Compare commits
1
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Matthijs Mekking
|
a16276abce |
@@ -11,7 +11,6 @@ BraceWrapping:
|
||||
AfterFunction: false # should also be MultiLine, but not yet supported
|
||||
AfterExternBlock: false
|
||||
BeforeElse: false
|
||||
BeforeWhile: false
|
||||
IndentBraces: false
|
||||
SplitEmptyFunction: true
|
||||
AllowShortIfStatementsOnASingleLine: false
|
||||
@@ -20,7 +19,6 @@ AlwaysBreakAfterReturnType: All
|
||||
Cpp11BracedListStyle: false
|
||||
ColumnLimit: 80
|
||||
AlignAfterOpenBracket: Align
|
||||
AlignConsecutiveBitFields: true
|
||||
AlignConsecutiveDeclarations: false
|
||||
AlignConsecutiveMacros: true
|
||||
AlignTrailingComments: true
|
||||
@@ -64,7 +62,6 @@ IncludeCategories:
|
||||
Priority: 1
|
||||
- Regex: '.*'
|
||||
Priority: 0
|
||||
IndentExternBlock: NoIndent
|
||||
KeepEmptyLinesAtTheStartOfBlocks: false
|
||||
MaxEmptyLinesToKeep: 1
|
||||
PenaltyBreakAssignment: 30
|
||||
|
||||
@@ -11,7 +11,6 @@ BraceWrapping:
|
||||
AfterFunction: false # should also be MultiLine, but not yet supported
|
||||
AfterExternBlock: false
|
||||
BeforeElse: false
|
||||
BeforeWhile: false
|
||||
IndentBraces: false
|
||||
SplitEmptyFunction: true
|
||||
AllowShortIfStatementsOnASingleLine: false
|
||||
@@ -20,7 +19,6 @@ AlwaysBreakAfterReturnType: All
|
||||
Cpp11BracedListStyle: false
|
||||
ColumnLimit: 80
|
||||
AlignAfterOpenBracket: Align
|
||||
AlignConsecutiveBitFields: true
|
||||
AlignConsecutiveDeclarations: true
|
||||
AlignConsecutiveMacros: true
|
||||
AlignTrailingComments: true
|
||||
@@ -52,7 +50,6 @@ IncludeCategories:
|
||||
Priority: 1
|
||||
- Regex: '".*"'
|
||||
Priority: 9
|
||||
IndentExternBlock: NoIndent
|
||||
KeepEmptyLinesAtTheStartOfBlocks: false
|
||||
MaxEmptyLinesToKeep: 1
|
||||
PenaltyBreakAssignment: 30
|
||||
|
||||
@@ -106,9 +106,6 @@
|
||||
(list
|
||||
"--enable=all"
|
||||
"--suppress=missingIncludeSystem"
|
||||
"--suppress=nullPointerRedundantCheck"
|
||||
(concat "--suppressions-list=" (expand-file-name
|
||||
(concat directory-of-current-dir-locals-file "util/suppressions.txt")))
|
||||
(concat "-include=" (expand-file-name
|
||||
(concat directory-of-current-dir-locals-file "config.h")))
|
||||
)
|
||||
|
||||
@@ -1,8 +1,6 @@
|
||||
*.sln.in eol=crlf
|
||||
*.vcxproj.* eol=crlf
|
||||
|
||||
/fuzz/dns_rdata_fromwire_text.in/input-* -text
|
||||
|
||||
.gitignore export-ignore
|
||||
/conftools export-ignore
|
||||
/doc/design export-ignore
|
||||
|
||||
@@ -1,15 +0,0 @@
|
||||
name: 'Lock down mirror repository'
|
||||
|
||||
on:
|
||||
issues:
|
||||
types: opened
|
||||
pull_request:
|
||||
types: opened
|
||||
|
||||
jobs:
|
||||
lockdown:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: dessant/repo-lockdown@v2
|
||||
with:
|
||||
github-token: ${{ github.token }}
|
||||
+2
-33
@@ -39,6 +39,7 @@ __pycache__/
|
||||
/depcomp
|
||||
/install-sh
|
||||
/isc-config.sh
|
||||
/libltdl/*
|
||||
/libtool
|
||||
/ltmain.sh
|
||||
/m4/libtool.m4
|
||||
@@ -56,45 +57,13 @@ Makefile
|
||||
Makefile.in
|
||||
ans.run
|
||||
gen.dSYM/
|
||||
kyua.log
|
||||
named.memstats
|
||||
named.run
|
||||
timestamp
|
||||
/compile_commands.json
|
||||
# Gets generated by Build Ear (bear)
|
||||
/compile_commands.commands.json
|
||||
/cppcheck_html/
|
||||
/cppcheck.results
|
||||
/tsan
|
||||
/util/check-make-install
|
||||
/INSTALL
|
||||
doc/man/dnssec-cds.8in
|
||||
doc/man/dnssec-checkds.8in
|
||||
doc/man/dnssec-coverage.8in
|
||||
doc/man/dnssec-dsfromkey.8in
|
||||
doc/man/dnssec-importkey.8in
|
||||
doc/man/dnssec-keyfromlabel.8in
|
||||
doc/man/dnssec-keygen.8in
|
||||
doc/man/dnssec-keymgr.8in
|
||||
doc/man/dnssec-revoke.8in
|
||||
doc/man/dnssec-settime.8in
|
||||
doc/man/dnssec-signzone.8in
|
||||
doc/man/dnssec-verify.8in
|
||||
doc/man/named-checkconf.8in
|
||||
doc/man/named-checkzone.8in
|
||||
doc/man/named-journalprint.8in
|
||||
doc/man/named-nzd2nzf.8in
|
||||
doc/man/nsec3hash.8in
|
||||
doc/man/pkcs11-destroy.8in
|
||||
doc/man/pkcs11-keygen.8in
|
||||
doc/man/pkcs11-list.8in
|
||||
doc/man/pkcs11-tokens.8in
|
||||
# clangd index directory
|
||||
/\.cache/
|
||||
# GNU Global index files
|
||||
/GPATH
|
||||
/GRTAGS
|
||||
/GTAGS
|
||||
# Emacs specific files
|
||||
\.dir-locals-2.el
|
||||
/emacs.desktop
|
||||
/emacs.desktop-lock
|
||||
|
||||
+281
-475
File diff suppressed because it is too large
Load Diff
@@ -1,33 +0,0 @@
|
||||
<!--
|
||||
THIS ISSUE TEMPLATE IS INTENDED ONLY FOR INTERNAL USE.
|
||||
|
||||
If the bug you are reporting is potentially security-related - for example,
|
||||
if it involves an assertion failure or other crash in `named` that can be
|
||||
triggered repeatedly - then please do *NOT* report it here, but send an
|
||||
email to [security-officer@isc.org](security-officer@isc.org).
|
||||
-->
|
||||
|
||||
### CVE-specific actions
|
||||
|
||||
- [ ] Assign a CVE identifier
|
||||
- [ ] Determine CVSS score
|
||||
- [ ] Determine the range of BIND versions affected (including the Subscription Edition)
|
||||
- [ ] Determine whether workarounds for the problem exists
|
||||
- [ ] Create a draft of the security advisory and put the information above in there
|
||||
- [ ] Prepare a detailed description of the problem which should include the following by default:
|
||||
- instructions for reproducing the problem (a system test is good enough)
|
||||
- explanation of code flow which triggers the problem (a system test is *not* good enough)
|
||||
- [ ] Prepare a private merge request containing the following items in separate commits:
|
||||
- a test for the issue (may be moved to a separate merge request for deferred merging)
|
||||
- a fix for the issue
|
||||
- documentation updates (`CHANGES`, release notes, anything else applicable)
|
||||
- [ ] Ensure the merge request from the previous step is reviewed by SWENG staff and has no outstanding discussions
|
||||
- [ ] Ensure the documentation changes introduced by the merge request addressing the problem are reviewed by Support and Marketing staff
|
||||
- [ ] Prepare backports of the merge request addressing the problem for all affected (and still maintained) BIND branches (backporting might affect the issue's scope and/or description)
|
||||
- [ ] Prepare a standalone patch for the last stable release of each affected (and still maintained) BIND branch
|
||||
|
||||
### Release-specific actions
|
||||
|
||||
- [ ] Create/update the private issue containing links to fixes & reproducers for all CVEs fixed in a given release cycle
|
||||
- [ ] Reserve a block of `CHANGES` placeholders once the complete set of vulnerabilities fixed in a given release cycle is determined
|
||||
- [ ] Ensure the merge requests containing CVE fixes are merged into `security-*` branches in CVE identifier order
|
||||
@@ -6,26 +6,6 @@
|
||||
|
||||
**Public Release:**
|
||||
|
||||
## Documentation Review Links
|
||||
|
||||
**Closed issues assigned to the milestone without a release note:**
|
||||
|
||||
- []()
|
||||
- []()
|
||||
- []()
|
||||
|
||||
**Merge requests merged into the milestone without a release note:**
|
||||
|
||||
- []()
|
||||
- []()
|
||||
- []()
|
||||
|
||||
**Merge requests merged into the milestone without a `CHANGES` entry:**
|
||||
|
||||
- []()
|
||||
- []()
|
||||
- []()
|
||||
|
||||
## Release Checklist
|
||||
|
||||
### Before the Code Freeze
|
||||
@@ -41,17 +21,20 @@
|
||||
|
||||
- [ ] ***(QA)*** Look for outstanding documentation issues (e.g. `CHANGES` mistakes) and address them if any are found.
|
||||
- [ ] ***(QA)*** Ensure release notes are correct, ask Support and Marketing to check them as well.
|
||||
- [ ] ***(QA)*** Update API files for libraries with new version information.
|
||||
- [ ] ***(QA)*** Change software version and library versions in `configure.ac` (new major release only).
|
||||
- [ ] ***(QA)*** Rebuild `configure` using Autoconf on `docs.isc.org`.
|
||||
- [ ] ***(QA)*** Update `CHANGES`.
|
||||
- [ ] ***(QA)*** Update `CHANGES.SE` (Subscription Edition only).
|
||||
- [ ] ***(QA)*** Update `README.md`.
|
||||
- [ ] ***(QA)*** Update `version`.
|
||||
- [ ] ***(QA)*** Build documentation on `docs.isc.org`.
|
||||
- [ ] ***(Support)*** Check release notes, ask QA to correct any mistakes found.
|
||||
- [ ] ***(Marketing)*** Check release notes, ask QA to correct any mistakes found.
|
||||
- [ ] ***(SwEng)*** Update API files for libraries with new version information.
|
||||
- [ ] ***(SwEng)*** Change software version and library versions in `configure.ac` (new major release only).
|
||||
- [ ] ***(SwEng)*** Rebuild `configure` using Autoconf on `docs.isc.org`.
|
||||
- [ ] ***(SwEng)*** Update `CHANGES`.
|
||||
- [ ] ***(SwEng)*** Update `CHANGES.SE` (Subscription Edition only).
|
||||
- [ ] ***(SwEng)*** Update `README.md`.
|
||||
- [ ] ***(SwEng)*** Update `version`.
|
||||
- [ ] ***(SwEng)*** Build documentation on `docs.isc.org`.
|
||||
- [ ] ***(QA)*** Check that all the above steps were performed correctly.
|
||||
- [ ] ***(QA)*** Check that the formatting is correct for text, PDF, and HTML versions of release notes.
|
||||
- [ ] ***(QA)*** Check that the formatting of the generated man pages is correct.
|
||||
- [ ] ***(QA)*** Tag the releases in the private repository (`git tag -s -m "BIND 9.x.y" v9_x_y`).
|
||||
- [ ] ***(SwEng)*** Tag the releases[^2]. (Tags may only be pushed to the public repository for releases which are *not* security releases.)
|
||||
- [ ] ***(SwEng)*** If this is the first tag for a release (e.g. beta), create a release branch named `release_v9_X_Y` to allow development to continue on the maintenance branch whilst release engineering continues.
|
||||
|
||||
### Before the ASN Deadline (for ASN Releases) or the Public Release Date (for Regular Releases)
|
||||
|
||||
@@ -71,7 +54,6 @@
|
||||
- [ ] ***(Support)*** Publish links to downloads on ISC website.
|
||||
- [ ] ***(Support)*** Write release email to *bind-announce*.
|
||||
- [ ] ***(Support)*** Write email to *bind-users* (if a major release).
|
||||
- [ ] ***(Support)*** Send eligible customers updated links to the Subscription Edition (update the -S edition delivery tickets, even if those links were provided earlier via an ASN ticket).
|
||||
- [ ] ***(Support)*** Update tickets in case of waiting support customers.
|
||||
- [ ] ***(QA)*** Build and test any outstanding private packages.
|
||||
- [ ] ***(QA)*** Build public packages (`*.deb`, RPMs).
|
||||
@@ -81,13 +63,12 @@
|
||||
- [ ] ***(Marketing)*** Update [Wikipedia entry for BIND](https://en.wikipedia.org/wiki/BIND).
|
||||
- [ ] ***(Marketing)*** Write blog article (if a major release).
|
||||
- [ ] ***(QA)*** Ensure all new tags are annotated and signed.
|
||||
- [ ] ***(QA)*** Push tags for the published releases to the public repository.
|
||||
- [ ] ***(QA)*** Merge the automatically prepared `prep 9.x.y` commit which updates `version` and documentation on the release branch into the relevant maintenance branch (`v9_x`).
|
||||
- [ ] ***(SwEng)*** Merge the automatically prepared `prep 9.X.Y` commit which updates `version` and documentation on the release branch into the relevant maintenance branch (`v9_X`).
|
||||
- [ ] ***(SwEng)*** Push tags for the published releases to the public repository.
|
||||
- [ ] ***(QA)*** For each maintained branch, update the `BIND_BASELINE_VERSION` variable for the `abi-check` job in `.gitlab-ci.yml` to the latest published BIND version tag for a given branch.
|
||||
- [ ] ***(QA)*** Prepare empty release notes for the next set of releases.
|
||||
- [ ] ***(QA)*** Sanitize confidential issues which are assigned to the current release milestone and do not describe a security vulnerability, then make them public.
|
||||
- [ ] ***(QA)*** Sanitize confidential issues which are assigned to older release milestones and describe security vulnerabilities, then make them public if appropriate[^2].
|
||||
- [ ] ***(QA)*** Update QA tools used in GitLab CI (e.g. Flake8, PyLint) by modifying the relevant `Dockerfile`.
|
||||
|
||||
[^1]: If not, use the time remaining until the tagging deadline to ensure all outstanding issues are either resolved or moved to a different milestone.
|
||||
[^2]: As a rule of thumb, security vulnerabilities which have reproducers merged to the public repository are considered okay for full disclosure.
|
||||
|
||||
[^2]: Preferred command line: `git tag -u <DEVELOPER_KEYID> -a -s -m "BIND 9.X.Y[alphatag]" v9_X_Y[alphatag]`, where `[alphatag]` is an optional string such as `b1`, `rc1`, etc.
|
||||
|
||||
@@ -13,7 +13,6 @@ extraction:
|
||||
- "libidn2-dev"
|
||||
- "libmaxminddb-dev"
|
||||
- "libuv1-dev"
|
||||
- "libnghttp2-dev"
|
||||
configure:
|
||||
command:
|
||||
- "autoreconf -fi"
|
||||
@@ -30,6 +29,7 @@ path_classifiers:
|
||||
- "**/*.5"
|
||||
- "**/*.8"
|
||||
queries:
|
||||
- exclude: libltdl/
|
||||
- exclude: fuzz/
|
||||
- exclude: "bin/tests/system/*/ans*/*.py"
|
||||
- exclude: cpp/use-of-goto
|
||||
|
||||
@@ -5,4 +5,3 @@ disable=
|
||||
C0116, # missing-function-docstring
|
||||
R0801, # duplicate-code
|
||||
C0103, # invalid-name
|
||||
C0415,# import-outside-toplevel
|
||||
|
||||
@@ -1,868 +1,7 @@
|
||||
5652. [bug] Copy and paste error caused the socket option to
|
||||
be enabled instead of disabled. [GL #2746]
|
||||
|
||||
5651. [func] Refactor zone dumping to be processed asynchronously
|
||||
via the uv_work_t thread pool API. [GL #2732]
|
||||
|
||||
5650. [bug] Prevent a crash that could occur if serve-stale
|
||||
was enabled and a prefetch was triggered during a
|
||||
query restart. [GL #2733]
|
||||
|
||||
5649. [bug] If a query was answered with stale data on a server
|
||||
with DNS64 enabled, an assertion could occur if a
|
||||
non-stale answer arrived afterward. [GL #2731]
|
||||
|
||||
5648. [bug] The calculation of the estimated IXFR transaction
|
||||
size by dns_journal_iter_init() was invalid. [GL #2685]
|
||||
|
||||
5647. [func] The interfacemgr has been refactored to use fewer
|
||||
clientmgr objects, which in turn use fewer memory
|
||||
contexts and tasks. This should result in less
|
||||
fragmented memory and better startup performance.
|
||||
[GL #2433]
|
||||
|
||||
5646. [bug] The default TCP timeout for rndc has been increased
|
||||
to 60 seconds. This was its original value, but it
|
||||
had been inadvertently lowered to 10. [GL #2643]
|
||||
|
||||
5645. [cleanup] Remove the rarely-used dns_name_copy() function
|
||||
and rename dns_name_copynf() to dns_name_copy().
|
||||
[GL !5081]
|
||||
|
||||
5644. [bug] Fix a race condition in reading and writing key files
|
||||
for KASP zones in multiple views. [GL #1875]
|
||||
|
||||
5643. [placeholder]
|
||||
|
||||
5642. [bug] Check "key-directory" conflicts in "named.conf" for
|
||||
zones in multiple views with different "dnssec-policy".
|
||||
[GL #2463].
|
||||
|
||||
5641. [bug] Address potential memory leak in dst_key_fromnamedfile.
|
||||
[GL #2689]
|
||||
|
||||
5640. [func] Add new configuration option to set the operating system
|
||||
receive and send buffers. [GL #2313]
|
||||
|
||||
5639. [bug] Check that the first and last SOA record of an AXFR
|
||||
are consistent. [GL #2528]
|
||||
|
||||
--- 9.17.13 released ---
|
||||
|
||||
5638. [bug] Improvements related to network manager/task manager
|
||||
integration:
|
||||
- isc_managers_create() and isc_managers_destroy()
|
||||
functions were added to handle setup and teardown of
|
||||
netmgr, taskmgr, timermgr, and socketmgr, since these
|
||||
require a precise order of operations now.
|
||||
- Event queue processing is now quantized to prevent
|
||||
infinite looping.
|
||||
- The netmgr can now be paused from within a netmgr
|
||||
thread.
|
||||
- Deadlocks due to a conflict between netmgr's
|
||||
pause/resume and listen/stoplistening operations were
|
||||
fixed.
|
||||
[GL #2654]
|
||||
|
||||
5637. [placeholder]
|
||||
|
||||
5636. [bug] named and named-checkconf did not report an error when
|
||||
multiple zones with the "dnssec-policy" option set were
|
||||
using the same zone file. This has been fixed.
|
||||
[GL #2603]
|
||||
|
||||
5635. [bug] Journal compaction could fail when a journal with
|
||||
invalid transaction headers was not detected at startup.
|
||||
This has been fixed. [GL #2670]
|
||||
|
||||
5634. [bug] If "dnssec-policy" was active and a private key file was
|
||||
temporarily offline during a rekey event, named could
|
||||
incorrectly introduce replacement keys and break a
|
||||
signed zone. This has been fixed. [GL #2596]
|
||||
|
||||
5633. [doc] The "inline-signing" option was incorrectly described as
|
||||
being inherited from the "options"/"view" levels and was
|
||||
incorrectly accepted at those levels without effect.
|
||||
This has been fixed. [GL #2536]
|
||||
|
||||
5632. [func] Add a new built-in KASP, "insecure", which is used to
|
||||
transition a zone from a signed to an unsigned state.
|
||||
The existing built-in KASP "none" should no longer be
|
||||
used to unsign a zone. [GL #2645]
|
||||
|
||||
5631. [protocol] Update the implementation of the ZONEMD RR type to match
|
||||
RFC 8976. [GL #2658]
|
||||
|
||||
5630. [func] Treat DNSSEC responses containing NSEC3 records with
|
||||
iteration counts greater than 150 as insecure.
|
||||
[GL #2445]
|
||||
|
||||
5629. [func] Reduce the maximum supported number of NSEC3 iterations
|
||||
that can be configured for a zone to 150. [GL #2642]
|
||||
|
||||
5628. [bug] Host and nslookup could crash upon receiving a SERVFAIL
|
||||
response. This has been fixed. [GL #2564]
|
||||
|
||||
5627. [bug] RRSIG(SOA) RRsets placed anywhere other than at the zone
|
||||
apex were triggering infinite resigning loops. This has
|
||||
been fixed. [GL #2650]
|
||||
|
||||
5626. [bug] When generating zone signing keys, KASP now also checks
|
||||
for key ID conflicts among newly created keys, rather
|
||||
than just between new and existing ones. [GL #2628]
|
||||
|
||||
5625. [bug] A deadlock could occur when multiple "rndc addzone",
|
||||
"rndc delzone", and/or "rndc modzone" commands were
|
||||
invoked simultaneously for different zones. This has
|
||||
been fixed. [GL #2626]
|
||||
|
||||
5624. [func] Task manager events are now processed inside network
|
||||
manager loops. The task manager no longer needs its own
|
||||
set of worker threads, which improves resolver
|
||||
performance. [GL #2638]
|
||||
|
||||
5623. [bug] When named was shut down during an ongoing zone
|
||||
transfer, xfrin_fail() could incorrectly be called
|
||||
twice. This has been fixed. [GL #2630]
|
||||
|
||||
5622. [cleanup] The lib/samples/ directory has been removed, as export
|
||||
versions of libraries are no longer maintained.
|
||||
[GL !4835]
|
||||
|
||||
5621. [placeholder]
|
||||
|
||||
5620. [bug] If zone journal files written by BIND 9.16.11 or earlier
|
||||
were present when BIND was upgraded, the zone file for
|
||||
that zone could have been inadvertently rewritten with
|
||||
the current zone contents. This caused the original zone
|
||||
file structure (e.g. comments, $INCLUDE directives) to
|
||||
be lost, although the zone data itself was preserved.
|
||||
This has been fixed. [GL #2623]
|
||||
|
||||
5619. [protocol] Implement draft-vandijk-dnsop-nsec-ttl, updating the
|
||||
protocol such that NSEC(3) TTL values are set to the
|
||||
minimum of the SOA MINIMUM value or the SOA TTL.
|
||||
[GL #2347]
|
||||
|
||||
5618. [bug] Change 5149 introduced some inconsistencies in the way
|
||||
record TTLs were presented in cache dumps. These
|
||||
inconsistencies have been eliminated. [GL #389]
|
||||
[GL #2289]
|
||||
|
||||
--- 9.17.12 released ---
|
||||
|
||||
5617. [placeholder]
|
||||
|
||||
5616. [security] named crashed when a DNAME record placed in the ANSWER
|
||||
section during DNAME chasing turned out to be the final
|
||||
answer to a client query. (CVE-2021-25215) [GL #2540]
|
||||
|
||||
5615. [security] Insufficient IXFR checks could result in named serving a
|
||||
zone without an SOA record at the apex, leading to a
|
||||
RUNTIME_CHECK assertion failure when the zone was
|
||||
subsequently refreshed. This has been fixed by adding an
|
||||
owner name check for all SOA records which are included
|
||||
in a zone transfer. (CVE-2021-25214) [GL #2467]
|
||||
|
||||
5614. [bug] Ensure all resources are properly cleaned up when a call
|
||||
to gss_accept_sec_context() fails. [GL #2620]
|
||||
|
||||
5613. [bug] It was possible to write an invalid transaction header
|
||||
in the journal file for a managed-keys database after
|
||||
upgrading. This has been fixed. Invalid headers in
|
||||
existing journal files are detected and named is able
|
||||
to recover from them. [GL #2600]
|
||||
|
||||
5612. [bug] Continued refactoring of the network manager:
|
||||
- allow recovery from read and connect timeout events,
|
||||
- ensure that calls to isc_nm_*connect() always
|
||||
return the connection status via a callback
|
||||
function.
|
||||
[GL #2401]
|
||||
|
||||
5611. [func] Set "stale-answer-client-timeout" to "off" by default.
|
||||
[GL #2608]
|
||||
|
||||
5610. [bug] Prevent a crash which could happen when a lookup
|
||||
triggered by "stale-answer-client-timeout" was attempted
|
||||
right after recursion for a client query finished.
|
||||
[GL #2594]
|
||||
|
||||
5609. [func] The ISC implementation of SPNEGO was removed from BIND 9
|
||||
source code. It was no longer necessary as all major
|
||||
contemporary Kerberos/GSSAPI libraries include support
|
||||
for SPNEGO. [GL #2607]
|
||||
|
||||
5608. [bug] When sending queries over TCP, dig now properly handles
|
||||
"+tries=1 +retry=0" by not retrying the connection when
|
||||
the remote server closes the connection prematurely.
|
||||
[GL #2490]
|
||||
|
||||
5607. [bug] As "rndc dnssec -checkds" and "rndc dnssec -rollover"
|
||||
commands may affect the next scheduled key event,
|
||||
reconfiguration of zone keys is now triggered after
|
||||
receiving either of these commands to prevent
|
||||
unnecessary key rollover delays. [GL #2488]
|
||||
|
||||
5606. [bug] CDS/CDNSKEY DELETE records are now removed when a zone
|
||||
transitions from a secure to an insecure state.
|
||||
named-checkzone also no longer reports an error when
|
||||
such records are found in an unsigned zone. [GL #2517]
|
||||
|
||||
5605. [bug] "dig -u" now uses the CLOCK_REALTIME clock source for
|
||||
more accurate time reporting. [GL #2592]
|
||||
|
||||
5604. [experimental] A "filter-a.so" plugin, which is similar to the
|
||||
"filter-aaaa.so" plugin but which omits A records
|
||||
instead of AAAA records, has been added. Thanks to
|
||||
GitLab user @treysis. [GL #2585]
|
||||
|
||||
5603. [placeholder]
|
||||
|
||||
5602. [bug] Fix TCPDNS and TLSDNS timers in Network Manager. This
|
||||
makes the "tcp-initial-timeout" and "tcp-idle-timeout"
|
||||
options work correctly again. [GL #2583]
|
||||
|
||||
5601. [bug] Zones using KASP could not be thawed after they were
|
||||
frozen using "rndc freeze". This has been fixed.
|
||||
[GL #2523]
|
||||
|
||||
5600. [bug] Send a full certificate chain instead of just the leaf
|
||||
certificate to DNS-over-TLS (DoT) and DNS-over-HTTPS
|
||||
(DoH) clients. This makes BIND 9 DoT/DoH servers
|
||||
compatible with a broader set of clients. [GL #2514]
|
||||
|
||||
5599. [bug] Fix a named crash which occurred after skipping a
|
||||
primary server while transferring a zone over TLS.
|
||||
[GL #2562]
|
||||
|
||||
5598. [port] Silence -Wchar-subscripts compiler warnings triggered on
|
||||
some platforms due to calling character classification
|
||||
functions declared in the <ctype.h> header with
|
||||
arguments of type char. [GL #2567]
|
||||
|
||||
--- 9.17.11 released ---
|
||||
|
||||
5597. [bug] When serve-stale was enabled and starting the recursive
|
||||
resolution process for a query failed, a named instance
|
||||
could crash if it was configured as both a recursive and
|
||||
authoritative server. This problem was introduced by
|
||||
change 5573 and has now been fixed. [GL #2565]
|
||||
|
||||
5596. [func] Client-side support for DNS-over-HTTPS (DoH) has been
|
||||
added to dig. "dig +https" can now query a server via
|
||||
HTTP/2. [GL #1641]
|
||||
|
||||
5595. [cleanup] Public header files for BIND 9 libraries no longer
|
||||
directly include third-party library headers. This
|
||||
prevents the need to include paths to third-party header
|
||||
files in CFLAGS whenever BIND 9 public header files are
|
||||
used, which could cause build-time issues on hosts with
|
||||
older versions of BIND 9 installed. [GL #2357]
|
||||
|
||||
5594. [bug] Building with --enable-dnsrps --enable-dnsrps-dl failed.
|
||||
[GL #2298]
|
||||
|
||||
5593. [bug] Journal files written by older versions of named can now
|
||||
be read when loading zones, so that journal
|
||||
incompatibility does not cause problems on upgrade.
|
||||
Outdated journals are updated to the new format after
|
||||
loading. [GL #2505]
|
||||
|
||||
5592. [bug] Prevent hazard pointer table overflows on machines with
|
||||
many cores, by allowing the thread IDs (serving as
|
||||
indices into hazard pointer tables) of finished threads
|
||||
to be reused by those created later. [GL #2396]
|
||||
|
||||
5591. [bug] Fix a crash that occurred when
|
||||
"stale-answer-client-timeout" was triggered without any
|
||||
(stale) data available in the cache to answer the query.
|
||||
[GL #2503]
|
||||
|
||||
5590. [bug] NSEC3 records were not immediately created for dynamic
|
||||
zones using NSEC3 with "dnssec-policy", resulting in
|
||||
such zones going bogus. Add code to process the
|
||||
NSEC3PARAM queue at zone load time so that NSEC3 records
|
||||
for such zones are created immediately. [GL #2498]
|
||||
|
||||
5589. [placeholder]
|
||||
|
||||
5588. [func] Add a new "purge-keys" option for "dnssec-policy". This
|
||||
option determines the period of time for which key files
|
||||
are retained after they become obsolete. [GL #2408]
|
||||
|
||||
5587. [bug] A standalone libtool script no longer needs to be
|
||||
present in PATH to build BIND 9 from a source tarball
|
||||
prepared using "make dist". [GL #2504]
|
||||
|
||||
5586. [bug] An invalid direction field in a LOC record resulted in
|
||||
an INSIST failure when a zone file containing such a
|
||||
record was loaded. [GL #2499]
|
||||
|
||||
5585. [func] Memory contexts and memory pool implementations were
|
||||
refactored to reduce lock contention for shared memory
|
||||
contexts by replacing mutexes with atomic operations.
|
||||
The internal memory allocator was simplified so that it
|
||||
is only a thin wrapper around the system allocator. This
|
||||
change made the "-M external" named option redundant and
|
||||
it was therefore removed. [GL #2433]
|
||||
|
||||
5584. [bug] No longer set the IP_DONTFRAG option on UDP sockets, to
|
||||
prevent dropping outgoing packets exceeding
|
||||
"max-udp-size". [GL #2466]
|
||||
|
||||
5583. [func] Changes to DNS-over-HTTPS (DoH) configuration syntax:
|
||||
- When "http" is specified in "listen-on" or
|
||||
"listen-on-v6" statements, "tls" must also now be
|
||||
specified. If an unencrypted connection is desired
|
||||
(for example, when running behind a reverse proxy),
|
||||
use "tls none".
|
||||
- "http default" can now be specified in "listen-on" and
|
||||
"listen-on-v6" statements to use the default HTTP
|
||||
endpoint of "/dns-query". It is no longer necessary to
|
||||
include an "http" statement in named.conf unless
|
||||
overriding this value.
|
||||
[GL #2472]
|
||||
|
||||
5582. [bug] BIND 9 failed to build when static OpenSSL libraries
|
||||
were used and the pkg-config files for libssl and/or
|
||||
libcrypto were unavailable. This has been fixed by
|
||||
ensuring that the correct linking order for libssl and
|
||||
libcrypto is always used. [GL #2402]
|
||||
|
||||
5581. [bug] Fix a memory leak that occurred when inline-signed zones
|
||||
were added to the configuration, followed by a
|
||||
reconfiguration of named. [GL #2041]
|
||||
|
||||
5580. [test] The system test framework no longer differentiates
|
||||
between SKIPPED and UNTESTED system test results. Any
|
||||
system test which is not run is now marked as SKIPPED.
|
||||
[GL !4517]
|
||||
|
||||
5579. [bug] If an invalid key name (e.g. "a..b") was specified in a
|
||||
primaries list in named.conf, the wrong size was passed
|
||||
to isc_mem_put(), resulting in the returned memory being
|
||||
put on the wrong free list. This prevented named from
|
||||
starting up. [GL #2460]
|
||||
|
||||
--- 9.17.10 released ---
|
||||
|
||||
5578. [protocol] Make "check-names" accept A records below "_spf",
|
||||
"_spf_rate", and "_spf_verify" labels in order to cater
|
||||
for the "exists" SPF mechanism specified in RFC 7208
|
||||
section 5.7 and appendix D.1. [GL #2377]
|
||||
|
||||
5577. [bug] Fix the "three is a crowd" key rollover bug in KASP by
|
||||
correctly implementing Equation (2) of the "Flexible and
|
||||
Robust Key Rollover" paper. [GL #2375]
|
||||
|
||||
5576. [experimental] Initial server-side implementation of DNS-over-HTTPS
|
||||
(DoH). Support for both TLS-encrypted and unencrypted
|
||||
HTTP/2 connections has been added to the network manager
|
||||
and integrated into named. (Note: there is currently no
|
||||
client-side support for DNS-over-HTTPS; this will be
|
||||
added to dig in a future release.) [GL #1144]
|
||||
|
||||
5575. [bug] When migrating to KASP, BIND 9 considered keys with the
|
||||
"Inactive" and/or "Delete" timing metadata to be
|
||||
possible active keys. This has been fixed. [GL #2406]
|
||||
|
||||
5574. [func] Incoming zone transfers can now use TLS. Addresses in a
|
||||
"primaries" list take an optional "tls" argument,
|
||||
specifying either a previously configured "tls" block or
|
||||
"ephemeral"; SOA queries and zone transfer requests are
|
||||
then sent via TLS. [GL #2392]
|
||||
|
||||
5573. [func] When serve-stale is enabled and stale data is available,
|
||||
named now returns stale answers upon encountering any
|
||||
unexpected error in the query resolution process.
|
||||
However, the "stale-refresh-time" window is still only
|
||||
started upon a timeout. [GL #2434]
|
||||
|
||||
5572. [bug] Address potential double free in generatexml().
|
||||
[GL #2420]
|
||||
|
||||
5571. [bug] named failed to start when its configuration included a
|
||||
zone with a non-builtin "allow-update" ACL attached.
|
||||
[GL #2413]
|
||||
|
||||
5570. [bug] Improve performance of the DNSSEC verification code by
|
||||
reducing the number of repeated calls to
|
||||
dns_dnssec_keyfromrdata(). [GL #2073]
|
||||
|
||||
5569. [bug] Emit useful error message when "rndc retransfer" is
|
||||
applied to a zone of inappropriate type. [GL #2342]
|
||||
|
||||
5568. [bug] Fixed a crash in "dnssec-keyfromlabel" when using ECDSA
|
||||
keys. [GL #2178]
|
||||
|
||||
5567. [bug] Dig now reports unknown dash options while pre-parsing
|
||||
the options. This prevents "-multi" instead of "+multi"
|
||||
from reporting memory usage before ending option parsing
|
||||
with "Invalid option: -lti". [GL #2403]
|
||||
|
||||
5566. [func] Add "stale-answer-client-timeout" option, which is the
|
||||
amount of time a recursive resolver waits before
|
||||
attempting to answer the query using stale data from
|
||||
cache. [GL #2247]
|
||||
|
||||
5565. [func] The SONAMEs for BIND 9 libraries now include the current
|
||||
BIND 9 version number, in an effort to tightly couple
|
||||
internal libraries with a specific release. [GL #2387]
|
||||
|
||||
5564. [cleanup] Network manager's TLSDNS module was refactored to use
|
||||
libuv and libssl directly instead of a stack of TCP/TLS
|
||||
sockets. [GL #2335]
|
||||
|
||||
5563. [cleanup] Changed several obsolete configuration options to
|
||||
ancient, making them fatal errors. Also cleaned up the
|
||||
number of clause flags in the configuration parser.
|
||||
[GL #1086]
|
||||
|
||||
5562. [placeholder]
|
||||
|
||||
5561. [bug] KASP incorrectly set signature validity to the value of
|
||||
the DNSKEY signature validity. This is now fixed.
|
||||
[GL #2383]
|
||||
|
||||
5560. [func] The default value of "max-stale-ttl" has been changed
|
||||
from 12 hours to 1 day and the default value of
|
||||
"stale-answer-ttl" has been changed from 1 second to 30
|
||||
seconds, following RFC 8767 recommendations. [GL #2248]
|
||||
|
||||
--- 9.17.9 released ---
|
||||
|
||||
5559. [bug] The --with-maxminddb=PATH form of the build-time option
|
||||
enabling support for libmaxminddb was not working
|
||||
correctly. This has been fixed. [GL #2366]
|
||||
|
||||
5558. [bug] Asynchronous hook modules could trigger an assertion
|
||||
failure when the fetch handle was detached too late.
|
||||
Thanks to Jinmei Tatuya at Infoblox. [GL #2379]
|
||||
|
||||
5557. [bug] Prevent RBTDB instances from being destroyed by multiple
|
||||
threads at the same time. [GL #2317]
|
||||
|
||||
5556. [bug] Further tweak newline printing in dnssec-signzone and
|
||||
dnssec-verify. [GL #2359]
|
||||
|
||||
5555. [placeholder]
|
||||
|
||||
5554. [bug] dnssec-signzone and dnssec-verify were missing newlines
|
||||
between log messages. [GL #2359]
|
||||
|
||||
5553. [bug] When reconfiguring named, removing "auto-dnssec" did not
|
||||
turn off DNSSEC maintenance. [GL #2341]
|
||||
|
||||
5552. [func] When switching to "dnssec-policy none;", named now
|
||||
permits a safe transition to insecure mode and publishes
|
||||
the CDS and CDNSKEY DELETE records, as described in RFC
|
||||
8078. [GL #1750]
|
||||
|
||||
5551. [bug] named no longer attempts to assign threads to CPUs
|
||||
outside the CPU affinity set. Thanks to Ole Bjørn
|
||||
Hessen. [GL #2245]
|
||||
|
||||
5550. [func] dnssec-signzone and named now log a warning when falling
|
||||
back to the "increment" SOA serial method. [GL #2058]
|
||||
|
||||
5549. [protocol] ipv4only.arpa is now served when DNS64 is configured.
|
||||
[GL #385]
|
||||
|
||||
5548. [placeholder]
|
||||
|
||||
5547. [placeholder]
|
||||
|
||||
--- 9.17.8 released ---
|
||||
|
||||
5546. [placeholder]
|
||||
|
||||
5545. [func] OS support for load-balanced sockets is no longer
|
||||
required to receive incoming queries in multiple netmgr
|
||||
threads. [GL #2137]
|
||||
|
||||
5544. [func] Restore the default value of "nocookie-udp-size" to 4096
|
||||
bytes. [GL #2250]
|
||||
|
||||
5543. [bug] Fix UDP performance issues caused by making netmgr
|
||||
callbacks asynchronous-only. [GL #2320]
|
||||
|
||||
5542. [bug] Refactor netmgr. [GL #1920] [GL #2034] [GL #2061]
|
||||
[GL #2194] [GL #2221] [GL #2266] [GL #2283] [GL #2318]
|
||||
[GL #2321]
|
||||
|
||||
5541. [func] Adjust the "max-recursion-queries" default from 75 to
|
||||
100. [GL #2305]
|
||||
|
||||
5540. [port] Fix building with native PKCS#11 support for AEP Keyper.
|
||||
[GL #2315]
|
||||
|
||||
5539. [bug] Tighten handling of missing DNS COOKIE responses over
|
||||
UDP by falling back to TCP. [GL #2275]
|
||||
|
||||
5538. [func] Add NSEC3 support to KASP. A new option for
|
||||
"dnssec-policy", "nsec3param", can be used to set the
|
||||
desired NSEC3 parameters. NSEC3 salt collisions are
|
||||
automatically prevented during resalting. Salt
|
||||
generation is now logged with zone context. [GL #1620]
|
||||
|
||||
5537. [func] The query plugin mechanism has been extended
|
||||
to support asynchronous operations. For example, a
|
||||
plugin can now trigger recursion and resume
|
||||
processing when it is complete. Thanks to Jinmei
|
||||
Tatuya at Infoblox. [GL #2141]
|
||||
|
||||
5536. [func] Dig can now report the DNS64 prefixes in use
|
||||
(+dns64prefix). [GL #1154]
|
||||
|
||||
5535. [bug] dig/nslookup/host could crash on shutdown after an
|
||||
interrupt. [GL #2287] [GL #2288]
|
||||
|
||||
5534. [bug] The CNAME synthesized from a DNAME was incorrectly
|
||||
followed when the QTYPE was CNAME or ANY. [GL #2280]
|
||||
|
||||
--- 9.17.7 released ---
|
||||
|
||||
5533. [func] Add the "stale-refresh-time" option, a time window that
|
||||
starts after a failed lookup, during which a stale RRset
|
||||
is served directly from cache before a new attempt to
|
||||
refresh it is made. [GL #2066]
|
||||
|
||||
5532. [cleanup] Unused header files were removed:
|
||||
bin/rndc/include/rndc/os.h, lib/isc/timer_p.h,
|
||||
lib/isccfg/include/isccfg/dnsconf.h and code related
|
||||
to those files. [GL #1913]
|
||||
|
||||
5531. [func] Add support for DNS over TLS (DoT) to dig and named.
|
||||
dig output now includes the transport protocol used.
|
||||
[GL #1816] [GL #1840]
|
||||
|
||||
5530. [bug] dnstap did not capture responses to forwarded UPDATE
|
||||
requests. [GL #2252]
|
||||
|
||||
5529. [func] The network manager API is now used by named to send
|
||||
zone transfer requests. [GL #2016]
|
||||
|
||||
5528. [func] Convert dig, host, and nslookup to use the network
|
||||
manager API. As a side effect of this change, "dig
|
||||
+unexpected" no longer works, and has been disabled.
|
||||
[GL #2140]
|
||||
|
||||
5527. [bug] A NULL pointer dereference occurred when creating an NTA
|
||||
recheck query failed. [GL #2244]
|
||||
|
||||
5526. [bug] Fix a race/NULL dereference in TCPDNS read. [GL #2227]
|
||||
|
||||
5525. [placeholder]
|
||||
|
||||
5524. [func] Added functionality to the network manager to support
|
||||
outgoing DNS queries in addition to incoming ones.
|
||||
[GL #2235]
|
||||
|
||||
5523. [bug] The initial lookup in a zone transitioning to/from a
|
||||
signed state could fail if the DNSKEY RRset was not
|
||||
found. [GL #2236]
|
||||
|
||||
5522. [bug] Fixed a race/NULL dereference in TCPDNS send. [GL #2227]
|
||||
|
||||
5521. [func] All use of libltdl was dropped. libuv's shared library
|
||||
handling interface is now used instead. [GL !4278]
|
||||
|
||||
5520. [bug] Fixed a number of shutdown races, reference counting
|
||||
errors, and spurious log messages that could occur
|
||||
in the network manager. [GL #2221]
|
||||
|
||||
5519. [cleanup] Unused source code was removed: lib/dns/dbtable.c,
|
||||
lib/dns/portlist.c, lib/isc/bufferlist.c, and code
|
||||
related to those files. [GL #2060]
|
||||
|
||||
5518. [bug] Stub zones now work correctly with primary servers using
|
||||
"minimal-responses yes". [GL #1736]
|
||||
|
||||
5517. [bug] Do not treat UV_EOF as a TCP4RecvErr or a TCP6RecvErr.
|
||||
[GL #2208]
|
||||
|
||||
--- 9.17.6 released ---
|
||||
|
||||
5516. [func] The default EDNS buffer size has been changed from 4096
|
||||
to 1232 bytes, the EDNS buffer size probing has been
|
||||
removed, and named now sets the DF (Don't Fragment) flag
|
||||
on outgoing UDP packets. [GL #2183]
|
||||
|
||||
5515. [func] Add 'rndc dnssec -rollover' command to trigger a manual
|
||||
rollover for a specific key. [GL #1749]
|
||||
|
||||
5514. [bug] Fix KASP expected key size for Ed25519 and Ed448.
|
||||
[GL #2171]
|
||||
|
||||
5513. [doc] The ARM section describing the "rrset-order" statement
|
||||
was rewritten to make it unambiguous and up-to-date with
|
||||
the source code. [GL #2139]
|
||||
|
||||
5512. [bug] "rrset-order" rules using "order none" were causing
|
||||
named to crash despite named-checkconf treating them as
|
||||
valid. [GL #2139]
|
||||
|
||||
5511. [bug] 'dig -u +yaml' failed to display timestamps to the
|
||||
microsecond. [GL #2190]
|
||||
|
||||
5510. [bug] Implement the attach/detach semantics for dns_message_t
|
||||
to fix a data race in accessing an already-destroyed
|
||||
fctx->rmessage. [GL #2124]
|
||||
|
||||
5509. [bug] filter-aaaa: named crashed upon shutdown if it was in
|
||||
the process of recursing for A RRsets. [GL #1040]
|
||||
|
||||
5508. [func] Added new parameter "-expired" for "rndc dumpdb" that
|
||||
also prints expired RRsets (awaiting cleanup) to the
|
||||
dump file. [GL #1870]
|
||||
|
||||
5507. [bug] Named could compute incorrect SIG(0) responses.
|
||||
[GL #2109]
|
||||
|
||||
5506. [bug] Properly handle failed sysconf() calls, so we don't
|
||||
report invalid memory size. [GL #2166]
|
||||
|
||||
5505. [bug] Updating contents of a mixed-case RPZ could cause some
|
||||
rules to be ignored. [GL #2169]
|
||||
|
||||
5504. [func] The "glue-cache" option has been marked as deprecated.
|
||||
The glue cache feature will be permanently enabled in a
|
||||
future release. [GL #2146]
|
||||
|
||||
5503. [bug] Cleaned up reference counting of network manager
|
||||
handles, now using isc_nmhandle_attach() and _detach()
|
||||
instead of _ref() and _unref(). [GL #2122]
|
||||
|
||||
--- 9.17.5 released ---
|
||||
|
||||
5502. [func] 'dig +bufsize=0' no longer disables EDNS. [GL #2054]
|
||||
|
||||
5501. [func] Log CDS/CDNSKEY publication. [GL #1748]
|
||||
|
||||
5500. [bug] Fix (non-)publication of CDS and CDNSKEY records.
|
||||
[GL #2103]
|
||||
|
||||
5499. [func] Add '-P ds' and '-D ds' arguments to dnssec-settime.
|
||||
[GL #1748]
|
||||
|
||||
5498. [test] The --with-gperftools-profiler configure option was
|
||||
removed. [GL !4045]
|
||||
|
||||
5497. [placeholder]
|
||||
|
||||
5496. [bug] Address a TSAN report by ensuring each rate limiter
|
||||
object holds a reference to its task. [GL #2081]
|
||||
|
||||
5495. [bug] With query minimization enabled, named failed to
|
||||
resolve ip6.arpa. names that had extra labels to the
|
||||
left of the IPv6 part. [GL #1847]
|
||||
|
||||
5494. [bug] Silence the EPROTO syslog message on older systems.
|
||||
[GL #1928]
|
||||
|
||||
5493. [bug] Fix off-by-one error when calculating new hash table
|
||||
size. [GL #2104]
|
||||
|
||||
5492. [bug] Tighten LOC parsing to reject a period (".") and/or "m"
|
||||
as a value. Fix handling of negative altitudes which are
|
||||
not whole meters. [GL #2074]
|
||||
|
||||
5491. [bug] rbtversion->glue_table_size could be read without the
|
||||
appropriate lock being held. [GL #2080]
|
||||
|
||||
5490. [func] Refactor readline support to use pkg-config and add
|
||||
support for the editline library. [GL !3942]
|
||||
|
||||
5489. [bug] Named erroneously accepted certain invalid resource
|
||||
records that were incorrectly processed after
|
||||
subsequently being written to disk and loaded back, as
|
||||
the wire format differed. Such records include: CERT,
|
||||
IPSECKEY, NSEC3, NSEC3PARAM, NXT, SIG, TLSA, WKS, and
|
||||
X25. [GL !3953]
|
||||
|
||||
5488. [bug] NTA code needed to have a weak reference on its
|
||||
associated view to prevent the latter from being deleted
|
||||
while NTA tests were being performed. [GL #2067]
|
||||
|
||||
5487. [cleanup] Update managed keys log messages to be less confusing.
|
||||
[GL #2027]
|
||||
|
||||
5486. [func] Add 'rndc dnssec -checkds' command, which signals to
|
||||
named that the DS record for a given zone or key has
|
||||
been updated in the parent zone. [GL #1613]
|
||||
|
||||
--- 9.17.4 released ---
|
||||
|
||||
5485. [placeholder]
|
||||
|
||||
5484. [func] Expire zero TTL records quickly rather than using them
|
||||
for stale answers. [GL #1829]
|
||||
|
||||
5483. [func] Keeping "stale" answers in cache has been disabled by
|
||||
default and can be re-enabled with a new configuration
|
||||
option "stale-cache-enable". [GL #1712]
|
||||
|
||||
5482. [bug] If the Duplicate Address Detection (DAD) mechanism had
|
||||
not yet finished after adding a new IPv6 address to the
|
||||
system, BIND 9 would fail to bind to IPv6 addresses in a
|
||||
tentative state. [GL #2038]
|
||||
|
||||
5481. [security] "update-policy" rules of type "subdomain" were
|
||||
incorrectly treated as "zonesub" rules, which allowed
|
||||
keys used in "subdomain" rules to update names outside
|
||||
of the specified subdomains. The problem was fixed by
|
||||
making sure "subdomain" rules are again processed as
|
||||
described in the ARM. (CVE-2020-8624) [GL #2055]
|
||||
|
||||
5480. [security] When BIND 9 was compiled with native PKCS#11 support, it
|
||||
was possible to trigger an assertion failure in code
|
||||
determining the number of bits in the PKCS#11 RSA public
|
||||
key with a specially crafted packet. (CVE-2020-8623)
|
||||
[GL #2037]
|
||||
|
||||
5479. [security] named could crash in certain query resolution scenarios
|
||||
where QNAME minimization and forwarding were both
|
||||
enabled. (CVE-2020-8621) [GL #1997]
|
||||
|
||||
5478. [security] It was possible to trigger an assertion failure by
|
||||
sending a specially crafted large TCP DNS message.
|
||||
(CVE-2020-8620) [GL #1996]
|
||||
|
||||
5477. [bug] The idle timeout for connected TCP sockets, which was
|
||||
previously set to a high fixed value, is now derived
|
||||
from the client query processing timeout configured for
|
||||
a resolver. [GL #2024]
|
||||
|
||||
5476. [security] It was possible to trigger an assertion failure when
|
||||
verifying the response to a TSIG-signed request.
|
||||
(CVE-2020-8622) [GL #2028]
|
||||
|
||||
5475. [bug] Wildcard RPZ passthru rules could incorrectly be
|
||||
overridden by other rules that were loaded from RPZ
|
||||
zones which appeared later in the "response-policy"
|
||||
statement. This has been fixed. [GL #1619]
|
||||
|
||||
5474. [bug] dns_rdata_hip_next() failed to return ISC_R_NOMORE
|
||||
when it should have. [GL !3880]
|
||||
|
||||
5473. [func] The RBT hash table implementation has been changed
|
||||
to use a faster hash function (HalfSipHash2-4) and
|
||||
Fibonacci hashing for better distribution. Setting
|
||||
"max-cache-size" now preallocates a fixed-size hash
|
||||
table so that rehashing does not cause resolution
|
||||
brownouts while the hash table is grown. [GL #1775]
|
||||
|
||||
5472. [func] The statistics channel has been updated to use the
|
||||
new network manager. [GL #2022]
|
||||
|
||||
5471. [bug] The introduction of KASP support inadvertently caused
|
||||
the second field of "sig-validity-interval" to always be
|
||||
calculated in hours, even in cases when it should have
|
||||
been calculated in days. This has been fixed. (Thanks to
|
||||
Tony Finch.) [GL !3735]
|
||||
|
||||
5470. [port] gsskrb5_register_acceptor_identity() is now only called
|
||||
if gssapi_krb5.h is present. [GL #1995]
|
||||
|
||||
5469. [port] On illumos, a constant called SEC is already defined in
|
||||
<sys/time.h>, which conflicts with an identically named
|
||||
constant in libbind9. This conflict has been resolved.
|
||||
[GL #1993]
|
||||
|
||||
5468. [bug] Addressed potential double unlock in process_fd().
|
||||
[GL #2005]
|
||||
|
||||
5467. [func] The control channel and the rndc utility have been
|
||||
updated to use the new network manager. To support
|
||||
this, the network manager was updated to enable
|
||||
the initiation of client TCP connections. Its
|
||||
internal reference counting has been refactored.
|
||||
|
||||
Note: As a side effect of this change, rndc cannot
|
||||
currently be used with UNIX-domain sockets, and its
|
||||
default timeout has changed from 60 seconds to 30.
|
||||
These will be addressed in a future release.
|
||||
[GL #1759]
|
||||
|
||||
5466. [bug] Addressed an error in recursive clients stats reporting.
