diff --git a/CHANGES b/CHANGES index 612ac40df5..0fe450c0d2 100644 --- a/CHANGES +++ b/CHANGES @@ -1,8 +1,8 @@ + --- 9.7.0b1 released --- + 2713. [bug] powerpc: atomic operations missing asm("ics") / __isync() calls. - --- 9.7.0b1 released --- - 2712. [func] New 'auto-dnssec' zone option allows zone signing to be fully automated in zones configured for dynamic DNS. 'auto-dnssec allow;' permits a zone diff --git a/bin/named/bind.keys.h b/bin/named/bind.keys.h index 1c8a4aba11..58a94f2011 100644 --- a/bin/named/bind.keys.h +++ b/bin/named/bind.keys.h @@ -1,6 +1,6 @@ #define TRUSTED_KEYS "\ trusted-keys {\n\ - # NOTE: This key is current as of September 2009.\n\ + # NOTE: This key is current as of October 2009.\n\ # If it fails to initialize correctly, it may have expired;\n\ # see https://www.isc.org/solutions/dlv for a replacement.\n\ dlv.isc.org. 257 3 5 \"BEAAAAPHMu/5onzrEE7z1egmhg/WPO0+juoZrW3euWEn4MxDCE1+lLy2 brhQv5rN32RKtMzX6Mj70jdzeND4XknW58dnJNPCxn8+jAGl2FZLK8t+ 1uq4W+nnA3qO2+DL+k6BD4mewMLbIYFwe0PG73Te9fZ2kJb56dhgMde5 ymX4BI/oQ+cAK50/xvJv00Frf8kw6ucMTwFlgPe+jnGxPPEmHAte/URk Y62ZfkLoBAADLHQ9IrS2tryAe7mbBZVcOwIeU/Rw/mRx/vwwMCTgNboM QKtUdvNXDrYJDSHZws3xiRXF1Rf+al9UmZfSav/4NWLKjHzpT59k/VSt TDN0YUuWrBNh\";\n\ @@ -9,7 +9,7 @@ trusted-keys {\n\ #define MANAGED_KEYS "\ managed-keys {\n\ - # NOTE: This key is current as of September 2009.\n\ + # NOTE: This key is current as of October 2009.\n\ # If it fails to initialize correctly, it may have expired;\n\ # see https://www.isc.org/solutions/dlv for a replacement.\n\ dlv.isc.org. initial-key 257 3 5 \"BEAAAAPHMu/5onzrEE7z1egmhg/WPO0+juoZrW3euWEn4MxDCE1+lLy2 brhQv5rN32RKtMzX6Mj70jdzeND4XknW58dnJNPCxn8+jAGl2FZLK8t+ 1uq4W+nnA3qO2+DL+k6BD4mewMLbIYFwe0PG73Te9fZ2kJb56dhgMde5 ymX4BI/oQ+cAK50/xvJv00Frf8kw6ucMTwFlgPe+jnGxPPEmHAte/URk Y62ZfkLoBAADLHQ9IrS2tryAe7mbBZVcOwIeU/Rw/mRx/vwwMCTgNboM QKtUdvNXDrYJDSHZws3xiRXF1Rf+al9UmZfSav/4NWLKjHzpT59k/VSt TDN0YUuWrBNh\";\n\ diff --git a/bin/named/named.conf.docbook b/bin/named/named.conf.docbook index a570654e15..c81cab9838 100644 --- a/bin/named/named.conf.docbook +++ b/bin/named/named.conf.docbook @@ -17,7 +17,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> - + Aug 13, 2004 @@ -132,6 +132,15 @@ trusted-keys { + + MANAGED-KEYS + +managed-keys { + domain_name initial-key flags protocol algorithm key; ... +}; + + + CONTROLS @@ -273,6 +282,7 @@ options { dnssec-enable boolean; dnssec-validation boolean; dnssec-lookaside string trust-anchor string; + dnssec-lookaside ( auto | domain trust-anchor domain ); dnssec-must-be-secure string boolean; dnssec-accept-expired boolean; @@ -339,10 +349,17 @@ options { zone-statistics boolean; key-directory quoted_string; + auto-dnssec allow|maintain|create|off; try-tcp-refresh boolean; zero-no-soa-ttl boolean; zero-no-soa-ttl-cache boolean; secure-to-insecure boolean; + deny-answer-addresses { + address_match_list + } except-from { namelist } ; + deny-answer-aliases { + namelist + } except-from { namelist } ; nsec3-test-zone boolean; // testing only @@ -384,7 +401,8 @@ view string optional_class }; trusted-keys { - string integer integer integer quoted_string; ... + string integer integer integer quoted_string; + ... }; allow-recursion { address_match_element; ... }; @@ -545,13 +563,14 @@ zone string optional_class allow-transfer { address_match_element; ... }; allow-update { address_match_element; ... }; allow-update-forwarding { address_match_element; ... }; - update-policy { + update-policy local | { ( grant | deny ) string ( name | subdomain | wildcard | self | selfsub | selfwild | krb5-self | ms-self | krb5-subdomain | ms-subdomain | - tcp-self | 6to4-self ) string - rrtypelist; ... - }; + tcp-self | zonesub | 6to4-self ) string + rrtypelist; + ... + }; update-check-ksk boolean; dnskey-ksk-only boolean; diff --git a/bin/nsupdate/nsupdate.docbook b/bin/nsupdate/nsupdate.docbook index ab234b498b..31afb2811d 100644 --- a/bin/nsupdate/nsupdate.docbook +++ b/bin/nsupdate/nsupdate.docbook @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> - + Aug 25, 2009 @@ -76,7 +76,7 @@ DESCRIPTION nsupdate - is used to submit Dynamic DNS Update requests as defined in RFC2136 + is used to submit Dynamic DNS Update requests as defined in RFC 2136 to a name server. This allows resource records to be added or removed from a zone without manually editing the zone file. @@ -118,8 +118,8 @@ Transaction signatures can be used to authenticate the Dynamic DNS updates. These use the TSIG resource record type described - in RFC2845 or the SIG(0) record described in RFC3535 and - RFC2931 or GSS-TSIG as described in RFC3645. TSIG relies on + in RFC 2845 or the SIG(0) record described in RFC 2535 and + RFC 2931 or GSS-TSIG as described in RFC 3645. TSIG relies on a shared secret that should only be known to nsupdate and the name server. Currently, the only supported encryption algorithm for TSIG is HMAC-MD5, @@ -136,7 +136,12 @@ record in a zone served by the name server. nsupdate does not read /etc/named.conf. - GSS-TSIG uses Kerberos credentials. + + + GSS-TSIG uses Kerberos credentials. Standard GSS-TSIG mode + is switched on with the flag. A + non-standards-compliant variant of GSS-TSIG used by Windows + 2000 can be switched on with the flag. nsupdate uses the or option @@ -629,9 +634,9 @@ If there are, the update request fails. If this name does not exist, a CNAME for it is added. This ensures that when the CNAME is added, it cannot conflict with the - long-standing rule in RFC1034 that a name must not exist as any other + long-standing rule in RFC 1034 that a name must not exist as any other record type if it exists as a CNAME. - (The rule has been updated for DNSSEC in RFC2535 to allow CNAMEs to have + (The rule has been updated for DNSSEC in RFC 2535 to allow CNAMEs to have RRSIG, DNSKEY and NSEC records.) @@ -687,27 +692,14 @@ SEE ALSO - - RFC2136 - , - - RFC3007 - , - - RFC2104 - , - - RFC2845 - , - - RFC1034 - , - - RFC2535 - , - - RFC2931 - , + + RFC 2136, + RFC 3007, + RFC 2104, + RFC 2845, + RFC 1034, + RFC 2535, + RFC 2931, named8 , @@ -718,8 +710,8 @@ dnssec-keygen8 . - + BUGS diff --git a/bind.keys b/bind.keys index 511dff4f01..1b5cab17f5 100644 --- a/bind.keys +++ b/bind.keys @@ -1,5 +1,5 @@ managed-keys { - # NOTE: This key is current as of September 2009. + # NOTE: This key is current as of October 2009. # If it fails to initialize correctly, it may have expired; # see https://www.isc.org/solutions/dlv for a replacement. dlv.isc.org. initial-key 257 3 5 "BEAAAAPHMu/5onzrEE7z1egmhg/WPO0+juoZrW3euWEn4MxDCE1+lLy2 brhQv5rN32RKtMzX6Mj70jdzeND4XknW58dnJNPCxn8+jAGl2FZLK8t+ 1uq4W+nnA3qO2+DL+k6BD4mewMLbIYFwe0PG73Te9fZ2kJb56dhgMde5 ymX4BI/oQ+cAK50/xvJv00Frf8kw6ucMTwFlgPe+jnGxPPEmHAte/URk Y62ZfkLoBAADLHQ9IrS2tryAe7mbBZVcOwIeU/Rw/mRx/vwwMCTgNboM QKtUdvNXDrYJDSHZws3xiRXF1Rf+al9UmZfSav/4NWLKjHzpT59k/VSt TDN0YUuWrBNh"; diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml index f12dd94c4f..c92446a270 100644 --- a/doc/arm/Bv9ARM-book.xml +++ b/doc/arm/Bv9ARM-book.xml @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> - + BIND 9 Administrator Reference Manual @@ -5509,24 +5509,42 @@ options { validator with an alternate method to validate DNSKEY records at the top of a zone. When a DNSKEY is at or below a domain specified by the deepest - dnssec-lookaside, and the normal dnssec + dnssec-lookaside, and the normal DNSSEC validation has left the key untrusted, the trust-anchor - will be append to the key name and a DLV record will be + will be appended to the key name and a DLV record will be looked up to see if it can validate the key. If the DLV - record validates a DNSKEY (similarly to the way a DS record - does) the DNSKEY RRset is deemed to be trusted. + record validates a DNSKEY (similarly to the way a DS + record does) the DNSKEY RRset is deemed to be trusted. If dnssec-lookaside is set to auto, then built-in default - values for the domain and trust anchor will be + values for the DLV domain and trust anchor will be used, along with a built-in key for validation. - - NOTE: Since the built-in key may expire, it can be - overridden without recompiling named - by placing a new key in the file - bind.keys. + + The default DLV key is stored in the file + bind.keys, which + named loads at startup if + dnssec-lookaside is set to + auto. A copy of that file is + installed along with BIND 9, and is + current as of the release date. If the DLV key expires, a + new copy of bind.keys can be downloaded + from https://www.isc.org/solutions/dlv. + + + (To prevent problems if bind.keys is + not found, the current key is also compiled in to + named. Relying on this is not + recommended, however, as it requires named + to be recompiled with a new key when the DLV key expires.) + + + NOTE: Using bind.keys to store + locally-configured keys is possible, but not + recommended, as the file will be overwritten whenever + BIND 9 is re-installed or upgraded. diff --git a/lib/dns/dnssec.c b/lib/dns/dnssec.c index 1b52ba32ea..d55d3ec378 100644 --- a/lib/dns/dnssec.c +++ b/lib/dns/dnssec.c @@ -16,7 +16,7 @@ */ /* - * $Id: dnssec.c,v 1.104 2009/10/12 23:48:01 tbox Exp $ + * $Id: dnssec.c,v 1.105 2009/10/16 02:59:41 each Exp $ */ /*! \file */ @@ -1256,15 +1256,15 @@ dns_dnssec_keylistfromrdataset(dns_name_t *origin, if (!is_zone_key(pubkey) || (dst_key_flags(pubkey) & DNS_KEYTYPE_NOAUTH) != 0) - continue; + goto again; /* Corrupted .key file? */ if (!dns_name_equal(origin, dst_key_name(pubkey))) - continue; + goto again; if (public) { addkey(keylist, &pubkey, savekeys, mctx); - continue; + goto again; } result = dst_key_fromfile(dst_key_name(pubkey), @@ -1274,20 +1274,20 @@ dns_dnssec_keylistfromrdataset(dns_name_t *origin, directory, mctx, &privkey); if (result == ISC_R_FILENOTFOUND) { addkey(keylist, &pubkey, savekeys, mctx); - continue; + goto again; } RETERR(result); - if ((dst_key_flags(privkey) & DNS_KEYTYPE_NOAUTH) != 0) { - /* We should never get here. */ - dst_key_free(&pubkey); - dst_key_free(&privkey); - continue; - } + /* This should never happen. */ + if ((dst_key_flags(privkey) & DNS_KEYTYPE_NOAUTH) != 0) + goto again; addkey(keylist, &privkey, savekeys, mctx); - - dst_key_free(&pubkey); + again: + if (pubkey != NULL) + dst_key_free(&pubkey); + if (privkey != NULL) + dst_key_free(&privkey); } if (result == ISC_R_NOMORE) result = ISC_R_SUCCESS;