diff --git a/CHANGES b/CHANGES
index 704e5132f4..486f0df83c 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,5 @@
+ --- 9.11.5rc1 released ---
+
5038. [bug] Chaosnet addresses were compared incorrectly.
[GL #562]
diff --git a/README b/README
index 07d3b95e2e..c27c307faa 100644
--- a/README
+++ b/README
@@ -250,6 +250,15 @@ BIND 9.11.4
BIND 9.11.4 is a maintenance release, and addresses the security flaw
disclosed in CVE-2018-5738.
+BIND 9.11.5
+
+BIND 9.11.5 is a maintenance release, and also addresses CVE-2018-5741 by
+correcting faulty documentation and introducing the following new feature:
+
+ * New krb5-selfsub and ms-selfsub rule types for update-policy
+ statements allow updating of subdomains based on a Kerberos or Active
+ Directory machine principal.
+
Building BIND
BIND requires a UNIX or Linux system with an ANSI C compiler, basic POSIX
diff --git a/README.md b/README.md
index 291c22105c..5c72e1959e 100644
--- a/README.md
+++ b/README.md
@@ -266,6 +266,16 @@ disclosed in CVE-2017-3145.
BIND 9.11.4 is a maintenance release, and addresses the security flaw
disclosed in CVE-2018-5738.
+#### BIND 9.11.5
+
+BIND 9.11.5 is a maintenance release, and also addresses CVE-2018-5741
+by correcting faulty documentation and introducing the following new
+feature:
+
+* New `krb5-selfsub` and `ms-selfsub` rule types for `update-policy`
+ statements allow updating of subdomains based on a Kerberos or
+ Active Directory machine principal.
+
### Building BIND
BIND requires a UNIX or Linux system with an ANSI C compiler, basic POSIX
diff --git a/bin/named/named.conf.5 b/bin/named/named.conf.5
index cb21f43f77..2f3f789584 100644
--- a/bin/named/named.conf.5
+++ b/bin/named/named.conf.5
@@ -891,10 +891,10 @@ view \fIstring\fR [ \fIclass\fR ] {
| slave | static\-stub | stub );
update\-check\-ksk \fIboolean\fR;
update\-policy ( local | { ( deny | grant ) \fIstring\fR (
- 6to4\-self | external | krb5\-self | krb5\-subdomain |
- ms\-self | ms\-subdomain | name | self | selfsub |
- selfwild | subdomain | tcp\-self | wildcard | zonesub )
- [ \fIstring\fR ] \fIrrtypelist\fR; \&.\&.\&. };
+ 6to4\-self | external | krb5\-self | krb5\-selfsub |
+ krb5\-subdomain | ms\-self | ms\-selfsub | ms\-subdomain |
+ name | self | selfsub | selfwild | subdomain | tcp\-self
+ | wildcard | zonesub ) [ \fIstring\fR ] \fIrrtypelist\fR; \&.\&.\&. };
use\-alt\-transfer\-source \fIboolean\fR;
zero\-no\-soa\-ttl \fIboolean\fR;
zone\-statistics ( full | terse | none | \fIboolean\fR );
@@ -996,9 +996,10 @@ zone \fIstring\fR [ \fIclass\fR ] {
| static\-stub | stub );
update\-check\-ksk \fIboolean\fR;
update\-policy ( local | { ( deny | grant ) \fIstring\fR ( 6to4\-self |
- external | krb5\-self | krb5\-subdomain | ms\-self | ms\-subdomain
- | name | self | selfsub | selfwild | subdomain | tcp\-self |
- wildcard | zonesub ) [ \fIstring\fR ] \fIrrtypelist\fR; \&.\&.\&. };
+ external | krb5\-self | krb5\-selfsub | krb5\-subdomain | ms\-self
+ | ms\-selfsub | ms\-subdomain | name | self | selfsub | selfwild
+ | subdomain | tcp\-self | wildcard | zonesub ) [ \fIstring\fR ]
+ \fIrrtypelist\fR; \&.\&.\&. };
use\-alt\-transfer\-source \fIboolean\fR;
zero\-no\-soa\-ttl \fIboolean\fR;
zone\-statistics ( full | terse | none | \fIboolean\fR );
diff --git a/bin/named/named.conf.docbook b/bin/named/named.conf.docbook
index f8c94eb3d8..a4bd6894f6 100644
--- a/bin/named/named.conf.docbook
+++ b/bin/named/named.conf.docbook
@@ -863,10 +863,10 @@ view string [ class ] {
| slave | static-stub | stub );
update-check-ksk boolean;
update-policy ( local | { ( deny | grant ) string (
- 6to4-self | external | krb5-self | krb5-subdomain |
- ms-self | ms-subdomain | name | self | selfsub |
- selfwild | subdomain | tcp-self | wildcard | zonesub )
- [ string ] rrtypelist; ... };
+ 6to4-self | external | krb5-self | krb5-selfsub |
+ krb5-subdomain | ms-self | ms-selfsub | ms-subdomain |
+ name | self | selfsub | selfwild | subdomain | tcp-self
+ | wildcard | zonesub ) [ string ] rrtypelist; ... };
use-alt-transfer-source boolean;
zero-no-soa-ttl boolean;
zone-statistics ( full | terse | none | boolean );
@@ -964,9 +964,10 @@ zone string [ class ] {
| static-stub | stub );
update-check-ksk boolean;
update-policy ( local | { ( deny | grant ) string ( 6to4-self |
- external | krb5-self | krb5-subdomain | ms-self | ms-subdomain
- | name | self | selfsub | selfwild | subdomain | tcp-self |
- wildcard | zonesub ) [ string ] rrtypelist; ... };