|
||||
[GL #1719]
|
||||
|
||||
5465. [func] Added fallback to built-in trust-anchors, managed-keys,
|
||||
or trusted-keys if the bindkeys-file (bind.keys) cannot
|
||||
be parsed. [GL #1235]
|
||||
|
||||
5464. [bug] Requesting more than 128 files to be saved when rolling
|
||||
dnstap log files caused a buffer overflow. This has been
|
||||
fixed. [GL #1989]
|
||||
|
||||
5463. [placeholder]
|
||||
|
||||
5462. [bug] Move LMDB locking from LMDB itself to named. [GL #1976]
|
||||
|
||||
5461. [bug] The STALE rdataset header attribute was updated while
|
||||
the write lock was not being held, leading to incorrect
|
||||
statistics. The header attributes are now converted to
|
||||
use atomic operations. [GL #1475]
|
||||
|
||||
5460. [cleanup] tsig-keygen was previously an alias for
|
||||
ddns-confgen and was documented in the ddns-confgen
|
||||
man page. This has been reversed; tsig-keygen is
|
||||
now the primary name. [GL #1998]
|
||||
|
||||
5459. [bug] Fixed bad isc_mem_put() size when an invalid type was
|
||||
specified in an "update-policy" rule. [GL #1990]
|
||||
|
||||
--- 9.17.3 released ---
|
||||
|
||||
5458. [bug] Prevent a theoretically possible NULL dereference caused
|
||||
by a data race between zone_maintenance() and
|
||||
dns_zone_setview_helper(). [GL #1627]
|
||||
|
||||
5457. [placeholder]
|
||||
|
||||
5456. [func] Added "primaries" as a synonym for "masters" in
|
||||
named.conf, and "primary-only" as a synonym for
|
||||
"master-only" in the parameters to "notify", to bring
|
||||
terminology up-to-date with RFC 8499. [GL #1948]
|
||||
|
||||
5455. [bug] named could crash when cleaning dead nodes in
|
||||
lib/dns/rbtdb.c that were being reused. [GL #1968]
|
||||
|
||||
5454. [bug] Address a startup crash that occurred when the server
|
||||
was under load and the root zone had not yet been
|
||||
loaded. [GL #1862]
|
||||
|
||||
5453. [bug] named crashed on shutdown when a new rndc connection was
|
||||
received during shutdown. [GL #1747]
|
||||
|
||||
5452. [bug] The "blackhole" ACL was accidentally disabled for client
|
||||
queries. [GL #1936]
|
||||
|
||||
5451. [func] Add 'rndc dnssec -status' command. [GL #1612]
|
||||
|
||||
5450. [placeholder]
|
||||
|
||||
5449. [bug] Fix a socket shutdown race in netmgr udp. [GL #1938]
|
||||
|
||||
5448. [bug] Fix a race condition in isc__nm_tcpdns_send().
|
||||
[GL #1937]
|
||||
|
||||
5447. [bug] IPv6 addresses ending in "::" could break YAML
|
||||
parsing. A "0" is now appended to such addresses
|
||||
in YAML output from dig, mdig, delv, and dnstap-read.
|
||||
[GL #1952]
|
||||
|
||||
5446. [bug] The validator could fail to accept a properly signed
|
||||
RRset if an unsupported algorithm appeared earlier in
|
||||
the DNSKEY RRset than a supported algorithm. It could
|
||||
also stop if it detected a malformed public key.
|
||||
[GL #1689]
|
||||
|
||||
5445. [cleanup] Disable and disallow static linking. [GL #1933]
|
||||
|
||||
5444. [bug] 'rndc dnstap -roll <value>' did not limit the number of
|
||||
saved files to <value>. [GL !3728]
|
||||
5444. [bug] 'rndc dnstap -roll <value>' was not limiting the
|
||||
number of saved files to <value>. [GL !3728]
|
||||
|
||||
5443. [bug] The "primary" and "secondary" keywords, when used
|
||||
as parameters for "check-names", were not
|
||||
@@ -875,8 +14,8 @@
|
||||
|
||||
5440. [placeholder]
|
||||
|
||||
5439. [bug] The DS RRset returned by dns_keynode_dsset() was used in
|
||||
a non-thread-safe manner. [GL #1926]
|
||||
5439. [bug] The dsset returned by dns_keynode_dsset() was not
|
||||
thread safe. [GL #1926]
|
||||
|
||||
--- 9.17.2 released ---
|
||||
|
||||
|
||||
+2
-2
@@ -7,8 +7,8 @@ people.
|
||||
|
||||
Diversity is one of our huge strengths, but it can also lead to communication
|
||||
issues and unhappiness. To that end, we have a few ground rules that we ask
|
||||
people to adhere to. This code applies equally to the core development team,
|
||||
open source contributors and those seeking help and guidance.
|
||||
people to adhere to. This code applies equally to the core development team, open source contributors and those
|
||||
seeking help and guidance.
|
||||
|
||||
This isn't an exhaustive list of things that you can't do. Rather, take it in
|
||||
the spirit in which it's intended - a guide to make it easier to enrich all of
|
||||
|
||||
+16
-19
@@ -39,28 +39,29 @@ anyone can see the source, but only ISC employees have commit access.
|
||||
In the past, the source could only be seen once ISC had published
|
||||
a release; read access to the source repository was restricted just
|
||||
as commit access was. That has changed, as ISC now provides a
|
||||
public git repository of the BIND source tree (see below).
|
||||
public git mirror to the BIND source tree (see below).
|
||||
|
||||
At ISC, we're committed to
|
||||
building communities that are welcoming and inclusive: environments where people
|
||||
are encouraged to share ideas, treat each other with respect, and collaborate
|
||||
towards the best solutions. To reinforce our commitment, ISC
|
||||
has adopted a slightly modified version of the Django
|
||||
[Code of Conduct](https://gitlab.isc.org/isc-projects/bind9/-/blob/main/CODE_OF_CONDUCT.md)
|
||||
for the BIND 9 project, as well as for the conduct of our developers throughout
|
||||
the industry.
|
||||
[Code of Conduct](https://gitlab.isc.org/isc-projects/bind9/-/blob/master/CODE_OF_CONDUCT.md) for the BIND 9 project, as well as for the conduct of our
|
||||
developers throughout the industry.
|
||||
|
||||
### <a name="access"></a>Access to source code
|
||||
|
||||
Public BIND releases are always available from the
|
||||
[ISC FTP site](ftp://ftp.isc.org/isc/bind9).
|
||||
|
||||
A public-access git repository is also available at
|
||||
[https://gitlab.isc.org](https://gitlab.isc.org). This repository
|
||||
contains all public release branches. Upcoming releases can be viewed in
|
||||
their current state at any time. Short-lived development branches
|
||||
contain unreviewed work in progress. Commits which address security
|
||||
vulnerablilities are withheld until after public disclosure.
|
||||
A public-access GIT repository is also available at
|
||||
[https://gitlab.isc.org](https://gitlab.isc.org).
|
||||
This repository is a mirror, updated several times per day, of the
|
||||
source repository maintained by ISC. It contains all the public release
|
||||
branches; upcoming releases can be viewed in their current state at any
|
||||
time. It does *not* contain development branches or unreviewed work in
|
||||
progress. Commits which address security vulnerablilities are withheld
|
||||
until after public disclosure.
|
||||
|
||||
You can browse the source online via
|
||||
[https://gitlab.isc.org/isc-projects/bind9](https://gitlab.isc.org/isc-projects/bind9)
|
||||
@@ -79,7 +80,7 @@ Whenever a branch is ready for publication, a tag is placed of the
|
||||
form `v9_X_Y`. The 9.12.0 release, for instance, is tagged as `v9_12_0`.
|
||||
|
||||
The branch in which the next major release is being developed is called
|
||||
`main`.
|
||||
`master`.
|
||||
|
||||
### <a name="bugs"></a>Reporting bugs
|
||||
|
||||
@@ -99,7 +100,6 @@ use credentials from an existing account at GitHub, GitLab, Google,
|
||||
Twitter, or Facebook.
|
||||
|
||||
### Reporting possible security issues
|
||||
|
||||
If you think you may be seeing a potential security vulnerability in BIND
|
||||
(for example, a crash with REQUIRE, INSIST, or ASSERT failure), please
|
||||
report it immediately by emailing to security-officer@isc.org. Plain-text
|
||||
@@ -111,8 +111,7 @@ Do not discuss undisclosed security vulnerabilities on any public mailing list.
|
||||
ISC has a long history of handling reported vulnerabilities promptly and
|
||||
effectively and we respect and acknowledge responsible reporters.
|
||||
|
||||
ISC's Security Vulnerability Disclosure Policy is documented at
|
||||
[https://kb.isc.org/docs/aa-00861](https://kb.isc.org/docs/aa-00861).
|
||||
ISC's Security Vulnerability Disclosure Policy is documented at [https://kb.isc.org/docs/aa-00861](https://kb.isc.org/docs/aa-00861).
|
||||
|
||||
If you have a crash, you may want to consult
|
||||
["What to do if your BIND or DHCP server has crashed."](https://kb.isc.org/docs/aa-00340)
|
||||
@@ -121,8 +120,7 @@ If you have a crash, you may want to consult
|
||||
|
||||
BIND is licensed under the
|
||||
[Mozilla Public License 2.0](https://www.mozilla.org/en-US/MPL/2.0/).
|
||||
Earlier versions (BIND 9.10 and earlier) were licensed under the
|
||||
[ISC License](https://www.isc.org/licenses/)
|
||||
Earlier versions (BIND 9.10 and earlier) were licensed under the [ISC License](https://www.isc.org/licenses/)
|
||||
|
||||
ISC does not require an explicit copyright assignment for patch
|
||||
contributions. However, by submitting a patch to ISC, you implicitly
|
||||
@@ -138,7 +136,7 @@ Patches for BIND may be submitted directly via merge requests in
|
||||
repository for BIND.
|
||||
|
||||
Patches can also be submitted as diffs against a specific version of
|
||||
BIND -- preferably the current top of the `main` branch. Diffs may
|
||||
BIND -- preferably the current top of the `master` branch. Diffs may
|
||||
be generated using either `git format-patch` or `git diff`.
|
||||
|
||||
Those wanting to write code for BIND may be interested in the
|
||||
@@ -186,8 +184,7 @@ of documentation in the BIND source tree:
|
||||
they document, in files ending in `.rst`: for example, the
|
||||
`named` man page is `bin/named/named.rst`.
|
||||
* The *BIND 9 Administrator Reference Manual* is in the .rst files in
|
||||
`doc/arm/`; the PDF and HTML versions are automatically generated from
|
||||
the `.rst` files.
|
||||
`doc/arm/`; the PDF and HTML versions are automatically generated from the `.rst` files.
|
||||
* API documentation is in the header file describing the API, in
|
||||
Doxygen-formatted comments.
|
||||
|
||||
|
||||
@@ -1,8 +1,8 @@
|
||||
Copyright (C) 1996-2021 Internet Systems Consortium, Inc. ("ISC")
|
||||
Copyright (C) 1996-2020 Internet Systems Consortium, Inc. ("ISC")
|
||||
|
||||
This Source Code Form is subject to the terms of the Mozilla Public
|
||||
License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
|
||||
-----------------------------------------------------------------------------
|
||||
|
||||
@@ -367,25 +367,3 @@ distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
|
||||
-----------------------------------------------------------------------------
|
||||
|
||||
Copyright Joyent, Inc. and other Node contributors. All rights reserved.
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
of this software and associated documentation files (the "Software"), to
|
||||
deal in the Software without restriction, including without limitation the
|
||||
rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
|
||||
sell copies of the Software, and to permit persons to whom the Software is
|
||||
furnished to do so, subject to the following conditions:
|
||||
|
||||
The above copyright notice and this permission notice shall be included in
|
||||
all copies or substantial portions of the Software.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
|
||||
FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
|
||||
IN THE SOFTWARE.
|
||||
|
||||
+1
-1
@@ -1,6 +1,6 @@
|
||||
include $(top_srcdir)/Makefile.top
|
||||
|
||||
SUBDIRS = . lib doc bin fuzz
|
||||
SUBDIRS = . libltdl lib doc bin
|
||||
|
||||
BUILT_SOURCES = bind.keys.h
|
||||
CLEANFILES = bind.keys.h
|
||||
|
||||
@@ -10,7 +10,6 @@ AM_V_SPHINX_0 = @echo " SPHINX $@";
|
||||
SPHINXBUILDDIR = $(builddir)/_build
|
||||
|
||||
common_SPHINXOPTS = \
|
||||
-W \
|
||||
-c $(srcdir) \
|
||||
-a \
|
||||
$(SPHINX_V)
|
||||
|
||||
+2
-3
@@ -3,9 +3,8 @@
|
||||
|
||||
AM_CPPFLAGS += \
|
||||
$(CMOCKA_CFLAGS) \
|
||||
-DNAMED_PLUGINDIR=\"$(libdir)/named\" \
|
||||
-DSKIPPED_TEST_EXIT_CODE=77 \
|
||||
-DTESTS_DIR=\"$(abs_srcdir)\"
|
||||
-DTESTS_DIR=\"$(abs_srcdir)\" \
|
||||
-DNAMED_PLUGINDIR=\"$(libdir)/named\"
|
||||
|
||||
LDADD = \
|
||||
$(CMOCKA_LIBS)
|
||||
|
||||
+20
-6
@@ -11,12 +11,10 @@ AM_CPPFLAGS = \
|
||||
-include $(top_builddir)/config.h \
|
||||
-I$(srcdir)/include
|
||||
|
||||
AM_LDFLAGS =
|
||||
|
||||
if HOST_MACOS
|
||||
AM_LDFLAGS += \
|
||||
-Wl,-flat_namespace
|
||||
endif HOST_MACOS
|
||||
if HAVE_GSSAPI
|
||||
AM_CPPFLAGS += \
|
||||
$(GSSAPI_CFLAGS)
|
||||
endif
|
||||
|
||||
LIBISC_CFLAGS = \
|
||||
-I$(top_srcdir)/include \
|
||||
@@ -25,6 +23,16 @@ LIBISC_CFLAGS = \
|
||||
-I$(top_srcdir)/lib/isc/include \
|
||||
-I$(top_builddir)/lib/isc/include
|
||||
|
||||
if HAVE_JSON_C
|
||||
LIBISC_CFLAGS += \
|
||||
$(JSON_C_CFLAGS)
|
||||
endif HAVE_JSON_C
|
||||
|
||||
if HAVE_LIBXML2
|
||||
LIBISC_CFLAGS += \
|
||||
$(LIBXML2_CFLAGS)
|
||||
endif HAVE_LIBXML2
|
||||
|
||||
LIBISC_LIBS = $(top_builddir)/lib/isc/libisc.la
|
||||
|
||||
LIBDNS_CFLAGS = \
|
||||
@@ -63,3 +71,9 @@ LIBBIND9_CFLAGS = \
|
||||
|
||||
LIBBIND9_LIBS = \
|
||||
$(top_builddir)/lib/bind9/libbind9.la
|
||||
|
||||
LIBLTDL_CFLAGS = \
|
||||
-I$(top_srcdir)/libltdl
|
||||
|
||||
LIBLTDL_LIBS = \
|
||||
$(top_builddir)/libltdl/libltdlc.la
|
||||
|
||||
+14
-13
@@ -8,19 +8,20 @@
|
||||
- See the COPYRIGHT file distributed with this work for additional
|
||||
- information regarding copyright ownership.
|
||||
-->
|
||||
Setting the `CPPFLAGS` environment variable before running `configure`
|
||||
can be used to enable certain compile-time options that are not
|
||||
explicitly defined in `configure`.
|
||||
Setting the `STD_CDEFINES` environment variable before running `configure`
|
||||
can be used to enable certain compile-time options that are not explicitly
|
||||
defined in `configure`.
|
||||
|
||||
Some of these settings are:
|
||||
|
||||
| Setting | Description |
|
||||
| ---------------------------- | -------------------------------------------------------------------------------------------------------------------------------------- |
|
||||
| `-DCHECK_LOCAL=0` | Don't check out-of-zone addresses in `named-checkzone` |
|
||||
| `-DCHECK_SIBLING=0` | Don't check sibling glue in `named-checkzone` |
|
||||
| `-DISC_FACILITY=LOG_LOCAL0` | Change the default syslog facility for `named` |
|
||||
| `-DISC_HEAP_CHECK` | Test heap consistency after every heap operation; used when debugging |
|
||||
| `-DISC_MEM_DEFAULTFILL=1` | Overwrite memory with tag values when allocating or freeing it; this impairs performance but makes debugging of memory problems easier |
|
||||
| `-DISC_MEM_TRACKLINES=0` | Don't track memory allocations by file and line number; this improves performance but makes debugging more difficult |
|
||||
| `-DNAMED_RUN_PID_DIR=0` | Create default PID files in `${localstatedir}/run` rather than `${localstatedir}/run/named/` |
|
||||
| `-DNS_CLIENT_DROPPORT=0` | Disable dropping queries from particular well-known ports |
|
||||
|Setting |Description |
|
||||
|-----------------------------------|----------------------------------------|
|
||||
|`-DISC_MEM_DEFAULTFILL=1`|Overwrite memory with tag values when allocating or freeing it; this impairs performance but makes debugging of memory problems easier.|
|
||||
|`-DISC_MEM_TRACKLINES=0`|Don't track memory allocations by file and line number; this improves performance but makes debugging more difficult.|
|
||||
|<nobr>`-DISC_FACILITY=LOG_LOCAL0`</nobr>|Change the default syslog facility for `named`|
|
||||
|`-DNS_CLIENT_DROPPORT=0`|Disable dropping queries from particular well-known ports:|
|
||||
|`-DCHECK_SIBLING=0`|Don't check sibling glue in `named-checkzone`|
|
||||
|`-DCHECK_LOCAL=0`|Don't check out-of-zone addresses in `named-checkzone`|
|
||||
|`-DNS_RUN_PID_DIR=0`|Create default PID files in `${localstatedir}/run` rather than `${localstatedir}/run/named/`|
|
||||
|`-DISC_BUFFER_USEINLINE=0`|Disable the use of inline functions to implement the `isc_buffer` API: this reduces performance but may be useful when debugging |
|
||||
|`-DISC_HEAP_CHECK`|Test heap consistency after every heap operation; used when debugging|
|
||||
|
||||
+10
-10
@@ -13,7 +13,7 @@
|
||||
In general, this version of BIND will build and run on any POSIX-compliant
|
||||
system with a C11-compliant C compiler, BSD-style sockets with RFC-compliant
|
||||
IPv6 support, POSIX-compliant threads, the `libuv` asynchronous I/O library,
|
||||
the OpenSSL cryptography library, and the `nghttp2` HTTP/2 library.
|
||||
and the OpenSSL cryptography library.
|
||||
|
||||
The following C11 features are used in BIND 9:
|
||||
|
||||
@@ -42,16 +42,16 @@ offer support on a "best effort" basis for some.
|
||||
|
||||
### Regularly tested platforms
|
||||
|
||||
As of Nov 2020, BIND 9.17 is fully supported and regularly tested on the
|
||||
As of Mar 2020, BIND 9.17 is fully supported and regularly tested on the
|
||||
following systems:
|
||||
|
||||
* Debian 9, 10
|
||||
* Ubuntu LTS 18.04, 20.04
|
||||
* Fedora 34
|
||||
* Ubuntu LTS 16.04, 18.04
|
||||
* Fedora 31
|
||||
* Red Hat Enterprise Linux / CentOS 7, 8
|
||||
* FreeBSD 11.4, 12.2, 13.0
|
||||
* OpenBSD 6.9
|
||||
* Alpine Linux 3.13
|
||||
* FreeBSD 11.3, 12.1
|
||||
* OpenBSD 6.6
|
||||
* Alpine Linux
|
||||
|
||||
The amd64, i386, armhf and arm64 CPU architectures are all fully supported.
|
||||
|
||||
@@ -61,7 +61,7 @@ The following are platforms on which BIND is known to build and run.
|
||||
ISC makes every effort to fix bugs on these platforms, but may be unable to
|
||||
do so quickly due to lack of hardware, less familiarity on the part of
|
||||
engineering staff, and other constraints. With the exception of Windows
|
||||
Server 2016, none of these are tested regularly by ISC.
|
||||
Server 2012 R2, none of these are tested regularly by ISC.
|
||||
|
||||
* Windows Server 2012 R2, 2016 / x64
|
||||
* Windows 10 / x64
|
||||
@@ -69,7 +69,7 @@ Server 2016, none of these are tested regularly by ISC.
|
||||
* Solaris 11
|
||||
* NetBSD
|
||||
* Other Linux distributions still supported by their vendors, such as:
|
||||
* Ubuntu 20.10+
|
||||
* Ubuntu 19.04+
|
||||
* Gentoo
|
||||
* Arch Linux
|
||||
* OpenWRT/LEDE 17.01+
|
||||
@@ -86,7 +86,7 @@ assessed against the risk of adverse effect on officially supported
|
||||
platforms.
|
||||
|
||||
* Platforms past or close to their respective EOL dates, such as:
|
||||
* Ubuntu 14.04, 16.04 (Ubuntu ESM releases are not supported)
|
||||
* Ubuntu 14.04, 18.10
|
||||
* CentOS 6
|
||||
* Debian Jessie
|
||||
* FreeBSD 10.x
|
||||
|
||||
@@ -15,6 +15,7 @@
|
||||
1. [Introduction](#intro)
|
||||
1. [Reporting bugs and getting help](#help)
|
||||
1. [Contributing to BIND](#contrib)
|
||||
1. [BIND 9.17 features](#features)
|
||||
1. [Building BIND](#build)
|
||||
1. [macOS](#macos)
|
||||
1. [Dependencies](#dependencies)
|
||||
@@ -124,17 +125,27 @@ If you prefer, you may also submit code by opening a
|
||||
including your patch as an attachment, preferably generated by
|
||||
`git format-patch`.
|
||||
|
||||
### <a name="features"/> BIND 9.17 features
|
||||
|
||||
BIND 9.17 is the newest development branch of BIND 9. It includes a
|
||||
number of changes from BIND 9.16 and earlier releases. New features include:
|
||||
|
||||
* The new option `max-ixfr-ratio` to limit the size of outgoing IXFR responses
|
||||
before falling back to full zone transfers.
|
||||
* `rndc nta -d` and `rndc secroots` now include `validate-except` entries
|
||||
when listing negative trust anchors.
|
||||
|
||||
### <a name="build"/> Building BIND 9
|
||||
|
||||
At a minimum, BIND requires a Unix or Linux system with an ANSI C compiler,
|
||||
basic POSIX support, and a 64-bit integer type. BIND also requires the
|
||||
`libuv` asynchronous I/O library, the `nghttp2` HTTP/2 library, and a
|
||||
cryptography provider library such as OpenSSL or a hardware service
|
||||
module supporting PKCS#11. On Linux, BIND requires the `libcap` library
|
||||
to set process privileges, though this requirement can be overridden by
|
||||
disabling capability support at compile time. See [Compile-time
|
||||
options](#opts) below for details on other libraries that may be
|
||||
required to support optional features.
|
||||
`libuv` asynchronous I/O library, and a cryptography provider library
|
||||
such as OpenSSL or a hardware service module supporting PKCS#11. On
|
||||
Linux, BIND requires the `libcap` library to set process privileges,
|
||||
though this requirement can be overridden by disabling capability
|
||||
support at compile time. See [Compile-time options](#opts) below
|
||||
for details on other libraries that may be required to support
|
||||
optional features.
|
||||
|
||||
Successful builds have been observed on many versions of Linux and
|
||||
Unix, including RHEL/CentOS, Fedora, Debian, Ubuntu, SLES, openSUSE,
|
||||
@@ -151,7 +162,8 @@ To build on a Unix or Linux system, use:
|
||||
$ ./configure
|
||||
$ make
|
||||
|
||||
If you're using Emacs, you might find `make tags` helpful.
|
||||
If you're planning on making changes to the BIND 9 source, you should run
|
||||
`make depend`. If you're using Emacs, you might find `make tags` helpful.
|
||||
|
||||
Several environment variables, which can be set before running `configure`,
|
||||
affect compilation. Significant ones are:
|
||||
@@ -173,8 +185,9 @@ command:
|
||||
Building on macOS assumes that the "Command Tools for Xcode" are installed.
|
||||
These can be downloaded from
|
||||
[https://developer.apple.com/download/more/](https://developer.apple.com/download/more/)
|
||||
or, if you have Xcode already installed, you can run `xcode-select --install`.
|
||||
(Note that an Apple ID may be required to access the download page.)
|
||||
or, if you have Xcode already installed, you can run
|
||||
`xcode-select--install`. (Note that an Apple ID may be required to access the download
|
||||
page.)
|
||||
|
||||
#### <a name="dependencies"> Dependencies
|
||||
|
||||
@@ -189,11 +202,15 @@ installed:
|
||||
autoconf (includes autoreconf)
|
||||
automake
|
||||
libtool
|
||||
libltdl-dev (Debian) / libtool-ltdl-dev (Fedora/CentOS) / libltdl (FreeBSD)
|
||||
|
||||
#### <a name="opts"/> Compile-time options
|
||||
|
||||
To see a full list of configuration options, run `configure --help`.
|
||||
|
||||
To build shared libraries, specify `--with-libtool` on the `configure`
|
||||
command line.
|
||||
|
||||
For the server to support DNSSEC, you need to build it with crypto support.
|
||||
To use OpenSSL, you should have OpenSSL 1.0.2e or newer installed. If the
|
||||
OpenSSL library is installed in a nonstandard location, specify the prefix
|
||||
@@ -322,7 +339,7 @@ the change that was made; these categories are:
|
||||
| [cleanup] | Minor corrections and refactoring |
|
||||
| [doc] | Documentation |
|
||||
| [contrib] | Changes to the contributed tools and libraries in the 'contrib' subdirectory |
|
||||
| [placeholder] | Used in the main development branch to reserve change numbers for use in other branches, e.g., when fixing a bug that only exists in older releases |
|
||||
| [placeholder] | Used in the master development branch to reserve change numbers for use in other branches, e.g., when fixing a bug that only exists in older releases |
|
||||
|
||||
In general, [func] and [experimental] tags only appear in new-feature
|
||||
releases (i.e., those with version numbers ending in zero). Some new
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
@@ -185,7 +185,7 @@ configure_zone(const char *vclass, const char *view, const cfg_obj_t *zconfig,
|
||||
const char *zname;
|
||||
const char *zfile = NULL;
|
||||
const cfg_obj_t *maps[4];
|
||||
const cfg_obj_t *primariesobj = NULL;
|
||||
const cfg_obj_t *mastersobj = NULL;
|
||||
const cfg_obj_t *inviewobj = NULL;
|
||||
const cfg_obj_t *zoptions = NULL;
|
||||
const cfg_obj_t *classobj = NULL;
|
||||
@@ -279,12 +279,8 @@ configure_zone(const char *vclass, const char *view, const cfg_obj_t *zconfig,
|
||||
* Is the redirect zone configured as a slave?
|
||||
*/
|
||||
if (strcasecmp(cfg_obj_asstring(typeobj), "redirect") == 0) {
|
||||
cfg_map_get(zoptions, "primaries", &primariesobj);
|
||||
if (primariesobj == NULL) {
|
||||
cfg_map_get(zoptions, "masters", &primariesobj);
|
||||
}
|
||||
|
||||
if (primariesobj != NULL) {
|
||||
cfg_map_get(zoptions, "masters", &mastersobj);
|
||||
if (mastersobj != NULL) {
|
||||
return (ISC_R_SUCCESS);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
|
||||
This Source Code Form is subject to the terms of the Mozilla Public
|
||||
License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
|
||||
See the COPYRIGHT file distributed with this work for additional
|
||||
information regarding copyright ownership.
|
||||
@@ -35,62 +35,62 @@ Description
|
||||
~~~~~~~~~~~
|
||||
|
||||
``named-checkconf`` checks the syntax, but not the semantics, of a
|
||||
``named`` configuration file. The file, along with all files included by it, is parsed and checked for syntax
|
||||
errors. If no file is specified,
|
||||
``named`` configuration file. The file is parsed and checked for syntax
|
||||
errors, along with all files included by it. If no file is specified,
|
||||
``/etc/named.conf`` is read by default.
|
||||
|
||||
Note: files that ``named`` reads in separate parser contexts, such as
|
||||
``rndc.key`` and ``bind.keys``, are not automatically read by
|
||||
``named-checkconf``. Configuration errors in these files may cause
|
||||
``named`` to fail to run, even if ``named-checkconf`` was successful.
|
||||
However, ``named-checkconf`` can be run on these files explicitly.
|
||||
``named-checkconf`` can be run on these files explicitly, however.
|
||||
|
||||
Options
|
||||
~~~~~~~
|
||||
|
||||
``-h``
|
||||
This option prints the usage summary and exits.
|
||||
**-h**
|
||||
Print the usage summary and exit.
|
||||
|
||||
``-j``
|
||||
When loading a zonefile, this option instructs ``named`` to read the journal if it exists.
|
||||
**-j**
|
||||
When loading a zonefile read the journal if it exists.
|
||||
|
||||
``-l``
|
||||
This option lists all the configured zones. Each line of output contains the zone
|
||||
name, class (e.g. IN), view, and type (e.g. primary or secondary).
|
||||
**-l**
|
||||
List all the configured zones. Each line of output contains the zone
|
||||
name, class (e.g. IN), view, and type (e.g. master or slave).
|
||||
|
||||
``-c``
|
||||
This option specifies that only the "core" configuration should be checked. This suppresses the loading of
|
||||
**-c**
|
||||
Check "core" configuration only. This suppresses the loading of
|
||||
plugin modules, and causes all parameters to ``plugin`` statements to
|
||||
be ignored.
|
||||
|
||||
``-i``
|
||||
This option ignores warnings on deprecated options.
|
||||
**-i**
|
||||
Ignore warnings on deprecated options.
|
||||
|
||||
``-p``
|
||||
This option prints out the ``named.conf`` and included files in canonical form if
|
||||
**-p**
|
||||
Print out the ``named.conf`` and included files in canonical form if
|
||||
no errors were detected. See also the ``-x`` option.
|
||||
|
||||
``-t directory``
|
||||
This option instructs ``named`` to chroot to ``directory``, so that ``include`` directives in the
|
||||
**-t** directory
|
||||
Chroot to ``directory`` so that include directives in the
|
||||
configuration file are processed as if run by a similarly chrooted
|
||||
``named``.
|
||||
|
||||
``-v``
|
||||
This option prints the version of the ``named-checkconf`` program and exits.
|
||||
**-v**
|
||||
Print the version of the ``named-checkconf`` program and exit.
|
||||
|
||||
``-x``
|
||||
When printing the configuration files in canonical form, this option obscures
|
||||
**-x**
|
||||
When printing the configuration files in canonical form, obscure
|
||||
shared secrets by replacing them with strings of question marks
|
||||
(``?``). This allows the contents of ``named.conf`` and related files
|
||||
to be shared - for example, when submitting bug reports -
|
||||
('?'). This allows the contents of ``named.conf`` and related files
|
||||
to be shared MDASH for example, when submitting bug reports MDASH
|
||||
without compromising private data. This option cannot be used without
|
||||
``-p``.
|
||||
|
||||
``-z``
|
||||
This option performs a test load of all zones of type ``primary`` found in ``named.conf``.
|
||||
**-z**
|
||||
Perform a test load of all master zones found in ``named.conf``.
|
||||
|
||||
``filename``
|
||||
This indicates the name of the configuration file to be checked. If not specified,
|
||||
filename
|
||||
The name of the configuration file to be checked. If not specified,
|
||||
it defaults to ``/etc/named.conf``.
|
||||
|
||||
Return Values
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
|
||||
+109
-108
@@ -3,7 +3,7 @@
|
||||
|
||||
This Source Code Form is subject to the terms of the Mozilla Public
|
||||
License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
|
||||
See the COPYRIGHT file distributed with this work for additional
|
||||
information regarding copyright ownership.
|
||||
@@ -21,6 +21,8 @@
|
||||
|
||||
.. highlight: console
|
||||
|
||||
.. _man_named-checkzone:
|
||||
|
||||
named-checkzone, named-compilezone - zone file validity checking or converting tool
|
||||
-----------------------------------------------------------------------------------
|
||||
|
||||
@@ -41,164 +43,163 @@ configuring them into a name server.
|
||||
|
||||
``named-compilezone`` is similar to ``named-checkzone``, but it always
|
||||
dumps the zone contents to a specified file in a specified format.
|
||||
It also applies stricter check levels by default, since the
|
||||
dump output is used as an actual zone file loaded by ``named``.
|
||||
Additionally, it applies stricter check levels by default, since the
|
||||
dump output will be used as an actual zone file loaded by ``named``.
|
||||
When manually specified otherwise, the check levels must at least be as
|
||||
strict as those specified in the ``named`` configuration file.
|
||||
|
||||
Options
|
||||
~~~~~~~
|
||||
|
||||
``-d``
|
||||
This option enables debugging.
|
||||
**-d**
|
||||
Enable debugging.
|
||||
|
||||
``-h``
|
||||
This option prints the usage summary and exits.
|
||||
**-h**
|
||||
Print the usage summary and exit.
|
||||
|
||||
``-q``
|
||||
This option sets quiet mode, which only sets an exit code to indicate
|
||||
successful or failed completion.
|
||||
**-q**
|
||||
Quiet mode - exit code only.
|
||||
|
||||
``-v``
|
||||
This option prints the version of the ``named-checkzone`` program and exits.
|
||||
**-v**
|
||||
Print the version of the ``named-checkzone`` program and exit.
|
||||
|
||||
``-j``
|
||||
When loading a zone file, this option tells ``named`` to read the journal if it exists. The journal
|
||||
file name is assumed to be the zone file name with the
|
||||
string ``.jnl`` appended.
|
||||
**-j**
|
||||
When loading a zone file, read the journal if it exists. The journal
|
||||
file name is assumed to be the zone file name appended with the
|
||||
string ``.jnl``.
|
||||
|
||||
``-J filename``
|
||||
When loading the zone file, this option tells ``named`` to read the journal from the given file, if
|
||||
it exists. This implies ``-j``.
|
||||
**-J** filename
|
||||
When loading the zone file read the journal from the given file, if
|
||||
it exists. (Implies -j.)
|
||||
|
||||
``-c class``
|
||||
This option specifies the class of the zone. If not specified, ``IN`` is assumed.
|
||||
**-c** class
|
||||
Specify the class of the zone. If not specified, "IN" is assumed.
|
||||
|
||||
``-i mode``
|
||||
This option performs post-load zone integrity checks. Possible modes are
|
||||
``full`` (the default), ``full-sibling``, ``local``,
|
||||
``local-sibling``, and ``none``.
|
||||
**-i** mode
|
||||
Perform post-load zone integrity checks. Possible modes are
|
||||
``"full"`` (default), ``"full-sibling"``, ``"local"``,
|
||||
``"local-sibling"`` and ``"none"``.
|
||||
|
||||
Mode ``full`` checks that MX records refer to A or AAAA records
|
||||
(both in-zone and out-of-zone hostnames). Mode ``local`` only
|
||||
Mode ``"full"`` checks that MX records refer to A or AAAA record
|
||||
(both in-zone and out-of-zone hostnames). Mode ``"local"`` only
|
||||
checks MX records which refer to in-zone hostnames.
|
||||
|
||||
Mode ``full`` checks that SRV records refer to A or AAAA records
|
||||
(both in-zone and out-of-zone hostnames). Mode ``local`` only
|
||||
Mode ``"full"`` checks that SRV records refer to A or AAAA record
|
||||
(both in-zone and out-of-zone hostnames). Mode ``"local"`` only
|
||||
checks SRV records which refer to in-zone hostnames.
|
||||
|
||||
Mode ``full`` checks that delegation NS records refer to A or AAAA
|
||||
records (both in-zone and out-of-zone hostnames). It also checks that
|
||||
Mode ``"full"`` checks that delegation NS records refer to A or AAAA
|
||||
record (both in-zone and out-of-zone hostnames). It also checks that
|
||||
glue address records in the zone match those advertised by the child.
|
||||
Mode ``local`` only checks NS records which refer to in-zone
|
||||
hostnames or verifies that some required glue exists, i.e., when the
|
||||
name server is in a child zone.
|
||||
Mode ``"local"`` only checks NS records which refer to in-zone
|
||||
hostnames or that some required glue exists, that is when the
|
||||
nameserver is in a child zone.
|
||||
|
||||
Modes ``full-sibling`` and ``local-sibling`` disable sibling glue
|
||||
checks, but are otherwise the same as ``full`` and ``local``,
|
||||
Mode ``"full-sibling"`` and ``"local-sibling"`` disable sibling glue
|
||||
checks but are otherwise the same as ``"full"`` and ``"local"``
|
||||
respectively.
|
||||
|
||||
Mode ``none`` disables the checks.
|
||||
Mode ``"none"`` disables the checks.
|
||||
|
||||
``-f format``
|
||||
This option specifies the format of the zone file. Possible formats are ``text``
|
||||
(the default), ``raw``, and ``map``.
|
||||
**-f** format
|
||||
Specify the format of the zone file. Possible formats are ``"text"``
|
||||
(default), ``"raw"``, and ``"map"``.
|
||||
|
||||
``-F format``
|
||||
This option specifies the format of the output file specified. For
|
||||
``named-checkzone``, this does not have any effect unless it dumps
|
||||
**-F** format
|
||||
Specify the format of the output file specified. For
|
||||
``named-checkzone``, this does not cause any effects unless it dumps
|
||||
the zone contents.
|
||||
|
||||
Possible formats are ``text`` (the default), which is the standard
|
||||
textual representation of the zone, and ``map``, ``raw``, and
|
||||
``raw=N``, which store the zone in a binary format for rapid
|
||||
loading by ``named``. ``raw=N`` specifies the format version of the
|
||||
raw zone file: if ``N`` is 0, the raw file can be read by any version of
|
||||
``named``; if N is 1, the file can only be read by release 9.9.0 or
|
||||
higher. The default is 1.
|
||||
Possible formats are ``"text"`` (default), which is the standard
|
||||
textual representation of the zone, and ``"map"``, ``"raw"``, and
|
||||
``"raw=N"``, which store the zone in a binary format for rapid
|
||||
loading by ``named``. ``"raw=N"`` specifies the format version of the
|
||||
raw zone file: if N is 0, the raw file can be read by any version of
|
||||
``named``; if N is 1, the file can be read by release 9.9.0 or
|
||||
higher; the default is 1.
|
||||
|
||||
``-k mode``
|
||||
This option performs ``check-names`` checks with the specified failure mode.
|
||||
Possible modes are ``fail`` (the default for ``named-compilezone``),
|
||||
``warn`` (the default for ``named-checkzone``), and ``ignore``.
|
||||
**-k** mode
|
||||
Perform ``"check-names"`` checks with the specified failure mode.
|
||||
Possible modes are ``"fail"`` (default for ``named-compilezone``),
|
||||
``"warn"`` (default for ``named-checkzone``) and ``"ignore"``.
|
||||
|
||||
``-l ttl``
|
||||
This option sets a maximum permissible TTL for the input file. Any record with a
|
||||
TTL higher than this value causes the zone to be rejected. This
|
||||
**-l** ttl
|
||||
Sets a maximum permissible TTL for the input file. Any record with a
|
||||
TTL higher than this value will cause the zone to be rejected. This
|
||||
is similar to using the ``max-zone-ttl`` option in ``named.conf``.
|
||||
|
||||
``-L serial``
|
||||
When compiling a zone to ``raw`` or ``map`` format, this option sets the "source
|
||||
serial" value in the header to the specified serial number. This is
|
||||
expected to be used primarily for testing purposes.
|
||||
**-L** serial
|
||||
When compiling a zone to "raw" or "map" format, set the "source
|
||||
serial" value in the header to the specified serial number. (This is
|
||||
expected to be used primarily for testing purposes.)
|
||||
|
||||
``-m mode``
|
||||
This option specifies whether MX records should be checked to see if they are
|
||||
addresses. Possible modes are ``fail``, ``warn`` (the default), and
|
||||
``ignore``.
|
||||
**-m** mode
|
||||
Specify whether MX records should be checked to see if they are
|
||||
addresses. Possible modes are ``"fail"``, ``"warn"`` (default) and
|
||||
``"ignore"``.
|
||||
|
||||
``-M mode``
|
||||
This option checks whether a MX record refers to a CNAME. Possible modes are
|
||||
``fail``, ``warn`` (the default), and ``ignore``.
|
||||
**-M** mode
|
||||
Check if a MX record refers to a CNAME. Possible modes are
|
||||
``"fail"``, ``"warn"`` (default) and ``"ignore"``.
|
||||
|
||||
``-n mode``
|
||||
This option specifies whether NS records should be checked to see if they are
|
||||
addresses. Possible modes are ``fail`` (the default for
|
||||
``named-compilezone``), ``warn`` (the default for ``named-checkzone``),
|
||||
and ``ignore``.
|
||||
**-n** mode
|
||||
Specify whether NS records should be checked to see if they are
|
||||
addresses. Possible modes are ``"fail"`` (default for
|
||||
``named-compilezone``), ``"warn"`` (default for ``named-checkzone``)
|
||||
and ``"ignore"``.
|
||||
|
||||
``-o filename``
|
||||
This option writes the zone output to ``filename``. If ``filename`` is ``-``, then
|
||||
the zone output is written to standard output. This is mandatory for ``named-compilezone``.
|
||||
**-o** filename
|
||||
Write zone output to ``filename``. If ``filename`` is ``-`` then
|
||||
write to standard out. This is mandatory for ``named-compilezone``.
|
||||
|
||||
``-r mode``
|
||||
This option checks for records that are treated as different by DNSSEC but are
|
||||
semantically equal in plain DNS. Possible modes are ``fail``,
|
||||
``warn`` (the default), and ``ignore``.
|
||||
**-r** mode
|
||||
Check for records that are treated as different by DNSSEC but are
|
||||
semantically equal in plain DNS. Possible modes are ``"fail"``,
|
||||
``"warn"`` (default) and ``"ignore"``.
|
||||
|
||||
``-s style``
|
||||
This option specifies the style of the dumped zone file. Possible styles are
|
||||
``full`` (the default) and ``relative``. The ``full`` format is most
|
||||
suitable for processing automatically by a separate script.
|
||||
The relative format is more human-readable and is thus
|
||||
suitable for editing by hand. For ``named-checkzone``, this does not
|
||||
have any effect unless it dumps the zone contents. It also does not
|
||||
**-s** style
|
||||
Specify the style of the dumped zone file. Possible styles are
|
||||
``"full"`` (default) and ``"relative"``. The full format is most
|
||||
suitable for processing automatically by a separate script. On the
|
||||
other hand, the relative format is more human-readable and is thus
|
||||
suitable for editing by hand. For ``named-checkzone`` this does not
|
||||
cause any effects unless it dumps the zone contents. It also does not
|
||||
have any meaning if the output format is not text.
|
||||
|
||||
``-S mode``
|
||||
This option checks whether an SRV record refers to a CNAME. Possible modes are
|
||||
``fail``, ``warn`` (the default), and ``ignore``.
|
||||
**-S** mode
|
||||
Check if a SRV record refers to a CNAME. Possible modes are
|
||||
``"fail"``, ``"warn"`` (default) and ``"ignore"``.
|
||||
|
||||
``-t directory``
|
||||
This option tells ``named`` to chroot to ``directory``, so that ``include`` directives in the
|
||||
**-t** directory
|
||||
Chroot to ``directory`` so that include directives in the
|
||||
configuration file are processed as if run by a similarly chrooted
|
||||
``named``.
|
||||
|
||||
``-T mode``
|
||||
This option checks whether Sender Policy Framework (SPF) records exist and issues a
|
||||
**-T** mode
|
||||
Check if Sender Policy Framework (SPF) records exist and issues a
|
||||
warning if an SPF-formatted TXT record is not also present. Possible
|
||||
modes are ``warn`` (the default) and ``ignore``.
|
||||
modes are ``"warn"`` (default), ``"ignore"``.
|
||||
|
||||
``-w directory``
|
||||
This option instructs ``named`` to chdir to ``directory``, so that relative filenames in master file
|
||||
``$INCLUDE`` directives work. This is similar to the directory clause in
|
||||
**-w** directory
|
||||
chdir to ``directory`` so that relative filenames in master file
|
||||
$INCLUDE directives work. This is similar to the directory clause in
|
||||
``named.conf``.
|
||||
|
||||
``-D``
|
||||
This option dumps the zone file in canonical format. This is always enabled for
|
||||
**-D**
|
||||
Dump zone file in canonical format. This is always enabled for
|
||||
``named-compilezone``.
|
||||
|
||||
``-W mode``
|
||||
This option specifies whether to check for non-terminal wildcards. Non-terminal
|
||||
**-W** mode
|
||||
Specify whether to check for non-terminal wildcards. Non-terminal
|
||||
wildcards are almost always the result of a failure to understand the
|
||||
wildcard matching algorithm (:rfc:`1034`). Possible modes are ``warn``
|
||||
(the default) and ``ignore``.
|
||||
wildcard matching algorithm (:rfc:`1034`). Possible modes are ``"warn"``
|
||||
(default) and ``"ignore"``.
|
||||
|
||||
``zonename``
|
||||
This indicates the domain name of the zone being checked.
|
||||
zonename
|
||||
The domain name of the zone being checked.
|
||||
|
||||
``filename``
|
||||
This is the name of the zone file.
|
||||
filename
|
||||
The name of the zone file.
|
||||
|
||||
Return Values
|
||||
~~~~~~~~~~~~~
|
||||
|
||||
@@ -77,7 +77,7 @@
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\isccc\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);..\..\..\lib\ns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;libbind9.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;libbind9.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
|
||||
@@ -108,7 +108,7 @@
|
||||
<OptimizeReferences>true</OptimizeReferences>
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\isccc\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);..\..\..\lib\ns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;libbind9.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;libbind9.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
|
||||
@@ -77,7 +77,7 @@
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\ns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
</Link>
|
||||
<PostBuildEvent>
|
||||
<Command>cd ..\..\..\Build\$(Configuration)
|
||||
@@ -114,7 +114,7 @@ copy /Y named-checkzone.ilk named-compilezone.ilk
|
||||
<OptimizeReferences>true</OptimizeReferences>
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\ns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
|
||||
</Link>
|
||||
<PostBuildEvent>
|
||||
|
||||
@@ -20,11 +20,11 @@ libconfgen_la_SOURCES = \
|
||||
util.c \
|
||||
unix/os.c
|
||||
|
||||
sbin_PROGRAMS = tsig-keygen rndc-confgen
|
||||
sbin_PROGRAMS = ddns-confgen rndc-confgen
|
||||
|
||||
install-exec-hook:
|
||||
ln -f $(DESTDIR)$(sbindir)/tsig-keygen \
|
||||
$(DESTDIR)$(sbindir)/ddns-confgen
|
||||
ln -f $(DESTDIR)$(sbindir)/ddns-confgen \
|
||||
$(DESTDIR)$(sbindir)/tsig-confgen
|
||||
|
||||
uninstall-hook:
|
||||
-rm -f $(DESTDIR)$(sbindir)/ddns-confgen
|
||||
-rm -f $(DESTDIR)$(sbindir)/tsig-confgen
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
@@ -12,8 +12,9 @@
|
||||
/*! \file */
|
||||
|
||||
/**
|
||||
* tsig-keygen generates TSIG keys that can be used in named configuration
|
||||
* files for dynamic DNS.
|
||||
* ddns-confgen generates configuration files for dynamic DNS. It can
|
||||
* be used as a convenient alternative to writing the ddns.key file
|
||||
* and the corresponding key and update-policy statements in named.conf.
|
||||
*/
|
||||
|
||||
#include <stdarg.h>
|
||||
@@ -0,0 +1,103 @@
|
||||
..
|
||||
Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
||||
|
||||
This Source Code Form is subject to the terms of the Mozilla Public
|
||||
License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
|
||||
See the COPYRIGHT file distributed with this work for additional
|
||||
information regarding copyright ownership.
|
||||
|
||||
..
|
||||
Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
||||
|
||||
This Source Code Form is subject to the terms of the Mozilla Public
|
||||
License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
|
||||
See the COPYRIGHT file distributed with this work for additional
|
||||
information regarding copyright ownership.
|
||||
|
||||
|
||||
.. highlight: console
|
||||
|
||||
.. _man_ddns-confgen:
|
||||
|
||||
ddns-confgen - ddns key generation tool
|
||||
---------------------------------------
|
||||
|
||||
Synopsis
|
||||
~~~~~~~~
|
||||
:program:`tsig-keygen` [**-a** algorithm] [**-h**] [**-r** randomfile] [**-s** name]
|
||||
|
||||
:program:`ddns-confgen` [**-a** algorithm] [**-h**] [**-k** keyname] [**-q**] [**-r** randomfile] [**-s** name] [**-z** zone]
|
||||
|
||||
Description
|
||||
~~~~~~~~~~~
|
||||
|
||||
``tsig-keygen`` and ``ddns-confgen`` are invocation methods for a
|
||||
utility that generates keys for use in TSIG signing. The resulting keys
|
||||
can be used, for example, to secure dynamic DNS updates to a zone or for
|
||||
the ``rndc`` command channel.
|
||||
|
||||
When run as ``tsig-keygen``, a domain name can be specified on the
|
||||
command line which will be used as the name of the generated key. If no
|
||||
name is specified, the default is ``tsig-key``.
|
||||
|
||||
When run as ``ddns-confgen``, the generated key is accompanied by
|
||||
configuration text and instructions that can be used with ``nsupdate``
|
||||
and ``named`` when setting up dynamic DNS, including an example
|
||||
``update-policy`` statement. (This usage similar to the ``rndc-confgen``
|
||||
command for setting up command channel security.)
|
||||
|
||||
Note that ``named`` itself can configure a local DDNS key for use with
|
||||
``nsupdate -l``: it does this when a zone is configured with
|
||||
``update-policy local;``. ``ddns-confgen`` is only needed when a more
|
||||
elaborate configuration is required: for instance, if ``nsupdate`` is to
|
||||
be used from a remote system.
|
||||
|
||||
Options
|
||||
~~~~~~~
|
||||
|
||||
**-a** algorithm
|
||||
Specifies the algorithm to use for the TSIG key. Available choices
|
||||
are: hmac-md5, hmac-sha1, hmac-sha224, hmac-sha256, hmac-sha384 and
|
||||
hmac-sha512. The default is hmac-sha256. Options are
|
||||
case-insensitive, and the "hmac-" prefix may be omitted.
|
||||
|
||||
**-h**
|
||||
Prints a short summary of options and arguments.
|
||||
|
||||
**-k** keyname
|
||||
Specifies the key name of the DDNS authentication key. The default is
|
||||
``ddns-key`` when neither the ``-s`` nor ``-z`` option is specified;
|
||||
otherwise, the default is ``ddns-key`` as a separate label followed
|
||||
by the argument of the option, e.g., ``ddns-key.example.com.`` The
|
||||
key name must have the format of a valid domain name, consisting of
|
||||
letters, digits, hyphens and periods.
|
||||
|
||||
**-q**
|
||||
(``ddns-confgen`` only.) Quiet mode: Print only the key, with no
|
||||
explanatory text or usage examples; This is essentially identical to
|
||||
``tsig-keygen``.
|
||||
|
||||
**-s** name
|
||||
(``ddns-confgen`` only.) Generate configuration example to allow
|
||||
dynamic updates of a single hostname. The example ``named.conf`` text
|
||||
shows how to set an update policy for the specified name using the
|
||||
"name" nametype. The default key name is ddns-key.name. Note that the
|
||||
"self" nametype cannot be used, since the name to be updated may
|
||||
differ from the key name. This option cannot be used with the ``-z``
|
||||
option.
|
||||
|
||||
**-z** zone
|
||||
(``ddns-confgen`` only.) Generate configuration example to allow
|
||||
dynamic updates of a zone: The example ``named.conf`` text shows how
|
||||
to set an update policy for the specified zone using the "zonesub"
|
||||
nametype, allowing updates to all subdomain names within that zone.
|
||||
This option cannot be used with the ``-s`` option.
|
||||
|
||||
See Also
|
||||
~~~~~~~~
|
||||
|
||||
:manpage:`nsupdate(1)`, :manpage:`named.conf(5)`, :manpage:`named(8)`, BIND 9 Administrator Reference Manual.
|
||||
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
|
||||
This Source Code Form is subject to the terms of the Mozilla Public
|
||||
License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
|
||||
See the COPYRIGHT file distributed with this work for additional
|
||||
information regarding copyright ownership.
|
||||
@@ -41,75 +41,79 @@ by hand. Alternatively, it can be run with the ``-a`` option to set up a
|
||||
``rndc.key`` file and avoid the need for a ``rndc.conf`` file and a
|
||||
``controls`` statement altogether.
|
||||
|
||||
Options
|
||||
~~~~~~~
|
||||
Arguments
|
||||
~~~~~~~~~
|
||||
|
||||
``-a``
|
||||
This option sets automatic ``rndc`` configuration, which creates a file ``rndc.key``
|
||||
in ``/etc`` (or a different ``sysconfdir`` specified when BIND
|
||||
**-a**
|
||||
Do automatic ``rndc`` configuration. This creates a file ``rndc.key``
|
||||
in ``/etc`` (or whatever ``sysconfdir`` was specified as when BIND
|
||||
was built) that is read by both ``rndc`` and ``named`` on startup.
|
||||
The ``rndc.key`` file defines a default command channel and
|
||||
authentication key allowing ``rndc`` to communicate with ``named`` on
|
||||
the local host with no further configuration.
|
||||
|
||||
Running ``rndc-confgen -a`` allows BIND 9 and ``rndc`` to be used as
|
||||
drop-in replacements for BIND 8 and ``ndc``, with no changes to the
|
||||
existing BIND 8 ``named.conf`` file.
|
||||
|
||||
If a more elaborate configuration than that generated by
|
||||
``rndc-confgen -a`` is required, for example if rndc is to be used
|
||||
remotely, run ``rndc-confgen`` without the ``-a`` option
|
||||
and set up ``rndc.conf`` and ``named.conf`` as directed.
|
||||
remotely, you should run ``rndc-confgen`` without the ``-a`` option
|
||||
and set up a ``rndc.conf`` and ``named.conf`` as directed.
|
||||
|
||||
``-A algorithm``
|
||||
This option specifies the algorithm to use for the TSIG key. Available choices
|
||||
are: hmac-md5, hmac-sha1, hmac-sha224, hmac-sha256, hmac-sha384, and
|
||||
**-A** algorithm
|
||||
Specifies the algorithm to use for the TSIG key. Available choices
|
||||
are: hmac-md5, hmac-sha1, hmac-sha224, hmac-sha256, hmac-sha384 and
|
||||
hmac-sha512. The default is hmac-sha256.
|
||||
|
||||
``-b keysize``
|
||||
This option specifies the size of the authentication key in bits. The size must be between
|
||||
**-b** keysize
|
||||
Specifies the size of the authentication key in bits. Must be between
|
||||
1 and 512 bits; the default is the hash size.
