diff --git a/contrib/bind9/CHANGES b/contrib/bind9/CHANGES
index dc0b2c69981..19f8e51615a 100644
--- a/contrib/bind9/CHANGES
+++ b/contrib/bind9/CHANGES
@@ -1,9 +1,309 @@
- --- 9.8.1-P1 released ---
+ --- 9.8.2 released ---
+
+3298. [bug] Named could dereference a NULL pointer in
+ zmgr_start_xfrin_ifquota if the zone was being removed.
+ [RT #28419]
+
+3297. [bug] Named could die on a malformed master file. [RT #28467]
+
+3295. [bug] Adjust isc_time_secondsastimet range check to be more
+ portable. [RT # 26542]
+
+3294. [bug] isccc/cc.c:table_fromwire failed to free alist on
+ error. [RT #28265]
+
+3291. [port] Fixed a build error on systems without ENOTSUP.
+ [RT #28200]
+
+3290. [bug] was not being installed. [RT #28169]
+
+3288. [bug] dlz_destroy() function wasn't correctly registered
+ by the DLZ dlopen driver. [RT #28056]
+
+3287. [port] Update ans.pl to work with Net::DNS 0.68. [RT #28028]
+
+3286. [bug] Managed key maintenance timer could fail to start
+ after 'rndc reconfig'. [RT #26786]
+
+ --- 9.8.2rc2 released ---
+
+3285. [bug] val-frdataset was incorrectly disassociated in
+ proveunsecure after calling startfinddlvsep.
+ [RT #27928]
+
+3284. [bug] Address race conditions with the handling of
+ rbtnode.deadlink. [RT #27738]
+
+3283. [bug] Raw zones with with more than 512 records in a RRset
+ failed to load. [RT #27863]
+
+3282. [bug] Restrict the TTL of NS RRset to no more than that
+ of the old NS RRset when replacing it.
+ [RT #27792] [RT #27884]
+
+3281. [bug] SOA refresh queries could be treated as cancelled
+ despite succeeding over the loopback interface.
+ [RT #27782]
+
+3280. [bug] Potential double free of a rdataset on out of memory
+ with DNS64. [RT #27762]
+
+3278. [bug] Make sure automatic key maintenance is started
+ when "auto-dnssec maintain" is turned on during
+ "rndc reconfig". [RT #26805]
+
+3276. [bug] win32: ns_os_openfile failed to return NULL on
+ safe_open failure. [RT #27696]
+
+3274. [bug] Log when a zone is not reusable. Only set loadtime
+ on successful loads. [RT #27650]
+
+3273. [bug] AAAA responses could be returned in the additional
+ section even when filter-aaaa-on-v4 was in use.
+ [RT #27292]
+
+3271. [port] darwin: mksymtbl is not always stable, loop several
+ times before giving up. mksymtbl was using non
+ portable perl to covert 64 bit hex strings. [RT #27653]
+
+3268. [bug] Convert RRSIG expiry times to 64 timestamps to work
+ out the earliest expiry time. [RT #23311]
+
+3267. [bug] Memory allocation failures could be mis-reported as
+ unexpected error. New ISC_R_UNSET result code.
+ [RT #27336]
+
+3266. [bug] The maximum number of NSEC3 iterations for a
+ DNSKEY RRset was not being properly computed.
+ [RT #26543]
+
+3262. [bug] Signed responses were handled incorrectly by RPZ.
+ [RT #27316]
+
+ --- 9.8.2rc1 released ---
+
+3260. [bug] "rrset-order cyclic" could appear not to rotate
+ for some query patterns. [RT #27170/27185]
+
+3259. [bug] named-compilezone: Suppress "dump zone to "
+ message when writing to stdout. [RT #27109]
+
+3258. [test] Add "forcing full sign with unreadable keys" test.
+ [RT #27153]
+
+3257. [bug] Do not generate a error message when calling fsync()
+ in a pipe or socket. [RT #27109]
+
+3256. [bug] Disable empty zones for lwresd -C. [RT #27139]
+
+3254. [bug] Set isc_socket_ipv6only() on the IPv6 control channels.
+ [RT #22249]
+
+3253. [bug] Return DNS_R_SYNTAX when the input to a text field is
+ too long. [RT #26956]
+
+3251. [bug] Enforce a upper bound (65535 bytes) on the amount of
+ memory dns_sdlz_putrr() can allocate per record to
+ prevent run away memory consumption on ISC_R_NOSPACE.
+ [RT #26956]
+
+3250. [func] 'configure --enable-developer'; turn on various
+ configure options, normally off by default, that
+ we want developers to build and test with. [RT #27103]
+
+3249. [bug] Update log message when saving slave zones files for
+ analysis after load failures. [RT #27087]
+
+3248. [bug] Configure options --enable-fixed-rrset and
+ --enable-exportlib were incompatible with each
+ other. [RT #27087]
+
+3247. [bug] 'raw' format zones failed to preserve load order
+ breaking 'fixed' sort order. [RT #27087]
+
+3243. [port] netbsd,bsdi: the thread defaults were not being
+ properly set.
+
+3241. [bug] Address race conditions in the resolver code.
+ [RT #26889]
+
+3240. [bug] DNSKEY state change events could be missed. [RT #26874]
+
+3239. [bug] dns_dnssec_findmatchingkeys needs to use a consistent
+ timestamp. [RT #26883]
+
+3238. [bug] keyrdata was not being reinitialized in
+ lib/dns/rbtdb.c:iszonesecure. [RT#26913]
+
+3237. [bug] dig -6 didn't work with +trace. [RT #26906]
+
+ --- 9.8.2b1 released ---
+
+3234. [bug] 'make depend' produced invalid makefiles. [RT #26830]
+
+3231. [bug] named could fail to send a uncompressable zone.
+ [RT #26796]
+
+3230. [bug] 'dig axfr' failed to properly handle a multi-message
+ axfr with a serial of 0. [RT #26796]
+
+3229. [bug] Fix local variable to struct var assignment
+ found by CLANG warning.
+
+3228. [tuning] Dynamically grow symbol table to improve zone
+ loading performance. [RT #26523]
+
+3227. [bug] Interim fix to make WKS's use of getprotobyname()
+ and getservbyname() self thread safe. [RT #26232]
+
+3226. [bug] Address minor resource leakages. [RT #26624]
+
+3221. [bug] Fixed a potential coredump on shutdown due to
+ referencing fetch context after it's been freed.
+ [RT #26720]
+
+3220. [bug] Change #3186 was incomplete; dns_db_rpz_findips()
+ could fail to set the database version correctly,
+ causing an assertion failure. [RT #26180]
3218. [security] Cache lookup could return RRSIG data associated with
nonexistent records, leading to an assertion
failure. [RT #26590]
+3217. [cleanup] Fix build problem with --disable-static. [RT #26476]
+
+3216. [bug] resolver.c:validated() was not thread-safe. [RT #26478]
+
+3213. [doc] Clarify ixfr-from-differences behavior. [RT #25188]
+
+3212. [bug] rbtdb.c: failed to remove a node from the deadnodes
+ list prior to adding a reference to it leading a
+ possible assertion failure. [RT #23219]
+
+3209. [func] Add "dnssec-lookaside 'no'". [RT #24858]
+
+3208. [bug] 'dig -y' handle unknown tsig alorithm better.
+ [RT #25522]
+
+3207. [contrib] Fixed build error in Berkeley DB DLZ module. [RT #26444]
+
+3206. [cleanup] Add ISC information to log at start time. [RT #25484]
+
+3204. [bug] When a master server that has been marked as
+ unreachable sends a NOTIFY, mark it reachable
+ again. [RT #25960]
+
+3203. [bug] Increase log level to 'info' for validation failures
+ from expired or not-yet-valid RRSIGs. [RT #21796]
+
+3200. [doc] Some rndc functions were undocumented or were
+ missing from 'rndc -h' output. [RT #25555]
+
+3198. [doc] Clarified that dnssec-settime can alter keyfile
+ permissions. [RT #24866]
+
+3196. [bug] nsupdate: return nonzero exit code when target zone
+ doesn't exist. [RT #25783]
+
+3195. [cleanup] Silence "file not found" warnings when loading
+ managed-keys zone. [RT #26340]
+
+3194. [doc] Updated RFC references in the 'empty-zones-enable'
+ documentation. [RT #25203]
+
+3193. [cleanup] Changed MAXZONEKEYS to DNS_MAXZONEKEYS, moved to
+ dnssec.h. [RT #26415]
+
+3192. [bug] A query structure could be used after being freed.
+ [RT #22208]
+
+3191. [bug] Print NULL records using "unknown" format. [RT #26392]
+
+3190. [bug] Underflow in error handling in isc_mutexblock_init.
+ [RT #26397]
+
+3189. [test] Added a summary report after system tests. [RT #25517]
+
+3188. [bug] zone.c:zone_refreshkeys() could fail to detach
+ references correctly when errors occurred, causing
+ a hang on shutdown. [RT #26372]
+
+3187. [port] win32: support for Visual Studio 2008. [RT #26356]
+
+3186. [bug] Version/db mis-match in rpz code. [RT #26180]
+
+3179. [port] kfreebsd: build issues. [RT #26273]
+
+3175. [bug] Fix how DNSSEC positive wildcard responses from a
+ NSEC3 signed zone are validated. Stop sending a
+ unnecessary NSEC3 record when generating such
+ responses. [RT #26200]
+
+3174. [bug] Always compute to revoked key tag from scratch.
+ [RT #26186]
+
+3173. [port] Correctly validate root DS responses. [RT #25726]
+
+3171. [bug] Exclusively lock the task when adding a zone using
+ 'rndc addzone'. [RT #25600]
+
+3170. [func] RPZ update:
+ - fix precedence among competing rules
+ - improve ARM text including documenting rule precedence
+ - try to rewrite CNAME chains until first hit
+ - new "rpz" logging channel
+ - RDATA for CNAME rules can include wildcards
+ - replace "NO-OP" named.conf policy override with
+ "PASSTHRU" and add "DISABLED" override ("NO-OP"
+ is still recognized)
+ [RT #25172]
+
+3169. [func] Catch db/version mis-matches when calling dns_db_*().
+ [RT #26017]
+
+3167. [bug] Negative answers from forwarders were not being
+ correctly tagged making them appear to not be cached.
+ [RT #25380]
+
+3162. [test] start.pl: modified to allow for "named.args" in
+ ns*/ subdirectory to override stock arguments to
+ named. Largely from RT#26044, but no separate ticket.
+
+3161. [bug] zone.c:del_sigs failed to always reset rdata leading
+ assertion failures. [RT #25880]
+
+3157. [tuning] Reduce the time spent in "rndc reconfig" by parsing
+ the config file before pausing the server. [RT #21373]
+
+3155. [bug] Fixed a build failure when using contrib DLZ
+ drivers (e.g., mysql, postgresql, etc). [RT #25710]
+
+3154. [bug] Attempting to print an empty rdataset could trigger
+ an assert. [RT #25452]
+
+3152. [cleanup] Some versions of gcc and clang failed due to
+ incorrect use of __builtin_expect. [RT #25183]
+
+3151. [bug] Queries for type RRSIG or SIG could be handled
+ incorrectly. [RT #21050]
+
+3148. [bug] Processing of normal queries could be stalled when
+ forwarding a UPDATE message. [RT #24711]
+
+3146. [test] Fixed gcc4.6.0 errors in ATF. [RT #25598]
+
+3145. [test] Capture output of ATF unit tests in "./atf.out" if
+ there were any errors while running them. [RT #25527]
+
+3144. [bug] dns_dbiterator_seek() could trigger an assert when
+ used with a nonexistent database node. [RT #25358]
+
+3143. [bug] Silence clang compiler warnings. [RT #25174]
+
+3139. [test] Added tests from RFC 6234, RFC 2202, and RFC 1321
+ for the hashing algorithms (md5, sha1 - sha512, and
+ their hmac counterparts). [RT #25067]
+
--- 9.8.1 released ---
--- 9.8.1rc1 released ---
@@ -14,7 +314,7 @@
3138. [bug] Address memory leaks and out-of-order operations when
shutting named down. [RT #25210]
-3136. [func] Add RFC 1918 reverse zones to the list of built-in
+3136. [func] Add RFC 1918 reverse zones to the list of built-in
empty zones switched on by the 'empty-zones-enable'
option. [RT #24990]
@@ -34,9 +334,9 @@
3133. [bug] Change #3114 was incomplete. [RT #24577]
-3131. [tuning] Improve scalability by allocating one zone task
- per 100 zones at startup time, rather than using a
- fixed-size task table. [RT #24406]
+3131. [tuning] Improve scalability by allocating one zone task
+ per 100 zones at startup time, rather than using a
+ fixed-size task table. [RT #24406]
3129. [bug] Named could crash on 'rndc reconfig' when
allow-new-zones was set to yes and named ACLs
@@ -62,10 +362,10 @@
3122. [cleanup] dnssec-settime: corrected usage message. [RT #24664]
-3121. [security] An authoritative name server sending a negative
- response containing a very large RRset could
- trigger an off-by-one error in the ncache code
- and crash named. [RT #24650]
+3121. [security] An authoritative name server sending a negative
+ response containing a very large RRset could
+ trigger an off-by-one error in the ncache code
+ and crash named. [RT #24650]
3120. [bug] Named could fail to validate zones listed in a DLV
that validated insecure without using DLV and had
@@ -99,9 +399,9 @@
"krb5-subdomain", which allow machines to update
their own records, to the BIND 9 ARM.
-3111. [bug] Improved consistency checks for dnssec-enable and
- dnssec-validation, added test cases to the
- checkconf system test. [RT #24398]
+3111. [bug] Improved consistency checks for dnssec-enable and
+ dnssec-validation, added test cases to the
+ checkconf system test. [RT #24398]
3110. [bug] dnssec-signzone: Wrong error message could appear
when attempting to sign with no KSK. [RT #24369]
@@ -109,10 +409,10 @@
3107. [bug] dnssec-signzone: Report the correct number of ZSKs
when using -x. [RT #20852]
-3105. [bug] GOST support can be suppressed by "configure
- --without-gost" [RT #24367]
+3105. [bug] GOST support can be suppressed by "configure
+ --without-gost" [RT #24367]
-3104. [bug] Better support for cross-compiling. [RT #24367]
+3104. [bug] Better support for cross-compiling. [RT #24367]
3103. [bug] Configuring 'dnssec-validation auto' in a view
instead of in the options statement could trigger
@@ -142,7 +442,7 @@
3094. [doc] Expand dns64 documentation.
-3093. [bug] Fix gssapi/kerberos dependencies [RT #23836]
+3093. [bug] Fix gssapi/kerberos dependencies [RT #23836]
3092. [bug] Signatures for records at the zone apex could go
stale due to an incorrect timer setting. [RT #23769]
@@ -151,7 +451,7 @@
and then subsequently activated could fail to trigger
automatic signing. [RT #22911]
-3090. [func] Make --with-gssapi default [RT #23738]
+3090. [func] Make --with-gssapi default [RT #23738]
3088. [bug] Remove bin/tests/system/logfileconfig/ns1/named.conf
and add setup.sh in order to resolve changing
@@ -269,9 +569,9 @@
3043. [test] Merged in the NetBSD ATF test framework (currently
version 0.12) for development of future unit tests.
- Use configure --with-atf to build ATF internally
- or configure --with-atf=prefix to use an external
- copy. [RT #23209]
+ Use configure --with-atf to build ATF internally
+ or configure --with-atf=prefix to use an external
+ copy. [RT #23209]
3042. [bug] dig +trace could fail attempting to use IPv6
addresses on systems with only IPv4 connectivity.
@@ -706,7 +1006,7 @@
2929. [bug] Improved handling of GSS security contexts:
- added LRU expiration for generated TSIGs
- added the ability to use a non-default realm
- - added new "realm" keyword in nsupdate
+ - added new "realm" keyword in nsupdate
- limited lifetime of generated keys to 1 hour
or the lifetime of the context (whichever is
smaller)
@@ -1535,7 +1835,7 @@
--with-export-includedir. [RT #20252]
2675. [bug] dnssec-signzone could crash if the key directory
- did not exist. [RT #20232]
+ did not exist. [RT #20232]
--- 9.7.0a3 released ---
@@ -1626,7 +1926,7 @@
64-bit systems. [RT #20076]
2650. [bug] Assertion failure in dnssec-signzone when trying
- to read keyset-* files. [RT #20075]
+ to read keyset-* files. [RT #20075]
2649. [bug] Set the domain for forward only zones. [RT #19944]
@@ -1698,7 +1998,7 @@
2630. [func] Improved syntax for DDNS autoconfiguration: use
"update-policy local;" to switch on local DDNS in a
zone. (The "ddns-autoconf" option has been removed.)
- [RT #19875]
+ [RT #19875]
2629. [port] Check for seteuid()/setegid(), use setresuid()/
setresgid() if not present. [RT #19932]
@@ -2383,10 +2683,10 @@
time. [RT #18277]
2423. [security] Randomize server selection on queries, so as to
- make forgery a little more difficult. Instead of
- always preferring the server with the lowest RTT,
- pick a server with RTT within the same 128
- millisecond band. [RT #18441]
+ make forgery a little more difficult. Instead of
+ always preferring the server with the lowest RTT,
+ pick a server with RTT within the same 128
+ millisecond band. [RT #18441]
2422. [bug] Handle the special return value of a empty node as
if it was a NXRRSET in the validator. [RT #18447]
@@ -2467,7 +2767,7 @@
2399. [placeholder]
-2398. [bug] Improve file descriptor management. New,
+2398. [bug] Improve file descriptor management. New,
temporary, named.conf option reserved-sockets,
default 512. [RT #18344]
diff --git a/contrib/bind9/COPYRIGHT b/contrib/bind9/COPYRIGHT
index 6f94496d4ba..6f2c8e5aa22 100644
--- a/contrib/bind9/COPYRIGHT
+++ b/contrib/bind9/COPYRIGHT
@@ -1,4 +1,4 @@
-Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
+Copyright (C) 2004-2012 Internet Systems Consortium, Inc. ("ISC")
Copyright (C) 1996-2003 Internet Software Consortium.
Permission to use, copy, modify, and/or distribute this software for any
@@ -13,7 +13,7 @@ LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
PERFORMANCE OF THIS SOFTWARE.
-$Id: COPYRIGHT,v 1.17.14.1 2011-02-22 06:34:47 marka Exp $
+$Id: COPYRIGHT,v 1.17.14.2 2012/01/04 23:46:18 tbox Exp $
Portions of this code release fall under one or more of the
following Copyright notices. Please see individual source
diff --git a/contrib/bind9/FAQ.xml b/contrib/bind9/FAQ.xml
index 4c83f764707..7b21689ce90 100644
--- a/contrib/bind9/FAQ.xml
+++ b/contrib/bind9/FAQ.xml
@@ -17,7 +17,7 @@
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
Frequently Asked Questions about BIND 9
diff --git a/contrib/bind9/Makefile.in b/contrib/bind9/Makefile.in
index f0edc926ba7..2a00df415f3 100644
--- a/contrib/bind9/Makefile.in
+++ b/contrib/bind9/Makefile.in
@@ -13,7 +13,7 @@
# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
# PERFORMANCE OF THIS SOFTWARE.
-# $Id: Makefile.in,v 1.58.250.2 2011-02-28 01:19:57 tbox Exp $
+# $Id: Makefile.in,v 1.58.250.4 2011/09/06 04:06:11 marka Exp $
srcdir = @srcdir@
VPATH = @srcdir@
@@ -64,8 +64,10 @@ tags:
check: test
test:
- (cd bin/tests && ${MAKE} ${MAKEDEFS} test)
- (test -f unit/unittest.sh && $(SHELL) unit/unittest.sh)
+ status=0; \
+ (cd bin/tests && ${MAKE} ${MAKEDEFS} test) || status=1; \
+ (test -f unit/unittest.sh && $(SHELL) unit/unittest.sh) || status=1; \
+ exit $$status
FAQ: FAQ.xml
${XSLTPROC} doc/xsl/isc-docbook-text.xsl FAQ.xml | \
diff --git a/contrib/bind9/README b/contrib/bind9/README
index 708def9dd3e..d78fb859d19 100644
--- a/contrib/bind9/README
+++ b/contrib/bind9/README
@@ -48,6 +48,14 @@ BIND 9
For a detailed list of user-visible changes from
previous releases, see the CHANGES file.