+ external | krb5-self | krb5-selfsub | krb5-subdomain | ms-self
+ | ms-selfsub | ms-subdomain | name | self | selfsub | selfwild
+ | subdomain | tcp-self | wildcard | zonesub ) [ string ]
+ rrtypelist; ... };
use-alt-transfer-source boolean;
zero-no-soa-ttl boolean;
zone-statistics ( full | terse | none | boolean );
diff --git a/bin/named/named.conf.html b/bin/named/named.conf.html
index cfcfe69b83..d3144942bc 100644
--- a/bin/named/named.conf.html
+++ b/bin/named/named.conf.html
@@ -856,10 +856,10 @@ view
| slave | static-stub | stub );
update-check-ksk boolean;
update-policy ( local | { ( deny | grant ) string (
- 6to4-self | external | krb5-self | krb5-subdomain |
- ms-self | ms-subdomain | name | self | selfsub |
- selfwild | subdomain | tcp-self | wildcard | zonesub )
- [ string ] rrtypelist; ... };
+ 6to4-self | external | krb5-self | krb5-selfsub |
+ krb5-subdomain | ms-self | ms-selfsub | ms-subdomain |
+ name | self | selfsub | selfwild | subdomain | tcp-self
+ | wildcard | zonesub ) [ string ] rrtypelist; ... };
use-alt-transfer-source boolean;
zero-no-soa-ttl boolean;
zone-statistics ( full | terse | none | boolean );
@@ -958,9 +958,10 @@ zone
| static-stub | stub );
update-check-ksk boolean;
update-policy ( local | { ( deny | grant ) string ( 6to4-self |
- external | krb5-self | krb5-subdomain | ms-self | ms-subdomain
- | name | self | selfsub | selfwild | subdomain | tcp-self |
- wildcard | zonesub ) [ string ] rrtypelist; ... };
+ external | krb5-self | krb5-selfsub | krb5-subdomain | ms-self
+ | ms-selfsub | ms-subdomain | name | self | selfsub | selfwild
+ | subdomain | tcp-self | wildcard | zonesub ) [ string ]
+ rrtypelist; ... };
use-alt-transfer-source boolean;
zero-no-soa-ttl boolean;
zone-statistics ( full | terse | none | boolean );
diff --git a/bin/rndc/rndc.8 b/bin/rndc/rndc.8
index 38d23df44c..a7e2dc610d 100644
--- a/bin/rndc/rndc.8
+++ b/bin/rndc/rndc.8
@@ -310,7 +310,7 @@ See also
\fBrndc trace\fR\&.
.RE
.PP
-\fBnta \fR\fB[( \-d | \-f | \-r | \-l \fIduration\fR)]\fR\fB \fR\fB\fIdomain\fR\fR\fB \fR\fB[\fIview\fR]\fR\fB \fR
+\fBnta \fR\fB[( \-class \fIclass\fR | \-dump | \-force | \-remove | \-lifetime \fIduration\fR)]\fR\fB \fR\fB\fIdomain\fR\fR\fB \fR\fB[\fIview\fR]\fR\fB \fR
.RS 4
Sets a DNSSEC negative trust anchor (NTA) for
\fBdomain\fR, with a lifetime of
@@ -342,7 +342,7 @@ option\&. TTL\-style suffixes can be used to specify the lifetime in seconds, mi
to zero is equivalent to
\fB\-remove\fR\&.
.sp
-If
+If the
\fB\-dump\fR
is used, any other arguments are ignored, and a list of existing NTAs is printed (note that this may include NTAs that are expired but have not yet been cleaned up)\&.
.sp
@@ -354,11 +354,16 @@ option in the Administrator Reference Manual for details)\&. If data can be vali
\fB\-force\fR
overrides this behavior and forces an NTA to persist for its entire lifetime, regardless of whether data could be validated if the NTA were not present\&.
.sp
+The view class can be specified with
+\fB\-class\fR\&. The default is class
+\fBIN\fR, which is the only class for which DNSSEC is currently supported\&.
+.sp
All of these options can be shortened, i\&.e\&., to
\fB\-l\fR,
\fB\-r\fR,
-\fB\-d\fR, and
-\fB\-f\fR\&.
+\fB\-d\fR,
+\fB\-f\fR, and
+\fB\-c\fR\&.
.RE
.PP
\fBquerylog\fR [ on | off ]
diff --git a/bin/rndc/rndc.html b/bin/rndc/rndc.html
index c4694bdc56..4bb7649b35 100644
--- a/bin/rndc/rndc.html
+++ b/bin/rndc/rndc.html
@@ -417,7 +417,7 @@
nta
- [( -d | -f | -r | -l duration)]
+ [( -class class | -dump | -force | -remove | -lifetime duration)]
domain
[view]
@@ -465,7 +465,7 @@
is equivalent to -remove.
- If -dump is used, any other arguments
+ If the -dump is used, any other arguments
are ignored, and a list of existing NTAs is printed
(note that this may include NTAs that are expired but
have not yet been cleaned up).
@@ -482,10 +482,15 @@
lifetime, regardless of whether data could be
validated if the NTA were not present.
+
+ The view class can be specified with -class.
+ The default is class IN, which is
+ the only class for which DNSSEC is currently supported.
+
All of these options can be shortened, i.e., to
-l, -r, -d,
- and -f.
+ -f, and -c.
querylog [ on | off ]
diff --git a/doc/arm/Bv9ARM.ch01.html b/doc/arm/Bv9ARM.ch01.html
index 47fe522cce..dfcf90d4c3 100644
--- a/doc/arm/Bv9ARM.ch01.html
+++ b/doc/arm/Bv9ARM.ch01.html
@@ -616,6 +616,6 @@
-BIND 9.11.4-P1 (Extended Support Version)
+BIND 9.11.5rc1 (Extended Support Version)