v 1.33 2007/09/13 04:45:18 each Exp $ */
+/* $Id: control.c,v 1.33.266.2 2009/07/11 23:47:17 tbox Exp $ */
/*! \file */
@@ -56,7 +56,7 @@ command_compare(const char *text, const char *command) {
/*%
* This function is called to process the incoming command
- * when a control channel message is received.
+ * when a control channel message is received.
*/
isc_result_t
ns_control_docommand(isccc_sexpr_t *message, isc_buffer_t *text) {
@@ -170,10 +170,12 @@ ns_control_docommand(isccc_sexpr_t *message, isc_buffer_t *text) {
} else if (command_compare(command, NS_COMMAND_TSIGDELETE)) {
result = ns_server_tsigdelete(ns_g_server, command, text);
} else if (command_compare(command, NS_COMMAND_FREEZE)) {
- result = ns_server_freeze(ns_g_server, ISC_TRUE, command);
+ result = ns_server_freeze(ns_g_server, ISC_TRUE, command,
+ text);
} else if (command_compare(command, NS_COMMAND_UNFREEZE) ||
command_compare(command, NS_COMMAND_THAW)) {
- result = ns_server_freeze(ns_g_server, ISC_FALSE, command);
+ result = ns_server_freeze(ns_g_server, ISC_FALSE, command,
+ text);
} else if (command_compare(command, NS_COMMAND_RECURSING)) {
result = ns_server_dumprecursing(ns_g_server);
} else if (command_compare(command, NS_COMMAND_TIMERPOKE)) {
diff --git a/bin/named/include/named/server.h b/bin/named/include/named/server.h
index 43eccc4a63d4..1a3f746f3fb4 100644
--- a/bin/named/include/named/server.h
+++ b/bin/named/include/named/server.h
@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: server.h,v 1.93.120.2 2009/01/29 23:47:44 tbox Exp $ */
+/* $Id: server.h,v 1.93.120.3 2009/07/11 04:23:53 marka Exp $ */
#ifndef NAMED_SERVER_H
#define NAMED_SERVER_H 1
@@ -276,7 +276,8 @@ ns_server_tsigdelete(ns_server_t *server, char *command, isc_buffer_t *text);
* Enable or disable updates for a zone.
*/
isc_result_t
-ns_server_freeze(ns_server_t *server, isc_boolean_t freeze, char *args);
+ns_server_freeze(ns_server_t *server, isc_boolean_t freeze, char *args,
+ isc_buffer_t *text);
/*%
* Dump the current recursive queries.
diff --git a/bin/named/lwresd.8 b/bin/named/lwresd.8
index c0862aae1f49..56d272b23ad1 100644
--- a/bin/named/lwresd.8
+++ b/bin/named/lwresd.8
@@ -1,7 +1,7 @@
.\" Copyright (C) 2004, 2005, 2007-2009 Internet Systems Consortium, Inc. ("ISC")
.\" Copyright (C) 2000, 2001 Internet Software Consortium.
.\"
-.\" Permission to use, copy, modify, and distribute this software for any
+.\" Permission to use, copy, modify, and/or distribute this software for any
.\" purpose with or without fee is hereby granted, provided that the above
.\" copyright notice and this permission notice appear in all copies.
.\"
@@ -13,7 +13,7 @@
.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
.\" PERFORMANCE OF THIS SOFTWARE.
.\"
-.\" $Id: lwresd.8,v 1.29.14.1 2009/01/23 01:53:33 tbox Exp $
+.\" $Id: lwresd.8,v 1.29.14.2 2009/07/11 01:55:21 tbox Exp $
.\"
.hy 0
.ad l
diff --git a/bin/named/lwresd.html b/bin/named/lwresd.html
index 4c2b059fcfc6..728acc8a8164 100644
--- a/bin/named/lwresd.html
+++ b/bin/named/lwresd.html
@@ -2,7 +2,7 @@
- Copyright (C) 2004, 2005, 2007-2009 Internet Systems Consortium, Inc. ("ISC")
- Copyright (C) 2000, 2001 Internet Software Consortium.
-
- - Permission to use, copy, modify, and distribute this software for any
+ - Permission to use, copy, modify, and/or distribute this software for any
- purpose with or without fee is hereby granted, provided that the above
- copyright notice and this permission notice appear in all copies.
-
@@ -14,7 +14,7 @@
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
diff --git a/bin/named/named.8 b/bin/named/named.8
index 340840360fa6..287427274cbf 100644
--- a/bin/named/named.8
+++ b/bin/named/named.8
@@ -1,7 +1,7 @@
-.\" Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2009 Internet Systems Consortium, Inc. ("ISC")
.\" Copyright (C) 2000, 2001, 2003 Internet Software Consortium.
.\"
-.\" Permission to use, copy, modify, and distribute this software for any
+.\" Permission to use, copy, modify, and/or distribute this software for any
.\" purpose with or without fee is hereby granted, provided that the above
.\" copyright notice and this permission notice appear in all copies.
.\"
@@ -13,18 +13,18 @@
.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
.\" PERFORMANCE OF THIS SOFTWARE.
.\"
-.\" $Id: named.8,v 1.38 2008/11/07 01:11:19 tbox Exp $
+.\" $Id: named.8,v 1.38.14.2 2009/12/03 05:06:38 tbox Exp $
.\"
.hy 0
.ad l
.\" Title: named
.\" Author:
.\" Generator: DocBook XSL Stylesheets v1.71.1
-.\" Date: June 30, 2000
+.\" Date: May 21, 2009
.\" Manual: BIND9
.\" Source: BIND9
.\"
-.TH "NAMED" "8" "June 30, 2000" "BIND9" "BIND9"
+.TH "NAMED" "8" "May 21, 2009" "BIND9" "BIND9"
.\" disable hyphenation
.nh
.\" disable justification (adjust text to left margin only)
@@ -224,6 +224,16 @@ The
\fBnamed\fR
configuration file is too complex to describe in detail here. A complete description is provided in the
BIND 9 Administrator Reference Manual.
+.PP
+\fBnamed\fR
+inherits the
+\fBumask\fR
+(file creation mode mask) from the parent process. If files created by
+\fBnamed\fR, such as journal files, need to have custom permissions, the
+\fBumask\fR
+should be set explicitly in the script used to start the
+\fBnamed\fR
+process.
.SH "FILES"
.PP
\fI/etc/named.conf\fR
@@ -250,7 +260,7 @@ BIND 9 Administrator Reference Manual.
.PP
Internet Systems Consortium
.SH "COPYRIGHT"
-Copyright \(co 2004\-2008 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004\-2009 Internet Systems Consortium, Inc. ("ISC")
.br
Copyright \(co 2000, 2001, 2003 Internet Software Consortium.
.br
diff --git a/bin/named/named.conf.5 b/bin/named/named.conf.5
index 039c7954dfd8..3206f5d6bbcb 100644
--- a/bin/named/named.conf.5
+++ b/bin/named/named.conf.5
@@ -1,6 +1,6 @@
.\" Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC")
.\"
-.\" Permission to use, copy, modify, and distribute this software for any
+.\" Permission to use, copy, modify, and/or distribute this software for any
.\" purpose with or without fee is hereby granted, provided that the above
.\" copyright notice and this permission notice appear in all copies.
.\"
@@ -12,7 +12,7 @@
.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
.\" PERFORMANCE OF THIS SOFTWARE.
.\"
-.\" $Id: named.conf.5,v 1.36 2008/09/25 04:45:04 tbox Exp $
+.\" $Id: named.conf.5,v 1.36.48.1 2009/07/11 01:55:21 tbox Exp $
.\"
.hy 0
.ad l
diff --git a/bin/named/named.conf.html b/bin/named/named.conf.html
index 7bbbd0acbcbf..190f0c1b8886 100644
--- a/bin/named/named.conf.html
+++ b/bin/named/named.conf.html
@@ -1,7 +1,7 @@
-
+
diff --git a/bin/named/named.docbook b/bin/named/named.docbook
index f47eae1e6b4b..246c4f5d399e 100644
--- a/bin/named/named.docbook
+++ b/bin/named/named.docbook
@@ -2,7 +2,7 @@
"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
[]>
-
+
- June 30, 2000
+ May 21, 2009
@@ -42,6 +42,7 @@
200620072008
+ 2009Internet Systems Consortium, Inc. ("ISC")
@@ -374,6 +375,16 @@
in the
BIND 9 Administrator Reference Manual.
+
+
+ named inherits the umask
+ (file creation mode mask) from the parent process. If files
+ created by named, such as journal files,
+ need to have custom permissions, the umask
+ should be set explicitly in the script used to start the
+ named process.
+
+
diff --git a/bin/named/named.html b/bin/named/named.html
index 23c9a7c32bc5..35224759ee71 100644
--- a/bin/named/named.html
+++ b/bin/named/named.html
@@ -1,8 +1,8 @@
-
+
@@ -32,7 +32,7 @@
named
is a Domain Name System (DNS) server,
part of the BIND 9 distribution from ISC. For more
@@ -47,7 +47,7 @@
-
OPTIONS
+
OPTIONS
-4
@@ -220,7 +220,7 @@
-
SIGNALS
+
SIGNALS
In routine operation, signals should not be used to control
the nameserver; rndc should be used
@@ -241,16 +241,24 @@
-
CONFIGURATION
+
CONFIGURATION
The named configuration file is too complex
to describe in detail here. A complete description is provided
in the
BIND 9 Administrator Reference Manual.
+
+ named inherits the umask
+ (file creation mode mask) from the parent process. If files
+ created by named, such as journal files,
+ need to have custom permissions, the umask
+ should be set explicitly in the script used to start the
+ named process.
+
-
FILES
+
FILES
/etc/named.conf
@@ -263,7 +271,7 @@
-
SEE ALSO
+
SEE ALSO
RFC 1033,
RFC 1034,
RFC 1035,
@@ -276,7 +284,7 @@
-
AUTHOR
+
AUTHOR
Internet Systems Consortium
diff --git a/bin/named/query.c b/bin/named/query.c
index a56d2e646f7f..cef6d7f7c3a8 100644
--- a/bin/named/query.c
+++ b/bin/named/query.c
@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: query.c,v 1.313.20.7.12.4 2009/12/31 22:53:03 each Exp $ */
+/* $Id: query.c,v 1.313.20.16 2009/12/30 08:34:29 jinmei Exp $ */
/*! \file */
@@ -2244,7 +2244,8 @@ query_addns(ns_client_t *client, dns_db_t *db, dns_dbversion_t *version) {
static inline isc_result_t
query_addcnamelike(ns_client_t *client, dns_name_t *qname, dns_name_t *tname,
- dns_trust_t trust, dns_name_t **anamep, dns_rdatatype_t type)
+ dns_rdataset_t *dname, dns_name_t **anamep,
+ dns_rdatatype_t type)
{
dns_rdataset_t *rdataset;
dns_rdatalist_t *rdatalist;
@@ -2280,7 +2281,7 @@ query_addcnamelike(ns_client_t *client, dns_name_t *qname, dns_name_t *tname,
rdatalist->type = type;
rdatalist->covers = 0;
rdatalist->rdclass = client->message->rdclass;
- rdatalist->ttl = 0;
+ rdatalist->ttl = dname->ttl;
dns_name_toregion(tname, &r);
rdata->data = r.base;
@@ -2292,7 +2293,7 @@ query_addcnamelike(ns_client_t *client, dns_name_t *qname, dns_name_t *tname,
ISC_LIST_APPEND(rdatalist->rdata, rdata, link);
RUNTIME_CHECK(dns_rdatalist_tordataset(rdatalist, rdataset)
== ISC_R_SUCCESS);
- rdataset->trust = trust;
+ rdataset->trust = dname->trust;
query_addrrset(client, anamep, &rdataset, NULL, NULL,
DNS_SECTION_ANSWER);
@@ -2735,7 +2736,7 @@ query_addds(ns_client_t *client, dns_db_t *db, dns_dbnode_t *node,
return;
addnsec3:
- if (dns_db_iscache(db))
+ if (!dns_db_iszone(db))
goto cleanup;
/*
* Add the NSEC3 which proves the DS does not exist.
@@ -3317,6 +3318,14 @@ do { \
line = __LINE__; \
} while (0)
+#define RECURSE_ERROR(r) \
+do { \
+ if ((r) == DNS_R_DUPLICATE || (r) == DNS_R_DROP) \
+ QUERY_ERROR(r); \
+ else \
+ QUERY_ERROR(DNS_R_SERVFAIL); \
+} while (0)
+
/*
* Extract a network address from the RDATA of an A or AAAA
* record.
@@ -3604,7 +3613,7 @@ query_findclosestnsec3(dns_name_t *qname, dns_db_t *db,
dns_name_t *found)
{
unsigned char salt[256];
- size_t salt_length = sizeof(salt);
+ size_t salt_length;
isc_uint16_t iterations;
isc_result_t result;
unsigned int dboptions;
@@ -3999,14 +4008,8 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
if (result == ISC_R_SUCCESS)
client->query.attributes |=
NS_QUERYATTR_RECURSING;
- else if (result == DNS_R_DUPLICATE ||
- result == DNS_R_DROP) {
- /* Duplicate query. */
- QUERY_ERROR(result);
- } else {
- /* Unable to recurse. */
- QUERY_ERROR(DNS_R_SERVFAIL);
- }
+ else
+ RECURSE_ERROR(result);
goto cleanup;
} else {
/* Unable to give root server referral. */
@@ -4185,11 +4188,8 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
if (result == ISC_R_SUCCESS)
client->query.attributes |=
NS_QUERYATTR_RECURSING;
- else if (result == DNS_R_DUPLICATE ||
- result == DNS_R_DROP)
- QUERY_ERROR(result);
else
- QUERY_ERROR(DNS_R_SERVFAIL);
+ RECURSE_ERROR(result);
} else {
dns_fixedname_t fixed;
@@ -4603,7 +4603,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
*/
dns_name_init(tname, NULL);
(void)query_addcnamelike(client, client->query.qname, fname,
- trdataset->trust, &tname,
+ trdataset, &tname,
dns_rdatatype_cname);
if (tname != NULL)
dns_message_puttempname(client->message, &tname);
@@ -4729,7 +4729,8 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
client->query.attributes |=
NS_QUERYATTR_RECURSING;
else
- QUERY_ERROR(DNS_R_SERVFAIL); }
+ RECURSE_ERROR(result);
+ }
goto addauth;
}
/*
@@ -5123,9 +5124,17 @@ ns_query_start(ns_client_t *client) {
}
/*
- * Turn on minimal response for DNSKEY queries.
+ * Turn on minimal response for DNSKEY and DS queries.
*/
- if (qtype == dns_rdatatype_dnskey)
+ if (qtype == dns_rdatatype_dnskey || qtype == dns_rdatatype_ds)
+ client->query.attributes |= (NS_QUERYATTR_NOAUTHORITY |
+ NS_QUERYATTR_NOADDITIONAL);
+
+ /*
+ * Turn on minimal responses for EDNS/UDP bufsize 512 queries.
+ */
+ if (client->opt != NULL && client->udpsize <= 512U &&
+ (client->attributes & NS_CLIENTATTR_TCP) == 0)
client->query.attributes |= (NS_QUERYATTR_NOAUTHORITY |
NS_QUERYATTR_NOADDITIONAL);
diff --git a/bin/named/server.c b/bin/named/server.c
index e685e18dc336..b9259c71a7c1 100644
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: server.c,v 1.520.12.7 2009/01/30 03:53:38 marka Exp $ */
+/* $Id: server.c,v 1.520.12.11 2009/12/24 00:17:47 each Exp $ */
/*! \file */
@@ -2826,7 +2826,7 @@ set_limit(const cfg_obj_t **maps, const char *configname,
isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER,
result == ISC_R_SUCCESS ?