+ For up-to-date release notes and errata, see
+ http://www.isc.org/software/bind9/releasenotes
+
+BIND 9.8.2
+
+ BIND 9.8.2 includes a number of bug fixes and prevents a security
+ problem described in CVE-2011-4313
+
BIND 9.8.1
BIND 9.8.1 includes a number of bug fixes and enhancements from
@@ -314,6 +322,7 @@ Building
libraries. sh-utils-1.16 provides a "printf" which compiles
on SunOS 4.
+
Documentation
The BIND 9 Administrator Reference Manual is included with the
@@ -336,6 +345,48 @@ Documentation
in the other README files.
+Change Log
+
+ A detailed list of all changes to BIND 9 is included in the
+ file CHANGES, with the most recent changes listed first.
+ Change notes include tags indicating the category of the
+ change that was made; these categories are:
+
+ [func] New feature
+
+ [bug] General bug fix
+
+ [security] Fix for a significant security flaw
+
+ [experimental] Used for new features when the syntax
+ or other aspects of the design are still
+ in flux and may change
+
+ [port] Portability enhancement
+
+ [maint] Updates to built-in data such as root
+ server addresses and keys
+
+ [tuning] Changes to built-in configuration defaults
+ and constants to improve performanceo
+
+ [protocol] Updates to the DNS protocol such as new
+ RR types
+
+ [test] Changes to the automatic tests, not
+ affecting server functionality
+
+ [cleanup] Minor corrections and refactoring
+
+ [doc] Documentation
+
+ In general, [func] and [experimental] tags will only appear
+ in new-feature releases (i.e., those with version numbers
+ ending in zero). Some new functionality may be backported to
+ older releases on a case-by-case basis. All other change
+ types may be applied to all currently-supported releases.
+
+
Bug Reports and Mailing Lists
Bugs reports should be sent to
diff --git a/contrib/bind9/acconfig.h b/contrib/bind9/acconfig.h
index d9da221f83f..736d1bcdd31 100644
--- a/contrib/bind9/acconfig.h
+++ b/contrib/bind9/acconfig.h
@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: acconfig.h,v 1.53 2008-12-01 23:47:44 tbox Exp $ */
+/* $Id: acconfig.h,v 1.53 2008/12/01 23:47:44 tbox Exp $ */
/*! \file */
diff --git a/contrib/bind9/bin/Makefile.in b/contrib/bind9/bin/Makefile.in
index d263d795eb0..e4805520e7e 100644
--- a/contrib/bind9/bin/Makefile.in
+++ b/contrib/bind9/bin/Makefile.in
@@ -13,7 +13,7 @@
# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
# PERFORMANCE OF THIS SOFTWARE.
-# $Id: Makefile.in,v 1.29 2009-10-05 12:07:08 fdupont Exp $
+# $Id: Makefile.in,v 1.29 2009/10/05 12:07:08 fdupont Exp $
srcdir = @srcdir@
VPATH = @srcdir@
diff --git a/contrib/bind9/bin/check/Makefile.in b/contrib/bind9/bin/check/Makefile.in
index d5827dcce11..403933b2ed7 100644
--- a/contrib/bind9/bin/check/Makefile.in
+++ b/contrib/bind9/bin/check/Makefile.in
@@ -13,7 +13,7 @@
# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
# PERFORMANCE OF THIS SOFTWARE.
-# $Id: Makefile.in,v 1.36 2009-12-05 23:31:40 each Exp $
+# $Id: Makefile.in,v 1.36 2009/12/05 23:31:40 each Exp $
srcdir = @srcdir@
VPATH = @srcdir@
diff --git a/contrib/bind9/bin/check/check-tool.c b/contrib/bind9/bin/check/check-tool.c
index 4d2ca5c45ab..422d9b1cde9 100644
--- a/contrib/bind9/bin/check/check-tool.c
+++ b/contrib/bind9/bin/check/check-tool.c
@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: check-tool.c,v 1.41 2010-09-07 23:46:59 tbox Exp $ */
+/* $Id: check-tool.c,v 1.41 2010/09/07 23:46:59 tbox Exp $ */
/*! \file */
diff --git a/contrib/bind9/bin/check/check-tool.h b/contrib/bind9/bin/check/check-tool.h
index 4371ae29ec2..e988597a740 100644
--- a/contrib/bind9/bin/check/check-tool.h
+++ b/contrib/bind9/bin/check/check-tool.h
@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: check-tool.h,v 1.16 2010-09-07 23:46:59 tbox Exp $ */
+/* $Id: check-tool.h,v 1.16 2010/09/07 23:46:59 tbox Exp $ */
#ifndef CHECK_TOOL_H
#define CHECK_TOOL_H
diff --git a/contrib/bind9/bin/check/named-checkconf.8 b/contrib/bind9/bin/check/named-checkconf.8
index fabcfa916eb..67a8f4a3da6 100644
--- a/contrib/bind9/bin/check/named-checkconf.8
+++ b/contrib/bind9/bin/check/named-checkconf.8
@@ -13,7 +13,7 @@
.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
.\" PERFORMANCE OF THIS SOFTWARE.
.\"
-.\" $Id: named-checkconf.8,v 1.33 2009-12-29 01:14:03 tbox Exp $
+.\" $Id$
.\"
.hy 0
.ad l
diff --git a/contrib/bind9/bin/check/named-checkconf.c b/contrib/bind9/bin/check/named-checkconf.c
index 11a429c649c..a342dd9fbd9 100644
--- a/contrib/bind9/bin/check/named-checkconf.c
+++ b/contrib/bind9/bin/check/named-checkconf.c
@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: named-checkconf.c,v 1.54.62.2 2011-03-12 04:59:13 tbox Exp $ */
+/* $Id: named-checkconf.c,v 1.54.62.2 2011/03/12 04:59:13 tbox Exp $ */
/*! \file */
diff --git a/contrib/bind9/bin/check/named-checkconf.docbook b/contrib/bind9/bin/check/named-checkconf.docbook
index fe12cb3ea27..9535e28430c 100644
--- a/contrib/bind9/bin/check/named-checkconf.docbook
+++ b/contrib/bind9/bin/check/named-checkconf.docbook
@@ -18,7 +18,7 @@
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
June 14, 2000
diff --git a/contrib/bind9/bin/check/named-checkconf.html b/contrib/bind9/bin/check/named-checkconf.html
index f5e4cd38511..aa80c7cbe88 100644
--- a/contrib/bind9/bin/check/named-checkconf.html
+++ b/contrib/bind9/bin/check/named-checkconf.html
@@ -14,7 +14,7 @@
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
@@ -32,7 +32,7 @@
diff --git a/contrib/bind9/bin/confgen/Makefile.in b/contrib/bind9/bin/confgen/Makefile.in
index da3587982cd..64ddf760a06 100644
--- a/contrib/bind9/bin/confgen/Makefile.in
+++ b/contrib/bind9/bin/confgen/Makefile.in
@@ -12,7 +12,7 @@
# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
# PERFORMANCE OF THIS SOFTWARE.
-# $Id: Makefile.in,v 1.8 2009-12-05 23:31:40 each Exp $
+# $Id: Makefile.in,v 1.8 2009/12/05 23:31:40 each Exp $
srcdir = @srcdir@
VPATH = @srcdir@
diff --git a/contrib/bind9/bin/confgen/ddns-confgen.8 b/contrib/bind9/bin/confgen/ddns-confgen.8
index d69af398e61..fd2670e5ff4 100644
--- a/contrib/bind9/bin/confgen/ddns-confgen.8
+++ b/contrib/bind9/bin/confgen/ddns-confgen.8
@@ -12,7 +12,7 @@
.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
.\" PERFORMANCE OF THIS SOFTWARE.
.\"
-.\" $Id: ddns-confgen.8,v 1.10 2009-09-19 01:14:52 tbox Exp $
+.\" $Id$
.\"
.hy 0
.ad l
diff --git a/contrib/bind9/bin/confgen/ddns-confgen.c b/contrib/bind9/bin/confgen/ddns-confgen.c
index 3fdf4d47417..826b500d950 100644
--- a/contrib/bind9/bin/confgen/ddns-confgen.c
+++ b/contrib/bind9/bin/confgen/ddns-confgen.c
@@ -14,7 +14,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: ddns-confgen.c,v 1.9.308.2 2011-03-12 04:59:13 tbox Exp $ */
+/* $Id: ddns-confgen.c,v 1.9.308.2 2011/03/12 04:59:13 tbox Exp $ */
/*! \file */
diff --git a/contrib/bind9/bin/confgen/ddns-confgen.docbook b/contrib/bind9/bin/confgen/ddns-confgen.docbook
index 2b3e1c0556a..cedfbf5726c 100644
--- a/contrib/bind9/bin/confgen/ddns-confgen.docbook
+++ b/contrib/bind9/bin/confgen/ddns-confgen.docbook
@@ -17,7 +17,7 @@
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
Jan 29, 2009
diff --git a/contrib/bind9/bin/confgen/ddns-confgen.html b/contrib/bind9/bin/confgen/ddns-confgen.html
index 17c3f26dcca..6b2f7dc5d56 100644
--- a/contrib/bind9/bin/confgen/ddns-confgen.html
+++ b/contrib/bind9/bin/confgen/ddns-confgen.html
@@ -13,7 +13,7 @@
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
@@ -31,7 +31,7 @@
ddns-confgen [-a algorithm] [-h] [-k keyname] [-r randomfile] [ -s name | -z zone ] [-q] [name]
-
DESCRIPTION
+
DESCRIPTION
ddns-confgen
generates a key for use by nsupdate
and named. It simplifies configuration
@@ -58,7 +58,7 @@
diff --git a/contrib/bind9/bin/confgen/unix/Makefile.in b/contrib/bind9/bin/confgen/unix/Makefile.in
index 1785e0d0f4d..924701e61ff 100644
--- a/contrib/bind9/bin/confgen/unix/Makefile.in
+++ b/contrib/bind9/bin/confgen/unix/Makefile.in
@@ -12,7 +12,7 @@
# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
# PERFORMANCE OF THIS SOFTWARE.
-# $Id: Makefile.in,v 1.3 2009-06-11 23:47:55 tbox Exp $
+# $Id: Makefile.in,v 1.3 2009/06/11 23:47:55 tbox Exp $
srcdir = @srcdir@
VPATH = @srcdir@
diff --git a/contrib/bind9/bin/confgen/unix/os.c b/contrib/bind9/bin/confgen/unix/os.c
index e439a518264..3901350d770 100644
--- a/contrib/bind9/bin/confgen/unix/os.c
+++ b/contrib/bind9/bin/confgen/unix/os.c
@@ -14,7 +14,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: os.c,v 1.3 2009-06-11 23:47:55 tbox Exp $ */
+/* $Id: os.c,v 1.3 2009/06/11 23:47:55 tbox Exp $ */
/*! \file */
diff --git a/contrib/bind9/bin/confgen/util.c b/contrib/bind9/bin/confgen/util.c
index 158a8d35581..5f5f817a5d3 100644
--- a/contrib/bind9/bin/confgen/util.c
+++ b/contrib/bind9/bin/confgen/util.c
@@ -14,7 +14,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: util.c,v 1.3 2009-06-11 23:47:55 tbox Exp $ */
+/* $Id: util.c,v 1.3 2009/06/11 23:47:55 tbox Exp $ */
/*! \file */
diff --git a/contrib/bind9/bin/confgen/util.h b/contrib/bind9/bin/confgen/util.h
index 651b6e558cf..f3b2ec9dee1 100644
--- a/contrib/bind9/bin/confgen/util.h
+++ b/contrib/bind9/bin/confgen/util.h
@@ -14,7 +14,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: util.h,v 1.4 2009-09-29 15:06:05 fdupont Exp $ */
+/* $Id: util.h,v 1.4 2009/09/29 15:06:05 fdupont Exp $ */
#ifndef RNDC_UTIL_H
#define RNDC_UTIL_H 1
diff --git a/contrib/bind9/bin/dig/Makefile.in b/contrib/bind9/bin/dig/Makefile.in
index bebef6f45d3..19dc61c4353 100644
--- a/contrib/bind9/bin/dig/Makefile.in
+++ b/contrib/bind9/bin/dig/Makefile.in
@@ -13,7 +13,7 @@
# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
# PERFORMANCE OF THIS SOFTWARE.
-# $Id: Makefile.in,v 1.47 2009-12-05 23:31:40 each Exp $
+# $Id: Makefile.in,v 1.47 2009/12/05 23:31:40 each Exp $
srcdir = @srcdir@
VPATH = @srcdir@
diff --git a/contrib/bind9/bin/dig/dig.1 b/contrib/bind9/bin/dig/dig.1
index 87d5045701c..6e3bfb6c0c6 100644
--- a/contrib/bind9/bin/dig/dig.1
+++ b/contrib/bind9/bin/dig/dig.1
@@ -13,7 +13,7 @@
.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
.\" PERFORMANCE OF THIS SOFTWARE.
.\"
-.\" $Id: dig.1,v 1.54 2010-03-05 01:14:15 tbox Exp $
+.\" $Id$
.\"
.hy 0
.ad l
diff --git a/contrib/bind9/bin/dig/dig.c b/contrib/bind9/bin/dig/dig.c
index 72883872127..5e5ec0fa48d 100644
--- a/contrib/bind9/bin/dig/dig.c
+++ b/contrib/bind9/bin/dig/dig.c
@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: dig.c,v 1.237.124.3 2011-03-11 06:46:58 marka Exp $ */
+/* $Id: dig.c,v 1.237.124.4 2011/12/07 17:23:55 each Exp $ */
/*! \file */
@@ -1527,7 +1527,7 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
if (strncmp(rv[0], "%", 1) == 0)
break;
if (strncmp(rv[0], "@", 1) == 0) {
- addresscount = getaddresses(lookup, &rv[0][1]);
+ addresscount = getaddresses(lookup, &rv[0][1], NULL);
} else if (rv[0][0] == '+') {
plus_option(&rv[0][1], is_batchfile,
lookup);
diff --git a/contrib/bind9/bin/dig/dig.docbook b/contrib/bind9/bin/dig/dig.docbook
index 19e2ca2afbf..d64d038b500 100644
--- a/contrib/bind9/bin/dig/dig.docbook
+++ b/contrib/bind9/bin/dig/dig.docbook
@@ -18,7 +18,7 @@
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
diff --git a/contrib/bind9/bin/dig/dig.html b/contrib/bind9/bin/dig/dig.html
index c9ce8f0e254..ceef3fa8d98 100644
--- a/contrib/bind9/bin/dig/dig.html
+++ b/contrib/bind9/bin/dig/dig.html
@@ -14,7 +14,7 @@
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
@@ -34,7 +34,7 @@
dig [global-queryopt...] [query...]
-
DESCRIPTION
+
DESCRIPTION
dig
(domain information groper) is a flexible tool
for interrogating DNS name servers. It performs DNS lookups and
@@ -80,7 +80,7 @@
-
SIMPLE USAGE
+
SIMPLE USAGE
A typical invocation of dig looks like:
@@ -126,7 +126,7 @@
-
OPTIONS
+
OPTIONS
The -b option sets the source IP address of the query
to address. This must be a valid
@@ -230,7 +230,7 @@
-
QUERY OPTIONS
+
QUERY OPTIONS
dig
provides a number of query options which affect
the way in which lookups are made and the results displayed. Some of
@@ -561,7 +561,7 @@
-
MULTIPLE QUERIES
+
MULTIPLE QUERIES
The BIND 9 implementation of dig
supports
@@ -607,7 +607,7 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
-
IDN SUPPORT
+
IDN SUPPORT
If dig has been built with IDN (internationalized
domain name) support, it can accept and display non-ASCII domain names.
@@ -621,14 +621,14 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
host
is a simple utility for performing DNS lookups.
It is normally used to convert names to IP addresses and vice versa.
@@ -184,7 +184,7 @@
-
IDN SUPPORT
+
IDN SUPPORT
If host has been built with IDN (internationalized
domain name) support, it can accept and display non-ASCII domain names.
@@ -198,12 +198,12 @@
-
FILES
+
FILES
/etc/resolv.conf
-
SEE ALSO
+
SEE ALSO
dig(1),
named(8).
diff --git a/contrib/bind9/bin/dig/include/dig/dig.h b/contrib/bind9/bin/dig/include/dig/dig.h
index 2db5de552fc..6c186dec5e4 100644
--- a/contrib/bind9/bin/dig/include/dig/dig.h
+++ b/contrib/bind9/bin/dig/include/dig/dig.h
@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: dig.h,v 1.111.306.2 2011-02-28 01:19:58 tbox Exp $ */
+/* $Id: dig.h,v 1.111.306.3 2011/12/07 17:23:55 each Exp $ */
#ifndef DIG_H
#define DIG_H
@@ -289,7 +289,7 @@ isc_result_t
get_address(char *host, in_port_t port, isc_sockaddr_t *sockaddr);
int
-getaddresses(dig_lookup_t *lookup, const char *host);
+getaddresses(dig_lookup_t *lookup, const char *host, isc_result_t *resultp);
isc_result_t
get_reverse(char *reverse, size_t len, char *value, isc_boolean_t ip6_int,
diff --git a/contrib/bind9/bin/dig/nslookup.1 b/contrib/bind9/bin/dig/nslookup.1
index e97ee1f9ba3..f988995ba86 100644
--- a/contrib/bind9/bin/dig/nslookup.1
+++ b/contrib/bind9/bin/dig/nslookup.1
@@ -12,7 +12,7 @@
.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
.\" PERFORMANCE OF THIS SOFTWARE.
.\"
-.\" $Id: nslookup.1,v 1.16 2010-02-23 01:14:31 tbox Exp $
+.\" $Id$
.\"
.hy 0
.ad l
diff --git a/contrib/bind9/bin/dig/nslookup.c b/contrib/bind9/bin/dig/nslookup.c
index e327c0f7fce..48c390b8ae0 100644
--- a/contrib/bind9/bin/dig/nslookup.c
+++ b/contrib/bind9/bin/dig/nslookup.c
@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: nslookup.c,v 1.127.38.2 2011-02-28 01:19:58 tbox Exp $ */
+/* $Id: nslookup.c,v 1.127.38.2 2011/02/28 01:19:58 tbox Exp $ */
#include
diff --git a/contrib/bind9/bin/dig/nslookup.docbook b/contrib/bind9/bin/dig/nslookup.docbook
index 9c4789d4cb1..f4d497b3998 100644
--- a/contrib/bind9/bin/dig/nslookup.docbook
+++ b/contrib/bind9/bin/dig/nslookup.docbook
@@ -17,7 +17,7 @@
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
-
+
@@ -21,7 +21,7 @@
-
+
Name
nslookup — query Internet name servers interactively
@@ -31,7 +31,7 @@
nslookup [-option] [name | -] [server]
-
DESCRIPTION
+
DESCRIPTION
Nslookup
is a program to query Internet domain name servers. Nslookup
has two modes: interactive and non-interactive. Interactive mode allows
@@ -43,7 +43,7 @@
-
ARGUMENTS
+
ARGUMENTS
Interactive mode is entered in the following cases:
dnssec-keyfromlabel
gets keys with the given label from a crypto hardware and builds
key files for DNSSEC (Secure DNS), as defined in RFC 2535
@@ -44,7 +44,7 @@
-
OPTIONS
+
OPTIONS
-a algorithm
@@ -163,7 +163,7 @@
-
TIMING OPTIONS
+
TIMING OPTIONS
Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.
If the argument begins with a '+' or '-', it is interpreted as
@@ -210,7 +210,7 @@
-
GENERATED KEY FILES
+
GENERATED KEY FILES
When dnssec-keyfromlabel completes
successfully,
@@ -249,7 +249,7 @@
diff --git a/contrib/bind9/bin/dnssec/dnssec-revoke.8 b/contrib/bind9/bin/dnssec/dnssec-revoke.8
index d57b6aa09de..2af719e249d 100644
--- a/contrib/bind9/bin/dnssec/dnssec-revoke.8
+++ b/contrib/bind9/bin/dnssec/dnssec-revoke.8
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2009 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2009, 2011 Internet Systems Consortium, Inc. ("ISC")
.\"
.\" Permission to use, copy, modify, and/or distribute this software for any
.\" purpose with or without fee is hereby granted, provided that the above
@@ -12,7 +12,7 @@
.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
.\" PERFORMANCE OF THIS SOFTWARE.
