From 91cdb031b82ef8fe347078e97cba528ae41fc218 Mon Sep 17 00:00:00 2001 From: Tinderbox User Date: Thu, 3 Nov 2016 01:16:35 +0000 Subject: [PATCH] regen v9_10 --- bin/named/named.conf.5 | 3 + bin/named/named.conf.html | 3 + doc/arm/Bv9ARM.ch06.html | 11 +++ doc/arm/Bv9ARM.ch09.html | 7 ++ doc/arm/man.named.conf.html | 3 + doc/arm/notes.html | 7 ++ doc/misc/options | 149 +++++++++++++++++++++--------------- 7 files changed, 121 insertions(+), 62 deletions(-) diff --git a/bin/named/named.conf.5 b/bin/named/named.conf.5 index 78b0700261..b5c4d0db27 100644 --- a/bin/named/named.conf.5 +++ b/bin/named/named.conf.5 @@ -351,6 +351,7 @@ options { ( \fIipv4_address\fR | \fIipv6_address\fR ) [ port \fIinteger\fR ]; \&.\&.\&. }; max\-journal\-size \fIsize_no_default\fR; + max\-records \fIinteger\fR; max\-transfer\-time\-in \fIinteger\fR; max\-transfer\-time\-out \fIinteger\fR; max\-transfer\-idle\-in \fIinteger\fR; @@ -532,6 +533,7 @@ view \fIstring\fR \fIoptional_class\fR { ( \fIipv4_address\fR | \fIipv6_address\fR ) [ port \fIinteger\fR ]; \&.\&.\&. }; max\-journal\-size \fIsize_no_default\fR; + max\-records \fIinteger\fR; max\-transfer\-time\-in \fIinteger\fR; max\-transfer\-time\-out \fIinteger\fR; max\-transfer\-idle\-in \fIinteger\fR; @@ -623,6 +625,7 @@ zone \fIstring\fR \fIoptional_class\fR { ( \fIipv4_address\fR | \fIipv6_address\fR ) [ port \fIinteger\fR ]; \&.\&.\&. }; max\-journal\-size \fIsize_no_default\fR; + max\-records \fIinteger\fR; max\-transfer\-time\-in \fIinteger\fR; max\-transfer\-time\-out \fIinteger\fR; max\-transfer\-idle\-in \fIinteger\fR; diff --git a/bin/named/named.conf.html b/bin/named/named.conf.html index 9981084d09..fc0dbf7dcc 100644 --- a/bin/named/named.conf.html +++ b/bin/named/named.conf.html @@ -302,6 +302,7 @@ options };

max-journal-size size_no_default;
+ max-records integer;
max-transfer-time-in integer;
max-transfer-time-out integer;
max-transfer-idle-in integer;
@@ -498,6 +499,7 @@ view };

max-journal-size size_no_default;
+ max-records integer;
max-transfer-time-in integer;
max-transfer-time-out integer;
max-transfer-idle-in integer;
@@ -594,6 +596,7 @@ zone };

max-journal-size size_no_default;
+ max-records integer;
max-transfer-time-in integer;
max-transfer-time-out integer;
max-transfer-idle-in integer;
diff --git a/doc/arm/Bv9ARM.ch06.html b/doc/arm/Bv9ARM.ch06.html index 884b7e2844..27e4fcdcc8 100644 --- a/doc/arm/Bv9ARM.ch06.html +++ b/doc/arm/Bv9ARM.ch06.html @@ -2338,6 +2338,7 @@ badresp:1,adberr:0,findfail:0,valfail:0] [ use-queryport-pool yes_or_no; ] [ queryport-pool-ports number; ] [ queryport-pool-updateinterval number; ] + [ max-records number; ] [ max-transfer-time-in number; ] [ max-transfer-time-out number; ] [ max-transfer-idle-in number; ] @@ -5112,6 +5113,11 @@ avoid-v6-udp-ports { 40000; range 50000 60000; }; means 2 gigabytes. This may also be set on a per-zone basis.

+
max-records
+

+ The maximum number of records permitted in a zone. + The default is zero which means unlimited. +

host-statistics-max

In BIND 8, specifies the maximum number of host statistics @@ -8529,6 +8535,11 @@ zone zone_name [max-journal-size in the section called “Server Resource Limits”.