ISC_LOG_DEBUG(3) : ISC_LOG_WARNING,
- "set maximum %s to %" ISC_PRINT_QUADFORMAT "d: %s",
+ "set maximum %s to %" ISC_PRINT_QUADFORMAT "u: %s",
description, value, isc_result_totext(result));
}
@@ -4337,6 +4337,8 @@ zone_from_args(ns_server_t *server, char *args, dns_zone_t **zonep) {
/* Partial match? */
if (result != ISC_R_SUCCESS && *zonep != NULL)
dns_zone_detach(zonep);
+ if (result == DNS_R_PARTIALMATCH)
+ result = ISC_R_NOTFOUND;
fail1:
return (result);
}
@@ -5401,7 +5403,9 @@ ns_server_tsiglist(ns_server_t *server, isc_buffer_t *text) {
* Act on a "freeze" or "thaw" command from the command channel.
*/
isc_result_t
-ns_server_freeze(ns_server_t *server, isc_boolean_t freeze, char *args) {
+ns_server_freeze(ns_server_t *server, isc_boolean_t freeze, char *args,
+ isc_buffer_t *text)
+{
isc_result_t result, tresult;
dns_zone_t *zone = NULL;
dns_zonetype_t type;
@@ -5411,6 +5415,7 @@ ns_server_freeze(ns_server_t *server, isc_boolean_t freeze, char *args) {
char *journal;
const char *vname, *sep;
isc_boolean_t frozen;
+ const char *msg = NULL;
result = zone_from_args(server, args, &zone);
if (result != ISC_R_SUCCESS)
@@ -5441,27 +5446,52 @@ ns_server_freeze(ns_server_t *server, isc_boolean_t freeze, char *args) {
return (ISC_R_NOTFOUND);
}
+ result = isc_task_beginexclusive(server->task);
+ RUNTIME_CHECK(result == ISC_R_SUCCESS);
frozen = dns_zone_getupdatedisabled(zone);
if (freeze) {
- if (frozen)
+ if (frozen) {
+ msg = "WARNING: The zone was already frozen.\n"
+ "Someone else may be editing it or "
+ "it may still be re-loading.";
result = DNS_R_FROZEN;
- if (result == ISC_R_SUCCESS)
+ }
+ if (result == ISC_R_SUCCESS) {
result = dns_zone_flush(zone);
+ if (result != ISC_R_SUCCESS)
+ msg = "Flushing the zone updates to "
+ "disk failed.";
+ }
if (result == ISC_R_SUCCESS) {
journal = dns_zone_getjournal(zone);
if (journal != NULL)
(void)isc_file_remove(journal);
}
+ if (result == ISC_R_SUCCESS)
+ dns_zone_setupdatedisabled(zone, freeze);
} else {
if (frozen) {
- result = dns_zone_load(zone);
- if (result == DNS_R_CONTINUE ||
- result == DNS_R_UPTODATE)
+ result = dns_zone_loadandthaw(zone);
+ switch (result) {
+ case ISC_R_SUCCESS:
+ case DNS_R_UPTODATE:
+ msg = "The zone reload and thaw was "
+ "successful.";
result = ISC_R_SUCCESS;
+ break;
+ case DNS_R_CONTINUE:
+ msg = "A zone reload and thaw was started.\n"
+ "Check the logs to see the result.";
+ result = ISC_R_SUCCESS;
+ break;
+ }
}
}
- if (result == ISC_R_SUCCESS)
- dns_zone_setupdatedisabled(zone, freeze);
+ isc_task_endexclusive(server->task);
+
+ if (msg != NULL && strlen(msg) < isc_buffer_availablelength(text))
+ isc_buffer_putmem(text, (const unsigned char *)msg,
+ strlen(msg) + 1);
view = dns_zone_getview(zone);
if (strcmp(view->name, "_bind") == 0 ||
diff --git a/bin/named/statschannel.c b/bin/named/statschannel.c
index 81f40bb2d15a..4773ec6dcad5 100644
--- a/bin/named/statschannel.c
+++ b/bin/named/statschannel.c
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2008, 2009 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2008-2010 Internet Systems Consortium, Inc. ("ISC")
*
* Permission to use, copy, modify, and/or distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
@@ -14,7 +14,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: statschannel.c,v 1.14.64.6 2009/02/17 03:43:07 marka Exp $ */
+/* $Id: statschannel.c,v 1.14.64.11 2010/02/04 23:47:46 tbox Exp $ */
/*! \file */
@@ -70,6 +70,7 @@ stats_dumparg {
int ncounters; /* used for general statistics */
int *counterindices; /* used for general statistics */
isc_uint64_t *countervalues; /* used for general statistics */
+ isc_result_t result;
} stats_dumparg_t;
static isc_once_t once = ISC_ONCE_INIT;
@@ -95,6 +96,8 @@ static const char *sockstats_xmldesc[isc_sockstatscounter_max];
#define sockstats_xmldesc NULL
#endif /* HAVE_LIBXML2 */
+#define TRY0(a) do { xmlrc = (a); if (xmlrc < 0) goto error; } while(0)
+
/*%
* Mapping arrays to represent statistics counters in the order of our
* preference, regardless of the order of counter indices. For example,
@@ -129,11 +132,11 @@ init_desc(void) {
int i;
/* Initialize name server statistics */
- memset((void *)nsstats_desc, 0,
- dns_nsstatscounter_max * sizeof(nsstats_desc[0]));
+ for (i = 0; i < dns_nsstatscounter_max; i++)
+ nsstats_desc[i] = NULL;
#ifdef HAVE_LIBXML2
- memset((void *)nsstats_xmldesc, 0,
- dns_nsstatscounter_max * sizeof(nsstats_xmldesc[0]));
+ for (i = 0; i < dns_nsstatscounter_max; i++)
+ nsstats_xmldesc[i] = NULL;
#endif
#define SET_NSSTATDESC(counterid, desc, xmldesc) \
@@ -197,11 +200,11 @@ init_desc(void) {
INSIST(i == dns_nsstatscounter_max);
/* Initialize resolver statistics */
- memset((void *)resstats_desc, 0,
- dns_resstatscounter_max * sizeof(resstats_desc[0]));
+ for (i = 0; i < dns_resstatscounter_max; i++)
+ resstats_desc[i] = NULL;
#ifdef HAVE_LIBXML2
- memset((void *)resstats_xmldesc, 0,
- dns_resstatscounter_max * sizeof(resstats_xmldesc[0]));
+ for (i = 0; i < dns_resstatscounter_max; i++)
+ resstats_xmldesc[i] = NULL;
#endif
#define SET_RESSTATDESC(counterid, desc, xmldesc) \
@@ -267,11 +270,11 @@ init_desc(void) {
INSIST(i == dns_resstatscounter_max);
/* Initialize zone statistics */
- memset((void *)zonestats_desc, 0,
- dns_zonestatscounter_max * sizeof(zonestats_desc[0]));
+ for (i = 0; i < dns_zonestatscounter_max; i++)
+ zonestats_desc[i] = NULL;
#ifdef HAVE_LIBXML2
- memset((void *)zonestats_xmldesc, 0,
- dns_zonestatscounter_max * sizeof(zonestats_xmldesc[0]));
+ for (i = 0; i < dns_zonestatscounter_max; i++)
+ zonestats_xmldesc[i] = NULL;
#endif
#define SET_ZONESTATDESC(counterid, desc, xmldesc) \
@@ -299,11 +302,11 @@ init_desc(void) {
INSIST(i == dns_zonestatscounter_max);
/* Initialize socket statistics */
- memset((void *)sockstats_desc, 0,
- isc_sockstatscounter_max * sizeof(sockstats_desc[0]));
+ for (i = 0; i < isc_sockstatscounter_max; i++)
+ sockstats_desc[i] = NULL;
#ifdef HAVE_LIBXML2
- memset((void *)sockstats_xmldesc, 0,
- isc_sockstatscounter_max * sizeof(sockstats_xmldesc[0]));
+ for (i = 0; i < isc_sockstatscounter_max; i++)
+ sockstats_xmldesc[i] = NULL;
#endif
#define SET_SOCKSTATDESC(counterid, desc, xmldesc) \
@@ -437,7 +440,7 @@ generalstat_dump(isc_statscounter_t counter, isc_uint64_t val, void *arg) {
dumparg->countervalues[counter] = val;
}
-static void
+static isc_result_t
dump_counters(isc_stats_t *stats, statsformat_t type, void *arg,
const char *category, const char **desc, int ncounters,
int *indices, isc_uint64_t *values, int options)
@@ -448,6 +451,7 @@ dump_counters(isc_stats_t *stats, statsformat_t type, void *arg,
FILE *fp;
#ifdef HAVE_LIBXML2
xmlTextWriterPtr writer;
+ int xmlrc;
#endif
#ifndef HAVE_LIBXML2
@@ -480,31 +484,41 @@ dump_counters(isc_stats_t *stats, statsformat_t type, void *arg,
writer = arg;
if (category != NULL) {
- xmlTextWriterStartElement(writer,
- ISC_XMLCHAR
- category);
- xmlTextWriterStartElement(writer,
- ISC_XMLCHAR "name");
- xmlTextWriterWriteString(writer, ISC_XMLCHAR
- desc[index]);
- xmlTextWriterEndElement(writer); /* name */
+ TRY0(xmlTextWriterStartElement(writer,
+ ISC_XMLCHAR
+ category));
+ TRY0(xmlTextWriterStartElement(writer,
+ ISC_XMLCHAR
+ "name"));
+ TRY0(xmlTextWriterWriteString(writer,
+ ISC_XMLCHAR
+ desc[index]));
+ TRY0(xmlTextWriterEndElement(writer)); /* name */
- xmlTextWriterStartElement(writer, ISC_XMLCHAR
- "counter");
+ TRY0(xmlTextWriterStartElement(writer,
+ ISC_XMLCHAR
+ "counter"));
} else {
- xmlTextWriterStartElement(writer, ISC_XMLCHAR
- desc[index]);
+ TRY0(xmlTextWriterStartElement(writer,
+ ISC_XMLCHAR
+ desc[index]));
}
- xmlTextWriterWriteFormatString(writer,
- "%" ISC_PRINT_QUADFORMAT
- "u", value);
- xmlTextWriterEndElement(writer); /* counter */
+ TRY0(xmlTextWriterWriteFormatString(writer,
+ "%"
+ ISC_PRINT_QUADFORMAT
+ "u", value));
+ TRY0(xmlTextWriterEndElement(writer)); /* counter */
if (category != NULL)
- xmlTextWriterEndElement(writer); /* category */
+ TRY0(xmlTextWriterEndElement(writer)); /* category */
#endif
break;
}
}
+ return (ISC_R_SUCCESS);
+#ifdef HAVE_LIBXML2
+ error:
+ return (ISC_R_FAILURE);
+#endif
}
static void
@@ -515,6 +529,7 @@ rdtypestat_dump(dns_rdatastatstype_t type, isc_uint64_t val, void *arg) {
FILE *fp;
#ifdef HAVE_LIBXML2
xmlTextWriterPtr writer;
+ int xmlrc;
#endif
if ((DNS_RDATASTATSTYPE_ATTR(type) & DNS_RDATASTATSTYPE_ATTR_OTHERTYPE)
@@ -534,22 +549,28 @@ rdtypestat_dump(dns_rdatastatstype_t type, isc_uint64_t val, void *arg) {
#ifdef HAVE_LIBXML2
writer = dumparg->arg;
- xmlTextWriterStartElement(writer, ISC_XMLCHAR "rdtype");
+ TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "rdtype"));
- xmlTextWriterStartElement(writer, ISC_XMLCHAR "name");
- xmlTextWriterWriteString(writer, ISC_XMLCHAR typestr);
- xmlTextWriterEndElement(writer); /* name */
+ TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "name"));
+ TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR typestr));
+ TRY0(xmlTextWriterEndElement(writer)); /* name */
- xmlTextWriterStartElement(writer, ISC_XMLCHAR "counter");
- xmlTextWriterWriteFormatString(writer,
+ TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "counter"));
+ TRY0(xmlTextWriterWriteFormatString(writer,
"%" ISC_PRINT_QUADFORMAT "u",
- val);
- xmlTextWriterEndElement(writer); /* counter */
+ val));
+ TRY0(xmlTextWriterEndElement(writer)); /* counter */
- xmlTextWriterEndElement(writer); /* rdtype */
+ TRY0(xmlTextWriterEndElement(writer)); /* rdtype */
#endif
break;
}
+ return;
+#ifdef HAVE_LIBXML2
+ error:
+ dumparg->result = ISC_R_FAILURE;
+ return;
+#endif
}
static void
@@ -561,6 +582,7 @@ rdatasetstats_dump(dns_rdatastatstype_t type, isc_uint64_t val, void *arg) {
isc_boolean_t nxrrset = ISC_FALSE;
#ifdef HAVE_LIBXML2
xmlTextWriterPtr writer;
+ int xmlrc;
#endif
if ((DNS_RDATASTATSTYPE_ATTR(type) & DNS_RDATASTATSTYPE_ATTR_NXDOMAIN)
@@ -589,22 +611,28 @@ rdatasetstats_dump(dns_rdatastatstype_t type, isc_uint64_t val, void *arg) {
#ifdef HAVE_LIBXML2
writer = dumparg->arg;
- xmlTextWriterStartElement(writer, ISC_XMLCHAR "rrset");
- xmlTextWriterStartElement(writer, ISC_XMLCHAR "name");
- xmlTextWriterWriteFormatString(writer, "%s%s",
- nxrrset ? "!" : "", typestr);
- xmlTextWriterEndElement(writer); /* name */
+ TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "rrset"));
+ TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "name"));
+ TRY0(xmlTextWriterWriteFormatString(writer, "%s%s",
+ nxrrset ? "!" : "", typestr));
+ TRY0(xmlTextWriterEndElement(writer)); /* name */
- xmlTextWriterStartElement(writer, ISC_XMLCHAR "counter");
- xmlTextWriterWriteFormatString(writer,
+ TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "counter"));
+ TRY0(xmlTextWriterWriteFormatString(writer,
"%" ISC_PRINT_QUADFORMAT "u",
- val);
- xmlTextWriterEndElement(writer); /* counter */
+ val));
+ TRY0(xmlTextWriterEndElement(writer)); /* counter */
- xmlTextWriterEndElement(writer); /* rrset */
+ TRY0(xmlTextWriterEndElement(writer)); /* rrset */
#endif
break;
}
+ return;
+#ifdef HAVE_LIBXML2
+ error:
+ dumparg->result = ISC_R_FAILURE;
+#endif
+
}
static void
@@ -615,6 +643,7 @@ opcodestat_dump(dns_opcode_t code, isc_uint64_t val, void *arg) {
stats_dumparg_t *dumparg = arg;
#ifdef HAVE_LIBXML2
xmlTextWriterPtr writer;
+ int xmlrc;
#endif
isc_buffer_init(&b, codebuf, sizeof(codebuf) - 1);
@@ -630,30 +659,35 @@ opcodestat_dump(dns_opcode_t code, isc_uint64_t val, void *arg) {
#ifdef HAVE_LIBXML2
writer = dumparg->arg;
- xmlTextWriterStartElement(writer, ISC_XMLCHAR "opcode");
+ TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "opcode"));
- xmlTextWriterStartElement(writer, ISC_XMLCHAR "name");
- xmlTextWriterWriteString(writer, ISC_XMLCHAR codebuf);
- xmlTextWriterEndElement(writer); /* name */
+ TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "name"));
+ TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR codebuf));
+ TRY0(xmlTextWriterEndElement(writer)); /* name */
- xmlTextWriterStartElement(writer, ISC_XMLCHAR "counter");
- xmlTextWriterWriteFormatString(writer,
+ TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "counter"));
+ TRY0(xmlTextWriterWriteFormatString(writer,
"%" ISC_PRINT_QUADFORMAT "u",
- val);
- xmlTextWriterEndElement(writer); /* counter */
+ val));
+ TRY0(xmlTextWriterEndElement(writer)); /* counter */
- xmlTextWriterEndElement(writer); /* opcode */
+ TRY0(xmlTextWriterEndElement(writer)); /* opcode */
#endif
break;
}
+ return;
+
+#ifdef HAVE_LIBXML2
+ error:
+ dumparg->result = ISC_R_FAILURE;
+ return;
+#endif
}
#ifdef HAVE_LIBXML2
/* XXXMLG below here sucks. */
-#define TRY(a) do { result = (a); INSIST(result == ISC_R_SUCCESS); } while(0);
-#define TRY0(a) do { xmlrc = (a); INSIST(xmlrc >= 0); } while(0);
static isc_result_t
zone_xmlrender(dns_zone_t *zone, void *arg) {
@@ -663,47 +697,55 @@ zone_xmlrender(dns_zone_t *zone, void *arg) {
xmlTextWriterPtr writer = arg;
isc_stats_t *zonestats;
isc_uint64_t nsstat_values[dns_nsstatscounter_max];
+ int xmlrc;
+ isc_result_t result;
- xmlTextWriterStartElement(writer, ISC_XMLCHAR "zone");
+ TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "zone"));
dns_zone_name(zone, buf, sizeof(buf));
- xmlTextWriterStartElement(writer, ISC_XMLCHAR "name");
- xmlTextWriterWriteString(writer, ISC_XMLCHAR buf);
- xmlTextWriterEndElement(writer);
+ TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "name"));
+ TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR buf));
+ TRY0(xmlTextWriterEndElement(writer));
rdclass = dns_zone_getclass(zone);
dns_rdataclass_format(rdclass, buf, sizeof(buf));