.\"
-.\" $Id: dnssec-revoke.8,v 1.9 2010-05-19 01:14:14 tbox Exp $
+.\" $Id$
.\"
.hy 0
.ad l
@@ -32,7 +32,7 @@
dnssec\-revoke \- Set the REVOKED bit on a DNSSEC key
.SH "SYNOPSIS"
.HP 14
-\fBdnssec\-revoke\fR [\fB\-hr\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-f\fR] {keyfile}
+\fBdnssec\-revoke\fR [\fB\-hr\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-f\fR] [\fB\-R\fR] {keyfile}
.SH "DESCRIPTION"
.PP
\fBdnssec\-revoke\fR
@@ -70,6 +70,11 @@ Force overwrite: Causes
\fBdnssec\-revoke\fR
to write the new key pair even if a file already exists matching the algorithm and key ID of the revoked key.
.RE
+.PP
+\-R
+.RS 4
+Print the key tag of the key with the REVOKE bit set but do not revoke the key.
+.RE
.SH "SEE ALSO"
.PP
\fBdnssec\-keygen\fR(8),
@@ -79,5 +84,5 @@ RFC 5011.
.PP
Internet Systems Consortium
.SH "COPYRIGHT"
-Copyright \(co 2009 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2009, 2011 Internet Systems Consortium, Inc. ("ISC")
.br
diff --git a/contrib/bind9/bin/dnssec/dnssec-revoke.c b/contrib/bind9/bin/dnssec/dnssec-revoke.c
index 90e905c4d0b..8346f1c9118 100644
--- a/contrib/bind9/bin/dnssec/dnssec-revoke.c
+++ b/contrib/bind9/bin/dnssec/dnssec-revoke.c
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2009, 2010 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2009-2011 Internet Systems Consortium, Inc. ("ISC")
*
* Permission to use, copy, modify, and/or distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
@@ -14,7 +14,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: dnssec-revoke.c,v 1.22 2010-05-06 23:50:56 tbox Exp $ */
+/* $Id: dnssec-revoke.c,v 1.22.124.2 2011/10/20 23:46:27 tbox Exp $ */
/*! \file */
@@ -92,6 +92,7 @@ main(int argc, char **argv) {
isc_buffer_t buf;
isc_boolean_t force = ISC_FALSE;
isc_boolean_t remove = ISC_FALSE;
+ isc_boolean_t id = ISC_FALSE;
if (argc == 1)
usage();
@@ -104,7 +105,7 @@ main(int argc, char **argv) {
isc_commandline_errprint = ISC_FALSE;
- while ((ch = isc_commandline_parse(argc, argv, "E:fK:rhv:")) != -1) {
+ while ((ch = isc_commandline_parse(argc, argv, "E:fK:rRhv:")) != -1) {
switch (ch) {
case 'E':
engine = isc_commandline_argument;
@@ -126,6 +127,9 @@ main(int argc, char **argv) {
case 'r':
remove = ISC_TRUE;
break;
+ case 'R':
+ id = ISC_TRUE;
+ break;
case 'v':
verbose = strtol(isc_commandline_argument, &endp, 0);
if (*endp != '\0')
@@ -186,6 +190,10 @@ main(int argc, char **argv) {
fatal("Invalid keyfile name %s: %s",
filename, isc_result_totext(result));
+ if (id) {
+ fprintf(stdout, "%u\n", dst_key_rid(key));
+ goto cleanup;
+ }
dst_key_format(key, keystr, sizeof(keystr));
if (verbose > 2)
diff --git a/contrib/bind9/bin/dnssec/dnssec-revoke.docbook b/contrib/bind9/bin/dnssec/dnssec-revoke.docbook
index b7b56202130..99518bb2f2f 100644
--- a/contrib/bind9/bin/dnssec/dnssec-revoke.docbook
+++ b/contrib/bind9/bin/dnssec/dnssec-revoke.docbook
@@ -2,7 +2,7 @@
"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
[]>
-
+
June 1, 2009
@@ -37,6 +37,7 @@
2009
+ 2011Internet Systems Consortium, Inc. ("ISC")
@@ -49,6 +50,7 @@
+ keyfile
@@ -123,6 +125,16 @@
+
+
+ -R
+
+
+ Print the key tag of the key with the REVOKE bit set but do
+ not revoke the key.
+
+
+
diff --git a/contrib/bind9/bin/dnssec/dnssec-revoke.html b/contrib/bind9/bin/dnssec/dnssec-revoke.html
index fad9ac52019..b3b71b961cf 100644
--- a/contrib/bind9/bin/dnssec/dnssec-revoke.html
+++ b/contrib/bind9/bin/dnssec/dnssec-revoke.html
@@ -1,5 +1,5 @@
-
+
@@ -28,10 +28,10 @@
dnssec-revoke
reads a DNSSEC key file, sets the REVOKED bit on the key as defined
in RFC 5011, and creates a new pair of key files containing the
@@ -39,7 +39,7 @@
-
OPTIONS
+
OPTIONS
-h
@@ -69,17 +69,22 @@
write the new key pair even if a file already exists matching
the algorithm and key ID of the revoked key.
+
-R
+
+ Print the key tag of the key with the REVOKE bit set but do
+ not revoke the key.
+
diff --git a/contrib/bind9/bin/dnssec/dnssec-settime.8 b/contrib/bind9/bin/dnssec/dnssec-settime.8
index cbe4092e52a..8a5e2e78900 100644
--- a/contrib/bind9/bin/dnssec/dnssec-settime.8
+++ b/contrib/bind9/bin/dnssec/dnssec-settime.8
@@ -12,7 +12,7 @@
.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
.\" PERFORMANCE OF THIS SOFTWARE.
.\"
-.\" $Id: dnssec-settime.8,v 1.14.70.1 2011-03-22 02:37:44 tbox Exp $
+.\" $Id$
.\"
.hy 0
.ad l
@@ -52,7 +52,7 @@ simply prints the key timing metadata already stored in the key.
.PP
When key metadata fields are changed, both files of a key pair (\fIKnnnn.+aaa+iiiii.key\fR
and
-\fIKnnnn.+aaa+iiiii.private\fR) are regenerated. Metadata fields are stored in the private file. A human\-readable description of the metadata is also placed in comments in the key file.
+\fIKnnnn.+aaa+iiiii.private\fR) are regenerated. Metadata fields are stored in the private file. A human\-readable description of the metadata is also placed in comments in the key file. The private file's permissions are always set to be inaccessible to anyone other than the owner (mode 0600).
.SH "OPTIONS"
.PP
\-f
diff --git a/contrib/bind9/bin/dnssec/dnssec-settime.c b/contrib/bind9/bin/dnssec/dnssec-settime.c
index a1258ef30cd..7a814904a99 100644
--- a/contrib/bind9/bin/dnssec/dnssec-settime.c
+++ b/contrib/bind9/bin/dnssec/dnssec-settime.c
@@ -14,7 +14,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: dnssec-settime.c,v 1.28.16.3 2011-06-02 20:24:11 each Exp $ */
+/* $Id: dnssec-settime.c,v 1.28.16.3 2011/06/02 20:24:11 each Exp $ */
/*! \file */
diff --git a/contrib/bind9/bin/dnssec/dnssec-settime.docbook b/contrib/bind9/bin/dnssec/dnssec-settime.docbook
index daf720ba936..3d89b651b47 100644
--- a/contrib/bind9/bin/dnssec/dnssec-settime.docbook
+++ b/contrib/bind9/bin/dnssec/dnssec-settime.docbook
@@ -17,7 +17,7 @@
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
July 15, 2009
@@ -82,7 +82,8 @@
Knnnn.+aaa+iiiii.private) are regenerated.
Metadata fields are stored in the private file. A human-readable
description of the metadata is also placed in comments in the key
- file.
+ file. The private file's permissions are always set to be
+ inaccessible to anyone other than the owner (mode 0600).
diff --git a/contrib/bind9/bin/dnssec/dnssec-settime.html b/contrib/bind9/bin/dnssec/dnssec-settime.html
index baca8f56ece..0ac82bcbd3d 100644
--- a/contrib/bind9/bin/dnssec/dnssec-settime.html
+++ b/contrib/bind9/bin/dnssec/dnssec-settime.html
@@ -13,7 +13,7 @@
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
@@ -31,7 +31,7 @@
dnssec-settime
reads a DNSSEC private key file and sets the key timing metadata
as specified by the -P, -A,
@@ -52,11 +52,12 @@
Knnnn.+aaa+iiiii.private) are regenerated.
Metadata fields are stored in the private file. A human-readable
description of the metadata is also placed in comments in the key
- file.
+ file. The private file's permissions are always set to be
+ inaccessible to anyone other than the owner (mode 0600).
-
OPTIONS
+
OPTIONS
-f
@@ -89,7 +90,7 @@
-
TIMING OPTIONS
+
TIMING OPTIONS
Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.
If the argument begins with a '+' or '-', it is interpreted as
@@ -168,7 +169,7 @@
-
PRINTING OPTIONS
+
PRINTING OPTIONS
dnssec-settime can also be used to print the
timing metadata associated with a key.
@@ -194,7 +195,7 @@
diff --git a/contrib/bind9/bin/dnssec/dnssec-signzone.8 b/contrib/bind9/bin/dnssec/dnssec-signzone.8
index 9822883747b..028068803cd 100644
--- a/contrib/bind9/bin/dnssec/dnssec-signzone.8
+++ b/contrib/bind9/bin/dnssec/dnssec-signzone.8
@@ -13,7 +13,7 @@
.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
.\" PERFORMANCE OF THIS SOFTWARE.
.\"
-.\" $Id: dnssec-signzone.8,v 1.59 2009-12-04 01:13:44 tbox Exp $
+.\" $Id$
.\"
.hy 0
.ad l
diff --git a/contrib/bind9/bin/dnssec/dnssec-signzone.c b/contrib/bind9/bin/dnssec/dnssec-signzone.c
index fe02d2e6bce..953e2b086fc 100644
--- a/contrib/bind9/bin/dnssec/dnssec-signzone.c
+++ b/contrib/bind9/bin/dnssec/dnssec-signzone.c
@@ -29,7 +29,7 @@
* IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: dnssec-signzone.c,v 1.262.110.9 2011-07-19 23:47:12 tbox Exp $ */
+/* $Id: dnssec-signzone.c,v 1.262.110.9 2011/07/19 23:47:12 tbox Exp $ */
/*! \file */
diff --git a/contrib/bind9/bin/dnssec/dnssec-signzone.docbook b/contrib/bind9/bin/dnssec/dnssec-signzone.docbook
index 51a14968a9c..128ebe96341 100644
--- a/contrib/bind9/bin/dnssec/dnssec-signzone.docbook
+++ b/contrib/bind9/bin/dnssec/dnssec-signzone.docbook
@@ -18,7 +18,7 @@
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
June 05, 2009
diff --git a/contrib/bind9/bin/dnssec/dnssec-signzone.html b/contrib/bind9/bin/dnssec/dnssec-signzone.html
index 28e7158e6e7..82185c6477d 100644
--- a/contrib/bind9/bin/dnssec/dnssec-signzone.html
+++ b/contrib/bind9/bin/dnssec/dnssec-signzone.html
@@ -14,7 +14,7 @@
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
@@ -32,7 +32,7 @@
zone stringoptional_class {
type ( master | slave | stub | hint |
@@ -619,12 +618,12 @@ zone
-
FILES
+
FILES
/etc/named.conf
-
SEE ALSO
+
SEE ALSO
named(8),
named-checkconf(8),
rndc(8),
diff --git a/contrib/bind9/bin/named/named.docbook b/contrib/bind9/bin/named/named.docbook
index 214f8ac6e9d..c748911e24a 100644
--- a/contrib/bind9/bin/named/named.docbook
+++ b/contrib/bind9/bin/named/named.docbook
@@ -18,7 +18,7 @@
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
May 21, 2009
diff --git a/contrib/bind9/bin/named/named.html b/contrib/bind9/bin/named/named.html
index fa869c4c6d1..cf3cb2678f3 100644
--- a/contrib/bind9/bin/named/named.html
+++ b/contrib/bind9/bin/named/named.html
@@ -14,7 +14,7 @@
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
@@ -32,7 +32,7 @@
nsupdate
is used to submit Dynamic DNS Update requests as defined in RFC 2136
to a name server.
@@ -192,7 +192,7 @@
-
INPUT FORMAT
+
INPUT FORMAT
nsupdate
reads input from
filename
@@ -480,7 +480,7 @@
-
EXAMPLES
+
EXAMPLES
The examples below show how
nsupdate
@@ -534,7 +534,7 @@
-
FILES
+
FILES
/etc/resolv.conf
@@ -557,7 +557,7 @@
-
SEE ALSO
+
SEE ALSO
RFC 2136,
RFC 3007,
@@ -572,7 +572,7 @@
-
BUGS
+
BUGS
The TSIG key is redundantly stored in two separate files.
This is a consequence of nsupdate using the DST library
diff --git a/contrib/bind9/bin/rndc/Makefile.in b/contrib/bind9/bin/rndc/Makefile.in
index 6c7c56f4abf..e67bad7efc5 100644
--- a/contrib/bind9/bin/rndc/Makefile.in
+++ b/contrib/bind9/bin/rndc/Makefile.in
@@ -13,7 +13,7 @@
# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
# PERFORMANCE OF THIS SOFTWARE.
-# $Id: Makefile.in,v 1.49 2009-12-05 23:31:40 each Exp $
+# $Id: Makefile.in,v 1.49 2009/12/05 23:31:40 each Exp $
srcdir = @srcdir@
VPATH = @srcdir@
diff --git a/contrib/bind9/bin/rndc/include/rndc/os.h b/contrib/bind9/bin/rndc/include/rndc/os.h
index 91986cb0c1d..3f2c7767e85 100644
--- a/contrib/bind9/bin/rndc/include/rndc/os.h
+++ b/contrib/bind9/bin/rndc/include/rndc/os.h
@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: os.h,v 1.12 2009-06-10 00:27:21 each Exp $ */
+/* $Id: os.h,v 1.12 2009/06/10 00:27:21 each Exp $ */
/*! \file */
diff --git a/contrib/bind9/bin/rndc/rndc.8 b/contrib/bind9/bin/rndc/rndc.8
index e4d723bb519..7197ed0b928 100644
--- a/contrib/bind9/bin/rndc/rndc.8
+++ b/contrib/bind9/bin/rndc/rndc.8
@@ -13,7 +13,7 @@
.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
.\" PERFORMANCE OF THIS SOFTWARE.
.\"
-.\" $Id: rndc.8,v 1.43 2009-07-11 01:12:46 tbox Exp $
+.\" $Id$
.\"
.hy 0
.ad l
diff --git a/contrib/bind9/bin/rndc/rndc.c b/contrib/bind9/bin/rndc/rndc.c
index 1e9c3b064a8..5811cfa141f 100644
--- a/contrib/bind9/bin/rndc/rndc.c
+++ b/contrib/bind9/bin/rndc/rndc.c
@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: rndc.c,v 1.131.20.2 2011-02-28 01:19:59 tbox Exp $ */
+/* $Id: rndc.c,v 1.131.20.3 2011/11/03 22:06:31 each Exp $ */
/*! \file */
@@ -142,13 +142,17 @@ command is one of the following:\n\
Flush the given name from the server's cache(s)\n\
status Display status of the server.\n\
recursing Dump the queries that are currently recursing (named.recursing)\n\
+ tsig-list List all currently active TSIG keys, including both statically\n\
+ configured and TKEY-negotiated keys.\n\
+ tsig-delete keyname [view] \n\
+ Delete a TKEY-negotiated TSIG key.\n\
validation newstate [view]\n\
Enable / disable DNSSEC validation.\n\
- *restart Restart the server.\n\
addzone [\"file\"] zone [class [view]] { zone-options }\n\
Add zone to given view. Requires new-zone-file option.\n\
delzone [\"file\"] zone [class [view]]\n\
Removes zone from given view. Requires new-zone-file option.\n\
+ *restart Restart the server.\n\
\n\
* == not yet implemented\n\
Version: %s\n",
diff --git a/contrib/bind9/bin/rndc/rndc.conf b/contrib/bind9/bin/rndc/rndc.conf
index 057028a94b2..67542b91c7a 100644
--- a/contrib/bind9/bin/rndc/rndc.conf
+++ b/contrib/bind9/bin/rndc/rndc.conf
@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: rndc.conf,v 1.11 2007-06-19 23:46:59 tbox Exp $ */
+/* $Id: rndc.conf,v 1.11 2007/06/19 23:46:59 tbox Exp $ */
/*
* Sample rndc configuration file.
diff --git a/contrib/bind9/bin/rndc/rndc.conf.5 b/contrib/bind9/bin/rndc/rndc.conf.5
index 54c4af9c21f..694a4815dac 100644
--- a/contrib/bind9/bin/rndc/rndc.conf.5
+++ b/contrib/bind9/bin/rndc/rndc.conf.5
@@ -13,7 +13,7 @@
.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
.\" PERFORMANCE OF THIS SOFTWARE.
.\"
-.\" $Id: rndc.conf.5,v 1.41 2009-07-11 01:12:46 tbox Exp $
+.\" $Id$
.\"
.hy 0
.ad l
diff --git a/contrib/bind9/bin/rndc/rndc.conf.docbook b/contrib/bind9/bin/rndc/rndc.conf.docbook
index 4a92682ca97..9de1995467f 100644
--- a/contrib/bind9/bin/rndc/rndc.conf.docbook
+++ b/contrib/bind9/bin/rndc/rndc.conf.docbook
@@ -18,7 +18,7 @@
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
June 30, 2000
diff --git a/contrib/bind9/bin/rndc/rndc.conf.html b/contrib/bind9/bin/rndc/rndc.conf.html
index 463b99fd2c2..b0f904b2ab3 100644
--- a/contrib/bind9/bin/rndc/rndc.conf.html
+++ b/contrib/bind9/bin/rndc/rndc.conf.html
@@ -14,7 +14,7 @@
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
@@ -32,7 +32,7 @@
rndc.conf
-
DESCRIPTION
+
DESCRIPTION
rndc.conf is the configuration file
for rndc, the BIND 9 name server control
utility. This file has a similar structure and syntax to
@@ -117,7 +117,7 @@
diff --git a/contrib/bind9/bin/rndc/rndc.docbook b/contrib/bind9/bin/rndc/rndc.docbook
index 3bf63259c78..d407f2b515c 100644
--- a/contrib/bind9/bin/rndc/rndc.docbook
+++ b/contrib/bind9/bin/rndc/rndc.docbook
@@ -18,7 +18,7 @@
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
June 30, 2000
diff --git a/contrib/bind9/bin/rndc/rndc.html b/contrib/bind9/bin/rndc/rndc.html
index ecc0f318614..4195c4e07e9 100644
--- a/contrib/bind9/bin/rndc/rndc.html
+++ b/contrib/bind9/bin/rndc/rndc.html
@@ -14,7 +14,7 @@
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
@@ -32,7 +32,7 @@
diff --git a/contrib/bind9/bin/rndc/util.c b/contrib/bind9/bin/rndc/util.c
index 8a7078a2135..c654462bf04 100644
--- a/contrib/bind9/bin/rndc/util.c
+++ b/contrib/bind9/bin/rndc/util.c
@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: util.c,v 1.7 2007-06-19 23:46:59 tbox Exp $ */
+/* $Id: util.c,v 1.7 2007/06/19 23:46:59 tbox Exp $ */
/*! \file */
diff --git a/contrib/bind9/bin/rndc/util.h b/contrib/bind9/bin/rndc/util.h
index 8eba61a57ee..d7277148ffa 100644
--- a/contrib/bind9/bin/rndc/util.h
+++ b/contrib/bind9/bin/rndc/util.h
@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: util.h,v 1.12 2009-09-29 23:48:03 tbox Exp $ */
+/* $Id: util.h,v 1.12 2009/09/29 23:48:03 tbox Exp $ */
#ifndef RNDC_UTIL_H
#define RNDC_UTIL_H 1
diff --git a/contrib/bind9/bin/tools/Makefile.in b/contrib/bind9/bin/tools/Makefile.in
index 35b8285715d..a77376b251e 100644
--- a/contrib/bind9/bin/tools/Makefile.in
+++ b/contrib/bind9/bin/tools/Makefile.in
@@ -12,7 +12,7 @@
# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
# PERFORMANCE OF THIS SOFTWARE.
-# $Id: Makefile.in,v 1.13 2010-01-07 23:48:53 tbox Exp $
+# $Id: Makefile.in,v 1.13 2010/01/07 23:48:53 tbox Exp $
srcdir = @srcdir@
VPATH = @srcdir@
diff --git a/contrib/bind9/bin/tools/arpaname.1 b/contrib/bind9/bin/tools/arpaname.1
index 66623801814..5b582514224 100644
--- a/contrib/bind9/bin/tools/arpaname.1
+++ b/contrib/bind9/bin/tools/arpaname.1
@@ -12,7 +12,7 @@
.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
.\" PERFORMANCE OF THIS SOFTWARE.