+
max-records
+

+ See the description of + max-records in the section called “Server Resource Limits”. +

max-transfer-time-in

See the description of diff --git a/doc/arm/Bv9ARM.ch09.html b/doc/arm/Bv9ARM.ch09.html index d8f714594b..8c841bc517 100644 --- a/doc/arm/Bv9ARM.ch09.html +++ b/doc/arm/Bv9ARM.ch09.html @@ -88,6 +88,13 @@

Security Fixes

    +

  • + Added the ability to specify the maximum number of records + permitted in a zone (max-records #;). This provides a mechanism + to block overly large zone transfers, which is a potential risk + with slave zones from other parties, as described in CVE-2016-6170. + [RT #42143] +

  • It was possible to trigger a assertion when rendering a message using a specially crafted request. This flaw is diff --git a/doc/arm/man.named.conf.html b/doc/arm/man.named.conf.html index f796c19e4c..832f42721c 100644 --- a/doc/arm/man.named.conf.html +++ b/doc/arm/man.named.conf.html @@ -321,6 +321,7 @@ options };

    max-journal-size size_no_default;
    + max-records integer;
    max-transfer-time-in integer;
    max-transfer-time-out integer;
    max-transfer-idle-in integer;
    @@ -517,6 +518,7 @@ view };

    max-journal-size size_no_default;
    + max-records integer;
    max-transfer-time-in integer;
    max-transfer-time-out integer;
    max-transfer-idle-in integer;
    @@ -613,6 +615,7 @@ zone };

    max-journal-size size_no_default;
    + max-records integer;
    max-transfer-time-in integer;
    max-transfer-time-out integer;
    max-transfer-idle-in integer;
    diff --git a/doc/arm/notes.html b/doc/arm/notes.html index c4a5b5e993..cdac8bc46d 100644 --- a/doc/arm/notes.html +++ b/doc/arm/notes.html @@ -48,6 +48,13 @@

    Security Fixes

      +

    • + Added the ability to specify the maximum number of records + permitted in a zone (max-records #;). This provides a mechanism + to block overly large zone transfers, which is a potential risk + with slave zones from other parties, as described in CVE-2016-6170. + [RT #42143] +

