diff --git a/CHANGES b/CHANGES
index 1c76d006df..b3f5d4ad8a 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,5 @@
+ --- 9.15.2 released ---
+
5263. [cleanup] Use atomics and isc_refcount_t wherever possible.
[GL #1038]
diff --git a/README b/README
index ea7b28cc1e..15f3c62b8c 100644
--- a/README
+++ b/README
@@ -139,7 +139,7 @@ make depend. If you're using Emacs, you might find make tags helpful.
Several environment variables that can be set before running configure
will affect compilation:
-Variable Description
+ Variable Description
CC The C compiler to use. configure tries to figure out the
right one for supported systems.
C compiler flags. Defaults to include -g and/or -O2 as
@@ -291,7 +291,7 @@ development BIND 9 is included in the file CHANGES, with the most recent
changes listed first. Change notes include tags indicating the category of
the change that was made; these categories are:
-Category Description
+ Category Description
[func] New feature
[bug] General bug fix
[security] Fix for a significant security flaw
@@ -342,21 +342,23 @@ Acknowledgments
* The original development of BIND 9 was underwritten by the following
organizations:
- Sun Microsystems, Inc.
- Hewlett Packard
- Compaq Computer Corporation
- IBM
- Process Software Corporation
- Silicon Graphics, Inc.
- Network Associates, Inc.
- U.S. Defense Information Systems Agency
- USENIX Association
- Stichting NLnet - NLnet Foundation
- Nominum, Inc.
+ Sun Microsystems, Inc.
+ Hewlett Packard
+ Compaq Computer Corporation
+ IBM
+ Process Software Corporation
+ Silicon Graphics, Inc.
+ Network Associates, Inc.
+ U.S. Defense Information Systems Agency
+ USENIX Association
+ Stichting NLnet - NLnet Foundation
+ Nominum, Inc.
* This product includes software developed by the OpenSSL Project for
use in the OpenSSL Toolkit. http://www.OpenSSL.org/
+
* This product includes cryptographic software written by Eric Young
(eay@cryptsoft.com)
+
* This product includes software written by Tim Hudson
(tjh@cryptsoft.com)
diff --git a/bin/check/named-checkconf.8 b/bin/check/named-checkconf.8
index dc9e2d5b1e..32209be0fe 100644
--- a/bin/check/named-checkconf.8
+++ b/bin/check/named-checkconf.8
@@ -86,6 +86,11 @@ Check "core" configuration only\&. This suppresses the loading of plugin modules
statements to be ignored\&.
.RE
.PP
+\-i
+.RS 4
+Ignore warnings on deprecated options\&.
+.RE
+.PP
\-p
.RS 4
Print out the
diff --git a/bin/check/named-checkconf.html b/bin/check/named-checkconf.html
index a87b2977f8..56eea3b6a3 100644
--- a/bin/check/named-checkconf.html
+++ b/bin/check/named-checkconf.html
@@ -96,6 +96,12 @@
plugin statements to be ignored.
+-i
+
+
+ Ignore warnings on deprecated options.
+
+
-p
diff --git a/bin/dnssec/dnssec-keygen.8 b/bin/dnssec/dnssec-keygen.8
index 7758ae9d3e..0450efac89 100644
--- a/bin/dnssec/dnssec-keygen.8
+++ b/bin/dnssec/dnssec-keygen.8
@@ -92,8 +92,7 @@ to generate TSIG keys\&.
.RS 4
Specifies the number of bits in the key\&. The choice of key size depends on the algorithm used\&. RSA keys must be between 1024 and 4096 bits\&. Diffie Hellman keys must be between 128 and 4096 bits\&. Elliptic curve algorithms don\*(Aqt need this parameter\&.
.sp
-If the key size is not specified, some algorithms have pre\-defined defaults\&. For example, RSA keys for use as DNSSEC zone signing keys have a default size of 1024 bits; RSA keys for use as key signing keys (KSKs, generated with
-\fB\-f KSK\fR) default to 2048 bits\&.
+If the key size is not specified, some algorithms have pre\-defined defaults\&. For instance, RSA keys have a default size of 2048 bits\&.