.\"
-.\" $Id: arpaname.1,v 1.4 2010-05-19 01:14:14 tbox Exp $
+.\" $Id$
.\"
.hy 0
.ad l
diff --git a/contrib/bind9/bin/tools/arpaname.c b/contrib/bind9/bin/tools/arpaname.c
index e7f14345dfd..356a883a45d 100644
--- a/contrib/bind9/bin/tools/arpaname.c
+++ b/contrib/bind9/bin/tools/arpaname.c
@@ -14,7 +14,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: arpaname.c,v 1.4 2009-10-27 03:05:33 marka Exp $ */
+/* $Id: arpaname.c,v 1.4 2009/10/27 03:05:33 marka Exp $ */
#include "config.h"
diff --git a/contrib/bind9/bin/tools/arpaname.docbook b/contrib/bind9/bin/tools/arpaname.docbook
index a7eb79e9c3b..6fb3ca29e5a 100644
--- a/contrib/bind9/bin/tools/arpaname.docbook
+++ b/contrib/bind9/bin/tools/arpaname.docbook
@@ -17,7 +17,7 @@
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
March 4, 2009
diff --git a/contrib/bind9/bin/tools/arpaname.html b/contrib/bind9/bin/tools/arpaname.html
index e44cfbd782e..92f46b4f71f 100644
--- a/contrib/bind9/bin/tools/arpaname.html
+++ b/contrib/bind9/bin/tools/arpaname.html
@@ -13,7 +13,7 @@
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
@@ -31,20 +31,20 @@
arpaname {ipaddress ...}
-
DESCRIPTION
+
DESCRIPTION
arpaname translates IP addresses (IPv4 and
IPv6) to the corresponding IN-ADDR.ARPA or IP6.ARPA names.
-
SEE ALSO
+
SEE ALSO
BIND 9 Administrator Reference Manual.
-
AUTHOR
+
AUTHOR
Internet Systems Consortium
diff --git a/contrib/bind9/bin/tools/genrandom.8 b/contrib/bind9/bin/tools/genrandom.8
index 5005658c9a1..38c1ccd67c2 100644
--- a/contrib/bind9/bin/tools/genrandom.8
+++ b/contrib/bind9/bin/tools/genrandom.8
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2009-2011 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2009-2012 Internet Systems Consortium, Inc. ("ISC")
.\"
.\" Permission to use, copy, modify, and/or distribute this software for any
.\" purpose with or without fee is hereby granted, provided that the above
@@ -12,7 +12,7 @@
.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
.\" PERFORMANCE OF THIS SOFTWARE.
.\"
-.\" $Id: genrandom.8,v 1.8.124.1 2011-08-09 01:52:58 tbox Exp $
+.\" $Id$
.\"
.hy 0
.ad l
@@ -65,5 +65,5 @@ The file name into which random data should be written.
.PP
Internet Systems Consortium
.SH "COPYRIGHT"
-Copyright \(co 2009\-2011 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2009\-2012 Internet Systems Consortium, Inc. ("ISC")
.br
diff --git a/contrib/bind9/bin/tools/genrandom.c b/contrib/bind9/bin/tools/genrandom.c
index 8473be25940..675e5043d60 100644
--- a/contrib/bind9/bin/tools/genrandom.c
+++ b/contrib/bind9/bin/tools/genrandom.c
@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: genrandom.c,v 1.7 2010-05-17 23:51:04 tbox Exp $ */
+/* $Id: genrandom.c,v 1.7 2010/05/17 23:51:04 tbox Exp $ */
/*! \file */
#include
diff --git a/contrib/bind9/bin/tools/genrandom.docbook b/contrib/bind9/bin/tools/genrandom.docbook
index b52ab4932a1..730aab99bb5 100644
--- a/contrib/bind9/bin/tools/genrandom.docbook
+++ b/contrib/bind9/bin/tools/genrandom.docbook
@@ -2,7 +2,7 @@
"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
[]>
-
+
Feb 19, 2009
@@ -39,6 +39,7 @@
200920102011
+ 2012Internet Systems Consortium, Inc. ("ISC")
diff --git a/contrib/bind9/bin/tools/genrandom.html b/contrib/bind9/bin/tools/genrandom.html
index c3b2993a05c..f69b7ca2da2 100644
--- a/contrib/bind9/bin/tools/genrandom.html
+++ b/contrib/bind9/bin/tools/genrandom.html
@@ -1,5 +1,5 @@
-
+
@@ -31,7 +31,7 @@
genrandom [-n number] {size} {filename}
-
DESCRIPTION
+
DESCRIPTION
genrandom
generates a file or a set of files containing a specified quantity
@@ -40,7 +40,7 @@
-
ARGUMENTS
+
ARGUMENTS
-n number
@@ -58,14 +58,14 @@
-
SEE ALSO
+
SEE ALSO
rand(3),
arc4random(3)
-
AUTHOR
+
AUTHOR
Internet Systems Consortium
diff --git a/contrib/bind9/bin/tools/isc-hmac-fixup.8 b/contrib/bind9/bin/tools/isc-hmac-fixup.8
index 99c58c8304c..c02ed03f4fb 100644
--- a/contrib/bind9/bin/tools/isc-hmac-fixup.8
+++ b/contrib/bind9/bin/tools/isc-hmac-fixup.8
@@ -12,7 +12,7 @@
.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
.\" PERFORMANCE OF THIS SOFTWARE.
.\"
-.\" $Id: isc-hmac-fixup.8,v 1.4 2010-05-19 01:14:14 tbox Exp $
+.\" $Id$
.\"
.hy 0
.ad l
diff --git a/contrib/bind9/bin/tools/isc-hmac-fixup.c b/contrib/bind9/bin/tools/isc-hmac-fixup.c
index 09cb85deeeb..daf391a81cd 100644
--- a/contrib/bind9/bin/tools/isc-hmac-fixup.c
+++ b/contrib/bind9/bin/tools/isc-hmac-fixup.c
@@ -14,7 +14,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: isc-hmac-fixup.c,v 1.4 2010-03-10 02:17:52 marka Exp $ */
+/* $Id: isc-hmac-fixup.c,v 1.4 2010/03/10 02:17:52 marka Exp $ */
#include
diff --git a/contrib/bind9/bin/tools/isc-hmac-fixup.docbook b/contrib/bind9/bin/tools/isc-hmac-fixup.docbook
index a3039ee814d..c298a85861d 100644
--- a/contrib/bind9/bin/tools/isc-hmac-fixup.docbook
+++ b/contrib/bind9/bin/tools/isc-hmac-fixup.docbook
@@ -17,7 +17,7 @@
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
January 5, 2010
diff --git a/contrib/bind9/bin/tools/isc-hmac-fixup.html b/contrib/bind9/bin/tools/isc-hmac-fixup.html
index 8b70777cd79..d39ebf0fa16 100644
--- a/contrib/bind9/bin/tools/isc-hmac-fixup.html
+++ b/contrib/bind9/bin/tools/isc-hmac-fixup.html
@@ -13,7 +13,7 @@
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
@@ -31,7 +31,7 @@
isc-hmac-fixup {algorithm} {secret}
-
DESCRIPTION
+
DESCRIPTION
Versions of BIND 9 up to and including BIND 9.6 had a bug causing
HMAC-SHA* TSIG keys which were longer than the digest length of the
@@ -57,7 +57,7 @@
-
SECURITY CONSIDERATIONS
+
SECURITY CONSIDERATIONS
Secrets that have been converted by isc-hmac-fixup
are shortened, but as this is how the HMAC protocol works in
@@ -68,14 +68,14 @@
-
SEE ALSO
+
SEE ALSO
BIND 9 Administrator Reference Manual,
RFC 2104.
-
AUTHOR
+
AUTHOR
Internet Systems Consortium
diff --git a/contrib/bind9/bin/tools/named-journalprint.8 b/contrib/bind9/bin/tools/named-journalprint.8
index 347b67b1bac..670cd5d3dda 100644
--- a/contrib/bind9/bin/tools/named-journalprint.8
+++ b/contrib/bind9/bin/tools/named-journalprint.8
@@ -12,7 +12,7 @@
.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
.\" PERFORMANCE OF THIS SOFTWARE.
.\"
-.\" $Id: named-journalprint.8,v 1.4 2010-05-19 01:14:14 tbox Exp $
+.\" $Id$
.\"
.hy 0
.ad l
diff --git a/contrib/bind9/bin/tools/named-journalprint.c b/contrib/bind9/bin/tools/named-journalprint.c
index 8a00aa7a85d..36d1acd3136 100644
--- a/contrib/bind9/bin/tools/named-journalprint.c
+++ b/contrib/bind9/bin/tools/named-journalprint.c
@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: named-journalprint.c,v 1.2 2009-12-04 21:59:23 marka Exp $ */
+/* $Id: named-journalprint.c,v 1.2 2009/12/04 21:59:23 marka Exp $ */
/*! \file */
#include
diff --git a/contrib/bind9/bin/tools/named-journalprint.docbook b/contrib/bind9/bin/tools/named-journalprint.docbook
index d523f8c1aff..d0bea2c483a 100644
--- a/contrib/bind9/bin/tools/named-journalprint.docbook
+++ b/contrib/bind9/bin/tools/named-journalprint.docbook
@@ -17,7 +17,7 @@
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
Feb 18, 2009
diff --git a/contrib/bind9/bin/tools/named-journalprint.html b/contrib/bind9/bin/tools/named-journalprint.html
index 8878fc50655..8639ee885a8 100644
--- a/contrib/bind9/bin/tools/named-journalprint.html
+++ b/contrib/bind9/bin/tools/named-journalprint.html
@@ -13,7 +13,7 @@
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
@@ -31,7 +31,7 @@
named-journalprint {journal}
-
DESCRIPTION
+
DESCRIPTION
named-journalprint
prints the contents of a zone journal file in a human-readable
@@ -57,7 +57,7 @@
-
SEE ALSO
+
SEE ALSO
named(8),
nsupdate(8),
@@ -65,7 +65,7 @@
-
AUTHOR
+
AUTHOR
Internet Systems Consortium
diff --git a/contrib/bind9/bin/tools/nsec3hash.8 b/contrib/bind9/bin/tools/nsec3hash.8
index 6fba8c886cf..324391042c9 100644
--- a/contrib/bind9/bin/tools/nsec3hash.8
+++ b/contrib/bind9/bin/tools/nsec3hash.8
@@ -12,7 +12,7 @@
.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
.\" PERFORMANCE OF THIS SOFTWARE.
.\"
-.\" $Id: nsec3hash.8,v 1.5 2010-05-19 01:14:14 tbox Exp $
+.\" $Id$
.\"
.hy 0
.ad l
diff --git a/contrib/bind9/bin/tools/nsec3hash.c b/contrib/bind9/bin/tools/nsec3hash.c
index 0e2a910c915..6a54163e689 100644
--- a/contrib/bind9/bin/tools/nsec3hash.c
+++ b/contrib/bind9/bin/tools/nsec3hash.c
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2006, 2008, 2009 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2006, 2008, 2009, 2011, 2012 Internet Systems Consortium, Inc. ("ISC")
*
* Permission to use, copy, modify, and/or distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
@@ -14,7 +14,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: nsec3hash.c,v 1.6 2009-10-06 21:20:44 each Exp $ */
+/* $Id$ */
#include
@@ -60,7 +60,8 @@ check_result(isc_result_t result, const char *message) {
static void
usage() {
- fatal("salt hash iterations domain");
+ printf("Usage: %s salt algorithm iterations domain\n", program);
+ exit(1);
}
int
diff --git a/contrib/bind9/bin/tools/nsec3hash.docbook b/contrib/bind9/bin/tools/nsec3hash.docbook
index 48eb4afb41c..d20eb83b990 100644
--- a/contrib/bind9/bin/tools/nsec3hash.docbook
+++ b/contrib/bind9/bin/tools/nsec3hash.docbook
@@ -17,7 +17,7 @@
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
Feb 18, 2009
diff --git a/contrib/bind9/bin/tools/nsec3hash.html b/contrib/bind9/bin/tools/nsec3hash.html
index e6c09959f15..e5b5a14842a 100644
--- a/contrib/bind9/bin/tools/nsec3hash.html
+++ b/contrib/bind9/bin/tools/nsec3hash.html
@@ -13,7 +13,7 @@
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
@@ -31,7 +31,7 @@
nsec3hash generates an NSEC3 hash based on
a set of NSEC3 parameters. This can be used to check the validity
@@ -39,7 +39,7 @@
-
ARGUMENTS
+
ARGUMENTS
salt
@@ -63,14 +63,14 @@
-
SEE ALSO
+
SEE ALSO
BIND 9 Administrator Reference Manual,
RFC 5155.
-
AUTHOR
+
AUTHOR
Internet Systems Consortium
diff --git a/contrib/bind9/config.h.in b/contrib/bind9/config.h.in
index 477291da29f..bafcadd2168 100644
--- a/contrib/bind9/config.h.in
+++ b/contrib/bind9/config.h.in
@@ -16,7 +16,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: config.h.in,v 1.143.8.4 2011-03-10 04:29:14 each Exp $ */
+/* $Id$ */
/*! \file */
@@ -144,6 +144,9 @@ int sigwait(const unsigned int *set, int *sig);
/* Define if threads need PTHREAD_SCOPE_SYSTEM */
#undef NEED_PTHREAD_SCOPE_SYSTEM
+/* Define if building universal (internal helper macro) */
+#undef AC_APPLE_UNIVERSAL_BUILD
+
/* Define to enable the "filter-aaaa-on-v4" option. */
#undef ALLOW_FILTER_AAAA_ON_V4
@@ -380,6 +383,9 @@ int sigwait(const unsigned int *set, int *sig);
/* Define to the one symbol short name of this package. */
#undef PACKAGE_TARNAME
+/* Define to the home page for this package. */
+#undef PACKAGE_URL
+
/* Define to the version of this package. */
#undef PACKAGE_VERSION
@@ -387,6 +393,9 @@ int sigwait(const unsigned int *set, int *sig);
(O_NDELAY/O_NONBLOCK). */
#undef PORT_NONBLOCK
+/* The size of `void *', as computed by sizeof. */
+#undef SIZEOF_VOID_P
+
/* Define to 1 if you have the ANSI C header files. */
#undef STDC_HEADERS
@@ -400,9 +409,17 @@ int sigwait(const unsigned int *set, int *sig);
/* define if idnkit support is to be included. */
#undef WITH_IDN
-/* Define to 1 if your processor stores words with the most significant byte
- first (like Motorola and SPARC, unlike Intel and VAX). */
-#undef WORDS_BIGENDIAN
+/* Define WORDS_BIGENDIAN to 1 if your processor stores words with the most
+ significant byte first (like Motorola and SPARC, unlike Intel). */
+#if defined AC_APPLE_UNIVERSAL_BUILD
+# if defined __BIG_ENDIAN__
+# define WORDS_BIGENDIAN 1
+# endif
+#else
+# ifndef WORDS_BIGENDIAN
+# undef WORDS_BIGENDIAN
+# endif
+#endif
/* Define to empty if `const' does not conform to ANSI C. */
#undef const
diff --git a/contrib/bind9/config.threads.in b/contrib/bind9/config.threads.in
index e7a8d609ccb..a56ca37d483 100644
--- a/contrib/bind9/config.threads.in
+++ b/contrib/bind9/config.threads.in
@@ -33,8 +33,9 @@ case $host in
*-*-sysv*OpenUNIX*)
# UnixWare
use_threads=true ;;
-*-netbsd[1234].*)
- # NetBSD earlier than NetBSD 5.0 has poor pthreads. Don't use it by default.
+[*-netbsd[1234].*])
+ # NetBSD earlier than NetBSD 5.0 has poor pthreads.
+ # Don't use it by default.
use_threads=false ;;
*-netbsd*)
use_threads=true ;;
@@ -44,7 +45,7 @@ case $host in
use_threads=false ;;
*-freebsd*)
use_threads=false ;;
-*-bsdi[234]*)
+[*-bsdi[234]*])
# Thread signals do not work reliably on some versions of BSD/OS.
use_threads=false ;;
*-bsdi5*)
diff --git a/contrib/bind9/configure.in b/contrib/bind9/configure.in
index ff41067bdae..2d7132c94de 100644
--- a/contrib/bind9/configure.in
+++ b/contrib/bind9/configure.in
@@ -18,7 +18,7 @@ AC_DIVERT_PUSH(1)dnl
esyscmd([sed "s/^/# /" COPYRIGHT])dnl
AC_DIVERT_POP()dnl
-AC_REVISION($Revision: 1.512.8.12 $)
+AC_REVISION($Revision: 1.512.8.15 $)
AC_INIT(lib/dns/name.c)
AC_PREREQ(2.59)
@@ -62,6 +62,25 @@ It is available from http://www.isc.org as a separate download.])
;;
esac
+AC_ARG_ENABLE(developer, [ --enable-developer enable developer build settings])
+case "$enable_developer" in
+yes)
+ test "${enable_fixed_rrset+set}" = set || enable_fixed_rrset=yes
+ test "${with_atf+set}" = set || with_atf=yes
+ test "${enable_filter_aaaa+set}" = set || enable_filter_aaaa=yes
+ test "${enable_rpz_nsip+set}" = set || enable_rpz_nsip=yes
+ test "${enable_rpz_nsdname+set}" = set || enable_rpz_nsdname=yes
+ test "${with_dlz_filesystem+set}" = set || with_dlz_filesystem=yes
+ case "$host" in
+ *-darwin*)
+ test "${enable_exportlib+set}" = set || enable_exportlib=yes
+ ;;
+ *-linux*)
+ test "${enable_exportlib+set}" = set || enable_exportlib=yes
+ ;;
+ esac
+ ;;
+esac
#
# Make very sure that these are the first files processed by
# config.status, since we use the processed output as the input for
@@ -263,7 +282,7 @@ case "$host" in
# as it breaks how the two halves (Basic and Advanced) of the IPv6
# Socket API were designed to be used but we have to live with it.
# Define _GNU_SOURCE to pull in the IPv6 Advanced Socket API.
- *-linux*)
+ *-linux* | *-kfreebsd*-gnu)
STD_CDEFINES="$STD_CDEFINES -D_GNU_SOURCE"
CPPFLAGS="$CPPFLAGS -D_GNU_SOURCE"
;;
@@ -502,7 +521,6 @@ AC_SUBST(LWRES_PLATFORM_NEEDSYSSELECTH)
#
AC_C_BIGENDIAN
-
#
# was --with-openssl specified?
#
@@ -1437,9 +1455,9 @@ case $use_libtool in
O=lo
A=la
LIBTOOL_MKDEP_SED='s;\.o;\.lo;'
- LIBTOOL_MODE_COMPILE='--mode=compile'
- LIBTOOL_MODE_INSTALL='--mode=install'
- LIBTOOL_MODE_LINK='--mode=link'
+ LIBTOOL_MODE_COMPILE='--mode=compile --tag=CC'
+ LIBTOOL_MODE_INSTALL='--mode=install --tag=CC'
+ LIBTOOL_MODE_LINK='--mode=link --tag=CC'
case "$host" in
*) LIBTOOL_ALLOW_UNDEFINED= ;;
esac
diff --git a/contrib/bind9/doc/Makefile.in b/contrib/bind9/doc/Makefile.in
index 41d1f970353..14d35bc2d64 100644
--- a/contrib/bind9/doc/Makefile.in
+++ b/contrib/bind9/doc/Makefile.in
@@ -13,7 +13,7 @@
# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
# PERFORMANCE OF THIS SOFTWARE.
-# $Id: Makefile.in,v 1.11 2007-06-19 23:47:13 tbox Exp $
+# $Id: Makefile.in,v 1.11 2007/06/19 23:47:13 tbox Exp $
# This Makefile is a placeholder. It exists merely to make
# sure that its directory gets created in the object directory
diff --git a/contrib/bind9/doc/arm/Bv9ARM-book.xml b/contrib/bind9/doc/arm/Bv9ARM-book.xml
index b899c8b4059..6137359bf1f 100644
--- a/contrib/bind9/doc/arm/Bv9ARM-book.xml
+++ b/contrib/bind9/doc/arm/Bv9ARM-book.xml
@@ -2,7 +2,7 @@
"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
[]>
-
+
BIND 9 Administrator Reference Manual
@@ -32,6 +32,7 @@
200920102011
+ 2012Internet Systems Consortium, Inc. ("ISC")
@@ -1461,6 +1462,31 @@ zone "eng.example.com" {
+
+ tsig-list
+
+
+ List the names of all TSIG keys currently configured
+ for use by named in each view. The
+ list both statically configured keys and dynamic
+ TKEY-negotiated keys.