- xmlTextWriterStartElement(writer, ISC_XMLCHAR "rdataclass");
- xmlTextWriterWriteString(writer, ISC_XMLCHAR buf);
- xmlTextWriterEndElement(writer);
+ TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "rdataclass"));
+ TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR buf));
+ TRY0(xmlTextWriterEndElement(writer));
- serial = dns_zone_getserial(zone);
- xmlTextWriterStartElement(writer, ISC_XMLCHAR "serial");
- xmlTextWriterWriteFormatString(writer, "%u", serial);
- xmlTextWriterEndElement(writer);
+ TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "serial"));
+ if (dns_zone_getserial2(zone, &serial) == ISC_R_SUCCESS)
+ TRY0(xmlTextWriterWriteFormatString(writer, "%u", serial));
+ else
+ TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR "-"));
+ TRY0(xmlTextWriterEndElement(writer));
zonestats = dns_zone_getrequeststats(zone);
if (zonestats != NULL) {
- xmlTextWriterStartElement(writer, ISC_XMLCHAR "counters");
- dump_counters(zonestats, statsformat_xml, writer, NULL,
- nsstats_xmldesc, dns_nsstatscounter_max,
- nsstats_index, nsstat_values,
- ISC_STATSDUMP_VERBOSE);
- xmlTextWriterEndElement(writer); /* counters */
+ TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "counters"));
+ result = dump_counters(zonestats, statsformat_xml, writer, NULL,
+ nsstats_xmldesc, dns_nsstatscounter_max,
+ nsstats_index, nsstat_values,
+ ISC_STATSDUMP_VERBOSE);
+ if (result != ISC_R_SUCCESS)
+ goto error;
+ TRY0(xmlTextWriterEndElement(writer)); /* counters */
}
- xmlTextWriterEndElement(writer); /* zone */
+ TRY0(xmlTextWriterEndElement(writer)); /* zone */
return (ISC_R_SUCCESS);
+ error:
+ return (ISC_R_FAILURE);
}
-static void
+static isc_result_t
generatexml(ns_server_t *server, int *buflen, xmlChar **buf) {
char boottime[sizeof "yyyy-mm-ddThh:mm:ssZ"];
char nowstr[sizeof "yyyy-mm-ddThh:mm:ssZ"];
isc_time_t now;
- xmlTextWriterPtr writer;
- xmlDocPtr doc;
+ xmlTextWriterPtr writer = NULL;
+ xmlDocPtr doc = NULL;
int xmlrc;
dns_view_t *view;
stats_dumparg_t dumparg;
@@ -712,12 +754,15 @@ generatexml(ns_server_t *server, int *buflen, xmlChar **buf) {
isc_uint64_t resstat_values[dns_resstatscounter_max];
isc_uint64_t zonestat_values[dns_zonestatscounter_max];
isc_uint64_t sockstat_values[isc_sockstatscounter_max];
+ isc_result_t result;
isc_time_now(&now);
isc_time_formatISO8601(&ns_g_boottime, boottime, sizeof boottime);
isc_time_formatISO8601(&now, nowstr, sizeof nowstr);
writer = xmlNewTextWriterDoc(&doc, 0);
+ if (writer == NULL)
+ goto error;
TRY0(xmlTextWriterStartDocument(writer, NULL, "UTF-8", NULL));
TRY0(xmlTextWriterWritePI(writer, ISC_XMLCHAR "xml-stylesheet",
ISC_XMLCHAR "type=\"text/xsl\" href=\"/bind9.xsl\""));
@@ -728,7 +773,7 @@ generatexml(ns_server_t *server, int *buflen, xmlChar **buf) {
TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "bind"));
TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "statistics"));
TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "version",
- ISC_XMLCHAR "2.0"));
+ ISC_XMLCHAR "2.2"));
/* Set common fields for statistics dump */
dumparg.type = statsformat_xml;
@@ -741,39 +786,55 @@ generatexml(ns_server_t *server, int *buflen, xmlChar **buf) {
view = ISC_LIST_HEAD(server->viewlist);
TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "views"));
while (view != NULL) {
- xmlTextWriterStartElement(writer, ISC_XMLCHAR "view");
+ TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "view"));
- xmlTextWriterStartElement(writer, ISC_XMLCHAR "name");
- xmlTextWriterWriteString(writer, ISC_XMLCHAR view->name);
- xmlTextWriterEndElement(writer);
+ TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "name"));
+ TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR view->name));
+ TRY0(xmlTextWriterEndElement(writer));
- xmlTextWriterStartElement(writer, ISC_XMLCHAR "zones");
- dns_zt_apply(view->zonetable, ISC_FALSE, zone_xmlrender,
- writer);
- xmlTextWriterEndElement(writer);
+ TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "zones"));
+ result = dns_zt_apply(view->zonetable, ISC_TRUE, zone_xmlrender,
+ writer);
+ if (result != ISC_R_SUCCESS)
+ goto error;
+ TRY0(xmlTextWriterEndElement(writer));
if (view->resquerystats != NULL) {
+ dumparg.result = ISC_R_SUCCESS;
dns_rdatatypestats_dump(view->resquerystats,
rdtypestat_dump, &dumparg, 0);
+ if (dumparg.result != ISC_R_SUCCESS)
+ goto error;
}
if (view->resstats != NULL) {
- dump_counters(view->resstats, statsformat_xml, writer,
- "resstat", resstats_xmldesc,
- dns_resstatscounter_max, resstats_index,
- resstat_values, ISC_STATSDUMP_VERBOSE);
+ result = dump_counters(view->resstats, statsformat_xml,
+ writer, "resstat",
+ resstats_xmldesc,
+ dns_resstatscounter_max,
+ resstats_index, resstat_values,
+ ISC_STATSDUMP_VERBOSE);
+ if (result != ISC_R_SUCCESS)
+ goto error;
}
cachestats = dns_db_getrrsetstats(view->cachedb);
if (cachestats != NULL) {
- xmlTextWriterStartElement(writer,
- ISC_XMLCHAR "cache");
+ TRY0(xmlTextWriterStartElement(writer,
+ ISC_XMLCHAR "cache"));
+ TRY0(xmlTextWriterWriteAttribute(writer,
+ ISC_XMLCHAR "name",
+ ISC_XMLCHAR
+ view->name));
+ dumparg.result = ISC_R_SUCCESS;
dns_rdatasetstats_dump(cachestats, rdatasetstats_dump,
&dumparg, 0);
- xmlTextWriterEndElement(writer); /* cache */
+ if (dumparg.result != ISC_R_SUCCESS)
+ goto error;
+ TRY0(xmlTextWriterEndElement(writer)); /* cache */
}
- xmlTextWriterEndElement(writer); /* view */
+ TRY0(xmlTextWriterEndElement(writer)); /* view */
view = ISC_LIST_NEXT(view, link);
}
@@ -788,44 +849,63 @@ generatexml(ns_server_t *server, int *buflen, xmlChar **buf) {
TRY0(xmlTextWriterEndElement(writer)); /* taskmgr */
TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "server"));
- xmlTextWriterStartElement(writer, ISC_XMLCHAR "boot-time");
- xmlTextWriterWriteString(writer, ISC_XMLCHAR boottime);
- xmlTextWriterEndElement(writer);
- xmlTextWriterStartElement(writer, ISC_XMLCHAR "current-time");
- xmlTextWriterWriteString(writer, ISC_XMLCHAR nowstr);
- xmlTextWriterEndElement(writer);
+ TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "boot-time"));
+ TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR boottime));
+ TRY0(xmlTextWriterEndElement(writer));
+ TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "current-time"));
+ TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR nowstr));
+ TRY0(xmlTextWriterEndElement(writer));
TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "requests"));
+ dumparg.result = ISC_R_SUCCESS;
dns_opcodestats_dump(server->opcodestats, opcodestat_dump, &dumparg,
0);
- xmlTextWriterEndElement(writer); /* requests */
+ if (dumparg.result != ISC_R_SUCCESS)
+ goto error;
+ TRY0(xmlTextWriterEndElement(writer)); /* requests */
TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "queries-in"));
+ dumparg.result = ISC_R_SUCCESS;
dns_rdatatypestats_dump(server->rcvquerystats, rdtypestat_dump,
&dumparg, 0);
- xmlTextWriterEndElement(writer); /* queries-in */
+ if (dumparg.result != ISC_R_SUCCESS)
+ goto error;
+ TRY0(xmlTextWriterEndElement(writer)); /* queries-in */
- dump_counters(server->nsstats, statsformat_xml, writer,
- "nsstat", nsstats_xmldesc, dns_nsstatscounter_max,
- nsstats_index, nsstat_values, ISC_STATSDUMP_VERBOSE);
+ result = dump_counters(server->nsstats, statsformat_xml, writer,
+ "nsstat", nsstats_xmldesc,
+ dns_nsstatscounter_max,
+ nsstats_index, nsstat_values,
+ ISC_STATSDUMP_VERBOSE);
+ if (result != ISC_R_SUCCESS)
+ goto error;
- dump_counters(server->zonestats, statsformat_xml, writer, "zonestat",
- zonestats_xmldesc, dns_zonestatscounter_max,
- zonestats_index, zonestat_values, ISC_STATSDUMP_VERBOSE);
+ result = dump_counters(server->zonestats, statsformat_xml, writer,
+ "zonestat", zonestats_xmldesc,
+ dns_zonestatscounter_max, zonestats_index,
+ zonestat_values, ISC_STATSDUMP_VERBOSE);
+ if (result != ISC_R_SUCCESS)
+ goto error;
/*
* Most of the common resolver statistics entries are 0, so we don't
* use the verbose dump here.
*/
- dump_counters(server->resolverstats, statsformat_xml, writer, "resstat",
- resstats_xmldesc, dns_resstatscounter_max, resstats_index,
- resstat_values, 0);
+ result = dump_counters(server->resolverstats, statsformat_xml, writer,
+ "resstat", resstats_xmldesc,
+ dns_resstatscounter_max, resstats_index,
+ resstat_values, 0);
+ if (result != ISC_R_SUCCESS)
+ goto error;
- dump_counters(server->sockstats, statsformat_xml, writer, "sockstat",
- sockstats_xmldesc, isc_sockstatscounter_max,
- sockstats_index, sockstat_values, ISC_STATSDUMP_VERBOSE);
+ result = dump_counters(server->sockstats, statsformat_xml, writer,
+ "sockstat", sockstats_xmldesc,
+ isc_sockstatscounter_max, sockstats_index,
+ sockstat_values, ISC_STATSDUMP_VERBOSE);
+ if (result != ISC_R_SUCCESS)
+ goto error;
- xmlTextWriterEndElement(writer); /* server */
+ TRY0(xmlTextWriterEndElement(writer)); /* server */
TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "memory"));
isc_mem_renderxml(writer);
@@ -841,6 +921,14 @@ generatexml(ns_server_t *server, int *buflen, xmlChar **buf) {
xmlDocDumpFormatMemoryEnc(doc, buf, buflen, "UTF-8", 1);
xmlFreeDoc(doc);
+ return (ISC_R_SUCCESS);
+
+ error:
+ if (writer != NULL)
+ xmlFreeTextWriter(writer);
+ if (doc != NULL)
+ xmlFreeDoc(doc);
+ return (ISC_R_FAILURE);
}
static void
@@ -859,21 +947,24 @@ render_index(const char *url, const char *querystring, void *arg,
unsigned char *msg;
int msglen;
ns_server_t *server = arg;
+ isc_result_t result;
UNUSED(url);
UNUSED(querystring);
- generatexml(server, &msglen, &msg);
+ result = generatexml(server, &msglen, &msg);
- *retcode = 200;
- *retmsg = "OK";
- *mimetype = "text/xml";
- isc_buffer_reinit(b, msg, msglen);
- isc_buffer_add(b, msglen);
- *freecb = wrap_xmlfree;
- *freecb_args = NULL;
+ if (result == ISC_R_SUCCESS) {
+ *retcode = 200;
+ *retmsg = "OK";
+ *mimetype = "text/xml";
+ isc_buffer_reinit(b, msg, msglen);
+ isc_buffer_add(b, msglen);
+ *freecb = wrap_xmlfree;
+ *freecb_args = NULL;
+ }
- return (ISC_R_SUCCESS);
+ return (result);
}
#endif /* HAVE_LIBXML2 */
@@ -1274,20 +1365,20 @@ ns_stats_dump(ns_server_t *server, FILE *fp) {
}
fprintf(fp, "++ Name Server Statistics ++\n");
- dump_counters(server->nsstats, statsformat_file, fp, NULL,
- nsstats_desc, dns_nsstatscounter_max, nsstats_index,
- nsstat_values, 0);
+ (void) dump_counters(server->nsstats, statsformat_file, fp, NULL,
+ nsstats_desc, dns_nsstatscounter_max,
+ nsstats_index, nsstat_values, 0);
fprintf(fp, "++ Zone Maintenance Statistics ++\n");
- dump_counters(server->zonestats, statsformat_file, fp, NULL,
- zonestats_desc, dns_zonestatscounter_max,
- zonestats_index, zonestat_values, 0);
+ (void) dump_counters(server->zonestats, statsformat_file, fp, NULL,
+ zonestats_desc, dns_zonestatscounter_max,
+ zonestats_index, zonestat_values, 0);
fprintf(fp, "++ Resolver Statistics ++\n");
fprintf(fp, "[Common]\n");
- dump_counters(server->resolverstats, statsformat_file, fp, NULL,
- resstats_desc, dns_resstatscounter_max, resstats_index,
- resstat_values, 0);
+ (void) dump_counters(server->resolverstats, statsformat_file, fp, NULL,
+ resstats_desc, dns_resstatscounter_max,
+ resstats_index, resstat_values, 0);
for (view = ISC_LIST_HEAD(server->viewlist);
view != NULL;
view = ISC_LIST_NEXT(view, link)) {
@@ -1297,9 +1388,9 @@ ns_stats_dump(ns_server_t *server, FILE *fp) {
fprintf(fp, "[View: default]\n");
else
fprintf(fp, "[View: %s]\n", view->name);
- dump_counters(view->resstats, statsformat_file, fp, NULL,
- resstats_desc, dns_resstatscounter_max,
- resstats_index, resstat_values, 0);
+ (void) dump_counters(view->resstats, statsformat_file, fp, NULL,
+ resstats_desc, dns_resstatscounter_max,
+ resstats_index, resstat_values, 0);
}
fprintf(fp, "++ Cache DB RRsets ++\n");
@@ -1320,9 +1411,9 @@ ns_stats_dump(ns_server_t *server, FILE *fp) {
}
fprintf(fp, "++ Socket I/O Statistics ++\n");
- dump_counters(server->sockstats, statsformat_file, fp, NULL,
- sockstats_desc, isc_sockstatscounter_max, sockstats_index,
- sockstat_values, 0);
+ (void) dump_counters(server->sockstats, statsformat_file, fp, NULL,
+ sockstats_desc, isc_sockstatscounter_max,
+ sockstats_index, sockstat_values, 0);
fprintf(fp, "++ Per Zone Query Statistics ++\n");
zone = NULL;
@@ -1343,9 +1434,10 @@ ns_stats_dump(ns_server_t *server, FILE *fp) {
fprintf(fp, " (view: %s)", view->name);
fprintf(fp, "]\n");
- dump_counters(zonestats, statsformat_file, fp, NULL,
- nsstats_desc, dns_nsstatscounter_max,
- nsstats_index, nsstat_values, 0);
+ (void) dump_counters(zonestats, statsformat_file, fp,
+ NULL, nsstats_desc,
+ dns_nsstatscounter_max,
+ nsstats_index, nsstat_values, 0);
}
}
diff --git a/bin/named/update.c b/bin/named/update.c
index b0a556d5cc41..74a192ad07b0 100644
--- a/bin/named/update.c
+++ b/bin/named/update.c
@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: update.c,v 1.151.12.5.12.1 2009/07/28 14:18:08 marka Exp $ */
+/* $Id: update.c,v 1.151.12.9 2009/12/30 04:02:56 marka Exp $ */
#include
@@ -3031,7 +3031,7 @@ check_dnssec(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
} else {
CHECK(get_iterations(db, ver, &iterations));
CHECK(dns_nsec3_maxiterations(db, ver, client->mctx, &max));
- if (iterations > max) {
+ if (max != 0 && iterations > max) {
flag = ISC_TRUE;
update_log(client, zone, ISC_LOG_WARNING,
"too many NSEC3 iterations (%u) for "
@@ -3157,6 +3157,24 @@ add_nsec3param_records(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
&newtuple));
CHECK(do_one_tuple(&newtuple, db, ver, diff));
}
+
+ /*
+ * Remove any existing CREATE request to add an
+ * otherwise indentical chain with a reversed
+ * OPTOUT state.
