diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 15a7693b40..0366061a71 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -201,6 +201,7 @@ stages: - make -j${BUILD_PARALLEL_JOBS:-1} -k all V=1 - test -z "${RUN_MAKE_INSTALL}" || make install - test -z "${RUN_MAKE_INSTALL}" || sh util/check-make-install + - if test "$(git status --porcelain | grep -Ev '\?\?' | wc -l)" -gt "0"; then git status --short; exit 1; fi needs: - job: autoreconf artifacts: true diff --git a/doc/arm/manpages.rst b/doc/arm/manpages.rst index 0ca442053a..e00f4d5230 100644 --- a/doc/arm/manpages.rst +++ b/doc/arm/manpages.rst @@ -14,7 +14,6 @@ Manual Pages ============ .. include:: ../../bin/tools/arpaname.rst -.. include:: ../../bin/confgen/tsig-keygen.rst .. include:: ../../bin/delv/delv.rst .. include:: ../../bin/dig/dig.rst .. include:: ../../bin/dnssec/dnssec-cds.rst @@ -47,3 +46,4 @@ Manual Pages .. include:: ../../bin/confgen/rndc-confgen.rst .. include:: ../../bin/rndc/rndc.conf.rst .. include:: ../../bin/rndc/rndc.rst +.. include:: ../../bin/confgen/tsig-keygen.rst diff --git a/doc/man/Makefile.am b/doc/man/Makefile.am index d038d01e6e..5601cb8ca7 100644 --- a/doc/man/Makefile.am +++ b/doc/man/Makefile.am @@ -5,6 +5,7 @@ MANPAGES_RST = \ arpaname.rst \ delv.rst \ dig.rst \ + ddns-confgen.rst \ dnssec-cds.rst \ dnssec-dsfromkey.rst \ dnssec-importkey.rst \ diff --git a/doc/man/ddns-confgen.8in b/doc/man/ddns-confgen.8in new file mode 100644 index 0000000000..fe0d8431e7 --- /dev/null +++ b/doc/man/ddns-confgen.8in @@ -0,0 +1,109 @@ +.\" Man page generated from reStructuredText. +. +.TH "DDNS-CONFGEN" "8" "@RELEASE_DATE@" "@PACKAGE_VERSION@" "BIND 9" +.SH NAME +ddns-confgen \- ddns key generation tool +. +.nr rst2man-indent-level 0 +. +.de1 rstReportMargin +\\$1 \\n[an-margin] +level \\n[rst2man-indent-level] +level margin: \\n[rst2man-indent\\n[rst2man-indent-level]] +- +\\n[rst2man-indent0] +\\n[rst2man-indent1] +\\n[rst2man-indent2] +.. +.de1 INDENT +.\" .rstReportMargin pre: +. RS \\$1 +. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin] +. nr rst2man-indent-level +1 +.\" .rstReportMargin post: +.. +.de UNINDENT +. RE +.\" indent \\n[an-margin] +.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]] +.nr rst2man-indent-level -1 +.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]] +.in \\n[rst2man-indent\\n[rst2man-indent-level]]u +.. +.SH SYNOPSIS +.sp +\fBtsig\-keygen\fP [\fB\-a\fP algorithm] [\fB\-h\fP] [\fB\-r\fP randomfile] [\fB\-s\fP name] +.sp +\fBddns\-confgen\fP [\fB\-a\fP algorithm] [\fB\-h\fP] [\fB\-k\fP keyname] [\fB\-q\fP] [\fB\-r\fP randomfile] [\fB\-s\fP name] [\fB\-z\fP zone] +.SH DESCRIPTION +.sp +\fBtsig\-keygen\fP and \fBddns\-confgen\fP are invocation methods for a +utility that generates keys for use in TSIG signing. The resulting keys +can be used, for example, to secure dynamic DNS updates to a zone or for +the \fBrndc\fP command channel. +.sp +When run as \fBtsig\-keygen\fP, a domain name can be specified on the +command line to be used as the name of the generated key. If no +name is specified, the default is \fBtsig\-key\fP\&. +.sp +When run as \fBddns\-confgen\fP, the generated key is accompanied by +configuration text and instructions that can be used with \fBnsupdate\fP +and \fBnamed\fP when setting up dynamic DNS, including an example +\fBupdate\-policy\fP statement. (This usage is similar to the \fBrndc\-confgen\fP +command for setting up command\-channel security.) +.sp +Note that \fBnamed\fP itself can configure a local DDNS key for use with +\fBnsupdate \-l\fP; it does this when a zone is configured with +\fBupdate\-policy local;\fP\&. \fBddns\-confgen\fP is only needed when a more +elaborate configuration is required: for instance, if \fBnsupdate\fP is to +be used from a remote system. +.SH OPTIONS +.INDENT 0.0 +.TP +.B \fB\-a algorithm\fP +This option specifies the algorithm to use for the TSIG key. Available choices +are: hmac\-md5, hmac\-sha1, hmac\-sha224, hmac\-sha256, hmac\-sha384, and +hmac\-sha512. The default is hmac\-sha256. Options are +case\-insensitive, and the "hmac\-" prefix may be omitted. +.TP +.B \fB\-h\fP +This option prints a short summary of options and arguments. +.TP +.B \fB\-k keyname\fP +This option specifies the key name of the DDNS authentication key. The default is +\fBddns\-key\fP when neither the \fB\-s\fP nor \fB\-z\fP option is specified; +otherwise, the default is \fBddns\-key\fP as a separate label followed +by the argument of the option, e.g., \fBddns\-key.example.com.\fP The +key name must have the format of a valid domain name, consisting of +letters, digits, hyphens, and periods. +.TP +.B \fB\-q\fP (\fBddns\-confgen\fP only) +This option enables quiet mode, which prints only the key, with no +explanatory text or usage examples. This is essentially identical to +\fBtsig\-keygen\fP\&. +.TP +.B \fB\-s name\fP (\fBddns\-confgen\fP only) +This option generates a configuration example to allow +dynamic updates of a single hostname. The example \fBnamed.conf\fP text +shows how to set an update policy for the specified name using the +"name" nametype. The default key name is \fBddns\-key.name\fP\&. Note that the +"self" nametype cannot be used, since the name to be updated may +differ from the key name. This option cannot be used with the \fB\-z\fP +option. +.TP +.B \fB\-z zone\fP (\fBddns\-confgen\fP only) +This option generates a configuration example to allow +dynamic updates of a zone. The example \fBnamed.conf\fP text shows how +to set an update policy for the specified zone using the "zonesub" +nametype, allowing updates to all subdomain names within that zone. +This option cannot be used with the \fB\-s\fP option. +.UNINDENT +.SH SEE ALSO +.sp +\fBnsupdate(1)\fP, \fBnamed.conf(5)\fP, \fBnamed(8)\fP, BIND 9 Administrator Reference Manual. +.SH AUTHOR +Internet Systems Consortium +.SH COPYRIGHT +2020, Internet Systems Consortium +.\" Generated by docutils manpage writer. +. diff --git a/doc/man/ddns-confgen.rst b/doc/man/ddns-confgen.rst new file mode 100644 index 0000000000..a1e41cceea --- /dev/null +++ b/doc/man/ddns-confgen.rst @@ -0,0 +1,13 @@ +.. + Copyright (C) Internet Systems Consortium, Inc. ("ISC") + + This Source Code Form is subject to the terms of the Mozilla Public + License, v. 2.0. If a copy of the MPL was not distributed with this + file, You can obtain one at http://mozilla.org/MPL/2.0/. + + See the COPYRIGHT file distributed with this work for additional + information regarding copyright ownership. + +:orphan: + +.. include:: ../../bin/confgen/tsig-keygen.rst diff --git a/doc/man/dnssec-importkey.1in b/doc/man/dnssec-importkey.1in index 174c25c2a3..619e5edade 100644 --- a/doc/man/dnssec-importkey.1in +++ b/doc/man/dnssec-importkey.1in @@ -39,7 +39,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]] .sp \fBdnssec\-importkey\fP reads a public DNSKEY record and generates a pair of .key/.private files. The DNSKEY record may be read from an existing -\&.key file, in which case a corresponding .private file is +.key file, in which case a corresponding .private file is generated, or it may be read from any other file or from the standard input, in which case both .key and .private files are generated. .sp diff --git a/doc/man/named.conf.5in b/doc/man/named.conf.5in index f8feea55aa..0e77255d9b 100644 --- a/doc/man/named.conf.5in +++ b/doc/man/named.conf.5in @@ -1120,7 +1120,7 @@ zone string [ class ] { \fB/etc/named.conf\fP .SH SEE ALSO .sp -\fBtsig\-keygen(8)\fP, \fBnamed(8)\fP, \fBnamed\-checkconf(8)\fP, \fBrndc(8)\fP, \fBrndc\-confgen(8)\fP, BIND 9 Administrator Reference Manual. +\fBnamed(8)\fP, \fBnamed\-checkconf(8)\fP, \fBrndc(8)\fP, \fBrndc\-confgen(8)\fP, \fBtsig\-keygen(8)\fP, BIND 9 Administrator Reference Manual. .SH AUTHOR Internet Systems Consortium .SH COPYRIGHT diff --git a/doc/man/nsupdate.1in b/doc/man/nsupdate.1in index 3e53a1b351..02984590a3 100644 --- a/doc/man/nsupdate.1in +++ b/doc/man/nsupdate.1in @@ -364,7 +364,7 @@ Base\-64 encoding of the HMAC\-MD5 key created by \fBdnssec\-keygen\fP\&. .SH SEE ALSO .sp \fI\%RFC 2136\fP, \fI\%RFC 3007\fP, \fI\%RFC 2104\fP, \fI\%RFC 2845\fP, \fI\%RFC 1034\fP, \fI\%RFC 2535\fP, \fI\%RFC 2931\fP, -\fBnamed(8)\fP, \fBtsig\-keygen(8)\fP, \fBdnssec\-keygen(8)\fP\&. +\fBnamed(8)\fP, \fBdnssec\-keygen(8)\fP, \fBtsig\-keygen(8)\fP\&. .SH BUGS .sp The TSIG key is redundantly stored in two separate files. This is a diff --git a/doc/man/tsig-keygen.8in b/doc/man/tsig-keygen.8in index cd19148de5..4023cf146d 100644 --- a/doc/man/tsig-keygen.8in +++ b/doc/man/tsig-keygen.8in @@ -30,6 +30,77 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]] .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]] .in \\n[rst2man-indent\\n[rst2man-indent-level]]u .. +.SH SYNOPSIS +.sp +\fBtsig\-keygen\fP [\fB\-a\fP algorithm] [\fB\-h\fP] [\fB\-r\fP randomfile] [\fB\-s\fP name] +.sp +\fBddns\-confgen\fP [\fB\-a\fP algorithm] [\fB\-h\fP] [\fB\-k\fP keyname] [\fB\-q\fP] [\fB\-r\fP randomfile] [\fB\-s\fP name] [\fB\-z\fP zone] +.SH DESCRIPTION +.sp +\fBtsig\-keygen\fP and \fBddns\-confgen\fP are invocation methods for a +utility that generates keys for use in TSIG signing. The resulting keys +can be used, for example, to secure dynamic DNS updates to a zone, or for +the \fBrndc\fP command channel. +.sp +When run as \fBtsig\-keygen\fP, a domain name can be specified on the +command line to be used as the name of the generated key. If no +name is specified, the default is \fBtsig\-key\fP\&. +.sp +When run as \fBddns\-confgen\fP, the key name can specified using \fB\-k\fP +parameter and defaults to \fBddns\-key\fP\&. The generated key is accompanied +by configuration text and instructions that can be used with \fBnsupdate\fP +and \fBnamed\fP when setting up dynamic