+
+
+
+
+
+ tsig-delete
+ keyname
+ view
+
+
+ Delete a given TKEY-negotated key from the server.
+ (This does not apply to statically configured TSIG
+ keys.)
+
+
+
+
addzone
zone
@@ -1898,11 +1924,13 @@ controls {
- When acting as a slave, BIND 9 will
- attempt to use IXFR unless
- it is explicitly disabled. For more information about disabling
- IXFR, see the description of the request-ixfr clause
- of the server statement.
+ When acting as a slave, BIND 9 will attempt
+ to use IXFR unless it is explicitly disabled via the
+ request-ixfr option or the use of
+ ixfr-from-differences. For
+ more information about disabling IXFR, see the description
+ of the request-ixfr clause of the
+ server statement.
@@ -4645,6 +4673,19 @@ category notify { null; };
+
+
+ RPZ
+
+
+
+ Information about errors in response policy zone files,
+ rewritten responses, and at the highest
+ debug levels, mere rewriting
+ attempts.
+
+
+
@@ -4993,6 +5034,10 @@ badresp:1,adberr:0,findfail:0,valfail:0]
cache-file path_name; dump-file path_name; bindkeys-file path_name;
+ secroots-file path_name;
+ session-keyfile path_name;
+ session-keyname key_name;
+ session-keyalg algorithm_id; memstatistics yes_or_no; memstatistics-file path_name; pid-file path_name;
@@ -5018,7 +5063,8 @@ badresp:1,adberr:0,findfail:0,valfail:0]
ixfr-from-differences (yes_or_no | master | slave); dnssec-enable yes_or_no; dnssec-validation (yes_or_no | auto);
- dnssec-lookaside ( auto |
+ dnssec-lookaside ( auto |
+ no |
domain trust-anchor domain ); dnssec-must-be-secure domain yes_or_no; dnssec-accept-expired yes_or_no;
@@ -5166,7 +5212,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
resolver-query-timeout number ; deny-answer-addresses { address_match_list } except-from { namelist } ; deny-answer-aliases { namelist } except-from { namelist } ;
- response-policy { zone_name policy given | no-op | nxdomain | nodata | cname domain ; } ;
+ response-policy { zone_name policy given | disabled | passthru | nxdomain | nodata | cname domain ; } ;
};
@@ -5516,7 +5562,8 @@ badresp:1,adberr:0,findfail:0,valfail:0]
The pathname of the file the server dumps
security roots to when instructed to do so with
rndc secroots.
- If not specified, the default is named.secroots.
+ If not specified, the default is
+ named.secroots.
@@ -5560,19 +5607,6 @@ badresp:1,adberr:0,findfail:0,valfail:0]
-
- session-keyfile
-
-
- The pathname of the file into which to write a session TSIG
- key for use by nsupdate -l. (See the
- discussion of the update-policy
- statement's local option for more
- details on this feature.)
-
-
-
-
port
@@ -5708,6 +5742,11 @@ options {
values for the DLV domain and trust anchor will be
used, along with a built-in key for validation.
+
+ If dnssec-lookaside is set to
+ no, then dnssec-lookaside
+ is not used.
+
The default DLV key is stored in the file
bind.keys;
@@ -8590,7 +8629,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
Specify a private RDATA type to be used when generating
key signing records. The default is
- 65535.
+ 65534.
It is expected that this parameter may be removed
@@ -8853,10 +8892,11 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
and which queries should not be sent to the Internet's root
servers. The official servers which cover these namespaces
return NXDOMAIN responses to these queries. In particular,
- these cover the reverse namespace for addresses from RFC 1918 and
- RFC 3330. They also include the reverse namespace for IPv6 local
- address (locally assigned), IPv6 link local addresses, the IPv6
- loopback address and the IPv6 unknown address.
+ these cover the reverse namespaces for addresses from
+ RFC 1918, RFC 4193, and RFC 5737. They also include the
+ reverse namespace for IPv6 local address (locally assigned),
+ IPv6 link local addresses, the IPv6 loopback address and the
+ IPv6 unknown address.
Named will attempt to determine if a built-in zone already exists
@@ -9227,141 +9267,228 @@ deny-answer-aliases { "example.net"; };
Response Policy Zone (RPZ) Rewriting
BIND 9 includes an intentionally limited
- mechanism to modify DNS responses for recursive requests
- similar to email anti-spam DNS blacklists.
- All response policy zones are named in the
- response-policy option for the view or among the
- global options if there is no response-policy option for the view.
-
-
-
- The rules encoded in a response policy zone (RPZ) are applied
- only to responses to queries that ask for recursion (RD=1).
- RPZs are normal DNS zones containing RRsets
- that can be queried normally if allowed.
- It is usually best to restrict those queries with something like
- allow-query {none; }; or
- allow-query { 127.0.0.1; };.
-
-
-
- There are four kinds of RPZ rewrite rules. QNAME rules are
- applied to query names in requests and to targets of CNAME
- records resolved in the process of generating the response.
- The owner name of a QNAME rule is the query name relativized
- to the RPZ.
- The records in a rewrite rule are usually A, AAAA, or special
- CNAMEs, but can be any type except DNAME.
-
-
-
- IP rules are triggered by addresses in A and AAAA records.
- All IP addresses in A or AAAA RRsets are tested and the rule
- longest prefix is applied. Ties between rules with equal prefixes
- are broken in favor of the first RPZ mentioned in the
- response-policy option.
- The rule matching the smallest IP address is chosen among equal
- prefix rules from a single RPZ.
- IP rules are expressed in RRsets with owner names that are
- subdomains of rpz-ip and encoding an IP address block, reversed
- as in IN-ARPA.
- prefix.B.B.B.B with prefix between 1 and 32 and B between 1 and 255
- encodes an IPv4 address.
- IPv6 addresses are encoded by with prefix.W.W.W.W.W.W.W.W or
- prefix.WORDS.zz.WORDS. The words in the standard IPv6 text
- representation are reversed, "::" is replaced with ".zz.",
- and ":" becomes ".".
-
-
-
- NSDNAME rules match names in NS RRsets for the response or a
- parent. They are encoded as subdomains of rpz-nsdomain relativized
- to the RPZ origin name.
-
-
-
- NSIP rules match IP addresses in A and AAAA RRsets for names of
- responsible servers or the names that can be matched by NSDNAME
- rules. The are encoded like IP rules except as subdomains of
- rpz-nsip.
+ mechanism to modify DNS responses for recursive requests
+ somewhat similar to email anti-spam DNS blacklists.
+ Responses can be changed to deny the existence of domains(NXDOMAIN),
+ deny the existence of IP addresses for domains (NODATA),
+ or contain other IP addresses or data.
- Authority verification issues and variations in authority data in
- the current version of BIND 9 can cause
- inconsistent results from NSIP and NSDNAME. So they are available
+ The actions encoded in a response policy zone (RPZ) are applied
+ only to queries that ask for recursion (RD=1).
+ Response policy zones are named in the
+ response-policy option for the view or among the
+ global options if there is no response-policy option for the view.
+ RPZs are ordinary DNS zones containing RRsets
+ that can be queried normally if allowed.
+ It is usually best to restrict those queries with something like
+ allow-query { localhost; };.
+
+
+
+ There are four kinds of RPZ records, QNAME, IP, NSIP,
+ and NSDNAME.
+ QNAME records are applied to query names of requests and targets
+ of CNAME records resolved to generate the response.
+ The owner name of a QNAME RPZ record is the query name relativized
+ to the RPZ.
+
+
+
+ The second kind of RPZ record, an IP policy record,
+ is triggered by addresses in A and AAAA records
+ for the ANSWER sections of responses.
+ IP policy records have owner names that are
+ subdomains of rpz-ip relativized to the
+ RPZ origin name and encode an IP address or address block.
+ IPv4 addresses are encoded as
+ prefixlength.B4.B3.B2.B1.rpz-ip.
+ The prefix length must be between 1 and 32.
+ All four bytes, B4, B3, B2, and B1, must be present.
+ B4 is the decimal value of the least significant byte of the
+ IPv4 address as in IN-ADDR.ARPA.
+ IPv6 addresses are encoded in a format similar to the standard
+ IPv6 text representation,
+ prefixlength.W8.W7.W6.W5.W4.W3.W2.W1.rpz-ip.
+ Each of W8,...,W1 is a one to four digit hexadecimal number
+ representing 16 bits of the IPv6 address as in the standard text
+ representation of IPv6 addresses, but reversed as in IN-ADDR.ARPA.
+ All 8 words must be present except when consecutive
+ zero words are replaced with .zz.
+ analogous to double colons (::) in standard IPv6 text encodings.
+ The prefix length must be between 1 and 128.
+
+
+
+ NSDNAME policy records match names of authoritative servers
+ for the query name, a parent of the query name, a CNAME,
+ or a parent of a CNAME.
+ They are encoded as subdomains of
+ rpz-nsdomain relativized
+ to the RPZ origin name.
+
+
+
+ NSIP policy records match IP addresses in A and AAAA RRsets
+ for domains that can be checked against NSDNAME policy records.
+ The are encoded like IP policies except as subdomains of
+ rpz-nsip.
+
+
+
+ The query response is checked against all RPZs, so
+ two or more policy records can apply to a single response.
+ Because DNS responses can be rewritten according by at most a
+ single policy record, a single policy (other than
+ DISABLED policies) must be chosen.
+ Policies are chosen in the following order:
+
+ Among applicable zones, use the RPZ that appears first
+ in the response-policy option.
+
+ Prefer QNAME to IP to NSDNAME to NSIP policy records
+ in a single RPZ
+
+ Among applicable NSDNAME policy records, prefer the
+ policy record that matches the lexically smallest name
+
+ Among IP or NSIP policy records, prefer the record
+ with the longest prefix.
+
+ Among records with the same prefex length,
+ prefer the IP or NSIP policy record that matches
+ the smallest IP address.
+
+
+
+
+
+ When the processing of a response is restarted to resolve
+ DNAME or CNAME records and an applicable policy record set has
+ not been found,
+ all RPZs are again consulted for the DNAME or CNAME names
+ and addresses.
+
+
+
+ Authority verification issues and variations in authority data
+ can cause inconsistent results for NSIP and NSDNAME policy records.
+ Glue NS records often differ from authoritative NS records.
+ So they are available
only when BIND is built with the
--enable-rpz-nsip or
--enable-rpz-nsdname options
- on the "configure" command line.
-
+ on the "configure" command line.
+
-
- Four policies can be expressed.
- The NXDOMAIN policy causes a NXDOMAIN response
- and is expressed with an RRset consisting of a single CNAME
- whose target is the root domain (.).
- NODATA generates NODATA or ANCOUNT=1 regardless
- of query type.
- It is expressed with a CNAME whose target is the wildcard
- top-level domain (*.).
- The NO-OP policy does not change the response
- and is used to "poke holes" in policies for larger CIDR blocks or in
- zones named later in the response-policy option.
- The NO-OP policy is expressed by a CNAME with a target consisting
- of the variable part of the owner name, such as "example.com." for
- a QNAME rule or "128.1.0.0.127." for an IP rule.
- The CNAME policy is used to replace the RRsets
- of response.
- A and AAAA RRsets are most common and useful to capture
- an evil domain in a walled garden, but any valid set of RRsets
- is possible.
-
+
+ RPZ record sets are special CNAME records or one or more
+ of any types of DNS record except DNAME or DNSSEC.
+ Except when a policy record is a CNAME, there can be more
+ more than one record and more than one type
+ in a set of policy records.
+ Except for three kinds of CNAME records that are illegal except
+ in policy zones, the records in a set are used in the response as if
+ their owner name were the query name. They are copied to the
+ response as dictated by their types.
+
+ A CNAME whose target is the root domain (.)
+ specifies the NXDOMAIN policy,
+ which generates an NXDOMAIN response.
+
+ A CNAME whose target is the wildcard top-level
+ domain (*.) specifies the NODATA policy,
+ which rewrites the response to NODATA or ANCOUNT=1.
+
+ A CNAME whose target is a wildcard hostname such
+ as *.example.com is used normally after the astrisk (*)
+ has been replaced with the query name.
+ These records are usually resolved with ordinary CNAMEs
+ outside the policy zones. They can be useful for logging.
+
+ The PASSTHRU policy is specified
+ by a CNAME whose target is the variable part of its own
+ owner name. It causes the response to not be rewritten
+ and is most often used to "poke holes" in policies for
+ CIDR blocks.
+
+
+
-
- All of the policies in an RPZ can be overridden with a
- policy clause.
- given says "do not override."
- no-op says "do nothing" regardless of the policy
- in RPZ records.
- nxdomain causes all RPZ rules to generate
- NXDOMAIN results.
- nodata gives nodata.
- cname domain causes all RPZ rules to act as if
- the consisted of a "cname domain" record.
-
+
+ The policies specified in individual records
+ in an RPZ can be overridden with a policy clause
+ in the response-policy option.
+ An organization using an RPZ provided by another organization might
+ use this mechanism to redirect domains to its own walled garden.
+
+ GIVEN says "do not override."
+
+ DISABLED causes policy records to do
+ nothing but log what they might have done.
+ The response to the DNS query will be written according to
+ any matching policy records that are not disabled.
+ Policy zones overridden with DISABLED should
+ appear first, because they will often not be logged
+ if a higher precedence policy is found first.
+
+ PASSTHRU causes all policy records
+ to act as if they were CNAME records with targets the variable
+ part of their owner name. They protect the response from
+ being changed.
+
+ NXDOMAIN causes all RPZ records
+ to specify NXDOMAIN policies.
+
+ NODATA overrides with the
+ NODATA policy
+
+ CNAME domain causes all RPZ
+ policy records to act as if they were "cname domain" records.
+
+
+
-
- For example, you might use this option statement
+
+ For example, you might use this option statement
-response-policy { zone "bl"; };
+ response-policy { zone "badlist"; };
and this zone statement
-zone "bl" {type master; file "example/bl"; allow-query {none;}; };
+ zone "badlist" {type master; file "master/badlist"; allow-query {none;}; };
with this zone file
$TTL 1H
-@ SOA LOCALHOST. named-mgr.example.com (1 1h 15m 30d 2h)
+@ SOA LOCALHOST. named-mgr.example.com (1 1h 15m 30d 2h)
+ NS LOCALHOST.
-; QNAME rules
-nxdomain.domain.com CNAME .
-nodata.domain.com CNAME *.
-bad.domain.com A 10.0.0.1
- AAAA 2001:2::1
-ok.domain.com CNAME ok.domain.com.
-*.badzone.domain.com CNAME garden.example.com.
+; QNAME policy records. There are no periods (.) after the owner names.
+nxdomain.domain.com CNAME . ; NXDOMAIN policy
+nodata.domain.com CNAME *. ; NODATA policy
+bad.domain.com A 10.0.0.1 ; redirect to a walled garden
+ AAAA 2001:2::1
-; IP rules rewriting all answers for 127/8 except 127.0.0.1
-8.0.0.0.127.ip CNAME .
-32.1.0.0.127.ip CNAME 32.1.0.0.127.
+; do not rewrite (PASSTHRU) OK.DOMAIN.COM
+ok.domain.com CNAME ok.domain.com.
-; NSDNAME and NSIP rules
+bzone.domain.com CNAME garden.example.com.
+
+; redirect x.bzone.domain.com to x.bzone.domain.com.garden.example.com
+*.bzone.domain.com CNAME *.garden.example.com.
+
+
+; IP policy records that rewrite all answers for 127/8 except 127.0.0.1
+8.0.0.0.127.rpz-ip CNAME .
+32.1.0.0.127.rpz-ip CNAME 32.1.0.0.127. ; PASSTHRU for 127.0.0.1
+
+; NSDNAME and NSIP policy records
ns.domain.com.rpz-nsdname CNAME .
48.zz.2.2001.rpz-nsip CNAME .
-
+
@@ -14725,9 +14852,8 @@ HOST-127.EXAMPLE. MX 0 .
// RFC1918 space and some reserved space, which is
// commonly used in spoofing attacks.
acl bogusnets {
- 0.0.0.0/8; 1.0.0.0/8; 2.0.0.0/8; 192.0.2.0/24;
- 224.0.0.0/3; 10.0.0.0/8; 172.16.0.0/12;
- 192.168.0.0/16;
+ 0.0.0.0/8; 192.0.2.0/24; 224.0.0.0/3;
+ 10.0.0.0/8; 172.16.0.0/12; 192.168.0.0/16;
};
// Set up an ACL called our-nets. Replace this with the
diff --git a/contrib/bind9/doc/arm/Bv9ARM.ch01.html b/contrib/bind9/doc/arm/Bv9ARM.ch01.html
index f0ec1299e5a..420d7b35599 100644
--- a/contrib/bind9/doc/arm/Bv9ARM.ch01.html
+++ b/contrib/bind9/doc/arm/Bv9ARM.ch01.html
@@ -1,5 +1,5 @@
-
+
@@ -45,17 +45,17 @@
The Berkeley Internet Name Domain
(BIND) implements a
@@ -87,7 +87,7 @@
-Organization of This Document
+Organization of This Document
In this document, Chapter 1 introduces
the basic DNS and BIND concepts. Chapter 2
@@ -116,7 +116,7 @@
-Conventions Used in This Document
+Conventions Used in This Document
In this document, we use the following general typographic
conventions:
@@ -243,7 +243,7 @@
-The Domain Name System (DNS)
+The Domain Name System (DNS)
The purpose of this document is to explain the installation
and upkeep of the BIND (Berkeley Internet
@@ -253,7 +253,7 @@
-DNS Fundamentals
+DNS Fundamentals
The Domain Name System (DNS) is a hierarchical, distributed
database. It stores information for mapping Internet host names to
@@ -275,7 +275,7 @@
-Domains and Domain Names
+Domains and Domain Names
The data stored in the DNS is identified by domain names that are organized as a tree according to
organizational or administrative boundaries. Each node of the tree,
@@ -321,7 +321,7 @@
-Zones
+Zones
To properly operate a name server, it is important to understand
the difference between a zone
@@ -374,7 +374,7 @@
-Authoritative Name Servers
+Authoritative Name Servers
Each zone is served by at least
one authoritative name server,
@@ -391,7 +391,7 @@
-The Primary Master
+The Primary Master
The authoritative server where the master copy of the zone
data is maintained is called the
@@ -411,7 +411,7 @@
-Slave Servers
+Slave Servers
The other authoritative servers, the slave
servers (also known as secondary servers)
@@ -427,7 +427,7 @@
-Stealth Servers
+Stealth Servers
Usually all of the zone's authoritative servers are listed in
NS records in the parent zone. These NS records constitute
@@ -462,7 +462,7 @@
-Caching Name Servers
+Caching Name Servers
The resolver libraries provided by most operating systems are
stub resolvers, meaning that they are not
@@ -489,7 +489,7 @@
-Forwarding
+Forwarding
Even a caching name server does not necessarily perform
the complete recursive lookup itself. Instead, it can
@@ -516,7 +516,7 @@
-Name Servers in Multiple Roles
+Name Servers in Multiple Roles
The BIND name server can
simultaneously act as
diff --git a/contrib/bind9/doc/arm/Bv9ARM.ch02.html b/contrib/bind9/doc/arm/Bv9ARM.ch02.html
index a9fde322a12..29657819716 100644
--- a/contrib/bind9/doc/arm/Bv9ARM.ch02.html
+++ b/contrib/bind9/doc/arm/Bv9ARM.ch02.html
@@ -1,5 +1,5 @@
-
+
DNS hardware requirements have
traditionally been quite modest.