+ */
+ buf[1] ^= DNS_NSEC3FLAG_OPTOUT;
+ CHECK(rr_exists(db, ver, name, &rdata, &flag));
+
+ if (flag) {
+ CHECK(dns_difftuple_create(diff->mctx,
+ DNS_DIFFOP_DEL,
+ name, tuple->ttl,
+ &rdata,
+ &newtuple));
+ CHECK(do_one_tuple(&newtuple, db, ver, diff));
+ }
+
/*
* Remove the temporary add record.
*/
@@ -4140,9 +4158,6 @@ update_action(isc_task_t *task, isc_event_t *event) {
goto common;
failure:
- if (result == DNS_R_REFUSED)
- inc_stats(zone, dns_nsstatscounter_updaterej);
-
/*
* The reason for failure should have been logged at this point.
*/
diff --git a/bin/nsupdate/nsupdate.1 b/bin/nsupdate/nsupdate.1
index b0688a3ac263..83fd7d78da8f 100644
--- a/bin/nsupdate/nsupdate.1
+++ b/bin/nsupdate/nsupdate.1
@@ -1,7 +1,7 @@
.\" Copyright (C) 2004-2009 Internet Systems Consortium, Inc. ("ISC")
.\" Copyright (C) 2000-2003 Internet Software Consortium.
.\"
-.\" Permission to use, copy, modify, and distribute this software for any
+.\" Permission to use, copy, modify, and/or distribute this software for any
.\" purpose with or without fee is hereby granted, provided that the above
.\" copyright notice and this permission notice appear in all copies.
.\"
@@ -13,7 +13,7 @@
.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
.\" PERFORMANCE OF THIS SOFTWARE.
.\"
-.\" $Id: nsupdate.1,v 1.3.48.2 2009/03/10 01:54:11 tbox Exp $
+.\" $Id: nsupdate.1,v 1.3.48.3 2009/07/11 01:55:21 tbox Exp $
.\"
.hy 0
.ad l
diff --git a/bin/nsupdate/nsupdate.html b/bin/nsupdate/nsupdate.html
index dab7f9029cf9..9f45171a4fea 100644
--- a/bin/nsupdate/nsupdate.html
+++ b/bin/nsupdate/nsupdate.html
@@ -2,7 +2,7 @@
- Copyright (C) 2004-2009 Internet Systems Consortium, Inc. ("ISC")
- Copyright (C) 2000-2003 Internet Software Consortium.
-
- - Permission to use, copy, modify, and distribute this software for any
+ - Permission to use, copy, modify, and/or distribute this software for any
- purpose with or without fee is hereby granted, provided that the above
- copyright notice and this permission notice appear in all copies.
-
@@ -14,7 +14,7 @@
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
diff --git a/bin/rndc/rndc-confgen.8 b/bin/rndc/rndc-confgen.8
index 440870a54eda..d37c00adcd24 100644
--- a/bin/rndc/rndc-confgen.8
+++ b/bin/rndc/rndc-confgen.8
@@ -1,7 +1,7 @@
.\" Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
.\" Copyright (C) 2001, 2003 Internet Software Consortium.
.\"
-.\" Permission to use, copy, modify, and distribute this software for any
+.\" Permission to use, copy, modify, and/or distribute this software for any
.\" purpose with or without fee is hereby granted, provided that the above
.\" copyright notice and this permission notice appear in all copies.
.\"
@@ -13,7 +13,7 @@
.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
.\" PERFORMANCE OF THIS SOFTWARE.
.\"
-.\" $Id: rndc-confgen.8,v 1.20 2007/01/30 00:24:59 marka Exp $
+.\" $Id: rndc-confgen.8,v 1.20.418.1 2009/07/11 01:55:21 tbox Exp $
.\"
.hy 0
.ad l
diff --git a/bin/rndc/rndc-confgen.html b/bin/rndc/rndc-confgen.html
index 4be87afb9fa7..41debdcc910d 100644
--- a/bin/rndc/rndc-confgen.html
+++ b/bin/rndc/rndc-confgen.html
@@ -2,7 +2,7 @@
- Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
- Copyright (C) 2001, 2003 Internet Software Consortium.
-
- - Permission to use, copy, modify, and distribute this software for any
+ - Permission to use, copy, modify, and/or distribute this software for any
- purpose with or without fee is hereby granted, provided that the above
- copyright notice and this permission notice appear in all copies.
-
@@ -14,7 +14,7 @@
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
diff --git a/bin/rndc/rndc.8 b/bin/rndc/rndc.8
index 7f0dea110c7f..8ab0df2c8f07 100644
--- a/bin/rndc/rndc.8
+++ b/bin/rndc/rndc.8
@@ -1,7 +1,7 @@
.\" Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
.\" Copyright (C) 2000, 2001 Internet Software Consortium.
.\"
-.\" Permission to use, copy, modify, and distribute this software for any
+.\" Permission to use, copy, modify, and/or distribute this software for any
.\" purpose with or without fee is hereby granted, provided that the above
.\" copyright notice and this permission notice appear in all copies.
.\"
@@ -13,7 +13,7 @@
.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
.\" PERFORMANCE OF THIS SOFTWARE.
.\"
-.\" $Id: rndc.8,v 1.42 2007/12/14 22:37:22 marka Exp $
+.\" $Id: rndc.8,v 1.42.214.1 2009/07/11 01:55:21 tbox Exp $
.\"
.hy 0
.ad l
diff --git a/bin/rndc/rndc.conf.5 b/bin/rndc/rndc.conf.5
index 9e9bad41f361..edb3a360a81f 100644
--- a/bin/rndc/rndc.conf.5
+++ b/bin/rndc/rndc.conf.5
@@ -1,7 +1,7 @@
.\" Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
.\" Copyright (C) 2000, 2001 Internet Software Consortium.
.\"
-.\" Permission to use, copy, modify, and distribute this software for any
+.\" Permission to use, copy, modify, and/or distribute this software for any
.\" purpose with or without fee is hereby granted, provided that the above
.\" copyright notice and this permission notice appear in all copies.
.\"
@@ -13,7 +13,7 @@
.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
.\" PERFORMANCE OF THIS SOFTWARE.
.\"
-.\" $Id: rndc.conf.5,v 1.38 2007/05/09 13:35:57 marka Exp $
+.\" $Id: rndc.conf.5,v 1.38.366.1 2009/07/11 01:55:21 tbox Exp $
.\"
.hy 0
.ad l
diff --git a/bin/rndc/rndc.conf.html b/bin/rndc/rndc.conf.html
index 144cd1c91d84..6fbaaa2f7cc3 100644
--- a/bin/rndc/rndc.conf.html
+++ b/bin/rndc/rndc.conf.html
@@ -2,7 +2,7 @@
- Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
- Copyright (C) 2000, 2001 Internet Software Consortium.
-
- - Permission to use, copy, modify, and distribute this software for any
+ - Permission to use, copy, modify, and/or distribute this software for any
- purpose with or without fee is hereby granted, provided that the above
- copyright notice and this permission notice appear in all copies.
-
@@ -14,7 +14,7 @@
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
diff --git a/bin/rndc/rndc.html b/bin/rndc/rndc.html
index a8d11c47bd15..52c862a9747a 100644
--- a/bin/rndc/rndc.html
+++ b/bin/rndc/rndc.html
@@ -2,7 +2,7 @@
- Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
- Copyright (C) 2000, 2001 Internet Software Consortium.
-
- - Permission to use, copy, modify, and distribute this software for any
+ - Permission to use, copy, modify, and/or distribute this software for any
- purpose with or without fee is hereby granted, provided that the above
- copyright notice and this permission notice appear in all copies.
-
@@ -14,7 +14,7 @@
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
diff --git a/config.h.in b/config.h.in
index 97b13c4a5ad2..28ace46a71b9 100644
--- a/config.h.in
+++ b/config.h.in
@@ -16,7 +16,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: config.h.in,v 1.106.40.6 2009/03/13 05:35:43 marka Exp $ */
+/* $Id: config.h.in,v 1.106.40.11 2010/01/15 19:38:52 each Exp $ */
/*! \file */
@@ -144,6 +144,9 @@ int sigwait(const unsigned int *set, int *sig);
/* Define if threads need PTHREAD_SCOPE_SYSTEM */
#undef NEED_PTHREAD_SCOPE_SYSTEM
+/* Define if building universal (internal helper macro) */
+#undef AC_APPLE_UNIVERSAL_BUILD
+
/* Define if recvmsg() does not meet all of the BSD socket API specifications.
*/
#undef BROKEN_RECVMSG
@@ -163,6 +166,12 @@ int sigwait(const unsigned int *set, int *sig);
/* Define to 1 if you have the header file. */
#undef HAVE_DLFCN_H
+/* Define to 1 if you have the `EVP_sha256' function. */
+#undef HAVE_EVP_SHA256
+
+/* Define to 1 if you have the `EVP_sha512' function. */
+#undef HAVE_EVP_SHA512
+
/* Define to 1 if you have the header file. */
#undef HAVE_FCNTL_H
@@ -293,6 +302,9 @@ int sigwait(const unsigned int *set, int *sig);
/* Define to the one symbol short name of this package. */
#undef PACKAGE_TARNAME
+/* Define to the home page for this package. */
+#undef PACKAGE_URL
+
/* Define to the version of this package. */
#undef PACKAGE_VERSION
@@ -314,11 +326,15 @@ int sigwait(const unsigned int *set, int *sig);
#undef WITH_IDN
/* Define WORDS_BIGENDIAN to 1 if your processor stores words with the most
- significant byte first (like Motorola and SPARC, unlike Intel and VAX). */
-#if defined __BIG_ENDIAN__
-# define WORDS_BIGENDIAN 1
-#elif ! defined __LITTLE_ENDIAN__
-# undef WORDS_BIGENDIAN
+ significant byte first (like Motorola and SPARC, unlike Intel). */
+#if defined AC_APPLE_UNIVERSAL_BUILD
+# if defined __BIG_ENDIAN__
+# define WORDS_BIGENDIAN 1
+# endif
+#else
+# ifndef WORDS_BIGENDIAN
+# undef WORDS_BIGENDIAN
+# endif
#endif
/* Define to empty if `const' does not conform to ANSI C. */
diff --git a/configure.in b/configure.in
index 6ebdfddcca2f..76e1eb33ea45 100644
--- a/configure.in
+++ b/configure.in
@@ -1,4 +1,4 @@
-# Copyright (C) 2004-2009 Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004-2010 Internet Systems Consortium, Inc. ("ISC")
# Copyright (C) 1998-2003 Internet Software Consortium.
#
# Permission to use, copy, modify, and/or distribute this software for any
@@ -18,7 +18,7 @@ AC_DIVERT_PUSH(1)dnl
esyscmd([sed "s/^/# /" COPYRIGHT])dnl
AC_DIVERT_POP()dnl
-AC_REVISION($Revision: 1.457.26.9 $)
+AC_REVISION($Revision: 1.457.26.16 $)
AC_INIT(lib/dns/name.c)
AC_PREREQ(2.59)
@@ -28,6 +28,18 @@ AC_CONFIG_HEADER(config.h)
AC_CANONICAL_HOST
AC_PROG_MAKE_SET
+
+#
+# GNU libtool support
+#
+case $build_os in
+sunos*)
+ # Just set the maximum command line length for sunos as it otherwise
+ # takes a exceptionally long time to work it out. Required for libtool.
+ lt_cv_sys_max_cmd_len=4096;
+ ;;
+esac
+
AC_PROG_LIBTOOL
AC_PROG_INSTALL
AC_PROG_LN_S
@@ -466,7 +478,7 @@ AC_C_BIGENDIAN
OPENSSL_WARNING=
AC_MSG_CHECKING(for OpenSSL library)
AC_ARG_WITH(openssl,
-[ --with-openssl[=PATH] Build with OpenSSL [yes|no|path].
+[ --with-openssl[=PATH] Build with OpenSSL [yes|no|path].