|
||||
|
||||
``-c keyfile``
|
||||
This option is used with the ``-a`` option to specify an alternate location for
|
||||
**-c** keyfile
|
||||
Used with the ``-a`` option to specify an alternate location for
|
||||
``rndc.key``.
|
||||
|
||||
``-h``
|
||||
This option prints a short summary of the options and arguments to
|
||||
**-h**
|
||||
Prints a short summary of the options and arguments to
|
||||
``rndc-confgen``.
|
||||
|
||||
``-k keyname``
|
||||
This option specifies the key name of the ``rndc`` authentication key. This must be a
|
||||
**-k** keyname
|
||||
Specifies the key name of the rndc authentication key. This must be a
|
||||
valid domain name. The default is ``rndc-key``.
|
||||
|
||||
``-p port``
|
||||
This option specifies the command channel port where ``named`` listens for
|
||||
**-p** port
|
||||
Specifies the command channel port where ``named`` listens for
|
||||
connections from ``rndc``. The default is 953.
|
||||
|
||||
``-q``
|
||||
This option prevets printing the written path in automatic configuration mode.
|
||||
**-q**
|
||||
Omits printing written path in automatic configuration mode.
|
||||
|
||||
``-s address``
|
||||
This option specifies the IP address where ``named`` listens for command-channel
|
||||
**-s** address
|
||||
Specifies the IP address where ``named`` listens for command channel
|
||||
connections from ``rndc``. The default is the loopback address
|
||||
127.0.0.1.
|
||||
|
||||
``-t chrootdir``
|
||||
This option is used with the ``-a`` option to specify a directory where ``named``
|
||||
runs chrooted. An additional copy of the ``rndc.key`` is
|
||||
written relative to this directory, so that it is found by the
|
||||
**-t** chrootdir
|
||||
Used with the ``-a`` option to specify a directory where ``named``
|
||||
will run chrooted. An additional copy of the ``rndc.key`` will be
|
||||
written relative to this directory so that it will be found by the
|
||||
chrooted ``named``.
|
||||
|
||||
``-u user``
|
||||
This option is used with the ``-a`` option to set the owner of the generated ``rndc.key`` file.
|
||||
If ``-t`` is also specified, only the file in the chroot
|
||||
**-u** user
|
||||
Used with the ``-a`` option to set the owner of the ``rndc.key`` file
|
||||
generated. If ``-t`` is also specified only the file in the chroot
|
||||
area has its owner changed.
|
||||
|
||||
Examples
|
||||
~~~~~~~~
|
||||
|
||||
To allow ``rndc`` to be used with no manual configuration, run:
|
||||
To allow ``rndc`` to be used with no manual configuration, run
|
||||
|
||||
``rndc-confgen -a``
|
||||
|
||||
To print a sample ``rndc.conf`` file and the corresponding ``controls`` and
|
||||
``key`` statements to be manually inserted into ``named.conf``, run:
|
||||
To print a sample ``rndc.conf`` file and corresponding ``controls`` and
|
||||
``key`` statements to be manually inserted into ``named.conf``, run
|
||||
|
||||
``rndc-confgen``
|
||||
|
||||
|
||||
@@ -1,101 +0,0 @@
|
||||
..
|
||||
Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
||||
|
||||
This Source Code Form is subject to the terms of the Mozilla Public
|
||||
License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
|
||||
See the COPYRIGHT file distributed with this work for additional
|
||||
information regarding copyright ownership.
|
||||
|
||||
..
|
||||
Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
||||
|
||||
This Source Code Form is subject to the terms of the Mozilla Public
|
||||
License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
|
||||
See the COPYRIGHT file distributed with this work for additional
|
||||
information regarding copyright ownership.
|
||||
|
||||
|
||||
.. highlight: console
|
||||
|
||||
tsig-keygen, ddns-confgen - TSIG key generation tool
|
||||
----------------------------------------------------
|
||||
|
||||
Synopsis
|
||||
~~~~~~~~
|
||||
:program:`tsig-keygen` [**-a** algorithm] [**-h**] [**-r** randomfile] [name]
|
||||
|
||||
:program:`ddns-confgen` [**-a** algorithm] [**-h**] [**-k** keyname] [**-q**] [**-r** randomfile] [**-s** name] [**-z** zone]
|
||||
|
||||
Description
|
||||
~~~~~~~~~~~
|
||||
|
||||
``tsig-keygen`` and ``ddns-confgen`` are invocation methods for a
|
||||
utility that generates keys for use in TSIG signing. The resulting keys
|
||||
can be used, for example, to secure dynamic DNS updates to a zone, or for
|
||||
the ``rndc`` command channel.
|
||||
|
||||
When run as ``tsig-keygen``, a domain name can be specified on the
|
||||
command line to be used as the name of the generated key. If no
|
||||
name is specified, the default is ``tsig-key``.
|
||||
|
||||
When run as ``ddns-confgen``, the key name can specified using ``-k``
|
||||
parameter and defaults to ``ddns-key``. The generated key is accompanied
|
||||
by configuration text and instructions that can be used with ``nsupdate``
|
||||
and ``named`` when setting up dynamic DNS, including an example
|
||||
``update-policy`` statement. (This usage is similar to the ``rndc-confgen``
|
||||
command for setting up command-channel security.)
|
||||
|
||||
Note that ``named`` itself can configure a local DDNS key for use with
|
||||
``nsupdate -l``; it does this when a zone is configured with
|
||||
``update-policy local;``. ``ddns-confgen`` is only needed when a more
|
||||
elaborate configuration is required: for instance, if ``nsupdate`` is to
|
||||
be used from a remote system.
|
||||
|
||||
Options
|
||||
~~~~~~~
|
||||
|
||||
``-a algorithm``
|
||||
This option specifies the algorithm to use for the TSIG key. Available
|
||||
choices are: hmac-md5, hmac-sha1, hmac-sha224, hmac-sha256, hmac-sha384,
|
||||
and hmac-sha512. The default is hmac-sha256. Options are
|
||||
case-insensitive, and the "hmac-" prefix may be omitted.
|
||||
|
||||
``-h``
|
||||
This option prints a short summary of options and arguments.
|
||||
|
||||
``-k keyname``
|
||||
This option specifies the key name of the DDNS authentication key. The
|
||||
default is ``ddns-key`` when neither the ``-s`` nor ``-z`` option is
|
||||
specified; otherwise, the default is ``ddns-key`` as a separate label
|
||||
followed by the argument of the option, e.g., ``ddns-key.example.com.``
|
||||
The key name must have the format of a valid domain name, consisting of
|
||||
letters, digits, hyphens, and periods.
|
||||
|
||||
``-q`` (``ddns-confgen`` only)
|
||||
This option enables quiet mode, which prints only the key, with no
|
||||
explanatory text or usage examples. This is essentially identical to
|
||||
``tsig-keygen``.
|
||||
|
||||
``-s name`` (``ddns-confgen`` only)
|
||||
This option generates a configuration example to allow dynamic updates
|
||||
of a single hostname. The example ``named.conf`` text shows how to set
|
||||
an update policy for the specified name using the "name" nametype. The
|
||||
default key name is ``ddns-key.name``. Note that the "self" nametype
|
||||
cannot be used, since the name to be updated may differ from the key
|
||||
name. This option cannot be used with the ``-z`` option.
|
||||
|
||||
``-z zone`` (``ddns-confgen`` only)
|
||||
This option generates a configuration example to allow
|
||||
dynamic updates of a zone. The example ``named.conf`` text shows how
|
||||
to set an update policy for the specified zone using the "zonesub"
|
||||
nametype, allowing updates to all subdomain names within that zone.
|
||||
This option cannot be used with the ``-s`` option.
|
||||
|
||||
See Also
|
||||
~~~~~~~~
|
||||
|
||||
:manpage:`nsupdate(1)`, :manpage:`named.conf(5)`, :manpage:`named(8)`, BIND 9 Administrator Reference Manual.
|
||||
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
|
||||
+1
-1
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
|
||||
+1
-1
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
|
||||
+2
-2
@@ -11,8 +11,8 @@
|
||||
</Filter>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClCompile Include="..\tsig-keygen.c">
|
||||
<ClCompile Include="..\ddns-confgen.c">
|
||||
<Filter>Source Files</Filter>
|
||||
</ClCompile>
|
||||
</ItemGroup>
|
||||
</Project>
|
||||
</Project>
|
||||
@@ -13,7 +13,7 @@
|
||||
<PropertyGroup Label="Globals">
|
||||
<ProjectGuid>{1EA4FC64-F33B-4A50-970A-EA052BBE9CF1}</ProjectGuid>
|
||||
<Keyword>Win32Proj</Keyword>
|
||||
<RootNamespace>tsigkeygen</RootNamespace>
|
||||
<RootNamespace>ddnsconfgen</RootNamespace>
|
||||
@WINDOWS_TARGET_PLATFORM_VERSION@
|
||||
</PropertyGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
|
||||
@@ -45,14 +45,14 @@
|
||||
<OutDir>..\..\..\Build\$(Configuration)\</OutDir>
|
||||
<IntDir>.\$(Configuration)\</IntDir>
|
||||
<IntDirSharingDetected>None</IntDirSharingDetected>
|
||||
<TargetName>tsig-keygen</TargetName>
|
||||
<TargetName>ddns-confgen</TargetName>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
|
||||
<LinkIncremental>false</LinkIncremental>
|
||||
<OutDir>..\..\..\Build\$(Configuration)\</OutDir>
|
||||
<IntDir>.\$(Configuration)\</IntDir>
|
||||
<IntDirSharingDetected>None</IntDirSharingDetected>
|
||||
<TargetName>tsig-keygen</TargetName>
|
||||
<TargetName>ddns-confgen</TargetName>
|
||||
</PropertyGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'">
|
||||
<ClCompile>
|
||||
@@ -77,12 +77,12 @@
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@confgentool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@confgentool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
</Link>
|
||||
<PostBuildEvent>
|
||||
<Command>cd ..\..\..\Build\$(Configuration)
|
||||
copy /Y tsig-keygen.exe ddns-confgen.exe
|
||||
copy /Y tsig-keygen.ilk ddns-confgen.ilk
|
||||
copy /Y ddns-confgen.exe tsig-keygen.exe
|
||||
copy /Y ddns-confgen.ilk tsig-keygen.ilk
|
||||
</Command>
|
||||
</PostBuildEvent>
|
||||
</ItemDefinitionGroup>
|
||||
@@ -115,16 +115,16 @@ copy /Y tsig-keygen.ilk ddns-confgen.ilk
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
|
||||
<AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@confgentool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@confgentool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
</Link>
|
||||
<PostBuildEvent>
|
||||
<Command>cd ..\..\..\Build\$(Configuration)
|
||||
copy /Y tsig-keygen.exe ddns-confgen.exe
|
||||
copy /Y ddns-confgen.exe tsig-keygen.exe
|
||||
</Command>
|
||||
</PostBuildEvent>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemGroup>
|
||||
<ClCompile Include="..\tsig-keygen.c" />
|
||||
<ClCompile Include="..\ddns-confgen.c" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ProjectReference Include="..\..\..\lib\isc\win32\libisc.vcxproj">
|
||||
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
|
||||
@@ -77,7 +77,7 @@
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@confgentool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@confgentool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
|
||||
@@ -109,7 +109,7 @@
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
|
||||
<AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@confgentool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@confgentool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemGroup>
|
||||
|
||||
+21
-17
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
@@ -34,10 +34,8 @@
|
||||
#include <isc/hex.h>
|
||||
#include <isc/lib.h>
|
||||
#include <isc/log.h>
|
||||
#include <isc/managers.h>
|
||||
#include <isc/md.h>
|
||||
#include <isc/mem.h>
|
||||
#include <isc/netmgr.h>
|
||||
#ifdef WIN32
|
||||
#include <isc/ntpaths.h>
|
||||
#endif /* ifdef WIN32 */
|
||||
@@ -612,13 +610,11 @@ key_fromconfig(const cfg_obj_t *key, dns_client_t *client) {
|
||||
dns_name_t *keyname;
|
||||
isc_result_t result;
|
||||
bool match_root = false;
|
||||
enum {
|
||||
INITIAL_KEY,
|
||||
STATIC_KEY,
|
||||
INITIAL_DS,
|
||||
STATIC_DS,
|
||||
TRUSTED
|
||||
} anchortype;
|
||||
enum { INITIAL_KEY,
|
||||
STATIC_KEY,
|
||||
INITIAL_DS,
|
||||
STATIC_DS,
|
||||
TRUSTED } anchortype;
|
||||
const cfg_obj_t *obj;
|
||||
|
||||
keynamestr = cfg_obj_asstring(cfg_tuple_get(key, "name"));
|
||||
@@ -1738,7 +1734,6 @@ main(int argc, char *argv[]) {
|
||||
dns_namelist_t namelist;
|
||||
unsigned int resopt;
|
||||
isc_appctx_t *actx = NULL;
|
||||
isc_nm_t *netmgr = NULL;
|
||||
isc_taskmgr_t *taskmgr = NULL;
|
||||
isc_socketmgr_t *socketmgr = NULL;
|
||||
isc_timermgr_t *timermgr = NULL;
|
||||
@@ -1762,8 +1757,9 @@ main(int argc, char *argv[]) {
|
||||
isc_mem_create(&mctx);
|
||||
|
||||
CHECK(isc_appctx_create(mctx, &actx));
|
||||
isc_managers_create(mctx, 1, 0, 0, &netmgr, &taskmgr, &timermgr,
|
||||
&socketmgr);
|
||||
CHECK(isc_taskmgr_createinctx(mctx, 1, 0, &taskmgr));
|
||||
CHECK(isc_socketmgr_createinctx(mctx, &socketmgr));
|
||||
CHECK(isc_timermgr_createinctx(mctx, &timermgr));
|
||||
|
||||
parse_args(argc, argv);
|
||||
|
||||
@@ -1783,8 +1779,8 @@ main(int argc, char *argv[]) {
|
||||
#endif /* ifndef WIN32 */
|
||||
|
||||
/* Create client */
|
||||
result = dns_client_create(mctx, actx, taskmgr, socketmgr, timermgr, 0,
|
||||
&client, srcaddr4, srcaddr6);
|
||||
result = dns_client_createx(mctx, actx, taskmgr, socketmgr, timermgr, 0,
|
||||
&client, srcaddr4, srcaddr6);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
delv_log(ISC_LOG_ERROR, "dns_client_create: %s",
|
||||
isc_result_totext(result));
|
||||
@@ -1804,7 +1800,7 @@ main(int argc, char *argv[]) {
|
||||
CHECK(convert_name(&qfn, &query_name, qname));
|
||||
|
||||
/* Set up resolution options */
|
||||
resopt = DNS_CLIENTRESOPT_NOCDFLAG;
|
||||
resopt = DNS_CLIENTRESOPT_ALLOWRUN | DNS_CLIENTRESOPT_NOCDFLAG;
|
||||
if (no_sigs) {
|
||||
resopt |= DNS_CLIENTRESOPT_NODNSSEC;
|
||||
}
|
||||
@@ -1866,7 +1862,15 @@ cleanup:
|
||||
if (client != NULL) {
|
||||
dns_client_destroy(&client);
|
||||
}
|
||||
isc_managers_destroy(&netmgr, &taskmgr, &timermgr, &socketmgr);
|
||||
if (taskmgr != NULL) {
|
||||
isc_taskmgr_destroy(&taskmgr);
|
||||
}
|
||||
if (timermgr != NULL) {
|
||||
isc_timermgr_destroy(&timermgr);
|
||||
}
|
||||
if (socketmgr != NULL) {
|
||||
isc_socketmgr_destroy(&socketmgr);
|
||||
}
|
||||
if (actx != NULL) {
|
||||
isc_appctx_destroy(&actx);
|
||||
}
|
||||
|
||||
+90
-90
@@ -3,7 +3,7 @@
|
||||
|
||||
This Source Code Form is subject to the terms of the Mozilla Public
|
||||
License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
|
||||
See the COPYRIGHT file distributed with this work for additional
|
||||
information regarding copyright ownership.
|
||||
@@ -43,15 +43,15 @@ Description
|
||||
``delv`` is a tool for sending DNS queries and validating the results,
|
||||
using the same internal resolver and validator logic as ``named``.
|
||||
|
||||
``delv`` sends to a specified name server all queries needed to
|
||||
``delv`` will send to a specified name server all queries needed to
|
||||
fetch and validate the requested data; this includes the original
|
||||
requested query, subsequent queries to follow CNAME or DNAME chains,
|
||||
requested query, subsequent queries to follow CNAME or DNAME chains, and
|
||||
queries for DNSKEY, and DS records to establish a chain of trust for
|
||||
DNSSEC validation. It does not perform iterative resolution, but
|
||||
simulates the behavior of a name server configured for DNSSEC validating
|
||||
and forwarding.
|
||||
|
||||
By default, responses are validated using the built-in DNSSEC trust anchor
|
||||
By default, responses are validated using built-in DNSSEC trust anchor
|
||||
for the root zone ("."). Records returned by ``delv`` are either fully
|
||||
validated or were not signed. If validation fails, an explanation of the
|
||||
failure is included in the output; the validation process can be traced
|
||||
@@ -59,13 +59,13 @@ in detail. Because ``delv`` does not rely on an external server to carry
|
||||
out validation, it can be used to check the validity of DNS responses in
|
||||
environments where local name servers may not be trustworthy.
|
||||
|
||||
Unless it is told to query a specific name server, ``delv`` tries
|
||||
Unless it is told to query a specific name server, ``delv`` will try
|
||||
each of the servers listed in ``/etc/resolv.conf``. If no usable server
|
||||
addresses are found, ``delv`` sends queries to the localhost
|
||||
addresses are found, ``delv`` will send queries to the localhost
|
||||
addresses (127.0.0.1 for IPv4, ::1 for IPv6).
|
||||
|
||||
When no command-line arguments or options are given, ``delv``
|
||||
performs an NS query for "." (the root zone).
|
||||
When no command line arguments or options are given, ``delv`` will
|
||||
perform an NS query for "." (the root zone).
|
||||
|
||||
Simple Usage
|
||||
~~~~~~~~~~~~
|
||||
@@ -89,109 +89,109 @@ where:
|
||||
If no ``server`` argument is provided, ``delv`` consults
|
||||
``/etc/resolv.conf``; if an address is found there, it queries the
|
||||
name server at that address. If either of the ``-4`` or ``-6``
|
||||
options is in use, then only addresses for the corresponding
|
||||
transport are tried. If no usable addresses are found, ``delv``
|
||||
sends queries to the localhost addresses (127.0.0.1 for IPv4, ::1
|
||||
options are in use, then only addresses for the corresponding
|
||||
transport will be tried. If no usable addresses are found, ``delv``
|
||||
will send queries to the localhost addresses (127.0.0.1 for IPv4, ::1
|
||||
for IPv6).
|
||||
|
||||
``name``
|
||||
is the domain name to be looked up.
|
||||
|
||||
``type``
|
||||
indicates what type of query is required - ANY, A, MX, etc.
|
||||
indicates what type of query is required MDASH ANY, A, MX, etc.
|
||||
``type`` can be any valid query type. If no ``type`` argument is
|
||||
supplied, ``delv`` performs a lookup for an A record.
|
||||
supplied, ``delv`` will perform a lookup for an A record.
|
||||
|
||||
Options
|
||||
~~~~~~~
|
||||
|
||||
``-a anchor-file``
|
||||
This option specifies a file from which to read DNSSEC trust anchors. The default
|
||||
**-a** anchor-file
|
||||
Specifies a file from which to read DNSSEC trust anchors. The default
|
||||
is ``/etc/bind.keys``, which is included with BIND 9 and contains one
|
||||
or more trust anchors for the root zone (".").
|
||||
|
||||
Keys that do not match the root zone name are ignored. An alternate
|
||||
key name can be specified using the ``+root=NAME`` options.
|
||||
|
||||
Note: When reading the trust anchor file, ``delv`` treats ``trust-anchors``,
|
||||
``initial-key``, and ``static-key`` identically. That is, for a managed key,
|
||||
Note: When reading the trust anchor file, ``delv`` treat ``trust-anchors``
|
||||
``initial-key`` and ``static-key`` identically. That is, for a managed key,
|
||||
it is the *initial* key that is trusted; :rfc:`5011` key management is not
|
||||
supported. ``delv`` does not consult the managed-keys database maintained by
|
||||
``named``, which means that if either of the keys in ``/etc/bind.keys`` is
|
||||
revoked and rolled over, ``/etc/bind.keys`` must be updated to
|
||||
supported. ``delv`` will not consult the managed-keys database maintained by
|
||||
``named``. This means that if either of the keys in ``/etc/bind.keys`` is
|
||||
revoked and rolled over, it will be necessary to update ``/etc/bind.keys`` to
|
||||
use DNSSEC validation in ``delv``.
|
||||
|
||||
``-b address``
|
||||
This option sets the source IP address of the query to ``address``. This must be
|
||||
a valid address on one of the host's network interfaces, or ``0.0.0.0``,
|
||||
or ``::``. An optional source port may be specified by appending
|
||||
``#<port>``
|
||||
**-b** address
|
||||
Sets the source IP address of the query to ``address``. This must be
|
||||
a valid address on one of the host's network interfaces or "0.0.0.0"
|
||||
or "::". An optional source port may be specified by appending
|
||||
"#<port>"
|
||||
|
||||
``-c class``
|
||||
This option sets the query class for the requested data. Currently, only class
|
||||
**-c** class
|
||||
Sets the query class for the requested data. Currently, only class
|
||||
"IN" is supported in ``delv`` and any other value is ignored.
|
||||
|
||||
``-d level``
|
||||
This option sets the systemwide debug level to ``level``. The allowed range is
|
||||
**-d** level
|
||||
Set the systemwide debug level to ``level``. The allowed range is
|
||||
from 0 to 99. The default is 0 (no debugging). Debugging traces from
|
||||
``delv`` become more verbose as the debug level increases. See the
|
||||
``+mtrace``, ``+rtrace``, and ``+vtrace`` options below for
|
||||
additional debugging details.
|
||||
|
||||
``-h``
|
||||
This option displays the ``delv`` help usage output and exits.
|
||||
**-h**
|
||||
Display the ``delv`` help usage output and exit.
|
||||
|
||||
``-i``
|
||||
This option sets insecure mode, which disables internal DNSSEC validation. (Note,
|
||||
however, that this does not set the CD bit on upstream queries. If the
|
||||
server being queried is performing DNSSEC validation, then it does
|
||||
**-i**
|
||||
Insecure mode. This disables internal DNSSEC validation. (Note,
|
||||
however, this does not set the CD bit on upstream queries. If the
|
||||
server being queried is performing DNSSEC validation, then it will
|
||||
not return invalid data; this can cause ``delv`` to time out. When it
|
||||
is necessary to examine invalid data to debug a DNSSEC problem, use
|
||||
``dig +cd``.)
|
||||
|
||||
``-m``
|
||||
This option enables memory usage debugging.
|
||||
**-m**
|
||||
Enables memory usage debugging.
|
||||
|
||||
``-p port#``
|
||||
This option specifies a destination port to use for queries, instead of the
|
||||
standard DNS port number 53. This option is used with a name
|
||||
**-p** port#
|
||||
Specifies a destination port to use for queries instead of the
|
||||
standard DNS port number 53. This option would be used with a name
|
||||
server that has been configured to listen for queries on a
|
||||
non-standard port number.
|
||||
|
||||
``-q name``
|
||||
This option sets the query name to ``name``. While the query name can be
|
||||
specified without using the ``-q`` option, it is sometimes necessary to
|
||||
**-q** name
|
||||
Sets the query name to ``name``. While the query name can be
|
||||
specified without using the ``-q``, it is sometimes necessary to
|
||||
disambiguate names from types or classes (for example, when looking
|
||||
up the name "ns", which could be misinterpreted as the type NS, or
|
||||
"ch", which could be misinterpreted as class CH).
|
||||
|
||||
``-t type``
|
||||
This option sets the query type to ``type``, which can be any valid query type
|
||||
**-t** type
|
||||
Sets the query type to ``type``, which can be any valid query type
|
||||
supported in BIND 9 except for zone transfer types AXFR and IXFR. As
|
||||
with ``-q``, this is useful to distinguish query-name types or classes
|
||||
when they are ambiguous. It is sometimes necessary to disambiguate
|
||||
with ``-q``, this is useful to distinguish query name type or class
|
||||
when they are ambiguous. it is sometimes necessary to disambiguate
|
||||
names from types.
|
||||
|
||||
The default query type is "A", unless the ``-x`` option is supplied
|
||||
to indicate a reverse lookup, in which case it is "PTR".
|
||||
|
||||
``-v``
|
||||
This option prints the ``delv`` version and exits.
|
||||
**-v**
|
||||
Print the ``delv`` version and exit.
|
||||
|
||||
``-x addr``
|
||||
This option performs a reverse lookup, mapping an address to a name. ``addr``
|
||||
**-x** addr
|
||||
Performs a reverse lookup, mapping an addresses to a name. ``addr``
|
||||
is an IPv4 address in dotted-decimal notation, or a colon-delimited
|
||||
IPv6 address. When ``-x`` is used, there is no need to provide the
|
||||
``name`` or ``type`` arguments; ``delv`` automatically performs a
|
||||
``name`` or ``type`` arguments. ``delv`` automatically performs a
|
||||
lookup for a name like ``11.12.13.10.in-addr.arpa`` and sets the
|
||||
query type to PTR. IPv6 addresses are looked up using nibble format
|
||||
under the IP6.ARPA domain.
|
||||
|
||||
``-4``
|
||||
This option forces ``delv`` to only use IPv4.
|
||||
**-4**
|
||||
Forces ``delv`` to only use IPv4.
|
||||
|
||||
``-6``
|
||||
This option forces ``delv`` to only use IPv6.
|
||||
**-6**
|
||||
Forces ``delv`` to only use IPv6.
|
||||
|
||||
Query Options
|
||||
~~~~~~~~~~~~~
|
||||
@@ -206,122 +206,122 @@ assign values to options like the timeout interval. They have the form
|
||||
``+keyword=value``. The query options are:
|
||||
|
||||
``+[no]cdflag``
|
||||
This option controls whether to set the CD (checking disabled) bit in queries
|
||||
Controls whether to set the CD (checking disabled) bit in queries
|
||||
sent by ``delv``. This may be useful when troubleshooting DNSSEC
|
||||
problems from behind a validating resolver. A validating resolver
|
||||
blocks invalid responses, making it difficult to retrieve them
|
||||
for analysis. Setting the CD flag on queries causes the resolver
|
||||
will block invalid responses, making it difficult to retrieve them
|
||||
for analysis. Setting the CD flag on queries will cause the resolver
|
||||
to return invalid responses, which ``delv`` can then validate
|
||||
internally and report the errors in detail.
|
||||
|
||||
``+[no]class``
|
||||
This option controls whether to display the CLASS when printing a record. The
|
||||
Controls whether to display the CLASS when printing a record. The
|
||||
default is to display the CLASS.
|
||||
|
||||
``+[no]ttl``
|
||||
This option controls whether to display the TTL when printing a record. The
|
||||
Controls whether to display the TTL when printing a record. The
|
||||
default is to display the TTL.
|
||||
|
||||
``+[no]rtrace``
|
||||
This option toggles resolver fetch logging. This reports the name and type of each
|
||||
Toggle resolver fetch logging. This reports the name and type of each
|
||||
query sent by ``delv`` in the process of carrying out the resolution
|
||||
and validation process, including the original query
|
||||
and validation process: this includes including the original query
|
||||
and all subsequent queries to follow CNAMEs and to establish a chain
|
||||
of trust for DNSSEC validation.
|
||||
|
||||
This is equivalent to setting the debug level to 1 in the "resolver"
|
||||
logging category. Setting the systemwide debug level to 1 using the
|
||||
``-d`` option produces the same output, but affects other
|
||||
logging categories as well.
|
||||
``-d`` option will product the same output (but will affect other
|
||||
logging categories as well).
|
||||
|
||||
``+[no]mtrace``
|
||||
This option toggles message logging. This produces a detailed dump of the
|
||||
Toggle message logging. This produces a detailed dump of the
|
||||
responses received by ``delv`` in the process of carrying out the
|
||||
resolution and validation process.
|
||||
|
||||
This is equivalent to setting the debug level to 10 for the "packets"
|
||||
module of the "resolver" logging category. Setting the systemwide
|
||||
debug level to 10 using the ``-d`` option produces the same
|
||||
output, but affects other logging categories as well.
|
||||
debug level to 10 using the ``-d`` option will produce the same
|
||||
output (but will affect other logging categories as well).
|
||||
|
||||
``+[no]vtrace``
|
||||
This option toggles validation logging. This shows the internal process of the
|
||||
Toggle validation logging. This shows the internal process of the
|
||||
validator as it determines whether an answer is validly signed,
|
||||
unsigned, or invalid.
|
||||
|
||||
This is equivalent to setting the debug level to 3 for the
|
||||
"validator" module of the "dnssec" logging category. Setting the
|
||||
systemwide debug level to 3 using the ``-d`` option produces the
|
||||
same output, but affects other logging categories as well.
|
||||
systemwide debug level to 3 using the ``-d`` option will produce the
|
||||
same output (but will affect other logging categories as well).
|
||||
|
||||
``+[no]short``
|
||||
This option toggles between verbose and terse answers. The default is to print the answer in a
|
||||
Provide a terse answer. The default is to print the answer in a
|
||||
verbose form.
|
||||
|
||||
``+[no]comments``
|
||||
This option toggles the display of comment lines in the output. The default is to
|
||||
Toggle the display of comment lines in the output. The default is to
|
||||
print comments.
|
||||
|
||||
``+[no]rrcomments``
|
||||
This option toggles the display of per-record comments in the output (for example,
|
||||
Toggle the display of per-record comments in the output (for example,
|
||||
human-readable key information about DNSKEY records). The default is
|
||||
to print per-record comments.
|
||||
|
||||
``+[no]crypto``
|
||||
This option toggles the display of cryptographic fields in DNSSEC records. The
|
||||
contents of these fields are unnecessary to debug most DNSSEC
|
||||
Toggle the display of cryptographic fields in DNSSEC records. The
|
||||
contents of these field are unnecessary to debug most DNSSEC
|
||||
validation failures and removing them makes it easier to see the
|
||||
common failures. The default is to display the fields. When omitted,
|
||||
they are replaced by the string ``[omitted]`` or, in the DNSKEY case, the
|
||||
key ID is displayed as the replacement, e.g. ``[ key id = value ]``.
|
||||
common failures. The default is to display the fields. When omitted
|
||||
they are replaced by the string "[omitted]" or in the DNSKEY case the
|
||||
key id is displayed as the replacement, e.g. "[ key id = value ]".
|
||||
|
||||
``+[no]trust``
|
||||
This option controls whether to display the trust level when printing a record.
|
||||
Controls whether to display the trust level when printing a record.
|
||||
The default is to display the trust level.
|
||||
|
||||
``+[no]split[=W]``
|
||||
This option splits long hex- or base64-formatted fields in resource records into
|
||||
Split long hex- or base64-formatted fields in resource records into
|
||||
chunks of ``W`` characters (where ``W`` is rounded up to the nearest
|
||||
multiple of 4). ``+nosplit`` or ``+split=0`` causes fields not to be
|
||||
split at all. The default is 56 characters, or 44 characters when
|
||||
multiline mode is active.
|
||||
|
||||
``+[no]all``
|
||||
This option sets or clears the display options ``+[no]comments``,
|
||||
Set or clear the display options ``+[no]comments``,
|
||||
``+[no]rrcomments``, and ``+[no]trust`` as a group.
|
||||
|
||||
``+[no]multiline``
|
||||
This option prints long records (such as RRSIG, DNSKEY, and SOA records) in a
|
||||
Print long records (such as RRSIG, DNSKEY, and SOA records) in a
|
||||
verbose multi-line format with human-readable comments. The default
|
||||
is to print each record on a single line, to facilitate machine
|
||||
parsing of the ``delv`` output.
|
||||
|
||||
``+[no]dnssec``
|
||||
This option indicates whether to display RRSIG records in the ``delv`` output.
|
||||
Indicates whether to display RRSIG records in the ``delv`` output.
|
||||
The default is to do so. Note that (unlike in ``dig``) this does
|
||||
*not* control whether to request DNSSEC records or to
|
||||
*not* control whether to request DNSSEC records or whether to
|
||||
validate them. DNSSEC records are always requested, and validation
|
||||
always occurs unless suppressed by the use of ``-i`` or
|
||||
will always occur unless suppressed by the use of ``-i`` or
|
||||
``+noroot``.
|
||||
|
||||
``+[no]root[=ROOT]``
|
||||
This option indicates whether to perform conventional DNSSEC validation, and if so,
|
||||
Indicates whether to perform conventional DNSSEC validation, and if so,
|
||||
specifies the name of a trust anchor. The default is to validate using a
|
||||
trust anchor of "." (the root zone), for which there is a built-in key. If
|
||||
specifying a different trust anchor, then ``-a`` must be used to specify a
|
||||
file containing the key.
|
||||
|
||||
``+[no]tcp``
|
||||
This option controls whether to use TCP when sending queries. The default is to
|
||||
Controls whether to use TCP when sending queries. The default is to
|
||||
use UDP unless a truncated response has been received.
|
||||
|
||||
``+[no]unknownformat``
|
||||
This option prints all RDATA in unknown RR-type presentation format (:rfc:`3597`).
|
||||
Print all RDATA in unknown RR type presentation format (:rfc:`3597`).
|
||||
The default is to print RDATA for known types in the type's
|
||||
presentation format.
|
||||
|
||||
``+[no]yaml``
|
||||
This option prints response data in YAML format.
|
||||
Print response data in YAML format.
|
||||
|
||||
Files
|
||||
~~~~~
|
||||
|
||||
@@ -75,7 +75,7 @@
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<AdditionalLibraryDirectories>..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@libisc.lib;libdns.lib;libisccfg.lib;libirs.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@libisc.lib;libdns.lib;libisccfg.lib;libirs.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
|
||||
@@ -107,7 +107,7 @@
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
|
||||
<AdditionalLibraryDirectories>..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@libisc.lib;libdns.lib;libisccfg.lib;libirs.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@libisc.lib;libdns.lib;libisccfg.lib;libirs.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemGroup>
|
||||
|
||||
+3
-12
@@ -25,15 +25,6 @@ libdighost_la_SOURCES = \
|
||||
|
||||
bin_PROGRAMS = dig host nslookup
|
||||
|
||||
nslookup_CPPFLAGS = \
|
||||
$(AM_CPPFLAGS)
|
||||
|
||||
nslookup_LDADD = \
|
||||
$(LDADD)
|
||||
|
||||
if HAVE_READLINE
|
||||
nslookup_CPPFLAGS += \
|
||||
$(READLINE_CFLAGS)
|
||||
nslookup_LDADD += \
|
||||
$(READLINE_LIBS)
|
||||
endif HAVE_READLINE
|
||||
nslookup_LDADD = \
|
||||
$(LDADD) \
|
||||
$(READLINE_LIB)
|
||||
|
||||
+52
-279
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
@@ -30,7 +30,6 @@
|
||||
#include <pk11/site.h>
|
||||
|
||||
#include <dns/byaddr.h>
|
||||
#include <dns/dns64.h>
|
||||
#include <dns/fixedname.h>
|
||||
#include <dns/masterdump.h>
|
||||
#include <dns/message.h>
|
||||
@@ -186,7 +185,7 @@ help(void) {
|
||||
" +[no]besteffort (Try to parse even "
|
||||
"illegal "
|
||||
"messages)\n"
|
||||
" +bufsize[=###] (Set EDNS0 Max UDP packet "
|
||||
" +bufsize=### (Set EDNS0 Max UDP packet "
|
||||
"size)\n"
|
||||
" +[no]cdflag (Set checking disabled "
|
||||
"flag in query)\n"
|
||||
@@ -207,8 +206,6 @@ help(void) {
|
||||
" fields in records)\n"
|
||||
" +[no]defname (Use search list "
|
||||
"(+[no]search))\n"
|
||||
" +[no]dns64prefix (Get the DNS64 prefixes "
|
||||
"from ipv4only.arpa)\n"
|
||||
" +[no]dnssec (Request DNSSEC records)\n"
|
||||
" +domain=### (Set default domainname)\n"
|
||||
" +[no]dscp[=###] (Set the DSCP value to "
|
||||
@@ -228,10 +225,6 @@ help(void) {
|
||||
"SERVFAIL)\n"
|
||||
" +[no]header-only (Send query without a "
|
||||
"question section)\n"
|
||||
" +[no]https[=###] (DNS over HTTPS mode) "
|
||||
"[/]\n"
|
||||
" +[no]https-get (Use GET instead of "
|
||||
"default POST method\n"
|
||||
" +[no]identify (ID responders in short "
|
||||
"answers)\n"
|
||||
#ifdef HAVE_LIBIDN2
|
||||
@@ -294,7 +287,6 @@ help(void) {
|
||||
"(+[no]tcflag))\n"
|
||||
" +[no]tcp (TCP mode (+[no]vc))\n"
|
||||
" +timeout=### (Set query timeout) [5]\n"
|
||||
" +[no]tls (DNS over TLS mode)\n"
|
||||
" +[no]trace (Trace delegation down "
|
||||
"from root "
|
||||
"[+dnssec])\n"
|
||||
@@ -304,6 +296,9 @@ help(void) {
|
||||
"in records)\n"
|
||||
" +[no]ttlunits (Display TTLs in "
|
||||
"human-readable units)\n"
|
||||
" +[no]unexpected (Print replies from "
|
||||
"unexpected sources\n"
|
||||
" default=off)\n"
|
||||
" +[no]unknownformat (Print RDATA in RFC 3597 "
|
||||
"\"unknown\" "
|
||||
"format)\n"
|
||||
@@ -343,28 +338,13 @@ received(unsigned int bytes, isc_sockaddr_t *from, dig_query_t *query) {
|
||||
}
|
||||
|
||||
if (query->lookup->stats) {
|
||||
const char *proto;
|
||||
diff = isc_time_microdiff(&query->time_recv, &query->time_sent);
|
||||
if (query->lookup->use_usec) {
|
||||
printf(";; Query time: %ld usec\n", (long)diff);
|
||||
} else {
|
||||
printf(";; Query time: %ld msec\n", (long)diff / 1000);
|
||||
}
|
||||
if (query->lookup->tls_mode) {
|
||||
proto = "TLS";
|
||||
} else if (query->lookup->https_mode) {
|
||||
if (query->lookup->http_plain) {
|
||||
proto = "HTTP";
|
||||
} else {
|
||||
proto = "HTTPS";
|
||||
}
|
||||
} else if (query->lookup->tcp_mode) {
|
||||
proto = "TCP";
|
||||
} else {
|
||||
proto = "UDP";
|
||||
}
|
||||
printf(";; SERVER: %s(%s) (%s)\n", fromtext, query->userarg,
|
||||
proto);
|
||||
printf(";; SERVER: %s(%s)\n", fromtext, query->servname);
|
||||
time(&tnow);
|
||||
(void)localtime_r(&tnow, &tmnow);
|
||||
|
||||
@@ -486,50 +466,6 @@ say_message(dns_rdata_t *rdata, dig_query_t *query, isc_buffer_t *buf) {
|
||||
return (ISC_R_SUCCESS);
|
||||
}
|
||||
|
||||
/*%
|
||||
* short_form message print handler. Calls above say_message()
|
||||
*/
|
||||
static isc_result_t
|
||||
dns64prefix_answer(dns_message_t *msg, isc_buffer_t *buf) {
|
||||
dns_rdataset_t *rdataset = NULL;
|
||||
dns_fixedname_t fixed;
|
||||
dns_name_t *name;
|
||||
isc_result_t result;
|
||||
isc_netprefix_t prefix[10];
|
||||
size_t i, count = 10;
|
||||
|
||||
name = dns_fixedname_initname(&fixed);
|
||||
result = dns_name_fromstring(name, "ipv4only.arpa", 0, NULL);
|
||||
check_result(result, "dns_name_fromstring");
|
||||
|
||||
result = dns_message_findname(msg, DNS_SECTION_ANSWER, name,
|
||||
dns_rdatatype_aaaa, dns_rdatatype_none,
|
||||
NULL, &rdataset);
|
||||
if (result == DNS_R_NXDOMAIN || result == DNS_R_NXRRSET) {
|
||||
return (ISC_R_SUCCESS);
|
||||
} else if (result != ISC_R_SUCCESS) {
|
||||
return (result);
|
||||
}
|
||||
|
||||
result = dns_dns64_findprefix(rdataset, prefix, &count);
|
||||
if (result == ISC_R_NOTFOUND)
|
||||
return (ISC_R_SUCCESS);
|
||||
if (count > 10)
|
||||
count = 10;
|
||||
for (i = 0; i < count; i++) {
|
||||
result = isc_netaddr_totext(&prefix[i].addr, buf);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
return (result);
|
||||
}
|
||||
result = isc_buffer_printf(buf, "/%u\n", prefix[i].prefixlen);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
return (result);
|
||||
}
|
||||
}
|
||||
|
||||
return (ISC_R_SUCCESS);
|
||||
}
|
||||
|
||||
/*%
|
||||
* short_form message print handler. Calls above say_message()
|
||||
*/
|
||||
@@ -616,12 +552,9 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
|
||||
dns_master_style_t *style = NULL;
|
||||
unsigned int styleflags = 0;
|
||||
bool isquery = (msg == query->lookup->sendmsg);
|
||||
bool dns64prefix = query->lookup->dns64prefix;
|
||||
|
||||
UNUSED(msgbuf);
|
||||
|
||||
dig_idnsetup(query->lookup, true);
|
||||
|
||||
styleflags |= DNS_STYLEFLAG_REL_OWNER;
|
||||
if (yaml) {
|
||||
msg->indent.string = " ";
|
||||
@@ -681,16 +614,14 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
|
||||
check_result(result, "dns_master_stylecreate");
|
||||
|
||||
if (query->lookup->cmdline[0] != 0) {
|
||||
if (!short_form && !dns64prefix && printcmd) {
|
||||
if (!short_form && printcmd) {
|
||||
printf("%s", query->lookup->cmdline);
|
||||
}
|
||||
query->lookup->cmdline[0] = '\0';
|
||||
}
|
||||
debug("printmessage(%s %s %s)", headers ? "headers" : "noheaders",
|
||||
query->lookup->comments ? "comments" : "nocomments",
|
||||
short_form ? "short_form"
|
||||
: dns64prefix ? "dns64prefix_form"
|
||||
: "long_form");
|
||||
short_form ? "short_form" : "long_form");
|
||||
|
||||
flags = 0;
|
||||
if (!headers) {
|
||||
@@ -711,6 +642,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
|
||||
if (yaml) {
|
||||
enum { Q = 0x1, R = 0x2 }; /* Q:query; R:ecursive */
|
||||
unsigned int tflag = 0;
|
||||
isc_sockaddr_t saddr;
|
||||
char sockstr[ISC_SOCKADDR_FORMATSIZE];
|
||||
uint16_t sport;
|
||||
char *hash;
|
||||
@@ -743,25 +675,15 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
|
||||
|
||||
if (!isc_time_isepoch(&query->time_sent)) {
|
||||
char tbuf[100];
|
||||
if (query->lookup->use_usec) {
|
||||
isc_time_formatISO8601us(&query->time_sent,
|
||||
tbuf, sizeof(tbuf));
|
||||
} else {
|
||||
isc_time_formatISO8601ms(&query->time_sent,
|
||||
tbuf, sizeof(tbuf));
|
||||
}
|
||||
isc_time_formatISO8601ms(&query->time_sent, tbuf,
|
||||
sizeof(tbuf));
|
||||
printf(" query_time: !!timestamp %s\n", tbuf);
|
||||
}
|
||||
|
||||
if (!isquery && !isc_time_isepoch(&query->time_recv)) {
|
||||
char tbuf[100];
|
||||
if (query->lookup->use_usec) {
|
||||
isc_time_formatISO8601us(&query->time_recv,
|
||||
tbuf, sizeof(tbuf));
|
||||
} else {
|
||||
isc_time_formatISO8601ms(&query->time_recv,
|
||||
tbuf, sizeof(tbuf));
|
||||
}
|
||||
isc_time_formatISO8601ms(&query->time_recv, tbuf,
|
||||
sizeof(tbuf));
|
||||
printf(" response_time: !!timestamp %s\n", tbuf);
|
||||
}
|
||||
|
||||
@@ -791,9 +713,10 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
|
||||
printf(" response_port: %u\n", sport);
|
||||
}
|
||||
|
||||
if (query->handle != NULL) {
|
||||
isc_sockaddr_t saddr =
|
||||
isc_nmhandle_localaddr(query->handle);
|
||||
if (query->sock != NULL &&
|
||||
isc_socket_getsockname(query->sock, &saddr) ==
|
||||
ISC_R_SUCCESS)
|
||||
{
|
||||
sport = isc_sockaddr_getport(&saddr);
|
||||
isc_sockaddr_format(&saddr, sockstr, sizeof(sockstr));
|
||||
hash = strchr(sockstr, '#');
|
||||
@@ -811,7 +734,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
|
||||
printf(" %s:\n", isquery ? "query_message_data"
|
||||
: "response_message_data");
|
||||
result = dns_message_headertotext(msg, style, flags, buf);
|
||||
} else if (query->lookup->comments && !short_form && !dns64prefix) {
|
||||
} else if (query->lookup->comments && !short_form) {
|
||||
if (query->lookup->cmdline[0] != '\0' && printcmd) {
|
||||
printf("; %s\n", query->lookup->cmdline);
|
||||
}
|
||||
@@ -892,7 +815,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
|
||||
|
||||
repopulate_buffer:
|
||||
|
||||
if (query->lookup->comments && headers && !short_form && !dns64prefix) {
|
||||
if (query->lookup->comments && headers && !short_form) {
|
||||
result = dns_message_pseudosectiontotext(
|
||||
msg, DNS_PSEUDOSECTION_OPT, style, flags, buf);
|
||||
if (result == ISC_R_NOSPACE) {
|
||||
@@ -906,7 +829,7 @@ repopulate_buffer:
|
||||
}
|
||||
|
||||
if (query->lookup->section_question && headers) {
|
||||
if (!short_form && !dns64prefix) {
|
||||
if (!short_form) {
|
||||
result = dns_message_sectiontotext(
|
||||
msg, DNS_SECTION_QUESTION, style, flags, buf);
|
||||
if (result == ISC_R_NOSPACE) {
|
||||
@@ -916,18 +839,13 @@ repopulate_buffer:
|
||||
}
|
||||
}
|
||||
if (query->lookup->section_answer) {
|
||||
if (!short_form && !dns64prefix) {
|
||||
if (!short_form) {
|
||||
result = dns_message_sectiontotext(
|
||||
msg, DNS_SECTION_ANSWER, style, flags, buf);
|
||||
if (result == ISC_R_NOSPACE) {
|
||||
goto buftoosmall;
|
||||
}
|
||||
check_result(result, "dns_message_sectiontotext");
|
||||
} else if (dns64prefix) {
|
||||
result = dns64prefix_answer(msg, buf);
|
||||
if (result == ISC_R_NOSPACE)
|
||||
goto buftoosmall;
|
||||
check_result(result, "dns64prefix_answer");
|
||||
} else {
|
||||
result = short_answer(msg, flags, buf, query);
|
||||
if (result == ISC_R_NOSPACE) {
|
||||
@@ -937,7 +855,7 @@ repopulate_buffer:
|
||||
}
|
||||
}
|
||||
if (query->lookup->section_authority) {
|
||||
if (!short_form && !dns64prefix) {
|
||||
if (!short_form) {
|
||||
result = dns_message_sectiontotext(
|
||||
msg, DNS_SECTION_AUTHORITY, style, flags, buf);
|
||||
if (result == ISC_R_NOSPACE) {
|
||||
@@ -947,7 +865,7 @@ repopulate_buffer:
|
||||
}
|
||||
}
|
||||
if (query->lookup->section_additional) {
|
||||
if (!short_form && !dns64prefix) {
|
||||
if (!short_form) {
|
||||
result = dns_message_sectiontotext(
|
||||
msg, DNS_SECTION_ADDITIONAL, style, flags, buf);
|
||||
if (result == ISC_R_NOSPACE) {
|
||||
@@ -989,9 +907,6 @@ repopulate_buffer:
|
||||
if (style != NULL) {
|
||||
dns_master_styledestroy(&style, mctx);
|
||||
}
|
||||
|
||||
dig_idnsetup(query->lookup, false);
|
||||
|
||||
return (result);
|
||||
}
|
||||
|
||||
@@ -1041,9 +956,8 @@ printgreeting(int argc, char **argv, dig_lookup_t *lookup) {
|
||||
* XXX doc options
|
||||
*/
|
||||
|
||||
static dig_lookup_t *
|
||||
plus_option(char *option, bool is_batchfile, bool *need_clone,
|
||||
dig_lookup_t *lookup) {
|
||||
static void
|
||||
plus_option(char *option, bool is_batchfile, dig_lookup_t *lookup) {
|
||||
isc_result_t result;
|
||||
char *cmd, *value, *last = NULL, *code, *extra;
|
||||
uint32_t num;
|
||||
@@ -1054,7 +968,7 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
|
||||
|
||||
if ((cmd = strtok_r(option, "=", &last)) == NULL) {
|
||||
printf(";; Invalid option %s\n", option);
|
||||
return (lookup);
|
||||
return;
|
||||
}
|
||||
if (strncasecmp(cmd, "no", 2) == 0) {
|
||||
cmd += 2;
|
||||
@@ -1076,17 +990,6 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
|
||||
(_l >= sizeof(B) || strncasecmp(cmd, B, _l) != 0)) \
|
||||
goto invalid_option; \
|
||||
} while (0)
|
||||
#define FULLCHECK6(A, B, C, D, E, F) \
|
||||
do { \
|
||||
size_t _l = strlen(cmd); \
|
||||
if ((_l >= sizeof(A) || strncasecmp(cmd, A, _l) != 0) && \
|
||||
(_l >= sizeof(B) || strncasecmp(cmd, B, _l) != 0) && \
|
||||
(_l >= sizeof(C) || strncasecmp(cmd, C, _l) != 0) && \
|
||||
(_l >= sizeof(D) || strncasecmp(cmd, D, _l) != 0) && \
|
||||
(_l >= sizeof(E) || strncasecmp(cmd, E, _l) != 0) && \
|
||||
(_l >= sizeof(F) || strncasecmp(cmd, F, _l) != 0)) \
|
||||
goto invalid_option; \
|
||||
} while (0)
|
||||
|
||||
switch (cmd[0]) {
|
||||
case 'a':
|
||||
@@ -1144,13 +1047,12 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
|
||||
break;
|
||||
case 'u': /* bufsize */
|
||||
FULLCHECK("bufsize");
|
||||
if (value == NULL) {
|
||||
goto need_value;
|
||||
}
|
||||
if (!state) {
|
||||
goto invalid_option;
|
||||
}
|
||||
if (value == NULL) {
|
||||
lookup->udpsize = DEFAULT_EDNS_BUFSIZE;
|
||||
break;
|
||||
}
|
||||
result = parse_uint(&num, value, COMMSIZE,
|
||||
"buffer size");
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
@@ -1197,7 +1099,7 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
|
||||
case 'o': /* cookie */
|
||||
FULLCHECK("cookie");
|
||||
if (state && lookup->edns == -1) {
|
||||
lookup->edns = DEFAULT_EDNS_VERSION;
|
||||
lookup->edns = 0;
|
||||
}
|
||||
lookup->sendcookie = state;
|
||||
if (value != NULL) {
|
||||
@@ -1232,57 +1134,13 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
|
||||
usesearch = state;
|
||||
}
|
||||
break;
|
||||
case 'n':
|
||||
switch (cmd[2]) {
|
||||
case 's':
|
||||
switch (cmd[3]) {
|
||||
case '6': /* dns64prefix */
|
||||
FULLCHECK("dns64prefix");
|
||||
if (state) {
|
||||
if (*need_clone) {
|
||||
lookup = clone_lookup(
|
||||
default_lookup,
|
||||
true);
|
||||
}
|
||||
*need_clone = true;
|
||||
lookup->dns64prefix = state;
|
||||
strlcpy(lookup->textname,
|
||||
"ipv4only.arpa",
|
||||
sizeof(lookup->textname));
|
||||
printcmd = false;
|
||||
lookup->section_additional =
|
||||
false;
|
||||
lookup->section_answer = true;
|
||||
lookup->section_authority =
|
||||
false;
|
||||
lookup->section_question =
|
||||
false;
|
||||
lookup->comments = false;
|
||||
lookup->stats = false;
|
||||
lookup->rrcomments = -1;
|
||||
lookup->rdtype =
|
||||
dns_rdatatype_aaaa;
|
||||
lookup->rdtypeset = true;
|
||||
ISC_LIST_APPEND(lookup_list,
|
||||
lookup, link);
|
||||
}
|
||||
break;
|
||||
case 's': /* dnssec */
|
||||
FULLCHECK("dnssec");
|
||||
dnssec:
|
||||
if (state && lookup->edns == -1) {
|
||||
lookup->edns =
|
||||
DEFAULT_EDNS_VERSION;
|
||||
}
|
||||
lookup->dnssec = state;
|
||||
break;
|
||||
default:
|
||||
goto invalid_option;
|
||||
}
|
||||
break;
|
||||
default:
|
||||
goto invalid_option;
|
||||
case 'n': /* dnssec */
|
||||
FULLCHECK("dnssec");
|
||||
dnssec:
|
||||
if (state && lookup->edns == -1) {
|
||||
lookup->edns = 0;
|
||||
}
|
||||
lookup->dnssec = state;
|
||||
break;
|
||||
case 'o': /* domain ... but treat "do" as synonym for dnssec */
|
||||
if (cmd[2] == '\0') {
|
||||
@@ -1332,8 +1190,7 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
|
||||
break;
|
||||
}
|
||||
if (value == NULL) {
|
||||
lookup->edns =
|
||||
DEFAULT_EDNS_VERSION;
|
||||
lookup->edns = 0;
|
||||
break;
|
||||
}
|
||||
result = parse_uint(&num, value,
|
||||
@@ -1433,78 +1290,8 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
|
||||
lookup->servfail_stops = state;
|
||||
break;
|
||||
case 'h':
|
||||
switch (cmd[1]) {
|
||||
case 'e': /* header-only */
|
||||
FULLCHECK("header-only");
|
||||
lookup->header_only = state;
|
||||
break;
|
||||
case 't':
|
||||
FULLCHECK6("https", "https-get", "https-post",
|
||||
"http-plain", "http-plain-get",
|
||||
"http-plain-post");
|
||||
if (lookup->https_path != NULL) {
|
||||
isc_mem_free(mctx, lookup->https_path);
|
||||
lookup->https_path = NULL;
|
||||
}
|
||||
if (!state) {
|
||||
lookup->https_mode = false;
|
||||
break;
|
||||
}
|
||||
lookup->https_mode = true;
|
||||
if (cmd[4] == '-') {
|
||||
lookup->http_plain = true;
|
||||
switch (cmd[10]) {
|
||||
case '\0':
|
||||
FULLCHECK("http-plain");
|
||||
break;
|
||||
case '-':
|
||||
switch (cmd[6]) {
|
||||
case 'p':
|
||||
FULLCHECK("https-plain-post");
|
||||
break;
|
||||
case 'g':
|
||||
FULLCHECK("https-plain-get");
|
||||
lookup->https_get = true;
|
||||
break;
|
||||
}
|
||||
break;
|
||||
default:
|
||||
goto invalid_option;
|
||||
}
|
||||
} else {
|
||||
switch (cmd[5]) {
|
||||
case '\0':
|
||||
FULLCHECK("https");
|
||||
break;
|
||||
case '-':
|
||||
switch (cmd[6]) {
|
||||
case 'p':
|
||||
FULLCHECK("https-post");
|
||||
break;
|
||||
case 'g':
|
||||
FULLCHECK("https-get");
|
||||
lookup->https_get = true;
|
||||
break;
|
||||
}
|
||||
break;
|
||||
default:
|
||||
goto invalid_option;
|
||||
}
|
||||
}
|
||||
if (!lookup->tcp_mode_set) {
|
||||
lookup->tcp_mode = state;
|
||||
}
|
||||
if (value == NULL) {
|
||||
lookup->https_path = isc_mem_strdup(
|
||||
mctx, DEFAULT_HTTPS_PATH);
|
||||
} else {
|
||||
lookup->https_path = isc_mem_strdup(mctx,
|
||||
value);
|
||||
}
|
||||
break;
|
||||
default:
|
||||
goto invalid_option;
|
||||
}
|
||||
FULLCHECK("header-only");
|
||||
lookup->header_only = state;
|
||||
break;
|
||||
case 'i':
|
||||
switch (cmd[1]) {
|
||||
@@ -1618,7 +1405,7 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
|
||||
case 'i': /* nsid */
|
||||
FULLCHECK("nsid");
|
||||
if (state && lookup->edns == -1) {
|
||||
lookup->edns = DEFAULT_EDNS_VERSION;
|
||||
lookup->edns = 0;
|
||||
}
|
||||
lookup->nsid = state;
|
||||
break;
|
||||
@@ -1688,7 +1475,7 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
|
||||
case 'p':
|
||||
FULLCHECK("padding");
|
||||
if (state && lookup->edns == -1) {
|
||||
lookup->edns = DEFAULT_EDNS_VERSION;
|
||||
lookup->edns = 0;
|
||||
}
|
||||
if (value == NULL) {
|
||||
goto need_value;
|
||||
@@ -1874,7 +1661,7 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
|
||||
break;
|
||||
}
|
||||
if (lookup->edns == -1) {
|
||||
lookup->edns = DEFAULT_EDNS_VERSION;
|
||||
lookup->edns = 0;
|
||||
}
|
||||
if (lookup->ecs_addr != NULL) {
|
||||
isc_mem_free(mctx, lookup->ecs_addr);
|
||||
@@ -1927,13 +1714,6 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
|
||||
timeout = 1;
|
||||
}
|
||||
break;
|
||||
case 'l':
|
||||
FULLCHECK("tls");
|
||||
lookup->tls_mode = state;
|
||||
if (!lookup->tcp_mode_set) {
|
||||
lookup->tcp_mode = state;
|
||||
}
|
||||
break;
|
||||
case 'o':
|
||||
FULLCHECK("topdown");
|
||||
fprintf(stderr, ";; +topdown option is deprecated");
|
||||
@@ -2017,8 +1797,7 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
|
||||
switch (cmd[2]) {
|
||||
case 'e':
|
||||
FULLCHECK("unexpected");
|
||||
fprintf(stderr, ";; +unexpected option "
|
||||
"is deprecated");
|
||||
lookup->accept_reply_unexpected_src = state;
|
||||
break;
|
||||
case 'k':
|
||||
FULLCHECK("unknownformat");
|
||||
@@ -2062,7 +1841,7 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
|
||||
fprintf(stderr, "Invalid option: +%s\n", option);
|
||||
usage();
|
||||
}
|
||||
return (lookup);
|
||||
return;
|
||||
|
||||
#if !TARGET_OS_IPHONE
|
||||
exit_or_usage:
|
||||
@@ -2188,10 +1967,10 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
|
||||
srcport = 0;
|
||||
}
|
||||
if (have_ipv6 && inet_pton(AF_INET6, value, &in6) == 1) {
|
||||
isc_sockaddr_fromin6(&localaddr, &in6, srcport);
|
||||
isc_sockaddr_fromin6(&bind_address, &in6, srcport);
|
||||
isc_net_disableipv4();
|
||||
} else if (have_ipv4 && inet_pton(AF_INET, value, &in4) == 1) {
|
||||
isc_sockaddr_fromin(&localaddr, &in4, srcport);
|
||||
isc_sockaddr_fromin(&bind_address, &in4, srcport);
|
||||
isc_net_disableipv6();
|
||||
} else {
|
||||
if (hash != NULL) {
|
||||
@@ -2235,7 +2014,6 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
|
||||
fatal("Couldn't parse port number");
|
||||
}
|
||||
port = num;
|
||||
port_set = true;
|
||||
return (value_from_next);
|
||||
case 'q':
|
||||
if (!config_only) {
|
||||
@@ -2432,20 +2210,16 @@ preparse_args(int argc, char **argv) {
|
||||
continue;
|
||||
}
|
||||
/* Look for dash value option. */
|
||||
if (strpbrk(option, dash_opts) != &option[0]) {
|
||||
goto invalid_option;
|
||||
}
|
||||
if (strlen(option) > 1U) {
|
||||
/* value in option. */
|
||||
if (strpbrk(option, dash_opts) != &option[0] ||
|
||||
strlen(option) > 1U) {
|
||||
/* Error or value in option. */
|
||||
continue;
|
||||
}
|
||||
/* Dash value is next argument so we need to skip it. */
|
||||
rc--, rv++;
|
||||
/* Handle missing argument */
|
||||
if (rc == 0) {
|
||||
invalid_option:
|
||||
fprintf(stderr, "Invalid option: -%s\n", option);
|
||||
usage();
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -2502,7 +2276,7 @@ parse_args(bool is_batchfile, bool config_only, int argc, char **argv) {
|
||||
debug("making new lookup");
|
||||
default_lookup = make_empty_lookup();
|
||||
default_lookup->adflag = true;
|
||||
default_lookup->edns = DEFAULT_EDNS_VERSION;
|
||||
default_lookup->edns = 0;
|
||||
default_lookup->sendcookie = true;
|
||||
|
||||
#ifndef NOPOSIX
|
||||
@@ -2577,8 +2351,7 @@ parse_args(bool is_batchfile, bool config_only, int argc, char **argv) {
|
||||
}
|
||||
}
|
||||
} else if (rv[0][0] == '+') {
|
||||
lookup = plus_option(&rv[0][1], is_batchfile,
|
||||
&need_clone, lookup);
|
||||
plus_option(&rv[0][1], is_batchfile, lookup);
|
||||
} else if (rv[0][0] == '-') {
|
||||
if (rc <= 1) {
|
||||
if (dash_option(&rv[0][1], NULL, &lookup,
|
||||
|
||||
+213
-240
@@ -3,7 +3,7 @@
|
||||
|
||||
This Source Code Form is subject to the terms of the Mozilla Public
|
||||
License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
|
||||
See the COPYRIGHT file distributed with this work for additional
|
||||
information regarding copyright ownership.