DNS, including an example +\fBupdate\-policy\fP statement. (This usage is similar to the \fBrndc\-confgen\fP +command for setting up command\-channel security.) +.sp +Note that \fBnamed\fP itself can configure a local DDNS key for use with +\fBnsupdate \-l\fP; it does this when a zone is configured with +\fBupdate\-policy local;\fP\&. \fBddns\-confgen\fP is only needed when a more +elaborate configuration is required: for instance, if \fBnsupdate\fP is to +be used from a remote system. +.SH OPTIONS +.INDENT 0.0 +.TP +.B \fB\-a algorithm\fP +This option specifies the algorithm to use for the TSIG key. Available +choices are: hmac\-md5, hmac\-sha1, hmac\-sha224, hmac\-sha256, hmac\-sha384, +and hmac\-sha512. The default is hmac\-sha256. Options are +case\-insensitive, and the "hmac\-" prefix may be omitted. +.TP +.B \fB\-h\fP +This option prints a short summary of options and arguments. +.TP +.B \fB\-k keyname\fP +This option specifies the key name of the DDNS authentication key. The +default is \fBddns\-key\fP when neither the \fB\-s\fP nor \fB\-z\fP option is +specified; otherwise, the default is \fBddns\-key\fP as a separate label +followed by the argument of the option, e.g., \fBddns\-key.example.com.\fP +The key name must have the format of a valid domain name, consisting of +letters, digits, hyphens, and periods. +.TP +.B \fB\-q\fP (\fBddns\-confgen\fP only) +This option enables quiet mode, which prints only the key, with no +explanatory text or usage examples. This is essentially identical to +\fBtsig\-keygen\fP\&. +.TP +.B \fB\-s name\fP (\fBddns\-confgen\fP only) +This option generates a configuration example to allow dynamic updates +of a single hostname. The example \fBnamed.conf\fP text shows how to set +an update policy for the specified name using the "name" nametype. The +default key name is \fBddns\-key.name\fP\&. Note that the "self" nametype +cannot be used, since the name to be updated may differ from the key +name. This option cannot be used with the \fB\-z\fP option. +.TP +.B \fB\-z zone\fP (\fBddns\-confgen\fP only) +This option generates a configuration example to allow +dynamic updates of a zone. The example \fBnamed.conf\fP text shows how +to set an update policy for the specified zone using the "zonesub" +nametype, allowing updates to all subdomain names within that zone. +This option cannot be used with the \fB\-s\fP option. +.UNINDENT +.SH SEE ALSO +.sp +\fBnsupdate(1)\fP, \fBnamed.conf(5)\fP, \fBnamed(8)\fP, BIND 9 Administrator Reference Manual. .SH AUTHOR Internet Systems Consortium .SH COPYRIGHT diff --git a/doc/man/tsig-keygen.rst b/doc/man/tsig-keygen.rst index 751a7c83da..a1e41cceea 100644 --- a/doc/man/tsig-keygen.rst +++ b/doc/man/tsig-keygen.rst @@ -10,4 +10,4 @@ :orphan: -.. include:: ../../bin/confgen/ddns-confgen.rst \ No newline at end of file +.. include:: ../../bin/confgen/tsig-keygen.rst diff --git a/util/copyrights b/util/copyrights index 135b8f835a..557b9b33fd 100644 --- a/util/copyrights +++ b/util/copyrights @@ -1174,6 +1174,7 @@ ./doc/doxygen/mainpage X 2006,2018,2019,2020 ./doc/man/arpaname.rst RST 2020 ./doc/man/conf.py PYTHON 2020 +./doc/man/ddns-confgen.rst RST 2020 ./doc/man/delv.rst RST 2020 ./doc/man/dig.rst RST 2020 ./doc/man/dnssec-cds.rst RST 2020