@@ -73,7 +73,7 @@
-CPU Requirements
+CPU Requirements
CPU requirements for BIND 9 range from
i486-class machines
@@ -84,7 +84,7 @@
-Memory Requirements
+Memory Requirements
The memory of the server has to be large enough to fit the
cache and zones loaded off disk. The max-cache-size
@@ -107,7 +107,7 @@
-Name Server Intensive Environment Issues
+Name Server Intensive Environment Issues
For name server intensive environments, there are two alternative
configurations that may be used. The first is where clients and
@@ -124,7 +124,7 @@
-Supported Operating Systems
+Supported Operating Systems
ISC BIND 9 compiles and runs on a large
number
diff --git a/contrib/bind9/doc/arm/Bv9ARM.ch03.html b/contrib/bind9/doc/arm/Bv9ARM.ch03.html
index aaaa96a52b7..32000b18865 100644
--- a/contrib/bind9/doc/arm/Bv9ARM.ch03.html
+++ b/contrib/bind9/doc/arm/Bv9ARM.ch03.html
@@ -1,5 +1,5 @@
-
+
The following sample configuration is appropriate for a caching-only
name server for use by clients internal to a corporation. All
@@ -98,7 +98,7 @@ zone "0.0.127.in-addr.arpa" {
-An Authoritative-only Name Server
+An Authoritative-only Name Server
This sample configuration is for an authoritative-only server
that is the master server for "example.com"
@@ -146,7 +146,7 @@ zone "eng.example.com" {
-Load Balancing
+Load Balancing
A primitive form of load balancing can be achieved in
the DNS by using multiple records
@@ -289,10 +289,10 @@ zone "eng.example.com" {
-Name Server Operations
+Name Server Operations
-Tools for Use With the Name Server Daemon
+Tools for Use With the Name Server Daemon
This section describes several indispensable diagnostic,
administrative and monitoring tools available to the system
@@ -670,6 +670,21 @@ zone "eng.example.com" {
set to yes to be effective.
It defaults to enabled.
+
tsig-list
+
+ List the names of all TSIG keys currently configured
+ for use by named in each view. The
+ list both statically configured keys and dynamic
+ TKEY-negotiated keys.
+
+
tsig-delete
+ keyname
+ [view]
+
+ Delete a given TKEY-negotated key from the server.
+ (This does not apply to statically configured TSIG
+ keys.)
+
addzone
zone
[class
@@ -873,7 +888,7 @@ controls {
-Signals
+Signals
Certain UNIX signals cause the name server to take specific
actions, as described in the following table. These signals can
diff --git a/contrib/bind9/doc/arm/Bv9ARM.ch04.html b/contrib/bind9/doc/arm/Bv9ARM.ch04.html
index f1d0a6ccf13..202439f5af2 100644
--- a/contrib/bind9/doc/arm/Bv9ARM.ch04.html
+++ b/contrib/bind9/doc/arm/Bv9ARM.ch04.html
@@ -1,5 +1,5 @@
-
+
- When acting as a slave, BIND 9 will
- attempt to use IXFR unless
- it is explicitly disabled. For more information about disabling
- IXFR, see the description of the request-ixfr clause
- of the server statement.
+ When acting as a slave, BIND 9 will attempt
+ to use IXFR unless it is explicitly disabled via the
+ request-ixfr option or the use of
+ ixfr-from-differences. For
+ more information about disabling IXFR, see the description
+ of the request-ixfr clause of the
+ server statement.
-Split DNS
+Split DNS
Setting up different views, or visibility, of the DNS space to
internal and external resolvers is usually referred to as a
@@ -286,7 +288,7 @@
-Example split DNS setup
+Example split DNS setup
Let's say a company named Example, Inc.
(example.com)
@@ -543,7 +545,7 @@ nameserver 172.16.72.4
-Generate Shared Keys for Each Pair of Hosts
+Generate Shared Keys for Each Pair of Hosts
A shared secret is generated to be shared between host1 and host2.
An arbitrary key name is chosen: "host1-host2.". The key name must
@@ -551,7 +553,7 @@ nameserver 172.16.72.4
-Automatic Generation
+Automatic Generation
The following command will generate a 128-bit (16 byte) HMAC-SHA256
key as described above. Longer keys are better, but shorter keys
@@ -575,7 +577,7 @@ nameserver 172.16.72.4
-Manual Generation
+Manual Generation
The shared secret is simply a random sequence of bits, encoded
in base-64. Most ASCII strings are valid base-64 strings (assuming
@@ -590,7 +592,7 @@ nameserver 172.16.72.4
-Copying the Shared Secret to Both Machines
+Copying the Shared Secret to Both Machines
This is beyond the scope of DNS. A secure transport mechanism
should be used. This could be secure FTP, ssh, telephone, etc.
@@ -598,7 +600,7 @@ nameserver 172.16.72.4
-Informing the Servers of the Key's Existence
+Informing the Servers of the Key's Existence
Imagine host1 and host 2
are
@@ -625,7 +627,7 @@ key host1-host2. {
-Instructing the Server to Use the Key
+Instructing the Server to Use the Key
Since keys are shared between two hosts only, the server must
be told when keys are to be used. The following is added to the named.conf file
@@ -657,7 +659,7 @@ server 10.1.2.3 {
-TSIG Key Based Access Control
+TSIG Key Based Access Control
BIND allows IP addresses and ranges
to be specified in ACL
@@ -684,7 +686,7 @@ allow-update { key host1-host2. ;};
-Errors
+Errors
The processing of TSIG signed messages can result in
several errors. If a signed message is sent to a non-TSIG aware
@@ -710,7 +712,7 @@ allow-update { key host1-host2. ;};
-TKEY
+TKEY
TKEY
is a mechanism for automatically generating a shared secret
between two hosts. There are several "modes" of
@@ -746,7 +748,7 @@ allow-update { key host1-host2. ;};
-SIG(0)
+SIG(0)
BIND 9 partially supports DNSSEC SIG(0)
transaction signatures as specified in RFC 2535 and RFC 2931.
@@ -807,7 +809,7 @@ allow-update { key host1-host2. ;};
-Generating Keys
+Generating Keys
The dnssec-keygen program is used to
generate keys.
@@ -863,7 +865,7 @@ allow-update { key host1-host2. ;};
-Signing the Zone
+Signing the Zone
The dnssec-signzone program is used
to sign a zone.
@@ -905,7 +907,7 @@ allow-update { key host1-host2. ;};
-Configuring Servers
+Configuring Servers
To enable named to respond appropriately
to DNS requests from DNSSEC aware clients,
@@ -1065,7 +1067,7 @@ options {
from insecure to signed and back again. A secure zone can use
either NSEC or NSEC3 chains.
-Converting from insecure to secure
+Converting from insecure to secure
Changing a zone from insecure to secure can be done in two
ways: using a dynamic DNS update, or the
auto-dnssec zone option.
@@ -1091,7 +1093,7 @@ options {
well. An NSEC chain will be generated as part of the initial
signing process.
-Dynamic DNS update method
+Dynamic DNS update method
To insert the keys via dynamic update:
% nsupdate
@@ -1127,7 +1129,7 @@ options {
While the initial signing and NSEC/NSEC3 chain generation
is happening, other updates are possible as well.
-Fully automatic zone signing
+Fully automatic zone signing
To enable automatic signing, add the
auto-dnssec option to the zone statement in
named.conf.
@@ -1162,7 +1164,7 @@ options {
configuration. If this has not been done, the configuration will
fail.
-Private-type records
+Private-type records
The state of the signing process is signaled by
private-type records (with a default type value of 65534). When
signing is complete, these records will have a nonzero value for
@@ -1203,12 +1205,12 @@ options {
-DNSKEY rollovers
+DNSKEY rollovers
As with insecure-to-secure conversions, rolling DNSSEC
keys can be done in two ways: using a dynamic DNS update, or the
auto-dnssec zone option.
-Dynamic DNS update method
+Dynamic DNS update method
To perform key rollovers via dynamic update, you need to add
the K* files for the new keys so that
named can find them. You can then add the new
@@ -1230,7 +1232,7 @@ options {
named will clean out any signatures generated
by the old key after the update completes.
-Automatic key rollovers
+Automatic key rollovers
When a new key reaches its activation date (as set by
dnssec-keygen or dnssec-settime),
if the auto-dnssec zone option is set to
@@ -1245,27 +1247,27 @@ options {
completes in 30 days, after which it will be safe to remove the
old key from the DNSKEY RRset.
-NSEC3PARAM rollovers via UPDATE
+NSEC3PARAM rollovers via UPDATE
Add the new NSEC3PARAM record via dynamic update. When the
new NSEC3 chain has been generated, the NSEC3PARAM flag field
will be zero. At this point you can remove the old NSEC3PARAM
record. The old chain will be removed after the update request
completes.
-Converting from NSEC to NSEC3
+Converting from NSEC to NSEC3
To do this, you just need to add an NSEC3PARAM record. When
the conversion is complete, the NSEC chain will have been removed
and the NSEC3PARAM record will have a zero flag field. The NSEC3
chain will be generated before the NSEC chain is
destroyed.
-Converting from NSEC3 to NSEC
+Converting from NSEC3 to NSEC
To do this, use nsupdate to
remove all NSEC3PARAM records with a zero flag
field. The NSEC chain will be generated before the NSEC3 chain is
removed.
-Converting from secure to insecure
+Converting from secure to insecure
To convert a signed zone to unsigned using dynamic DNS,
delete all the DNSKEY records from the zone apex using
nsupdate. All signatures, NSEC or NSEC3 chains,
@@ -1280,14 +1282,14 @@ options {
allow instead (or it will re-sign).
-Periodic re-signing
+Periodic re-signing
In any secure zone which supports dynamic updates, named
will periodically re-sign RRsets which have not been re-signed as
a result of some update action. The signature lifetimes will be
adjusted so as to spread the re-sign load over time rather than
all at once.
-NSEC3 and OPTOUT
+NSEC3 and OPTOUT
named only supports creating new NSEC3 chains
where all the NSEC3 records in the zone have the same OPTOUT
@@ -1309,7 +1311,7 @@ options {
configuration files.
-Validating Resolver
+Validating Resolver
To configure a validating resolver to use RFC 5011 to
maintain a trust anchor, configure the trust anchor using a
managed-keys statement. Information about
@@ -1320,7 +1322,7 @@ options {
-Authoritative Server
+Authoritative Server
To set up an authoritative zone for RFC 5011 trust anchor
maintenance, generate two (or more) key signing keys (KSKs) for
the zone. Sign the zone with one of them; this is the "active"
@@ -1394,7 +1396,7 @@ $ dnssec-signzone -S -K keys example.net<
Debian Linux, Solaris x86 and Windows Server 2003.
-Prerequisites
+Prerequisites
See the HSM vendor documentation for information about
installing, initializing, testing and troubleshooting the
HSM.
@@ -1429,13 +1431,16 @@ $ dnssec-signzone -S -K keys example.net<
other computationally-intensive operations. The AEP Keyper
is an example of such a device.
-
The modified OpenSSL code is included in the BIND 9.7.0
- release, in the form of a context diff against the latest OpenSSL.
+
The modified OpenSSL code is included in the BIND 9 release,
+ in the form of a context diff against the latest verions of
+ OpenSSL. OpenSSL 0.9.8 and 1.0.0 are both supported; there are
+ separate diffs for each version. In the examples to follow,
+ we use OpenSSL 0.9.8, but the same methods work with OpenSSL 1.0.0.
Note
- The latest OpenSSL version at the time of the BIND release
- is 0.9.8l.
+ The latest OpenSSL versions at the time of the BIND release
+ are 0.9.8s and 1.0.0f.
ISC will provide an updated patch as new versions of OpenSSL
are released. The version number in the following examples
is expected to change.
@@ -1444,18 +1449,18 @@ $ dnssec-signzone -S -K keys example.net<
necessary to build OpenSSL with this patch in place and inform
it of the path to the HSM-specific PKCS #11 provider
library.
-
(Note that the patch file may not be compatible with the
@@ -1468,7 +1473,7 @@ $ patch -p1 -d openssl-0.9.8l \
when we configure BIND 9.
-Building OpenSSL for the AEP Keyper on Linux
+Building OpenSSL for the AEP Keyper on Linux
The AEP Keyper is a highly secure key storage device,
but does not provide hardware cryptographic acceleration. It
can carry out cryptographic operations, but it is probably
@@ -1487,7 +1492,7 @@ $ cp pkcs11.GCC4.0.2.so.4.05 /opt/pkcs11/usr/lib
Finally, the Keyper library requires threads, so we
must specify -pthread.
The SCA-6000 PKCS #11 provider is installed as a system
library, libpkcs11. It is a true crypto accelerator, up to 4
times faster than any CPU, so the flavor shall be
@@ -1508,7 +1513,7 @@ $ ./Configure linux-generic32 -m32 -pthread \
In this example, we are building on Solaris x86 on an
AMD64 system.
SoftHSM is a software library provided by the OpenDNSSEC
+ project (http://www.opendnssec.org) which provides a PKCS#11
+ interface to a virtual HSM, implemented in the form of encrypted
+ data on the local filesystem. It uses the Botan library for
+ encryption and SQLite3 for data storage. Though less secure
+ than a true HSM, it can provide more secure key storage than
+ traditional key files, and can allow you to experiment with
+ PKCS#11 when an HSM is not available.
+
The SoftHSM cryptographic store must be installed and
+ initialized before using it with OpenSSL, and the SOFTHSM_CONF
+ environment variable must always point to the SoftHSM configuration
+ file:
+
+$ cd softhsm-1.3.0
+$ configure --prefix=/opt/pkcs11/usr
+$ make
+$ make install
+$ export SOFTHSM_CONF=/opt/pkcs11/softhsm.conf
+$ echo "0:/opt/pkcs11/softhsm.db" > $SOFTHSM_CONF
+$ /opt/pkcs11/usr/bin/softhsm --init-token 0 --slot 0 --label softhsm
+
+
SoftHSM can perform all cryptographic operations, but
+ since it only uses your system CPU, there is no need to use it
+ for anything but signing. Therefore, we choose the 'sign-only'
+ flavor when building OpenSSL.
Once you have built OpenSSL, run
- "apps/openssl engine pkcs11" to confirm
- that PKCS #11 support was compiled in correctly. The output
- should be one of the following lines, depending on the flavor
- selected:
+ "apps/openssl engine pkcs11" to confirm
+ that PKCS #11 support was compiled in correctly. The output
+ should be one of the following lines, depending on the flavor
+ selected:
Next, run
- "apps/openssl engine pkcs11 -t". This will
- attempt to initialize the PKCS #11 engine. If it is able to
- do so successfully, it will report
- “[ available ]”.
+ "apps/openssl engine pkcs11 -t". This will
+ attempt to initialize the PKCS #11 engine. If it is able to
+ do so successfully, it will report
+ “[ available ]”.
If the output is correct, run
- "make install" which will install the
- modified OpenSSL suite to
- /opt/pkcs11/usr.
-
+ "make install" which will install the
+ modified OpenSSL suite to
+ /opt/pkcs11/usr.
-Building BIND 9 with PKCS#11
+Building BIND 9 with PKCS#11
When building BIND 9, the location of the custom-built
OpenSSL library must be specified via configure.
-Configuring BIND 9 for Linux
+Configuring BIND 9 for Linux with the AEP Keyper
To link with the PKCS #11 provider, threads must be
enabled in the BIND 9 build.
The PKCS #11 library for the AEP Keyper is currently
@@ -1557,7 +1600,7 @@ $ ./Configure solaris64-x86_64-cc \
64-bit host, we must force a 32-bit build by adding "-m32" to
the CC options on the "configure" command line.
To link with the PKCS #11 provider, threads must be
enabled in the BIND 9 build.
-$ cd ../bind-9.7.0
+$ cd ../bind9
$ ./configure CC="cc -xarch=amd64" --enable-threads \
--with-openssl=/opt/pkcs11/usr \
--with-pkcs11=/usr/lib/64/libpkcs11.so
@@ -1581,14 +1624,26 @@ $ ./configure CC="cc -xarch=amd64" --enable-thre
same as the --prefix argument to the OpenSSL
Configure).
+
After configuring, run
"make",
"make test" and
"make install".
+
(Note: If "make test" fails in the "pkcs11" system test, you may
+ have forgotten to set the SOFTHSM_CONF environment variable.)
-PKCS #11 Tools
+PKCS #11 Tools
BIND 9 includes a minimal set of tools to operate the
HSM, including
pkcs11-keygen to generate a new key pair
@@ -1606,7 +1661,7 @@ $ ./configure CC="cc -xarch=amd64" --enable-thre
-Using the HSM
+Using the HSM
First, we must set up the runtime environment so the
OpenSSL and PKCS #11 libraries can be loaded:
@@ -1694,7 +1749,7 @@ example.net.signed
-Specifying the engine on the command line
+Specifying the engine on the command line
The OpenSSL engine can be specified in
named and all of the BIND
dnssec-* tools by using the "-E
@@ -1715,7 +1770,7 @@ $ dnssec-signzone -E '' -S example.net
-Running named with automatic zone re-signing
+Running named with automatic zone re-signing
If you want
named to dynamically re-sign zones using HSM
keys, and/or to to sign new records inserted via nsupdate, then
@@ -1751,7 +1806,7 @@ $ dnssec-signzone -E '' -S example.net
-IPv6 Support in BIND 9
+IPv6 Support in BIND 9
BIND 9 fully supports all currently
defined forms of IPv6 name to address and address to name
@@ -1789,7 +1844,7 @@ $ dnssec-signzone -E '' -S example.net
-Address Lookups Using AAAA Records
+Address Lookups Using AAAA Records
The IPv6 AAAA record is a parallel to the IPv4 A record,
and, unlike the deprecated A6 record, specifies the entire
@@ -1808,7 +1863,7 @@ host 3600 IN AAAA 2001:db8::1
-Address to Name Lookups Using Nibble Format
+Address to Name Lookups Using Nibble Format
When looking up an address in nibble format, the address
components are simply reversed, just as in IPv4, and
diff --git a/contrib/bind9/doc/arm/Bv9ARM.ch05.html b/contrib/bind9/doc/arm/Bv9ARM.ch05.html
index 99e2a9db661..0779c970ddc 100644
--- a/contrib/bind9/doc/arm/Bv9ARM.ch05.html
+++ b/contrib/bind9/doc/arm/Bv9ARM.ch05.html
@@ -1,5 +1,5 @@
-
+
Traditionally applications have been linked with a stub resolver
library that sends recursive DNS queries to a local caching name
diff --git a/contrib/bind9/doc/arm/Bv9ARM.ch06.html b/contrib/bind9/doc/arm/Bv9ARM.ch06.html
index 24338616ed0..8e7bac373a2 100644
--- a/contrib/bind9/doc/arm/Bv9ARM.ch06.html
+++ b/contrib/bind9/doc/arm/Bv9ARM.ch06.html
@@ -1,5 +1,5 @@
-
+
@@ -2517,7 +2535,8 @@ badresp:1,adberr:0,findfail:0,valfail:0]
The pathname of the file the server dumps
security roots to when instructed to do so with
rndc secroots.
- If not specified, the default is named.secroots.
+ If not specified, the default is
+ named.secroots.
session-keyfile
@@ -2543,14 +2562,6 @@ badresp:1,adberr:0,findfail:0,valfail:0]
hmac-sha384, hmac-sha512 and hmac-md5. If not
specified, the default is hmac-sha256.