|
||||
@@ -24,7 +24,7 @@
|
||||
.. _man_dig:
|
||||
|
||||
dig - DNS lookup utility
|
||||
------------------------
|
||||
----------------------------------
|
||||
|
||||
Synopsis
|
||||
~~~~~~~~
|
||||
@@ -40,33 +40,33 @@ Description
|
||||
``dig`` is a flexible tool for interrogating DNS name servers. It
|
||||
performs DNS lookups and displays the answers that are returned from the
|
||||
name server(s) that were queried. Most DNS administrators use ``dig`` to
|
||||
troubleshoot DNS problems because of its flexibility, ease of use, and
|
||||
troubleshoot DNS problems because of its flexibility, ease of use and
|
||||
clarity of output. Other lookup tools tend to have less functionality
|
||||
than ``dig``.
|
||||
|
||||
Although ``dig`` is normally used with command-line arguments, it also
|
||||
has a batch mode of operation for reading lookup requests from a file. A
|
||||
brief summary of its command-line arguments and options is printed when
|
||||
the ``-h`` option is given. The BIND 9
|
||||
the ``-h`` option is given. Unlike earlier versions, the BIND 9
|
||||
implementation of ``dig`` allows multiple lookups to be issued from the
|
||||
command line.
|
||||
|
||||
Unless it is told to query a specific name server, ``dig`` tries each
|
||||
Unless it is told to query a specific name server, ``dig`` will try each
|
||||
of the servers listed in ``/etc/resolv.conf``. If no usable server
|
||||
addresses are found, ``dig`` sends the query to the local host.
|
||||
addresses are found, ``dig`` will send the query to the local host.
|
||||
|
||||
When no command-line arguments or options are given, ``dig``
|
||||
performs an NS query for "." (the root).
|
||||
When no command line arguments or options are given, ``dig`` will
|
||||
perform an NS query for "." (the root).
|
||||
|
||||
It is possible to set per-user defaults for ``dig`` via
|
||||
``${HOME}/.digrc``. This file is read and any options in it are applied
|
||||
before the command-line arguments. The ``-r`` option disables this
|
||||
feature, for scripts that need predictable behavior.
|
||||
before the command line arguments. The ``-r`` option disables this
|
||||
feature, for scripts that need predictable behaviour.
|
||||
|
||||
The IN and CH class names overlap with the IN and CH top-level domain
|
||||
The IN and CH class names overlap with the IN and CH top level domain
|
||||
names. Either use the ``-t`` and ``-c`` options to specify the type and
|
||||
class, use the ``-q`` to specify the domain name, or use "IN." and
|
||||
"CH." when looking up these top-level domains.
|
||||
class, use the ``-q`` the specify the domain name, or use "IN." and
|
||||
"CH." when looking up these top level domains.
|
||||
|
||||
Simple Usage
|
||||
~~~~~~~~~~~~
|
||||
@@ -90,110 +90,110 @@ where:
|
||||
``/etc/resolv.conf``; if an address is found there, it queries the
|
||||
name server at that address. If either of the ``-4`` or ``-6``
|
||||
options are in use, then only addresses for the corresponding
|
||||
transport are tried. If no usable addresses are found, ``dig``
|
||||
sends the query to the local host. The reply from the name server
|
||||
transport will be tried. If no usable addresses are found, ``dig``
|
||||
will send the query to the local host. The reply from the name server
|
||||
that responds is displayed.
|
||||
|
||||
``name``
|
||||
is the name of the resource record that is to be looked up.
|
||||
|
||||
``type``
|
||||
indicates what type of query is required - ANY, A, MX, SIG, etc.
|
||||
indicates what type of query is required MDASH ANY, A, MX, SIG, etc.
|
||||
``type`` can be any valid query type. If no ``type`` argument is
|
||||
supplied, ``dig`` performs a lookup for an A record.
|
||||
supplied, ``dig`` will perform a lookup for an A record.
|
||||
|
||||
Options
|
||||
~~~~~~~
|
||||
|
||||
``-4``
|
||||
This option indicates that only IPv4 should be used.
|
||||
**-4**
|
||||
Use IPv4 only.
|
||||
|
||||
``-6``
|
||||
This option indicates that only IPv6 should be used.
|
||||
**-6**
|
||||
Use IPv6 only.
|
||||
|
||||
``-b address[#port]``
|
||||
This option sets the source IP address of the query. The ``address`` must be a
|
||||
**-b** address[#port]
|
||||
Set the source IP address of the query. The ``address`` must be a
|
||||
valid address on one of the host's network interfaces, or "0.0.0.0"
|
||||
or "::". An optional port may be specified by appending ``#port``.
|
||||
or "::". An optional port may be specified by appending "#<port>"
|
||||
|
||||
``-c class``
|
||||
This option sets the query class. The default ``class`` is IN; other classes are
|
||||
**-c** class
|
||||
Set the query class. The default ``class`` is IN; other classes are
|
||||
HS for Hesiod records or CH for Chaosnet records.
|
||||
|
||||
``-f file``
|
||||
This option sets batch mode, in which ``dig`` reads a list of lookup requests to process from
|
||||
**-f** file
|
||||
Batch mode: ``dig`` reads a list of lookup requests to process from
|
||||
the given ``file``. Each line in the file should be organized in the
|
||||
same way it would be presented as a query to ``dig`` using the
|
||||
same way they would be presented as queries to ``dig`` using the
|
||||
command-line interface.
|
||||
|
||||
``-k keyfile``
|
||||
This option tells ``named`` to sign queries using TSIG using a key read from the given file. Key
|
||||
files can be generated using ``tsig-keygen``. When using TSIG
|
||||
**-k** keyfile
|
||||
Sign queries using TSIG using a key read from the given file. Key
|
||||
files can be generated using tsig-keygen8. When using TSIG
|
||||
authentication with ``dig``, the name server that is queried needs to
|
||||
know the key and algorithm that is being used. In BIND, this is done
|
||||
by providing appropriate ``key`` and ``server`` statements in
|
||||
``named.conf``.
|
||||
|
||||
``-m``
|
||||
This option enables memory usage debugging.
|
||||
**-m**
|
||||
Enable memory usage debugging.
|
||||
|
||||
``-p port``
|
||||
This option sends the query to a non-standard port on the server, instead of the
|
||||
default port 53. This option is used to test a name server that
|
||||
**-p** port
|
||||
Send the query to a non-standard port on the server, instead of the
|
||||
default port 53. This option would be used to test a name server that
|
||||
has been configured to listen for queries on a non-standard port
|
||||
number.
|
||||
|
||||
``-q name``
|
||||
This option specifies the domain name to query. This is useful to distinguish the ``name``
|
||||
**-q** name
|
||||
The domain name to query. This is useful to distinguish the ``name``
|
||||
from other arguments.
|
||||
|
||||
``-r``
|
||||
This option indicates that options from ``${HOME}/.digrc`` should not be read. This is useful for
|
||||
scripts that need predictable behavior.
|
||||
**-r**
|
||||
Do not read options from ``${HOME}/.digrc``. This is useful for
|
||||
scripts that need predictable behaviour.
|
||||
|
||||
``-t type``
|
||||
This option indicates the resource record type to query, which can be any valid query type. If
|
||||
**-t** type
|
||||
The resource record type to query. It can be any valid query type. If
|
||||
it is a resource record type supported in BIND 9, it can be given by
|
||||
the type mnemonic (such as ``NS`` or ``AAAA``). The default query type is
|
||||
``A``, unless the ``-x`` option is supplied to indicate a reverse
|
||||
the type mnemonic (such as "NS" or "AAAA"). The default query type is
|
||||
"A", unless the ``-x`` option is supplied to indicate a reverse
|
||||
lookup. A zone transfer can be requested by specifying a type of
|
||||
AXFR. When an incremental zone transfer (IXFR) is required, set the
|
||||
``type`` to ``ixfr=N``. The incremental zone transfer contains
|
||||
all changes made to the zone since the serial number in the zone's
|
||||
``type`` to ``ixfr=N``. The incremental zone transfer will contain
|
||||
the changes made to the zone since the serial number in the zone's
|
||||
SOA record was ``N``.
|
||||
|
||||
All resource record types can be expressed as ``TYPEnn``, where ``nn`` is
|
||||
All resource record types can be expressed as "TYPEnn", where "nn" is
|
||||
the number of the type. If the resource record type is not supported
|
||||
in BIND 9, the result is displayed as described in :rfc:`3597`.
|
||||
in BIND 9, the result will be displayed as described in :rfc:`3597`.
|
||||
|
||||
``-u``
|
||||
This option indicates that print query times should be provided in microseconds instead of milliseconds.
|
||||
**-u**
|
||||
Print query times in microseconds instead of milliseconds.
|
||||
|
||||
``-v``
|
||||
This option prints the version number and exits.
|
||||
**-v**
|
||||
Print the version number and exit.
|
||||
|
||||
``-x addr``
|
||||
This option sets simplified reverse lookups, for mapping addresses to names. The
|
||||
**-x** addr
|
||||
Simplified reverse lookups, for mapping addresses to names. The
|
||||
``addr`` is an IPv4 address in dotted-decimal notation, or a
|
||||
colon-delimited IPv6 address. When the ``-x`` option is used, there is no
|
||||
need to provide the ``name``, ``class``, and ``type`` arguments.
|
||||
colon-delimited IPv6 address. When the ``-x`` is used, there is no
|
||||
need to provide the ``name``, ``class`` and ``type`` arguments.
|
||||
``dig`` automatically performs a lookup for a name like
|
||||
``94.2.0.192.in-addr.arpa`` and sets the query type and class to PTR
|
||||
and IN respectively. IPv6 addresses are looked up using nibble format
|
||||
under the IP6.ARPA domain.
|
||||
|
||||
``-y [hmac:]keyname:secret``
|
||||
This option signs queries using TSIG with the given authentication key.
|
||||
``keyname`` is the name of the key, and ``secret`` is the
|
||||
base64-encoded shared secret. ``hmac`` is the name of the key algorithm;
|
||||
**-y** [hmac:]keyname:secret
|
||||
Sign queries using TSIG with the given authentication key.
|
||||
``keyname`` is the name of the key, and ``secret`` is the base64
|
||||
encoded shared secret. ``hmac`` is the name of the key algorithm;
|
||||
valid choices are ``hmac-md5``, ``hmac-sha1``, ``hmac-sha224``,
|
||||
``hmac-sha256``, ``hmac-sha384``, or ``hmac-sha512``. If ``hmac`` is
|
||||
not specified, the default is ``hmac-md5``; if MD5 was disabled, the default is
|
||||
not specified, the default is ``hmac-md5`` or if MD5 was disabled
|
||||
``hmac-sha256``.
|
||||
|
||||
.. note:: Only the ``-k`` option should be used, rather than the ``-y`` option,
|
||||
because with ``-y`` the shared secret is supplied as a command-line
|
||||
argument in clear text. This may be visible in the output from ``ps1`` or
|
||||
.. note:: You should use the ``-k`` option and avoid the ``-y`` option,
|
||||
because with ``-y`` the shared secret is supplied as a command line
|
||||
argument in clear text. This may be visible in the output from ps1 or
|
||||
in a history file maintained by the user's shell.
|
||||
|
||||
Query Options
|
||||
@@ -206,324 +206,297 @@ answer get printed, and others determine the timeout and retry
|
||||
strategies.
|
||||
|
||||
Each query option is identified by a keyword preceded by a plus sign
|
||||
(``+``). Some keywords set or reset an option; these may be preceded by
|
||||
(``+``). Some keywords set or reset an option. These may be preceded by
|
||||
the string ``no`` to negate the meaning of that keyword. Other keywords
|
||||
assign values to options, like the timeout interval. They have the form
|
||||
assign values to options like the timeout interval. They have the form
|
||||
``+keyword=value``. Keywords may be abbreviated, provided the
|
||||
abbreviation is unambiguous; for example, ``+cd`` is equivalent to
|
||||
``+cdflag``. The query options are:
|
||||
|
||||
``+[no]aaflag``
|
||||
This option is a synonym for ``+[no]aaonly``.
|
||||
A synonym for ``+[no]aaonly``.
|
||||
|
||||
``+[no]aaonly``
|
||||
This option sets the ``aa`` flag in the query.
|
||||
Sets the "aa" flag in the query.
|
||||
|
||||
``+[no]additional``
|
||||
This option displays [or does not display] the additional section of a reply. The
|
||||
Display [do not display] the additional section of a reply. The
|
||||
default is to display it.
|
||||
|
||||
``+[no]adflag``
|
||||
This option sets [or does not set] the AD (authentic data) bit in the query. This
|
||||
Set [do not set] the AD (authentic data) bit in the query. This
|
||||
requests the server to return whether all of the answer and authority
|
||||
sections have been validated as secure, according to the security
|
||||
policy of the server. ``AD=1`` indicates that all records have been
|
||||
validated as secure and the answer is not from a OPT-OUT range. ``AD=0``
|
||||
indicates that some part of the answer was insecure or not validated.
|
||||
sections have all been validated as secure according to the security
|
||||
policy of the server. AD=1 indicates that all records have been
|
||||
validated as secure and the answer is not from a OPT-OUT range. AD=0
|
||||
indicate that some part of the answer was insecure or not validated.
|
||||
This bit is set by default.
|
||||
|
||||
``+[no]all``
|
||||
This option sets or clears all display flags.
|
||||
Set or clear all display flags.
|
||||
|
||||
``+[no]answer``
|
||||
This option displays [or does not display] the answer section of a reply. The default
|
||||
Display [do not display] the answer section of a reply. The default
|
||||
is to display it.
|
||||
|
||||
``+[no]authority``
|
||||
This option displays [or does not display] the authority section of a reply. The
|
||||
Display [do not display] the authority section of a reply. The
|
||||
default is to display it.
|
||||
|
||||
``+[no]badcookie``
|
||||
This option retries the lookup with a new server cookie if a BADCOOKIE response is
|
||||
Retry lookup with the new server cookie if a BADCOOKIE response is
|
||||
received.
|
||||
|
||||
``+[no]besteffort``
|
||||
This option attempts to display the contents of messages which are malformed. The
|
||||
Attempt to display the contents of messages which are malformed. The
|
||||
default is to not display malformed answers.
|
||||
|
||||
``+bufsize[=B]``
|
||||
This option sets the UDP message buffer size advertised using EDNS0 to
|
||||
``B`` bytes. The maximum and minimum sizes of this buffer are 65535 and
|
||||
0, respectively. ``+bufsize`` restores the default buffer size.
|
||||
``+bufsize=B``
|
||||
Set the UDP message buffer size advertised using EDNS0 to ``B``
|
||||
bytes. The maximum and minimum sizes of this buffer are 65535 and 0
|
||||
respectively. Values outside this range are rounded up or down
|
||||
appropriately. Values other than zero will cause a EDNS query to be
|
||||
sent.
|
||||
|
||||
``+[no]cdflag``
|
||||
This option sets [or does not set] the CD (checking disabled) bit in the query. This
|
||||
Set [do not set] the CD (checking disabled) bit in the query. This
|
||||
requests the server to not perform DNSSEC validation of responses.
|
||||
|
||||
``+[no]class``
|
||||
This option displays [or does not display] the CLASS when printing the record.
|
||||
Display [do not display] the CLASS when printing the record.
|
||||
|
||||
``+[no]cmd``
|
||||
This option toggles the printing of the initial comment in the output, identifying the
|
||||
version of ``dig`` and the query options that have been applied. This option
|
||||
always has a global effect; it cannot be set globally and then overridden on a
|
||||
per-lookup basis. The default is to print this comment.
|
||||
Toggles the printing of the initial comment in the output, identifying the
|
||||
version of ``dig`` and the query options that have been applied. This option
|
||||
always has global effect; it cannot be set globally and then overridden on a
|
||||
per-lookup basis. The default is to print this comment.
|
||||
|
||||
``+[no]comments``
|
||||
This option toggles the display of some comment lines in the output, with
|
||||
Toggles the display of some comment lines in the output, containing
|
||||
information about the packet header and OPT pseudosection, and the names of
|
||||
the response section. The default is to print these comments.
|
||||
the response section. The default is to print these comments.
|
||||
|
||||
Other types of comments in the output are not affected by this option, but
|
||||
can be controlled using other command-line switches. These include
|
||||
can be controlled using other command line switches. These include
|
||||
``+[no]cmd``, ``+[no]question``, ``+[no]stats``, and ``+[no]rrcomments``.
|
||||
|
||||
``+[no]cookie=####``
|
||||
This option sends [or does not send] a COOKIE EDNS option, with an optional value. Replaying a COOKIE
|
||||
from a previous response allows the server to identify a previous
|
||||
Send a COOKIE EDNS option, with optional value. Replaying a COOKIE
|
||||
from a previous response will allow the server to identify a previous
|
||||
client. The default is ``+cookie``.
|
||||
|
||||
``+cookie`` is also set when ``+trace`` is set to better emulate the
|
||||
``+cookie`` is also set when +trace is set to better emulate the
|
||||
default queries from a nameserver.
|
||||
|
||||
``+[no]crypto``
|
||||
This option toggles the display of cryptographic fields in DNSSEC records. The
|
||||
contents of these fields are unnecessary for debugging most DNSSEC
|
||||
Toggle the display of cryptographic fields in DNSSEC records. The
|
||||
contents of these field are unnecessary to debug most DNSSEC
|
||||
validation failures and removing them makes it easier to see the
|
||||
common failures. The default is to display the fields. When omitted,
|
||||
they are replaced by the string ``[omitted]`` or, in the DNSKEY case, the
|
||||
key ID is displayed as the replacement, e.g. ``[ key id = value ]``.
|
||||
common failures. The default is to display the fields. When omitted
|
||||
they are replaced by the string "[omitted]" or in the DNSKEY case the
|
||||
key id is displayed as the replacement, e.g. "[ key id = value ]".
|
||||
|
||||
``+[no]defname``
|
||||
This option, which is deprecated, is treated as a synonym for ``+[no]search``.
|
||||
|
||||
``+[no]dns64prefix``
|
||||
Lookup IPV4ONLY.ARPA AAAA and print any DNS64 prefixes found.
|
||||
Deprecated, treated as a synonym for ``+[no]search``
|
||||
|
||||
``+[no]dnssec``
|
||||
This option requests that DNSSEC records be sent by setting the DNSSEC OK (DO) bit in
|
||||
Requests DNSSEC records be sent by setting the DNSSEC OK bit (DO) in
|
||||
the OPT record in the additional section of the query.
|
||||
|
||||
``+domain=somename``
|
||||
This option sets the search list to contain the single domain ``somename``, as if
|
||||
Set the search list to contain the single domain ``somename``, as if
|
||||
specified in a ``domain`` directive in ``/etc/resolv.conf``, and
|
||||
enables search list processing as if the ``+search`` option were
|
||||
enable search list processing as if the ``+search`` option were
|
||||
given.
|
||||
|
||||
``+dscp=value``
|
||||
This option sets the DSCP code point to be used when sending the query. Valid DSCP
|
||||
code points are in the range [0...63]. By default no code point is
|
||||
Set the DSCP code point to be used when sending the query. Valid DSCP
|
||||
code points are in the range [0..63]. By default no code point is
|
||||
explicitly set.
|
||||
|
||||
``+[no]edns[=#]``
|
||||
This option specifies the EDNS version to query with. Valid values are 0 to 255.
|
||||
Setting the EDNS version causes an EDNS query to be sent.
|
||||
Specify the EDNS version to query with. Valid values are 0 to 255.
|
||||
Setting the EDNS version will cause a EDNS query to be sent.
|
||||
``+noedns`` clears the remembered EDNS version. EDNS is set to 0 by
|
||||
default.
|
||||
|
||||
``+[no]ednsflags[=#]``
|
||||
This option sets the must-be-zero EDNS flags bits (Z bits) to the specified value.
|
||||
Decimal, hex, and octal encodings are accepted. Setting a named flag
|
||||
(e.g., DO) is silently ignored. By default, no Z bits are set.
|
||||
Set the must-be-zero EDNS flags bits (Z bits) to the specified value.
|
||||
Decimal, hex and octal encodings are accepted. Setting a named flag
|
||||
(e.g. DO) will silently be ignored. By default, no Z bits are set.
|
||||
|
||||
``+[no]ednsnegotiation``
|
||||
This option enables/disables EDNS version negotiation. By default, EDNS version
|
||||
Enable / disable EDNS version negotiation. By default EDNS version
|
||||
negotiation is enabled.
|
||||
|
||||
``+[no]ednsopt[=code[:value]]``
|
||||
This option specifies the EDNS option with code point ``code`` and an optional payload
|
||||
Specify EDNS option with code point ``code`` and optionally payload
|
||||
of ``value`` as a hexadecimal string. ``code`` can be either an EDNS
|
||||
option name (for example, ``NSID`` or ``ECS``) or an arbitrary
|
||||
option name (for example, ``NSID`` or ``ECS``), or an arbitrary
|
||||
numeric value. ``+noednsopt`` clears the EDNS options to be sent.
|
||||
|
||||
``+[no]expire``
|
||||
This option sends an EDNS Expire option.
|
||||
Send an EDNS Expire option.
|
||||
|
||||
``+[no]fail``
|
||||
This option indicates that ``named`` should try [or not try] the next server if a SERVFAIL is received. The default is
|
||||
to not try the next server, which is the reverse of normal stub
|
||||
Do not try the next server if you receive a SERVFAIL. The default is
|
||||
to not try the next server which is the reverse of normal stub
|
||||
resolver behavior.
|
||||
|
||||
``+[no]header-only``
|
||||
This option sends a query with a DNS header without a question section. The
|
||||
Send a query with a DNS header without a question section. The
|
||||
default is to add a question section. The query type and query name
|
||||
are ignored when this is set.
|
||||
|
||||
``+[no]https[=value]``
|
||||
This option indicates whether to use DNS-over-HTTPS (DoH) when querying
|
||||
name servers. When this option is in use, the port number defaults to 443.
|
||||
The HTTP POST request mode is used when sending the query.
|
||||
|
||||
If ``value`` is specified, it will be used as the HTTP endpoint in the
|
||||
query URI; the default is ``/dns-query``. So, for example, ``dig
|
||||
@example.com +https`` will use the URI ``https://example.com/dns-query``.
|
||||
|
||||
``+[no]https-get[=value]``
|
||||
Similar to ``+https``, except that the HTTP GET request mode is used
|
||||
when sending the query.
|
||||
|
||||
``+[no]https-post[=value]``
|
||||
Same as ``+https``.
|
||||
|
||||
``+[no]http-plain[=value]``
|
||||
Similar to ``+https``, except that HTTP queries will be sent over a
|
||||
non-encrypted channel. When this option is in use, the port number
|
||||
defaults to 80 and the HTTP request mode is POST.
|
||||
|
||||
``+[no]http-plain-get[=value]``
|
||||
Similar to ``+http-plain``, except that the HTTP request mode is GET.
|
||||
|
||||
``+[no]http-plain-post[=value]``
|
||||
Same as ``+http-plain``.
|
||||
|
||||
``+[no]identify``
|
||||
This option shows [or does not show] the IP address and port number that
|
||||
supplied the answer, when the ``+short`` option is enabled. If short
|
||||
form answers are requested, the default is not to show the source
|
||||
address and port number of the server that provided the answer.
|
||||
Show [or do not show] the IP address and port number that supplied
|
||||
the answer when the ``+short`` option is enabled. If short form
|
||||
answers are requested, the default is not to show the source address
|
||||
and port number of the server that provided the answer.
|
||||
|
||||
``+[no]idnin``
|
||||
This option processes [or does not process] IDN domain names on input. This requires
|
||||
``IDN SUPPORT`` to have been enabled at compile time.
|
||||
Process [do not process] IDN domain names on input. This requires IDN
|
||||
SUPPORT to have been enabled at compile time.
|
||||
|
||||
The default is to process IDN input when standard output is a tty.
|
||||
The IDN processing on input is disabled when ``dig`` output is redirected
|
||||
The IDN processing on input is disabled when dig output is redirected
|
||||
to files, pipes, and other non-tty file descriptors.
|
||||
|
||||
``+[no]idnout``
|
||||
This option converts [or does not convert] puny code on output. This requires
|
||||
``IDN SUPPORT`` to have been enabled at compile time.
|
||||
Convert [do not convert] puny code on output. This requires IDN
|
||||
SUPPORT to have been enabled at compile time.
|
||||
|
||||
The default is to process puny code on output when standard output is
|
||||
a tty. The puny code processing on output is disabled when ``dig`` output
|
||||
a tty. The puny code processing on output is disabled when dig output
|
||||
is redirected to files, pipes, and other non-tty file descriptors.
|
||||
|
||||
``+[no]ignore``
|
||||
This option ignores [or does not ignore] truncation in UDP responses instead of retrying with TCP. By
|
||||
Ignore truncation in UDP responses instead of retrying with TCP. By
|
||||
default, TCP retries are performed.
|
||||
|
||||
``+[no]keepalive``
|
||||
This option sends [or does not send] an EDNS Keepalive option.
|
||||
Send [or do not send] an EDNS Keepalive option.
|
||||
|
||||
``+[no]keepopen``
|
||||
This option keeps [or does not keep] the TCP socket open between queries, and reuses it rather than
|
||||
Keep the TCP socket open between queries and reuse it rather than
|
||||
creating a new TCP socket for each lookup. The default is
|
||||
``+nokeepopen``.
|
||||
|
||||
``+[no]mapped``
|
||||
This option allows [or does not allow] mapped IPv4-over-IPv6 addresses to be used. The default is
|
||||
Allow mapped IPv4 over IPv6 addresses to be used. The default is
|
||||
``+mapped``.
|
||||
|
||||
``+[no]multiline``
|
||||
This option prints [or does not print] records, like the SOA records, in a verbose multi-line format
|
||||
Print records like the SOA records in a verbose multi-line format
|
||||
with human-readable comments. The default is to print each record on
|
||||
a single line to facilitate machine parsing of the ``dig`` output.
|
||||
a single line, to facilitate machine parsing of the ``dig`` output.
|
||||
|
||||
``+ndots=D``
|
||||
This option sets the number of dots (``D``) that must appear in ``name`` for
|
||||
Set the number of dots that have to appear in ``name`` to ``D`` for
|
||||
it to be considered absolute. The default value is that defined using
|
||||
the ``ndots`` statement in ``/etc/resolv.conf``, or 1 if no ``ndots``
|
||||
the ndots statement in ``/etc/resolv.conf``, or 1 if no ndots
|
||||
statement is present. Names with fewer dots are interpreted as
|
||||
relative names, and are searched for in the domains listed in the
|
||||
relative names and will be searched for in the domains listed in the
|
||||
``search`` or ``domain`` directive in ``/etc/resolv.conf`` if
|
||||
``+search`` is set.
|
||||
|
||||
``+[no]nsid``
|
||||
When enabled, this option includes an EDNS name server ID request when sending a query.
|
||||
Include an EDNS name server ID request when sending a query.
|
||||
|
||||
``+[no]nssearch``
|
||||
When this option is set, ``dig`` attempts to find the authoritative
|
||||
name servers for the zone containing the name being looked up, and
|
||||
name servers for the zone containing the name being looked up and
|
||||
display the SOA record that each name server has for the zone.
|
||||
Addresses of servers that did not respond are also printed.
|
||||
Addresses of servers that that did not respond are also printed.
|
||||
|
||||
``+[no]onesoa``
|
||||
When enabled, this option prints only one (starting) SOA record when performing an AXFR. The
|
||||
Print only one (starting) SOA record when performing an AXFR. The
|
||||
default is to print both the starting and ending SOA records.
|
||||
|
||||
``+[no]opcode=value``
|
||||
When enabled, this option sets (restores) the DNS message opcode to the specified value. The
|
||||
Set [restore] the DNS message opcode to the specified value. The
|
||||
default value is QUERY (0).
|
||||
|
||||
``+padding=value``
|
||||
This option pads the size of the query packet using the EDNS Padding option to
|
||||
blocks of ``value`` bytes. For example, ``+padding=32`` causes a
|
||||
Pad the size of the query packet using the EDNS Padding option to
|
||||
blocks of ``value`` bytes. For example, ``+padding=32`` would cause a
|
||||
48-byte query to be padded to 64 bytes. The default block size is 0,
|
||||
which disables padding; the maximum is 512. Values are ordinarily
|
||||
which disables padding. The maximum is 512. Values are ordinarily
|
||||
expected to be powers of two, such as 128; however, this is not
|
||||
mandatory. Responses to padded queries may also be padded, but only
|
||||
if the query uses TCP or DNS COOKIE.
|
||||
|
||||
``+qid=value``
|
||||
This option specifies the query ID to use when sending queries.
|
||||
|
||||
Specify the query ID to use when sending queries.
|
||||
|
||||
``+[no]qr``
|
||||
This option toggles the display of the query message as it is sent. By default, the query
|
||||
Toggles the display of the query message as it is sent. By default, the query
|
||||
is not printed.
|
||||
|
||||
``+[no]question``
|
||||
This option toggles the display of the question section of a query when an answer is
|
||||
returned. The default is to print the question section as a comment.
|
||||
Toggles the display of the question section of a query when an answer is
|
||||
returned. The default is to print the question section as a comment.
|
||||
|
||||
``+[no]raflag``
|
||||
This option sets [or does not set] the RA (Recursion Available) bit in the query. The
|
||||
default is ``+noraflag``. This bit is ignored by the server for
|
||||
Set [do not set] the RA (Recursion Available) bit in the query. The
|
||||
default is +noraflag. This bit should be ignored by the server for
|
||||
QUERY.
|
||||
|
||||
``+[no]rdflag``
|
||||
This option is a synonym for ``+[no]recurse``.
|
||||
A synonym for ``+[no]recurse``.
|
||||
|
||||
``+[no]recurse``
|
||||
This option toggles the setting of the RD (recursion desired) bit in the query.
|
||||
Toggle the setting of the RD (recursion desired) bit in the query.
|
||||
This bit is set by default, which means ``dig`` normally sends
|
||||
recursive queries. Recursion is automatically disabled when the
|
||||
``+nssearch`` or ``+trace`` query option is used.
|
||||
``+nssearch`` or ``+trace`` query options are used.
|
||||
|
||||
``+retry=T``
|
||||
This option sets the number of times to retry UDP and TCP queries to server to ``T``
|
||||
instead of the default, 2. Unlike ``+tries``, this does not include
|
||||
Sets the number of times to retry UDP queries to server to ``T``
|
||||
instead of the default, 2. Unlike ``+tries``, this does not include
|
||||
the initial query.
|
||||
|
||||
``+[no]rrcomments``
|
||||
This option toggles the display of per-record comments in the output (for example,
|
||||
Toggle the display of per-record comments in the output (for example,
|
||||
human-readable key information about DNSKEY records). The default is
|
||||
not to print record comments unless multiline mode is active.
|
||||
|
||||
``+[no]search``
|
||||
This option uses [or does not use] the search list defined by the searchlist or domain
|
||||
directive in ``resolv.conf``, if any. The search list is not used by
|
||||
Use [do not use] the search list defined by the searchlist or domain
|
||||
directive in ``resolv.conf`` (if any). The search list is not used by
|
||||
default.
|
||||
|
||||
``ndots`` from ``resolv.conf`` (default 1), which may be overridden by
|
||||
``+ndots``, determines whether the name is treated as relative
|
||||
and hence whether a search is eventually performed.
|
||||
'ndots' from ``resolv.conf`` (default 1) which may be overridden by
|
||||
``+ndots`` determines if the name will be treated as relative or not
|
||||
and hence whether a search is eventually performed or not.
|
||||
|
||||
``+[no]short``
|
||||
This option toggles whether a terse answer is provided. The default is to print the answer in a verbose
|
||||
form. This option always has a global effect; it cannot be set globally and
|
||||
Provide a terse answer. The default is to print the answer in a verbose
|
||||
form. This option always has global effect; it cannot be set globally and
|
||||
then overridden on a per-lookup basis.
|
||||
|
||||
``+[no]showsearch``
|
||||
This option performs [or does not perform] a search showing intermediate results.
|
||||
Perform [do not perform] a search showing intermediate results.
|
||||
|
||||
``+[no]sigchase``
|
||||
This feature is now obsolete and has been removed; use ``delv``
|
||||
instead.
|
||||
|
||||
``+split=W``
|
||||
This option splits long hex- or base64-formatted fields in resource records into
|
||||
Split long hex- or base64-formatted fields in resource records into
|
||||
chunks of ``W`` characters (where ``W`` is rounded up to the nearest
|
||||
multiple of 4). ``+nosplit`` or ``+split=0`` causes fields not to be
|
||||
split at all. The default is 56 characters, or 44 characters when
|
||||
multiline mode is active.
|
||||
|
||||
``+[no]stats``
|
||||
This option toggles the printing of statistics: when the query was made, the size of the
|
||||
reply, etc. The default behavior is to print the query statistics as a
|
||||
Toggles the printing of statistics: when the query was made, the size of the
|
||||
reply and so on. The default behavior is to print the query statistics as a
|
||||
comment after each lookup.
|
||||
|
||||
``+[no]subnet=addr[/prefix-length]``
|
||||
This option sends [or does not send] an EDNS CLIENT-SUBNET option with the specified IP
|
||||
Send (don't send) an EDNS Client Subnet option with the specified IP
|
||||
address or network prefix.
|
||||
|
||||
``dig +subnet=0.0.0.0/0``, or simply ``dig +subnet=0`` for short,
|
||||
@@ -532,75 +505,75 @@ abbreviation is unambiguous; for example, ``+cd`` is equivalent to
|
||||
address information must *not* be used when resolving this query.
|
||||
|
||||
``+[no]tcflag``
|
||||
This option sets [or does not set] the TC (TrunCation) bit in the query. The default is
|
||||
``+notcflag``. This bit is ignored by the server for QUERY.
|
||||
Set [do not set] the TC (TrunCation) bit in the query. The default is
|
||||
+notcflag. This bit should be ignored by the server for QUERY.
|
||||
|
||||
``+[no]tcp``
|
||||
This option indicates whether to use TCP when querying name servers.
|
||||
The default behavior is to use UDP unless a type ``any`` or ``ixfr=N``
|
||||
query is requested, in which case the default is TCP. AXFR queries
|
||||
always use TCP.
|
||||
Use [do not use] TCP when querying name servers. The default behavior
|
||||
is to use UDP unless a type ``any`` or ``ixfr=N`` query is requested,
|
||||
in which case the default is TCP. AXFR queries always use TCP.
|
||||
|
||||
``+timeout=T``
|
||||
This option sets the timeout for a query to ``T`` seconds. The default timeout is
|
||||
5 seconds. An attempt to set ``T`` to less than 1 is silently set to 1.
|
||||
|
||||
``+[no]tls``
|
||||
This option indicates whether to use DNS-over-TLS (DoT) when querying
|
||||
name servers. When this option is in use, the port number defaults
|
||||
to 853.
|
||||
Sets the timeout for a query to ``T`` seconds. The default timeout is
|
||||
5 seconds. An attempt to set ``T`` to less than 1 will result in a
|
||||
query timeout of 1 second being applied.
|
||||
|
||||
``+[no]topdown``
|
||||
This feature is related to ``dig +sigchase``, which is obsolete and
|
||||
has been removed. Use ``delv`` instead.
|
||||
|
||||
``+[no]trace``
|
||||
This option toggles tracing of the delegation path from the root name servers for
|
||||
Toggle tracing of the delegation path from the root name servers for
|
||||
the name being looked up. Tracing is disabled by default. When
|
||||
tracing is enabled, ``dig`` makes iterative queries to resolve the
|
||||
name being looked up. It follows referrals from the root servers,
|
||||
name being looked up. It will follow referrals from the root servers,
|
||||
showing the answer from each server that was used to resolve the
|
||||
lookup.
|
||||
|
||||
If ``@server`` is also specified, it affects only the initial query for
|
||||
If @server is also specified, it affects only the initial query for
|
||||
the root zone name servers.
|
||||
|
||||
``+dnssec`` is also set when ``+trace`` is set, to better emulate the
|
||||
default queries from a name server.
|
||||
``+dnssec`` is also set when +trace is set to better emulate the
|
||||
default queries from a nameserver.
|
||||
|
||||
``+tries=T``
|
||||
This option sets the number of times to try UDP and TCP queries to server to ``T``
|
||||
Sets the number of times to try UDP queries to server to ``T``
|
||||
instead of the default, 3. If ``T`` is less than or equal to zero,
|
||||
the number of tries is silently rounded up to 1.
|
||||
|
||||
``+trusted-key=####``
|
||||
This option formerly specified trusted keys for use with ``dig +sigchase``. This
|
||||
Formerly specified trusted keys for use with ``dig +sigchase``. This
|
||||
feature is now obsolete and has been removed; use ``delv`` instead.
|
||||
|
||||
``+[no]ttlid``
|
||||
This option displays [or does not display] the TTL when printing the record.
|
||||
Display [do not display] the TTL when printing the record.
|
||||
|
||||
``+[no]ttlunits``
|
||||
This option displays [or does not display] the TTL in friendly human-readable time
|
||||
units of ``s``, ``m``, ``h``, ``d``, and ``w``, representing seconds, minutes,
|
||||
hours, days, and weeks. This implies ``+ttlid``.
|
||||
Display [do not display] the TTL in friendly human-readable time
|
||||
units of "s", "m", "h", "d", and "w", representing seconds, minutes,
|
||||
hours, days and weeks. Implies +ttlid.
|
||||
|
||||
``+[no]unexpected``
|
||||
Accept [do not accept] answers from unexpected sources. By default, ``dig``
|
||||
won't accept a reply from a source other than the one to which it sent the
|
||||
query.
|
||||
|
||||
``+[no]unknownformat``
|
||||
This option prints all RDATA in unknown RR type presentation format (:rfc:`3597`).
|
||||
Print all RDATA in unknown RR type presentation format (:rfc:`3597`).
|
||||
The default is to print RDATA for known types in the type's
|
||||
presentation format.
|
||||
|
||||
``+[no]vc``
|
||||
This option uses [or does not use] TCP when querying name servers. This alternate
|
||||
Use [do not use] TCP when querying name servers. This alternate
|
||||
syntax to ``+[no]tcp`` is provided for backwards compatibility. The
|
||||
``vc`` stands for "virtual circuit."
|
||||
"vc" stands for "virtual circuit".
|
||||
|
||||
``+[no]yaml``
|
||||
When enabled, this option prints the responses (and, if ``+qr`` is in use, also the
|
||||
Print the responses (and, if <option>+qr</option> is in use, also the
|
||||
outgoing queries) in a detailed YAML format.
|
||||
|
||||
``+[no]zflag``
|
||||
This option sets [or does not set] the last unassigned DNS header flag in a DNS query.
|
||||
Set [do not set] the last unassigned DNS header flag in a DNS query.
|
||||
This flag is off by default.
|
||||
|
||||
Multiple Queries
|
||||
@@ -609,12 +582,12 @@ Multiple Queries
|
||||
The BIND 9 implementation of ``dig`` supports specifying multiple
|
||||
queries on the command line (in addition to supporting the ``-f`` batch
|
||||
file option). Each of those queries can be supplied with its own set of
|
||||
flags, options, and query options.
|
||||
flags, options and query options.
|
||||
|
||||
In this case, each ``query`` argument represents an individual query in
|
||||
In this case, each ``query`` argument represent an individual query in
|
||||
the command-line syntax described above. Each consists of any of the
|
||||
standard options and flags, the name to be looked up, an optional query
|
||||
type and class, and any query options that should be applied to that
|
||||
type and class and any query options that should be applied to that
|
||||
query.
|
||||
|
||||
A global set of query options, which should be applied to all queries,
|
||||
@@ -628,12 +601,12 @@ query options. For example:
|
||||
|
||||
dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
|
||||
|
||||
shows how ``dig`` can be used from the command line to make three
|
||||
lookups: an ANY query for ``www.isc.org``, a reverse lookup of 127.0.0.1,
|
||||
shows how ``dig`` could be used from the command line to make three
|
||||
lookups: an ANY query for ``www.isc.org``, a reverse lookup of 127.0.0.1
|
||||
and a query for the NS records of ``isc.org``. A global query option of
|
||||
``+qr`` is applied, so that ``dig`` shows the initial query it made for
|
||||
each lookup. The final query has a local query option of ``+noqr`` which
|
||||
means that ``dig`` does not print the initial query when it looks up the
|
||||
means that ``dig`` will not print the initial query when it looks up the
|
||||
NS records for ``isc.org``.
|
||||
|
||||
IDN Support
|
||||
@@ -641,10 +614,10 @@ IDN Support
|
||||
|
||||
If ``dig`` has been built with IDN (internationalized domain name)
|
||||
support, it can accept and display non-ASCII domain names. ``dig``
|
||||
appropriately converts character encoding of a domain name before sending
|
||||
a request to a DNS server or displaying a reply from the server.
|
||||
To turn off IDN support, use the parameters
|
||||
``+noidnin`` and ``+noidnout``, or define the ``IDN_DISABLE`` environment
|
||||
appropriately converts character encoding of domain name before sending
|
||||
a request to DNS server or displaying a reply from the server. If you'd
|
||||
like to turn off the IDN support for some reason, use parameters
|
||||
``+noidnin`` and ``+noidnout`` or define the IDN_DISABLE environment
|
||||
variable.