.RE
.PP
\-C
diff --git a/bin/dnssec/dnssec-keygen.html b/bin/dnssec/dnssec-keygen.html
index b23904790a..bff3cf8149 100644
--- a/bin/dnssec/dnssec-keygen.html
+++ b/bin/dnssec/dnssec-keygen.html
@@ -145,10 +145,8 @@
If the key size is not specified, some algorithms have
- pre-defined defaults. For example, RSA keys for use as
- DNSSEC zone signing keys have a default size of 1024 bits;
- RSA keys for use as key signing keys (KSKs, generated with
- -f KSK) default to 2048 bits.
+ pre-defined defaults. For instance, RSA keys have a default
+ size of 2048 bits.
-C
diff --git a/bin/named/named.conf.5 b/bin/named/named.conf.5
index 7b93ad4771..3d8965df1c 100644
--- a/bin/named/named.conf.5
+++ b/bin/named/named.conf.5
@@ -10,12 +10,12 @@
.\" Title: named.conf
.\" Author:
.\" Generator: DocBook XSL Stylesheets v1.78.1
-.\" Date: 2019-05-10
+.\" Date: 2019-06-28
.\" Manual: BIND9
.\" Source: ISC
.\" Language: English
.\"
-.TH "NAMED\&.CONF" "5" "2019\-05\-10" "ISC" "BIND9"
+.TH "NAMED\&.CONF" "5" "2019\-06\-28" "ISC" "BIND9"
.\" -----------------------------------------------------------------
.\" * Define some portability stuff
.\" -----------------------------------------------------------------
@@ -163,15 +163,16 @@ logging {
.\}
.SH "MANAGED-KEYS"
.PP
-See DNSSEC\-KEYS\&.
+Deprecated \- see DNSSEC\-KEYS\&.
.sp
.if n \{\
.RS 4
.\}
.nf
-managed\-keys { \fIstring\fR ( static\-key |
- initial\-key ) \fIinteger\fR \fIinteger\fR \fIinteger\fR
- \fIquoted_string\fR; \&.\&.\&. };
+managed\-keys { \fIstring\fR ( static\-key
+ | initial\-key ) \fIinteger\fR
+ \fIinteger\fR \fIinteger\fR
+ \fIquoted_string\fR; \&.\&.\&. }; deprecated
.fi
.if n \{\
.RE
@@ -241,7 +242,6 @@ options {
check\-spf ( warn | ignore );
check\-srv\-cname ( fail | warn | ignore );
check\-wildcard \fIboolean\fR;
- cleaning\-interval \fIinteger\fR;
clients\-per\-query \fIinteger\fR;
cookie\-algorithm ( aes | sha1 | sha256 );
cookie\-secret \fIstring\fR;
@@ -274,8 +274,9 @@ options {
dnssec\-accept\-expired \fIboolean\fR;
dnssec\-dnskey\-kskonly \fIboolean\fR;
dnssec\-loadkeys\-interval \fIinteger\fR;
- dnssec\-lookaside ( \fIstring\fR trust\-anchor
- \fIstring\fR | auto | no );
+ dnssec\-lookaside ( \fIstring\fR
+ trust\-anchor \fIstring\fR |
+ auto | no ); deprecated
dnssec\-must\-be\-secure \fIstring\fR \fIboolean\fR;
dnssec\-secure\-to\-insecure \fIboolean\fR;
dnssec\-update\-mode ( maintain | no\-resign );
@@ -576,7 +577,7 @@ Deprecated \- see DNSSEC\-KEYS\&.