(Required for DNSSEC)],
use_openssl="$withval", use_openssl="auto")
@@ -491,7 +503,9 @@ case "$use_openssl" in
auto)
DST_OPENSSL_INC=""
USE_OPENSSL=""
- AC_MSG_RESULT(not found)
+ AC_MSG_ERROR(
+[OpenSSL was not found in any of $openssldirs; use --with-openssl=/path
+If you don't want OpenSSL, use --without-openssl])
;;
*)
if test "$use_openssl" = "yes"
@@ -630,8 +644,10 @@ esac
else
AC_MSG_RESULT(no)
fi
+ AC_CHECK_FUNCS(EVP_sha256 EVP_sha512)
CFLAGS="$saved_cflags"
LIBS="$saved_libs"
+
;;
esac
@@ -652,7 +668,7 @@ DNS_CRYPTO_LIBS="$DNS_CRYPTO_LIBS $DNS_OPENSSL_LIBS"
AC_MSG_CHECKING(for PKCS11 support)
AC_ARG_WITH(pkcs11,
-[ --with-pkcs11 Build with PKCS11 support],
+[ --with-pkcs11 Build with PKCS11 support],
use_pkcs11="yes", use_pkcs11="no")
case "$use_pkcs11" in
@@ -670,7 +686,7 @@ AC_SUBST(USE_PKCS11)
AC_MSG_CHECKING(for GSSAPI library)
AC_ARG_WITH(gssapi,
-[ --with-gssapi=PATH Specify path for system-supplied GSSAPI],
+[ --with-gssapi=PATH Specify path for system-supplied GSSAPI],
use_gssapi="$withval", use_gssapi="no")
gssapidirs="/usr/local /usr/pkg /usr/kerberos /usr"
@@ -824,7 +840,7 @@ AC_SUBST(DNS_CRYPTO_LIBS)
#
AC_MSG_CHECKING(for random device)
AC_ARG_WITH(randomdev,
-[ --with-randomdev=PATH Specify path for random device],
+[ --with-randomdev=PATH Specify path for random device],
use_randomdev="$withval", use_randomdev="unspec")
case "$use_randomdev" in
@@ -997,7 +1013,7 @@ AC_SUBST(ISC_THREAD_DIR)
#
AC_MSG_CHECKING(for libxml2 library)
AC_ARG_WITH(libxml2,
-[ --with-libxml2[=PATH] Build with libxml2 library [yes|no|path]],
+[ --with-libxml2[=PATH] Build with libxml2 library [yes|no|path]],
use_libxml2="$withval", use_libxml2="auto")
case "$use_libxml2" in
@@ -1191,7 +1207,7 @@ esac
#
AC_MSG_CHECKING(whether to use purify)
AC_ARG_WITH(purify,
- [ --with-purify[=PATH] use Rational purify],
+ [ --with-purify[=PATH] use Rational purify],
use_purify="$withval", use_purify="no")
case "$use_purify" in
@@ -1228,19 +1244,9 @@ esac
AC_SUBST(PURIFY)
-#
-# GNU libtool support
-#
-case $build_os in
-sunos*)
- # Just set the maximum command line length for sunos as it otherwise
- # takes a exceptionally long time to work it out. Required for libtool.
- lt_cv_sys_max_cmd_len=4096;
- ;;
-esac
AC_ARG_WITH(libtool,
- [ --with-libtool use GNU libtool (following indented options supported)],
+ [ --with-libtool use GNU libtool],
use_libtool="$withval", use_libtool="no")
case $use_libtool in
@@ -1299,7 +1305,7 @@ AC_SUBST(LIBTOOL_IN_MAIN)
# IPv6
#
AC_ARG_ENABLE(ipv6,
- [ --enable-ipv6 use IPv6 [default=autodetect]])
+ [ --enable-ipv6 use IPv6 [default=autodetect]])
case "$enable_ipv6" in
yes|''|autodetect)
@@ -1330,7 +1336,7 @@ AC_TRY_COMPILE([
#
AC_MSG_CHECKING(for Kame IPv6 support)
AC_ARG_WITH(kame,
- [ --with-kame[=PATH] use Kame IPv6 [default path /usr/local/v6]],
+ [ --with-kame[=PATH] use Kame IPv6 [default path /usr/local/v6]],
use_kame="$withval", use_kame="no")
case "$use_kame" in
@@ -1780,7 +1786,7 @@ AC_SUBST(ISC_LWRES_GETADDRINFOPROTO)
AC_SUBST(ISC_LWRES_GETNAMEINFOPROTO)
AC_ARG_ENABLE(getifaddrs,
-[ --enable-getifaddrs Enable the use of getifaddrs() [[yes|no]].],
+[ --enable-getifaddrs Enable the use of getifaddrs() [[yes|no]].],
want_getifaddrs="$enableval", want_getifaddrs="yes")
#
@@ -1902,7 +1908,7 @@ AC_SUBST(ISC_EXTRA_SRCS)
# Use our own SPNEGO implementation?
#
AC_ARG_ENABLE(isc-spnego,
- [ --disable-isc-spnego use SPNEGO from GSSAPI library])
+ [ --disable-isc-spnego use SPNEGO from GSSAPI library])
if test -n "$USE_GSSAPI"
then
@@ -1967,7 +1973,7 @@ AC_SUBST(LWRES_PLATFORM_QUADFORMAT)
# Note it is very recommended to *not* disable chroot(),
# this is only because chroot() was made obsolete by Posix.
AC_ARG_ENABLE(chroot,
- [ --disable-chroot disable chroot])
+ [ --disable-chroot disable chroot])
case "$enable_chroot" in
yes|'')
AC_CHECK_FUNCS(chroot)
@@ -1976,7 +1982,7 @@ case "$enable_chroot" in
;;
esac
AC_ARG_ENABLE(linux-caps,
- [ --disable-linux-caps disable linux capabilities])
+ [ --disable-linux-caps disable linux capabilities])
case "$enable_linux_caps" in
yes|'')
AC_CHECK_HEADERS(linux/capability.h sys/capability.h)
@@ -2215,13 +2221,43 @@ AC_CHECK_FUNCS(nanosleep)
# Machine architecture dependent features
#
AC_ARG_ENABLE(atomic,
- [ --enable-atomic enable machine specific atomic operations
- [[default=autodetect]]],
+ [ --enable-atomic enable machine specific atomic operations
+ [[default=autodetect]]],
enable_atomic="$enableval",
enable_atomic="autodetect")
case "$enable_atomic" in
yes|''|autodetect)
- use_atomic=yes
+ case "$host" in
+ powerpc-ibm-aix*)
+ if test "X$GCC" = "Xyes"; then
+ AC_MSG_CHECKING([if asm("isc"); works])
+ AC_TRY_COMPILE(,[
+ main() { asm("ics"); exit(0); }
+ ],
+ [AC_MSG_RESULT(yes)
+ use_atomic=yes],
+ [
+ saved_cflags="$CFLAGS"
+ CFLAGS="$CFLAGS -Wa,-many"
+ AC_TRY_RUN([
+ main() { asm("ics"); exit(0); }
+ ],
+ [AC_MSG_RESULT([yes, required -Wa,-many])
+ use_atomic=yes],
+ [AC_MSG_RESULT([no, use_atomic disabled])
+ CFLAGS="$saved_cflags"
+ use_atomic=no],
+ [AC_MSG_RESULT([cross compile, assume yes])
+ CFLAGS="$saved_cflags"
+ use_atomic=yes])
+ ]
+ )
+ fi
+ ;;
+ *)
+ use_atomic=yes
+ ;;
+ esac
;;
no)
use_atomic=no
@@ -2248,8 +2284,16 @@ main() {
[arch=x86_32])
;;
x86_64-*|amd64-*)
- have_xaddq=yes
- arch=x86_64
+AC_TRY_RUN([
+main() {
+ exit((sizeof(void *) == 8) ? 0 : 1);
+}
+],
+ [arch=x86_64
+ have_xaddq=yes],
+ [arch=x86_32],
+ [arch=x86_64
+ have_xaddq=yes])
;;
alpha*-*)
arch=alpha
@@ -2354,9 +2398,9 @@ else
fi
if test "$have_xaddq" = "yes"; then
- ISC_PLATFORM_HAVEXADDQ="#define ISC_PLATFORM_HAVEXADDQ 1"
+ ISC_PLATFORM_HAVEXADDQ="#define ISC_PLATFORM_HAVEXADDQ 1"
else
- ISC_PLATFORM_HAVEXADDQ="#undef ISC_PLATFORM_HAVEXADDQ"
+ ISC_PLATFORM_HAVEXADDQ="#undef ISC_PLATFORM_HAVEXADDQ"
fi
AC_SUBST(ISC_PLATFORM_HAVEXADD)
@@ -2376,14 +2420,14 @@ AC_SUBST(ISC_ARCH_DIR)
# Activate "rrset-order fixed" or not?
#
AC_ARG_ENABLE(fixed-rrset,
- [ --enable-fixed-rrset enable fixed rrset ordering
- [[default=no]]],
+ [ --enable-fixed-rrset enable fixed rrset ordering
+ [[default=no]]],
enable_fixed="$enableval",
enable_fixed="no")
case "$enable_fixed" in
yes)
AC_DEFINE(DNS_RDATASET_FIXED, 1,
- [Define to enable "rrset-order fixed" syntax.])
+ [Define to enable "rrset-order fixed" syntax.])
;;
no)
;;
@@ -2503,7 +2547,7 @@ AC_SUBST($1)
#
AC_MSG_CHECKING(for Docbook-XSL path)
AC_ARG_WITH(docbook-xsl,
-[ --with-docbook-xsl=PATH Specify path for Docbook-XSL stylesheets],
+[ --with-docbook-xsl=PATH Specify path for Docbook-XSL stylesheets],
docbook_path="$withval", docbook_path="auto")
case "$docbook_path" in
auto)
@@ -2571,7 +2615,7 @@ AC_SUBST(XSLT_DB2LATEX_ADMONITIONS)
# IDN support
#
AC_ARG_WITH(idn,
- [ --with-idn[=MPREFIX] enable IDN support using idnkit [default PREFIX]],
+ [ --with-idn[=MPREFIX] enable IDN support using idnkit [default PREFIX]],
use_idn="$withval", use_idn="no")
case "$use_idn" in
yes)
@@ -2591,7 +2635,7 @@ esac
iconvinc=
iconvlib=
AC_ARG_WITH(libiconv,
- [ --with-libiconv[=IPREFIX] GNU libiconv are in IPREFIX [default PREFIX]],
+ [ --with-libiconv[=IPREFIX] GNU libiconv are in IPREFIX [default PREFIX]],
use_libiconv="$withval", use_libiconv="no")
case "$use_libiconv" in
yes)
@@ -2610,7 +2654,7 @@ no)
esac
AC_ARG_WITH(iconv,
- [ --with-iconv[=LIBSPEC] specify iconv library [default -liconv]],
+ [ --with-iconv[=LIBSPEC] specify iconv library [default -liconv]],
iconvlib="$withval")
case "$iconvlib" in
no)
@@ -2622,7 +2666,7 @@ yes)
esac
AC_ARG_WITH(idnlib,
- [ --with-idnlib=ARG specify libidnkit],
+ [ --with-idnlib=ARG specify libidnkit],
idnlib="$withval", idnlib="no")
if test "$idnlib" = yes; then
AC_MSG_ERROR([You must specify ARG for --with-idnlib.])
@@ -2678,7 +2722,7 @@ AC_SUBST_FILE(BIND9_MAKE_RULES)
BIND9_MAKE_RULES=$BIND9_TOP_BUILDDIR/make/rules
. $srcdir/version
-BIND9_VERSION="VERSION=${MAJORVER}.${MINORVER}.${PATCHVER}${RELEASETYPE}${RELEASEVER}"
+BIND9_VERSION="VERSION=${MAJORVER}.${MINORVER}${PATCHVER:+.}${PATCHVER}${RELEASETYPE}${RELEASEVER}"
AC_SUBST(BIND9_VERSION)
if test -z "$ac_configure_args"; then
@@ -2964,6 +3008,12 @@ AC_CONFIG_FILES([
AC_OUTPUT
+if test "X$USE_OPENSSL" = "X"; then
+cat << \EOF
+BIND is being built without OpenSSL. This means it will not have DNSSEC support.
+EOF
+fi
+
if test "X$OPENSSL_WARNING" != "X"; then
cat << \EOF
WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING
diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
index 0875e57ff09b..44e30b16da96 100644
--- a/doc/arm/Bv9ARM-book.xml
+++ b/doc/arm/Bv9ARM-book.xml
@@ -2,7 +2,7 @@
"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
[]>
-
+
BIND 9 Administrator Reference Manual
@@ -30,6 +30,7 @@
200720082009
+ 2010Internet Systems Consortium, Inc. ("ISC")
@@ -1679,6 +1680,11 @@ controls {
each dynamic update, because that would be too slow when a large
zone is updated frequently. Instead, the dump is delayed by
up to 15 minutes, allowing additional updates to take place.
+ During the dump process, transient files will be created
+ with the extensions .jnw and
+ .jbk; under ordinary circumstances, these
+ will be removed when the dump is complete, and can be safely
+ ignored.
@@ -2053,17 +2059,16 @@ nameserver 172.16.72.4
Automatic Generation
- The following command will generate a 128-bit (16 byte) HMAC-MD5
+ The following command will generate a 128-bit (16 byte) HMAC-SHA256
key as described above. Longer keys are better, but shorter keys
- are easier to read. Note that the maximum key length is 512 bits;
- keys longer than that will be digested with MD5 to produce a
- 128-bit key.
+ are easier to read. Note that the maximum key length is the digest
+ length, here 256 bits.
- dnssec-keygen -a hmac-md5 -b 128 -n HOST host1-host2.
+ dnssec-keygen -a hmac-sha256 -b 128 -n HOST host1-host2.
- The key is in the file Khost1-host2.+157+00000.private.
+ The key is in the file Khost1-host2.+163+00000.private.
Nothing directly uses this file, but the base-64 encoded string
following "Key:"
can be extracted from the file and used as a shared secret:
@@ -2105,18 +2110,16 @@ nameserver 172.16.72.4
key host1-host2. {
- algorithm hmac-md5;
+ algorithm hmac-sha256;
secret "La/E5CjG9O+os1jq0a2jdA==";
};
- The algorithm, hmac-md5, is the only one supported by BIND.
The secret is the one generated above. Since this is a secret, it
- is recommended that either named.conf be non-world
- readable, or the key directive be added to a non-world readable
- file that is included by
- named.conf.
+ is recommended that either named.conf be
+ non-world readable, or the key directive be added to a non-world
+ readable file that is included by named.conf.
At this point, the key is recognized. This means that if the
@@ -2445,14 +2448,17 @@ allow-update { key host1-host2. ;};
To enable named to respond appropriately
to DNS requests from DNSSEC aware clients,
dnssec-enable must be set to yes.
+ (This is the default setting.)
To enable named to validate answers from
- other servers both dnssec-enable and
- dnssec-validation must be set and some
- trusted-keys must be configured
- into named.conf.
+ other servers, the dnssec-enable and
+ dnssec-validation options must both be
+ set to yes (the default setting in BIND 9.5
+ and later), and at least one trust anchor must be configured
+ with a trusted-keys statement in
+ named.conf.
@@ -2531,6 +2537,41 @@ options {
the root key is not valid.
+
+ When DNSSEC validation is enabled and properly configured,
+ the resolver will reject any answers from signed, secure zones
+ which fail to validate, and will return SERVFAIL to the client.
+
+
+
+ Responses may fail to validate for any of several reasons,
+ including missing, expired, or invalid signatures, a key which
+ does not match the DS RRset in the parent zone, or an insecure
+ response from a zone which, according to its parent, should have
+ been secure.
+
+
+
+
+ When the validator receives a response from an unsigned zone
+ that has a signed parent, it must confirm with the parent
+ that the zone was intentionally left unsigned. It does
+ this by verifying, via signed and validated NSEC/NSEC3 records,
+ that the parent zone contains no DS records for the child.