|
||||
|
||||
Files
|
||||
|
||||
+1043
-923
File diff suppressed because it is too large
Load Diff
+39
-68
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
@@ -19,14 +19,13 @@
|
||||
|
||||
#include <isc/attributes.h>
|
||||
#include <isc/buffer.h>
|
||||
#include <isc/bufferlist.h>
|
||||
#include <isc/formatcheck.h>
|
||||
#include <isc/lang.h>
|
||||
#include <isc/list.h>
|
||||
#include <isc/magic.h>
|
||||
#include <isc/mem.h>
|
||||
#include <isc/netmgr.h>
|
||||
#include <isc/print.h>
|
||||
#include <isc/refcount.h>
|
||||
#include <isc/sockaddr.h>
|
||||
#include <isc/socket.h>
|
||||
|
||||
@@ -72,13 +71,6 @@
|
||||
#define SERVER_TIMEOUT 1
|
||||
|
||||
#define LOOKUP_LIMIT 64
|
||||
|
||||
#define DEFAULT_EDNS_VERSION 0
|
||||
#define DEFAULT_EDNS_BUFSIZE 1232
|
||||
|
||||
#define DEFAULT_HTTPS_PATH "/dns-query"
|
||||
#define DEFAULT_HTTPS_QUERY "?dns="
|
||||
|
||||
/*%
|
||||
* Lookup_limit is just a limiter, keeping too many lookups from being
|
||||
* created. It's job is mainly to prevent the program from running away
|
||||
@@ -93,39 +85,37 @@ typedef struct dig_server dig_server_t;
|
||||
typedef ISC_LIST(dig_server_t) dig_serverlist_t;
|
||||
typedef struct dig_searchlist dig_searchlist_t;
|
||||
|
||||
#define DIG_LOOKUP_MAGIC ISC_MAGIC('D', 'i', 'g', 'l')
|
||||
|
||||
#define DIG_VALID_LOOKUP(x) ISC_MAGIC_VALID((x), DIG_LOOKUP_MAGIC)
|
||||
|
||||
#define DIG_QUERY_MAGIC ISC_MAGIC('D', 'i', 'g', 'q')
|
||||
|
||||
#define DIG_VALID_QUERY(x) ISC_MAGIC_VALID((x), DIG_QUERY_MAGIC)
|
||||
|
||||
/*% The dig_lookup structure */
|
||||
struct dig_lookup {
|
||||
unsigned int magic;
|
||||
isc_refcount_t references;
|
||||
bool aaonly, adflag, badcookie, besteffort, cdflag, comments,
|
||||
dns64prefix, dnssec, doing_xfr, done_as_is, ednsneg, expandaaaa,
|
||||
expire, header_only, identify, /*%< Append an "on server <foo>"
|
||||
message */
|
||||
identify_previous_line, /*% Prepend a "Nameserver <foo>:"
|
||||
message, with newline and tab */
|
||||
idnin, idnout, ignore, mapped, multiline, need_search,
|
||||
new_search, noclass, nocrypto, nottl,
|
||||
ns_search_only, /*%< dig +nssearch, host -C */
|
||||
nsid, /*% Name Server ID (RFC 5001) */
|
||||
onesoa, pending, /*%< Pending a successful answer */
|
||||
print_unknown_format, qr, raflag, recurse, section_additional,
|
||||
section_answer, section_authority, section_question,
|
||||
seenbadcookie, sendcookie, servfail_stops,
|
||||
setqid, /*% use a speciied query ID */
|
||||
stats, tcflag, tcp_keepalive, tcp_mode, tcp_mode_set,
|
||||
tls_mode, /*% connect using TLS */
|
||||
bool pending, /*%< Pending a successful answer */
|
||||
waiting_connect, doing_xfr, ns_search_only, /*%< dig
|
||||
* +nssearch,
|
||||
* host -C */
|
||||
identify, /*%< Append an "on server <foo>" message */
|
||||
identify_previous_line, /*% Prepend a "Nameserver <foo>:"
|
||||
* message, with newline and tab */
|
||||
ignore, recurse, aaonly, adflag, cdflag, raflag, tcflag, zflag,
|
||||
trace, /*% dig +trace */
|
||||
trace_root, /*% initial query for either +trace or +nssearch */
|
||||
ttlunits, use_usec, waiting_connect, zflag;
|
||||
char textname[MXNAME]; /*% Name we're going to be looking up */
|
||||
trace_root, /*% initial query for either +trace or +nssearch
|
||||
* */
|
||||
tcp_mode, tcp_mode_set, comments, stats, section_question,
|
||||
section_answer, section_authority, section_additional,
|
||||
servfail_stops, new_search, need_search, done_as_is, besteffort,
|
||||
dnssec, expire, sendcookie, seenbadcookie, badcookie,
|
||||
nsid, /*% Name Server ID (RFC 5001) */
|
||||
tcp_keepalive, header_only, ednsneg, mapped,
|
||||
print_unknown_format, multiline, nottl, noclass, onesoa,
|
||||
use_usec, nocrypto, ttlunits, idnin, idnout, expandaaaa, qr,
|
||||
accept_reply_unexpected_src, /*% print replies from
|
||||
* unexpected
|
||||
* sources. */
|
||||
setqid; /*% use a speciied query ID */
|
||||
char textname[MXNAME]; /*% Name we're going to be
|
||||
* looking up */
|
||||
char cmdline[MXNAME];
|
||||
dns_rdatatype_t rdtype;
|
||||
dns_rdatatype_t qrdtype;
|
||||
@@ -151,7 +141,7 @@ struct dig_lookup {
|
||||
dig_query_t *xfr_q;
|
||||
uint32_t retries;
|
||||
int nsfound;
|
||||
int16_t udpsize;
|
||||
uint16_t udpsize;
|
||||
int16_t edns;
|
||||
int16_t padding;
|
||||
uint32_t ixfr_serial;
|
||||
@@ -171,23 +161,15 @@ struct dig_lookup {
|
||||
int rrcomments;
|
||||
unsigned int eoferr;
|
||||
uint16_t qid;
|
||||
struct {
|
||||
bool http_plain;
|
||||
bool https_mode;
|
||||
bool https_get;
|
||||
char *https_path;
|
||||
};
|
||||
};
|
||||
|
||||
/*% The dig_query structure */
|
||||
struct dig_query {
|
||||
unsigned int magic;
|
||||
dig_lookup_t *lookup;
|
||||
bool first_pass;
|
||||
bool first_soa_rcvd;
|
||||
bool second_rr_rcvd;
|
||||
bool first_repeat_rcvd;
|
||||
bool warn_id;
|
||||
bool waiting_connect, pending_free, waiting_senddone, first_pass,
|
||||
first_soa_rcvd, second_rr_rcvd, first_repeat_rcvd, recv_made,
|
||||
warn_id, timedout;
|
||||
uint32_t first_rr_serial;
|
||||
uint32_t second_rr_serial;
|
||||
uint32_t msg_count;
|
||||
@@ -195,12 +177,9 @@ struct dig_query {
|
||||
bool ixfr_axfr;
|
||||
char *servname;
|
||||
char *userarg;
|
||||
isc_buffer_t sendbuf;
|
||||
isc_buffer_t recvbuf, lengthbuf, tmpsendbuf, sendbuf;
|
||||
char *recvspace, *tmpsendspace, lengthspace[4];
|
||||
isc_refcount_t references;
|
||||
isc_nmhandle_t *handle;
|
||||
isc_nmhandle_t *readhandle;
|
||||
isc_nmhandle_t *sendhandle;
|
||||
isc_socket_t *sock;
|
||||
ISC_LINK(dig_query_t) link;
|
||||
ISC_LINK(dig_query_t) clink;
|
||||
isc_sockaddr_t sockaddr;
|
||||
@@ -208,7 +187,6 @@ struct dig_query {
|
||||
isc_time_t time_recv;
|
||||
uint64_t byte_count;
|
||||
isc_timer_t *timer;
|
||||
isc_tlsctx_t *tlsctx;
|
||||
};
|
||||
|
||||
struct dig_server {
|
||||
@@ -237,14 +215,13 @@ extern unsigned int extrabytes;
|
||||
extern bool check_ra, have_ipv4, have_ipv6, specified_source, usesearch,
|
||||
showsearch, yaml;
|
||||
extern in_port_t port;
|
||||
extern bool port_set;
|
||||
extern unsigned int timeout;
|
||||
extern isc_mem_t *mctx;
|
||||
extern isc_refcount_t sendcount;
|
||||
extern int sendcount;
|
||||
extern int ndots;
|
||||
extern int lookup_counter;
|
||||
extern int exitcode;
|
||||
extern isc_sockaddr_t localaddr;
|
||||
extern isc_sockaddr_t bind_address;
|
||||
extern char keynametext[MXNAME];
|
||||
extern char keyfile[MXNAME];
|
||||
extern char keysecret[MXNAME];
|
||||
@@ -409,38 +386,32 @@ setup_text_key(void);
|
||||
* Routines exported from dig.c for use by dig for iOS
|
||||
*/
|
||||
|
||||
/*%
|
||||
/*%<
|
||||
* Call once only to set up libraries, parse global
|
||||
* parameters and initial command line query parameters
|
||||
*/
|
||||
void
|
||||
dig_setup(int argc, char **argv);
|
||||
|
||||
/*%
|
||||
/*%<
|
||||
* Call to supply new parameters for the next lookup
|
||||
*/
|
||||
void
|
||||
dig_query_setup(bool, bool, int argc, char **argv);
|
||||
|
||||
/*%
|
||||
/*%<
|
||||
* set the main application event cycle running
|
||||
*/
|
||||
void
|
||||
dig_startup(void);
|
||||
|
||||
/*%
|
||||
/*%<
|
||||
* Initiates the next lookup cycle
|
||||
*/
|
||||
void
|
||||
dig_query_start(void);
|
||||
|
||||
/*%
|
||||
* Activate/deactivate IDN filtering of output.
|
||||
*/
|
||||
void
|
||||
dig_idnsetup(dig_lookup_t *lookup, bool active);
|
||||
|
||||
/*%
|
||||
/*%<
|
||||
* Cleans up the application
|
||||
*/
|
||||
void
|
||||
|
||||
+4
-8
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
@@ -151,11 +151,7 @@ received(unsigned int bytes, isc_sockaddr_t *from, dig_query_t *query) {
|
||||
if (!short_form) {
|
||||
char fromtext[ISC_SOCKADDR_FORMATSIZE];
|
||||
isc_sockaddr_format(from, fromtext, sizeof(fromtext));
|
||||
if (query->lookup->use_usec) {
|
||||
TIME_NOW_HIRES(&now);
|
||||
} else {
|
||||
TIME_NOW(&now);
|
||||
}
|
||||
TIME_NOW(&now);
|
||||
diff = (int)isc_time_microdiff(&now, &query->time_sent);
|
||||
printf("Received %u bytes from %s in %d ms\n", bytes, fromtext,
|
||||
diff / 1000);
|
||||
@@ -379,7 +375,7 @@ chase_cnamechain(dns_message_t *msg, dns_name_t *qname) {
|
||||
dns_rdataset_current(rdataset, &rdata);
|
||||
result = dns_rdata_tostruct(&rdata, &cname, NULL);
|
||||
check_result(result, "dns_rdata_tostruct");
|
||||
dns_name_copy(&cname.cname, qname);
|
||||
dns_name_copynf(&cname.cname, qname);
|
||||
dns_rdata_freestruct(&cname);
|
||||
}
|
||||
}
|
||||
@@ -442,7 +438,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
|
||||
|
||||
/* Add AAAA and MX lookups. */
|
||||
name = dns_fixedname_initname(&fixed);
|
||||
dns_name_copy(query->lookup->name, name);
|
||||
dns_name_copynf(query->lookup->name, name);
|
||||
chase_cnamechain(msg, name);
|
||||
dns_name_format(name, namestr, sizeof(namestr));
|
||||
lookup = clone_lookup(query->lookup, false);
|
||||
|
||||
+68
-68
@@ -3,7 +3,7 @@
|
||||
|
||||
This Source Code Form is subject to the terms of the Mozilla Public
|
||||
License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
|
||||
See the COPYRIGHT file distributed with this work for additional
|
||||
information regarding copyright ownership.
|
||||
@@ -36,12 +36,12 @@ Description
|
||||
|
||||
``host`` is a simple utility for performing DNS lookups. It is normally
|
||||
used to convert names to IP addresses and vice versa. When no arguments
|
||||
or options are given, ``host`` prints a short summary of its
|
||||
command-line arguments and options.
|
||||
or options are given, ``host`` prints a short summary of its command
|
||||
line arguments and options.
|
||||
|
||||
``name`` is the domain name that is to be looked up. It can also be a
|
||||
dotted-decimal IPv4 address or a colon-delimited IPv6 address, in which
|
||||
case ``host`` by default performs a reverse lookup for that address.
|
||||
case ``host`` will by default perform a reverse lookup for that address.
|
||||
``server`` is an optional argument which is either the name or IP
|
||||
address of the name server that ``host`` should query instead of the
|
||||
server or servers listed in ``/etc/resolv.conf``.
|
||||
@@ -49,111 +49,111 @@ server or servers listed in ``/etc/resolv.conf``.
|
||||
Options
|
||||
~~~~~~~
|
||||
|
||||
``-4``
|
||||
This option specifies that only IPv4 should be used for query transport. See also the ``-6`` option.
|
||||
**-4**
|
||||
Use IPv4 only for query transport. See also the ``-6`` option.
|
||||
|
||||
``-6``
|
||||
This option specifies that only IPv6 should be used for query transport. See also the ``-4`` option.
|
||||
**-6**
|
||||
Use IPv6 only for query transport. See also the ``-4`` option.
|
||||
|
||||
``-a``
|
||||
The ``-a`` ("all") option is normally equivalent to ``-v -t ANY``. It
|
||||
also affects the behavior of the ``-l`` list zone option.
|
||||
**-a**
|
||||
"All". The ``-a`` option is normally equivalent to ``-v -t ANY``. It
|
||||
also affects the behaviour of the ``-l`` list zone option.
|
||||
|
||||
``-A``
|
||||
The ``-A`` ("almost all") option is equivalent to ``-a``, except that RRSIG,
|
||||
**-A**
|
||||
"Almost all". The ``-A`` option is equivalent to ``-a`` except RRSIG,
|
||||
NSEC, and NSEC3 records are omitted from the output.
|
||||
|
||||
``-c class``
|
||||
This option specifies the query class, which can be used to lookup HS (Hesiod) or CH (Chaosnet)
|
||||
**-c** class
|
||||
Query class: This can be used to lookup HS (Hesiod) or CH (Chaosnet)
|
||||
class resource records. The default class is IN (Internet).
|
||||
|
||||
``-C``
|
||||
This option indicates that ``named`` should check consistency, meaning that ``host`` queries the SOA records for zone
|
||||
**-C**
|
||||
Check consistency: ``host`` will query the SOA records for zone
|
||||
``name`` from all the listed authoritative name servers for that
|
||||
zone. The list of name servers is defined by the NS records that are
|
||||
found for the zone.
|
||||
|
||||
``-d``
|
||||
This option prints debugging traces, and is equivalent to the ``-v`` verbose option.
|
||||
**-d**
|
||||
Print debugging traces. Equivalent to the ``-v`` verbose option.
|
||||
|
||||
``-l``
|
||||
This option tells ``named` to list the zone, meaning the ``host`` command performs a zone transfer of zone
|
||||
``name`` and prints out the NS, PTR, and address records (A/AAAA).
|
||||
**-l**
|
||||
List zone: The ``host`` command performs a zone transfer of zone
|
||||
``name`` and prints out the NS, PTR and address records (A/AAAA).
|
||||
|
||||
Together, the ``-l -a`` options print all records in the zone.
|
||||
|
||||
``-N ndots``
|
||||
This option specifies the number of dots (``ndots``) that have to be in ``name`` for it to be
|
||||
**-N** ndots
|
||||
The number of dots that have to be in ``name`` for it to be
|
||||
considered absolute. The default value is that defined using the
|
||||
``ndots`` statement in ``/etc/resolv.conf``, or 1 if no ``ndots`` statement
|
||||
is present. Names with fewer dots are interpreted as relative names,
|
||||
and are searched for in the domains listed in the ``search`` or
|
||||
ndots statement in ``/etc/resolv.conf``, or 1 if no ndots statement
|
||||
is present. Names with fewer dots are interpreted as relative names
|
||||
and will be searched for in the domains listed in the ``search`` or
|
||||
``domain`` directive in ``/etc/resolv.conf``.
|
||||
|
||||
``-p port``
|
||||
This option specifies the port to query on the server. The default is 53.
|
||||
**-p** port
|
||||
Specify the port on the server to query. The default is 53.
|
||||
|
||||
``-r``
|
||||
This option specifies a non-recursive query; setting this option clears the RD (recursion
|
||||
desired) bit in the query. This means that the name server
|
||||
receiving the query does not attempt to resolve ``name``. The ``-r``
|
||||
**-r**
|
||||
Non-recursive query: Setting this option clears the RD (recursion
|
||||
desired) bit in the query. This should mean that the name server
|
||||
receiving the query will not attempt to resolve ``name``. The ``-r``
|
||||
option enables ``host`` to mimic the behavior of a name server by
|
||||
making non-recursive queries, and expecting to receive answers to
|
||||
making non-recursive queries and expecting to receive answers to
|
||||
those queries that can be referrals to other name servers.
|
||||
|
||||
``-R number``
|
||||
This option specifies the number of retries for UDP queries. If ``number`` is negative or zero,
|
||||
the number of retries is silently set to 1. The default value is 1, or
|
||||
**-R** number
|
||||
Number of retries for UDP queries: If ``number`` is negative or zero,
|
||||
the number of retries will default to 1. The default value is 1, or
|
||||
the value of the ``attempts`` option in ``/etc/resolv.conf``, if set.
|
||||
|
||||
``-s``
|
||||
This option tells ``named`` *not* to send the query to the next nameserver if any server responds
|
||||
**-s**
|
||||
Do *not* send the query to the next nameserver if any server responds
|
||||
with a SERVFAIL response, which is the reverse of normal stub
|
||||
resolver behavior.
|
||||
|
||||
``-t type``
|
||||
This option specifies the query type. The ``type`` argument can be any recognized query type:
|
||||
**-t** type
|
||||
Query type: The ``type`` argument can be any recognized query type:
|
||||
CNAME, NS, SOA, TXT, DNSKEY, AXFR, etc.
|
||||
|
||||
When no query type is specified, ``host`` automatically selects an
|
||||
appropriate query type. By default, it looks for A, AAAA, and MX
|
||||
records. If the ``-C`` option is given, queries are made for SOA
|
||||
records. If the ``-C`` option is given, queries will be made for SOA
|
||||
records. If ``name`` is a dotted-decimal IPv4 address or
|
||||
colon-delimited IPv6 address, ``host`` queries for PTR records.
|
||||
colon-delimited IPv6 address, ``host`` will query for PTR records.
|
||||
|
||||
If a query type of IXFR is chosen, the starting serial number can be
|
||||
specified by appending an equals sign (=), followed by the starting serial
|
||||
number, e.g., ``-t IXFR=12345678``.
|
||||
If a query type of IXFR is chosen the starting serial number can be
|
||||
specified by appending an equal followed by the starting serial
|
||||
number (like ``-t IXFR=12345678``).
|
||||
|
||||
``-T``; ``-U``
|
||||
This option specifies TCP or UDP. By default, ``host`` uses UDP when making queries; the
|
||||
**-T**; **-U**
|
||||
TCP/UDP: By default, ``host`` uses UDP when making queries. The
|
||||
``-T`` option makes it use a TCP connection when querying the name
|
||||
server. TCP is automatically selected for queries that require
|
||||
it, such as zone transfer (AXFR) requests. Type ``ANY`` queries default
|
||||
to TCP, but can be forced to use UDP initially via ``-U``.
|
||||
server. TCP will be automatically selected for queries that require
|
||||
it, such as zone transfer (AXFR) requests. Type ANY queries default
|
||||
to TCP but can be forced to UDP initially using ``-U``.
|
||||
|
||||
``-m flag``
|
||||
This option sets memory usage debugging: the flag can be ``record``, ``usage``, or
|
||||
``trace``. The ``-m`` option can be specified more than once to set
|
||||
**-m** flag
|
||||
Memory usage debugging: the flag can be ``record``, ``usage``, or
|
||||
``trace``. You can specify the ``-m`` option more than once to set
|
||||
multiple flags.
|
||||
|
||||
``-v``
|
||||
This option sets verbose output, and is equivalent to the ``-d`` debug option. Verbose output
|
||||
**-v**
|
||||
Verbose output. Equivalent to the ``-d`` debug option. Verbose output
|
||||
can also be enabled by setting the ``debug`` option in
|
||||
``/etc/resolv.conf``.
|
||||
|
||||
``-V``
|
||||
This option prints the version number and exits.
|
||||
**-V**
|
||||
Print the version number and exit.
|
||||
|
||||
``-w``
|
||||
This option sets "wait forever": the query timeout is set to the maximum possible. See
|
||||
**-w**
|
||||
Wait forever: The query timeout is set to the maximum possible. See
|
||||
also the ``-W`` option.
|
||||
|
||||
``-W wait``
|
||||
This options sets the length of the wait timeout, indicating that ``named`` should wait for up to ``wait`` seconds for a reply. If ``wait`` is
|
||||
less than 1, the wait interval is set to 1 second.
|
||||
**-W** wait
|
||||
Timeout: Wait for up to ``wait`` seconds for a reply. If ``wait`` is
|
||||
less than one, the wait interval is set to one second.
|
||||
|
||||
By default, ``host`` waits for 5 seconds for UDP responses and 10
|
||||
By default, ``host`` will wait for 5 seconds for UDP responses and 10
|
||||
seconds for TCP connections. These defaults can be overridden by the
|
||||
``timeout`` option in ``/etc/resolv.conf``.
|
||||
|
||||
@@ -164,10 +164,10 @@ IDN Support
|
||||
|
||||
If ``host`` has been built with IDN (internationalized domain name)
|
||||
support, it can accept and display non-ASCII domain names. ``host``
|
||||
appropriately converts character encoding of a domain name before sending
|
||||
a request to a DNS server or displaying a reply from the server.
|
||||
To turn off IDN support, define the ``IDN_DISABLE``
|
||||
environment variable. IDN support is disabled if the variable is set
|
||||
appropriately converts character encoding of domain name before sending
|
||||
a request to DNS server or displaying a reply from the server. If you'd
|
||||
like to turn off the IDN support for some reason, define the IDN_DISABLE
|
||||
environment variable. The IDN support is disabled if the variable is set
|
||||
when ``host`` runs.
|
||||
|
||||
Files
|
||||
|
||||
Symlink
+1
@@ -0,0 +1 @@
|
||||
../../../.clang-format.headers
|
||||
+82
-14
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
@@ -37,7 +37,22 @@
|
||||
#include <dns/rdatatype.h>
|
||||
|
||||
#include "dighost.h"
|
||||
#include "readline.h"
|
||||
|
||||
#if defined(HAVE_READLINE)
|
||||
#if defined(HAVE_EDIT_READLINE_READLINE_H)
|
||||
#include <edit/readline/readline.h>
|
||||
#if defined(HAVE_EDIT_READLINE_HISTORY_H)
|
||||
#include <edit/readline/history.h>
|
||||
#endif /* if defined(HAVE_EDIT_READLINE_HISTORY_H) */
|
||||
#elif defined(HAVE_EDITLINE_READLINE_H)
|
||||
#include <editline/readline.h>
|
||||
#elif defined(HAVE_READLINE_READLINE_H)
|
||||
#include <readline/readline.h>
|
||||
#if defined(HAVE_READLINE_HISTORY_H)
|
||||
#include <readline/history.h>
|
||||
#endif /* if defined(HAVE_READLINE_HISTORY_H) */
|
||||
#endif /* if defined(HAVE_EDIT_READLINE_READLINE_H) */
|
||||
#endif /* if defined(HAVE_READLINE) */
|
||||
|
||||
static bool short_form = true, tcpmode = false, tcpmode_set = false,
|
||||
identify = false, stats = true, comments = true,
|
||||
@@ -110,6 +125,8 @@ static const char *rtypetext[] = {
|
||||
|
||||
#define N_KNOWN_RRTYPES (sizeof(rtypetext) / sizeof(rtypetext[0]))
|
||||
|
||||
static void
|
||||
flush_lookup_list(void);
|
||||
static void
|
||||
getinput(isc_task_t *task, isc_event_t *event);
|
||||
|
||||
@@ -134,6 +151,7 @@ static void
|
||||
query_finished(void) {
|
||||
isc_event_t *event = global_event;
|
||||
|
||||
flush_lookup_list();
|
||||
debug("dighost_shutdown()");
|
||||
|
||||
if (!in_use) {
|
||||
@@ -391,7 +409,7 @@ chase_cnamechain(dns_message_t *msg, dns_name_t *qname) {
|
||||
dns_rdataset_current(rdataset, &rdata);
|
||||
result = dns_rdata_tostruct(&rdata, &cname, NULL);
|
||||
check_result(result, "dns_rdata_tostruct");
|
||||
dns_name_copy(&cname.cname, qname);
|
||||
dns_name_copynf(&cname.cname, qname);
|
||||
dns_rdata_freestruct(&cname);
|
||||
}
|
||||
}
|
||||
@@ -448,7 +466,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
|
||||
|
||||
/* Add AAAA lookup. */
|
||||
name = dns_fixedname_initname(&fixed);
|
||||
dns_name_copy(query->lookup->name, name);
|
||||
dns_name_copynf(query->lookup->name, name);
|
||||
chase_cnamechain(msg, name);
|
||||
dns_name_format(name, namestr, sizeof(namestr));
|
||||
lookup = clone_lookup(query->lookup, false);
|
||||
@@ -619,8 +637,6 @@ static void
|
||||
setoption(char *opt) {
|
||||
size_t l = strlen(opt);
|
||||
|
||||
debugging = true;
|
||||
|
||||
#define CHECKOPT(A, N) \
|
||||
((l >= N) && (l < sizeof(A)) && (strncasecmp(opt, A, l) == 0))
|
||||
|
||||
@@ -771,6 +787,7 @@ addlookup(char *opt) {
|
||||
lookup->recurse = recurse;
|
||||
lookup->aaonly = aaonly;
|
||||
lookup->retries = tries;
|
||||
lookup->udpsize = 0;
|
||||
lookup->setqid = false;
|
||||
lookup->qid = 0;
|
||||
lookup->comments = comments;
|
||||
@@ -831,27 +848,38 @@ do_next_command(char *input) {
|
||||
|
||||
static void
|
||||
get_next_command(void) {
|
||||
char cmdlinebuf[COMMSIZE];
|
||||
char *cmdline, *ptr = NULL;
|
||||
char *buf;
|
||||
char *ptr;
|
||||
|
||||
fflush(stdout);
|
||||
buf = isc_mem_allocate(mctx, COMMSIZE);
|
||||
isc_app_block();
|
||||
if (interactive) {
|
||||
cmdline = ptr = readline("> ");
|
||||
if (ptr != NULL && *ptr != 0) {
|
||||
#ifdef HAVE_READLINE
|
||||
ptr = readline("> ");
|
||||
if (ptr != NULL) {
|
||||
add_history(ptr);
|
||||
}
|
||||
#else /* ifdef HAVE_READLINE */
|
||||
fprintf(stderr, "> ");
|
||||
fflush(stderr);
|
||||
ptr = fgets(buf, COMMSIZE, stdin);
|
||||
#endif /* ifdef HAVE_READLINE */
|
||||
} else {
|
||||
cmdline = fgets(cmdlinebuf, COMMSIZE, stdin);
|
||||
ptr = fgets(buf, COMMSIZE, stdin);
|
||||
}
|
||||
isc_app_unblock();
|
||||
if (cmdline == NULL) {
|
||||
if (ptr == NULL) {
|
||||
in_use = false;
|
||||
} else {
|
||||
do_next_command(cmdline);
|
||||
do_next_command(ptr);
|
||||
}
|
||||
if (ptr != NULL) {
|
||||
#ifdef HAVE_READLINE
|
||||
if (interactive) {
|
||||
free(ptr);
|
||||
}
|
||||
#endif /* ifdef HAVE_READLINE */
|
||||
isc_mem_free(mctx, buf);
|
||||
}
|
||||
|
||||
ISC_NORETURN static void
|
||||
@@ -903,6 +931,46 @@ parse_args(int argc, char **argv) {
|
||||
}
|
||||
}
|
||||
|
||||
static void
|
||||
flush_lookup_list(void) {
|
||||
dig_lookup_t *l, *lp;
|
||||
dig_query_t *q, *qp;
|
||||
dig_server_t *s, *sp;
|
||||
|
||||
lookup_counter = 0;
|
||||
l = ISC_LIST_HEAD(lookup_list);
|
||||
while (l != NULL) {
|
||||
q = ISC_LIST_HEAD(l->q);
|
||||
while (q != NULL) {
|
||||
if (q->sock != NULL) {
|
||||
isc_socket_cancel(q->sock, NULL,
|
||||
ISC_SOCKCANCEL_ALL);
|
||||
isc_socket_detach(&q->sock);
|
||||
}
|
||||
isc_buffer_invalidate(&q->recvbuf);
|
||||
isc_buffer_invalidate(&q->lengthbuf);
|
||||
qp = q;
|
||||
q = ISC_LIST_NEXT(q, link);
|
||||
ISC_LIST_DEQUEUE(l->q, qp, link);
|
||||
isc_mem_free(mctx, qp);
|
||||
}
|
||||
s = ISC_LIST_HEAD(l->my_server_list);
|
||||
while (s != NULL) {
|
||||
sp = s;
|
||||
s = ISC_LIST_NEXT(s, link);
|
||||
ISC_LIST_DEQUEUE(l->my_server_list, sp, link);
|
||||
isc_mem_free(mctx, sp);
|
||||
}
|
||||
if (l->sendmsg != NULL) {
|
||||
dns_message_destroy(&l->sendmsg);
|
||||
}
|
||||
lp = l;
|
||||
l = ISC_LIST_NEXT(l, link);
|
||||
ISC_LIST_DEQUEUE(lookup_list, lp, link);
|
||||
isc_mem_free(mctx, lp);
|
||||
}
|
||||
}
|
||||
|
||||
static void
|
||||
getinput(isc_task_t *task, isc_event_t *event) {
|
||||
UNUSED(task);
|
||||
|
||||
+79
-69
@@ -3,7 +3,7 @@
|
||||
|
||||
This Source Code Form is subject to the terms of the Mozilla Public
|
||||
License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
|
||||
See the COPYRIGHT file distributed with this work for additional
|
||||
information regarding copyright ownership.
|
||||
@@ -34,11 +34,11 @@ Synopsis
|
||||
Description
|
||||
~~~~~~~~~~~
|
||||
|
||||
``nslookup`` is a program to query Internet domain name servers.
|
||||
``nslookup`` has two modes: interactive and non-interactive. Interactive
|
||||
``Nslookup`` is a program to query Internet domain name servers.
|
||||
``Nslookup`` has two modes: interactive and non-interactive. Interactive
|
||||
mode allows the user to query name servers for information about various
|
||||
hosts and domains or to print a list of hosts in a domain.
|
||||
Non-interactive mode prints just the name and requested
|
||||
Non-interactive mode is used to print just the name and requested
|
||||
information for a host or domain.
|
||||
|
||||
Arguments
|
||||
@@ -46,7 +46,7 @@ Arguments
|
||||
|
||||
Interactive mode is entered in the following cases:
|
||||
|
||||
a. when no arguments are given (the default name server is used);
|
||||
a. when no arguments are given (the default name server will be used)
|
||||
|
||||
b. when the first argument is a hyphen (-) and the second argument is
|
||||
the host name or Internet address of a name server.
|
||||
@@ -57,7 +57,7 @@ argument specifies the host name or address of a name server.
|
||||
|
||||
Options can also be specified on the command line if they precede the
|
||||
arguments and are prefixed with a hyphen. For example, to change the
|
||||
default query type to host information, with an initial timeout of 10
|
||||
default query type to host information, and the initial timeout to 10
|
||||
seconds, type:
|
||||
|
||||
::
|
||||
@@ -65,59 +65,59 @@ seconds, type:
|
||||
nslookup -query=hinfo -timeout=10
|
||||
|
||||
The ``-version`` option causes ``nslookup`` to print the version number
|
||||
and immediately exit.
|
||||
and immediately exits.
|
||||
|
||||
Interactive Commands
|
||||
~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
``host [server]``
|
||||
This command looks up information for ``host`` using the current default server or
|
||||
using ``server``, if specified. If ``host`` is an Internet address and the
|
||||
query type is A or PTR, the name of the host is returned. If ``host`` is
|
||||
a name and does not have a trailing period (``.``), the search list is used
|
||||
``host`` [server]
|
||||
Look up information for host using the current default server or
|
||||
using server, if specified. If host is an Internet address and the
|
||||
query type is A or PTR, the name of the host is returned. If host is
|
||||
a name and does not have a trailing period, the search list is used
|
||||
to qualify the name.
|
||||
|
||||
To look up a host not in the current domain, append a period to the
|
||||
name.
|
||||
|
||||
``server domain`` | ``lserver domain``
|
||||
These commands change the default server to ``domain``; ``lserver`` uses the initial
|
||||
server to look up information about ``domain``, while ``server`` uses the
|
||||
current default server. If an authoritative answer cannot be found,
|
||||
``server`` domain | ``lserver`` domain
|
||||
Change the default server to domain; ``lserver`` uses the initial
|
||||
server to look up information about domain, while ``server`` uses the
|
||||
current default server. If an authoritative answer can't be found,
|
||||
the names of servers that might have the answer are returned.
|
||||
|
||||
``root``
|
||||
This command is not implemented.
|
||||
not implemented
|
||||
|
||||
``finger``
|
||||
This command is not implemented.
|
||||
not implemented
|
||||
|
||||
``ls``
|
||||
This command is not implemented.
|
||||
not implemented
|
||||
|
||||
``view``
|
||||
This command is not implemented.
|
||||
not implemented
|
||||
|
||||
``help``
|
||||
This command is not implemented.
|
||||
not implemented
|
||||
|
||||
``?``
|
||||
This command is not implemented.
|
||||
not implemented
|
||||
|
||||
``exit``
|
||||
This command exits the program.
|
||||
Exits the program.
|
||||
|
||||
``set keyword[=value]``
|
||||
``set`` keyword[=value]
|
||||
This command is used to change state information that affects the
|
||||
lookups. Valid keywords are:
|
||||
|
||||
``all``
|
||||
This keyword prints the current values of the frequently used options to
|
||||
Prints the current values of the frequently used options to
|
||||
``set``. Information about the current default server and host is
|
||||
also printed.
|
||||
|
||||
``class=value``
|
||||
This keyword changes the query class to one of:
|
||||
``class=``\ value
|
||||
Change the query class to one of:
|
||||
|
||||
``IN``
|
||||
the Internet class
|
||||
@@ -131,62 +131,72 @@ Interactive Commands
|
||||
``ANY``
|
||||
wildcard
|
||||
|
||||
The class specifies the protocol group of the information. The default
|
||||
is ``IN``; the abbreviation for this keyword is ``cl``.
|
||||
The class specifies the protocol group of the information.
|
||||
|
||||
(Default = IN; abbreviation = cl)
|
||||
|
||||
``nodebug``
|
||||
This keyword turns on or off the display of the full response packet, and any
|
||||
intermediate response packets, when searching. The default for this keyword is
|
||||
``nodebug``; the abbreviation for this keyword is ``[no]deb``.
|
||||
Turn on or off the display of the full response packet and any
|
||||
intermediate response packets when searching.
|
||||
|
||||
(Default = nodebug; abbreviation = [no]deb)
|
||||
|
||||
``nod2``
|
||||
This keyword turns debugging mode on or off. This displays more about what
|
||||
nslookup is doing. The default is ``nod2``.
|
||||
Turn debugging mode on or off. This displays more about what
|
||||
nslookup is doing.
|
||||
|
||||
``domain=name``
|
||||
This keyword sets the search list to ``name``.
|
||||
(Default = nod2)
|
||||
|
||||
``domain=``\ name
|
||||
Sets the search list to name.
|
||||
|
||||
``nosearch``
|
||||
If the lookup request contains at least one period, but does not end
|
||||
with a trailing period, this keyword appends the domain names in the domain
|
||||
search list to the request until an answer is received. The default is ``search``.
|
||||
If the lookup request contains at least one period but doesn't end
|
||||
with a trailing period, append the domain names in the domain
|
||||
search list to the request until an answer is received.
|
||||
|
||||
``port=value``
|
||||
This keyword changes the default TCP/UDP name server port to ``value`` from
|
||||
its default, port 53. The abbreviation for this keyword is ``po``.
|
||||
(Default = search)
|
||||
|
||||
``querytype=value`` | ``type=value``
|
||||
This keyword changes the type of the information query to ``value``. The
|
||||
defaults are A and then AAAA; the abbreviations for these keywords are
|
||||
``q`` and ``ty``.
|
||||
``port=``\ value
|
||||
Change the default TCP/UDP name server port to value.
|
||||
|
||||
Please note that it is only possible to specify one query type. Only the default
|
||||
behavior looks up both when an alternative is not specified.
|
||||
(Default = 53; abbreviation = po)
|
||||
|
||||
``querytype=``\ value | ``type=``\ value
|
||||
Change the type of the information query.
|
||||
|
||||
(Default = A and then AAAA; abbreviations = q, ty)
|
||||
|
||||
**Note:** It is only possible to specify one query type, only the default
|
||||
behavior looks up both when an alternative is not specified.
|
||||
|
||||
``norecurse``
|
||||
This keyword tells the name server to query other servers if it does not have
|
||||
the information. The default is ``recurse``; the abbreviation for this
|
||||
keyword is ``[no]rec``.
|
||||
Tell the name server to query other servers if it does not have
|
||||
the information.
|
||||
|
||||
``ndots=number``
|
||||
This keyword sets the number of dots (label separators) in a domain that
|
||||
disables searching. Absolute names always stop searching.
|
||||
(Default = recurse; abbreviation = [no]rec)
|
||||
|
||||
``retry=number``
|
||||
This keyword sets the number of retries to ``number``.
|
||||
``ndots=``\ number
|
||||
Set the number of dots (label separators) in a domain that will
|
||||
disable searching. Absolute names always stop searching.
|
||||
|
||||
``timeout=number``
|
||||
This keyword changes the initial timeout interval to wait for a reply to
|
||||
``number``, in seconds.
|
||||
``retry=``\ number
|
||||
Set the number of retries to number.
|
||||
|
||||
``timeout=``\ number
|
||||
Change the initial timeout interval for waiting for a reply to
|
||||
number seconds.
|
||||
|
||||
``novc``
|
||||
This keyword indicates that a virtual circuit should always be used when sending requests to the server.
|
||||
``novc`` is the default.
|
||||
Always use a virtual circuit when sending requests to the server.
|
||||
|
||||
(Default = novc)
|
||||
|
||||
``nofail``
|
||||
This keyword tries the next nameserver if a nameserver responds with SERVFAIL or
|
||||
a referral (nofail), or terminates the query (fail) on such a response. The
|
||||
default is ``nofail``.
|
||||
Try the next nameserver if a nameserver responds with SERVFAIL or
|
||||
a referral (nofail) or terminate query (fail) on such a response.
|
||||
|
||||
(Default = nofail)
|
||||
|
||||
Return Values
|
||||
~~~~~~~~~~~~~
|
||||
@@ -199,11 +209,11 @@ IDN Support
|
||||
|
||||
If ``nslookup`` has been built with IDN (internationalized domain name)
|
||||
support, it can accept and display non-ASCII domain names. ``nslookup``
|
||||
appropriately converts character encoding of a domain name before sending
|
||||
a request to a DNS server or displaying a reply from the server.
|
||||
To turn off IDN support, define the ``IDN_DISABLE``
|
||||
environment variable. IDN support is disabled if the variable is set
|
||||
when ``nslookup`` runs, or when the standard output is not a tty.
|
||||
appropriately converts character encoding of domain name before sending
|
||||
a request to DNS server or displaying a reply from the server. If you'd
|
||||
like to turn off the IDN support for some reason, define the IDN_DISABLE
|
||||
environment variable. The IDN support is disabled if the variable is set
|
||||
when ``nslookup`` runs or when the standard output is not a tty.
|
||||
|
||||
Files
|
||||
~~~~~
|
||||
|
||||
@@ -1,56 +0,0 @@
|
||||
/*
|
||||
* Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
*/
|
||||
|
||||
#pragma once
|
||||
|
||||
/*
|
||||
* A little wrapper around readline(), add_history() and free() to make using
|
||||
* the readline code simpler.
|
||||
*/
|
||||
|
||||
#if defined(HAVE_READLINE_LIBEDIT)
|
||||
#include <editline/readline.h>
|
||||
#elif defined(HAVE_READLINE_EDITLINE)
|
||||
#include <editline.h>
|
||||
#elif defined(HAVE_READLINE_READLINE)
|
||||
/* Prevent deprecated functions being declared. */
|
||||
#define _FUNCTION_DEF 1
|
||||
/* Ensure rl_message() gets prototype. */
|
||||
#define USE_VARARGS 1
|
||||
#define PREFER_STDARG 1
|
||||
#include <readline/history.h>
|
||||
#include <readline/readline.h>
|
||||
#endif
|
||||
|
||||
#if !defined(HAVE_READLINE_LIBEDIT) && !defined(HAVE_READLINE_EDITLINE) && \
|
||||
!defined(HAVE_READLINE_READLINE)
|
||||
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
|
||||
#define RL_MAXCMD (128 * 1024)
|
||||
|
||||
static inline char *
|
||||
readline(const char *prompt) {
|
||||
char *line, *buf = malloc(RL_MAXCMD);
|
||||
fprintf(stdout, "%s", prompt);
|
||||
fflush(stdout);
|
||||
line = fgets(buf, RL_MAXCMD, stdin);
|
||||
if (line == NULL) {
|
||||
free(buf);
|
||||
return (NULL);
|
||||
}
|
||||
return (buf);
|
||||
};
|
||||
|
||||
#define add_history(line)
|
||||
|
||||
#endif
|
||||
@@ -75,7 +75,7 @@
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dighost.lib;libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;@IDN_LIB@ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@dighost.lib;libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;@IDN_LIB@ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
|
||||
@@ -107,7 +107,7 @@
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
|
||||
<AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dighost.lib;libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;@IDN_LIB@ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@dighost.lib;libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;@IDN_LIB@ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemGroup>
|
||||
|
||||
@@ -75,7 +75,7 @@
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dighost.lib;@IDN_LIB@libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@dighost.lib;@IDN_LIB@libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
|
||||
@@ -107,7 +107,7 @@
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
|
||||
<AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dighost.lib;@IDN_LIB@libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@dighost.lib;@IDN_LIB@libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemGroup>
|
||||
|
||||
@@ -75,7 +75,7 @@
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<AdditionalLibraryDirectories>..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@@READLINE_LIBD@@IDN_LIB@libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@@READLINE_LIBD@@IDN_LIB@libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
|
||||
@@ -107,7 +107,7 @@
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
|
||||
<AdditionalLibraryDirectories>..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@@READLINE_LIB@@IDN_LIB@libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@@READLINE_LIB@@IDN_LIB@libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemGroup>
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
|
||||
+59
-60
@@ -3,7 +3,7 @@
|
||||
|
||||
This Source Code Form is subject to the terms of the Mozilla Public
|
||||
License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
|
||||
See the COPYRIGHT file distributed with this work for additional
|
||||
information regarding copyright ownership.
|
||||
@@ -29,7 +29,7 @@ dnssec-cds - change DS records for a child zone based on CDS/CDNSKEY
|
||||
Synopsis
|
||||
~~~~~~~~
|
||||
|
||||
:program:`dnssec-cds` [**-a** alg...] [**-c** class] [**-D**] {**-d** dsset-file} {**-f** child-file} [**-i**[extension]] [**-s** start-time] [**-T** ttl] [**-u**] [**-v** level] [**-V**] {domain}
|
||||
:program:`dnssec-cds` [**-a** alg...] [**-c** class] [**-D**] {**-d** dsset-file} {**-f** child-file} [**-i** [extension]] [**-s** start-time] [**-T** ttl] [**-u**] [**-v** level] [**-V**] {domain}
|
||||
|
||||
Description
|
||||
~~~~~~~~~~~
|
||||
@@ -38,8 +38,8 @@ The ``dnssec-cds`` command changes DS records at a delegation point
|
||||
based on CDS or CDNSKEY records published in the child zone. If both CDS
|
||||
and CDNSKEY records are present in the child zone, the CDS is preferred.
|
||||
This enables a child zone to inform its parent of upcoming changes to
|
||||
its key-signing keys (KSKs); by polling periodically with ``dnssec-cds``, the
|
||||
parent can keep the DS records up-to-date and enable automatic rolling
|
||||
its key-signing keys; by polling periodically with ``dnssec-cds``, the
|
||||
parent can keep the DS records up to date and enable automatic rolling
|
||||
of KSKs.
|
||||
|
||||
Two input files are required. The ``-f child-file`` option specifies a
|
||||
@@ -52,12 +52,12 @@ output of a previous run of ``dnssec-cds``.
|
||||
|
||||
The ``dnssec-cds`` command uses special DNSSEC validation logic
|
||||
specified by :rfc:`7344`. It requires that the CDS and/or CDNSKEY records
|
||||
be validly signed by a key represented in the existing DS records. This
|
||||
is typically the pre-existing KSK.
|
||||
are validly signed by a key represented in the existing DS records. This
|
||||
will typically be the pre-existing key-signing key (KSK).
|
||||
|
||||
For protection against replay attacks, the signatures on the child
|
||||
records must not be older than they were on a previous run of
|
||||
``dnssec-cds``. Their age is obtained from the modification time of the
|
||||
``dnssec-cds``. This time is obtained from the modification time of the
|
||||
``dsset-`` file, or from the ``-s`` option.
|
||||
|
||||
To protect against breaking the delegation, ``dnssec-cds`` ensures that
|
||||
@@ -67,104 +67,103 @@ type.
|
||||
|
||||
By default, replacement DS records are written to the standard output;
|
||||
with the ``-i`` option the input file is overwritten in place. The
|
||||
replacement DS records are the same as the existing records, when no
|
||||
change is required. The output can be empty if the CDS/CDNSKEY records
|
||||
specify that the child zone wants to be insecure.
|
||||
replacement DS records will be the same as the existing records when no
|
||||
change is required. The output can be empty if the CDS / CDNSKEY records
|
||||
specify that the child zone wants to go insecure.
|
||||
|
||||
.. warning::
|
||||
|
||||
Be careful not to delete the DS records when ``dnssec-cds`` fails!
|
||||
Warning: Be careful not to delete the DS records when ``dnssec-cds``
|
||||
fails!
|
||||
|
||||
Alternatively, ``dnssec-cds -u`` writes an ``nsupdate`` script to the
|
||||
standard output. The ``-u`` and ``-i`` options can be used together to
|
||||
standard output. You can use the ``-u`` and ``-i`` options together to
|
||||
maintain a ``dsset-`` file as well as emit an ``nsupdate`` script.
|
||||
|
||||
Options
|
||||
~~~~~~~
|
||||
|
||||
``-a algorithm``
|
||||
This option specifies a digest algorithm to use when converting CDNSKEY records to
|
||||
**-a** algorithm
|
||||
Specify a digest algorithm to use when converting CDNSKEY records to
|
||||
DS records. This option can be repeated, so that multiple DS records
|
||||
are created for each CDNSKEY record. This option has no effect when
|
||||
using CDS records.
|
||||
|
||||
The algorithm must be one of SHA-1, SHA-256, or SHA-384. These values
|
||||
are case-insensitive, and the hyphen may be omitted. If no algorithm
|
||||
are case insensitive, and the hyphen may be omitted. If no algorithm
|
||||
is specified, the default is SHA-256.
|
||||
|
||||
``-c class``
|
||||
This option specifies the DNS class of the zones.
|
||||
**-c** class
|
||||
Specifies the DNS class of the zones.
|
||||
|
||||
``-D``
|
||||
This option generates DS records from CDNSKEY records if both CDS and CDNSKEY
|
||||
**-D**
|
||||
Generate DS records from CDNSKEY records if both CDS and CDNSKEY
|
||||
records are present in the child zone. By default CDS records are
|
||||
preferred.
|
||||
|
||||
``-d path``
|
||||
This specifies the location of the parent DS records. The path can be the name of a file
|
||||
containing the DS records; if it is a directory, ``dnssec-cds``
|
||||
**-d** path
|
||||
Location of the parent DS records. The path can be the name of a file
|
||||
containing the DS records, or if it is a directory, ``dnssec-cds``
|
||||
looks for a ``dsset-`` file for the domain inside the directory.
|
||||
|
||||
To protect against replay attacks, child records are rejected if they
|
||||
were signed earlier than the modification time of the ``dsset-``
|
||||
file. This can be adjusted with the ``-s`` option.
|
||||
|
||||
``-f child-file``
|
||||
This option specifies the file containing the child's CDS and/or CDNSKEY records, plus its
|
||||
DNSKEY records and the covering RRSIG records, so that they can be
|
||||
**-f** child-file
|
||||
File containing the child's CDS and/or CDNSKEY records, plus its
|
||||
DNSKEY records and the covering RRSIG records so that they can be
|
||||
authenticated.
|
||||
|
||||
The examples below describe how to generate this file.
|
||||
The EXAMPLES below describe how to generate this file.
|
||||
|
||||
``-iextension``
|
||||
This option updates the ``dsset-`` file in place, instead of writing DS records to
|
||||
**-iextension**
|
||||
Update the ``dsset-`` file in place, instead of writing DS records to
|
||||
the standard output.
|
||||
|
||||
There must be no space between the ``-i`` and the extension. If
|
||||
no extension is provided, the old ``dsset-`` is discarded. If an
|
||||
There must be no space between the ``-i`` and the extension. If you
|
||||
provide no extension then the old ``dsset-`` is discarded. If an
|
||||
extension is present, a backup of the old ``dsset-`` file is kept
|
||||
with the extension appended to its filename.
|
||||
|
||||
To protect against replay attacks, the modification time of the
|
||||
``dsset-`` file is set to match the signature inception time of the
|
||||
child records, provided that it is later than the file's current
|
||||
child records, provided that is later than the file's current
|
||||
modification time.
|
||||
|
||||
``-s start-time``
|
||||
This option specifies the date and time after which RRSIG records become
|
||||
acceptable. This can be either an absolute or a relative time. An
|
||||
**-s** start-time
|
||||
Specify the date and time after which RRSIG records become
|
||||
acceptable. This can be either an absolute or relative time. An
|
||||
absolute start time is indicated by a number in YYYYMMDDHHMMSS
|
||||
notation; 20170827133700 denotes 13:37:00 UTC on August 27th, 2017. A
|
||||
time relative to the ``dsset-`` file is indicated with ``-N``, which is N
|
||||
time relative to the ``dsset-`` file is indicated with -N, which is N
|
||||
seconds before the file modification time. A time relative to the
|
||||
current time is indicated with ``now+N``.
|
||||
current time is indicated with now+N.
|
||||
|
||||
If no start-time is specified, the modification time of the
|
||||
``dsset-`` file is used.
|
||||
|
||||
``-T ttl``
|
||||
This option specifies a TTL to be used for new DS records. If not specified, the
|
||||
default is the TTL of the old DS records. If they had no explicit TTL,
|
||||
the new DS records also have no explicit TTL.
|
||||
**-T** ttl
|
||||
Specifies a TTL to be used for new DS records. If not specified, the
|
||||
default is the TTL of the old DS records. If they had no explicit TTL
|
||||
then the new DS records also have no explicit TTL.
|
||||
|
||||
``-u``
|
||||
This option writes an ``nsupdate`` script to the standard output, instead of
|
||||
printing the new DS reords. The output is empty if no change is
|
||||
**-u**
|
||||
Write an ``nsupdate`` script to the standard output, instead of
|
||||
printing the new DS reords. The output will be empty if no change is
|
||||
needed.
|
||||
|
||||
Note: The TTL of new records needs to be specified: it can be done in the
|
||||
original ``dsset-`` file, with the ``-T`` option, or using the
|
||||
Note: The TTL of new records needs to be specified, either in the
|
||||
original ``dsset-`` file, or with the ``-T`` option, or using the
|
||||
``nsupdate`` ``ttl`` command.
|
||||
|
||||
``-V``
|
||||
This option prints version information.
|
||||
**-V**
|
||||
Print version information.
|
||||
|
||||
``-v level``
|
||||
This option sets the debugging level. Level 1 is intended to be usefully verbose
|
||||
**-v** level
|
||||
Sets the debugging level. Level 1 is intended to be usefully verbose
|
||||
for general users; higher levels are intended for developers.
|
||||
|
||||
``domain``
|
||||
This indicates the name of the delegation point/child zone apex.
|
||||
domain
|
||||
The name of the delegation point / child zone apex.
|
||||
|
||||
Exit Status
|
||||
~~~~~~~~~~~
|
||||
@@ -172,17 +171,17 @@ Exit Status
|
||||
The ``dnssec-cds`` command exits 0 on success, or non-zero if an error
|
||||
occurred.
|
||||
|
||||
If successful, the DS records may or may not need to be
|
||||
In the success case, the DS records might or might not need to be
|
||||
changed.
|
||||
|
||||
Examples
|
||||
~~~~~~~~
|
||||
|
||||
Before running ``dnssec-signzone``, ensure that the delegations
|
||||
Before running ``dnssec-signzone``, you can ensure that the delegations
|
||||
are up-to-date by running ``dnssec-cds`` on every ``dsset-`` file.
|
||||
|
||||
To fetch the child records required by ``dnssec-cds``, invoke
|
||||
``dig`` as in the script below. It is acceptable if the ``dig`` fails, since
|
||||
To fetch the child records required by ``dnssec-cds`` you can invoke
|
||||
``dig`` as in the script below. It's okay if the ``dig`` fails since
|
||||
``dnssec-cds`` performs all the necessary checking.
|
||||
|
||||
::
|
||||
@@ -194,10 +193,10 @@ To fetch the child records required by ``dnssec-cds``, invoke
|
||||
dnssec-cds -i -f /dev/stdin -d $f $d
|
||||
done
|
||||
|
||||
When the parent zone is automatically signed by ``named``,
|
||||
``dnssec-cds`` can be used with ``nsupdate`` to maintain a delegation as follows.
|
||||
When the parent zone is automatically signed by ``named``, you can use
|
||||
``dnssec-cds`` with ``nsupdate`` to maintain a delegation as follows.
|
||||
The ``dsset-`` file allows the script to avoid having to fetch and
|
||||
validate the parent DS records, and it maintains the replay attack
|
||||
validate the parent DS records, and it keeps the replay attack
|
||||
protection time.
|
||||
|
||||
::
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
@@ -215,7 +215,7 @@ loadkey(char *filename, unsigned char *key_buf, unsigned int key_buf_size,
|
||||
rdclass = dst_key_class(key);
|
||||
|
||||
name = dns_fixedname_initname(&fixed);
|
||||
dns_name_copy(dst_key_name(key), name);
|
||||
dns_name_copynf(dst_key_name(key), name);
|
||||
|
||||
dst_key_free(&key);
|
||||
}
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
|
||||
This Source Code Form is subject to the terms of the Mozilla Public
|
||||
License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
|
||||
See the COPYRIGHT file distributed with this work for additional
|
||||
information regarding copyright ownership.
|
||||
@@ -45,7 +45,7 @@ The ``dnssec-dsfromkey`` command outputs DS (Delegation Signer) resource records
|
||||
|
||||
The input keys can be specified in a number of ways:
|
||||
|
||||
By default, ``dnssec-dsfromkey`` reads a key file named in the format
|
||||
By default, ``dnssec-dsfromkey`` reads a key file named like
|
||||
``Knnnn.+aaa+iiiii.key``, as generated by ``dnssec-keygen``.
|
||||
|
||||
With the ``-f file`` option, ``dnssec-dsfromkey`` reads keys from a zone
|
||||
@@ -57,73 +57,73 @@ as generated by ``dnssec-keygen`` ``-C``.
|
||||
Options
|
||||
~~~~~~~
|
||||
|
||||
``-1``
|
||||
This option is an abbreviation for ``-a SHA1``.
|
||||
**-1**
|
||||
An abbreviation for ``-a SHA1``
|
||||
|
||||
``-2``
|
||||
This option is an abbreviation for ``-a SHA-256``.
|
||||
**-2**
|
||||
An abbreviation for ``-a SHA-256``
|
||||
|
||||
``-a algorithm``
|
||||
This option specifies a digest algorithm to use when converting DNSKEY records to
|
||||
**-a** algorithm
|
||||
Specify a digest algorithm to use when converting DNSKEY records to
|
||||
DS records. This option can be repeated, so that multiple DS records
|
||||
are created for each DNSKEY record.
|
||||
|
||||
The algorithm must be one of SHA-1, SHA-256, or SHA-384. These values
|
||||
are case-insensitive, and the hyphen may be omitted. If no algorithm
|
||||
are case insensitive, and the hyphen may be omitted. If no algorithm
|
||||
is specified, the default is SHA-256.
|
||||
|
||||
``-A``
|
||||
This option indicates that ZSKs are to be included when generating DS records. Without this option, only
|
||||
keys which have the KSK flag set are converted to DS records and
|
||||
printed. This option is only useful in ``-f`` zone file mode.
|
||||
**-A**
|
||||
Include ZSKs when generating DS records. Without this option, only
|
||||
keys which have the KSK flag set will be converted to DS records and
|
||||
printed. Useful only in ``-f`` zone file mode.
|
||||
|
||||
``-c class``
|
||||
This option specifies the DNS class; the default is IN. This option is only useful in ``-s`` keyset
|
||||
**-c** class
|
||||
Specifies the DNS class (default is IN). Useful only in ``-s`` keyset
|
||||
or ``-f`` zone file mode.
|
||||
|
||||
``-C``
|
||||
This option generates CDS records rather than DS records.
|
||||
**-C**
|
||||
Generate CDS records rather than DS records.
|
||||
|
||||
``-f file``
|
||||
This option sets zone file mode, in which the final dnsname argument of ``dnssec-dsfromkey`` is the
|
||||
**-f** file
|
||||
Zone file mode: ``dnssec-dsfromkey``'s final dnsname argument is the
|
||||
DNS domain name of a zone whose master file can be read from
|
||||
``file``. If the zone name is the same as ``file``, then it may be
|
||||
omitted.