    • It was possible to trigger a assertion when rendering a message using a specially crafted request. This flaw is diff --git a/doc/misc/options b/doc/misc/options index 22ebacd0c1..f001eebdf0 100644 --- a/doc/misc/options +++ b/doc/misc/options @@ -2,28 +2,30 @@ This is a summary of the named.conf options supported by this version of BIND 9. -acl { ; ... }; +acl { ; ... }; // may occur multiple times controls { - inet ( | | * ) [ port ( | * - ) ] allow { ; ... } [ keys { ; - ... } ]; - unix perm owner group - [ keys { ; ... } ]; -}; + inet ( | | + * ) [ port ( | * ) ] allow + { ; ... } [ + keys { ; ... } ]; // may occur multiple times + unix perm + owner group [ + keys { ; ... } ]; // may occur multiple times +}; // may occur multiple times dlz { database ; search ; -}; +}; // may occur multiple times key { algorithm ; secret ; -}; +}; // may occur multiple times logging { - category { ; ... }; + category { ; ... }; // may occur multiple times channel { file [ versions ( "unlimited" | ) ] [ size ]; @@ -34,7 +36,7 @@ logging { severity ; stderr; syslog [ ]; - }; + }; // may occur multiple times }; lwres { @@ -43,14 +45,15 @@ lwres { ndots ; search { ; ... }; view [ ]; -}; +}; // may occur multiple times -managed-keys { - ; ... }; +managed-keys { + ; ... }; // may occur multiple times -masters [ port ] [ dscp ] { ( | - [ port ] | [ port ] ) - [ key ]; ... }; +masters [ port ] [ dscp + ] { ( | [ + port ] | [ port + ] ) [ key ]; ... }; // may occur multiple times options { acache-cleaning-interval ; @@ -89,7 +92,8 @@ options { check-integrity ; check-mx ( fail | warn | ignore ); check-mx-cname ( fail | warn | ignore ); - check-names ( master | slave | response ) ( fail | warn | ignore ); + check-names ( master | slave | response + ) ( fail | warn | ignore ); // may occur multiple times check-sibling ; check-spf ( warn | ignore ); check-srv-cname ( fail | warn | ignore ); @@ -105,9 +109,11 @@ options { ; ... } ]; dialup ( notify | notify-passive | refresh | passive | ); directory ; - disable-algorithms { ; ... }; - disable-ds-digests { ; ... }; - disable-empty-zone ; + disable-algorithms { ; + ... }; // may occur multiple times + disable-ds-digests { ; + ... }; // may occur multiple times + disable-empty-zone ; // may occur multiple times dns64 { break-dnssec ; clients { ; ... }; @@ -115,15 +121,16 @@ options { mapped { ; ... }; recursive-only ; suffix ; - }; + }; // may occur multiple times dns64-contact ; dns64-server ; dnssec-accept-expired ; dnssec-dnskey-kskonly ; dnssec-enable ; dnssec-loadkeys-interval ; - dnssec-lookaside ( trust-anchor | auto | no ); - dnssec-must-be-secure ; + dnssec-lookaside ( trust-anchor + | auto | no ); // may occur multiple times + dnssec-must-be-secure ; // may occur multiple times dnssec-secure-to-insecure ; dnssec-update-mode ( maintain | no-resign ); dnssec-validation ( yes | no | auto ); @@ -162,10 +169,12 @@ options { ixfr-from-differences ( master | slave | ); key-directory ; lame-ttl ; - listen-on [ port ] [ dscp ] { - ; ... }; - listen-on-v6 [ port ] [ dscp ] { - ; ... }; + listen-on [ port ] [ dscp + ] { + ; ... }; // may occur multiple times + listen-on-v6 [ port ] [ dscp + ] { + ; ... }; // may occur multiple times maintain-ixfr-base ; // obsolete managed-keys-directory ; masterfile-format ( text | raw | map ); @@ -177,6 +186,7 @@ options { max-ixfr-log-size ( unlimited | default | ); // obsolete max-journal-size ; max-ncache-ttl ; + max-records ; max-recursion-depth ; max-recursion-queries ; max-refresh-time ; @@ -198,7 +208,7 @@ options { multiple-cnames ; // obsolete named-xfer ; // obsolete no-case-compress { ; ... }; - nosit-udp-size ; // not configured + nosit-udp-size ; // not configured, experimental notify ( explicit | master-only | ); notify-delay ; notify-source ( | * ) [ port ( | * ) ] [ @@ -240,7 +250,7 @@ options { recursive-clients ; request-ixfr ; request-nsid ; - request-sit ; // not configured + request-sit ; // not configured, experimental reserved-sockets ; resolver-query-timeout ; response-policy { zone [ policy ( given | disabled @@ -265,7 +275,7 @@ options { sig-signing-signatures ; sig-signing-type ; sig-validity-interval [ ]; - sit-secret ; // not configured + sit-secret ; // not configured, experimental sortlist { ; ... }; stacksize ( unlimited | default | ); statistics-file ; @@ -287,7 +297,7 @@ options { transfers-out ; transfers-per-ns ; treat-cr-as-space ; // obsolete - trust-anchor-telemetry ; + trust-anchor-telemetry ; // experimental try-tcp-refresh ; update-check-ksk ; use-alt-transfer-source ; @@ -317,7 +327,7 @@ server { query-source-v6 ; request-ixfr ; request-nsid ; - request-sit ; // not configured + request-sit ; // not configured, experimental support-ixfr ; // obsolete tcp-only ; transfer-format ( many-answers | one-answer ); @@ -326,14 +336,17 @@ server { transfer-source-v6 ( | * ) [ port ( | * ) ] [ dscp ]; transfers ; -}; +}; // may occur multiple times statistics-channels { - inet ( | | * ) [ port ( | * - ) ] [ allow { ; ... } ]; -}; + inet ( | | + * ) [ port ( | * ) ] [ + allow { ; ... + } ]; // may occur multiple times +}; // may occur multiple times -trusted-keys { ; ... }; +trusted-keys { + ; ... }; // may occur multiple times view [ ] { acache-cleaning-interval ; @@ -367,7 +380,8 @@ view [ ] { check-integrity ; check-mx ( fail | warn | ignore ); check-mx-cname ( fail | warn | ignore ); - check-names ( master | slave | response ) ( fail | warn | ignore ); + check-names ( master | slave | response + ) ( fail | warn | ignore ); // may occur multiple times check-sibling ; check-spf ( warn | ignore ); check-srv-cname ( fail | warn | ignore ); @@ -379,13 +393,15 @@ view [ ] { deny-answer-aliases { ; ... } [ except-from { ; ... } ]; dialup ( notify | notify-passive | refresh | passive | ); - disable-algorithms { ; ... }; - disable-ds-digests { ; ... }; - disable-empty-zone ; + disable-algorithms { ; + ... }; // may occur multiple times + disable-ds-digests { ; + ... }; // may occur multiple times + disable-empty-zone ; // may occur multiple times dlz { database ; search ; - }; + }; // may occur multiple times dns64 { break-dnssec ; clients { ; ... }; @@ -393,15 +409,16 @@ view [ ] { mapped { ; ... }; recursive-only ; suffix ; - }; + }; // may occur multiple times dns64-contact ; dns64-server ; dnssec-accept-expired ; dnssec-dnskey-kskonly ; dnssec-enable ; dnssec-loadkeys-interval ; - dnssec-lookaside ( trust-anchor | auto | no ); - dnssec-must-be-secure ; + dnssec-lookaside ( trust-anchor + | auto | no ); // may occur multiple times + dnssec-must-be-secure ; // may occur multiple times dnssec-secure-to-insecure ; dnssec-update-mode ( maintain | no-resign ); dnssec-validation ( yes | no | auto ); @@ -429,12 +446,13 @@ view [ ] { key { algorithm ; secret ; - }; + }; // may occur multiple times key-directory ; lame-ttl ; maintain-ixfr-base ; // obsolete - managed-keys { - ; ... }; + managed-keys { + + ; ... }; // may occur multiple times masterfile-format ( text | raw | map ); match-clients { ; ... }; match-destinations { ; ... }; @@ -446,6 +464,7 @@ view [ ] { max-ixfr-log-size ( unlimited | default | ); // obsolete max-journal-size ; max-ncache-ttl ; + max-records ; max-recursion-depth ; max-recursion-queries ; max-refresh-time ; @@ -462,7 +481,7 @@ view [ ] { minimal-responses ; multi-master ; no-case-compress { ; ... }; - nosit-udp-size ; // not configured + nosit-udp-size ; // not configured, experimental notify ( explicit | master-only | ); notify-delay ; notify-source ( | * ) [ port ( | * ) ] [ @@ -498,7 +517,7 @@ view [ ] { recursion ; request-ixfr ; request-nsid ; - request-sit ; // not configured + request-sit ; // not configured, experimental resolver-query-timeout ; response-policy { zone [ policy ( given | disabled | passthru | no-op | drop | tcp-only | nxdomain | nodata | @@ -526,7 +545,7 @@ view [ ] { query-source-v6 ; request-ixfr ; request-nsid ; - request-sit ; // not configured + request-sit ; // not configured, experimental support-ixfr ; // obsolete tcp-only ; transfer-format ( many-answers | one-answer ); @@ -535,7 +554,7 @@ view [ ] { transfer-source-v6 ( | * ) [ port ( | * ) ] [ dscp ]; transfers ; - }; + }; // may occur multiple times sig-signing-nodes ; sig-signing-signatures ; sig-signing-type ; @@ -548,9 +567,10 @@ view [ ] { dscp ]; transfer-source-v6 ( | * ) [ port ( | * ) ] [ dscp ]; - trust-anchor-telemetry ; - trusted-keys { - ; ... }; + trust-anchor-telemetry ; // experimental + trusted-keys { + ; + ... }; // may occur multiple times try-tcp-refresh ; update-check-ksk ; use-alt-transfer-source ; @@ -611,6 +631,7 @@ view [ ] { max-ixfr-log-size ( unlimited | default | ); // obsolete max-journal-size ; + max-records ; max-refresh-time ; max-retry-time ; max-transfer-idle-in ; @@ -629,8 +650,10 @@ view [ ] { | * ) ] [ dscp ]; notify-to-soa ; nsec3-test-zone ; // test only - pubkey - ; // obsolete + pubkey + + + ; // obsolete, may occur multiple times request-ixfr ; serial-update-method ( increment | unixtime ); server-addresses { ( | ) [ @@ -656,9 +679,9 @@ view [ ] { use-alt-transfer-source ; zero-no-soa-ttl ; zone-statistics ( full | terse | none | ); - }; + }; // may occur multiple times zone-statistics ( full | terse | none | ); -}; +}; // may occur multiple times zone [ ] { allow-notify { ; ... }; @@ -710,6 +733,7 @@ zone [ ] { ] ) [ key ]; ... }; max-ixfr-log-size ( unlimited | default | ); // obsolete max-journal-size ; + max-records ; max-refresh-time ; max-retry-time ; max-transfer-idle-in ; @@ -728,7 +752,8 @@ zone [ ] { [ dscp ]; notify-to-soa ; nsec3-test-zone ; // test only - pubkey ; // obsolete + pubkey + ; // obsolete, may occur multiple times request-ixfr ; serial-update-method ( increment | unixtime ); server-addresses { ( | ) [ port @@ -753,5 +778,5 @@ zone [ ] { use-alt-transfer-source ; zero-no-soa-ttl ; zone-statistics ( full | terse | none | ); -}; +}; // may occur multiple times