.nf
trusted\-keys { \fIstring\fR \fIinteger\fR
\fIinteger\fR \fIinteger\fR
- \fIquoted_string\fR; \&.\&.\&. };, deprecated
+ \fIquoted_string\fR; \&.\&.\&. }; deprecated
.fi
.if n \{\
.RE
@@ -626,7 +627,6 @@ view \fIstring\fR [ \fIclass\fR ] {
check\-spf ( warn | ignore );
check\-srv\-cname ( fail | warn | ignore );
check\-wildcard \fIboolean\fR;
- cleaning\-interval \fIinteger\fR;
clients\-per\-query \fIinteger\fR;
deny\-answer\-addresses { \fIaddress_match_element\fR; \&.\&.\&. } [
except\-from { \fIstring\fR; \&.\&.\&. } ];
@@ -661,8 +661,9 @@ view \fIstring\fR [ \fIclass\fR ] {
initial\-key ) \fIinteger\fR \fIinteger\fR
\fIinteger\fR \fIquoted_string\fR; \&.\&.\&. };
dnssec\-loadkeys\-interval \fIinteger\fR;
- dnssec\-lookaside ( \fIstring\fR trust\-anchor
- \fIstring\fR | auto | no );
+ dnssec\-lookaside ( \fIstring\fR
+ trust\-anchor \fIstring\fR |
+ auto | no ); deprecated
dnssec\-must\-be\-secure \fIstring\fR \fIboolean\fR;
dnssec\-secure\-to\-insecure \fIboolean\fR;
dnssec\-update\-mode ( maintain | no\-resign );
@@ -697,9 +698,11 @@ view \fIstring\fR [ \fIclass\fR ] {
key\-directory \fIquoted_string\fR;
lame\-ttl \fIttlval\fR;
lmdb\-mapsize \fIsizeval\fR;
- managed\-keys { \fIstring\fR ( static\-key |
- initial\-key ) \fIinteger\fR \fIinteger\fR
- \fIinteger\fR \fIquoted_string\fR; \&.\&.\&. };
+ managed\-keys { \fIstring\fR (
+ static\-key | initial\-key
+ ) \fIinteger\fR \fIinteger\fR
+ \fIinteger\fR
+ \fIquoted_string\fR; \&.\&.\&. }; deprecated
masterfile\-format ( map | raw | text );
masterfile\-style ( full | relative );
match\-clients { \fIaddress_match_element\fR; \&.\&.\&. };
@@ -852,7 +855,7 @@ view \fIstring\fR [ \fIclass\fR ] {
trusted\-keys { \fIstring\fR
\fIinteger\fR \fIinteger\fR
\fIinteger\fR
- \fIquoted_string\fR; \&.\&.\&. };, deprecated
+ \fIquoted_string\fR; \&.\&.\&. }; deprecated
try\-tcp\-refresh \fIboolean\fR;
update\-check\-ksk \fIboolean\fR;
use\-alt\-transfer\-source \fIboolean\fR;
diff --git a/bin/named/named.conf.html b/bin/named/named.conf.html
index bca8de5a24..cb94491af8 100644
--- a/bin/named/named.conf.html
+++ b/bin/named/named.conf.html
@@ -142,11 +142,12 @@ logging
MANAGED-KEYS
-
See DNSSEC-KEYS.
+
Deprecated - see DNSSEC-KEYS.
-managed-keys { string ( static-key |
- initial-key ) integer integer integer
- quoted_string; ... };
+managed-keys { string ( static-key
+ | initial-key ) integer
+ integer integer
+ quoted_string; ... }; deprecated
@@ -208,7 +209,6 @@ options
check-spf ( warn | ignore );
check-srv-cname ( fail | warn | ignore );
check-wildcard boolean;
- cleaning-interval integer;
clients-per-query integer;
cookie-algorithm ( aes | sha1 | sha256 );
cookie-secret string;
@@ -241,8 +241,9 @@ options
dnssec-accept-expired boolean;
dnssec-dnskey-kskonly boolean;
dnssec-loadkeys-interval integer;
- dnssec-lookaside ( string trust-anchor
- string | auto | no );
+ dnssec-lookaside ( string
+ trust-anchor string |
+ auto | no ); deprecated
dnssec-must-be-secure string boolean;
dnssec-secure-to-insecure boolean;
dnssec-update-mode ( maintain | no-resign );
@@ -526,7 +527,7 @@ statistics-channels
trusted-keys { string integer
integer integer
- quoted_string; ... };, deprecated
+ quoted_string; ... }; deprecated
check-srv-cname ( fail | warn | ignore );
check-wildcard boolean;
- cleaning-interval integer;
clients-per-query integer;
deny-answer-addresses { address_match_element; ... } [
except-from { string; ... } ];
@@ -607,8 +607,9 @@ view
initial-key ) integer integer