+
+
+ If the validator can prove that the zone
+ is insecure, then the response is accepted. However, if it
+ cannot, then it must assume an insecure response to be a
+ forgery; it rejects the response and logs an error.
+
+
+ The logged error reads "insecurity proof failed" and
+ "got insecure response; parent indicates it should be secure".
+ (Prior to BIND 9.7, the logged error was "not insecure".
+ This referred to the zone, not the response.)
+
+
@@ -2539,10 +2580,9 @@ options {
BIND 9 fully supports all currently
- defined forms of IPv6
- name to address and address to name lookups. It will also use
- IPv6 addresses to make queries when running on an IPv6 capable
- system.
+ defined forms of IPv6 name to address and address to name
+ lookups. It will also use IPv6 addresses to make queries when
+ running on an IPv6 capable system.
@@ -4324,8 +4364,7 @@ category notify { null; };
Lame servers. These are misconfigurations
in remote servers, discovered by BIND 9 when trying to
- query
- those servers during resolution.
+ query those servers during resolution.
@@ -4785,7 +4824,7 @@ category notify { null; };
port ( ip_port | * ) ) ;
use-queryport-pool yes_or_no; queryport-pool-ports number;
- queryport-pool-interval number;
+ queryport-pool-updateinterval number; max-transfer-time-in number; max-transfer-time-out number; max-transfer-idle-in number;
@@ -4826,7 +4865,7 @@ category notify { null; };
lame-ttl number; max-ncache-ttl number; max-cache-ttl number;
- sig-validity-interval number ;
+ sig-validity-interval numbernumber ; sig-signing-nodes number ; sig-signing-signatures number ; sig-signing-type number ;
@@ -4909,11 +4948,12 @@ category notify { null; };
When performing dynamic update of secure zones, the
- directory where the public and private key files should be
- found,
- if different than the current working directory. The
- directory specified
- must be an absolute path.
+ directory where the public and private DNSSEC key files
+ should be found, if different than the current working
+ directory. The directory specified must be an absolute
+ path. (Note that this option has no effect on the paths
+ for files containing non-DNSSEC keys such as the
+ rndc.key.
@@ -5874,13 +5914,15 @@ options {
If yes, then an
IPv4-mapped IPv6 address will match any address match
list entries that match the corresponding IPv4 address.
- Enabling this option is sometimes useful on IPv6-enabled
- Linux
- systems, to work around a kernel quirk that causes IPv4
- TCP connections such as zone transfers to be accepted
- on an IPv6 socket using mapped addresses, causing
- address match lists designed for IPv4 to fail to match.
- The use of this option for any other purpose is discouraged.
+
+
+ This option was introduced to work around a kernel quirk
+ in some operating systems that causes IPv4 TCP
+ connections, such as zone transfers, to be accepted on an
+ IPv6 socket using mapped addresses. This caused address
+ match lists designed for IPv4 to fail to match. However,
+ named now solves this problem
+ internally. The use of this option is discouraged.
@@ -7919,7 +7961,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
The delay, in seconds, between sending sets of notify
- messages for a zone. The default is zero.
+ messages for a zone. The default is five (5) seconds.
@@ -8271,7 +8313,7 @@ XXX: end of RFC1918 addresses #defined out -->
query-source-v6 address ( ip_addr | * ) port ( ip_port | * ) ; use-queryport-pool yes_or_no; queryport-pool-ports number;
- queryport-pool-interval number;
+ queryport-pool-updateinterval number;
};
@@ -8751,7 +8793,7 @@ view "external" {
notify-source (ip4_addr | *) port ip_port ; notify-source-v6 (ip6_addr | *) port ip_port ; zone-statistics yes_or_no ;
- sig-validity-interval number ;
+ sig-validity-interval numbernumber ; sig-signing-nodes number ; sig-signing-signatures number ; sig-signing-type number ;
@@ -11205,6 +11247,16 @@ zone zone_nameclass$ORIGIN, $INCLUDE,
and $TTL.
+
+ The @ (at-sign)
+
+ When used in the label (or name) field, the asperand or
+ at-sign (@) symbol represents the current origin.
+ At the start of the zone file, it is the
+ <zone_name> (followed by
+ trailing dot).
+
+ The $ORIGIN Directive
@@ -11216,7 +11268,8 @@ zone zone_nameclass$ORIGIN
- <zone-name>.
+ <zone_name>.
+ (followed by trailing dot).
The current $ORIGIN is appended to
the domain specified in the $ORIGIN
argument if it is not absolute.
diff --git a/doc/arm/Bv9ARM.ch01.html b/doc/arm/Bv9ARM.ch01.html
index 320a86758374..ea561e6c36a2 100644
--- a/doc/arm/Bv9ARM.ch01.html
+++ b/doc/arm/Bv9ARM.ch01.html
@@ -1,8 +1,8 @@
-
+
@@ -45,17 +45,17 @@
The Berkeley Internet Name Domain
(BIND) implements a
@@ -87,7 +87,7 @@
-Organization of This Document
+Organization of This Document
In this document, Chapter 1 introduces
the basic DNS and BIND concepts. Chapter 2
@@ -116,7 +116,7 @@
-Conventions Used in This Document
+Conventions Used in This Document
In this document, we use the following general typographic
conventions:
@@ -243,7 +243,7 @@
-The Domain Name System (DNS)
+The Domain Name System (DNS)
The purpose of this document is to explain the installation
and upkeep of the BIND (Berkeley Internet
@@ -253,7 +253,7 @@
-DNS Fundamentals
+DNS Fundamentals
The Domain Name System (DNS) is a hierarchical, distributed
database. It stores information for mapping Internet host names to
@@ -275,7 +275,7 @@
-Domains and Domain Names
+Domains and Domain Names
The data stored in the DNS is identified by domain names that are organized as a tree according to
organizational or administrative boundaries. Each node of the tree,
@@ -321,7 +321,7 @@
-Zones
+Zones
To properly operate a name server, it is important to understand
the difference between a zone
@@ -374,7 +374,7 @@
-Authoritative Name Servers
+Authoritative Name Servers
Each zone is served by at least
one authoritative name server,
@@ -391,7 +391,7 @@
-The Primary Master
+The Primary Master
The authoritative server where the master copy of the zone
data is maintained is called the
@@ -411,7 +411,7 @@
-Slave Servers
+Slave Servers
The other authoritative servers, the slave
servers (also known as secondary servers)
@@ -427,7 +427,7 @@
-Stealth Servers
+Stealth Servers
Usually all of the zone's authoritative servers are listed in
NS records in the parent zone. These NS records constitute
@@ -462,7 +462,7 @@
-Caching Name Servers
+Caching Name Servers
The resolver libraries provided by most operating systems are
stub resolvers, meaning that they are not
@@ -489,7 +489,7 @@
-Forwarding
+Forwarding
Even a caching name server does not necessarily perform
the complete recursive lookup itself. Instead, it can
@@ -516,7 +516,7 @@
-Name Servers in Multiple Roles
+Name Servers in Multiple Roles
The BIND name server can
simultaneously act as
diff --git a/doc/arm/Bv9ARM.ch02.html b/doc/arm/Bv9ARM.ch02.html
index 831e7a12407e..b279c6754e71 100644
--- a/doc/arm/Bv9ARM.ch02.html
+++ b/doc/arm/Bv9ARM.ch02.html
@@ -1,8 +1,8 @@
-
+
DNS hardware requirements have
traditionally been quite modest.
@@ -73,7 +73,7 @@
-CPU Requirements
+CPU Requirements
CPU requirements for BIND 9 range from
i486-class machines
@@ -84,7 +84,7 @@
-Memory Requirements
+Memory Requirements
The memory of the server has to be large enough to fit the
cache and zones loaded off disk. The max-cache-size
@@ -107,7 +107,7 @@
-Name Server Intensive Environment Issues
+Name Server Intensive Environment Issues
For name server intensive environments, there are two alternative
configurations that may be used. The first is where clients and
@@ -124,7 +124,7 @@
-Supported Operating Systems
+Supported Operating Systems
ISC BIND 9 compiles and runs on a large
number
diff --git a/doc/arm/Bv9ARM.ch03.html b/doc/arm/Bv9ARM.ch03.html
index 9964823153fe..59d7e73d60bd 100644
--- a/doc/arm/Bv9ARM.ch03.html
+++ b/doc/arm/Bv9ARM.ch03.html
@@ -1,8 +1,8 @@
-
+
The following sample configuration is appropriate for a caching-only
name server for use by clients internal to a corporation. All
@@ -95,7 +95,7 @@ zone "0.0.127.in-addr.arpa" {
-An Authoritative-only Name Server
+An Authoritative-only Name Server
This sample configuration is for an authoritative-only server
that is the master server for "example.com"
@@ -137,7 +137,7 @@ zone "eng.example.com" {
-Load Balancing
+Load Balancing
A primitive form of load balancing can be achieved in
the DNS by using multiple records
@@ -280,10 +280,10 @@ zone "eng.example.com" {
-Name Server Operations
+Name Server Operations
-Tools for Use With the Name Server Daemon
+Tools for Use With the Name Server Daemon
This section describes several indispensable diagnostic,
administrative and monitoring tools available to the system
@@ -749,7 +749,7 @@ controls {
-Signals
+Signals
Certain UNIX signals cause the name server to take specific
actions, as described in the following table. These signals can
diff --git a/doc/arm/Bv9ARM.ch04.html b/doc/arm/Bv9ARM.ch04.html
index 123098e1eccc..2be5791f5181 100644
--- a/doc/arm/Bv9ARM.ch04.html
+++ b/doc/arm/Bv9ARM.ch04.html
@@ -1,8 +1,8 @@
-
+
@@ -149,6 +149,11 @@
each dynamic update, because that would be too slow when a large
zone is updated frequently. Instead, the dump is delayed by
up to 15 minutes, allowing additional updates to take place.
+ During the dump process, transient files will be created
+ with the extensions .jnw and
+ .jbk; under ordinary circumstances, these
+ will be removed when the dump is complete, and can be safely
+ ignored.
When a server is restarted after a shutdown or crash, it will replay
@@ -210,7 +215,7 @@
-Split DNS
+Split DNS
Setting up different views, or visibility, of the DNS space to
internal and external resolvers is usually referred to as a
@@ -240,7 +245,7 @@
-Example split DNS setup
+Example split DNS setup
Let's say a company named Example, Inc.
(example.com)
@@ -486,7 +491,7 @@ nameserver 172.16.72.4
-Generate Shared Keys for Each Pair of Hosts
+Generate Shared Keys for Each Pair of Hosts
A shared secret is generated to be shared between host1 and host2.
An arbitrary key name is chosen: "host1-host2.". The key name must
@@ -494,19 +499,18 @@ nameserver 172.16.72.4
-Automatic Generation
+Automatic Generation
- The following command will generate a 128-bit (16 byte) HMAC-MD5
+ The following command will generate a 128-bit (16 byte) HMAC-SHA256
key as described above. Longer keys are better, but shorter keys
- are easier to read. Note that the maximum key length is 512 bits;
- keys longer than that will be digested with MD5 to produce a
- 128-bit key.
+ are easier to read. Note that the maximum key length is the digest
+ length, here 256 bits.
- dnssec-keygen -a hmac-md5 -b 128 -n HOST host1-host2.
+ dnssec-keygen -a hmac-sha256 -b 128 -n HOST host1-host2.
- The key is in the file Khost1-host2.+157+00000.private.
+ The key is in the file Khost1-host2.+163+00000.private.
Nothing directly uses this file, but the base-64 encoded string
following "Key:"
can be extracted from the file and used as a shared secret:
@@ -519,7 +523,7 @@ nameserver 172.16.72.4
-Manual Generation
+Manual Generation
The shared secret is simply a random sequence of bits, encoded
in base-64. Most ASCII strings are valid base-64 strings (assuming
@@ -534,7 +538,7 @@ nameserver 172.16.72.4
-Copying the Shared Secret to Both Machines
+Copying the Shared Secret to Both Machines
This is beyond the scope of DNS. A secure transport mechanism
should be used. This could be secure FTP, ssh, telephone, etc.
@@ -542,7 +546,7 @@ nameserver 172.16.72.4
-Informing the Servers of the Key's Existence
+Informing the Servers of the Key's Existence
Imagine host1 and host 2
are
@@ -550,17 +554,15 @@ nameserver 172.16.72.4
- The algorithm, hmac-md5, is the only one supported by BIND.
The secret is the one generated above. Since this is a secret, it
- is recommended that either named.conf be non-world
- readable, or the key directive be added to a non-world readable
- file that is included by
- named.conf.
+ is recommended that either named.conf be
+ non-world readable, or the key directive be added to a non-world
+ readable file that is included by named.conf.
At this point, the key is recognized. This means that if the
@@ -571,7 +573,7 @@ key host1-host2. {
-Instructing the Server to Use the Key
+Instructing the Server to Use the Key
Since keys are shared between two hosts only, the server must
be told when keys are to be used. The following is added to the named.conf file
@@ -603,7 +605,7 @@ server 10.1.2.3 {
-TSIG Key Based Access Control
+TSIG Key Based Access Control
BIND allows IP addresses and ranges
to be specified in ACL
@@ -631,7 +633,7 @@ allow-update { key host1-host2. ;};
-Errors
+Errors
The processing of TSIG signed messages can result in
several errors. If a signed message is sent to a non-TSIG aware
@@ -657,7 +659,7 @@ allow-update { key host1-host2. ;};
-TKEY
+TKEY
TKEY
is a mechanism for automatically generating a shared secret
between two hosts. There are several "modes" of
@@ -693,7 +695,7 @@ allow-update { key host1-host2. ;};
-SIG(0)
+SIG(0)
BIND 9 partially supports DNSSEC SIG(0)
transaction signatures as specified in RFC 2535 and RFC 2931.
@@ -754,7 +756,7 @@ allow-update { key host1-host2. ;};
-Generating Keys
+Generating Keys
The dnssec-keygen program is used to
generate keys.
@@ -810,7 +812,7 @@ allow-update { key host1-host2. ;};
-Signing the Zone
+Signing the Zone
The dnssec-signzone program is used
to sign a zone.
@@ -852,18 +854,21 @@ allow-update { key host1-host2. ;};
-Configuring Servers
+Configuring Servers
To enable named to respond appropriately
to DNS requests from DNSSEC aware clients,
dnssec-enable must be set to yes.
+ (This is the default setting.)
To enable named to validate answers from
- other servers both dnssec-enable and
- dnssec-validation must be set and some
- trusted-keys must be configured
- into named.conf.
+ other servers, the dnssec-enable and
+ dnssec-validation options must both be
+ set to yes (the default setting in BIND 9.5
+ and later), and at least one trust anchor must be configured
+ with a trusted-keys statement in
+ named.conf.
trusted-keys are copies of DNSKEY RRs
@@ -936,17 +941,50 @@ options {
None of the keys listed in this example are valid. In particular,
the root key is not valid.
+
+ When DNSSEC validation is enabled and properly configured,
+ the resolver will reject any answers from signed, secure zones
+ which fail to validate, and will return SERVFAIL to the client.
+
+
+ Responses may fail to validate for any of several reasons,
+ including missing, expired, or invalid signatures, a key which
+ does not match the DS RRset in the parent zone, or an insecure
+ response from a zone which, according to its parent, should have
+ been secure.
+
+
+
Note
+
+ When the validator receives a response from an unsigned zone
+ that has a signed parent, it must confirm with the parent
+ that the zone was intentionally left unsigned. It does
+ this by verifying, via signed and validated NSEC/NSEC3 records,
+ that the parent zone contains no DS records for the child.