|
||||
|
||||
If ``file`` is ``-``, then the zone data is read from the standard
|
||||
If file is ``"-"``, then the zone data is read from the standard
|
||||
input. This makes it possible to use the output of the ``dig``
|
||||
command as input, as in:
|
||||
|
||||
``dig dnskey example.com | dnssec-dsfromkey -f - example.com``
|
||||
|
||||
``-h``
|
||||
This option prints usage information.
|
||||
**-h**
|
||||
Prints usage information.
|
||||
|
||||
``-K directory``
|
||||
This option tells BIND 9 to look for key files or ``keyset-`` files in ``directory``.
|
||||
**-K** directory
|
||||
Look for key files or ``keyset-`` files in ``directory``.
|
||||
|
||||
``-s``
|
||||
This option enables keyset mode, in which the final dnsname argument from ``dnssec-dsfromkey`` is the DNS
|
||||
**-s**
|
||||
Keyset mode: ``dnssec-dsfromkey``'s final dnsname argument is the DNS
|
||||
domain name used to locate a ``keyset-`` file.
|
||||
|
||||
``-T TTL``
|
||||
This option specifies the TTL of the DS records. By default the TTL is omitted.
|
||||
**-T** TTL
|
||||
Specifies the TTL of the DS records. By default the TTL is omitted.
|
||||
|
||||
``-v level``
|
||||
This option sets the debugging level.
|
||||
**-v** level
|
||||
Sets the debugging level.
|
||||
|
||||
``-V``
|
||||
This option prints version information.
|
||||
**-V**
|
||||
Prints version information.
|
||||
|
||||
Example
|
||||
~~~~~~~
|
||||
|
||||
To build the SHA-256 DS RR from the ``Kexample.com.+003+26160`` keyfile,
|
||||
issue the following command:
|
||||
To build the SHA-256 DS RR from the ``Kexample.com.+003+26160`` keyfile
|
||||
name, you can issue the following command:
|
||||
|
||||
``dnssec-dsfromkey -2 Kexample.com.+003+26160``
|
||||
|
||||
The command returns something similar to:
|
||||
The command would print something like:
|
||||
|
||||
``example.com. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0C5EA0B94``
|
||||
|
||||
@@ -131,16 +131,16 @@ Files
|
||||
~~~~~
|
||||
|
||||
The keyfile can be designated by the key identification
|
||||
``Knnnn.+aaa+iiiii`` or the full file name ``Knnnn.+aaa+iiiii.key``, as
|
||||
generated by ``dnssec-keygen``.
|
||||
``Knnnn.+aaa+iiiii`` or the full file name ``Knnnn.+aaa+iiiii.key`` as
|
||||
generated by dnssec-keygen8.
|
||||
|
||||
The keyset file name is built from the ``directory``, the string
|
||||
``keyset-``, and the ``dnsname``.
|
||||
``keyset-`` and the ``dnsname``.
|
||||
|
||||
Caveat
|
||||
~~~~~~
|
||||
|
||||
A keyfile error may return "file not found," even if the file exists.
|
||||
A keyfile error can give a "file not found" even if the file exists.
|
||||
|
||||
See Also
|
||||
~~~~~~~~
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
@@ -185,7 +185,7 @@ loadkey(char *filename, unsigned char *key_buf, unsigned int key_buf_size,
|
||||
rdclass = dst_key_class(key);
|
||||
|
||||
name = dns_fixedname_initname(&fixed);
|
||||
dns_name_copy(dst_key_name(key), name);
|
||||
dns_name_copynf(dst_key_name(key), name);
|
||||
|
||||
dst_key_free(&key);
|
||||
}
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
|
||||
This Source Code Form is subject to the terms of the Mozilla Public
|
||||
License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
|
||||
See the COPYRIGHT file distributed with this work for additional
|
||||
information regarding copyright ownership.
|
||||
@@ -37,12 +37,12 @@ Description
|
||||
~~~~~~~~~~~
|
||||
|
||||
``dnssec-importkey`` reads a public DNSKEY record and generates a pair
|
||||
of .key/.private files. The DNSKEY record may be read from an
|
||||
existing .key file, in which case a corresponding .private file is
|
||||
of .key/.private files. The DNSKEY record may be read from an existing
|
||||
.key file, in which case a corresponding .private file will be
|
||||
generated, or it may be read from any other file or from the standard
|
||||
input, in which case both .key and .private files are generated.
|
||||
input, in which case both .key and .private files will be generated.
|
||||
|
||||
The newly created .private file does *not* contain private key data, and
|
||||
The newly-created .private file does *not* contain private key data, and
|
||||
cannot be used for signing. However, having a .private file makes it
|
||||
possible to set publication (``-P``) and deletion (``-D``) times for the
|
||||
key, which means the public key can be added to and removed from the
|
||||
@@ -51,73 +51,73 @@ DNSKEY RRset on schedule even if the true private key is stored offline.
|
||||
Options
|
||||
~~~~~~~
|
||||
|
||||
``-f filename``
|
||||
This option indicates the zone file mode. Instead of a public keyfile name, the argument is the
|
||||
**-f** filename
|
||||
Zone file mode: instead of a public keyfile name, the argument is the
|
||||
DNS domain name of a zone master file, which can be read from
|
||||
``filename``. If the domain name is the same as ``filename``, then it may be
|
||||
``file``. If the domain name is the same as ``file``, then it may be
|
||||
omitted.
|
||||
|
||||
If ``filename`` is set to ``"-"``, then the zone data is read from the
|
||||
If ``file`` is set to ``"-"``, then the zone data is read from the
|
||||
standard input.
|
||||
|
||||
``-K directory``
|
||||
This option sets the directory in which the key files are to reside.
|
||||
**-K** directory
|
||||
Sets the directory in which the key files are to reside.
|
||||
|
||||
``-L ttl``
|
||||
This option sets the default TTL to use for this key when it is converted into a
|
||||
DNSKEY RR. This is the TTL used when the key is imported into a zone,
|
||||
unless there was already a DNSKEY RRset in
|
||||
place, in which case the existing TTL takes precedence. Setting the default TTL to ``0`` or ``none``
|
||||
removes it from the key.
|
||||
**-L** ttl
|
||||
Sets the default TTL to use for this key when it is converted into a
|
||||
DNSKEY RR. If the key is imported into a zone, this is the TTL that
|
||||
will be used for it, unless there was already a DNSKEY RRset in
|
||||
place, in which case the existing TTL would take precedence. Setting
|
||||
the default TTL to ``0`` or ``none`` removes it.
|
||||
|
||||
``-h``
|
||||
This option emits a usage message and exits.
|
||||
**-h**
|
||||
Emit usage message and exit.
|
||||
|
||||
``-v level``
|
||||
This option sets the debugging level.
|
||||
**-v** level
|
||||
Sets the debugging level.
|
||||
|
||||
``-V``
|
||||
This option prints version information.
|
||||
**-V**
|
||||
Prints version information.
|
||||
|
||||
Timing Options
|
||||
~~~~~~~~~~~~~~
|
||||
|
||||
Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the
|
||||
argument begins with a ``+`` or ``-``, it is interpreted as an offset from
|
||||
argument begins with a '+' or '-', it is interpreted as an offset from
|
||||
the present time. For convenience, if such an offset is followed by one
|
||||
of the suffixes ``y``, ``mo``, ``w``, ``d``, ``h``, or ``mi``, then the offset is
|
||||
of the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi', then the offset is
|
||||
computed in years (defined as 365 24-hour days, ignoring leap years),
|
||||
months (defined as 30 24-hour days), weeks, days, hours, or minutes,
|
||||
respectively. Without a suffix, the offset is computed in seconds. To
|
||||
explicitly prevent a date from being set, use ``none`` or ``never``.
|
||||
explicitly prevent a date from being set, use 'none' or 'never'.
|
||||
|
||||
``-P date/offset``
|
||||
This option sets the date on which a key is to be published to the zone. After
|
||||
that date, the key is included in the zone but is not used
|
||||
**-P** date/offset
|
||||
Sets the date on which a key is to be published to the zone. After
|
||||
that date, the key will be included in the zone but will not be used
|
||||
to sign it.
|
||||
|
||||
``-P sync date/offset``
|
||||
This option sets the date on which CDS and CDNSKEY records that match this key
|
||||
**-P** sync date/offset
|
||||
Sets the date on which CDS and CDNSKEY records that match this key
|
||||
are to be published to the zone.
|
||||
|
||||
``-D date/offset``
|
||||
This option sets the date on which the key is to be deleted. After that date, the
|
||||
key is no longer included in the zone. (However, it may remain in the key
|
||||
repository.)
|
||||
**-D** date/offset
|
||||
Sets the date on which the key is to be deleted. After that date, the
|
||||
key will no longer be included in the zone. (It may remain in the key
|
||||
repository, however.)
|
||||
|
||||
``-D sync date/offset``
|
||||
This option sets the date on which the CDS and CDNSKEY records that match this
|
||||
**-D** sync date/offset
|
||||
Sets the date on which the CDS and CDNSKEY records that match this
|
||||
key are to be deleted.
|
||||
|
||||
Files
|
||||
~~~~~
|
||||
|
||||
A keyfile can be designed by the key identification ``Knnnn.+aaa+iiiii``
|
||||
or the full file name ``Knnnn.+aaa+iiiii.key``, as generated by
|
||||
``dnssec-keygen``.
|
||||
or the full file name ``Knnnn.+aaa+iiiii.key`` as generated by
|
||||
dnssec-keygen8.
|
||||
|
||||
See Also
|
||||
~~~~~~~~
|
||||
--------
|
||||
|
||||
:manpage:`dnssec-keygen(8)`, :manpage:`dnssec-signzone(8)`, BIND 9 Administrator Reference Manual,
|
||||
:rfc:`5011`.
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
@@ -362,6 +362,7 @@ main(int argc, char **argv) {
|
||||
setup_logging(mctx, &log);
|
||||
|
||||
if (predecessor == NULL) {
|
||||
/* cppcheck-suppress nullPointerRedundantCheck */
|
||||
if (label == NULL) {
|
||||
fatal("the key label was not specified");
|
||||
}
|
||||
@@ -383,6 +384,7 @@ main(int argc, char **argv) {
|
||||
isc_result_totext(ret));
|
||||
}
|
||||
|
||||
/* cppcheck-suppress nullPointerRedundantCheck */
|
||||
if (strchr(label, ':') == NULL) {
|
||||
char *l;
|
||||
int len;
|
||||
@@ -394,11 +396,13 @@ main(int argc, char **argv) {
|
||||
label = l;
|
||||
}
|
||||
|
||||
/* cppcheck-suppress nullPointerRedundantCheck */
|
||||
if (algname == NULL) {
|
||||
fatal("no algorithm specified");
|
||||
}
|
||||
|
||||
r.base = algname;
|
||||
/* cppcheck-suppress nullPointerRedundantCheck */
|
||||
r.length = strlen(algname);
|
||||
ret = dns_secalg_fromtext(&alg, &r);
|
||||
if (ret != ISC_R_SUCCESS) {
|
||||
|
||||
+114
-114
@@ -3,7 +3,7 @@
|
||||
|
||||
This Source Code Form is subject to the terms of the Mozilla Public
|
||||
License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
|
||||
See the COPYRIGHT file distributed with this work for additional
|
||||
information regarding copyright ownership.
|
||||
@@ -34,11 +34,11 @@ Synopsis
|
||||
Description
|
||||
~~~~~~~~~~~
|
||||
|
||||
``dnssec-keyfromlabel`` generates a pair of key files that reference a
|
||||
``dnssec-keyfromlabel`` generates a key pair of files that referencing a
|
||||
key object stored in a cryptographic hardware service module (HSM). The
|
||||
private key file can be used for DNSSEC signing of zone data as if it
|
||||
were a conventional signing key created by ``dnssec-keygen``, but the
|
||||
key material is stored within the HSM and the actual signing takes
|
||||
key material is stored within the HSM, and the actual signing takes
|
||||
place there.
|
||||
|
||||
The ``name`` of the key is specified on the command line. This must
|
||||
@@ -47,194 +47,194 @@ match the name of the zone for which the key is being generated.
|
||||
Options
|
||||
~~~~~~~
|
||||
|
||||
``-a algorithm``
|
||||
This option selects the cryptographic algorithm. The value of ``algorithm`` must
|
||||
**-a** algorithm
|
||||
Selects the cryptographic algorithm. The value of ``algorithm`` must
|
||||
be one of RSASHA1, NSEC3RSASHA1, RSASHA256, RSASHA512,
|
||||
ECDSAP256SHA256, ECDSAP384SHA384, ED25519, or ED448.
|
||||
ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448.
|
||||
|
||||
If no algorithm is specified, RSASHA1 is used by default
|
||||
If no algorithm is specified, then RSASHA1 will be used by default,
|
||||
unless the ``-3`` option is specified, in which case NSEC3RSASHA1
|
||||
is used instead. (If ``-3`` is used and an algorithm is
|
||||
specified, that algorithm is checked for compatibility with
|
||||
will be used instead. (If ``-3`` is used and an algorithm is
|
||||
specified, that algorithm will be checked for compatibility with
|
||||
NSEC3.)
|
||||
|
||||
These values are case-insensitive. In some cases, abbreviations are
|
||||
These values are case insensitive. In some cases, abbreviations are
|
||||
supported, such as ECDSA256 for ECDSAP256SHA256 and ECDSA384 for
|
||||
ECDSAP384SHA384. If RSASHA1 is specified along with the ``-3``
|
||||
option, then NSEC3RSASHA1 is used instead.
|
||||
option, then NSEC3RSASHA1 will be used instead.
|
||||
|
||||
Since BIND 9.12.0, this option is mandatory except when using the
|
||||
``-S`` option, which copies the algorithm from the predecessory key.
|
||||
As of BIND 9.12.0, this option is mandatory except when using the
|
||||
``-S`` option (which copies the algorithm from the predecessory key).
|
||||
Previously, the default for newly generated keys was RSASHA1.
|
||||
|
||||
``-3``
|
||||
This option uses an NSEC3-capable algorithm to generate a DNSSEC key. If this
|
||||
**-3**
|
||||
Use an NSEC3-capable algorithm to generate a DNSSEC key. If this
|
||||
option is used with an algorithm that has both NSEC and NSEC3
|
||||
versions, then the NSEC3 version is used; for example,
|
||||
versions, then the NSEC3 version will be used; for example,
|
||||
``dnssec-keygen -3a RSASHA1`` specifies the NSEC3RSASHA1 algorithm.
|
||||
|
||||
``-E engine``
|
||||
This option specifies the cryptographic hardware to use.
|
||||
**-E** engine
|
||||
Specifies the cryptographic hardware to use.
|
||||
|
||||
When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
|
||||
engine identifier that drives the cryptographic accelerator or
|
||||
hardware service module (usually ``pkcs11``). When BIND is
|
||||
built with native PKCS#11 cryptography (``--enable-native-pkcs11``), it
|
||||
When BIND is built with OpenSSL PKCS#11 support, this defaults to the
|
||||
string "pkcs11", which identifies an OpenSSL engine that can drive a
|
||||
cryptographic accelerator or hardware service module. When BIND is
|
||||
built with native PKCS#11 cryptography (--enable-native-pkcs11), it
|
||||
defaults to the path of the PKCS#11 provider library specified via
|
||||
``--with-pkcs11``.
|
||||
"--with-pkcs11".
|
||||
|
||||
``-l label``
|
||||
This option specifies the label for a key pair in the crypto hardware.
|
||||
**-l** label
|
||||
Specifies the label for a key pair in the crypto hardware.
|
||||
|
||||
When BIND 9 is built with OpenSSL-based PKCS#11 support, the label is
|
||||
an arbitrary string that identifies a particular key. It may be
|
||||
preceded by an optional OpenSSL engine name, followed by a colon, as
|
||||
in ``pkcs11:keylabel``.
|
||||
in "pkcs11:keylabel".
|
||||
|
||||
When BIND 9 is built with native PKCS#11 support, the label is a
|
||||
PKCS#11 URI string in the format
|
||||
``pkcs11:keyword\ =value[;\ keyword\ =value;...]``. Keywords
|
||||
include ``token``, which identifies the HSM; ``object``, which identifies
|
||||
the key; and ``pin-source``, which identifies a file from which the
|
||||
HSM's PIN code can be obtained. The label is stored in the
|
||||
on-disk ``private`` file.
|
||||
"pkcs11:``keyword``\ =value[;\ ``keyword``\ =value;...]" Keywords
|
||||
include "token", which identifies the HSM; "object", which identifies
|
||||
the key; and "pin-source", which identifies a file from which the
|
||||
HSM's PIN code can be obtained. The label will be stored in the
|
||||
on-disk "private" file.
|
||||
|
||||
If the label contains a ``pin-source`` field, tools using the
|
||||
generated key files are able to use the HSM for signing and other
|
||||
generated key files will be able to use the HSM for signing and other
|
||||
operations without any need for an operator to manually enter a PIN.
|
||||
Note: Making the HSM's PIN accessible in this manner may reduce the
|
||||
security advantage of using an HSM; use caution
|
||||
with this feature.
|
||||
security advantage of using an HSM; be sure this is what you want to
|
||||
do before making use of this feature.
|
||||
|
||||
``-n nametype``
|
||||
This option specifies the owner type of the key. The value of ``nametype`` must
|
||||
**-n** nametype
|
||||
Specifies the owner type of the key. The value of ``nametype`` must
|
||||
either be ZONE (for a DNSSEC zone key (KEY/DNSKEY)), HOST or ENTITY
|
||||
(for a key associated with a host (KEY)), USER (for a key associated
|
||||
with a user (KEY)), or OTHER (DNSKEY). These values are
|
||||
case-insensitive.
|
||||
with a user(KEY)) or OTHER (DNSKEY). These values are case
|
||||
insensitive.
|
||||
|
||||
``-C``
|
||||
This option enables compatibility mode, which generates an old-style key, without any metadata.
|
||||
By default, ``dnssec-keyfromlabel`` includes the key's creation
|
||||
date in the metadata stored with the private key; other dates may
|
||||
be set there as well, including publication date, activation date, etc. Keys
|
||||
**-C**
|
||||
Compatibility mode: generates an old-style key, without any metadata.
|
||||
By default, ``dnssec-keyfromlabel`` will include the key's creation
|
||||
date in the metadata stored with the private key, and other dates may
|
||||
be set there as well (publication date, activation date, etc). Keys
|
||||
that include this data may be incompatible with older versions of
|
||||
BIND; the ``-C`` option suppresses them.
|
||||
|
||||
``-c class``
|
||||
This option indicates that the DNS record containing the key should have the
|
||||
**-c** class
|
||||
Indicates that the DNS record containing the key should have the
|
||||
specified class. If not specified, class IN is used.
|
||||
|
||||
``-f flag``
|
||||
This option sets the specified flag in the ``flag`` field of the KEY/DNSKEY record.
|
||||
The only recognized flags are KSK (Key-Signing Key) and REVOKE.
|
||||
**-f** flag
|
||||
Set the specified flag in the flag field of the KEY/DNSKEY record.
|
||||
The only recognized flags are KSK (Key Signing Key) and REVOKE.
|
||||
|
||||
``-G``
|
||||
This option generates a key, but does not publish it or sign with it. This option is
|
||||
incompatible with ``-P`` and ``-A``.
|
||||
**-G**
|
||||
Generate a key, but do not publish it or sign with it. This option is
|
||||
incompatible with -P and -A.
|
||||
|
||||
``-h``
|
||||
This option prints a short summary of the options and arguments to
|
||||
**-h**
|
||||
Prints a short summary of the options and arguments to
|
||||
``dnssec-keyfromlabel``.
|
||||
|
||||
``-K directory``
|
||||
This option sets the directory in which the key files are to be written.
|
||||
**-K** directory
|
||||
Sets the directory in which the key files are to be written.
|
||||
|
||||
``-k``
|
||||
This option generates KEY records rather than DNSKEY records.
|
||||
**-k**
|
||||
Generate KEY records rather than DNSKEY records.
|
||||
|
||||
``-L`` ttl
|
||||
This option sets the default TTL to use for this key when it is converted into a
|
||||
DNSKEY RR. This is the TTL used when the key is imported into a zone,
|
||||
unless there was already a DNSKEY RRset in
|
||||
**-L** ttl
|
||||
Sets the default TTL to use for this key when it is converted into a
|
||||
DNSKEY RR. If the key is imported into a zone, this is the TTL that
|
||||
will be used for it, unless there was already a DNSKEY RRset in
|
||||
place, in which case the existing TTL would take precedence. Setting
|
||||
the default TTL to ``0`` or ``none`` removes it.
|
||||
|
||||
``-p protocol``
|
||||
This option sets the protocol value for the key. The protocol is a number between
|
||||
**-p** protocol
|
||||
Sets the protocol value for the key. The protocol is a number between
|
||||
0 and 255. The default is 3 (DNSSEC). Other possible values for this
|
||||
argument are listed in :rfc:`2535` and its successors.
|
||||
|
||||
``-S key``
|
||||
This option generates a key as an explicit successor to an existing key. The name,
|
||||
algorithm, size, and type of the key are set to match the
|
||||
predecessor. The activation date of the new key is set to the
|
||||
inactivation date of the existing one. The publication date is
|
||||
**-S** key
|
||||
Generate a key as an explicit successor to an existing key. The name,
|
||||
algorithm, size, and type of the key will be set to match the
|
||||
predecessor. The activation date of the new key will be set to the
|
||||
inactivation date of the existing one. The publication date will be
|
||||
set to the activation date minus the prepublication interval, which
|
||||
defaults to 30 days.
|
||||
|
||||
``-t type``
|
||||
This option indicates the type of the key. ``type`` must be one of AUTHCONF,
|
||||
**-t** type
|
||||
Indicates the use of the key. ``type`` must be one of AUTHCONF,
|
||||
NOAUTHCONF, NOAUTH, or NOCONF. The default is AUTHCONF. AUTH refers
|
||||
to the ability to authenticate data, and CONF to the ability to encrypt
|
||||
to the ability to authenticate data, and CONF the ability to encrypt
|
||||
data.
|
||||
|
||||
``-v level``
|
||||
This option sets the debugging level.
|
||||
**-v** level
|
||||
Sets the debugging level.
|
||||
|
||||
``-V``
|
||||
This option prints version information.
|
||||
**-V**
|
||||
Prints version information.
|
||||
|
||||
``-y``
|
||||
This option allows DNSSEC key files to be generated even if the key ID would
|
||||
**-y**
|
||||
Allows DNSSEC key files to be generated even if the key ID would
|
||||
collide with that of an existing key, in the event of either key
|
||||
being revoked. (This is only safe to enable if
|
||||
:rfc:`5011` trust anchor maintenance is not used with either of the keys
|
||||
being revoked. (This is only safe to use if you are sure you won't be
|
||||
using :rfc:`5011` trust anchor maintenance with either of the keys
|
||||
involved.)
|
||||
|
||||
Timing Options
|
||||
~~~~~~~~~~~~~~
|
||||
|
||||
Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the
|
||||
argument begins with a ``+`` or ``-``, it is interpreted as an offset from
|
||||
argument begins with a '+' or '-', it is interpreted as an offset from
|
||||
the present time. For convenience, if such an offset is followed by one
|
||||
of the suffixes ``y``, ``mo``, ``w``, ``d``, ``h``, or ``mi``, then the offset is
|
||||
of the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi', then the offset is
|
||||
computed in years (defined as 365 24-hour days, ignoring leap years),
|
||||
months (defined as 30 24-hour days), weeks, days, hours, or minutes,
|
||||
respectively. Without a suffix, the offset is computed in seconds. To
|
||||
explicitly prevent a date from being set, use ``none`` or ``never``.
|
||||
explicitly prevent a date from being set, use 'none' or 'never'.
|
||||
|
||||
``-P date/offset``
|
||||
This option sets the date on which a key is to be published to the zone. After
|
||||
that date, the key is included in the zone but is not used
|
||||
to sign it. If not set, and if the ``-G`` option has not been used, the
|
||||
default is the current date.
|
||||
**-P** date/offset
|
||||
Sets the date on which a key is to be published to the zone. After
|
||||
that date, the key will be included in the zone but will not be used
|
||||
to sign it. If not set, and if the -G option has not been used, the
|
||||
default is "now".
|
||||
|
||||
``-P sync date/offset``
|
||||
This option sets the date on which CDS and CDNSKEY records that match this key
|
||||
are to be published to the zone.
|
||||
**-P** sync date/offset
|
||||
Sets the date on which the CDS and CDNSKEY records which match this
|
||||
key are to be published to the zone.
|
||||
|
||||
``-A date/offset``
|
||||
This option sets the date on which the key is to be activated. After that date,
|
||||
the key is included in the zone and used to sign it. If not set,
|
||||
and if the ``-G`` option has not been used, the default is the current date.
|
||||
**-A** date/offset
|
||||
Sets the date on which the key is to be activated. After that date,
|
||||
the key will be included in the zone and used to sign it. If not set,
|
||||
and if the -G option has not been used, the default is "now".
|
||||
|
||||
``-R date/offset``
|
||||
This option sets the date on which the key is to be revoked. After that date, the
|
||||
key is flagged as revoked. It is included in the zone and
|
||||
is used to sign it.
|
||||
**-R** date/offset
|
||||
Sets the date on which the key is to be revoked. After that date, the
|
||||
key will be flagged as revoked. It will be included in the zone and
|
||||
will be used to sign it.
|
||||
|
||||
``-I date/offset``
|
||||
This option sets the date on which the key is to be retired. After that date, the
|
||||
key is still included in the zone, but it is not used to
|
||||
**-I** date/offset
|
||||
Sets the date on which the key is to be retired. After that date, the
|
||||
key will still be included in the zone, but it will not be used to
|
||||
sign it.
|
||||
|
||||
``-D date/offset``
|
||||
This option sets the date on which the key is to be deleted. After that date, the
|
||||
key is no longer included in the zone. (However, it may remain in the key
|
||||
repository.)
|
||||
**-D** date/offset
|
||||
Sets the date on which the key is to be deleted. After that date, the
|
||||
key will no longer be included in the zone. (It may remain in the key
|
||||
repository, however.)
|
||||
|
||||
``-D sync date/offset``
|
||||
This option sets the date on which the CDS and CDNSKEY records that match this
|
||||
**-D** sync date/offset
|
||||
Sets the date on which the CDS and CDNSKEY records which match this
|
||||
key are to be deleted.
|
||||
|
||||
``-i interval``
|
||||
This option sets the prepublication interval for a key. If set, then the
|
||||
**-i** interval
|
||||
Sets the prepublication interval for a key. If set, then the
|
||||
publication and activation dates must be separated by at least this
|
||||
much time. If the activation date is specified but the publication
|
||||
date is not, the publication date defaults to this much time
|
||||
date isn't, then the publication date will default to this much time
|
||||
before the activation date; conversely, if the publication date is
|
||||
specified but not the activation date, activation is set to
|
||||
specified but activation date isn't, then activation will be set to
|
||||
this much time after publication.
|
||||
|
||||
If the key is being created as an explicit successor to another key,
|
||||
@@ -242,7 +242,7 @@ explicitly prevent a date from being set, use ``none`` or ``never``.
|
||||
zero.
|
||||
|
||||
As with date offsets, if the argument is followed by one of the
|
||||
suffixes ``y``, ``mo``, ``w``, ``d``, ``h``, or ``mi``, the interval is
|
||||
suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi', then the interval is
|
||||
measured in years, months, weeks, days, hours, or minutes,
|
||||
respectively. Without a suffix, the interval is measured in seconds.
|
||||
|
||||
@@ -264,7 +264,7 @@ printed string. ``Knnnn.+aaa+iiiii.key`` contains the public key, and
|
||||
``Knnnn.+aaa+iiiii.private`` contains the private key.
|
||||
|
||||
The ``.key`` file contains a DNS KEY record that can be inserted into a
|
||||
zone file (directly or with an $INCLUDE statement).
|
||||
zone file (directly or with a $INCLUDE statement).
|
||||
|
||||
The ``.private`` file contains algorithm-specific fields. For obvious
|
||||
security reasons, this file does not have general read permission.
|
||||
@@ -273,4 +273,4 @@ See Also
|
||||
~~~~~~~~
|
||||
|
||||
:manpage:`dnssec-keygen(8)`, :manpage:`dnssec-signzone(8)`, BIND 9 Administrator Reference Manual,
|
||||
:rfc:`4034`, :rfc:`7512`.
|
||||
:rfc:`4034`, The PKCS#11 URI Scheme (draft-pechanec-pkcs11uri-13).
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
@@ -269,8 +269,8 @@ kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, const char *name,
|
||||
continue;
|
||||
}
|
||||
|
||||
result = cfg_kasp_fromconfig(kconfig, NULL, mctx, lctx,
|
||||
&kasplist, &kasp);
|
||||
result = cfg_kasp_fromconfig(kconfig, mctx, lctx, &kasplist,
|
||||
&kasp);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
fatal("failed to configure dnssec-policy '%s': %s",
|
||||
cfg_obj_asstring(cfg_tuple_get(kconfig, "name")),
|
||||
@@ -284,7 +284,7 @@ kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, const char *name,
|
||||
*kaspp = kasp;
|
||||
|
||||
/*
|
||||
* Cleanup kasp list.
|
||||
* Same cleanup for kasp list.
|
||||
*/
|
||||
for (kasp = ISC_LIST_HEAD(kasplist); kasp != NULL; kasp = kasp_next) {
|
||||
kasp_next = ISC_LIST_NEXT(kasp, link);
|
||||
@@ -782,7 +782,7 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
|
||||
}
|
||||
|
||||
/* Set dnssec-policy related metadata */
|
||||
if (ctx->policy != NULL) {
|
||||
if (ctx->policy) {
|
||||
dst_key_setnum(key, DST_NUM_LIFETIME, ctx->lifetime);
|
||||
dst_key_setbool(key, DST_BOOL_KSK, ctx->ksk);
|
||||
dst_key_setbool(key, DST_BOOL_ZSK, ctx->zsk);
|
||||
@@ -1180,10 +1180,12 @@ main(int argc, char **argv) {
|
||||
}
|
||||
|
||||
if (ctx.predecessor == NULL && ctx.policy == NULL) {
|
||||
/* cppcheck-suppress nullPointerRedundantCheck */
|
||||
if (algname == NULL) {
|
||||
fatal("no algorithm specified");
|
||||
}
|
||||
r.base = algname;
|
||||
/* cppcheck-suppress nullPointerRedundantCheck */
|
||||
r.length = strlen(algname);
|
||||
ret = dns_secalg_fromtext(&ctx.alg, &r);
|
||||
if (ret != ISC_R_SUCCESS) {
|
||||
|
||||
+132
-132
@@ -3,7 +3,7 @@
|
||||
|
||||
This Source Code Form is subject to the terms of the Mozilla Public
|
||||
License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
|
||||
See the COPYRIGHT file distributed with this work for additional
|
||||
information regarding copyright ownership.
|
||||
@@ -46,220 +46,220 @@ generated.
|
||||
Options
|
||||
~~~~~~~
|
||||
|
||||
``-3``
|
||||
This option uses an NSEC3-capable algorithm to generate a DNSSEC key. If this
|
||||
**-3**
|
||||
Use an NSEC3-capable algorithm to generate a DNSSEC key. If this
|
||||
option is used with an algorithm that has both NSEC and NSEC3
|
||||
versions, then the NSEC3 version is selected; for example,
|
||||
versions, then the NSEC3 version will be used; for example,
|
||||
``dnssec-keygen -3a RSASHA1`` specifies the NSEC3RSASHA1 algorithm.
|
||||
|
||||
``-a algorithm``
|
||||
This option selects the cryptographic algorithm. For DNSSEC keys, the value of
|
||||
**-a** algorithm
|
||||
Selects the cryptographic algorithm. For DNSSEC keys, the value of
|
||||
``algorithm`` must be one of RSASHA1, NSEC3RSASHA1, RSASHA256,
|
||||
RSASHA512, ECDSAP256SHA256, ECDSAP384SHA384, ED25519, or ED448. For
|
||||
TKEY, the value must be DH (Diffie-Hellman); specifying this value
|
||||
automatically sets the ``-T KEY`` option as well.
|
||||
RSASHA512, ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448. For
|
||||
TKEY, the value must be DH (Diffie Hellman); specifying his value
|
||||
will automatically set the ``-T KEY`` option as well.
|
||||
|
||||
These values are case-insensitive. In some cases, abbreviations are
|
||||
These values are case insensitive. In some cases, abbreviations are
|
||||
supported, such as ECDSA256 for ECDSAP256SHA256 and ECDSA384 for
|
||||
ECDSAP384SHA384. If RSASHA1 is specified along with the ``-3``
|
||||
option, NSEC3RSASHA1 is used instead.
|
||||
option, then NSEC3RSASHA1 will be used instead.
|
||||
|
||||
This parameter *must* be specified except when using the ``-S``
|
||||
option, which copies the algorithm from the predecessor key.
|
||||
|
||||
In prior releases, HMAC algorithms could be generated for use as TSIG
|
||||
keys, but that feature was removed in BIND 9.13.0. Use
|
||||
keys, but that feature has been removed as of BIND 9.13.0. Use
|
||||
``tsig-keygen`` to generate TSIG keys.
|
||||
|
||||
``-b keysize``
|
||||
This option specifies the number of bits in the key. The choice of key size
|
||||
depends on the algorithm used: RSA keys must be between 1024 and 4096
|
||||
bits; Diffie-Hellman keys must be between 128 and 4096 bits. Elliptic
|
||||
curve algorithms do not need this parameter.
|
||||
**-b** keysize
|
||||
Specifies the number of bits in the key. The choice of key size
|
||||
depends on the algorithm used. RSA keys must be between 1024 and 4096
|
||||
bits. Diffie Hellman keys must be between 128 and 4096 bits. Elliptic
|
||||
curve algorithms don't need this parameter.
|
||||
|
||||
If the key size is not specified, some algorithms have pre-defined
|
||||
defaults. For example, RSA keys for use as DNSSEC zone-signing keys
|
||||
have a default size of 1024 bits; RSA keys for use as key-signing
|
||||
defaults. For example, RSA keys for use as DNSSEC zone signing keys
|
||||
have a default size of 1024 bits; RSA keys for use as key signing
|
||||
keys (KSKs, generated with ``-f KSK``) default to 2048 bits.
|
||||
|
||||
``-C``
|
||||
This option enables compatibility mode, which generates an old-style key, without any timing
|
||||
metadata. By default, ``dnssec-keygen`` includes the key's
|
||||
creation date in the metadata stored with the private key; other
|
||||
dates may be set there as well, including publication date, activation date,
|
||||
etc. Keys that include this data may be incompatible with older
|
||||
**-C**
|
||||
Compatibility mode: generates an old-style key, without any timing
|
||||
metadata. By default, ``dnssec-keygen`` will include the key's
|
||||
creation date in the metadata stored with the private key, and other
|
||||
dates may be set there as well (publication date, activation date,
|
||||
etc). Keys that include this data may be incompatible with older
|
||||
versions of BIND; the ``-C`` option suppresses them.
|
||||
|
||||
``-c class``
|
||||
This option indicates that the DNS record containing the key should have the
|
||||
**-c** class
|
||||
Indicates that the DNS record containing the key should have the
|
||||
specified class. If not specified, class IN is used.
|
||||
|
||||
``-d bits``
|
||||
This option specifies the key size in bits. For the algorithms RSASHA1, NSEC3RSASA1, RSASHA256, and
|
||||
RSASHA512 the key size must be between 1024 and 4096 bits; DH size is between 128
|
||||
and 4096 bits. This option is ignored for algorithms ECDSAP256SHA256,
|
||||
ECDSAP384SHA384, ED25519, and ED448.
|
||||
**-d** bits
|
||||
Key size in bits. For the algorithms RSASHA1, NSEC3RSASA1, RSASHA256 and
|
||||
RSASHA512 the key size must be in range 1024-4096. DH size is between 128
|
||||
and 4096. This option is ignored for algorithms ECDSAP256SHA256,
|
||||
ECDSAP384SHA384, ED25519 and ED448.
|
||||
|
||||
``-E engine``
|
||||
This option specifies the cryptographic hardware to use, when applicable.
|
||||
**-E** engine
|
||||
Specifies the cryptographic hardware to use, when applicable.
|
||||
|
||||
When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
|
||||
engine identifier that drives the cryptographic accelerator or
|
||||
hardware service module (usually ``pkcs11``). When BIND is
|
||||
built with native PKCS#11 cryptography (``--enable-native-pkcs11``), it
|
||||
When BIND is built with OpenSSL PKCS#11 support, this defaults to the
|
||||
string "pkcs11", which identifies an OpenSSL engine that can drive a
|
||||
cryptographic accelerator or hardware service module. When BIND is
|
||||
built with native PKCS#11 cryptography (--enable-native-pkcs11), it
|
||||
defaults to the path of the PKCS#11 provider library specified via
|
||||
``--with-pkcs11``.
|
||||
"--with-pkcs11".
|
||||
|
||||
``-f flag``
|
||||
This option sets the specified flag in the flag field of the KEY/DNSKEY record.
|
||||
The only recognized flags are KSK (Key-Signing Key) and REVOKE.
|
||||
**-f** flag
|
||||
Set the specified flag in the flag field of the KEY/DNSKEY record.
|
||||
The only recognized flags are KSK (Key Signing Key) and REVOKE.
|
||||
|
||||
``-G``
|
||||
This option generates a key, but does not publish it or sign with it. This option is
|
||||
incompatible with ``-P`` and ``-A``.
|
||||
**-G**
|
||||
Generate a key, but do not publish it or sign with it. This option is
|
||||
incompatible with -P and -A.
|
||||
|
||||
``-g generator``
|
||||
This option indicates the generator to use if generating a Diffie-Hellman key. Allowed
|
||||
**-g** generator
|
||||
If generating a Diffie Hellman key, use this generator. Allowed
|
||||
values are 2 and 5. If no generator is specified, a known prime from
|
||||
:rfc:`2539` is used if possible; otherwise the default is 2.
|
||||
:rfc:`2539` will be used if possible; otherwise the default is 2.
|
||||
|
||||
``-h``
|
||||
This option prints a short summary of the options and arguments to
|
||||
**-h**
|
||||
Prints a short summary of the options and arguments to
|
||||
``dnssec-keygen``.
|
||||
|
||||
``-K directory``
|
||||
This option sets the directory in which the key files are to be written.
|
||||
**-K** directory
|
||||
Sets the directory in which the key files are to be written.
|
||||
|
||||
``-k policy``
|
||||
This option creates keys for a specific ``dnssec-policy``. If a policy uses multiple keys,
|
||||
``dnssec-keygen`` generates multiple keys. This also
|
||||
creates a ".state" file to keep track of the key state.
|
||||
**-k** policy
|
||||
Create keys for a specific dnssec-policy. If a policy uses multiple keys,
|
||||
``dnssec-keygen`` will generate multiple keys. This will also
|
||||
create a ".state" file to keep track of the key state.
|
||||
|
||||
This option creates keys according to the ``dnssec-policy`` configuration, hence
|
||||
it cannot be used at the same time as many of the other options that
|
||||
This option creates keys according to the dnssec-policy configuration, hence
|
||||
it cannot be used together with many of the other options that
|
||||
``dnssec-keygen`` provides.
|
||||
|
||||
``-L ttl``
|
||||
This option sets the default TTL to use for this key when it is converted into a
|
||||
DNSKEY RR. This is the TTL used when the key is imported into a zone,
|
||||
unless there was already a DNSKEY RRset in
|
||||
place, in which case the existing TTL takes precedence. If this
|
||||
value is not set and there is no existing DNSKEY RRset, the TTL
|
||||
defaults to the SOA TTL. Setting the default TTL to ``0`` or ``none``
|
||||
**-L** ttl
|
||||
Sets the default TTL to use for this key when it is converted into a
|
||||
DNSKEY RR. If the key is imported into a zone, this is the TTL that
|
||||
will be used for it, unless there was already a DNSKEY RRset in
|
||||
place, in which case the existing TTL would take precedence. If this
|
||||
value is not set and there is no existing DNSKEY RRset, the TTL will
|
||||
default to the SOA TTL. Setting the default TTL to ``0`` or ``none``
|
||||
is the same as leaving it unset.
|
||||
|
||||
``-l file``
|
||||
This option provides a configuration file that contains a ``dnssec-policy`` statement
|
||||
**-l** file
|
||||
Provide a configuration file that contains a dnssec-policy statement
|
||||
(matching the policy set with ``-k``).
|
||||
|
||||
``-n nametype``
|
||||
This option specifies the owner type of the key. The value of ``nametype`` must
|
||||
**-n** nametype
|
||||
Specifies the owner type of the key. The value of ``nametype`` must
|
||||
either be ZONE (for a DNSSEC zone key (KEY/DNSKEY)), HOST or ENTITY
|
||||
(for a key associated with a host (KEY)), USER (for a key associated
|
||||
with a user (KEY)), or OTHER (DNSKEY). These values are
|
||||
case-insensitive. The default is ZONE for DNSKEY generation.
|
||||
with a user(KEY)) or OTHER (DNSKEY). These values are case
|
||||
insensitive. Defaults to ZONE for DNSKEY generation.
|
||||
|
||||
``-p protocol``
|
||||
This option sets the protocol value for the generated key, for use with
|
||||
**-p** protocol
|
||||
Sets the protocol value for the generated key, for use with
|
||||
``-T KEY``. The protocol is a number between 0 and 255. The default
|
||||
is 3 (DNSSEC). Other possible values for this argument are listed in
|
||||
:rfc:`2535` and its successors.
|
||||
|
||||
``-q``
|
||||
This option sets quiet mode, which suppresses unnecessary output, including progress
|
||||
**-q**
|
||||
Quiet mode: Suppresses unnecessary output, including progress
|
||||
indication. Without this option, when ``dnssec-keygen`` is run
|
||||
interactively to generate an RSA or DSA key pair, it prints a
|
||||
interactively to generate an RSA or DSA key pair, it will print a
|
||||
string of symbols to ``stderr`` indicating the progress of the key
|
||||
generation. A ``.`` indicates that a random number has been found which
|
||||
passed an initial sieve test; ``+`` means a number has passed a single
|
||||
round of the Miller-Rabin primality test; and a space ( ) means that the
|
||||
generation. A '.' indicates that a random number has been found which
|
||||
passed an initial sieve test; '+' means a number has passed a single
|
||||
round of the Miller-Rabin primality test; a space means that the
|
||||
number has passed all the tests and is a satisfactory key.
|
||||
|
||||
``-S key``
|
||||
This option creates a new key which is an explicit successor to an existing key.
|
||||
The name, algorithm, size, and type of the key are set to match
|
||||
the existing key. The activation date of the new key is set to
|
||||
the inactivation date of the existing one. The publication date is
|
||||
set to the activation date minus the prepublication interval,
|
||||
**-S** key
|
||||
Create a new key which is an explicit successor to an existing key.
|
||||
The name, algorithm, size, and type of the key will be set to match
|
||||
the existing key. The activation date of the new key will be set to
|
||||
the inactivation date of the existing one. The publication date will
|
||||
be set to the activation date minus the prepublication interval,
|
||||
which defaults to 30 days.
|
||||
|
||||
``-s strength``
|
||||
This option specifies the strength value of the key. The strength is a number
|
||||
**-s** strength
|
||||
Specifies the strength value of the key. The strength is a number
|
||||
between 0 and 15, and currently has no defined purpose in DNSSEC.
|
||||
|
||||
``-T rrtype``
|
||||
This option specifies the resource record type to use for the key. ``rrtype``
|
||||
**-T** rrtype
|
||||
Specifies the resource record type to use for the key. ``rrtype``
|
||||
must be either DNSKEY or KEY. The default is DNSKEY when using a
|
||||
DNSSEC algorithm, but it can be overridden to KEY for use with
|
||||
SIG(0).
|
||||
|
||||
``-t type``
|
||||
This option indicates the type of the key for use with ``-T KEY``. ``type``
|
||||
**-t** type
|
||||
Indicates the use of the key, for use with ``-T KEY``. ``type``
|
||||
must be one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF. The default
|
||||
is AUTHCONF. AUTH refers to the ability to authenticate data, and
|
||||
CONF to the ability to encrypt data.
|
||||
CONF the ability to encrypt data.
|
||||
|
||||
``-V``
|
||||
This option prints version information.
|
||||
**-V**
|
||||
Prints version information.
|
||||
|
||||
``-v level``
|
||||
This option sets the debugging level.
|
||||
**-v** level
|
||||
Sets the debugging level.
|
||||
|
||||
Timing Options
|
||||
~~~~~~~~~~~~~~
|
||||
|
||||
Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the
|
||||
argument begins with a ``+`` or ``-``, it is interpreted as an offset from
|
||||
argument begins with a '+' or '-', it is interpreted as an offset from
|
||||
the present time. For convenience, if such an offset is followed by one
|
||||
of the suffixes ``y``, ``mo``, ``w``, ``d``, ``h``, or ``mi``, then the offset is
|
||||
of the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi', then the offset is
|
||||
computed in years (defined as 365 24-hour days, ignoring leap years),
|
||||
months (defined as 30 24-hour days), weeks, days, hours, or minutes,
|
||||
respectively. Without a suffix, the offset is computed in seconds. To
|
||||
explicitly prevent a date from being set, use ``none`` or ``never``.
|
||||
explicitly prevent a date from being set, use 'none' or 'never'.
|
||||
|
||||
``-P date/offset``
|
||||
This option sets the date on which a key is to be published to the zone. After
|
||||
that date, the key is included in the zone but is not used
|
||||
to sign it. If not set, and if the ``-G`` option has not been used, the
|
||||
default is the current date.
|
||||
**-P** date/offset
|
||||
Sets the date on which a key is to be published to the zone. After
|
||||
that date, the key will be included in the zone but will not be used
|
||||
to sign it. If not set, and if the -G option has not been used, the
|
||||
default is "now".
|
||||
|
||||
``-P sync date/offset``
|
||||
This option sets the date on which CDS and CDNSKEY records that match this key
|
||||
**-P** sync date/offset
|
||||
Sets the date on which CDS and CDNSKEY records that match this key
|
||||
are to be published to the zone.
|
||||
|
||||
``-A date/offset``
|
||||
This option sets the date on which the key is to be activated. After that date,
|
||||
the key is included in the zone and used to sign it. If not set,
|
||||
and if the ``-G`` option has not been used, the default is the current date. If set,
|
||||
and ``-P`` is not set, the publication date is set to the
|
||||
**-A** date/offset
|
||||
Sets the date on which the key is to be activated. After that date,
|
||||
the key will be included in the zone and used to sign it. If not set,
|
||||
and if the -G option has not been used, the default is "now". If set,
|
||||
if and -P is not set, then the publication date will be set to the
|
||||
activation date minus the prepublication interval.
|
||||
|
||||
``-R date/offset``
|
||||
This option sets the date on which the key is to be revoked. After that date, the
|
||||
key is flagged as revoked. It is included in the zone and
|
||||
is used to sign it.
|
||||
**-R** date/offset
|
||||
Sets the date on which the key is to be revoked. After that date, the
|
||||
key will be flagged as revoked. It will be included in the zone and
|
||||
will be used to sign it.
|
||||
|
||||
``-I date/offset``
|
||||
This option sets the date on which the key is to be retired. After that date, the
|
||||
key is still included in the zone, but it is not used to
|
||||
**-I** date/offset
|
||||
Sets the date on which the key is to be retired. After that date, the
|
||||
key will still be included in the zone, but it will not be used to
|
||||
sign it.
|
||||
|
||||
``-D date/offset``
|
||||
This option sets the date on which the key is to be deleted. After that date, the
|
||||
key is no longer included in the zone. (However, it may remain in the key
|
||||
repository.)
|
||||
**-D** date/offset
|
||||
Sets the date on which the key is to be deleted. After that date, the
|
||||
key will no longer be included in the zone. (It may remain in the key
|
||||
repository, however.)
|
||||
|
||||
``-D sync date/offset``
|
||||
This option sets the date on which the CDS and CDNSKEY records that match this
|
||||
**-D** sync date/offset
|
||||
Sets the date on which the CDS and CDNSKEY records that match this
|
||||
key are to be deleted.
|
||||
|
||||
``-i interval``
|
||||
This option sets the prepublication interval for a key. If set, then the
|
||||
**-i** interval
|
||||
Sets the prepublication interval for a key. If set, then the
|
||||
publication and activation dates must be separated by at least this
|
||||
much time. If the activation date is specified but the publication
|
||||
date is not, the publication date defaults to this much time
|
||||
date isn't, then the publication date will default to this much time
|
||||
before the activation date; conversely, if the publication date is
|
||||
specified but not the activation date, activation is set to
|
||||
specified but activation date isn't, then activation will be set to
|
||||
this much time after publication.
|
||||
|
||||
If the key is being created as an explicit successor to another key,
|
||||
@@ -267,7 +267,7 @@ explicitly prevent a date from being set, use ``none`` or ``never``.
|
||||
zero.
|
||||
|
||||
As with date offsets, if the argument is followed by one of the
|
||||
suffixes ``y``, ``mo``, ``w``, ``d``, ``h``, or ``mi``, the interval is
|
||||
suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi', then the interval is
|
||||
measured in years, months, weeks, days, hours, or minutes,
|
||||
respectively. Without a suffix, the interval is measured in seconds.
|
||||
|
||||
@@ -289,9 +289,9 @@ string. ``Knnnn.+aaa+iiiii.key`` contains the public key, and
|
||||
``Knnnn.+aaa+iiiii.private`` contains the private key.
|
||||
|
||||
The ``.key`` file contains a DNSKEY or KEY record. When a zone is being
|
||||
signed by ``named`` or ``dnssec-signzone -S``, DNSKEY records are
|
||||
signed by ``named`` or ``dnssec-signzone`` ``-S``, DNSKEY records are
|
||||
included automatically. In other cases, the ``.key`` file can be
|
||||
inserted into a zone file manually or with an ``$INCLUDE`` statement.
|
||||
inserted into a zone file manually or with a ``$INCLUDE`` statement.
|
||||
|
||||
The ``.private`` file contains algorithm-specific fields. For obvious
|
||||
security reasons, this file does not have general read permission.
|
||||
@@ -304,7 +304,7 @@ To generate an ECDSAP256SHA256 zone-signing key for the zone
|
||||
|
||||
``dnssec-keygen -a ECDSAP256SHA256 example.com``
|
||||
|
||||
The command prints a string of the form:
|
||||
The command would print a string of the form:
|
||||
|
||||
``Kexample.com.+013+26160``
|
||||
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
|
||||
This Source Code Form is subject to the terms of the Mozilla Public
|
||||
License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
|
||||
See the COPYRIGHT file distributed with this work for additional
|
||||
information regarding copyright ownership.
|
||||
@@ -41,38 +41,38 @@ containing the now-revoked key.
|
||||
Options
|
||||
~~~~~~~
|
||||
|
||||
``-h``
|
||||
This option emits a usage message and exits.
|
||||
**-h**
|
||||
Emit usage message and exit.
|
||||
|
||||
``-K directory``
|
||||
This option sets the directory in which the key files are to reside.
|
||||
**-K** directory
|
||||
Sets the directory in which the key files are to reside.
|
||||
|
||||
``-r``
|
||||
This option indicates to remove the original keyset files after writing the new keyset files.
|
||||
**-r**
|
||||
After writing the new keyset files remove the original keyset files.
|
||||
|
||||
``-v level``
|
||||
This option sets the debugging level.
|
||||
**-v** level
|
||||
Sets the debugging level.
|
||||
|
||||
``-V``
|
||||
This option prints version information.
|
||||
**-V**
|
||||
Prints version information.
|
||||
|
||||
``-E engine``
|
||||
This option specifies the cryptographic hardware to use, when applicable.
|
||||
**-E** engine
|
||||
Specifies the cryptographic hardware to use, when applicable.
|
||||
|
||||
When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
|
||||
engine identifier that drives the cryptographic accelerator or
|
||||
hardware service module (usually ``pkcs11``). When BIND is
|
||||
built with native PKCS#11 cryptography (``--enable-native-pkcs11``), it
|
||||
When BIND is built with OpenSSL PKCS#11 support, this defaults to the
|
||||
string "pkcs11", which identifies an OpenSSL engine that can drive a
|
||||
cryptographic accelerator or hardware service module. When BIND is
|
||||
built with native PKCS#11 cryptography (--enable-native-pkcs11), it
|
||||
defaults to the path of the PKCS#11 provider library specified via
|
||||
``--with-pkcs11``.
|
||||
"--with-pkcs11".
|
||||
|
||||
``-f``
|
||||
This option indicates a forced overwrite and causes ``dnssec-revoke`` to write the new key pair,
|
||||
**-f**
|
||||
Force overwrite: Causes ``dnssec-revoke`` to write the new key pair
|
||||
even if a file already exists matching the algorithm and key ID of
|
||||
the revoked key.
|
||||
|
||||
``-R``
|
||||
This option prints the key tag of the key with the REVOKE bit set, but does not
|
||||
**-R**
|
||||
Print the key tag of the key with the REVOKE bit set but do not
|
||||
revoke the key.