-
session-keyfile
-
- The pathname of the file into which to write a session TSIG
- key for use by nsupdate -l. (See the
- discussion of the update-policy
- statement's local option for more
- details on this feature.)
-
port
The UDP/TCP port number the server uses for
@@ -2662,6 +2673,11 @@ options {
values for the DLV domain and trust anchor will be
used, along with a built-in key for validation.
+
+ If dnssec-lookaside is set to
+ no, then dnssec-lookaside
+ is not used.
+
The default DLV key is stored in the file
bind.keys;
@@ -3649,7 +3665,7 @@ options {
-Forwarding
+Forwarding
The forwarding facility can be used to create a large site-wide
cache on a few servers, reducing traffic over links to external
@@ -3693,7 +3709,7 @@ options {
-Dual-stack Servers
+Dual-stack Servers
Dual-stack servers are used as servers of last resort to work
around
@@ -3904,7 +3920,7 @@ options {
-Interfaces
+Interfaces
The interfaces and ports that the server will answer queries
from may be specified using the listen-on option. listen-on takes
@@ -4363,7 +4379,7 @@ avoid-v6-udp-ports {};
The server's usage of many system resources can be limited.
Scaled values are allowed when specifying resource limits. For
@@ -4567,7 +4583,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
Specify a private RDATA type to be used when generating
key signing records. The default is
- 65535.
+ 65534.
It is expected that this parameter may be removed
@@ -5210,10 +5226,11 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
and which queries should not be sent to the Internet's root
servers. The official servers which cover these namespaces
return NXDOMAIN responses to these queries. In particular,
- these cover the reverse namespace for addresses from RFC 1918 and
- RFC 3330. They also include the reverse namespace for IPv6 local
- address (locally assigned), IPv6 link local addresses, the IPv6
- loopback address and the IPv6 unknown address.
+ these cover the reverse namespaces for addresses from
+ RFC 1918, RFC 4193, and RFC 5737. They also include the
+ reverse namespace for IPv6 local address (locally assigned),
+ IPv6 link local addresses, the IPv6 loopback address and the
+ IPv6 unknown address.
Named will attempt to determine if a built-in zone already exists
@@ -5406,7 +5423,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
-Content Filtering
+Content Filtering
BIND 9 provides the ability to filter
out DNS responses from external DNS servers containing
@@ -5529,131 +5546,228 @@ deny-answer-aliases { "example.net"; };
-Response Policy Zone (RPZ) Rewriting
+Response Policy Zone (RPZ) Rewriting
BIND 9 includes an intentionally limited
mechanism to modify DNS responses for recursive requests
- similar to email anti-spam DNS blacklists.
- All response policy zones are named in the
+ somewhat similar to email anti-spam DNS blacklists.
+ Responses can be changed to deny the existence of domains(NXDOMAIN),
+ deny the existence of IP addresses for domains (NODATA),
+ or contain other IP addresses or data.
+
+
+ The actions encoded in a response policy zone (RPZ) are applied
+ only to queries that ask for recursion (RD=1).
+ Response policy zones are named in the
response-policy option for the view or among the
global options if there is no response-policy option for the view.
-
-
- The rules encoded in a response policy zone (RPZ) are applied
- only to responses to queries that ask for recursion (RD=1).
- RPZs are normal DNS zones containing RRsets
+ RPZs are ordinary DNS zones containing RRsets
that can be queried normally if allowed.
It is usually best to restrict those queries with something like
- allow-query {none; }; or
- allow-query { 127.0.0.1; };.
+ allow-query { localhost; };.
- There are four kinds of RPZ rewrite rules. QNAME rules are
- applied to query names in requests and to targets of CNAME
- records resolved in the process of generating the response.
- The owner name of a QNAME rule is the query name relativized
+ There are four kinds of RPZ records, QNAME, IP, NSIP,
+ and NSDNAME.
+ QNAME records are applied to query names of requests and targets
+ of CNAME records resolved to generate the response.
+ The owner name of a QNAME RPZ record is the query name relativized
to the RPZ.
- The records in a rewrite rule are usually A, AAAA, or special
- CNAMEs, but can be any type except DNAME.
- IP rules are triggered by addresses in A and AAAA records.
- All IP addresses in A or AAAA RRsets are tested and the rule
- longest prefix is applied. Ties between rules with equal prefixes
- are broken in favor of the first RPZ mentioned in the
- response-policy option.
- The rule matching the smallest IP address is chosen among equal
- prefix rules from a single RPZ.
- IP rules are expressed in RRsets with owner names that are
- subdomains of rpz-ip and encoding an IP address block, reversed
- as in IN-ARPA.
- prefix.B.B.B.B with prefix between 1 and 32 and B between 1 and 255
- encodes an IPv4 address.
- IPv6 addresses are encoded by with prefix.W.W.W.W.W.W.W.W or
- prefix.WORDS.zz.WORDS. The words in the standard IPv6 text
- representation are reversed, "::" is replaced with ".zz.",
- and ":" becomes ".".
+ The second kind of RPZ record, an IP policy record,
+ is triggered by addresses in A and AAAA records
+ for the ANSWER sections of responses.
+ IP policy records have owner names that are
+ subdomains of rpz-ip relativized to the
+ RPZ origin name and encode an IP address or address block.
+ IPv4 addresses are encoded as
+ prefixlength.B4.B3.B2.B1.rpz-ip.
+ The prefix length must be between 1 and 32.
+ All four bytes, B4, B3, B2, and B1, must be present.
+ B4 is the decimal value of the least significant byte of the
+ IPv4 address as in IN-ADDR.ARPA.
+ IPv6 addresses are encoded in a format similar to the standard
+ IPv6 text representation,
+ prefixlength.W8.W7.W6.W5.W4.W3.W2.W1.rpz-ip.
+ Each of W8,...,W1 is a one to four digit hexadecimal number
+ representing 16 bits of the IPv6 address as in the standard text
+ representation of IPv6 addresses, but reversed as in IN-ADDR.ARPA.
+ All 8 words must be present except when consecutive
+ zero words are replaced with .zz.
+ analogous to double colons (::) in standard IPv6 text encodings.
+ The prefix length must be between 1 and 128.
- NSDNAME rules match names in NS RRsets for the response or a
- parent. They are encoded as subdomains of rpz-nsdomain relativized
+ NSDNAME policy records match names of authoritative servers
+ for the query name, a parent of the query name, a CNAME,
+ or a parent of a CNAME.
+ They are encoded as subdomains of
+ rpz-nsdomain relativized
to the RPZ origin name.
- NSIP rules match IP addresses in A and AAAA RRsets for names of
- responsible servers or the names that can be matched by NSDNAME
- rules. The are encoded like IP rules except as subdomains of
- rpz-nsip.
+ NSIP policy records match IP addresses in A and AAAA RRsets
+ for domains that can be checked against NSDNAME policy records.
+ The are encoded like IP policies except as subdomains of
+ rpz-nsip.
- Authority verification issues and variations in authority data in
- the current version of BIND 9 can cause
- inconsistent results from NSIP and NSDNAME. So they are available
+ The query response is checked against all RPZs, so
+ two or more policy records can apply to a single response.
+ Because DNS responses can be rewritten according by at most a
+ single policy record, a single policy (other than
+ DISABLED policies) must be chosen.
+ Policies are chosen in the following order:
+
+
+
Among applicable zones, use the RPZ that appears first
+ in the response-policy option.
+
+
Prefer QNAME to IP to NSDNAME to NSIP policy records
+ in a single RPZ
+
+
Among applicable NSDNAME policy records, prefer the
+ policy record that matches the lexically smallest name
+
+
Among IP or NSIP policy records, prefer the record
+ with the longest prefix.
+
+
Among records with the same prefex length,
+ prefer the IP or NSIP policy record that matches
+ the smallest IP address.
+
+
+
+
+
+ When the processing of a response is restarted to resolve
+ DNAME or CNAME records and an applicable policy record set has
+ not been found,
+ all RPZs are again consulted for the DNAME or CNAME names
+ and addresses.
+
+
+ Authority verification issues and variations in authority data
+ can cause inconsistent results for NSIP and NSDNAME policy records.
+ Glue NS records often differ from authoritative NS records.
+ So they are available
only when BIND is built with the
--enable-rpz-nsip or
--enable-rpz-nsdname options
on the "configure" command line.
- Four policies can be expressed.
- The NXDOMAIN policy causes a NXDOMAIN response
- and is expressed with an RRset consisting of a single CNAME
- whose target is the root domain (.).
- NODATA generates NODATA or ANCOUNT=1 regardless
- of query type.
- It is expressed with a CNAME whose target is the wildcard
- top-level domain (*.).
- The NO-OP policy does not change the response
- and is used to "poke holes" in policies for larger CIDR blocks or in
- zones named later in the response-policy option.
- The NO-OP policy is expressed by a CNAME with a target consisting
- of the variable part of the owner name, such as "example.com." for
- a QNAME rule or "128.1.0.0.127." for an IP rule.
- The CNAME policy is used to replace the RRsets
- of response.
- A and AAAA RRsets are most common and useful to capture
- an evil domain in a walled garden, but any valid set of RRsets
- is possible.
+ RPZ record sets are special CNAME records or one or more
+ of any types of DNS record except DNAME or DNSSEC.
+ Except when a policy record is a CNAME, there can be more
+ more than one record and more than one type
+ in a set of policy records.
+ Except for three kinds of CNAME records that are illegal except
+ in policy zones, the records in a set are used in the response as if
+ their owner name were the query name. They are copied to the
+ response as dictated by their types.
+
+
+
A CNAME whose target is the root domain (.)
+ specifies the NXDOMAIN policy,
+ which generates an NXDOMAIN response.
+
+
A CNAME whose target is the wildcard top-level
+ domain (*.) specifies the NODATA policy,
+ which rewrites the response to NODATA or ANCOUNT=1.
+
+
A CNAME whose target is a wildcard hostname such
+ as *.example.com is used normally after the astrisk (*)
+ has been replaced with the query name.
+ These records are usually resolved with ordinary CNAMEs
+ outside the policy zones. They can be useful for logging.
+
+
The PASSTHRU policy is specified
+ by a CNAME whose target is the variable part of its own
+ owner name. It causes the response to not be rewritten
+ and is most often used to "poke holes" in policies for
+ CIDR blocks.
+
+
+
- All of the policies in an RPZ can be overridden with a
- policy clause.
- given says "do not override."
- no-op says "do nothing" regardless of the policy
- in RPZ records.
- nxdomain causes all RPZ rules to generate
- NXDOMAIN results.
- nodata gives nodata.
- cname domain causes all RPZ rules to act as if
- the consisted of a "cname domain" record.
+ The policies specified in individual records
+ in an RPZ can be overridden with a policy clause
+ in the response-policy option.
+ An organization using an RPZ provided by another organization might
+ use this mechanism to redirect domains to its own walled garden.
+
+
+
+GIVEN says "do not override."
+
+
+DISABLED causes policy records to do
+ nothing but log what they might have done.
+ The response to the DNS query will be written according to
+ any matching policy records that are not disabled.
+ Policy zones overridden with DISABLED should
+ appear first, because they will often not be logged
+ if a higher precedence policy is found first.
+
+
+PASSTHRU causes all policy records
+ to act as if they were CNAME records with targets the variable
+ part of their owner name. They protect the response from
+ being changed.
+
+
+NXDOMAIN causes all RPZ records
+ to specify NXDOMAIN policies.
+
+
+NODATA overrides with the
+ NODATA policy
+
+
+CNAME domain causes all RPZ
+ policy records to act as if they were "cname domain" records.
+
+
+
For example, you might use this option statement
-
response-policy { zone "bl"; };
+
response-policy { zone "badlist"; };
and this zone statement
-
zone "bl" {type master; file "example/bl"; allow-query {none;}; };
+
zone "badlist" {type master; file "master/badlist"; allow-query {none;}; };
with this zone file
$TTL 1H
-@ SOA LOCALHOST. named-mgr.example.com (1 1h 15m 30d 2h)
+@ SOA LOCALHOST. named-mgr.example.com (1 1h 15m 30d 2h)
+ NS LOCALHOST.
-; QNAME rules
-nxdomain.domain.com CNAME .
-nodata.domain.com CNAME *.
-bad.domain.com A 10.0.0.1
- AAAA 2001:2::1
-ok.domain.com CNAME ok.domain.com.
-*.badzone.domain.com CNAME garden.example.com.
+; QNAME policy records. There are no periods (.) after the owner names.
+nxdomain.domain.com CNAME . ; NXDOMAIN policy
+nodata.domain.com CNAME *. ; NODATA policy
+bad.domain.com A 10.0.0.1 ; redirect to a walled garden
+ AAAA 2001:2::1
-; IP rules rewriting all answers for 127/8 except 127.0.0.1
-8.0.0.0.127.ip CNAME .
-32.1.0.0.127.ip CNAME 32.1.0.0.127.
+; do not rewrite (PASSTHRU) OK.DOMAIN.COM
+ok.domain.com CNAME ok.domain.com.
-; NSDNAME and NSIP rules
+bzone.domain.com CNAME garden.example.com.
+
+; redirect x.bzone.domain.com to x.bzone.domain.com.garden.example.com
+*.bzone.domain.com CNAME *.garden.example.com.
+
+
+; IP policy records that rewrite all answers for 127/8 except 127.0.0.1
+8.0.0.0.127.rpz-ip CNAME .
+32.1.0.0.127.rpz-ip CNAME 32.1.0.0.127. ; PASSTHRU for 127.0.0.1
+
+; NSDNAME and NSIP policy records
ns.domain.com.rpz-nsdname CNAME .
48.zz.2.2001.rpz-nsip CNAME .
A domain name identifies a node. Each node has a set of
resource information, which may be empty. The set of resource
@@ -8303,7 +8417,7 @@ example.com. NS ns2.example.net.
-Textual expression of RRs
+Textual expression of RRs
RRs are represented in binary form in the packets of the DNS
protocol, and are usually represented in highly encoded form
@@ -8506,7 +8620,7 @@ example.com. NS ns2.example.net.
-Discussion of MX Records
+Discussion of MX Records
As described above, domain servers store information as a
series of resource records, each of which contains a particular
@@ -8762,7 +8876,7 @@ example.com. NS ns2.example.net.
-Inverse Mapping in IPv4
+Inverse Mapping in IPv4
Reverse name resolution (that is, translation from IP address
to name) is achieved by means of the in-addr.arpa domain
@@ -8823,7 +8937,7 @@ example.com. NS ns2.example.net.
-Other Zone File Directives
+Other Zone File Directives
The Master File Format was initially defined in RFC 1035 and
has subsequently been extended. While the Master File Format
@@ -8838,7 +8952,7 @@ example.com. NS ns2.example.net.
-The @ (at-sign)
+The @ (at-sign)
When used in the label (or name) field, the asperand or
at-sign (@) symbol represents the current origin.
@@ -8849,7 +8963,7 @@ example.com. NS ns2.example.net.
Socket I/O statistics counters are defined per socket
types, which are
@@ -10606,7 +10720,7 @@ HOST-127.EXAMPLE. MX 0 .
-Compatibility with BIND 8 Counters
+Compatibility with BIND 8 Counters
Most statistics counters that were available
in BIND 8 are also supported in
diff --git a/contrib/bind9/doc/arm/Bv9ARM.ch07.html b/contrib/bind9/doc/arm/Bv9ARM.ch07.html
index f2c50e28656..3900f707c82 100644
--- a/contrib/bind9/doc/arm/Bv9ARM.ch07.html
+++ b/contrib/bind9/doc/arm/Bv9ARM.ch07.html
@@ -1,5 +1,5 @@
-
+
@@ -84,9 +84,8 @@
// RFC1918 space and some reserved space, which is
// commonly used in spoofing attacks.
acl bogusnets {
- 0.0.0.0/8; 1.0.0.0/8; 2.0.0.0/8; 192.0.2.0/24;
- 224.0.0.0/3; 10.0.0.0/8; 172.16.0.0/12;
- 192.168.0.0/16;
+ 0.0.0.0/8; 192.0.2.0/24; 224.0.0.0/3;
+ 10.0.0.0/8; 172.16.0.0/12; 192.168.0.0/16;
};
// Set up an ACL called our-nets. Replace this with the
@@ -122,7 +121,7 @@ zone "example.com" {
-Chroot and Setuid
+Chroot and Setuid
On UNIX servers, it is possible to run BIND
@@ -148,7 +147,7 @@ zone "example.com" {
-The chroot Environment
+The chroot Environment
In order for a chroot environment
to
@@ -176,7 +175,7 @@ zone "example.com" {
-Using the setuid Function
+Using the setuid Function
Prior to running the named daemon,
use
diff --git a/contrib/bind9/doc/arm/Bv9ARM.ch08.html b/contrib/bind9/doc/arm/Bv9ARM.ch08.html
index faa3a0434c0..8a59dc66712 100644
--- a/contrib/bind9/doc/arm/Bv9ARM.ch08.html
+++ b/contrib/bind9/doc/arm/Bv9ARM.ch08.html
@@ -1,5 +1,5 @@
-
+
-It's not working; how can I figure out what's wrong?
+It's not working; how can I figure out what's wrong?
The best solution to solving installation and
configuration issues is to take preventative measures by setting
@@ -68,7 +68,7 @@
-Incrementing and Changing the Serial Number
+Incrementing and Changing the Serial Number
Zone serial numbers are just numbers — they aren't
date related. A lot of people set them to a number that
@@ -95,7 +95,7 @@
-Where Can I Get Help?
+Where Can I Get Help?
The Internet Systems Consortium
(ISC) offers a wide range
diff --git a/contrib/bind9/doc/arm/Bv9ARM.ch09.html b/contrib/bind9/doc/arm/Bv9ARM.ch09.html
index cda5f6c30d3..d627284af52 100644
--- a/contrib/bind9/doc/arm/Bv9ARM.ch09.html
+++ b/contrib/bind9/doc/arm/Bv9ARM.ch09.html
@@ -1,5 +1,5 @@
-
+
A Brief History of the DNS and BIND
@@ -172,7 +172,7 @@
-General DNS Reference Information
+General DNS Reference Information
IPv6 addresses (AAAA)
@@ -260,17 +260,17 @@
-Bibliography
+Bibliography
Standards
-
[RFC974] C.Partridge. Mail Routing and the Domain System. January 1986.
+
[RFC974] C.Partridge. Mail Routing and the Domain System. January 1986.
-
[RFC1034] P.V.Mockapetris. Domain Names — Concepts and Facilities. November 1987.
+
[RFC1034] P.V.Mockapetris. Domain Names — Concepts and Facilities. November 1987.
-
[RFC1035] P. V.Mockapetris. Domain Names — Implementation and
+
[RFC1035] P. V.Mockapetris. Domain Names — Implementation and
Specification. November 1987.
@@ -278,42 +278,42 @@
Proposed Standards
-
[RFC2181] R., R. BushElz. Clarifications to the DNS
+
[RFC2181] R., R. BushElz. Clarifications to the DNS
Specification. July 1997.
-
[RFC2308] M.Andrews. Negative Caching of DNS
+
[RFC2308] M.Andrews. Negative Caching of DNS
Queries. March 1998.
-
[RFC1995] M.Ohta. Incremental Zone Transfer in DNS. August 1996.
+
[RFC1995] M.Ohta. Incremental Zone Transfer in DNS. August 1996.
-
[RFC1996] P.Vixie. A Mechanism for Prompt Notification of Zone Changes. August 1996.
+
[RFC1996] P.Vixie. A Mechanism for Prompt Notification of Zone Changes. August 1996.
-
[RFC2136] P.Vixie, S.Thomson, Y.Rekhter, and J.Bound. Dynamic Updates in the Domain Name System. April 1997.
+
[RFC2136] P.Vixie, S.Thomson, Y.Rekhter, and J.Bound. Dynamic Updates in the Domain Name System. April 1997.
-
[RFC2671] P.Vixie. Extension Mechanisms for DNS (EDNS0). August 1997.
+
[RFC2671] P.Vixie. Extension Mechanisms for DNS (EDNS0). August 1997.
-
[RFC2672] M.Crawford. Non-Terminal DNS Name Redirection. August 1999.
+
[RFC2672] M.Crawford. Non-Terminal DNS Name Redirection. August 1999.