+
+
+ If the validator can prove that the zone
+ is insecure, then the response is accepted. However, if it
+ cannot, then it must assume an insecure response to be a
+ forgery; it rejects the response and logs an error.
+
+
+ The logged error reads "insecurity proof failed" and
+ "got insecure response; parent indicates it should be secure".
+ (Prior to BIND 9.7, the logged error was "not insecure".
+ This referred to the zone, not the response.)
+
+
-IPv6 Support in BIND 9
+IPv6 Support in BIND 9
BIND 9 fully supports all currently
- defined forms of IPv6
- name to address and address to name lookups. It will also use
- IPv6 addresses to make queries when running on an IPv6 capable
- system.
+ defined forms of IPv6 name to address and address to name
+ lookups. It will also use IPv6 addresses to make queries when
+ running on an IPv6 capable system.
The IPv6 AAAA record is a parallel to the IPv4 A record,
and, unlike the deprecated A6 record, specifies the entire
@@ -998,7 +1036,7 @@ host 3600 IN AAAA 2001:db8::1
-Address to Name Lookups Using Nibble Format
+Address to Name Lookups Using Nibble Format
When looking up an address in nibble format, the address
components are simply reversed, just as in IPv4, and
diff --git a/doc/arm/Bv9ARM.ch05.html b/doc/arm/Bv9ARM.ch05.html
index addc97ac643d..e84781f89324 100644
--- a/doc/arm/Bv9ARM.ch05.html
+++ b/doc/arm/Bv9ARM.ch05.html
@@ -1,8 +1,8 @@
-
+
Traditionally applications have been linked with a stub resolver
library that sends recursive DNS queries to a local caching name
diff --git a/doc/arm/Bv9ARM.ch06.html b/doc/arm/Bv9ARM.ch06.html
index 46fd0dd1f6a9..9da3432bc865 100644
--- a/doc/arm/Bv9ARM.ch06.html
+++ b/doc/arm/Bv9ARM.ch06.html
@@ -1,8 +1,8 @@
-
+
-logging Statement Definition and
+logging Statement Definition and
Usage
The logging statement configures a
@@ -1158,7 +1158,7 @@
-The channel Phrase
+The channel Phrase
All log output goes to one or more channels;
you can make as many of them as you want.
@@ -1666,8 +1666,7 @@ category notify { null; };
Lame servers. These are misconfigurations
in remote servers, discovered by BIND 9 when trying to
- query
- those servers during resolution.
+ query those servers during resolution.
@@ -1724,7 +1723,7 @@ category notify { null; };
-The query-errors Category
+The query-errors Category
The query-errors category is
specifically intended for debugging purposes: To identify
@@ -1944,7 +1943,7 @@ category notify { null; };
-lwres Statement Grammar
+lwres Statement Grammar
This is the grammar of the lwres
statement in the named.conf file:
@@ -1959,7 +1958,7 @@ category notify { null; };
-lwres Statement Definition and Usage
+lwres Statement Definition and Usage
The lwres statement configures the
name
@@ -2010,14 +2009,14 @@ category notify { null; };
-masters Statement Definition and
+masters Statement Definition and
Usage
masters
lists allow for a common set of masters to be easily used by
@@ -2026,7 +2025,7 @@ category notify { null; };
-options Statement Grammar
+options Statement Grammar
This is the grammar of the options
statement in the named.conf file:
@@ -2115,7 +2114,7 @@ category notify { null; };
[ port ( ip_port | * ) ] ) ; ]
[ use-queryport-pool yes_or_no; ]
[ queryport-pool-ports number; ]
- [ queryport-pool-interval number; ]
+ [ queryport-pool-updateinterval number; ]
[ max-transfer-time-in number; ]
[ max-transfer-time-out number; ]
[ max-transfer-idle-in number; ]
@@ -2156,7 +2155,7 @@ category notify { null; };
[ lame-ttl number; ]
[ max-ncache-ttl number; ]
[ max-cache-ttl number; ]
- [ sig-validity-interval number ; ]
+ [ sig-validity-interval number [number] ; ]
[ sig-signing-nodes number ; ]
[ sig-signing-signatures number ; ]
[ sig-signing-type number ; ]
@@ -2228,11 +2227,12 @@ category notify { null; };
key-directory
When performing dynamic update of secure zones, the
- directory where the public and private key files should be
- found,
- if different than the current working directory. The
- directory specified
- must be an absolute path.
+ directory where the public and private DNSSEC key files
+ should be found, if different than the current working
+ directory. The directory specified must be an absolute
+ path. (Note that this option has no effect on the paths
+ for files containing non-DNSSEC keys such as the
+ rndc.key.
named-xfer
@@ -2990,18 +2990,22 @@ options {
match-mapped-addresses
-
+
+
If yes, then an
IPv4-mapped IPv6 address will match any address match
list entries that match the corresponding IPv4 address.
- Enabling this option is sometimes useful on IPv6-enabled
- Linux
- systems, to work around a kernel quirk that causes IPv4
- TCP connections such as zone transfers to be accepted
- on an IPv6 socket using mapped addresses, causing
- address match lists designed for IPv4 to fail to match.
- The use of this option for any other purpose is discouraged.
-
+
+
+ This option was introduced to work around a kernel quirk
+ in some operating systems that causes IPv4 TCP
+ connections, such as zone transfers, to be accepted on an
+ IPv6 socket using mapped addresses. This caused address
+ match lists designed for IPv4 to fail to match. However,
+ named now solves this problem
+ internally. The use of this option is discouraged.
+
+
ixfr-from-differences
@@ -3181,7 +3185,7 @@ options {
-Forwarding
+Forwarding
The forwarding facility can be used to create a large site-wide
cache on a few servers, reducing traffic over links to external
@@ -3225,7 +3229,7 @@ options {
-Dual-stack Servers
+Dual-stack Servers
Dual-stack servers are used as servers of last resort to work
around
@@ -3422,7 +3426,7 @@ options {
-Interfaces
+Interfaces
The interfaces and ports that the server will answer queries
from may be specified using the listen-on option. listen-on takes
@@ -3874,7 +3878,7 @@ avoid-v6-udp-ports {};
The server's usage of many system resources can be limited.
Scaled values are allowed when specifying resource limits. For
@@ -4078,7 +4082,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
The delay, in seconds, between sending sets of notify
- messages for a zone. The default is zero.
+ messages for a zone. The default is five (5) seconds.
-trusted-keys Statement Definition
+trusted-keys Statement Definition
and Usage
The trusted-keys statement defines
@@ -5162,7 +5166,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
-view Statement Definition and Usage
+view Statement Definition and Usage
The view statement is a powerful
feature
@@ -5315,7 +5319,7 @@ view "external" {
[ notify-source (ip4_addr | *) [port ip_port] ; ]
[ notify-source-v6 (ip6_addr | *) [port ip_port] ; ]
[ zone-statistics yes_or_no ; ]
- [ sig-validity-interval number ; ]
+ [ sig-validity-interval number [number] ; ]
[ sig-signing-nodes number ; ]
[ sig-signing-signatures number ; ]
[ sig-signing-type number ; ]
@@ -5428,10 +5432,10 @@ zone zone_name [
-zone Statement Definition and Usage
+zone Statement Definition and Usage
-Zone Types
+Zone Types
@@ -5642,7 +5646,7 @@ zone zone_name [
-Class
+Class
The zone's name may optionally be followed by a class. If
a class is not specified, class IN (for Internet),
@@ -5664,7 +5668,7 @@ zone zone_name [
-Zone Options
+Zone Options
allow-notify
@@ -6243,7 +6247,7 @@ zone zone_name [
-Zone File
+Zone File
Types of Resource Records and When to Use Them
@@ -6256,7 +6260,7 @@ zone zone_name [
-Resource Records
+Resource Records
A domain name identifies a node. Each node has a set of
resource information, which may be empty. The set of resource
@@ -6993,7 +6997,7 @@ zone zone_name [
-Textual expression of RRs
+Textual expression of RRs
RRs are represented in binary form in the packets of the DNS
protocol, and are usually represented in highly encoded form
@@ -7196,7 +7200,7 @@ zone zone_name [
-Discussion of MX Records
+Discussion of MX Records
As described above, domain servers store information as a
series of resource records, each of which contains a particular
@@ -7452,7 +7456,7 @@ zone zone_name [
-Inverse Mapping in IPv4
+Inverse Mapping in IPv4
Reverse name resolution (that is, translation from IP address
to name) is achieved by means of the in-addr.arpa domain
@@ -7513,7 +7517,7 @@ zone zone_name [
-Other Zone File Directives
+Other Zone File Directives
The Master File Format was initially defined in RFC 1035 and
has subsequently been extended. While the Master File Format
@@ -7528,7 +7532,18 @@ zone zone_name [
-The $ORIGIN Directive
+The @ (at-sign)
+
+ When used in the label (or name) field, the asperand or
+ at-sign (@) symbol represents the current origin.
+ At the start of the zone file, it is the
+ <zone_name> (followed by
+ trailing dot).
+
+
+
+
+The $ORIGIN Directive
Syntax: $ORIGINdomain-name
@@ -7538,7 +7553,8 @@ zone zone_name [$ORIGIN
- <zone-name>.
+ <zone_name>.
+ (followed by trailing dot).
The current $ORIGIN is appended to
the domain specified in the $ORIGIN
argument if it is not absolute.
@@ -7556,7 +7572,7 @@ WWW.EXAMPLE.COM. CNAME MAIN-SERVER.EXAMPLE.COM.
Socket I/O statistics counters are defined per socket
types, which are
@@ -9244,7 +9260,7 @@ $GENERATE 1-127 $ CNAME $.0
-Compatibility with BIND 8 Counters
+Compatibility with BIND 8 Counters
Most statistics counters that were available
in BIND 8 are also supported in
diff --git a/doc/arm/Bv9ARM.ch07.html b/doc/arm/Bv9ARM.ch07.html
index ca12cb3c4357..dd6991c50401 100644
--- a/doc/arm/Bv9ARM.ch07.html
+++ b/doc/arm/Bv9ARM.ch07.html
@@ -1,8 +1,8 @@
-
+
On UNIX servers, it is possible to run BIND
@@ -145,7 +145,7 @@ zone "example.com" {
-The chroot Environment
+The chroot Environment
In order for a chroot environment
to
@@ -173,7 +173,7 @@ zone "example.com" {
-Using the setuid Function
+Using the setuid Function
Prior to running the named daemon,
use
diff --git a/doc/arm/Bv9ARM.ch08.html b/doc/arm/Bv9ARM.ch08.html
index 5e547eb48e01..8b5ebbed550b 100644
--- a/doc/arm/Bv9ARM.ch08.html
+++ b/doc/arm/Bv9ARM.ch08.html
@@ -1,8 +1,8 @@
-
+
-It's not working; how can I figure out what's wrong?
+It's not working; how can I figure out what's wrong?
The best solution to solving installation and
configuration issues is to take preventative measures by setting
@@ -68,7 +68,7 @@
-Incrementing and Changing the Serial Number
+Incrementing and Changing the Serial Number
Zone serial numbers are just numbers — they aren't
date related. A lot of people set them to a number that
@@ -95,7 +95,7 @@
-Where Can I Get Help?
+Where Can I Get Help?
The Internet Systems Consortium
(ISC) offers a wide range
diff --git a/doc/arm/Bv9ARM.ch09.html b/doc/arm/Bv9ARM.ch09.html
index 87134e05c3d2..72ab6fe248f6 100644
--- a/doc/arm/Bv9ARM.ch09.html
+++ b/doc/arm/Bv9ARM.ch09.html
@@ -1,8 +1,8 @@
-
+
A Brief History of the DNS and BIND
@@ -162,7 +162,7 @@
-General DNS Reference Information
+General DNS Reference Information
IPv6 addresses (AAAA)
@@ -250,17 +250,17 @@
-Bibliography
+Bibliography
Standards
-
[RFC974] C.Partridge. Mail Routing and the Domain System. January 1986.
+
[RFC974] C.Partridge. Mail Routing and the Domain System. January 1986.
-
[RFC1034] P.V.Mockapetris. Domain Names — Concepts and Facilities. November 1987.
+
[RFC1034] P.V.Mockapetris. Domain Names — Concepts and Facilities. November 1987.
-
[RFC1035] P. V.Mockapetris. Domain Names — Implementation and
+
[RFC1035] P. V.Mockapetris. Domain Names — Implementation and
Specification. November 1987.
@@ -268,42 +268,42 @@
Proposed Standards
-
[RFC2181] R., R. BushElz. Clarifications to the DNS
+
[RFC2181] R., R. BushElz. Clarifications to the DNS
Specification. July 1997.
-
[RFC2308] M.Andrews. Negative Caching of DNS
+
[RFC2308] M.Andrews. Negative Caching of DNS
Queries. March 1998.
-
[RFC1995] M.Ohta. Incremental Zone Transfer in DNS. August 1996.
+
[RFC1995] M.Ohta. Incremental Zone Transfer in DNS. August 1996.
-
[RFC1996] P.Vixie. A Mechanism for Prompt Notification of Zone Changes. August 1996.
+
[RFC1996] P.Vixie. A Mechanism for Prompt Notification of Zone Changes. August 1996.
-
[RFC2136] P.Vixie, S.Thomson, Y.Rekhter, and J.Bound. Dynamic Updates in the Domain Name System. April 1997.
+
[RFC2136] P.Vixie, S.Thomson, Y.Rekhter, and J.Bound. Dynamic Updates in the Domain Name System. April 1997.
-
[RFC2671] P.Vixie. Extension Mechanisms for DNS (EDNS0). August 1997.
+
[RFC2671] P.Vixie. Extension Mechanisms for DNS (EDNS0). August 1997.
-
[RFC2672] M.Crawford. Non-Terminal DNS Name Redirection. August 1999.
+
[RFC2672] M.Crawford. Non-Terminal DNS Name Redirection. August 1999.
-
[RFC2845] P.Vixie, O.Gudmundsson, D.Eastlake, 3rd, and B.Wellington. Secret Key Transaction Authentication for DNS (TSIG). May 2000.
+
[RFC2845] P.Vixie, O.Gudmundsson, D.Eastlake, 3rd, and B.Wellington. Secret Key Transaction Authentication for DNS (TSIG). May 2000.
-
[RFC2930] D.Eastlake, 3rd. Secret Key Establishment for DNS (TKEY RR). September 2000.
+
[RFC2930] D.Eastlake, 3rd. Secret Key Establishment for DNS (TKEY RR). September 2000.
-
[RFC2931] D.Eastlake, 3rd. DNS Request and Transaction Signatures (SIG(0)s). September 2000.
+
[RFC2931] D.Eastlake, 3rd. DNS Request and Transaction Signatures (SIG(0)s). September 2000.
-
[RFC3007] B.Wellington. Secure Domain Name System (DNS) Dynamic Update. November 2000.
+
[RFC3007] B.Wellington. Secure Domain Name System (DNS) Dynamic Update. November 2000.
-
[RFC3645] S.Kwan, P.Garg, J.Gilroy, L.Esibov, J.Westhead, and R.Hall. Generic Security Service Algorithm for Secret
+
[RFC3645] S.Kwan, P.Garg, J.Gilroy, L.Esibov, J.Westhead, and R.Hall. Generic Security Service Algorithm for Secret
Key Transaction Authentication for DNS
(GSS-TSIG). October 2003.
@@ -312,19 +312,19 @@
DNS Security Proposed Standards
-
[RFC3225] D.Conrad. Indicating Resolver Support of DNSSEC. December 2001.
+
[RFC3225] D.Conrad. Indicating Resolver Support of DNSSEC. December 2001.