|
||||
|
||||
See Also
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
@@ -75,8 +75,6 @@ usage(void) {
|
||||
fprintf(stderr, "Timing options:\n");
|
||||
fprintf(stderr, " -P date/[+-]offset/none: set/unset key "
|
||||
"publication date\n");
|
||||
fprintf(stderr, " -P ds date/[+-]offset/none: set/unset "
|
||||
"DS publication date\n");
|
||||
fprintf(stderr, " -P sync date/[+-]offset/none: set/unset "
|
||||
"CDS and CDNSKEY publication date\n");
|
||||
fprintf(stderr, " -A date/[+-]offset/none: set/unset key "
|
||||
@@ -87,8 +85,6 @@ usage(void) {
|
||||
"inactivation date\n");
|
||||
fprintf(stderr, " -D date/[+-]offset/none: set/unset key "
|
||||
"deletion date\n");
|
||||
fprintf(stderr, " -D ds date/[+-]offset/none: set/unset "
|
||||
"DS deletion date\n");
|
||||
fprintf(stderr, " -D sync date/[+-]offset/none: set/unset "
|
||||
"CDS and CDNSKEY deletion date\n");
|
||||
fprintf(stderr, " -S <key>: generate a successor to an existing "
|
||||
@@ -247,10 +243,6 @@ main(int argc, char **argv) {
|
||||
bool unsetsyncadd = false, setsyncadd = false;
|
||||
bool unsetsyncdel = false, setsyncdel = false;
|
||||
bool printsyncadd = false, printsyncdel = false;
|
||||
isc_stdtime_t dsadd = 0, dsdel = 0;
|
||||
bool unsetdsadd = false, setdsadd = false;
|
||||
bool unsetdsdel = false, setdsdel = false;
|
||||
bool printdsadd = false, printdsdel = false;
|
||||
|
||||
options = DST_TYPE_PUBLIC | DST_TYPE_PRIVATE | DST_TYPE_STATE;
|
||||
|
||||
@@ -298,18 +290,6 @@ main(int argc, char **argv) {
|
||||
unsetsyncdel = !setsyncdel;
|
||||
break;
|
||||
}
|
||||
/* -Dds ? */
|
||||
if (isoptarg("ds", argv, usage)) {
|
||||
if (unsetdsdel || setdsdel) {
|
||||
fatal("-D ds specified more than once");
|
||||
}
|
||||
|
||||
changed = true;
|
||||
dsdel = strtotime(isc_commandline_argument, now,
|
||||
now, &setdsdel);
|
||||
unsetdsdel = !setdsdel;
|
||||
break;
|
||||
}
|
||||
/* -Ddnskey ? */
|
||||
(void)isoptarg("dnskey", argv, usage);
|
||||
if (setdel || unsetdel) {
|
||||
@@ -414,19 +394,6 @@ main(int argc, char **argv) {
|
||||
unsetsyncadd = !setsyncadd;
|
||||
break;
|
||||
}
|
||||
/* -Pds ? */
|
||||
if (isoptarg("ds", argv, usage)) {
|
||||
if (unsetdsadd || setdsadd) {
|
||||
fatal("-P ds specified more than once");
|
||||
}
|
||||
|
||||
changed = true;
|
||||
dsadd = strtotime(isc_commandline_argument, now,
|
||||
now, &setdsadd);
|
||||
unsetdsadd = !setdsadd;
|
||||
break;
|
||||
}
|
||||
/* -Pdnskey ? */
|
||||
(void)isoptarg("dnskey", argv, usage);
|
||||
if (setpub || unsetpub) {
|
||||
fatal("-P specified more than once");
|
||||
@@ -448,8 +415,6 @@ main(int argc, char **argv) {
|
||||
printdel = true;
|
||||
printsyncadd = true;
|
||||
printsyncdel = true;
|
||||
printdsadd = true;
|
||||
printdsdel = true;
|
||||
break;
|
||||
}
|
||||
|
||||
@@ -467,11 +432,6 @@ main(int argc, char **argv) {
|
||||
printsyncdel = true;
|
||||
break;
|
||||
}
|
||||
if (!strncmp(p, "ds", 2)) {
|
||||
p += 2;
|
||||
printdsdel = true;
|
||||
break;
|
||||
}
|
||||
printdel = true;
|
||||
break;
|
||||
case 'I':
|
||||
@@ -483,11 +443,6 @@ main(int argc, char **argv) {
|
||||
printsyncadd = true;
|
||||
break;
|
||||
}
|
||||
if (!strncmp(p, "ds", 2)) {
|
||||
p += 2;
|
||||
printdsadd = true;
|
||||
break;
|
||||
}
|
||||
printpub = true;
|
||||
break;
|
||||
case 'R':
|
||||
@@ -822,18 +777,6 @@ main(int argc, char **argv) {
|
||||
dst_key_unsettime(key, DST_TIME_SYNCDELETE);
|
||||
}
|
||||
|
||||
if (setdsadd) {
|
||||
dst_key_settime(key, DST_TIME_DSPUBLISH, dsadd);
|
||||
} else if (unsetdsadd) {
|
||||
dst_key_unsettime(key, DST_TIME_DSPUBLISH);
|
||||
}
|
||||
|
||||
if (setdsdel) {
|
||||
dst_key_settime(key, DST_TIME_DSDELETE, dsdel);
|
||||
} else if (unsetdsdel) {
|
||||
dst_key_unsettime(key, DST_TIME_DSDELETE);
|
||||
}
|
||||
|
||||
if (setttl) {
|
||||
dst_key_setttl(key, ttl);
|
||||
}
|
||||
@@ -951,14 +894,6 @@ main(int argc, char **argv) {
|
||||
stdout);
|
||||
}
|
||||
|
||||
if (printdsadd) {
|
||||
printtime(key, DST_TIME_DSPUBLISH, "DS Publish", epoch, stdout);
|
||||
}
|
||||
|
||||
if (printdsdel) {
|
||||
printtime(key, DST_TIME_DSDELETE, "DS Delete", epoch, stdout);
|
||||
}
|
||||
|
||||
if (changed) {
|
||||
writekey(key, directory, write_state);
|
||||
if (predecessor != NULL && prevkey != NULL) {
|
||||
|
||||
+95
-106
@@ -3,7 +3,7 @@
|
||||
|
||||
This Source Code Form is subject to the terms of the Mozilla Public
|
||||
License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
|
||||
See the COPYRIGHT file distributed with this work for additional
|
||||
information regarding copyright ownership.
|
||||
@@ -29,7 +29,7 @@ dnssec-settime: set the key timing metadata for a DNSSEC key
|
||||
Synopsis
|
||||
~~~~~~~~
|
||||
|
||||
:program:`dnssec-settime` [**-f**] [**-K** directory] [**-L** ttl] [**-P** date/offset] [**-P** ds date/offset] [**-P** sync date/offset] [**-A** date/offset] [**-R** date/offset] [**-I** date/offset] [**-D** date/offset] [**-D** ds date/offset] [**-D** sync date/offset] [**-S** key] [**-i** interval] [**-h**] [**-V**] [**-v** level] [**-E** engine] {keyfile} [**-s**] [**-g** state] [**-d** state date/offset] [**-k** state date/offset] [**-r** state date/offset] [**-z** state date/offset]
|
||||
:program:`dnssec-settime` [**-f**] [**-K** directory] [**-L** ttl] [**-P** date/offset] [**-P** sync date/offset] [**-A** date/offset] [**-R** date/offset] [**-I** date/offset] [**-D** date/offset] [**-D** sync date/offset] [**-S** key] [**-i** interval] [**-h**] [**-V**] [**-v** level] [**-E** engine] {keyfile} [**-s**] [**-g** state] [**-d** state date/offset] [**-k** state date/offset] [**-r** state date/offset] [**-z** state date/offset]
|
||||
|
||||
Description
|
||||
~~~~~~~~~~~
|
||||
@@ -40,7 +40,7 @@ timing metadata as specified by the ``-P``, ``-A``, ``-R``, ``-I``, and
|
||||
other signing software to determine when a key is to be published,
|
||||
whether it should be used for signing a zone, etc.
|
||||
|
||||
If none of these options is set on the command line,
|
||||
If none of these options is set on the command line, then
|
||||
``dnssec-settime`` simply prints the key timing metadata already stored
|
||||
in the key.
|
||||
|
||||
@@ -54,165 +54,155 @@ the key file. The private file's permissions are always set to be
|
||||
inaccessible to anyone other than the owner (mode 0600).
|
||||
|
||||
When working with state files, it is possible to update the timing metadata in
|
||||
those files as well with ``-s``. With this option, it is also possible to update key
|
||||
those files as well with ``-s``. If this option is used you can also update key
|
||||
states with ``-d`` (DS), ``-k`` (DNSKEY), ``-r`` (RRSIG of KSK), or ``-z``
|
||||
(RRSIG of ZSK). Allowed states are HIDDEN, RUMOURED, OMNIPRESENT, and
|
||||
UNRETENTIVE.
|
||||
|
||||
The goal state of the key can also be set with ``-g``. This should be either
|
||||
HIDDEN or OMNIPRESENT, representing whether the key should be removed from the
|
||||
zone or published.
|
||||
You can also set the goal state of the key with ``-g``. This should be either
|
||||
HIDDEN or OMNIPRESENT (representing whether the key should be removed from the
|
||||
zone, or published).
|
||||
|
||||
It is NOT RECOMMENDED to manipulate state files manually, except for testing
|
||||
It is NOT RECOMMENDED to manipulate state files manually except for testing
|
||||
purposes.
|
||||
|
||||
Options
|
||||
~~~~~~~
|
||||
|
||||
``-f``
|
||||
This option forces an update of an old-format key with no metadata fields. Without
|
||||
this option, ``dnssec-settime`` fails when attempting to update a
|
||||
legacy key. With this option, the key is recreated in the new
|
||||
**-f**
|
||||
Force an update of an old-format key with no metadata fields. Without
|
||||
this option, ``dnssec-settime`` will fail when attempting to update a
|
||||
legacy key. With this option, the key will be recreated in the new
|
||||
format, but with the original key data retained. The key's creation
|
||||
date is set to the present time. If no other values are
|
||||
specified, then the key's publication and activation dates are also
|
||||
set to the present time.
|
||||
date will be set to the present time. If no other values are
|
||||
specified, then the key's publication and activation dates will also
|
||||
be set to the present time.
|
||||
|
||||
``-K directory``
|
||||
This option sets the directory in which the key files are to reside.
|
||||
**-K** directory
|
||||
Sets the directory in which the key files are to reside.
|
||||
|
||||
``-L ttl``
|
||||
This option sets the default TTL to use for this key when it is converted into a
|
||||
DNSKEY RR. This is the TTL used when the key is imported into a zone,
|
||||
unless there was already a DNSKEY RRset in
|
||||
place, in which case the existing TTL takes precedence. If this
|
||||
value is not set and there is no existing DNSKEY RRset, the TTL
|
||||
defaults to the SOA TTL. Setting the default TTL to ``0`` or ``none``
|
||||
**-L** ttl
|
||||
Sets the default TTL to use for this key when it is converted into a
|
||||
DNSKEY RR. If the key is imported into a zone, this is the TTL that
|
||||
will be used for it, unless there was already a DNSKEY RRset in
|
||||
place, in which case the existing TTL would take precedence. If this
|
||||
value is not set and there is no existing DNSKEY RRset, the TTL will
|
||||
default to the SOA TTL. Setting the default TTL to ``0`` or ``none``
|
||||
removes it from the key.
|
||||
|
||||
``-h``
|
||||
This option emits a usage message and exits.
|
||||
**-h**
|
||||
Emit usage message and exit.
|
||||
|
||||
``-V``
|
||||
This option prints version information.
|
||||
**-V**
|
||||
Prints version information.
|
||||
|
||||
``-v level``
|
||||
This option sets the debugging level.
|
||||
**-v** level
|
||||
Sets the debugging level.
|
||||
|
||||
``-E engine``
|
||||
This option specifies the cryptographic hardware to use, when applicable.
|
||||
**-E** engine
|
||||
Specifies the cryptographic hardware to use, when applicable.
|
||||
|
||||
When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
|
||||
engine identifier that drives the cryptographic accelerator or
|
||||
hardware service module (usually ``pkcs11``). When BIND is
|
||||
built with native PKCS#11 cryptography (``--enable-native-pkcs11``), it
|
||||
When BIND is built with OpenSSL PKCS#11 support, this defaults to the
|
||||
string "pkcs11", which identifies an OpenSSL engine that can drive a
|
||||
cryptographic accelerator or hardware service module. When BIND is
|
||||
built with native PKCS#11 cryptography (--enable-native-pkcs11), it
|
||||
defaults to the path of the PKCS#11 provider library specified via
|
||||
``--with-pkcs11``.
|
||||
"--with-pkcs11".
|
||||
|
||||
Timing Options
|
||||
~~~~~~~~~~~~~~
|
||||
|
||||
Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the
|
||||
argument begins with a ``+`` or ``-``, it is interpreted as an offset from
|
||||
argument begins with a '+' or '-', it is interpreted as an offset from
|
||||
the present time. For convenience, if such an offset is followed by one
|
||||
of the suffixes ``y``, ``mo``, ``w``, ``d``, ``h``, or ``mi``, then the offset is
|
||||
of the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi', then the offset is
|
||||
computed in years (defined as 365 24-hour days, ignoring leap years),
|
||||
months (defined as 30 24-hour days), weeks, days, hours, or minutes,
|
||||
respectively. Without a suffix, the offset is computed in seconds. To
|
||||
explicitly prevent a date from being set, use ``none`` or ``never``.
|
||||
unset a date, use 'none' or 'never'.
|
||||
|
||||
``-P date/offset``
|
||||
This option sets the date on which a key is to be published to the zone. After
|
||||
that date, the key is included in the zone but is not used
|
||||
**-P** date/offset
|
||||
Sets the date on which a key is to be published to the zone. After
|
||||
that date, the key will be included in the zone but will not be used
|
||||
to sign it.
|
||||
|
||||
``-P ds date/offset``
|
||||
This option sets the date on which DS records that match this key have been
|
||||
seen in the parent zone.
|
||||
|
||||
``-P sync date/offset``
|
||||
This option sets the date on which CDS and CDNSKEY records that match this key
|
||||
**-P** sync date/offset
|
||||
Sets the date on which CDS and CDNSKEY records that match this key
|
||||
are to be published to the zone.
|
||||
|
||||
``-A date/offset``
|
||||
This option sets the date on which the key is to be activated. After that date,
|
||||
the key is included in the zone and used to sign it.
|
||||
**-A** date/offset
|
||||
Sets the date on which the key is to be activated. After that date,
|
||||
the key will be included in the zone and used to sign it.
|
||||
|
||||
``-R date/offset``
|
||||
This option sets the date on which the key is to be revoked. After that date, the
|
||||
key is flagged as revoked. It is included in the zone and
|
||||
is used to sign it.
|
||||
**-R** date/offset
|
||||
Sets the date on which the key is to be revoked. After that date, the
|
||||
key will be flagged as revoked. It will be included in the zone and
|
||||
will be used to sign it.
|
||||
|
||||
``-I date/offset``
|
||||
This option sets the date on which the key is to be retired. After that date, the
|
||||
key is still included in the zone, but it is not used to
|
||||
**-I** date/offset
|
||||
Sets the date on which the key is to be retired. After that date, the
|
||||
key will still be included in the zone, but it will not be used to
|
||||
sign it.
|
||||
|
||||
``-D date/offset``
|
||||
This option sets the date on which the key is to be deleted. After that date, the
|
||||
key is no longer included in the zone. (However, it may remain in the key
|
||||
repository.)
|
||||
**-D** date/offset
|
||||
Sets the date on which the key is to be deleted. After that date, the
|
||||
key will no longer be included in the zone. (It may remain in the key
|
||||
repository, however.)
|
||||
|
||||
``-D ds date/offset``
|
||||
This option sets the date on which the DS records that match this key have
|
||||
been seen removed from the parent zone.
|
||||
|
||||
``-D sync date/offset``
|
||||
This option sets the date on which the CDS and CDNSKEY records that match this
|
||||
**-D** sync date/offset
|
||||
Sets the date on which the CDS and CDNSKEY records that match this
|
||||
key are to be deleted.
|
||||
|
||||
``-S predecessor key``
|
||||
This option selects a key for which the key being modified is an explicit
|
||||
**-S** predecessor key
|
||||
Select a key for which the key being modified will be an explicit
|
||||
successor. The name, algorithm, size, and type of the predecessor key
|
||||
must exactly match those of the key being modified. The activation
|
||||
date of the successor key is set to the inactivation date of the
|
||||
predecessor. The publication date is set to the activation date
|
||||
date of the successor key will be set to the inactivation date of the
|
||||
predecessor. The publication date will be set to the activation date
|
||||
minus the prepublication interval, which defaults to 30 days.
|
||||
|
||||
``-i interval``
|
||||
This option sets the prepublication interval for a key. If set, then the
|
||||
**-i** interval
|
||||
Sets the prepublication interval for a key. If set, then the
|
||||
publication and activation dates must be separated by at least this
|
||||
much time. If the activation date is specified but the publication
|
||||
date is not, the publication date defaults to this much time
|
||||
date isn't, then the publication date will default to this much time
|
||||
before the activation date; conversely, if the publication date is
|
||||
specified but not the activation date, activation is set to
|
||||
specified but activation date isn't, then activation will be set to
|
||||
this much time after publication.
|
||||
|
||||
If the key is being created as an explicit successor to another key,
|
||||
If the key is being set to be an explicit successor to another key,
|
||||
then the default prepublication interval is 30 days; otherwise it is
|
||||
zero.
|
||||
|
||||
As with date offsets, if the argument is followed by one of the
|
||||
suffixes ``y``, ``mo``, ``w``, ``d``, ``h``, or ``mi``, the interval is
|
||||
suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi', then the interval is
|
||||
measured in years, months, weeks, days, hours, or minutes,
|
||||
respectively. Without a suffix, the interval is measured in seconds.
|
||||
|
||||
Key State Options
|
||||
~~~~~~~~~~~~~~~~~
|
||||
|
||||
To test dnssec-policy it may be necessary to construct keys with artificial
|
||||
state information; these options are used by the testing framework for that
|
||||
purpose, but should never be used in production.
|
||||
|
||||
Known key states are HIDDEN, RUMOURED, OMNIPRESENT, and UNRETENTIVE.
|
||||
Known key states are HIDDEN, RUMOURED, OMNIPRESENT and UNRETENTIVE. These should
|
||||
not be set manually except for testing purposes.
|
||||
|
||||
``-s``
|
||||
This option indicates that when setting key timing data, the state file should also be updated.
|
||||
When setting key timing data, also update the state file.
|
||||
|
||||
``-g state``
|
||||
This option sets the goal state for this key. Must be HIDDEN or OMNIPRESENT.
|
||||
``-g``
|
||||
Set the goal state for this key. Must be HIDDEN or OMNIPRESENT.
|
||||
|
||||
``-d state date/offset``
|
||||
This option sets the DS state for this key as of the specified date, offset from the current date.
|
||||
``-d``
|
||||
Set the DS state for this key, and when it was last changed.
|
||||
|
||||
``-k state date/offset``
|
||||
This option sets the DNSKEY state for this key as of the specified date, offset from the current date.
|
||||
``-k``
|
||||
Set the DNSKEY state for this key, and when it was last changed.
|
||||
|
||||
``-r state date/offset``
|
||||
This option sets the RRSIG (KSK) state for this key as of the specified date, offset from the current date.
|
||||
``-r``
|
||||
Set the RRSIG (KSK) state for this key, and when it was last changed.
|
||||
|
||||
``-z state date/offset``
|
||||
This option sets the RRSIG (ZSK) state for this key as of the specified date, offset from the current date.
|
||||
``-z``
|
||||
|
||||
Set the RRSIG (ZSK) state for this key, and when it was last changed.
|
||||
|
||||
Printing Options
|
||||
~~~~~~~~~~~~~~~~
|
||||
@@ -220,19 +210,18 @@ Printing Options
|
||||
``dnssec-settime`` can also be used to print the timing metadata
|
||||
associated with a key.
|
||||
|
||||
``-u``
|
||||
This option indicates that times should be printed in Unix epoch format.
|
||||
**-u**
|
||||
Print times in UNIX epoch format.
|
||||
|
||||
``-p C/P/Pds/Psync/A/R/I/D/Dds/Dsync/all``
|
||||
This option prints a specific metadata value or set of metadata values.
|
||||
The ``-p`` option may be followed by one or more of the following letters or
|
||||
**-p** C/P/Psync/A/R/I/D/Dsync/all
|
||||
Print a specific metadata value or set of metadata values. The ``-p``
|
||||
option may be followed by one or more of the following letters or
|
||||
strings to indicate which value or values to print: ``C`` for the
|
||||
creation date, ``P`` for the publication date, ``Pds` for the DS publication
|
||||
date, ``Psync`` for the CDS and CDNSKEY publication date, ``A`` for the
|
||||
activation date, ``R`` for the revocation date, ``I`` for the inactivation
|
||||
date, ``D`` for the deletion date, ``Dds`` for the DS deletion date,
|
||||
and ``Dsync`` for the CDS and CDNSKEY deletion date. To print all of the
|
||||
metadata, use ``all``.
|
||||
creation date, ``P`` for the publication date, ``Psync`` for the CDS
|
||||
and CDNSKEY publication date, ``A`` for the activation date, ``R``
|
||||
for the revocation date, ``I`` for the inactivation date, ``D`` for
|
||||
the deletion date, and ``Dsync`` for the CDS and CDNSKEY deletion
|
||||
date To print all of the metadata, use ``-p all``.
|
||||
|
||||
See Also
|
||||
~~~~~~~~
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
@@ -40,7 +40,6 @@
|
||||
#include <isc/file.h>
|
||||
#include <isc/hash.h>
|
||||
#include <isc/hex.h>
|
||||
#include <isc/managers.h>
|
||||
#include <isc/md.h>
|
||||
#include <isc/mem.h>
|
||||
#include <isc/mutex.h>
|
||||
@@ -145,7 +144,6 @@ static unsigned int nsigned = 0, nretained = 0, ndropped = 0;
|
||||
static unsigned int nverified = 0, nverifyfailed = 0;
|
||||
static const char *directory = NULL, *dsdir = NULL;
|
||||
static isc_mutex_t namelock, statslock;
|
||||
static isc_nm_t *netmgr = NULL;
|
||||
static isc_taskmgr_t *taskmgr = NULL;
|
||||
static dns_db_t *gdb; /* The database */
|
||||
static dns_dbversion_t *gversion; /* The database version */
|
||||
@@ -179,9 +177,8 @@ static bool remove_orphansigs = false;
|
||||
static bool remove_inactkeysigs = false;
|
||||
static bool output_dnssec_only = false;
|
||||
static bool output_stdout = false;
|
||||
static bool set_maxttl = false;
|
||||
bool set_maxttl = false;
|
||||
static dns_ttl_t maxttl = 0;
|
||||
static bool no_max_check = false;
|
||||
|
||||
#define INCSTAT(counter) \
|
||||
if (printstats) { \
|
||||
@@ -201,7 +198,7 @@ savezonecut(dns_fixedname_t *fzonecut, dns_name_t *name) {
|
||||
dns_name_t *result;
|
||||
|
||||
result = dns_fixedname_initname(fzonecut);
|
||||
dns_name_copy(name, result);
|
||||
dns_name_copynf(name, result);
|
||||
|
||||
return (result);
|
||||
}
|
||||
@@ -594,10 +591,10 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
|
||||
vbprintf(2, "\trrsig by %s dropped - %s\n",
|
||||
sigstr,
|
||||
expired ? "expired"
|
||||
: rrsig.originalttl != set->ttl
|
||||
? "ttl change"
|
||||
: "failed to "
|
||||
"verify");
|
||||
: rrsig.originalttl != set->ttl
|
||||
? "ttl change"
|
||||
: "failed to "
|
||||
"verify");
|
||||
resign = true;
|
||||
}
|
||||
} else if (!ispublishedkey(key) && remove_orphansigs) {
|
||||
@@ -615,10 +612,10 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
|
||||
vbprintf(2, "\trrsig by %s dropped - %s\n",
|
||||
sigstr,
|
||||
expired ? "expired"
|
||||
: rrsig.originalttl != set->ttl
|
||||
? "ttl change"
|
||||
: "failed to "
|
||||
"verify");
|
||||
: rrsig.originalttl != set->ttl
|
||||
? "ttl change"
|
||||
: "failed to "
|
||||
"verify");
|
||||
}
|
||||
} else if (!expired) {
|
||||
vbprintf(2, "\trrsig by %s retained\n", sigstr);
|
||||
@@ -1337,8 +1334,8 @@ get_soa_ttls(void) {
|
||||
result = dns_rdataset_first(&soaset);
|
||||
check_result(result, "dns_rdataset_first");
|
||||
dns_rdataset_current(&soaset, &rdata);
|
||||
zone_soa_min_ttl = dns_soa_getminimum(&rdata);
|
||||
soa_ttl = soaset.ttl;
|
||||
zone_soa_min_ttl = ISC_MIN(dns_soa_getminimum(&rdata), soa_ttl);
|
||||
if (set_maxttl) {
|
||||
zone_soa_min_ttl = ISC_MIN(zone_soa_min_ttl, maxttl);
|
||||
soa_ttl = ISC_MIN(soa_ttl, maxttl);
|
||||
@@ -1355,8 +1352,7 @@ setsoaserial(uint32_t serial, dns_updatemethod_t method) {
|
||||
dns_dbnode_t *node = NULL;
|
||||
dns_rdataset_t rdataset;
|
||||
dns_rdata_t rdata = DNS_RDATA_INIT;
|
||||
uint32_t old_serial, new_serial = 0;
|
||||
dns_updatemethod_t used = dns_updatemethod_none;
|
||||
uint32_t old_serial, new_serial;
|
||||
|
||||
result = dns_db_getoriginnode(gdb, &node);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
@@ -1380,20 +1376,16 @@ setsoaserial(uint32_t serial, dns_updatemethod_t method) {
|
||||
|
||||
if (method == dns_updatemethod_date ||
|
||||
method == dns_updatemethod_unixtime) {
|
||||
new_serial = dns_update_soaserial(old_serial, method, &used);
|
||||
new_serial = dns_update_soaserial(old_serial, method);
|
||||
} else if (serial != 0 || method == dns_updatemethod_none) {
|
||||
/* Set SOA serial to the value provided. */
|
||||
new_serial = serial;
|
||||
used = method;
|
||||
} else {
|
||||
new_serial = dns_update_soaserial(old_serial, method, &used);
|
||||
}
|
||||
|
||||
if (method != used) {
|
||||
fprintf(stderr,
|
||||
"%s: warning: Serial number would not advance, "
|
||||
"using increment method instead\n",
|
||||
program);
|
||||
/* Increment SOA serial using RFC 1982 arithmetic */
|
||||
new_serial = (old_serial + 1) & 0xFFFFFFFF;
|
||||
if (new_serial == 0) {
|
||||
new_serial = 1;
|
||||
}
|
||||
}
|
||||
|
||||
/* If the new serial is not likely to cause a zone transfer
|
||||
@@ -2397,7 +2389,7 @@ nsec3ify(unsigned int hashalg, dns_iterations_t iterations,
|
||||
break;
|
||||
}
|
||||
if (result == ISC_R_NOMORE) {
|
||||
dns_name_copy(gorigin, nextname);
|
||||
dns_name_copynf(gorigin, nextname);
|
||||
done = true;
|
||||
} else if (result != ISC_R_SUCCESS) {
|
||||
fatal("iterating through the database failed: %s",
|
||||
@@ -2534,7 +2526,7 @@ nsec3ify(unsigned int hashalg, dns_iterations_t iterations,
|
||||
break;
|
||||
}
|
||||
if (result == ISC_R_NOMORE) {
|
||||
dns_name_copy(gorigin, nextname);
|
||||
dns_name_copynf(gorigin, nextname);
|
||||
done = true;
|
||||
} else if (result != ISC_R_SUCCESS) {
|
||||
fatal("iterating through the database failed: %s",
|
||||
@@ -2731,13 +2723,10 @@ static void
|
||||
report(const char *format, ...) {
|
||||
if (!quiet) {
|
||||
FILE *out = output_stdout ? stderr : stdout;
|
||||
char buf[4096];
|
||||
va_list args;
|
||||
|
||||
va_start(args, format);
|
||||
vsnprintf(buf, sizeof(buf), format, args);
|
||||
vfprintf(out, format, args);
|
||||
va_end(args);
|
||||
fprintf(out, "%s\n", buf);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -3441,12 +3430,6 @@ main(int argc, char *argv[]) {
|
||||
|
||||
case 'H':
|
||||
set_iter = true;
|
||||
/* too-many is NOT DOCUMENTED */
|
||||
if (strcmp(isc_commandline_argument, "too-many") == 0) {
|
||||
nsec3iter = 151;
|
||||
no_max_check = true;
|
||||
break;
|
||||
}
|
||||
nsec3iter = strtoul(isc_commandline_argument, &endp, 0);
|
||||
if (*endp != '\0') {
|
||||
fatal("iterations must be numeric");
|
||||
@@ -3815,7 +3798,11 @@ main(int argc, char *argv[]) {
|
||||
* of keys rather early.
|
||||
*/
|
||||
ISC_LIST_INIT(keylist);
|
||||
isc_rwlock_init(&keylist_lock, 0, 0);
|
||||
result = isc_rwlock_init(&keylist_lock, 0, 0);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
fatal("could not initialize keylist_lock: %s",
|
||||
isc_result_totext(result));
|
||||
}
|
||||
|
||||
/*
|
||||
* Fill keylist with:
|
||||
@@ -3865,6 +3852,7 @@ main(int argc, char *argv[]) {
|
||||
warnifallksk(gdb);
|
||||
|
||||
if (IS_NSEC3) {
|
||||
unsigned int max;
|
||||
bool answer;
|
||||
|
||||
hash_length = dns_nsec3_hashlength(dns_hash_sha1);
|
||||
@@ -3883,15 +3871,12 @@ main(int argc, char *argv[]) {
|
||||
"NSEC-only DNSKEY");
|
||||
}
|
||||
|
||||
if (nsec3iter > dns_nsec3_maxiterations()) {
|
||||
if (no_max_check) {
|
||||
fprintf(stderr,
|
||||
"Ignoring max iterations check.\n");
|
||||
} else {
|
||||
fatal("NSEC3 iterations too big. Maximum "
|
||||
"iterations allowed %u.",
|
||||
dns_nsec3_maxiterations());
|
||||
}
|
||||
result = dns_nsec3_maxiterations(gdb, NULL, mctx, &max);
|
||||
check_result(result, "dns_nsec3_maxiterations()");
|
||||
if (nsec3iter > max) {
|
||||
fatal("NSEC3 iterations too big for weakest DNSKEY "
|
||||
"strength. Maximum iterations allowed %u.",
|
||||
max);
|
||||
}
|
||||
} else {
|
||||
hashlist_init(&hashlist, 0, 0); /* silence clang */
|
||||
@@ -3964,7 +3949,11 @@ main(int argc, char *argv[]) {
|
||||
print_time(outfp);
|
||||
print_version(outfp);
|
||||
|
||||
isc_managers_create(mctx, ntasks, 0, 0, &netmgr, &taskmgr, NULL, NULL);
|
||||
result = isc_taskmgr_create(mctx, ntasks, 0, NULL, &taskmgr);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
fatal("failed to create task manager: %s",
|
||||
isc_result_totext(result));
|
||||
}
|
||||
|
||||
master = NULL;
|
||||
result = isc_task_create(taskmgr, 0, &master);
|
||||
@@ -4015,7 +4004,7 @@ main(int argc, char *argv[]) {
|
||||
for (i = 0; i < (int)ntasks; i++) {
|
||||
isc_task_detach(&tasks[i]);
|
||||
}
|
||||
isc_managers_destroy(&netmgr, &taskmgr, NULL, NULL);
|
||||
isc_taskmgr_destroy(&taskmgr);
|
||||
isc_mem_put(mctx, tasks, ntasks * sizeof(isc_task_t *));
|
||||
postsign();
|
||||
TIME_NOW(&sign_finish);
|
||||
|
||||
+170
-175
@@ -3,7 +3,7 @@
|
||||
|
||||
This Source Code Form is subject to the terms of the Mozilla Public
|
||||
License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
|
||||
See the COPYRIGHT file distributed with this work for additional
|
||||
information regarding copyright ownership.
|
||||
@@ -34,238 +34,233 @@ Synopsis
|
||||
Description
|
||||
~~~~~~~~~~~
|
||||
|
||||
``dnssec-signzone`` signs a zone; it generates NSEC and RRSIG records
|
||||
``dnssec-signzone`` signs a zone. It generates NSEC and RRSIG records
|
||||
and produces a signed version of the zone. The security status of
|
||||
delegations from the signed zone (that is, whether the child zones are
|
||||
secure) is determined by the presence or absence of a ``keyset``
|
||||
secure or not) is determined by the presence or absence of a ``keyset``
|
||||
file for each child zone.
|
||||
|
||||
Options
|
||||
~~~~~~~
|
||||
|
||||
``-a``
|
||||
This option verifies all generated signatures.
|
||||
**-a**
|
||||
Verify all generated signatures.
|
||||
|
||||
``-c class``
|
||||
This option specifies the DNS class of the zone.
|
||||
**-c** class
|
||||
Specifies the DNS class of the zone.
|
||||
|
||||
``-C``
|
||||
This option sets compatibility mode, in which a ``keyset-zonename`` file is generated in addition
|
||||
**-C**
|
||||
Compatibility mode: Generate a ``keyset-zonename`` file in addition
|
||||
to ``dsset-zonename`` when signing a zone, for use by older versions
|
||||
of ``dnssec-signzone``.
|
||||
|
||||
``-d directory``
|
||||
This option indicates the directory where BIND 9 should look for ``dsset-`` or ``keyset-`` files.
|
||||
**-d** directory
|
||||
Look for ``dsset-`` or ``keyset-`` files in ``directory``.
|
||||
|
||||
``-D``
|
||||
This option indicates that only those record types automatically managed by
|
||||
``dnssec-signzone``, i.e., RRSIG, NSEC, NSEC3 and NSEC3PARAM records, should be included in the output.
|
||||
**-D**
|
||||
Output only those record types automatically managed by
|
||||
``dnssec-signzone``, i.e. RRSIG, NSEC, NSEC3 and NSEC3PARAM records.
|
||||
If smart signing (``-S``) is used, DNSKEY records are also included.
|
||||
The resulting file can be included in the original zone file with
|
||||
``$INCLUDE``. This option cannot be combined with ``-O raw``,
|
||||
``-O map``, or serial-number updating.
|
||||
``-O map``, or serial number updating.
|
||||
|
||||
``-E engine``
|
||||
This option specifies the hardware to use for cryptographic
|
||||
operations, such as a secure key store used for signing, when applicable.
|
||||
**-E** engine
|
||||
When applicable, specifies the hardware to use for cryptographic
|
||||
operations, such as a secure key store used for signing.
|
||||
|
||||
When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
|
||||
engine identifier that drives the cryptographic accelerator or
|
||||
hardware service module (usually ``pkcs11``). When BIND is
|
||||
built with native PKCS#11 cryptography (``--enable-native-pkcs11``), it
|
||||
When BIND is built with OpenSSL PKCS#11 support, this defaults to the
|
||||
string "pkcs11", which identifies an OpenSSL engine that can drive a
|
||||
cryptographic accelerator or hardware service module. When BIND is
|
||||
built with native PKCS#11 cryptography (--enable-native-pkcs11), it
|
||||
defaults to the path of the PKCS#11 provider library specified via
|
||||
``--with-pkcs11``.
|
||||
"--with-pkcs11".
|
||||
|
||||
``-g``
|
||||
This option indicates that DS records for child zones should be generated from a ``dsset-`` or ``keyset-``
|
||||
file. Existing DS records are removed.
|
||||
**-g**
|
||||
Generate DS records for child zones from ``dsset-`` or ``keyset-``
|
||||
file. Existing DS records will be removed.
|
||||
|
||||
``-K directory``
|
||||
This option specifies the directory to search for DNSSEC keys. If not
|
||||
specified, it defaults to the current directory.
|
||||
**-K** directory
|
||||
Key repository: Specify a directory to search for DNSSEC keys. If not
|
||||
specified, defaults to the current directory.
|
||||
|
||||
``-k key``
|
||||
This option tells BIND 9 to treat the specified key as a key-signing key, ignoring any key flags. This
|
||||
**-k** key
|
||||
Treat specified key as a key signing key ignoring any key flags. This
|
||||
option may be specified multiple times.
|
||||
|
||||
``-M maxttl``
|
||||
This option sets the maximum TTL for the signed zone. Any TTL higher than ``maxttl``
|
||||
in the input zone is reduced to ``maxttl`` in the output. This
|
||||
**-M** maxttl
|
||||
Sets the maximum TTL for the signed zone. Any TTL higher than maxttl
|
||||
in the input zone will be reduced to maxttl in the output. This
|
||||
provides certainty as to the largest possible TTL in the signed zone,
|
||||
which is useful to know when rolling keys. The maxttl is the longest
|
||||
which is useful to know when rolling keys because it is the longest
|
||||
possible time before signatures that have been retrieved by resolvers
|
||||
expire from resolver caches. Zones that are signed with this
|
||||
will expire from resolver caches. Zones that are signed with this
|
||||
option should be configured to use a matching ``max-zone-ttl`` in
|
||||
``named.conf``. (Note: This option is incompatible with ``-D``,
|
||||
because it modifies non-DNSSEC data in the output zone.)
|
||||
|
||||
``-s start-time``
|
||||
This option specifies the date and time when the generated RRSIG records become
|
||||
**-s** start-time
|
||||
Specify the date and time when the generated RRSIG records become
|
||||
valid. This can be either an absolute or relative time. An absolute
|
||||
start time is indicated by a number in YYYYMMDDHHMMSS notation;
|
||||
20000530144500 denotes 14:45:00 UTC on May 30th, 2000. A relative
|
||||
start time is indicated by ``+N``, which is N seconds from the current
|
||||
start time is indicated by +N, which is N seconds from the current
|
||||
time. If no ``start-time`` is specified, the current time minus 1
|
||||
hour (to allow for clock skew) is used.
|
||||
|
||||
``-e end-time``
|
||||
This option specifies the date and time when the generated RRSIG records expire. As
|
||||
**-e** end-time
|
||||
Specify the date and time when the generated RRSIG records expire. As
|
||||
with ``start-time``, an absolute time is indicated in YYYYMMDDHHMMSS
|
||||
notation. A time relative to the start time is indicated with ``+N``,
|
||||
notation. A time relative to the start time is indicated with +N,
|
||||
which is N seconds from the start time. A time relative to the
|
||||
current time is indicated with ``now+N``. If no ``end-time`` is
|
||||
specified, 30 days from the start time is the default.
|
||||
current time is indicated with now+N. If no ``end-time`` is
|
||||
specified, 30 days from the start time is used as a default.
|
||||
``end-time`` must be later than ``start-time``.
|
||||
|
||||
``-X extended end-time``
|
||||
This option specifies the date and time when the generated RRSIG records for the
|
||||
DNSKEY RRset expire. This is to be used in cases when the DNSKEY
|
||||
**-X** extended end-time
|
||||
Specify the date and time when the generated RRSIG records for the
|
||||
DNSKEY RRset will expire. This is to be used in cases when the DNSKEY
|
||||
signatures need to persist longer than signatures on other records;
|
||||
e.g., when the private component of the KSK is kept offline and the
|
||||
KSK signature is to be refreshed manually.
|
||||
|
||||
As with ``end-time``, an absolute time is indicated in
|
||||
As with ``start-time``, an absolute time is indicated in
|
||||
YYYYMMDDHHMMSS notation. A time relative to the start time is
|
||||
indicated with ``+N``, which is N seconds from the start time. A time
|
||||
relative to the current time is indicated with ``now+N``. If no
|
||||
indicated with +N, which is N seconds from the start time. A time
|
||||
relative to the current time is indicated with now+N. If no
|
||||
``extended end-time`` is specified, the value of ``end-time`` is used
|
||||
as the default. (``end-time``, in turn, defaults to 30 days from the
|
||||
start time.) ``extended end-time`` must be later than ``start-time``.
|
||||
|
||||
``-f output-file``
|
||||
This option indicates the name of the output file containing the signed zone. The default
|
||||
**-f** output-file
|
||||
The name of the output file containing the signed zone. The default
|
||||
is to append ``.signed`` to the input filename. If ``output-file`` is
|
||||
set to ``-``, then the signed zone is written to the standard
|
||||
output, with a default output format of ``full``.
|
||||
set to ``"-"``, then the signed zone is written to the standard
|
||||
output, with a default output format of "full".
|
||||
|
||||
``-h``
|
||||
This option prints a short summary of the options and arguments to
|
||||
**-h**
|
||||
Prints a short summary of the options and arguments to
|
||||
``dnssec-signzone``.
|
||||
|
||||
``-V``
|
||||
This option prints version information.
|
||||
**-V**
|
||||
Prints version information.
|
||||
|
||||
``-i interval``
|
||||
This option indicates that, when a previously signed zone is passed as input, records may be
|
||||
re-signed. The ``interval`` option specifies the cycle interval as an
|
||||
offset from the current time, in seconds. If a RRSIG record expires
|
||||
after the cycle interval, it is retained; otherwise, it is considered
|
||||
to be expiring soon and it is replaced.
|
||||
**-i** interval
|
||||
When a previously-signed zone is passed as input, records may be
|
||||
resigned. The ``interval`` option specifies the cycle interval as an
|
||||
offset from the current time (in seconds). If a RRSIG record expires
|
||||
after the cycle interval, it is retained. Otherwise, it is considered
|
||||
to be expiring soon, and it will be replaced.
|
||||
|
||||
The default cycle interval is one quarter of the difference between
|
||||
the signature end and start times. So if neither ``end-time`` nor
|
||||
``start-time`` is specified, ``dnssec-signzone`` generates
|
||||
the signature end and start times. So if neither ``end-time`` or
|
||||
``start-time`` are specified, ``dnssec-signzone`` generates
|
||||
signatures that are valid for 30 days, with a cycle interval of 7.5
|
||||
days. Therefore, if any existing RRSIG records are due to expire in
|
||||
less than 7.5 days, they are replaced.
|
||||
less than 7.5 days, they would be replaced.
|
||||
|
||||
``-I input-format``
|
||||
This option sets the format of the input zone file. Possible formats are ``text``
|
||||
(the default), ``raw``, and ``map``. This option is primarily
|
||||
intended to be used for dynamic signed zones, so that the dumped zone
|
||||
**-I** input-format
|
||||
The format of the input zone file. Possible formats are ``"text"``
|
||||
(default), ``"raw"``, and ``"map"``. This option is primarily
|
||||
intended to be used for dynamic signed zones so that the dumped zone
|
||||
file in a non-text format containing updates can be signed directly.
|
||||
This option is not useful for non-dynamic zones.
|
||||
The use of this option does not make much sense for non-dynamic
|
||||
zones.
|
||||
|
||||
``-j jitter``
|
||||
**-j** jitter
|
||||
When signing a zone with a fixed signature lifetime, all RRSIG
|
||||
records issued at the time of signing expire simultaneously. If the
|
||||
zone is incrementally signed, i.e., a previously signed zone is passed
|
||||
as input to the signer, all expired signatures must be regenerated
|
||||
at approximately the same time. The ``jitter`` option specifies a jitter
|
||||
window that is used to randomize the signature expire time, thus
|
||||
records issued at the time of signing expires simultaneously. If the
|
||||
zone is incrementally signed, i.e. a previously-signed zone is passed
|
||||
as input to the signer, all expired signatures have to be regenerated
|
||||
at about the same time. The ``jitter`` option specifies a jitter
|
||||
window that will be used to randomize the signature expire time, thus
|
||||
spreading incremental signature regeneration over time.
|
||||
|
||||
Signature lifetime jitter also, to some extent, benefits validators and
|
||||
servers by spreading out cache expiration, i.e., if large numbers of
|
||||
RRSIGs do not expire at the same time from all caches, there is
|
||||
less congestion than if all validators need to refetch at around the
|
||||
Signature lifetime jitter also to some extent benefits validators and
|
||||
servers by spreading out cache expiration, i.e. if large numbers of
|
||||
RRSIGs don't expire at the same time from all caches there will be
|
||||
less congestion than if all validators need to refetch at mostly the
|
||||
same time.
|
||||
|
||||
``-L serial``
|
||||
When writing a signed zone to "raw" or "map" format, this option sets the "source
|
||||
serial" value in the header to the specified ``serial`` number. (This is
|
||||
**-L** serial
|
||||
When writing a signed zone to "raw" or "map" format, set the "source
|
||||
serial" value in the header to the specified serial number. (This is
|
||||
expected to be used primarily for testing purposes.)
|
||||
|
||||
``-n ncpus``
|
||||
This option specifies the number of threads to use. By default, one thread is
|
||||
**-n** ncpus
|
||||
Specifies the number of threads to use. By default, one thread is
|
||||
started for each detected CPU.
|
||||
|
||||
``-N soa-serial-format``
|
||||
This option sets the SOA serial number format of the signed zone. Possible formats are
|
||||
``keep`` (the default), ``increment``, ``unixtime``, and
|
||||
``date``.
|
||||
**-N** soa-serial-format
|
||||
The SOA serial number format of the signed zone. Possible formats are
|
||||
``"keep"`` (default), ``"increment"``, ``"unixtime"``, and
|
||||
``"date"``.
|
||||
|
||||
**keep**
|
||||
This format indicates that the SOA serial number should not be modified.
|
||||
``"keep"``
|
||||
Do not modify the SOA serial number.
|
||||
|
||||
**increment**
|
||||
This format increments the SOA serial number using :rfc:`1982` arithmetic.
|
||||
``"increment"``
|
||||
Increment the SOA serial number using :rfc:`1982` arithmetic.
|
||||
|
||||
**unixtime**
|
||||
This format sets the SOA serial number to the number of seconds
|
||||
since the beginning of the Unix epoch, unless the serial
|
||||
number is already greater than or equal to that value, in
|
||||
which case it is simply incremented by one.
|
||||
``"unixtime"``
|
||||
Set the SOA serial number to the number of seconds since epoch.
|
||||
|
||||
**date**
|
||||
This format sets the SOA serial number to today's date, in
|
||||
YYYYMMDDNN format, unless the serial number is already greater
|
||||
than or equal to that value, in which case it is simply
|
||||
incremented by one.
|
||||
``"date"``
|
||||
Set the SOA serial number to today's date in YYYYMMDDNN format.
|
||||
|
||||
``-o origin``
|
||||
This option sets the zone origin. If not specified, the name of the zone file is
|
||||
**-o** origin
|
||||
The zone origin. If not specified, the name of the zone file is
|
||||
assumed to be the origin.
|
||||
|
||||
``-O output-format``
|
||||
This option sets the format of the output file containing the signed zone. Possible
|
||||
formats are ``text`` (the default), which is the standard textual
|
||||
representation of the zone; ``full``, which is text output in a
|
||||
format suitable for processing by external scripts; and ``map``,
|
||||
``raw``, and ``raw=N``, which store the zone in binary formats
|
||||
for rapid loading by ``named``. ``raw=N`` specifies the format
|
||||
**-O** output-format
|
||||
The format of the output file containing the signed zone. Possible
|
||||
formats are ``"text"`` (default), which is the standard textual
|
||||
representation of the zone; ``"full"``, which is text output in a
|
||||
format suitable for processing by external scripts; and ``"map"``,
|
||||
``"raw"``, and ``"raw=N"``, which store the zone in binary formats
|
||||
for rapid loading by ``named``. ``"raw=N"`` specifies the format
|
||||
version of the raw zone file: if N is 0, the raw file can be read by
|
||||
any version of ``named``; if N is 1, the file can be read by release
|
||||
9.9.0 or higher. The default is 1.
|
||||
9.9.0 or higher; the default is 1.
|
||||
|
||||
``-P``
|
||||
This option disables post-sign verification tests.
|
||||
**-P**
|
||||
Disable post sign verification tests.
|
||||
|
||||
The post-sign verification tests ensure that for each algorithm in
|
||||
use there is at least one non-revoked self-signed KSK key, that all
|
||||
revoked KSK keys are self-signed, and that all records in the zone
|
||||
The post sign verification test ensures that for each algorithm in
|
||||
use there is at least one non revoked self signed KSK key, that all
|
||||
revoked KSK keys are self signed, and that all records in the zone
|
||||
are signed by the algorithm. This option skips these tests.
|
||||
|
||||
``-Q``
|
||||
This option removes signatures from keys that are no longer active.
|
||||
**-Q**
|
||||
Remove signatures from keys that are no longer active.
|
||||
|
||||
Normally, when a previously signed zone is passed as input to the
|
||||
Normally, when a previously-signed zone is passed as input to the
|
||||
signer, and a DNSKEY record has been removed and replaced with a new
|
||||
one, signatures from the old key that are still within their validity
|
||||
period are retained. This allows the zone to continue to validate
|
||||
with cached copies of the old DNSKEY RRset. The ``-Q`` option forces
|
||||
with cached copies of the old DNSKEY RRset. The ``-Q`` forces
|
||||
``dnssec-signzone`` to remove signatures from keys that are no longer
|
||||
active. This enables ZSK rollover using the procedure described in
|
||||
:rfc:`4641#4.2.1.1` ("Pre-Publish Key Rollover").
|
||||
|
||||
``-q``
|
||||
This option enables quiet mode, which suppresses unnecessary output. Without this option, when
|
||||
``dnssec-signzone`` is run it prints three pieces of information to standard output: the number of
|
||||
keys in use; the algorithms used to verify the zone was signed correctly and
|
||||
other status information; and the filename containing the signed
|
||||
zone. With the option that output is suppressed, leaving only the filename.
|
||||
Quiet mode: Suppresses unnecessary output. Without this option, when
|
||||
``dnssec-signzone`` is run it will print to standard output the number of
|
||||
keys in use, the algorithms used to verify the zone was signed correctly and
|
||||
other status information, and finally the filename containing the signed
|
||||
zone. With it, that output is suppressed, leaving only the filename.
|
||||
|
||||
``-R``
|
||||
This option removes signatures from keys that are no longer published.
|
||||
**-R**
|
||||
Remove signatures from keys that are no longer published.
|
||||
|
||||
This option is similar to ``-Q``, except it forces
|
||||
``dnssec-signzone`` to remove signatures from keys that are no longer
|
||||
``dnssec-signzone`` to signatures from keys that are no longer
|
||||
published. This enables ZSK rollover using the procedure described in
|
||||
:rfc:`4641#4.2.1.2` ("Double Signature Zone Signing Key
|
||||
Rollover").
|
||||
|
||||
``-S``
|
||||
This option enables smart signing, which instructs ``dnssec-signzone`` to search the key
|
||||
**-S**
|
||||
Smart signing: Instructs ``dnssec-signzone`` to search the key
|
||||
repository for keys that match the zone being signed, and to include
|
||||
them in the zone if appropriate.
|
||||
|
||||
@@ -279,94 +274,94 @@ Options
|
||||
If the key's publication date is set and is in the past, the key
|
||||
is published in the zone.
|
||||
|
||||
If the key's activation date is set and is in the past, the key is
|
||||
If the key's activation date is set and in the past, the key is
|
||||
published (regardless of publication date) and used to sign the
|
||||
zone.
|
||||
|
||||
If the key's revocation date is set and is in the past, and the key
|
||||
If the key's revocation date is set and in the past, and the key
|
||||
is published, then the key is revoked, and the revoked key is used
|
||||
to sign the zone.
|
||||
|
||||
If either the key's unpublication or deletion date is set and
|
||||
If either of the key's unpublication or deletion dates are set and
|
||||
in the past, the key is NOT published or used to sign the zone,
|
||||
regardless of any other metadata.
|
||||
|
||||
If the key's sync publication date is set and is in the past,
|
||||
If key's sync publication date is set and in the past,
|
||||
synchronization records (type CDS and/or CDNSKEY) are created.
|
||||
|
||||
If the key's sync deletion date is set and is in the past,
|
||||
If key's sync deletion date is set and in the past,
|
||||
synchronization records (type CDS and/or CDNSKEY) are removed.
|
||||
|
||||
``-T ttl``
|
||||
This option specifies a TTL to be used for new DNSKEY records imported into the
|
||||
**-T** ttl
|
||||
Specifies a TTL to be used for new DNSKEY records imported into the
|
||||
zone from the key repository. If not specified, the default is the
|
||||
TTL value from the zone's SOA record. This option is ignored when
|
||||
signing without ``-S``, since DNSKEY records are not imported from
|
||||
the key repository in that case. It is also ignored if there are any
|
||||
pre-existing DNSKEY records at the zone apex, in which case new
|
||||
records' TTL values are set to match them, or if any of the
|
||||
imported DNSKEY records had a default TTL value. In the event of a
|
||||
records' TTL values will be set to match them, or if any of the
|
||||
imported DNSKEY records had a default TTL value. In the event of a a
|
||||
conflict between TTL values in imported keys, the shortest one is
|
||||
used.
|
||||
|
||||
``-t``
|
||||
This option prints statistics at completion.
|
||||
**-t**
|
||||
Print statistics at completion.
|
||||
|
||||
``-u``
|
||||
This option updates the NSEC/NSEC3 chain when re-signing a previously signed zone.
|
||||
**-u**
|
||||
Update NSEC/NSEC3 chain when re-signing a previously signed zone.
|
||||
With this option, a zone signed with NSEC can be switched to NSEC3,
|
||||
or a zone signed with NSEC3 can be switched to NSEC or to NSEC3 with
|
||||
different parameters. Without this option, ``dnssec-signzone``
|
||||
retains the existing chain when re-signing.
|
||||
or a zone signed with NSEC3 can be switch to NSEC or to NSEC3 with
|
||||
different parameters. Without this option, ``dnssec-signzone`` will
|
||||
retain the existing chain when re-signing.
|
||||
|
||||
``-v level``
|
||||
This option sets the debugging level.
|
||||
**-v** level
|
||||
Sets the debugging level.
|
||||
|
||||
``-x``
|
||||
This option indicates that BIND 9 should only sign the DNSKEY, CDNSKEY, and CDS RRsets with key-signing keys,
|
||||
and should omit signatures from zone-signing keys. (This is similar to the
|
||||
**-x**
|
||||
Only sign the DNSKEY, CDNSKEY, and CDS RRsets with key-signing keys,
|
||||
and omit signatures from zone-signing keys. (This is similar to the
|
||||
``dnssec-dnskey-kskonly yes;`` zone option in ``named``.)
|
||||
|
||||
``-z``
|
||||
This option indicates that BIND 9 should ignore the KSK flag on keys when determining what to sign. This causes
|
||||
**-z**
|
||||
Ignore KSK flag on key when determining what to sign. This causes
|
||||
KSK-flagged keys to sign all records, not just the DNSKEY RRset.
|
||||
(This is similar to the ``update-check-ksk no;`` zone option in
|
||||
``named``.)
|
||||
|
||||
``-3 salt``
|
||||
This option generates an NSEC3 chain with the given hex-encoded salt. A dash
|
||||
(-) can be used to indicate that no salt is to be used when
|
||||
**-3** salt
|
||||
Generate an NSEC3 chain with the given hex encoded salt. A dash
|
||||
(salt) can be used to indicate that no salt is to be used when
|
||||
generating the NSEC3 chain.
|
||||
|
||||
``-H iterations``
|
||||
This option indicates that, when generating an NSEC3 chain, BIND 9 should use this many iterations. The default
|
||||
**-H** iterations
|
||||
When generating an NSEC3 chain, use this many iterations. The default
|
||||
is 10.
|
||||
|
||||
``-A``
|
||||
This option indicates that, when generating an NSEC3 chain, BIND 9 should set the OPTOUT flag on all NSEC3
|
||||
records and should not generate NSEC3 records for insecure delegations.
|
||||
**-A**
|
||||
When generating an NSEC3 chain set the OPTOUT flag on all NSEC3
|
||||
records and do not generate NSEC3 records for insecure delegations.
|
||||
|
||||
Using this option twice (i.e., ``-AA``) turns the OPTOUT flag off for
|
||||
all records. This is useful when using the ``-u`` option to modify an
|
||||
NSEC3 chain which previously had OPTOUT set.
|
||||
|
||||
``zonefile``
|
||||
This option sets the file containing the zone to be signed.
|
||||
**zonefile**
|
||||
The file containing the zone to be signed.
|
||||
|
||||
``key``
|
||||
This option specifies which keys should be used to sign the zone. If no keys are
|
||||
specified, the zone is examined for DNSKEY records at the
|
||||
zone apex. If these records are found and there are matching private keys in
|
||||
the current directory, they are used for signing.
|
||||
**key**
|
||||
Specify which keys should be used to sign the zone. If no keys are
|
||||
specified, then the zone will be examined for DNSKEY records at the
|
||||
zone apex. If these are found and there are matching private keys, in
|
||||
the current directory, then these will be used for signing.
|
||||
|
||||
Example
|
||||
~~~~~~~
|
||||
|
||||
The following command signs the ``example.com`` zone with the
|
||||
ECDSAP256SHA256 key generated by ``dnssec-keygen``
|
||||
ECDSAP256SHA256 key generated by key generated by ``dnssec-keygen``
|
||||
(Kexample.com.+013+17247). Because the ``-S`` option is not being used,
|
||||
the zone's keys must be in the master file (``db.example.com``). This
|
||||
invocation looks for ``dsset`` files in the current directory, so that
|
||||
invocation looks for ``dsset`` files, in the current directory, so that
|
||||
DS records can be imported from them (``-g``).
|
||||
|
||||
::
|
||||
@@ -378,7 +373,7 @@ DS records can be imported from them (``-g``).
|
||||
|
||||
In the above example, ``dnssec-signzone`` creates the file
|
||||
``db.example.com.signed``. This file should be referenced in a zone
|
||||
statement in the ``named.conf`` file.
|
||||
statement in a ``named.conf`` file.
|
||||
|
||||
This example re-signs a previously signed zone with default parameters.
|
||||
The private keys are assumed to be in the current directory.