integer quoted_string; ... };
dnssec-loadkeys-interval integer;
- dnssec-lookaside ( string trust-anchor
- string | auto | no );
+ dnssec-lookaside ( string
+ trust-anchor string |
+ auto | no ); deprecated
dnssec-must-be-secure string boolean;
dnssec-secure-to-insecure boolean;
dnssec-update-mode ( maintain | no-resign );
@@ -643,9 +644,11 @@ view
key-directory quoted_string;
lame-ttl ttlval;
lmdb-mapsize sizeval;
- managed-keys { string ( static-key |
- initial-key ) integer integer
- integer quoted_string; ... };
+ managed-keys { string (
+ static-key | initial-key
+ ) integer integer
+ integer
+ quoted_string; ... }; deprecated
masterfile-format ( map | raw | text );
masterfile-style ( full | relative );
match-clients { address_match_element; ... };
@@ -798,7 +801,7 @@ view
trusted-keys { string
integer integer
integer
- quoted_string; ... };, deprecated
+ quoted_string; ... }; deprecated
try-tcp-refresh boolean;
update-check-ksk boolean;
use-alt-transfer-source boolean;
diff --git a/bin/rndc/rndc.8 b/bin/rndc/rndc.8
index b859194604..ec6636234c 100644
--- a/bin/rndc/rndc.8
+++ b/bin/rndc/rndc.8
@@ -516,11 +516,7 @@ timer\&.
.RS 4
Dump the security roots (i\&.e\&., trust anchors configured via
\fBdnssec\-keys\fR
-statements, or the synonymous
-\fBmanaged\-keys\fR
-or the deprecated
-\fBtrusted\-keys\fR
-statements, or via
+statements, or the managed\-keys or trusted\-keys statements (both deprecated), or via
\fBdnssec\-validation auto\fR) and negative trust anchors for the specified views\&. If no view is specified, all views are dumped\&. Security roots will indicate whether they are configured as trusted keys, managed keys, or initializing managed keys (managed keys that have not yet been updated by a successful key refresh query)\&.
.sp
If the first argument is "\-", then the output is returned via the
diff --git a/bin/rndc/rndc.html b/bin/rndc/rndc.html
index d03708cb0f..c95d016a3f 100644
--- a/bin/rndc/rndc.html
+++ b/bin/rndc/rndc.html
@@ -653,9 +653,8 @@
Dump the security roots (i.e., trust anchors
- configured via dnssec-keys statements,
- or the synonymous managed-keys or
- the deprecated trusted-keys statements, or
+ configured via dnssec-keys statements, or the
+ managed-keys or trusted-keys statements (both deprecated), or
via dnssec-validation auto) and negative trust
anchors for the specified views. If no view is specified, all
views are dumped. Security roots will indicate whether
diff --git a/configure b/configure
index 6845ea53db..3b71dd9501 100755
--- a/configure
+++ b/configure
@@ -850,7 +850,6 @@ infodir
docdir
oldincludedir
includedir
-runstatedir
localstatedir
sharedstatedir
sysconfdir
@@ -1020,7 +1019,6 @@ datadir='${datarootdir}'
sysconfdir='${prefix}/etc'
sharedstatedir='${prefix}/com'
localstatedir='${prefix}/var'
-runstatedir='${localstatedir}/run'
includedir='${prefix}/include'
oldincludedir='/usr/include'
docdir='${datarootdir}/doc/${PACKAGE_TARNAME}'
@@ -1273,15 +1271,6 @@ do
| -silent | --silent | --silen | --sile | --sil)
silent=yes ;;
- -runstatedir | --runstatedir | --runstatedi | --runstated \
- | --runstate | --runstat | --runsta | --runst | --runs \
- | --run | --ru | --r)
- ac_prev=runstatedir ;;
- -runstatedir=* | --runstatedir=* | --runstatedi=* | --runstated=* \
- | --runstate=* | --runstat=* | --runsta=* | --runst=* | --runs=* \
- | --run=* | --ru=* | --r=*)
- runstatedir=$ac_optarg ;;
-
-sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb)
ac_prev=sbindir ;;
-sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \
@@ -1419,7 +1408,7 @@ fi
for ac_var in exec_prefix prefix bindir sbindir libexecdir datarootdir \
datadir sysconfdir sharedstatedir localstatedir includedir \
oldincludedir docdir infodir htmldir dvidir pdfdir psdir \
- libdir localedir mandir runstatedir
+ libdir localedir mandir
do
eval ac_val=\$$ac_var
# Remove trailing slashes.
@@ -1572,7 +1561,6 @@ Fine tuning of the installation directories:
--sysconfdir=DIR read-only single-machine data [PREFIX/etc]
--sharedstatedir=DIR modifiable architecture-independent data [PREFIX/com]
--localstatedir=DIR modifiable single-machine data [PREFIX/var]
- --runstatedir=DIR modifiable per-process data [LOCALSTATEDIR/run]
--libdir=DIR object code libraries [EPREFIX/lib]
--includedir=DIR C header files [PREFIX/include]
--oldincludedir=DIR C header files for non-gcc [/usr/include]
@@ -4013,7 +4001,7 @@ else
We can't simply define LARGE_OFF_T to be 9223372036854775807,
since some C++ compilers masquerading as C compilers
incorrectly reject 9223372036854775807. */
-#define LARGE_OFF_T ((((off_t) 1 << 31) << 31) - 1 + (((off_t) 1 << 31) << 31))
+#define LARGE_OFF_T (((off_t) 1 << 62) - 1 + ((off_t) 1 << 62))
int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721
&& LARGE_OFF_T % 2147483647 == 1)
? 1 : -1];
@@ -4059,7 +4047,7 @@ else
We can't simply define LARGE_OFF_T to be 9223372036854775807,
since some C++ compilers masquerading as C compilers
incorrectly reject 9223372036854775807. */
-#define LARGE_OFF_T ((((off_t) 1 << 31) << 31) - 1 + (((off_t) 1 << 31) << 31))
+#define LARGE_OFF_T (((off_t) 1 << 62) - 1 + ((off_t) 1 << 62))
int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721
&& LARGE_OFF_T % 2147483647 == 1)
? 1 : -1];
@@ -4083,7 +4071,7 @@ rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
We can't simply define LARGE_OFF_T to be 9223372036854775807,
since some C++ compilers masquerading as C compilers
incorrectly reject 9223372036854775807. */
-#define LARGE_OFF_T ((((off_t) 1 << 31) << 31) - 1 + (((off_t) 1 << 31) << 31))
+#define LARGE_OFF_T (((off_t) 1 << 62) - 1 + ((off_t) 1 << 62))
int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721
&& LARGE_OFF_T % 2147483647 == 1)
? 1 : -1];
@@ -4128,7 +4116,7 @@ else
We can't simply define LARGE_OFF_T to be 9223372036854775807,
since some C++ compilers masquerading as C compilers
incorrectly reject 9223372036854775807. */
-#define LARGE_OFF_T ((((off_t) 1 << 31) << 31) - 1 + (((off_t) 1 << 31) << 31))
+#define LARGE_OFF_T (((off_t) 1 << 62) - 1 + ((off_t) 1 << 62))
int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721
&& LARGE_OFF_T % 2147483647 == 1)
? 1 : -1];
@@ -4152,7 +4140,7 @@ rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
We can't simply define LARGE_OFF_T to be 9223372036854775807,
since some C++ compilers masquerading as C compilers
incorrectly reject 9223372036854775807. */
-#define LARGE_OFF_T ((((off_t) 1 << 31) << 31) - 1 + (((off_t) 1 << 31) << 31))
+#define LARGE_OFF_T (((off_t) 1 << 62) - 1 + ((off_t) 1 << 62))
int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721
&& LARGE_OFF_T % 2147483647 == 1)
? 1 : -1];
diff --git a/doc/arm/Bv9ARM.ch01.html b/doc/arm/Bv9ARM.ch01.html
index f469fc7511..f27750b36b 100644
--- a/doc/arm/Bv9ARM.ch01.html
+++ b/doc/arm/Bv9ARM.ch01.html
@@ -614,6 +614,6 @@
-
BIND 9.15.1 (Development Release)
+BIND 9.15.2 (Development Release)