-
[RFC2845] P.Vixie, O.Gudmundsson, D.Eastlake, 3rd, and B.Wellington. Secret Key Transaction Authentication for DNS (TSIG). May 2000.
+
[RFC2845] P.Vixie, O.Gudmundsson, D.Eastlake, 3rd, and B.Wellington. Secret Key Transaction Authentication for DNS (TSIG). May 2000.
-
[RFC2930] D.Eastlake, 3rd. Secret Key Establishment for DNS (TKEY RR). September 2000.
+
[RFC2930] D.Eastlake, 3rd. Secret Key Establishment for DNS (TKEY RR). September 2000.
-
[RFC2931] D.Eastlake, 3rd. DNS Request and Transaction Signatures (SIG(0)s). September 2000.
+
[RFC2931] D.Eastlake, 3rd. DNS Request and Transaction Signatures (SIG(0)s). September 2000.
-
[RFC3007] B.Wellington. Secure Domain Name System (DNS) Dynamic Update. November 2000.
+
[RFC3007] B.Wellington. Secure Domain Name System (DNS) Dynamic Update. November 2000.
-
[RFC3645] S.Kwan, P.Garg, J.Gilroy, L.Esibov, J.Westhead, and R.Hall. Generic Security Service Algorithm for Secret
+
[RFC3645] S.Kwan, P.Garg, J.Gilroy, L.Esibov, J.Westhead, and R.Hall. Generic Security Service Algorithm for Secret
Key Transaction Authentication for DNS
(GSS-TSIG). October 2003.
@@ -322,19 +322,19 @@
DNS Security Proposed Standards
-
[RFC3225] D.Conrad. Indicating Resolver Support of DNSSEC. December 2001.
+
[RFC3225] D.Conrad. Indicating Resolver Support of DNSSEC. December 2001.
-
[RFC3833] D.Atkins and R.Austein. Threat Analysis of the Domain Name System (DNS). August 2004.
+
[RFC3833] D.Atkins and R.Austein. Threat Analysis of the Domain Name System (DNS). August 2004.
-
[RFC4033] R.Arends, R.Austein, M.Larson, D.Massey, and S.Rose. DNS Security Introduction and Requirements. March 2005.
+
[RFC4033] R.Arends, R.Austein, M.Larson, D.Massey, and S.Rose. DNS Security Introduction and Requirements. March 2005.
-
[RFC4034] R.Arends, R.Austein, M.Larson, D.Massey, and S.Rose. Resource Records for the DNS Security Extensions. March 2005.
+
[RFC4034] R.Arends, R.Austein, M.Larson, D.Massey, and S.Rose. Resource Records for the DNS Security Extensions. March 2005.
-
[RFC4035] R.Arends, R.Austein, M.Larson, D.Massey, and S.Rose. Protocol Modifications for the DNS
+
[RFC4035] R.Arends, R.Austein, M.Larson, D.Massey, and S.Rose. Protocol Modifications for the DNS
Security Extensions. March 2005.
@@ -342,146 +342,146 @@
Other Important RFCs About DNS
Implementation
-
[RFC1535] E.Gavron. A Security Problem and Proposed Correction With Widely
+
[RFC1535] E.Gavron. A Security Problem and Proposed Correction With Widely
Deployed DNS Software.. October 1993.
-
[RFC1536] A.Kumar, J.Postel, C.Neuman, P.Danzig, and S.Miller. Common DNS Implementation
+
[RFC1536] A.Kumar, J.Postel, C.Neuman, P.Danzig, and S.Miller. Common DNS Implementation
Errors and Suggested Fixes. October 1993.
-
[RFC1982] R.Elz and R.Bush. Serial Number Arithmetic. August 1996.
+
[RFC1982] R.Elz and R.Bush. Serial Number Arithmetic. August 1996.
-
[RFC4074] Y.Morishita and T.Jinmei. Common Misbehaviour Against DNS
+
[RFC4074] Y.Morishita and T.Jinmei. Common Misbehaviour Against DNS
Queries for IPv6 Addresses. May 2005.
Resource Record Types
-
[RFC1183] C.F.Everhart, L. A.Mamakos, R.Ullmann, and P.Mockapetris. New DNS RR Definitions. October 1990.
+
[RFC1183] C.F.Everhart, L. A.Mamakos, R.Ullmann, and P.Mockapetris. New DNS RR Definitions. October 1990.
-
[RFC1706] B.Manning and R.Colella. DNS NSAP Resource Records. October 1994.
+
[RFC1706] B.Manning and R.Colella. DNS NSAP Resource Records. October 1994.
-
[RFC2168] R.Daniel and M.Mealling. Resolution of Uniform Resource Identifiers using
+
[RFC2168] R.Daniel and M.Mealling. Resolution of Uniform Resource Identifiers using
the Domain Name System. June 1997.
-
[RFC1876] C.Davis, P.Vixie, T., and I.Dickinson. A Means for Expressing Location Information in the
+
[RFC1876] C.Davis, P.Vixie, T., and I.Dickinson. A Means for Expressing Location Information in the
Domain
Name System. January 1996.
-
[RFC2052] A.Gulbrandsen and P.Vixie. A DNS RR for Specifying the
+
[RFC2052] A.Gulbrandsen and P.Vixie. A DNS RR for Specifying the
Location of
Services.. October 1996.
-
[RFC2163] A.Allocchio. Using the Internet DNS to
+
[RFC2163] A.Allocchio. Using the Internet DNS to
Distribute MIXER
Conformant Global Address Mapping. January 1998.
-
[RFC2230] R.Atkinson. Key Exchange Delegation Record for the DNS. October 1997.
+
[RFC2230] R.Atkinson. Key Exchange Delegation Record for the DNS. October 1997.
-
[RFC2536] D.Eastlake, 3rd. DSA KEYs and SIGs in the Domain Name System (DNS). March 1999.
+
[RFC2536] D.Eastlake, 3rd. DSA KEYs and SIGs in the Domain Name System (DNS). March 1999.
-
[RFC2537] D.Eastlake, 3rd. RSA/MD5 KEYs and SIGs in the Domain Name System (DNS). March 1999.
+
[RFC2537] D.Eastlake, 3rd. RSA/MD5 KEYs and SIGs in the Domain Name System (DNS). March 1999.
-
[RFC2538] D.Eastlake, 3rd and O.Gudmundsson. Storing Certificates in the Domain Name System (DNS). March 1999.
+
[RFC2538] D.Eastlake, 3rd and O.Gudmundsson. Storing Certificates in the Domain Name System (DNS). March 1999.
-
[RFC2539] D.Eastlake, 3rd. Storage of Diffie-Hellman Keys in the Domain Name System (DNS). March 1999.
+
[RFC2539] D.Eastlake, 3rd. Storage of Diffie-Hellman Keys in the Domain Name System (DNS). March 1999.
-
[RFC2540] D.Eastlake, 3rd. Detached Domain Name System (DNS) Information. March 1999.
+
[RFC2540] D.Eastlake, 3rd. Detached Domain Name System (DNS) Information. March 1999.
-
[RFC2782] A.Gulbrandsen. P.Vixie. L.Esibov. A DNS RR for specifying the location of services (DNS SRV). February 2000.
+
[RFC2782] A.Gulbrandsen. P.Vixie. L.Esibov. A DNS RR for specifying the location of services (DNS SRV). February 2000.
-
[RFC2915] M.Mealling. R.Daniel. The Naming Authority Pointer (NAPTR) DNS Resource Record. September 2000.
+
[RFC2915] M.Mealling. R.Daniel. The Naming Authority Pointer (NAPTR) DNS Resource Record. September 2000.
-
[RFC3110] D.Eastlake, 3rd. RSA/SHA-1 SIGs and RSA KEYs in the Domain Name System (DNS). May 2001.
+
[RFC3110] D.Eastlake, 3rd. RSA/SHA-1 SIGs and RSA KEYs in the Domain Name System (DNS). May 2001.
-
[RFC3123] P.Koch. A DNS RR Type for Lists of Address Prefixes (APL RR). June 2001.
+
[RFC3123] P.Koch. A DNS RR Type for Lists of Address Prefixes (APL RR). June 2001.
-
[RFC3596] S.Thomson, C.Huitema, V.Ksinant, and M.Souissi. DNS Extensions to support IP
+
[RFC3596] S.Thomson, C.Huitema, V.Ksinant, and M.Souissi. DNS Extensions to support IP
version 6. October 2003.
-
[RFC3597] A.Gustafsson. Handling of Unknown DNS Resource Record (RR) Types. September 2003.
+
[RFC3597] A.Gustafsson. Handling of Unknown DNS Resource Record (RR) Types. September 2003.
DNS and the Internet
-
[RFC1101] P. V.Mockapetris. DNS Encoding of Network Names
+
[RFC1101] P. V.Mockapetris. DNS Encoding of Network Names
and Other Types. April 1989.
-
[RFC1123] Braden. Requirements for Internet Hosts - Application and
+
[RFC1123] Braden. Requirements for Internet Hosts - Application and
Support. October 1989.
-
[RFC1591] J.Postel. Domain Name System Structure and Delegation. March 1994.
+
[RFC1591] J.Postel. Domain Name System Structure and Delegation. March 1994.
-
[RFC2317] H.Eidnes, G.de Groot, and P.Vixie. Classless IN-ADDR.ARPA Delegation. March 1998.
+
[RFC2317] H.Eidnes, G.de Groot, and P.Vixie. Classless IN-ADDR.ARPA Delegation. March 1998.
-
[RFC2826] Internet Architecture Board. IAB Technical Comment on the Unique DNS Root. May 2000.
+
[RFC2826] Internet Architecture Board. IAB Technical Comment on the Unique DNS Root. May 2000.
-
[RFC2929] D.Eastlake, 3rd, E.Brunner-Williams, and B.Manning. Domain Name System (DNS) IANA Considerations. September 2000.
+
[RFC2929] D.Eastlake, 3rd, E.Brunner-Williams, and B.Manning. Domain Name System (DNS) IANA Considerations. September 2000.
DNS Operations
-
[RFC1033] M.Lottor. Domain administrators operations guide.. November 1987.
+
[RFC1033] M.Lottor. Domain administrators operations guide.. November 1987.
-
[RFC1537] P.Beertema. Common DNS Data File
+
[RFC1537] P.Beertema. Common DNS Data File
Configuration Errors. October 1993.
-
[RFC1912] D.Barr. Common DNS Operational and
+
[RFC1912] D.Barr. Common DNS Operational and
Configuration Errors. February 1996.
-
[RFC2010] B.Manning and P.Vixie. Operational Criteria for Root Name Servers.. October 1996.
+
[RFC2010] B.Manning and P.Vixie. Operational Criteria for Root Name Servers.. October 1996.
-
[RFC2219] M.Hamilton and R.Wright. Use of DNS Aliases for
+
[RFC2219] M.Hamilton and R.Wright. Use of DNS Aliases for
Network Services.. October 1997.
Internationalized Domain Names
-
[RFC2825] IAB and R.Daigle. A Tangled Web: Issues of I18N, Domain Names,
+
[RFC2825] IAB and R.Daigle. A Tangled Web: Issues of I18N, Domain Names,
and the Other Internet protocols. May 2000.
-
[RFC3490] P.Faltstrom, P.Hoffman, and A.Costello. Internationalizing Domain Names in Applications (IDNA). March 2003.
+
[RFC3490] P.Faltstrom, P.Hoffman, and A.Costello. Internationalizing Domain Names in Applications (IDNA). March 2003.
-
[RFC3491] P.Hoffman and M.Blanchet. Nameprep: A Stringprep Profile for Internationalized Domain Names. March 2003.
+
[RFC3491] P.Hoffman and M.Blanchet. Nameprep: A Stringprep Profile for Internationalized Domain Names. March 2003.
-
[RFC3492] A.Costello. Punycode: A Bootstring encoding of Unicode
+
[RFC3492] A.Costello. Punycode: A Bootstring encoding of Unicode
for Internationalized Domain Names in
Applications (IDNA). March 2003.
@@ -497,47 +497,47 @@
-
[RFC1464] R.Rosenbaum. Using the Domain Name System To Store Arbitrary String
+
[RFC1464] R.Rosenbaum. Using the Domain Name System To Store Arbitrary String
Attributes. May 1993.
-
[RFC1713] A.Romao. Tools for DNS Debugging. November 1994.
+
[RFC1713] A.Romao. Tools for DNS Debugging. November 1994.
-
[RFC1794] T.Brisco. DNS Support for Load
+
[RFC1794] T.Brisco. DNS Support for Load
Balancing. April 1995.
-
[RFC2240] O.Vaughan. A Legal Basis for Domain Name Allocation. November 1997.
+
[RFC2240] O.Vaughan. A Legal Basis for Domain Name Allocation. November 1997.
-
[RFC2345] J.Klensin, T.Wolf, and G.Oglesby. Domain Names and Company Name Retrieval. May 1998.
+
[RFC2345] J.Klensin, T.Wolf, and G.Oglesby. Domain Names and Company Name Retrieval. May 1998.
-
[RFC2352] O.Vaughan. A Convention For Using Legal Names as Domain Names. May 1998.
+
[RFC2352] O.Vaughan. A Convention For Using Legal Names as Domain Names. May 1998.
-
[RFC3071] J.Klensin. Reflections on the DNS, RFC 1591, and Categories of Domains. February 2001.
+
[RFC3071] J.Klensin. Reflections on the DNS, RFC 1591, and Categories of Domains. February 2001.
-
[RFC3258] T.Hardie. Distributing Authoritative Name Servers via
+
[RFC3258] T.Hardie. Distributing Authoritative Name Servers via
Shared Unicast Addresses. April 2002.
-
[RFC3901] A.Durand and J.Ihren. DNS IPv6 Transport Operational Guidelines. September 2004.
+
[RFC3901] A.Durand and J.Ihren. DNS IPv6 Transport Operational Guidelines. September 2004.
Obsolete and Unimplemented Experimental RFC
-
[RFC1712] C.Farrell, M.Schulze, S.Pleitner, and D.Baldoni. DNS Encoding of Geographical
+
[RFC1712] C.Farrell, M.Schulze, S.Pleitner, and D.Baldoni. DNS Encoding of Geographical
Location. November 1994.
-
[RFC2673] M.Crawford. Binary Labels in the Domain Name System. August 1999.
+
[RFC2673] M.Crawford. Binary Labels in the Domain Name System. August 1999.
-
[RFC2874] M.Crawford and C.Huitema. DNS Extensions to Support IPv6 Address Aggregation
+
[RFC2874] M.Crawford and C.Huitema. DNS Extensions to Support IPv6 Address Aggregation
and Renumbering. July 2000.
@@ -551,39 +551,39 @@
-
[RFC2065] D.Eastlake, 3rd and C.Kaufman. Domain Name System Security Extensions. January 1997.
+
[RFC2065] D.Eastlake, 3rd and C.Kaufman. Domain Name System Security Extensions. January 1997.
-
[RFC2137] D.Eastlake, 3rd. Secure Domain Name System Dynamic Update. April 1997.
+
[RFC2137] D.Eastlake, 3rd. Secure Domain Name System Dynamic Update. April 1997.
-
[RFC2535] D.Eastlake, 3rd. Domain Name System Security Extensions. March 1999.
+
[RFC2535] D.Eastlake, 3rd. Domain Name System Security Extensions. March 1999.
-
[RFC3008] B.Wellington. Domain Name System Security (DNSSEC)
+
[RFC3008] B.Wellington. Domain Name System Security (DNSSEC)
Signing Authority. November 2000.
-
[RFC3090] E.Lewis. DNS Security Extension Clarification on Zone Status. March 2001.
+
[RFC3090] E.Lewis. DNS Security Extension Clarification on Zone Status. March 2001.
-
[RFC3445] D.Massey and S.Rose. Limiting the Scope of the KEY Resource Record (RR). December 2002.
+
[RFC3445] D.Massey and S.Rose. Limiting the Scope of the KEY Resource Record (RR). December 2002.
-
[RFC3655] B.Wellington and O.Gudmundsson. Redefinition of DNS Authenticated Data (AD) bit. November 2003.
+
[RFC3655] B.Wellington and O.Gudmundsson. Redefinition of DNS Authenticated Data (AD) bit. November 2003.
-
[RFC3658] O.Gudmundsson. Delegation Signer (DS) Resource Record (RR). December 2003.
+
[RFC3658] O.Gudmundsson. Delegation Signer (DS) Resource Record (RR). December 2003.
-
[RFC3755] S.Weiler. Legacy Resolver Compatibility for Delegation Signer (DS). May 2004.
+
[RFC3755] S.Weiler. Legacy Resolver Compatibility for Delegation Signer (DS). May 2004.
-
[RFC3757] O.Kolkman, J.Schlyter, and E.Lewis. Domain Name System KEY (DNSKEY) Resource Record
+
[RFC3757] O.Kolkman, J.Schlyter, and E.Lewis. Domain Name System KEY (DNSKEY) Resource Record
(RR) Secure Entry Point (SEP) Flag. April 2004.
-
[RFC3845] J.Schlyter. DNS Security (DNSSEC) NextSECure (NSEC) RDATA Format. August 2004.
+
[RFC3845] J.Schlyter. DNS Security (DNSSEC) NextSECure (NSEC) RDATA Format. August 2004.
@@ -604,14 +604,14 @@
-Other Documents About BIND
+Other Documents About BIND
GNU make is required to build the export libraries (other
part of BIND 9 can still be built with other types of make). In
the reminder of this document, "make" means GNU make. Note that
@@ -657,7 +657,7 @@
-Compilation
+Compilation
$ ./configure --enable-exportlib [other flags]
$ make
@@ -672,7 +672,7 @@ $ make
-Installation
+Installation
$ cd lib/export
$ make install
@@ -694,7 +694,7 @@ $ make install
-Known Defects/Restrictions
+Known Defects/Restrictions
Currently, win32 is not supported for the export
library. (Normal BIND 9 application can be built as
@@ -734,7 +734,7 @@ $ make
-The dns.conf File
+The dns.conf File
The IRS library supports an "advanced" configuration file
related to the DNS library for configuration parameters that
would be beyond the capability of the
@@ -752,14 +752,14 @@ $ make
-Sample Applications
+Sample Applications
Some sample application programs using this API are
provided for reference. The following is a brief description of
these applications.
-sample: a simple stub resolver utility
+sample: a simple stub resolver utility
It sends a query of a given name (of a given optional RR type) to a
specified recursive server, and prints the result as a list of
@@ -823,7 +823,7 @@ $ make
-sample-async: a simple stub resolver, working asynchronously
+sample-async: a simple stub resolver, working asynchronously
Similar to "sample", but accepts a list
of (query) domain names as a separate file and resolves the names
@@ -864,7 +864,7 @@ $ make
-sample-request: a simple DNS transaction client
+sample-request: a simple DNS transaction client
It sends a query to a specified server, and
prints the response with minimal processing. It doesn't act as a
@@ -905,7 +905,7 @@ $ make
-sample-gai: getaddrinfo() and getnameinfo() test code
+sample-gai: getaddrinfo() and getnameinfo() test code
This is a test program
to check getaddrinfo() and getnameinfo() behavior. It takes a
@@ -922,7 +922,7 @@ $ make
-sample-update: a simple dynamic update client program
+sample-update: a simple dynamic update client program
It accepts a single update command as a
command-line argument, sends an update request message to the
@@ -1017,7 +1017,7 @@ $ sample-update -a sample-update -k Kxxx.+nnn+mm
-nsprobe: domain/name server checker in terms of RFC 4074
+nsprobe: domain/name server checker in terms of RFC 4074
It checks a set
of domains to see the name servers of the domains behave
@@ -1074,7 +1074,7 @@ $ sample-update -a sample-update -k Kxxx.+nnn+mm
-Library References
+Library References
As of this writing, there is no formal "manual" of the
libraries, except this document, header files (some of them
provide pretty detailed explanations), and sample application
diff --git a/contrib/bind9/doc/arm/Bv9ARM.ch10.html b/contrib/bind9/doc/arm/Bv9ARM.ch10.html
index 7ff08e1a9f0..1484ecf469b 100644
--- a/contrib/bind9/doc/arm/Bv9ARM.ch10.html
+++ b/contrib/bind9/doc/arm/Bv9ARM.ch10.html
@@ -1,5 +1,5 @@
-
+