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
@@ -82,13 +82,10 @@ static bool keyset_kskonly = false;
|
||||
static void
|
||||
report(const char *format, ...) {
|
||||
if (!quiet) {
|
||||
char buf[4096];
|
||||
va_list args;
|
||||
|
||||
va_start(args, format);
|
||||
vsnprintf(buf, sizeof(buf), format, args);
|
||||
vfprintf(stdout, format, args);
|
||||
va_end(args);
|
||||
fprintf(stdout, "%s\n", buf);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
|
||||
This Source Code Form is subject to the terms of the Mozilla Public
|
||||
License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
|
||||
See the COPYRIGHT file distributed with this work for additional
|
||||
information regarding copyright ownership.
|
||||
@@ -35,72 +35,72 @@ Description
|
||||
~~~~~~~~~~~
|
||||
|
||||
``dnssec-verify`` verifies that a zone is fully signed for each
|
||||
algorithm found in the DNSKEY RRset for the zone, and that the
|
||||
NSEC/NSEC3 chains are complete.
|
||||
algorithm found in the DNSKEY RRset for the zone, and that the NSEC /
|
||||
NSEC3 chains are complete.
|
||||
|
||||
Options
|
||||
~~~~~~~
|
||||
|
||||
``-c class``
|
||||
This option specifies the DNS class of the zone.
|
||||
**-c** class
|
||||
Specifies the DNS class of the zone.
|
||||
|
||||
``-E engine``
|
||||
This option specifies the cryptographic hardware to use, when applicable.
|
||||
**-E** engine
|
||||
Specifies the cryptographic hardware to use, when applicable.
|
||||
|
||||
When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
|
||||
engine identifier that drives the cryptographic accelerator or
|
||||
hardware service module (usually ``pkcs11``). When BIND is
|
||||
built with native PKCS#11 cryptography (``--enable-native-pkcs11``), it
|
||||
When BIND is built with OpenSSL PKCS#11 support, this defaults to the
|
||||
string "pkcs11", which identifies an OpenSSL engine that can drive a
|
||||
cryptographic accelerator or hardware service module. When BIND is
|
||||
built with native PKCS#11 cryptography (--enable-native-pkcs11), it
|
||||
defaults to the path of the PKCS#11 provider library specified via
|
||||
``--with-pkcs11``.
|
||||
"--with-pkcs11".
|
||||
|
||||
``-I input-format``
|
||||
This option sets the format of the input zone file. Possible formats are ``text``
|
||||
(the default) and ``raw``. This option is primarily intended to be used
|
||||
for dynamic signed zones, so that the dumped zone file in a non-text
|
||||
format containing updates can be verified independently.
|
||||
This option is not useful for non-dynamic zones.
|
||||
**-I** input-format
|
||||
The format of the input zone file. Possible formats are ``"text"``
|
||||
(default) and ``"raw"``. This option is primarily intended to be used
|
||||
for dynamic signed zones so that the dumped zone file in a non-text
|
||||
format containing updates can be verified independently. The use of
|
||||
this option does not make much sense for non-dynamic zones.
|
||||
|
||||
``-o origin``
|
||||
This option indicates the zone origin. If not specified, the name of the zone file is
|
||||
**-o** origin
|
||||
The zone origin. If not specified, the name of the zone file is
|
||||
assumed to be the origin.
|
||||
|
||||
``-v level``
|
||||
This option sets the debugging level.
|
||||
**-v** level
|
||||
Sets the debugging level.
|
||||
|
||||
``-V``
|
||||
This option prints version information.
|
||||
**-V**
|
||||
Prints version information.
|
||||
|
||||
``-q``
|
||||
This option sets quiet mode, which suppresses output. Without this option, when ``dnssec-verify``
|
||||
is run it prints to standard output the number of keys in use, the
|
||||
algorithms used to verify the zone was signed correctly, and other status
|
||||
information. With this option, all non-error output is suppressed, and only the exit
|
||||
code indicates success.
|
||||
Quiet mode: Suppresses output. Without this option, when ``dnssec-verify``
|
||||
is run it will print to standard output the number of keys in use, the
|
||||
algorithms used to verify the zone was signed correctly and other status
|
||||
information. With it, all non-error output is suppressed, and only the exit
|
||||
code will indicate success.
|
||||
|
||||
``-x``
|
||||
This option verifies only that the DNSKEY RRset is signed with key-signing keys.
|
||||
Without this flag, it is assumed that the DNSKEY RRset is signed
|
||||
by all active keys. When this flag is set, it is not an error if
|
||||
**-x**
|
||||
Only verify that the DNSKEY RRset is signed with key-signing keys.
|
||||
Without this flag, it is assumed that the DNSKEY RRset will be signed
|
||||
by all active keys. When this flag is set, it will not be an error if
|
||||
the DNSKEY RRset is not signed by zone-signing keys. This corresponds
|
||||
to the ``-x`` option in ``dnssec-signzone``.
|
||||
|
||||
``-z``
|
||||
This option indicates that the KSK flag on the keys should be ignored when determining whether the zone is
|
||||
correctly signed. Without this flag, it is assumed that there is
|
||||
**-z**
|
||||
Ignore the KSK flag on the keys when determining whether the zone if
|
||||
correctly signed. Without this flag it is assumed that there will be
|
||||
a non-revoked, self-signed DNSKEY with the KSK flag set for each
|
||||
algorithm, and that RRsets other than DNSKEY RRset are signed with
|
||||
algorithm and that RRsets other than DNSKEY RRset will be signed with
|
||||
a different DNSKEY without the KSK flag set.
|
||||
|
||||
With this flag set, BIND 9 only requires that for each algorithm, there
|
||||
be at least one non-revoked, self-signed DNSKEY, regardless of
|
||||
the KSK flag state, and that other RRsets be signed by a
|
||||
With this flag set, we only require that for each algorithm, there
|
||||
will be at least one non-revoked, self-signed DNSKEY, regardless of
|
||||
the KSK flag state, and that other RRsets will be signed by a
|
||||
non-revoked key for the same algorithm that includes the self-signed
|
||||
key; the same key may be used for both purposes. This corresponds to
|
||||
the ``-z`` option in ``dnssec-signzone``.
|
||||
|
||||
``zonefile``
|
||||
This option indicates the file containing the zone to be signed.
|
||||
**zonefile**
|
||||
The file containing the zone to be signed.
|
||||
|
||||
See Also
|
||||
~~~~~~~~
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
@@ -43,12 +43,8 @@ extern uint8_t dtype[8];
|
||||
|
||||
typedef void(fatalcallback_t)(void);
|
||||
|
||||
#ifndef CPPCHECK
|
||||
ISC_NORETURN void
|
||||
fatal(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);
|
||||
#else /* CPPCHECK */
|
||||
#define fatal(...) exit(1)
|
||||
#endif
|
||||
|
||||
void
|
||||
setfatalcallback(fatalcallback_t *callback);
|
||||
|
||||
@@ -77,7 +77,7 @@
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
|
||||
@@ -109,7 +109,7 @@
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
|
||||
<AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemGroup>
|
||||
|
||||
@@ -77,7 +77,7 @@
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
</Link>
|
||||
@IF PYTHON
|
||||
<PostBuildEvent>
|
||||
@@ -122,7 +122,7 @@ set PYTHONPATH=.
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
|
||||
<AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
</Link>
|
||||
@IF PYTHON
|
||||
<PostBuildEvent>
|
||||
|
||||
@@ -77,7 +77,7 @@
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
|
||||
@@ -109,7 +109,7 @@
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
|
||||
<AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemGroup>
|
||||
|
||||
@@ -77,7 +77,7 @@
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
|
||||
@@ -109,7 +109,7 @@
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
|
||||
<AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemGroup>
|
||||
|
||||
@@ -76,7 +76,7 @@
|
||||
<SubSystem>Console</SubSystem>
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dnssectool.lib;libisc.lib;libisccfg.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libisccfg.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
@@ -108,7 +108,7 @@
|
||||
<OptimizeReferences>true</OptimizeReferences>
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dnssectool.lib;libisc.lib;libisccfg.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libisccfg.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
|
||||
@@ -77,7 +77,7 @@
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
|
||||
@@ -109,7 +109,7 @@
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
|
||||
<AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemGroup>
|
||||
|
||||
@@ -76,7 +76,7 @@
|
||||
<SubSystem>Console</SubSystem>
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
@@ -108,7 +108,7 @@
|
||||
<OptimizeReferences>true</OptimizeReferences>
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
|
||||
@@ -77,7 +77,7 @@
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
|
||||
@@ -109,7 +109,7 @@
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
|
||||
<AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemGroup>
|
||||
|
||||
@@ -76,7 +76,7 @@
|
||||
<SubSystem>Console</SubSystem>
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
@@ -108,7 +108,7 @@
|
||||
<OptimizeReferences>true</OptimizeReferences>
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
|
||||
@@ -9,12 +9,12 @@ AM_CPPFLAGS += \
|
||||
$(LIBISCCC_CFLAGS) \
|
||||
$(LIBISCCFG_CFLAGS) \
|
||||
$(LIBBIND9_CFLAGS) \
|
||||
$(LIBLTDL_CFLAGS) \
|
||||
$(OPENSSL_CFLAGS) \
|
||||
$(LIBCAP_CFLAGS) \
|
||||
$(LMDB_CFLAGS) \
|
||||
$(MAXMINDDB_CFLAGS) \
|
||||
$(DNSTAP_CFLAGS) \
|
||||
$(LIBUV_CFLAGS) \
|
||||
$(ZLIB_CFLAGS)
|
||||
|
||||
if HAVE_JSON_C
|
||||
@@ -59,7 +59,6 @@ named_SOURCES = \
|
||||
server.c \
|
||||
statschannel.c \
|
||||
tkeyconf.c \
|
||||
transportconf.c \
|
||||
tsigconf.c \
|
||||
zoneconf.c \
|
||||
unix/dlz_dlopen_driver.c \
|
||||
@@ -78,7 +77,6 @@ named_SOURCES = \
|
||||
include/named/smf_globals.h \
|
||||
include/named/statschannel.h \
|
||||
include/named/tkeyconf.h \
|
||||
include/named/transportconf.h \
|
||||
include/named/tsigconf.h \
|
||||
include/named/types.h \
|
||||
include/named/zoneconf.h \
|
||||
@@ -104,7 +102,6 @@ named_LDADD = \
|
||||
$(LMDB_LIBS) \
|
||||
$(MAXMINDDB_LIBS) \
|
||||
$(DNSTAP_LIBS) \
|
||||
$(LIBUV_LIBS) \
|
||||
$(LIBXML2_LIBS) \
|
||||
$(ZLIB_LIBS)
|
||||
|
||||
|
||||
+1
-1
@@ -4,7 +4,7 @@
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
- file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
- file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
-
|
||||
- See the COPYRIGHT file distributed with this work for additional
|
||||
- information regarding copyright ownership.
|
||||
|
||||
+26
-89
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
@@ -33,21 +33,17 @@
|
||||
typedef struct builtin builtin_t;
|
||||
|
||||
static isc_result_t
|
||||
do_authors_lookup(dns_sdblookup_t *lookup);
|
||||
static isc_result_t
|
||||
do_dns64_lookup(dns_sdblookup_t *lookup);
|
||||
static isc_result_t
|
||||
do_empty_lookup(dns_sdblookup_t *lookup);
|
||||
do_version_lookup(dns_sdblookup_t *lookup);
|
||||
static isc_result_t
|
||||
do_hostname_lookup(dns_sdblookup_t *lookup);
|
||||
static isc_result_t
|
||||
do_authors_lookup(dns_sdblookup_t *lookup);
|
||||
static isc_result_t
|
||||
do_id_lookup(dns_sdblookup_t *lookup);
|
||||
static isc_result_t
|
||||
do_ipv4only_lookup(dns_sdblookup_t *lookup);
|
||||
do_empty_lookup(dns_sdblookup_t *lookup);
|
||||
static isc_result_t
|
||||
do_ipv4reverse_lookup(dns_sdblookup_t *lookup);
|
||||
static isc_result_t
|
||||
do_version_lookup(dns_sdblookup_t *lookup);
|
||||
do_dns64_lookup(dns_sdblookup_t *lookup);
|
||||
|
||||
/*
|
||||
* We can't use function pointers as the db_data directly
|
||||
@@ -61,14 +57,12 @@ struct builtin {
|
||||
char *contact;
|
||||
};
|
||||
|
||||
static builtin_t authors_builtin = { do_authors_lookup, NULL, NULL };
|
||||
static builtin_t dns64_builtin = { do_dns64_lookup, NULL, NULL };
|
||||
static builtin_t empty_builtin = { do_empty_lookup, NULL, NULL };
|
||||
static builtin_t hostname_builtin = { do_hostname_lookup, NULL, NULL };
|
||||
static builtin_t id_builtin = { do_id_lookup, NULL, NULL };
|
||||
static builtin_t ipv4only_builtin = { do_ipv4only_lookup, NULL, NULL };
|
||||
static builtin_t ipv4reverse_builtin = { do_ipv4reverse_lookup, NULL, NULL };
|
||||
static builtin_t version_builtin = { do_version_lookup, NULL, NULL };
|
||||
static builtin_t hostname_builtin = { do_hostname_lookup, NULL, NULL };
|
||||
static builtin_t authors_builtin = { do_authors_lookup, NULL, NULL };
|
||||
static builtin_t id_builtin = { do_id_lookup, NULL, NULL };
|
||||
static builtin_t empty_builtin = { do_empty_lookup, NULL, NULL };
|
||||
static builtin_t dns64_builtin = { do_dns64_lookup, NULL, NULL };
|
||||
|
||||
static dns_sdbimplementation_t *builtin_impl;
|
||||
static dns_sdbimplementation_t *dns64_impl;
|
||||
@@ -95,8 +89,7 @@ static const unsigned char hex16[256] = {
|
||||
1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1 /*F0*/
|
||||
};
|
||||
|
||||
static const unsigned char decimal[] = "0123456789";
|
||||
static const unsigned char ipv4only[] = "\010ipv4only\004arpa";
|
||||
const unsigned char decimal[] = "0123456789";
|
||||
|
||||
static size_t
|
||||
dns64_rdata(unsigned char *v, size_t start, unsigned char *rdata) {
|
||||
@@ -296,16 +289,6 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name,
|
||||
*/
|
||||
return (ISC_R_NOTFOUND);
|
||||
}
|
||||
|
||||
/*
|
||||
* Reverse of 192.0.0.170 or 192.0.0.171 maps to ipv4only.arpa.
|
||||
*/
|
||||
if ((v[0] == 170 || v[0] == 171) && v[1] == 0 && v[2] == 0 &&
|
||||
v[3] == 192) {
|
||||
return (dns_sdb_putrdata(lookup, dns_rdatatype_ptr, 3600,
|
||||
ipv4only, sizeof(ipv4only)));
|
||||
}
|
||||
|
||||
return (dns_sdb_putrdata(lookup, dns_rdatatype_cname, 600, rdata,
|
||||
(unsigned int)len));
|
||||
}
|
||||
@@ -446,30 +429,6 @@ do_empty_lookup(dns_sdblookup_t *lookup) {
|
||||
return (ISC_R_SUCCESS);
|
||||
}
|
||||
|
||||
static isc_result_t
|
||||
do_ipv4only_lookup(dns_sdblookup_t *lookup) {
|
||||
isc_result_t result;
|
||||
unsigned char data[2][4] = { { 192, 0, 0, 170 }, { 192, 0, 0, 171 } };
|
||||
|
||||
for (int i = 0; i < 2; i++) {
|
||||
result = dns_sdb_putrdata(lookup, dns_rdatatype_a, 3600,
|
||||
data[i], 4);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
return (result);
|
||||
}
|
||||
}
|
||||
return (ISC_R_SUCCESS);
|
||||
}
|
||||
|
||||
static isc_result_t
|
||||
do_ipv4reverse_lookup(dns_sdblookup_t *lookup) {
|
||||
isc_result_t result;
|
||||
|
||||
result = dns_sdb_putrdata(lookup, dns_rdatatype_ptr, 3600, ipv4only,
|
||||
sizeof(ipv4only));
|
||||
return (result);
|
||||
}
|
||||
|
||||
static isc_result_t
|
||||
builtin_authority(const char *zone, void *dbdata, dns_sdblookup_t *lookup) {
|
||||
isc_result_t result;
|
||||
@@ -513,10 +472,7 @@ builtin_create(const char *zone, int argc, char **argv, void *driverdata,
|
||||
UNUSED(zone);
|
||||
UNUSED(driverdata);
|
||||
|
||||
if (strcmp(argv[0], "dns64") == 0 || strcmp(argv[0], "empty") == 0 ||
|
||||
strcmp(argv[0], "ipv4only") == 0 ||
|
||||
strcmp(argv[0], "ipv4reverse") == 0)
|
||||
{
|
||||
if (strcmp(argv[0], "empty") == 0 || strcmp(argv[0], "dns64") == 0) {
|
||||
if (argc != 3) {
|
||||
return (DNS_R_SYNTAX);
|
||||
}
|
||||
@@ -524,27 +480,19 @@ builtin_create(const char *zone, int argc, char **argv, void *driverdata,
|
||||
return (DNS_R_SYNTAX);
|
||||
}
|
||||
|
||||
if (strcmp(argv[0], "authors") == 0) {
|
||||
*dbdata = &authors_builtin;
|
||||
if (strcmp(argv[0], "version") == 0) {
|
||||
*dbdata = &version_builtin;
|
||||
} else if (strcmp(argv[0], "hostname") == 0) {
|
||||
*dbdata = &hostname_builtin;
|
||||
} else if (strcmp(argv[0], "authors") == 0) {
|
||||
*dbdata = &authors_builtin;
|
||||
} else if (strcmp(argv[0], "id") == 0) {
|
||||
*dbdata = &id_builtin;
|
||||
} else if (strcmp(argv[0], "version") == 0) {
|
||||
*dbdata = &version_builtin;
|
||||
} else if (strcmp(argv[0], "dns64") == 0 ||
|
||||
strcmp(argv[0], "empty") == 0 ||
|
||||
strcmp(argv[0], "ipv4only") == 0 ||
|
||||
strcmp(argv[0], "ipv4reverse") == 0)
|
||||
{
|
||||
} else if (strcmp(argv[0], "empty") == 0 ||
|
||||
strcmp(argv[0], "dns64") == 0) {
|
||||
builtin_t *empty;
|
||||
char *server;
|
||||
char *contact;
|
||||
|
||||
if (argc != 3) {
|
||||
return (DNS_R_SYNTAX);
|
||||
}
|
||||
|
||||
/*
|
||||
* We don't want built-in zones to fail. Fallback to
|
||||
* the static configuration if memory allocation fails.
|
||||
@@ -553,14 +501,10 @@ builtin_create(const char *zone, int argc, char **argv, void *driverdata,
|
||||
server = isc_mem_strdup(named_g_mctx, argv[1]);
|
||||
contact = isc_mem_strdup(named_g_mctx, argv[2]);
|
||||
if (empty == NULL || server == NULL || contact == NULL) {
|
||||
if (strcmp(argv[0], "dns64") == 0) {
|
||||
*dbdata = &dns64_builtin;
|
||||
} else if (strcmp(argv[0], "empty") == 0) {
|
||||
if (strcmp(argv[0], "empty") == 0) {
|
||||
*dbdata = &empty_builtin;
|
||||
} else if (strcmp(argv[0], "ipv4only") == 0) {
|
||||
*dbdata = &ipv4only_builtin;
|
||||
} else {
|
||||
*dbdata = &ipv4reverse_builtin;
|
||||
*dbdata = &dns64_builtin;
|
||||
}
|
||||
if (server != NULL) {
|
||||
isc_mem_free(named_g_mctx, server);
|
||||
@@ -573,17 +517,11 @@ builtin_create(const char *zone, int argc, char **argv, void *driverdata,
|
||||
sizeof(*empty));
|
||||
}
|
||||
} else {
|
||||
if (strcmp(argv[0], "dns64") == 0) {
|
||||
memmove(empty, &dns64_builtin,
|
||||
sizeof(empty_builtin));
|
||||
} else if (strcmp(argv[0], "empty") == 0) {
|
||||
if (strcmp(argv[0], "empty") == 0) {
|
||||
memmove(empty, &empty_builtin,
|
||||
sizeof(empty_builtin));
|
||||
} else if (strcmp(argv[0], "ipv4only") == 0) {
|
||||
memmove(empty, &ipv4only_builtin,
|
||||
sizeof(empty_builtin));
|
||||
} else {
|
||||
memmove(empty, &ipv4reverse_builtin,
|
||||
memmove(empty, &dns64_builtin,
|
||||
sizeof(empty_builtin));
|
||||
}
|
||||
empty->server = server;
|
||||
@@ -606,10 +544,9 @@ builtin_destroy(const char *zone, void *driverdata, void **dbdata) {
|
||||
/*
|
||||
* Don't free the static versions.
|
||||
*/
|
||||
if (*dbdata == &authors_builtin || *dbdata == &dns64_builtin ||
|
||||
*dbdata == &empty_builtin || *dbdata == &hostname_builtin ||
|
||||
*dbdata == &id_builtin || *dbdata == &ipv4only_builtin ||
|
||||
*dbdata == &ipv4reverse_builtin || *dbdata == &version_builtin)
|
||||
if (*dbdata == &version_builtin || *dbdata == &hostname_builtin ||
|
||||
*dbdata == &authors_builtin || *dbdata == &id_builtin ||
|
||||
*dbdata == &empty_builtin || *dbdata == &dns64_builtin)
|
||||
{
|
||||
return;
|
||||
}
|
||||
|
||||
+173
-200
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
@@ -59,7 +59,7 @@ options {\n\
|
||||
# directory <none>\n\
|
||||
dnssec-policy \"none\";\n\
|
||||
dump-file \"named_dump.db\";\n\
|
||||
edns-udp-size 1232;\n\
|
||||
edns-udp-size 4096;\n\
|
||||
# fake-iquery <obsolete>;\n"
|
||||
#ifndef WIN32
|
||||
" files unlimited;\n"
|
||||
@@ -83,7 +83,7 @@ options {\n\
|
||||
match-mapped-addresses no;\n\
|
||||
max-ixfr-ratio 100%;\n\
|
||||
max-rsa-exponent-size 0; /* no limit */\n\
|
||||
max-udp-size 1232;\n\
|
||||
max-udp-size 4096;\n\
|
||||
memstatistics-file \"named.memstats\";\n\
|
||||
# multiple-cnames <obsolete>;\n\
|
||||
# named-xfer <obsolete>;\n\
|
||||
@@ -93,9 +93,6 @@ options {\n\
|
||||
nta-recheck 300;\n\
|
||||
# pid-file \"" NAMED_LOCALSTATEDIR "/run/named/named.pid\"; \n\
|
||||
port 53;\n\
|
||||
tls-port 853;\n\
|
||||
http-port 80;\n\
|
||||
https-port 443;\n\
|
||||
prefetch 2 9;\n\
|
||||
recursing-file \"named.recursing\";\n\
|
||||
recursive-clients 1000;\n\
|
||||
@@ -123,8 +120,6 @@ options {\n\
|
||||
tcp-initial-timeout 300;\n\
|
||||
tcp-keepalive-timeout 300;\n\
|
||||
tcp-listen-queue 10;\n\
|
||||
tcp-receive-buffer 0;\n\
|
||||
tcp-send-buffer 0;\n\
|
||||
# tkey-dhkey <none>\n\
|
||||
# tkey-domain <none>\n\
|
||||
# tkey-gssapi-credential <none>\n\
|
||||
@@ -135,8 +130,7 @@ options {\n\
|
||||
# treat-cr-as-space <obsolete>;\n\
|
||||
trust-anchor-telemetry yes;\n\
|
||||
# use-id-pool <obsolete>;\n\
|
||||
udp-receive-buffer 0;\n\
|
||||
udp-send-buffer 0;\n\
|
||||
# use-ixfr <obsolete>;\n\
|
||||
\n\
|
||||
/* view */\n\
|
||||
allow-new-zones no;\n\
|
||||
@@ -146,6 +140,7 @@ options {\n\
|
||||
allow-recursion { localnets; localhost; };\n\
|
||||
allow-recursion-on { any; };\n\
|
||||
allow-update-forwarding {none;};\n\
|
||||
# allow-v6-synthesis <obsolete>;\n\
|
||||
auth-nxdomain false;\n\
|
||||
check-dup-records warn;\n\
|
||||
check-mx warn;\n\
|
||||
@@ -174,8 +169,8 @@ options {\n\
|
||||
max-clients-per-query 100;\n\
|
||||
max-ncache-ttl 10800; /* 3 hours */\n\
|
||||
max-recursion-depth 7;\n\
|
||||
max-recursion-queries 100;\n\
|
||||
max-stale-ttl 86400; /* 1 day */\n\
|
||||
max-recursion-queries 75;\n\
|
||||
max-stale-ttl 43200; /* 12 hours */\n\
|
||||
message-compression yes;\n\
|
||||
min-ncache-ttl 0; /* 0 hours */\n\
|
||||
min-cache-ttl 0; /* 0 seconds */\n\
|
||||
@@ -199,11 +194,8 @@ options {\n\
|
||||
root-key-sentinel yes;\n\
|
||||
servfail-ttl 1;\n\
|
||||
# sortlist <none>\n\
|
||||
stale-answer-client-timeout off;\n\
|
||||
stale-answer-enable false;\n\
|
||||
stale-answer-ttl 30; /* 30 seconds */\n\
|
||||
stale-cache-enable false;\n\
|
||||
stale-refresh-time 30; /* 30 seconds */\n\
|
||||
stale-answer-ttl 1; /* 1 second */\n\
|
||||
synth-from-dnssec no;\n\
|
||||
# topology <none>\n\
|
||||
transfer-format many-answers;\n\
|
||||
@@ -229,7 +221,7 @@ options {\n\
|
||||
dnssec-update-mode maintain;\n\
|
||||
# forward <none>\n\
|
||||
# forwarders <none>\n\
|
||||
# inline-signing no;\n\
|
||||
inline-signing no;\n\
|
||||
ixfr-from-differences false;\n\
|
||||
# maintain-ixfr-base <obsolete>;\n\
|
||||
# max-ixfr-log-size <obsolete>\n\
|
||||
@@ -310,7 +302,7 @@ view \"_bind\" chaos {\n\
|
||||
|
||||
"# END MANAGED KEYS\n\
|
||||
\n\
|
||||
primaries " DEFAULT_IANA_ROOT_ZONE_PRIMARIES " {\n\
|
||||
masters " DEFAULT_IANA_ROOT_ZONE_MASTERS " {\n\
|
||||
2001:500:84::b; # b.root-servers.net\n\
|
||||
2001:500:2f::f; # f.root-servers.net\n\
|
||||
2001:7fd::1; # k.root-servers.net\n\
|
||||
@@ -504,7 +496,7 @@ named_config_getiplist(const cfg_obj_t *config, const cfg_obj_t *list,
|
||||
} else if (defport != 0) {
|
||||
port = defport;
|
||||
} else {
|
||||
result = named_config_getport(config, "port", &port);
|
||||
result = named_config_getport(config, &port);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
return (result);
|
||||
}
|
||||
@@ -574,116 +566,37 @@ named_config_putiplist(isc_mem_t *mctx, isc_sockaddr_t **addrsp,
|
||||
}
|
||||
}
|
||||
|
||||
static isc_result_t
|
||||
getprimariesdef(const cfg_obj_t *cctx, const char *list, const char *name,
|
||||
const cfg_obj_t **ret) {
|
||||
isc_result_t
|
||||
named_config_getmastersdef(const cfg_obj_t *cctx, const char *name,
|
||||
const cfg_obj_t **ret) {
|
||||
isc_result_t result;
|
||||
const cfg_obj_t *obj = NULL;
|
||||
const cfg_obj_t *masters = NULL;
|
||||
const cfg_listelt_t *elt;
|
||||
|
||||
REQUIRE(cctx != NULL);
|
||||
REQUIRE(name != NULL);
|
||||
REQUIRE(ret != NULL && *ret == NULL);
|
||||
|
||||
result = cfg_map_get(cctx, list, &obj);
|
||||
result = cfg_map_get(cctx, "masters", &masters);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
return (result);
|
||||
}
|
||||
elt = cfg_list_first(obj);
|
||||
while (elt != NULL) {
|
||||
obj = cfg_listelt_value(elt);
|
||||
if (strcasecmp(cfg_obj_asstring(cfg_tuple_get(obj, "name")),
|
||||
name) == 0) {
|
||||
*ret = obj;
|
||||
for (elt = cfg_list_first(masters); elt != NULL;
|
||||
elt = cfg_list_next(elt)) {
|
||||
const cfg_obj_t *list;
|
||||
const char *listname;
|
||||
|
||||
list = cfg_listelt_value(elt);
|
||||
listname = cfg_obj_asstring(cfg_tuple_get(list, "name"));
|
||||
|
||||
if (strcasecmp(listname, name) == 0) {
|
||||
*ret = list;
|
||||
return (ISC_R_SUCCESS);
|
||||
}
|
||||
elt = cfg_list_next(elt);
|
||||
}
|
||||
return (ISC_R_NOTFOUND);
|
||||
}
|
||||
|
||||
isc_result_t
|
||||
named_config_getprimariesdef(const cfg_obj_t *cctx, const char *name,
|
||||
const cfg_obj_t **ret) {
|
||||
isc_result_t result;
|
||||
|
||||
result = getprimariesdef(cctx, "primaries", name, ret);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
result = getprimariesdef(cctx, "masters", name, ret);
|
||||
}
|
||||
return (result);
|
||||
}
|
||||
|
||||
static isc_result_t
|
||||
named_config_getname(isc_mem_t *mctx, const cfg_obj_t *obj,
|
||||
dns_name_t **namep) {
|
||||
REQUIRE(namep != NULL && *namep == NULL);
|
||||
|
||||
const char *objstr;
|
||||
isc_result_t result;
|
||||
isc_buffer_t b;
|
||||
dns_fixedname_t fname;
|
||||
|
||||
if (!cfg_obj_isstring(obj)) {
|
||||
*namep = NULL;
|
||||
return (ISC_R_SUCCESS);
|
||||
}
|
||||
|
||||
*namep = isc_mem_get(mctx, sizeof(**namep));
|
||||
dns_name_init(*namep, NULL);
|
||||
|
||||
objstr = cfg_obj_asstring(obj);
|
||||
isc_buffer_constinit(&b, objstr, strlen(objstr));
|
||||
isc_buffer_add(&b, strlen(objstr));
|
||||
dns_fixedname_init(&fname);
|
||||
result = dns_name_fromtext(dns_fixedname_name(&fname), &b, dns_rootname,
|
||||
0, NULL);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
isc_mem_put(mctx, *namep, sizeof(**namep));
|
||||
*namep = NULL;
|
||||
return (result);
|
||||
}
|
||||
dns_name_dup(dns_fixedname_name(&fname), mctx, *namep);
|
||||
|
||||
return (ISC_R_SUCCESS);
|
||||
}
|
||||
|
||||
#define grow_array(mctx, array, newlen, oldlen) \
|
||||
if (newlen >= oldlen) { \
|
||||
size_t newsize = (newlen + 16) * sizeof(array[0]); \
|
||||
size_t oldsize = oldlen * sizeof(array[0]); \
|
||||
void *tmp = isc_mem_get(mctx, newsize); \
|
||||
memset(tmp, 0, newsize); \
|
||||
if (oldlen != 0) { \
|
||||
memmove(tmp, array, oldsize); \
|
||||
isc_mem_put(mctx, array, oldsize); \
|
||||
} \
|
||||
array = tmp; \
|
||||
oldlen = newlen + 16; \
|
||||
}
|
||||
|
||||
#define shrink_array(mctx, array, newlen, oldlen) \
|
||||
if (newlen < oldlen) { \
|
||||
void *tmp = NULL; \
|
||||
size_t newsize = newlen * sizeof(array[0]); \
|
||||
size_t oldsize = oldlen * sizeof(array[0]); \
|
||||
if (newlen != 0) { \
|
||||
tmp = isc_mem_get(mctx, newsize); \
|
||||
memset(tmp, 0, newsize); \
|
||||
memmove(tmp, array, newsize); \
|
||||
} else { \
|
||||
tmp = NULL; \
|
||||
} \
|
||||
isc_mem_put(mctx, array, oldsize); \
|
||||
array = tmp; \
|
||||
oldlen = newlen; \
|
||||
}
|
||||
|
||||
isc_result_t
|
||||
named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
|
||||
isc_mem_t *mctx, dns_ipkeylist_t *ipkl) {
|
||||
uint32_t addrcount = 0, dscpcount = 0, keycount = 0, tlscount = 0,
|
||||
i = 0;
|
||||
uint32_t addrcount = 0, dscpcount = 0, keycount = 0, i = 0;
|
||||
uint32_t listcount = 0, l = 0, j;
|
||||
uint32_t stackcount = 0, pushed = 0;
|
||||
isc_result_t result;
|
||||
@@ -691,14 +604,12 @@ named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
|
||||
const cfg_obj_t *addrlist;
|
||||
const cfg_obj_t *portobj;
|
||||
const cfg_obj_t *dscpobj;
|
||||
in_port_t port = (in_port_t)0;
|
||||
in_port_t def_port;
|
||||
in_port_t def_tlsport;
|
||||
in_port_t port;
|
||||
isc_dscp_t dscp = -1;
|
||||
dns_fixedname_t fname;
|
||||
isc_sockaddr_t *addrs = NULL;
|
||||
isc_dscp_t *dscps = NULL;
|
||||
dns_name_t **keys = NULL;
|
||||
dns_name_t **tlss = NULL;
|
||||
struct {
|
||||
const char *name;
|
||||
} *lists = NULL;
|
||||
@@ -712,7 +623,6 @@ named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
|
||||
REQUIRE(ipkl->count == 0);
|
||||
REQUIRE(ipkl->addrs == NULL);
|
||||
REQUIRE(ipkl->keys == NULL);
|
||||
REQUIRE(ipkl->tlss == NULL);
|
||||
REQUIRE(ipkl->dscps == NULL);
|
||||
REQUIRE(ipkl->labels == NULL);
|
||||
REQUIRE(ipkl->allocated == 0);
|
||||
@@ -720,12 +630,7 @@ named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
|
||||
/*
|
||||
* Get system defaults.
|
||||
*/
|
||||
result = named_config_getport(config, "port", &def_port);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
result = named_config_getport(config, "tls-port", &def_tlsport);
|
||||
result = named_config_getport(config, &port);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
goto cleanup;
|
||||
}
|
||||
@@ -769,20 +674,33 @@ resume:
|
||||
for (; element != NULL; element = cfg_list_next(element)) {
|
||||
const cfg_obj_t *addr;
|
||||
const cfg_obj_t *key;
|
||||
const cfg_obj_t *tls;
|
||||
const char *keystr;
|
||||
isc_buffer_t b;
|
||||
|
||||
addr = cfg_tuple_get(cfg_listelt_value(element),
|
||||
"primarieselement");
|
||||
"masterselement");
|
||||
key = cfg_tuple_get(cfg_listelt_value(element), "key");
|
||||
tls = cfg_tuple_get(cfg_listelt_value(element), "tls");
|
||||
|
||||
if (!cfg_obj_issockaddr(addr)) {
|
||||
const char *listname = cfg_obj_asstring(addr);
|
||||
isc_result_t tresult;
|
||||
|
||||
/* Grow lists? */
|
||||
grow_array(mctx, lists, l, listcount);
|
||||
if (listcount == l) {
|
||||
void *tmp;
|
||||
uint32_t newlen = listcount + 16;
|
||||
size_t newsize, oldsize;
|
||||
|
||||
newsize = newlen * sizeof(*lists);
|
||||
oldsize = listcount * sizeof(*lists);
|
||||
tmp = isc_mem_get(mctx, newsize);
|
||||
if (listcount != 0) {
|
||||
memmove(tmp, lists, oldsize);
|
||||
isc_mem_put(mctx, lists, oldsize);
|
||||
}
|
||||
lists = tmp;
|
||||
listcount = newlen;
|
||||
}
|
||||
/* Seen? */
|
||||
for (j = 0; j < l; j++) {
|
||||
if (strcasecmp(lists[j].name, listname) == 0) {
|
||||
@@ -792,12 +710,11 @@ resume:
|
||||
if (j < l) {
|
||||
continue;
|
||||
}
|
||||
list = NULL;
|
||||
tresult = named_config_getprimariesdef(config, listname,
|
||||
&list);
|
||||
tresult = named_config_getmastersdef(config, listname,
|
||||
&list);
|
||||
if (tresult == ISC_R_NOTFOUND) {
|
||||
cfg_obj_log(addr, named_g_lctx, ISC_LOG_ERROR,
|
||||
"primaries \"%s\" not found",
|
||||
"masters \"%s\" not found",
|
||||
listname);
|
||||
|
||||
result = tresult;
|
||||
@@ -808,7 +725,21 @@ resume:
|
||||
}
|
||||
lists[l++].name = listname;
|
||||
/* Grow stack? */
|
||||
grow_array(mctx, stack, pushed, stackcount);
|
||||
if (stackcount == pushed) {
|
||||
void *tmp;
|
||||
uint32_t newlen = stackcount + 16;
|
||||
size_t newsize, oldsize;
|
||||
|
||||
newsize = newlen * sizeof(*stack);
|
||||
oldsize = stackcount * sizeof(*stack);
|
||||
tmp = isc_mem_get(mctx, newsize);
|
||||
if (stackcount != 0) {
|
||||
memmove(tmp, stack, oldsize);
|
||||
isc_mem_put(mctx, stack, oldsize);
|
||||
}
|
||||
stack = tmp;
|
||||
stackcount = newlen;
|
||||
}
|
||||
/*
|
||||
* We want to resume processing this list on the
|
||||
* next element.
|
||||
@@ -820,44 +751,68 @@ resume:
|
||||
goto newlist;
|
||||
}
|
||||
|
||||
grow_array(mctx, addrs, i, addrcount);
|
||||
grow_array(mctx, dscps, i, dscpcount);
|
||||
grow_array(mctx, keys, i, keycount);
|
||||
grow_array(mctx, tlss, i, tlscount);
|
||||
if (i == addrcount) {
|
||||
void *tmp;
|
||||
uint32_t newlen = addrcount + 16;
|
||||
size_t newsize, oldsize;
|
||||
|
||||
newsize = newlen * sizeof(isc_sockaddr_t);
|
||||
oldsize = addrcount * sizeof(isc_sockaddr_t);
|
||||
tmp = isc_mem_get(mctx, newsize);
|
||||
if (addrcount != 0) {
|
||||
memmove(tmp, addrs, oldsize);
|
||||
isc_mem_put(mctx, addrs, oldsize);
|
||||
}
|
||||
addrs = tmp;
|
||||
addrcount = newlen;
|
||||
|
||||
newsize = newlen * sizeof(isc_dscp_t);
|
||||
oldsize = dscpcount * sizeof(isc_dscp_t);
|
||||
tmp = isc_mem_get(mctx, newsize);
|
||||
if (dscpcount != 0) {
|
||||
memmove(tmp, dscps, oldsize);
|
||||
isc_mem_put(mctx, dscps, oldsize);
|
||||
}
|
||||
dscps = tmp;
|
||||
dscpcount = newlen;
|
||||
|
||||
newsize = newlen * sizeof(dns_name_t *);
|
||||
oldsize = keycount * sizeof(dns_name_t *);
|
||||
tmp = isc_mem_get(mctx, newsize);
|
||||
if (keycount != 0) {
|
||||
memmove(tmp, keys, oldsize);
|
||||
isc_mem_put(mctx, keys, oldsize);
|
||||
}
|
||||
keys = tmp;
|
||||
keycount = newlen;
|
||||
}
|
||||
|
||||
addrs[i] = *cfg_obj_assockaddr(addr);
|
||||
if (isc_sockaddr_getport(&addrs[i]) == 0) {
|
||||
isc_sockaddr_setport(&addrs[i], port);
|
||||
}
|
||||
dscps[i] = cfg_obj_getdscp(addr);
|
||||
if (dscps[i] == -1) {
|
||||
dscps[i] = dscp;
|
||||
}
|
||||
keys[i] = NULL;
|
||||
i++; /* Increment here so that cleanup on error works. */
|
||||
if (!cfg_obj_isstring(key)) {
|
||||
continue;
|
||||
}
|
||||
keys[i - 1] = isc_mem_get(mctx, sizeof(dns_name_t));
|
||||
dns_name_init(keys[i - 1], NULL);
|
||||
|
||||
result = named_config_getname(mctx, key, &keys[i]);
|
||||
keystr = cfg_obj_asstring(key);
|
||||
isc_buffer_constinit(&b, keystr, strlen(keystr));
|
||||
isc_buffer_add(&b, strlen(keystr));
|
||||
dns_fixedname_init(&fname);
|
||||
result = dns_name_fromtext(dns_fixedname_name(&fname), &b,
|
||||
dns_rootname, 0, NULL);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
i++; /* Increment here so that cleanup on error works.
|
||||
*/
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
result = named_config_getname(mctx, tls, &tlss[i]);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
i++; /* Increment here so that cleanup on error works.
|
||||
*/
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
/* Set the default port or tls-port */
|
||||
if (port == 0) {
|
||||
if (tlss[i] != NULL) {
|
||||
port = def_tlsport;
|
||||
} else {
|
||||
port = def_port;
|
||||
}
|
||||
}
|
||||
|
||||
if (isc_sockaddr_getport(&addrs[i]) == 0) {
|
||||
isc_sockaddr_setport(&addrs[i], port);
|
||||
}
|
||||
i++;
|
||||
dns_name_dup(dns_fixedname_name(&fname), mctx, keys[i - 1]);
|
||||
}
|
||||
if (pushed != 0) {
|
||||
pushed--;
|
||||
@@ -866,28 +821,61 @@ resume:
|
||||
dscp = stack[pushed].dscp;
|
||||
goto resume;
|
||||
}
|
||||
if (i < addrcount) {
|
||||
void *tmp;
|
||||
size_t newsize, oldsize;
|
||||
|
||||
shrink_array(mctx, addrs, i, addrcount);
|
||||
shrink_array(mctx, dscps, i, dscpcount);
|
||||
shrink_array(mctx, keys, i, keycount);
|
||||
shrink_array(mctx, tlss, i, tlscount);
|
||||
newsize = i * sizeof(isc_sockaddr_t);
|
||||
oldsize = addrcount * sizeof(isc_sockaddr_t);
|
||||
if (i != 0) {
|
||||
tmp = isc_mem_get(mctx, newsize);
|
||||
memmove(tmp, addrs, newsize);
|
||||
} else {
|
||||
tmp = NULL;
|
||||
}
|
||||
isc_mem_put(mctx, addrs, oldsize);
|
||||
addrs = tmp;
|
||||
addrcount = i;
|
||||
|
||||
newsize = i * sizeof(isc_dscp_t);
|
||||
oldsize = dscpcount * sizeof(isc_dscp_t);
|
||||
if (i != 0) {
|
||||
tmp = isc_mem_get(mctx, newsize);
|
||||
memmove(tmp, dscps, newsize);
|
||||
} else {
|
||||
tmp = NULL;
|
||||
}
|
||||
isc_mem_put(mctx, dscps, oldsize);
|
||||
dscps = tmp;
|
||||
dscpcount = i;
|
||||
|
||||
newsize = i * sizeof(dns_name_t *);
|
||||
oldsize = keycount * sizeof(dns_name_t *);
|
||||
if (i != 0) {
|
||||
tmp = isc_mem_get(mctx, newsize);
|
||||
memmove(tmp, keys, newsize);
|
||||
} else {
|
||||
tmp = NULL;
|
||||
}
|
||||
isc_mem_put(mctx, keys, oldsize);
|
||||
keys = tmp;
|
||||
keycount = i;
|
||||
}
|
||||
|
||||
if (lists != NULL) {
|
||||
isc_mem_put(mctx, lists, listcount * sizeof(lists[0]));
|
||||
isc_mem_put(mctx, lists, listcount * sizeof(*lists));
|
||||
}
|
||||
if (stack != NULL) {
|
||||
isc_mem_put(mctx, stack, stackcount * sizeof(stack[0]));
|
||||
isc_mem_put(mctx, stack, stackcount * sizeof(*stack));
|
||||
}
|
||||
|
||||
INSIST(dscpcount == addrcount);
|
||||
INSIST(keycount == addrcount);
|
||||
INSIST(tlscount == addrcount);
|
||||
INSIST(keycount == dscpcount);
|
||||
|
||||
ipkl->addrs = addrs;
|
||||
ipkl->dscps = dscps;
|
||||
ipkl->keys = keys;
|
||||
ipkl->tlss = tlss;
|
||||
ipkl->count = addrcount;
|
||||
ipkl->allocated = addrcount;
|
||||
|
||||
@@ -895,10 +883,10 @@ resume:
|
||||
|
||||
cleanup:
|
||||
if (addrs != NULL) {
|
||||
isc_mem_put(mctx, addrs, addrcount * sizeof(addrs[0]));
|
||||
isc_mem_put(mctx, addrs, addrcount * sizeof(isc_sockaddr_t));
|
||||
}
|
||||
if (dscps != NULL) {
|
||||
isc_mem_put(mctx, dscps, dscpcount * sizeof(dscps[0]));
|
||||
isc_mem_put(mctx, dscps, dscpcount * sizeof(isc_dscp_t));
|
||||
}
|
||||
if (keys != NULL) {
|
||||
for (j = 0; j < i; j++) {
|
||||
@@ -908,34 +896,21 @@ cleanup:
|
||||
if (dns_name_dynamic(keys[j])) {
|
||||
dns_name_free(keys[j], mctx);
|
||||
}
|
||||
isc_mem_put(mctx, keys[j], sizeof(*keys[j]));
|
||||
isc_mem_put(mctx, keys[j], sizeof(dns_name_t));
|
||||
}
|
||||
isc_mem_put(mctx, keys, keycount * sizeof(keys[0]));
|
||||
}
|
||||
if (tlss != NULL) {
|
||||
for (j = 0; j < i; j++) {
|
||||
if (tlss[j] == NULL) {
|
||||
continue;
|
||||
}
|
||||
if (dns_name_dynamic(tlss[j])) {
|
||||
dns_name_free(tlss[j], mctx);
|
||||
}
|
||||
isc_mem_put(mctx, tlss[j], sizeof(*tlss[j]));
|
||||
}
|
||||
isc_mem_put(mctx, tlss, tlscount * sizeof(tlss[0]));
|
||||
isc_mem_put(mctx, keys, keycount * sizeof(dns_name_t *));
|
||||
}
|
||||
if (lists != NULL) {
|
||||
isc_mem_put(mctx, lists, listcount * sizeof(lists[0]));
|
||||
isc_mem_put(mctx, lists, listcount * sizeof(*lists));
|
||||
}
|
||||
if (stack != NULL) {
|
||||
isc_mem_put(mctx, stack, stackcount * sizeof(stack[0]));
|
||||
isc_mem_put(mctx, stack, stackcount * sizeof(*stack));
|
||||
}
|
||||
return (result);
|
||||
}
|
||||
|
||||
isc_result_t
|
||||
named_config_getport(const cfg_obj_t *config, const char *type,
|
||||
in_port_t *portp) {
|
||||
named_config_getport(const cfg_obj_t *config, in_port_t *portp) {
|
||||
const cfg_obj_t *maps[3];
|
||||
const cfg_obj_t *options = NULL;
|
||||
const cfg_obj_t *portobj = NULL;
|
||||
@@ -950,7 +925,7 @@ named_config_getport(const cfg_obj_t *config, const char *type,
|
||||
maps[i++] = named_g_defaults;
|
||||
maps[i] = NULL;
|
||||
|
||||
result = named_config_get(maps, type, &portobj);
|
||||
result = named_config_get(maps, "port", &portobj);
|
||||
INSIST(result == ISC_R_SUCCESS);
|
||||
if (cfg_obj_asuint32(portobj) >= UINT16_MAX) {
|
||||
cfg_obj_log(portobj, named_g_lctx, ISC_LOG_ERROR,
|
||||
@@ -990,15 +965,13 @@ named_config_getdscp(const cfg_obj_t *config, isc_dscp_t *dscpp) {
|
||||
|
||||
struct keyalgorithms {
|
||||
const char *str;
|
||||
enum {
|
||||
hmacnone,
|
||||
hmacmd5,
|
||||
hmacsha1,
|
||||
hmacsha224,
|
||||
hmacsha256,
|
||||
hmacsha384,
|
||||
hmacsha512
|
||||
} hmac;
|
||||
enum { hmacnone,
|
||||
hmacmd5,
|
||||
hmacsha1,
|
||||
hmacsha224,
|
||||
hmacsha256,
|
||||
hmacsha384,
|
||||
hmacsha512 } hmac;
|
||||
unsigned int type;
|
||||
uint16_t size;
|
||||
} algorithms[] = { { "hmac-md5", hmacmd5, DST_ALG_HMACMD5, 128 },
|
||||
|
||||
+5
-5
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
@@ -183,7 +183,8 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
|
||||
/* Do not flush master files */
|
||||
named_server_flushonshutdown(named_g_server, false);
|
||||
named_os_shutdownmsg(cmdline, *text);
|
||||
result = ISC_R_SHUTTINGDOWN;
|
||||
isc_app_shutdown();
|
||||
result = ISC_R_SUCCESS;
|
||||
} else if (command_compare(command, NAMED_COMMAND_STOP)) {
|
||||
/*
|
||||
* "stop" is the same as "halt" except it does
|
||||
@@ -200,15 +201,14 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
|
||||
#endif /* ifdef HAVE_LIBSCF */
|
||||
named_server_flushonshutdown(named_g_server, true);
|
||||
named_os_shutdownmsg(cmdline, *text);
|
||||
result = ISC_R_SHUTTINGDOWN;
|
||||
isc_app_shutdown();
|
||||
result = ISC_R_SUCCESS;
|
||||
} else if (command_compare(command, NAMED_COMMAND_ADDZONE) ||
|
||||
command_compare(command, NAMED_COMMAND_MODZONE))
|
||||
{
|
||||
result = named_server_changezone(named_g_server, cmdline, text);
|
||||
} else if (command_compare(command, NAMED_COMMAND_DELZONE)) {
|
||||
result = named_server_delzone(named_g_server, lex, text);
|
||||
} else if (command_compare(command, NAMED_COMMAND_DNSSEC)) {
|
||||
result = named_server_dnssec(named_g_server, lex, text);
|
||||
} else if (command_compare(command, NAMED_COMMAND_DNSTAP) ||
|
||||
command_compare(command, NAMED_COMMAND_DNSTAPREOPEN))
|
||||
{
|
||||
|
||||
+525
-477
File diff suppressed because it is too large
Load Diff
+1
-1
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user