-
[RFC3833] D.Atkins and R.Austein. Threat Analysis of the Domain Name System (DNS). August 2004.
+
[RFC3833] D.Atkins and R.Austein. Threat Analysis of the Domain Name System (DNS). August 2004.
-
[RFC4033] R.Arends, R.Austein, M.Larson, D.Massey, and S.Rose. DNS Security Introduction and Requirements. March 2005.
+
[RFC4033] R.Arends, R.Austein, M.Larson, D.Massey, and S.Rose. DNS Security Introduction and Requirements. March 2005.
-
[RFC4034] R.Arends, R.Austein, M.Larson, D.Massey, and S.Rose. Resource Records for the DNS Security Extensions. March 2005.
+
[RFC4034] R.Arends, R.Austein, M.Larson, D.Massey, and S.Rose. Resource Records for the DNS Security Extensions. March 2005.
-
[RFC4035] R.Arends, R.Austein, M.Larson, D.Massey, and S.Rose. Protocol Modifications for the DNS
+
[RFC4035] R.Arends, R.Austein, M.Larson, D.Massey, and S.Rose. Protocol Modifications for the DNS
Security Extensions. March 2005.
@@ -332,146 +332,146 @@
Other Important RFCs About DNS
Implementation
-
[RFC1535] E.Gavron. A Security Problem and Proposed Correction With Widely
+
[RFC1535] E.Gavron. A Security Problem and Proposed Correction With Widely
Deployed DNS Software.. October 1993.
-
[RFC1536] A.Kumar, J.Postel, C.Neuman, P.Danzig, and S.Miller. Common DNS Implementation
+
[RFC1536] A.Kumar, J.Postel, C.Neuman, P.Danzig, and S.Miller. Common DNS Implementation
Errors and Suggested Fixes. October 1993.
-
[RFC1982] R.Elz and R.Bush. Serial Number Arithmetic. August 1996.
+
[RFC1982] R.Elz and R.Bush. Serial Number Arithmetic. August 1996.
-
[RFC4074] Y.Morishita and T.Jinmei. Common Misbehaviour Against DNS
+
[RFC4074] Y.Morishita and T.Jinmei. Common Misbehaviour Against DNS
Queries for IPv6 Addresses. May 2005.
Resource Record Types
-
[RFC1183] C.F.Everhart, L. A.Mamakos, R.Ullmann, and P.Mockapetris. New DNS RR Definitions. October 1990.
+
[RFC1183] C.F.Everhart, L. A.Mamakos, R.Ullmann, and P.Mockapetris. New DNS RR Definitions. October 1990.
-
[RFC1706] B.Manning and R.Colella. DNS NSAP Resource Records. October 1994.
+
[RFC1706] B.Manning and R.Colella. DNS NSAP Resource Records. October 1994.
-
[RFC2168] R.Daniel and M.Mealling. Resolution of Uniform Resource Identifiers using
+
[RFC2168] R.Daniel and M.Mealling. Resolution of Uniform Resource Identifiers using
the Domain Name System. June 1997.
-
[RFC1876] C.Davis, P.Vixie, T., and I.Dickinson. A Means for Expressing Location Information in the
+
[RFC1876] C.Davis, P.Vixie, T., and I.Dickinson. A Means for Expressing Location Information in the
Domain
Name System. January 1996.
-
[RFC2052] A.Gulbrandsen and P.Vixie. A DNS RR for Specifying the
+
[RFC2052] A.Gulbrandsen and P.Vixie. A DNS RR for Specifying the
Location of
Services.. October 1996.
-
[RFC2163] A.Allocchio. Using the Internet DNS to
+
[RFC2163] A.Allocchio. Using the Internet DNS to
Distribute MIXER
Conformant Global Address Mapping. January 1998.
-
[RFC2230] R.Atkinson. Key Exchange Delegation Record for the DNS. October 1997.
+
[RFC2230] R.Atkinson. Key Exchange Delegation Record for the DNS. October 1997.
-
[RFC2536] D.Eastlake, 3rd. DSA KEYs and SIGs in the Domain Name System (DNS). March 1999.
+
[RFC2536] D.Eastlake, 3rd. DSA KEYs and SIGs in the Domain Name System (DNS). March 1999.
-
[RFC2537] D.Eastlake, 3rd. RSA/MD5 KEYs and SIGs in the Domain Name System (DNS). March 1999.
+
[RFC2537] D.Eastlake, 3rd. RSA/MD5 KEYs and SIGs in the Domain Name System (DNS). March 1999.
-
[RFC2538] D.Eastlake, 3rd and O.Gudmundsson. Storing Certificates in the Domain Name System (DNS). March 1999.
+
[RFC2538] D.Eastlake, 3rd and O.Gudmundsson. Storing Certificates in the Domain Name System (DNS). March 1999.
-
[RFC2539] D.Eastlake, 3rd. Storage of Diffie-Hellman Keys in the Domain Name System (DNS). March 1999.
+
[RFC2539] D.Eastlake, 3rd. Storage of Diffie-Hellman Keys in the Domain Name System (DNS). March 1999.
-
[RFC2540] D.Eastlake, 3rd. Detached Domain Name System (DNS) Information. March 1999.
+
[RFC2540] D.Eastlake, 3rd. Detached Domain Name System (DNS) Information. March 1999.
-
[RFC2782] A.Gulbrandsen. P.Vixie. L.Esibov. A DNS RR for specifying the location of services (DNS SRV). February 2000.
+
[RFC2782] A.Gulbrandsen. P.Vixie. L.Esibov. A DNS RR for specifying the location of services (DNS SRV). February 2000.
-
[RFC2915] M.Mealling. R.Daniel. The Naming Authority Pointer (NAPTR) DNS Resource Record. September 2000.
+
[RFC2915] M.Mealling. R.Daniel. The Naming Authority Pointer (NAPTR) DNS Resource Record. September 2000.
-
[RFC3110] D.Eastlake, 3rd. RSA/SHA-1 SIGs and RSA KEYs in the Domain Name System (DNS). May 2001.
+
[RFC3110] D.Eastlake, 3rd. RSA/SHA-1 SIGs and RSA KEYs in the Domain Name System (DNS). May 2001.
-
[RFC3123] P.Koch. A DNS RR Type for Lists of Address Prefixes (APL RR). June 2001.
+
[RFC3123] P.Koch. A DNS RR Type for Lists of Address Prefixes (APL RR). June 2001.
-
[RFC3596] S.Thomson, C.Huitema, V.Ksinant, and M.Souissi. DNS Extensions to support IP
+
[RFC3596] S.Thomson, C.Huitema, V.Ksinant, and M.Souissi. DNS Extensions to support IP
version 6. October 2003.
-
[RFC3597] A.Gustafsson. Handling of Unknown DNS Resource Record (RR) Types. September 2003.
+
[RFC3597] A.Gustafsson. Handling of Unknown DNS Resource Record (RR) Types. September 2003.
DNS and the Internet
-
[RFC1101] P. V.Mockapetris. DNS Encoding of Network Names
+
[RFC1101] P. V.Mockapetris. DNS Encoding of Network Names
and Other Types. April 1989.
-
[RFC1123] Braden. Requirements for Internet Hosts - Application and
+
[RFC1123] Braden. Requirements for Internet Hosts - Application and
Support. October 1989.
-
[RFC1591] J.Postel. Domain Name System Structure and Delegation. March 1994.
+
[RFC1591] J.Postel. Domain Name System Structure and Delegation. March 1994.
-
[RFC2317] H.Eidnes, G.de Groot, and P.Vixie. Classless IN-ADDR.ARPA Delegation. March 1998.
+
[RFC2317] H.Eidnes, G.de Groot, and P.Vixie. Classless IN-ADDR.ARPA Delegation. March 1998.
-
[RFC2826] Internet Architecture Board. IAB Technical Comment on the Unique DNS Root. May 2000.
+
[RFC2826] Internet Architecture Board. IAB Technical Comment on the Unique DNS Root. May 2000.
-
[RFC2929] D.Eastlake, 3rd, E.Brunner-Williams, and B.Manning. Domain Name System (DNS) IANA Considerations. September 2000.
+
[RFC2929] D.Eastlake, 3rd, E.Brunner-Williams, and B.Manning. Domain Name System (DNS) IANA Considerations. September 2000.
DNS Operations
-
[RFC1033] M.Lottor. Domain administrators operations guide.. November 1987.
+
[RFC1033] M.Lottor. Domain administrators operations guide.. November 1987.
-
[RFC1537] P.Beertema. Common DNS Data File
+
[RFC1537] P.Beertema. Common DNS Data File
Configuration Errors. October 1993.
-
[RFC1912] D.Barr. Common DNS Operational and
+
[RFC1912] D.Barr. Common DNS Operational and
Configuration Errors. February 1996.
-
[RFC2010] B.Manning and P.Vixie. Operational Criteria for Root Name Servers.. October 1996.
+
[RFC2010] B.Manning and P.Vixie. Operational Criteria for Root Name Servers.. October 1996.
-
[RFC2219] M.Hamilton and R.Wright. Use of DNS Aliases for
+
[RFC2219] M.Hamilton and R.Wright. Use of DNS Aliases for
Network Services.. October 1997.
Internationalized Domain Names
-
[RFC2825] IAB and R.Daigle. A Tangled Web: Issues of I18N, Domain Names,
+
[RFC2825] IAB and R.Daigle. A Tangled Web: Issues of I18N, Domain Names,
and the Other Internet protocols. May 2000.
-
[RFC3490] P.Faltstrom, P.Hoffman, and A.Costello. Internationalizing Domain Names in Applications (IDNA). March 2003.
+
[RFC3490] P.Faltstrom, P.Hoffman, and A.Costello. Internationalizing Domain Names in Applications (IDNA). March 2003.
-
[RFC3491] P.Hoffman and M.Blanchet. Nameprep: A Stringprep Profile for Internationalized Domain Names. March 2003.
+
[RFC3491] P.Hoffman and M.Blanchet. Nameprep: A Stringprep Profile for Internationalized Domain Names. March 2003.
-
[RFC3492] A.Costello. Punycode: A Bootstring encoding of Unicode
+
[RFC3492] A.Costello. Punycode: A Bootstring encoding of Unicode
for Internationalized Domain Names in
Applications (IDNA). March 2003.
@@ -487,47 +487,47 @@
-
[RFC1464] R.Rosenbaum. Using the Domain Name System To Store Arbitrary String
+
[RFC1464] R.Rosenbaum. Using the Domain Name System To Store Arbitrary String
Attributes. May 1993.
-
[RFC1713] A.Romao. Tools for DNS Debugging. November 1994.
+
[RFC1713] A.Romao. Tools for DNS Debugging. November 1994.
-
[RFC1794] T.Brisco. DNS Support for Load
+
[RFC1794] T.Brisco. DNS Support for Load
Balancing. April 1995.
-
[RFC2240] O.Vaughan. A Legal Basis for Domain Name Allocation. November 1997.
+
[RFC2240] O.Vaughan. A Legal Basis for Domain Name Allocation. November 1997.
-
[RFC2345] J.Klensin, T.Wolf, and G.Oglesby. Domain Names and Company Name Retrieval. May 1998.
+
[RFC2345] J.Klensin, T.Wolf, and G.Oglesby. Domain Names and Company Name Retrieval. May 1998.
-
[RFC2352] O.Vaughan. A Convention For Using Legal Names as Domain Names. May 1998.
+
[RFC2352] O.Vaughan. A Convention For Using Legal Names as Domain Names. May 1998.
-
[RFC3071] J.Klensin. Reflections on the DNS, RFC 1591, and Categories of Domains. February 2001.
+
[RFC3071] J.Klensin. Reflections on the DNS, RFC 1591, and Categories of Domains. February 2001.
-
[RFC3258] T.Hardie. Distributing Authoritative Name Servers via
+
[RFC3258] T.Hardie. Distributing Authoritative Name Servers via
Shared Unicast Addresses. April 2002.
-
[RFC3901] A.Durand and J.Ihren. DNS IPv6 Transport Operational Guidelines. September 2004.
+
[RFC3901] A.Durand and J.Ihren. DNS IPv6 Transport Operational Guidelines. September 2004.
Obsolete and Unimplemented Experimental RFC
-
[RFC1712] C.Farrell, M.Schulze, S.Pleitner, and D.Baldoni. DNS Encoding of Geographical
+
[RFC1712] C.Farrell, M.Schulze, S.Pleitner, and D.Baldoni. DNS Encoding of Geographical
Location. November 1994.
-
[RFC2673] M.Crawford. Binary Labels in the Domain Name System. August 1999.
+
[RFC2673] M.Crawford. Binary Labels in the Domain Name System. August 1999.
-
[RFC2874] M.Crawford and C.Huitema. DNS Extensions to Support IPv6 Address Aggregation
+
[RFC2874] M.Crawford and C.Huitema. DNS Extensions to Support IPv6 Address Aggregation
and Renumbering. July 2000.
@@ -541,39 +541,39 @@
-
[RFC2065] D.Eastlake, 3rd and C.Kaufman. Domain Name System Security Extensions. January 1997.
+
[RFC2065] D.Eastlake, 3rd and C.Kaufman. Domain Name System Security Extensions. January 1997.
-
[RFC2137] D.Eastlake, 3rd. Secure Domain Name System Dynamic Update. April 1997.
+
[RFC2137] D.Eastlake, 3rd. Secure Domain Name System Dynamic Update. April 1997.
-
[RFC2535] D.Eastlake, 3rd. Domain Name System Security Extensions. March 1999.
+
[RFC2535] D.Eastlake, 3rd. Domain Name System Security Extensions. March 1999.
-
[RFC3008] B.Wellington. Domain Name System Security (DNSSEC)
+
[RFC3008] B.Wellington. Domain Name System Security (DNSSEC)
Signing Authority. November 2000.
-
[RFC3090] E.Lewis. DNS Security Extension Clarification on Zone Status. March 2001.
+
[RFC3090] E.Lewis. DNS Security Extension Clarification on Zone Status. March 2001.
-
[RFC3445] D.Massey and S.Rose. Limiting the Scope of the KEY Resource Record (RR). December 2002.
+
[RFC3445] D.Massey and S.Rose. Limiting the Scope of the KEY Resource Record (RR). December 2002.
-
[RFC3655] B.Wellington and O.Gudmundsson. Redefinition of DNS Authenticated Data (AD) bit. November 2003.
+
[RFC3655] B.Wellington and O.Gudmundsson. Redefinition of DNS Authenticated Data (AD) bit. November 2003.
-
[RFC3658] O.Gudmundsson. Delegation Signer (DS) Resource Record (RR). December 2003.
+
[RFC3658] O.Gudmundsson. Delegation Signer (DS) Resource Record (RR). December 2003.
-
[RFC3755] S.Weiler. Legacy Resolver Compatibility for Delegation Signer (DS). May 2004.
+
[RFC3755] S.Weiler. Legacy Resolver Compatibility for Delegation Signer (DS). May 2004.
-
[RFC3757] O.Kolkman, J.Schlyter, and E.Lewis. Domain Name System KEY (DNSKEY) Resource Record
+
[RFC3757] O.Kolkman, J.Schlyter, and E.Lewis. Domain Name System KEY (DNSKEY) Resource Record
(RR) Secure Entry Point (SEP) Flag. April 2004.
-
[RFC3845] J.Schlyter. DNS Security (DNSSEC) NextSECure (NSEC) RDATA Format. August 2004.
+
[RFC3845] J.Schlyter. DNS Security (DNSSEC) NextSECure (NSEC) RDATA Format. August 2004.
@@ -594,14 +594,14 @@
-Other Documents About BIND
+Other Documents About BIND